Scaleable input gradient regularization for adversarial robustness

1 INTRODUCTION . Neural networks are vulnerable to adversarial attacks . These are small ( imperceptible to the human eye ) perturbations of an image which cause a network to misclassify the image ( Biggio et al. , 2013 ; Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ) . The threat posed by adversarial attacks must be addressed before these methods can be deployed in error-sensitive and security-based applications ( Potember , 2017 ) . Building adversarially robust models is an optimization problem with two objectives : ( i ) maintain test accuracy on clean unperturbed images , and ( ii ) be robust to large adversarial perturbations . The present state-of-the-art method for adversarial defence , adversarial training ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Tramèr et al. , 2018 ; Madry et al. , 2017 ; Miyato et al. , 2018 ) , in which models are trained on perturbed images , offers robustness at the expense of test accuracy ( Tsipras et al. , 2018 ) . Up until the recent method of Shafahi et al . ( 2019b ) , multi-step adversarial training had taken many days to train on large datasets ( Kannan et al. , 2018 ; Xie et al. , 2018 ) . Assessing the empirical effectiveness of an adversarial defence requires careful testing with multiple attacks ( Goodfellow et al. , 2018 ) . Furthermore , existing defences are vulnerable to new , stronger attacks : Carlini & Wagner ( 2017a ) and Athalye et al . ( 2018 ) advocate designing specialized attacks to circumvent prior defences , while Uesato et al . ( 2018 ) warn against using weak attacks to evaluate robustness . This has led the community to develop theoretical tools to certify adversarial robustness . Several certification approaches have been proposed : through linear programming ( Wong & Kolter , 2018 ; Wong et al. , 2018 ) or mixed-integer linear-programming ( Xiao et al. , 2018 ) ; semi-definite relaxation ( Raghunathan et al. , 2018b ; a ) ; randomized smoothing ( Li et al. , 2018 ; Cohen et al. , 2019 ) ; or estimates of the local Lipschitz constant ( Hein & Andriushchenko , 2017 ; Weng et al. , 2018 ; Tsuzuku et al. , 2018 ) . The latter two approaches have scaled well to ImageNet-1k . Notably , randomized smoothing with adversarial training has shown great promise for rigorous certification against attacks in the ` 2 norm ( Salman et al. , 2019 ) , although it is not yet clear how randomized smoothing may be adapted to other norms . In practice , certifiably robust networks often perform worse than adversarially trained models , which in general lack theoretical guarantees . In this article , we work towards bridging the gap between theoretically robust networks and empirically effective training methods . Our approach relies on minimizing a loss regularized against large input gradients E ( x , y ) ∼P [ L ( f ( x ; w ) , y ) + λ 2 ‖∇x L ( f ( x ; w ) , y ) ‖2∗ ] where ‖ · ‖∗ is dual to the one measuring adversarial attacks ( for example the ` 1 norm for attacks measured in the ` ∞ norm ) . Heuristically , making loss gradients small should make gradient based attacks more challenging . Drucker & LeCun ( 1991 ) implemented gradient regularization using ‘ double backpropagation ’ , which has been shown to improve model generalization ( Novak et al. , 2018 ) . It has been used to improve the stability of GANs ( Roth et al. , 2017 ; Nagarajan & Kolter , 2017 ) and to promote learning robust features with contractive auto-encoders ( Rifai et al. , 2011 ) . While it has been proposed for adversarial attacks robustness ( Lyu et al. , 2015 ; Ross & Doshi-Velez , 2018 ; Roth et al. , 2018 ; Ororbia II et al. , 2017 ; Hein & Andriushchenko , 2017 ; Jakubovitz & Giryes , 2018 ; Simon-Gabriel et al. , 2018 ) , experimental evidence has been mixed , in particular , input gradient regularization has so far not been competitive with multi-step adversarial training . In particular , the heuristic that “ gradients should be small ” has motivated several other approaches to adversarial robustness which were later shown to suffer from problems of gradient obfuscation ( Athalye et al. , 2018 ) . This is the phenomenon whereby gradients are in some sense hidden or minimized , so that gradient-based attacks fail to produce adversarial examples . Due to this phenomenon , the community now greets adversarial robustness methods based on notions of small gradients with a healthy dose of skepticism . It is therefore necessary to demonstrate new methods do not suffer from gradient obfuscation ( Carlini et al. , 2019 ) , both empirically and theoretically : empirically , by attacking models with gradient-free methods or non-local attacks ; and theoretically using tight certification techniques . Our main contributions in this work are the following . First , we motivate using input gradient regularization of the loss by deriving new theoretical robustness bounds . These bounds use the gradient of the loss , and an estimate of the error of the linear approximation of the loss , called the modulus of continuity . These theoretical bounds show that small loss gradient and a small modulus of continuity are sufficient conditions for adversarial robustness . Second , we empirically show that input gradient regularization is competitive with standard adversarial training ( Madry et al. , 2017 ) , at a fraction of the training time . We verify that training with gradient regularization does not lead to gradient obfuscation , by attacking our trained models with gradient-free methods , and through certification bounds . Finally , we scale input gradient regularization to ImageNet-1k ( Deng et al. , 2009 ) by using finite differences to estimate the gradient regularization term , rather than double backpropagation ( which does not scale ) . This allows us to train adversarially robust networks on ImageNet-1k with only 50 % more training time than that of standard ( non robust ) training . 2 ADVERSARIAL ROBUSTNESS BOUNDS FROM THE LOSS . 2.1 BACKGROUND . Much effort has been directed towards determining theoretical lower bounds on the minimum sized perturbation necessary to perturb an image so that it is misclassified by a model . One promising approach , proposed by Hein & Andriushchenko ( 2017 ) and Weng et al . ( 2018 ) , and which has scaled well to ImageNet-1k , is to use the Lipschitz constant of the model . In this section , we build upon these ideas : we propose using the Lipschitz constant of a suitable loss , designed to measure classification errors . Additionally , we propose a tighter lower bound which uses the local gradient information of the loss , and an error bound on the first-order approximation of the loss . Our notation is as follows . Write y = f ( x ; w ) for a model which takes input vectors x to label probabilities , with parameters w. Let L ( y1 , y2 ) be the loss and write ` ( x ) : = L ( f ( x , w ) , y ) , for the loss of a model f . Finding an adversarial perturbation is interpreted as a global minimization problem : find the closest image to a clean image , in some specified norm , that is is also misclassified by the model min v ‖v‖ subject to f ( x+ v ) misclassified ( 1 ) However , ( 1 ) is a difficult and costly non-smooth , non-convex optimization problem . Instead , Goodfellow et al . ( 2014 ) proposed solving a surrogate problem : find a perturbation v of a clean image x that maximizes the loss , subject to the condition that the perturbation be inside a norm-ball of radius δ around the clean image . The surrogate problem is written max v ` ( x+ v ) − c ( v ) ; where c ( v ) = { 0 if ‖v‖ ≤ δ ∞ otherwise ( 2 ) The hard constraint c ( v ) forces perturbations to be inside the norm-ball centred at the clean image x . Ideally , solutions of this surrogate problem ( 2 ) will closely align with solutions of the original more difficult global minimization problem . However , the hard constraint in ( 2 ) forces a particular scale : it may miss attacks which would succeed with only a slightly bigger norm . Additionally , the maximization problem ( 2 ) does not force misclassification , it only asks that the loss be increased . The advantage of ( 2 ) is that it may be solved with gradient-based methods : present best-practice is to use variants of projected gradient descent ( PGD ) , such as the iterative fast-signed gradient method ( Kurakin et al. , 2016 ; Madry et al. , 2017 ) when attacks are measured in the ` ∞ norm . However , gradient-based methods are not always effective : on non-smooth networks , such as those built of ReLU activation functions , a small gradient does not guarantee that the loss remains small locally . That is , ReLU networks may increase rapidly with a very small perturbation , even when local gradients are small . This deficiency was identified in ( Papernot et al. , 2016 ) and expanded on by Athalye et al . ( 2018 ) . In this scenario , PGD methods will fail to locate these worst-case perturbations , and give a false impression of robustness . Carlini & Wagner ( 2017b ) avoid this scenario by incorporating decision boundary information into the loss ; others solve ( 1 ) directly ( Brendel et al. , 2018 ; Chen & Jordan , 2019 ; Finlay et al. , 2019 ) using gradient-free methods or non-local attacks . 2.2 DERIVATION OF THEORETICAL LOWER BOUNDS . This leads us to consider the following compromise between ( 1 ) and ( 2 ) . Consider the following modification of the Carlini & Wagner ( 2017b ) loss ` ( x ) = maxi 6=c fi ( x ) − fc ( x ) , where c is the index of the correct label , and fi ( x ) is the model output for the i-th label . This loss has the appealing property the sign of the loss determines if the classification is correct . Adversarial attacks are found by minimizing min v ‖v‖ subject to ` ( x+ v ) ≥ ` 0 ( 3 ) The constant ` 0 determines when classification is incorrect ; for the modified Carlini-Wagner loss , ` 0 = 0 . Problem ( 3 ) is closer to the true problem ( 1 ) , and will always find an adversarial image . We use ( 3 ) to derive theoretical lower bounds on the minimum size perturbation necessary to misclassify an image . Suppose the loss is L-Lipschitz with respect to model input . Then we have the estimate ` ( x+ v ) ≤ ` ( x ) + L‖v‖ ( 4 ) Now suppose v is adversarial , with minimum adversarial loss ` ( x+ v ) = ` 0 . Then rearranging ( 4 ) , we obtain the lower bound ‖v‖ ≥ 1L ( ` 0 − ` ( x ) ) . Unfortunately , the Lipschitz constant is a global quantity , and ignores local gradient information ; see for example Huster et al . ( 2018 ) . Thus this bound can be quite poor , even when networks have small Lipschitz constant . A tighter theoretical bound may instead be achieved by using ( i ) the local gradient , and ( ii ) a bound on the error of a first order approximation of the loss . At image x and perturbations up to size ε , the error of a first order approximation of the loss is bounded above by the modulus of continuity ω ( ε ) = sup x , ‖v‖≤ε ` ( x+ v ) − [ ` ( x ) + 〈v , ∇ ` ( x ) 〉 ] ( 5 ) Intuitively , this measures the maximum amount the gradient can change over perturbations of size ε . Note that the quantity is defined for any norm . Using this quantity , for perturbations of size ε we have the estimate ` ( x+ v ) ≤ ` ( x ) + 〈v , ∇ ` ( x ) 〉+ ω ( ε ) ≤ ` ( x ) + ‖v‖‖∇ ` ( x ) ‖∗ + ω ( ε ) ( 6 ) As before , assume v is adversarial , with minimum adversarial loss ` ( x+ v ) = ` 0 . Rearranging ( 6 ) , we obtain the lower bound ‖v‖ ≥ 1‖∇ ` ( x ) ‖∗ ( ` 0 − ` ( x ) − ω ( ε ) ) . Remark 2.1 . If the model and the loss are twice continuously differentiable , the modulus of continuity can be derived from the maximum curvature . However ω ( ε ) is defined even when the model and the loss are not twice differentiable . We have proved the following . Proposition 2.2 . Suppose the loss ` ( x ) is Lipschitz continuous with respect to model input x , with Lipschitz constant L. Let ` 0 be such that if ` ( x ) < ` 0 , the model is always correct . Then a lower bound on the minimum magnitude of perturbation v necessary to adversarially perturb an image x is ‖v‖ ≥ max { ` 0 − ` ( x ) , 0 } L ( L-bound ) Suppose in addition the modulus of continuity ω ( ε ) is defined as in ( 5 ) . Then the minimum adversarial distance is bounded below by ε provided the following inequality holds ` 0 − ` ( x ) − ω ( ε ) ‖∇ ` ( x ) ‖∗ ≥ ε ( ω-bound ) Proposition 2.2 motivates the need for input gradient regularization . The Lipschitz constant L is the maximum gradient norm of the loss over all inputs . Therefore ( L-bound ) says that a regularization term encouraging small gradients ( and so reducing L ) should increase the minimum adversarial distance . This aligns with ( Hein & Andriushchenko , 2017 ) , who proposed the cross-Lipschitz regularizer , penalizing networks with large Jacobians in order to shrink the Lipschitz constant of the network . However , this is not enough : the gap ` 0 − ` ( x ) must be large as well . Together ( L-bound ) explains one form of ‘ gradient masking ’ ( Papernot et al. , 2017 ) . Shrinking the magnitude of gradients while also closing the gap ` 0− ` ( x ) effectively does nothing to improve adversarial robustness . For example , in one form of defense distillation , the magnitude of the model Jacobian is reduced by increasing the temperature of the final softmax layer of the network . However , this has the detrimental side-effect of sending the model output to ( 1N , · · · , 1 N ) , where N is the number of classes , which effectively shrinks the loss gap to zero . An alternative form sends the temperature of the final softmax layer to zero , which pushes the model output to a one-hot vector ; however this sends the Lipschitz constant to ∞ . In either form , the lower bound provided by Proposition 2.2 approaches zero . Moreover , ( ω-bound ) states that even supposing the loss ’ s gradient is small , and the gap ` 0 − ` ( x ) is large , there may still be adversarially vulnerable images nearby due to errors in the first order approximation . Taken together , Proposition 2.2 provides three sufficient conditions for training robust networks : ( i ) the loss gap ` 0 − ` ( x ) should be large ; ( ii ) the gradients of the loss should be small ; and ( iii ) the error of the first-order approximation , measured by ω ( ε ) , should also be small . The first point will be satisfied by default when the loss is minimized . The second point will be satisfied by training with a loss regularized to penalize large input gradients . In Section 4 we provide experimental evidence that the third point is satisfied with input gradient regularization implemented using finite differences . These robustness bounds are most similar in spirit to Weng et al . ( 2018 ) , who derive bounds using an estimate of the local Lipschitz constant of the model by sampling the model gradient norm locally . Indeed , in practice , L and ω ( ε ) can only be estimated and are not exactly computable on all but the simplest networks . We estimate L and ω ( ε ) using the Extreme Value Theory approach outlined by Weng et al . ( 2018 ) . To estimate L , we sample the maximum gradient norm over batches from the data distribution , and estimate an upper bound by fitting a generalized extreme value ( GEV ) distribution to these samples through maximum likelihood estimation ( MLE ) . Similarly , we estimate ω ( ε ) by sampling the maximum of ( 5 ) over batches of the data distribution and ‖v‖ ≤ ε , and then fitting a GEV using MLE . The values of L and ω ( ε ) used in our bounds are estimated from the fitted GEV distribution with threshold p = 0.001 . Because these quantities are estimates , in practice the theoretical bounds of Proposition 2.2 can only be implemented approximately , providing a heuristic measure of adversarial robustness . Notably however , these bounds are valid in any norm with corresponding dual . Furthemore , upon estimating L and ω ( ε ) , we emphasize that these quantities only require one gradient evaluation and one model evaluation to provide an estimate on the robustness of an image . To date , the theoretical bounds in the Euclidean norm that show the greatest promise have arguably been those obtained through randomized smoothing ( Li et al. , 2018 ; Cohen et al. , 2019 ; Salman et al. , 2019 ) . In randomized smoothing , models are trained with inputs perturbed through Gaussian noise ; robust prediction is achieved by averaging model predictions over inputs again perturbed with Gaussian noise , which requires many tens of thousands of model evaluations . It is well known that training with Gaussian noise is equivalent to squared ` 2 norm gradient regularization ( Bishop , 1995 ) . Therefore we expect that models trained with squared norm gradient regularization , should have similar adversarial robustness as those trained through randomized smoothing .

Summary: This paper revisits the method of gradient regularization, which regularizes the loss function by adding the norm of the input gradient, aiming to improve adversarial robustness. The standard gradient regularization is implemented with "double backpropagation", which could be time consuming for large networks. This paper proposes to replace the exact gradient by its discretization via finite difference, which is computationally more efficient comparing to "double backpropagation".  Experiments are conducted to show the effectiveness of the method in reducing training time.