Towards Defending Multiple Adversarial Perturbations via Gated Batch Normalization

1 INTRODUCTION . Deep neural networks ( DNNs ) have achieved remarkable performance across a wide areas of applications ( Krizhevsky et al. , 2012 ; Bahdanau et al. , 2014 ; Hinton et al. , 2012 ) , but they are susceptible to adversarial examples ( Szegedy et al. , 2013 ) . These elaborately designed perturbations are imperceptible to humans but can easily lead DNNs to wrong predictions , threatening both digital and physical deep learning applications ( Kurakin et al. , 2016 ; Liu et al. , 2019a ) . To improve model robustness against adversarial perturbations , a number of adversarial defense methods have been proposed ( Papernot et al. , 2015 ; Engstrom et al. , 2018 ; Goodfellow et al. , 2014 ) . Many of these defense methods are based on adversarial training ( Goodfellow et al. , 2014 ; Madry et al. , 2018 ) , which augment training data with adversarial examples . However , most adversarial defenses are designed to counteract a single type of perturbation ( e.g. , small ` ∞-noise ) ( Madry et al. , 2018 ; Kurakin et al. , 2017 ; Dong et al. , 2018 ) . These defenses offer no guarantees for other perturbations ( e.g. , ` 1 , ` 2 ) , and sometimes even increase model vulnerability ( Kang et al. , 2019 ; Tramèr & Boneh , 2019 ) . To address this problem , other adversarial training strategies have been proposed with the goal of simultaneously achieving robustness against multiple types of attacks , i.e. , ` ∞ , ` 1 , and ` 2 attacks ( Tramèr & Boneh , 2019 ; Maini et al. , 2020 ) . Although these methods improve overall model robustness against adversarial attacks in multiple ` p balls , the performance for each individual perturbation type is still far from satisfactory . In this work , we propose the multi-domain hypothesis , which states that different types of adversarial perturbation arise in different domains , and thus have separable characteristics . Training on data from multiple domains can be regarded as solving the invariant risk minimization problem ( Ahuja et al. , 2020 ) , in which an invariant predictor is learnt to achieve the minimum risk for different environments . For a deep learning model , instance-related knowledge can be stored in the weight matrix 1Our code will be available upon publication . of each layer , whereas domain-related knowledge can be represented by the batch normalization ( BN ) layer statistics ( Li et al. , 2017 ) . Inspired by the multi-domain hypothesis , we propose to improve model robustness against multiple perturbation types by separating domain-specific information for different perturbation types , and using BN layer statistics to better align data from the mixture distribution and learn domain-invariant representations for multiple adversarial examples types . In particular , we propose a novel building block for DNNs , referred to as Gated Batch Normalization ( GBN ) , which consists of a gated subnetwork and a multi-branch BN layer . GBN first learns to separate perturbations from different domains on-the-fly and then normalizes them by obtaining domain-specific features . Specifically , each BN branch handles a single perturbation type ( i.e. , domain ) . Then , features computed from different branches are aligned as domain-invariant representations that are aggregated as the input to subsequent layers . Extensive experiments on MNIST , CIFAR-10 , and Tiny-ImageNet demonstrate that our method outperforms previous defense strategies by large margins , i.e. , 10-20 % . 2 BACKGROUND AND RELATED WORK . In this section , we provide a brief overview of existing work on adversarial attacks and defenses , as well as batch normalization techniques . 2.1 ADVERSARIAL ATTACKS AND DEFENSES . Adversarial examples are inputs intentionally designed to mislead DNNs ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ) . Given a DNN fΘ and an input image x ∈ X with the ground truth label y ∈ Y , an adversarial example xadv satisfies fΘ ( xadv ) 6= y s.t . ‖x− xadv‖ ≤ , where ‖ · ‖ is a distance metric . Commonly , ‖ · ‖ is measured by the ` p-norm ( p ∈ { 1,2 , ∞ } ) . Various defense approaches have been proposed to improve model robustness against adversarial examples ( Papernot et al. , 2015 ; Xie et al. , 2018 ; Madry et al. , 2018 ; Liao et al. , 2018 ; Cisse et al. , 2017 ) , among which adversarial training has been widely studied and demonstrated to be the most effective ( Goodfellow et al. , 2014 ; Madry et al. , 2018 ) . Specifically , adversarial training minimizes the worst case loss within some perturbation region for classifiers , by augmenting the training set { x ( i ) , y ( i ) } i=1 ... n with adversarial examples . However , these defenses only improve model robustness for one type of perturbation ( e.g. , ` ∞ ) and typically offer no robustness guarantees against other attacks ( Kang et al. , 2019 ; Tramèr & Boneh , 2019 ; Schott et al. , 2019 ) . To address this problem , recent works have attempted to improve the robustness against several types of perturbation ( Schott et al. , 2019 ; Tramèr & Boneh , 2019 ; Maini et al. , 2020 ) . Schott et al . ( 2019 ) proposed Analysis by Synthesis ( ABS ) , which used multiple variational autoencoders to defend ` 0 , ` 2 , and ` ∞ adversaries . However , ABS only works on the MNIST dataset . Croce & Hein ( 2020a ) proposed a provable adversarial defense against all ` p norms for p ≥1 using a regularization term . However , it is not applicable to the empirical setting , since it only guarantees robustness for very small perturbations ( e.g. , 0.1 and 2/255 for ` 2 and ` ∞ on CIFAR-10 ) . Tramèr & Boneh ( 2019 ) tried to defend against multiple perturbation types ( ` 1 , ` 2 , and ` ∞ ) by combining different types of adversarial examples for adversarial training . Specifically , they introduced two training strategies , “ MAX ” and “ AVG ” , where for each input image , the model is either trained on its strongest adversarial example or all types of perturbations . More recently , Maini et al . ( 2020 ) proposed multi steepest descent ( MSD ) , and showed that a simple modification to standard PGD adversarial training improves robustness to ` 1 , ` 2 , and ` ∞ adversaries . In this work , we follow ( Tramèr & Boneh , 2019 ; Maini et al. , 2020 ) to focus on defense against ` 1 , ` 2 , and ` ∞ adversarial perturbations , which are the most representative and commonly used perturbations . However , we propose a completely different perspective and solution to the problem . 2.2 BATCH NORMALIZATION . BN ( Ioffe & Szegedy , 2015 ) is typically used to stabilize and accelerate DNN training . Let x ∈ Rd denote the input to a neural network layer . During training , BN normalizes each neuron/channel within m mini-batch data by x̂j = BN ( xj ) = γj xj − µj√ σ2j + ξ + βj , j = 1 , 2 , ... , d , ( 1 ) where µj = 1m ∑m i=1 x ( i ) j and σ 2 j = 1 m ∑m i=1 ( x ( i ) j − µj ) 2 are the mini-batch mean and variance for each neuron , respectively , and ξ is a small number to prevent numerical instability . The learnable parameters γ and β are used to recover the representation capacity . During inference , the population statistics of mean µ̂ and variance σ̂2 are used in Eqn . 1 , which are usually calculated as the running average over different training iterations t with update factor α : µ̂t = ( 1− α ) µ̂t−1 + αµt−1 , ( σ̂t ) 2 = ( 1− α ) ( σ̂t−1 ) 2 + α ( σt−1 ) 2 . ( 2 ) A number of normalization techniques have been proposed to improve BN for style-transfer ( Huang & Belongie , 2017 ) and domain adaption ( Li et al. , 2017 ; Chang et al. , 2019 ; Deecke et al. , 2019 ) . Compared to studies for domain adaptation , our GBN does not require input domain knowledge during inference . In contrast to Mode Normalization ( Deecke et al. , 2019 ) , which aims to learn a mixture distribution for multi-task learning , GBN separates domain-specific statistics for different input types and then aligns the data to build domain-invariant representations . Recently , Xie & Yuille ( 2020 ) ; Xie et al . ( 2020 ) applied separate BNs to clean and adversarial examples for statistics estimation . In contrast to the above two studies that improve image recognition or analyze the properties of BN to adversarial training , we aim to defend against multiple adversarial perturbations . Furthermore , GBN can predict the domain for an input sample and then jointly incorporate the outputs of multiple BN branches to provide the final classification result . Conversely , Xie & Yuille ( 2020 ) ; Xie et al . ( 2020 ) manually selected the BN branch for each input image , which requires prior knowledge of whether the input is an adversarial or clean example ( the same as domain adaptation ) . 3 GATED BATCH NORMALIZATION . In this section , we present our proposed Gated Batch Normalization ( GBN ) approach , to improve the model robustness against multiple adversarial perturbations . We first illustrate our multi-domain hypothesis , which states that adversarial examples of different perturbation types are drawn from different domains . Motivated by this hypothesis , we demonstrate the architecture of our GBN block , then describe the training and inference procedures . 3.1 MOTIVATION : MULTI-DOMAIN HYPOTHESIS . We assumeN adversarial perturbation types2 , each characterized by a set Sk of perturbations for an input x . Let D0 denote the set of clean examples , and Dk ( k = 1 , ... , N ) denote the set of adversarial examples generated by the k-th adversarial perturbation type Sk . An adversarial example of the k-th type xkadv is generated by the pixel-wise addition of the perturbation δ k , i.e. , xkadv = x + δ k. Our multi-domain hypothesis states that different types of perturbations Dk ( for all k ≥ 0 , including the clean examples ) are drawn from different domains , inspired by the following observations : ( 1 ) Training on a single perturbation type is insufficient for achieving the robustness against other perturbations . Further , training on a mixture of different perturbation types still fail to achieve acceptable performance for each type of perturbation ( Tramèr & Boneh , 2019 ; Maini et al. , 2020 ) . ( 2 ) Adversarial examples are separable from clean examples ( Metzen et al. , 2018 ) . Xie & Yuille ( 2020 ) also suggested that clean and adversarial examples are drawn from two different domains . We first empirically investigate the hypothesis for deep neural networks . Specifically , we train separate BNs for different input domains Dk ( k ≥ 0 ) . As illustrated in Figure 1 ( b ) , we construct separate mini-batches to estimate BN statistics for different Dk , i.e. , ` 1 , ` 2 , and ` ∞ adversarial images , as well as for clean images . We defer the implementation details to Appendix A . Figure 1 ( c ) and 1 ( d ) show that different Dk induce significantly different running statistics , according to the running means and variances of different BN branches . 2In this work , we consider N = 3 adversarial perturbation types : ` 1 , ` 2 and ` ∞ . We further theoretically demonstrate that for a linear classifier f ( x ) = sign ( wTx + b ) , different types of adversarial perturbations belong to different domains , with pair-wise Wasserstein distances greater than 0 ( c.f . Appendix B ) . These theoretical and empirical results support our multi-domain hypothesis , and motivate our design of GBN , as discussed below .

Summary: This paper introduces an algorithm for defending against multiple adversarial attacks (L1, L2, L-inf) by learning separate batch-norm statistics for each attack type. At inference time, the batch-normalized outputs corresponding to the different attack types are averaged according to the probability of attack types as given by a separate prediction network (one per batch-norm layer). The algorithm is evaluated on a range of datasets (MNIST, CIFAR-10, Tiny-ImageNet) and is shown to outperform recent competing approaches on a range of adversarial attacks.