Geometry-aware Instance-reweighted Adversarial Training

1 INTRODUCTION . Crafted adversarial data can easily fool the standard-trained deep models by adding humanimperceptible noise to the natural data , which leads to the security issue in applications such as medicine , finance , and autonomous driving ( Szegedy et al. , 2014 ; Nguyen et al. , 2015 ) . To mitigate this issue , many adversarial training methods employ the most adversarial data maximizing the loss for updating the current model such as standard adversarial training ( AT ) ( Madry et al. , 2018 ) , TRADES ( Zhang et al. , 2019 ) , robust self-training ( RST ) ( Carmon et al. , 2019 ) , and MART ( Wang et al. , 2020b ) . The adversarial training methods seek to train an adversarially robust deep model whose predictions are locally invariant to a small neighborhood of its inputs ( Papernot et al. , 2016 ) . By leveraging adversarial data to smooth the small neighborhood , the adversarial training methods acquire adversarial robustness against adversarial data but often lead to the undesirable degradation of standard accuracy on natural data ( Madry et al. , 2018 ; Zhang et al. , 2019 ) . Thus , there have been debates on whether there exists a trade-off between robustness and accuracy . For example , some argued an inevitable trade-off : Tsipras et al . ( 2019 ) showed fundamentally different representations learned by a standard-trained model and an adversarial-trained model ; Zhang et al . ( 2019 ) and Wang et al . ( 2020a ) proposed adversarial training methods that can trade off standard accuracy for adversarial robustness . On the other hand , some argued that there is no such the trade-off : Raghunathan et al . ( 2020 ) showed infinite data could eliminate this trade-off ; Yang et al . ( 2020 ) showed benchmark image datasets are class-separated . Recently , emerging adversarial training methods have empirically challenged this trade-off . For example , Zhang et al . ( 2020b ) proposed the friendly adversarial training method ( FAT ) , employing friendly adversarial data minimizing the loss given that some wrongly-predicted adversarial data have been found . Yang et al . ( 2020 ) introduced dropout ( Srivastava et al. , 2014 ) into existing AT , RST , and TRADES methods . Both methods can improve the accuracy while maintaining the robustness . However , the other direction—whether we can improve the robustness while keeping the accuracy—remains unsolved and is more interesting . In this paper , we show this direction is also achievable . Firstly , we show over-parameterized deep networks may still have insufficient model capacity , because adversarial training has an overwhelming smoothing effect . Fitting adversarial data is demanding for a tremendous model capacity : It requires a large number of trainable parameters or long-enough training epochs to reach near-zero error on the adversarial training data ( see Figure 2 ) . The over-parameterized models that fit natural data entirely in the standard training ( Zhang et al. , 2017 ) are still far from enough for fitting adversarial data . Compared with standard training fitting the natural data points , adversarial training smooths the neighborhoods of natural data , so that adversarial data consume significantly more model capacity than natural data . Thus , adversarial training methods should carefully utilize the limited model capacity to fit the neighborhoods of the important data that aid to fine-tune the decision boundary . Therefore , it may be unwise to give equal weights to all adversarial data . Secondly , data along with their adversarial variants are not equally important . Some data are geometrically far away from the class boundary . They are relatively guarded . Their adversarial variants are hard to be misclassified . On the other hand , some data are close to the class boundary . They are relatively attackable . Their adversarial variants are easily misclassified ( see Figure 3 ) . As the adversarial training progresses , the adversarially robust model engenders an increasing number of guarded training data and a decreasing number of attackable training data . Given limited model capacity , treating all data equally may cause the vast number of adversarial variants of the guarded data to overwhelm the model , leading to the undesirable robust overfitting ( Rice et al. , 2020 ) . Thus , it may be pessimistic to treat all data equally in adversarial training . To ameliorate this pessimism , we propose a heuristic method , i.e. , geometry-aware instancereweighted adversarial training ( GAIRAT ) . As shown in Figure 1 , GAIRAT treats data differently . Specifically , for updating the current model , GAIRAT gives larger/smaller weight to the loss of an adversarial variant of attackable/guarded data point which is more/less important in fine-tuning the decision boundary . An attackable/guarded data point has a small/large geometric distance , i.e. , its distance from the decision boundary . We approximate its geometric distance by the least number of iterations κ that projected gradient descent method ( Madry et al. , 2018 ) requires to generate a misclassified adversarial variant ( see the details in Section 3.3 ) . GAIRAT explicitly assigns instancedependent weight to the loss of its adversarial variant based on the least iteration number κ . Our contributions are as follows . ( a ) In adversarial training , we identify the pessimism in treating all data equally , which is due to the insufficient model capacity and the unequal nature of different data ( in Section 3.1 ) . ( b ) We propose a new adversarial training method , i.e. , GAIRAT ( its learning objective in Section 3.2 and its realization in Section 3.3 ) . GAIRAT is a general method : Besides standard AT ( Madry et al. , 2018 ) , the existing adversarial training methods such as FAT ( Zhang et al. , 2020b ) and TRADES ( Zhang et al. , 2019 ) can be modified to GAIR-FAT and GAIR-TRADES ( in Appendices B.1 and B.2 , respectively ) . ( c ) Empirically , our GAIRAT can relieve the issue of robust overfitting ( Rice et al. , 2020 ) , meanwhile leading to the improved robustness with zero or little degradation of accuracy ( in Section 4.1 and Appendix C.1 ) . Besides , we use Wide ResNets ( Zagoruyko & Komodakis , 2016 ) to corroborate the efficacy of our geometry-aware instance-reweighted methods : Our GAIRAT significantly boosts the robustness of standard AT ; combined with FAT , our GAIRFAT improves both the robustness and accuracy of standard AT ( in Section 4.2 ) . Consequently , we conjecture no inevitable trade-off between robustness and accuracy . 2 ADVERSARIAL TRAINING . In this section , we review adversarial training methods ( Madry et al. , 2018 ; Zhang et al. , 2020b ) . 2.1 LEARNING OBJECTIVE . Let ( X , d∞ ) denote the input feature space X with the infinity distance metric dinf ( x , x′ ) = ‖x − x′‖∞ , and B [ x ] = { x′ ∈ X | dinf ( x , x′ ) ≤ } be the closed ball of radius > 0 centered at x in X . Dataset S = { ( xi , yi ) } ni=1 , where xi ∈ X and yi ∈ Y = { 0 , 1 , ... , C − 1 } . The objective function of standard adversarial training ( AT ) ( Madry et al. , 2018 ) is min fθ∈F 1 n n∑ i=1 ` ( fθ ( x̃i ) , yi ) , ( 1 ) where x̃i = arg maxx̃∈B [ xi ] ` ( fθ ( x̃ ) , yi ) , ( 2 ) where x̃ is the most adversarial data within the -ball centered at x , fθ ( · ) : X → RC is a score function , and the loss function ` : RC×Y → R is a composition of a base loss ` B : ∆C−1×Y → R ( e.g. , the cross-entropy loss ) and an inverse link function ` L : RC → ∆C−1 ( e.g. , the soft-max activation ) , in which ∆C−1 is the corresponding probability simplex—in other words , ` ( fθ ( · ) , y ) = ` B ( ` L ( fθ ( · ) ) , y ) . AT employs the most adversarial data generated according to Eq . ( 2 ) for updating the current model . The objective function of friendly adversarial training ( FAT ) ( Zhang et al. , 2020b ) is x̃i = arg min x̃∈B [ xi ] ` ( fθ ( x̃ ) , yi ) s.t . ` ( fθ ( x̃ ) , yi ) −miny∈Y ` ( fθ ( x̃ ) , y ) ≥ ρ . ( 3 ) Note that the outer minimization remains the same as Eq . ( 1 ) , and the operator arg max is replaced by arg min . ρ is a margin of loss values ( i.e. , the misclassification confidence ) . The constraint of Eq . ( 3 ) firstly ensures x̃ is misclassified , and secondly ensures for x̃ the wrong prediction is better than the desired prediction yi by at least ρ in terms of the loss value . Among all such x̃ satisfying the constraint , Eq . ( 3 ) selects the one minimizing ` ( fθ ( x̃ ) , yi ) by a violation of the value ρ . There are no constraints on x̃i if x̃i is correctly classified . FAT employs the friendly adversarial data generated according to Eq . ( 3 ) for updating the current model . 2.2 REALIZATIONS . AT and FAT ’ s objective functions imply the optimization of adversarially robust networks , with one step generating adversarial data and one step minimizing loss on the generated adversarial data w.r.t . the model parameters θ . The projected gradient descent method ( PGD ) ( Madry et al. , 2018 ) is the most common approximation method for searching adversarial data . Given a starting point x ( 0 ) ∈ X and step size α > 0 , PGD works as follows : x ( t+1 ) = ΠB [ x ( 0 ) ] ( x ( t ) + α sign ( ∇x ( t ) ` ( fθ ( x ( t ) ) , y ) ) ) , t ∈ N ( 4 ) until a certain stopping criterion is satisfied . ` is the loss function ; x ( 0 ) refers to natural data or natural data perturbed by a small Gaussian or uniformly random noise ; y is the corresponding label for natural data ; x ( t ) is adversarial data at step t ; and ΠB [ x0 ] ( · ) is the projection function that projects the adversarial data back into the -ball centered at x ( 0 ) if necessary . There are different stopping criteria between AT and FAT . AT employs a fixed number of iterations K , namely , the PGD-K algorithm ( Madry et al. , 2018 ) , which is commonly used in many adversarial training methods such as CAT ( Cai et al. , 2018 ) , DAT ( Wang et al. , 2019 ) , TRADES ( Zhang et al. , 2019 ) , and MART ( Wang et al. , 2020b ) . On the other hand , FAT employs the misclassification-aware criterion . For example , Zhang et al . ( 2020b ) proposed the early-stopped PGD-K-τ algorithm ( τ ≤ K ; K is the fixed and maximally allowed iteration number ) : Once the PGD-K-τ finds the current model misclassifying the adversarial data , it stops the iterations immediately ( τ = 0 ) or slides a few more steps ( τ > 0 ) . This misclassification-aware criterion is used in the emerging adversarial training methods such as MMA ( Ding et al. , 2020 ) , FAT ( Zhang et al. , 2020b ) , ATES ( Sitawarin et al. , 2020 ) , and Customized AT ( Cheng et al. , 2020 ) . AT can enhance the robustness against adversarial data but , unfortunately , degrades the standard accuracy on the natural data significantly ( Madry et al. , 2018 ) . On the other hand , FAT has better standard accuracy with near-zero or little degradation of robustness ( Zhang et al. , 2020b ) . Nevertheless , both AT and FAT treat the generated adversarial data equally for updating the model parameters , which is not necessary and sometimes even pessimistic . In the next sections , we introduce our method GAIRAT , which is compatible with existing methods such as AT , FAT , and TRADES . Consequently , GAIRAT can significantly enhance robustness with little or even zero degradation of standard accuracy .

Summary: The paper focused on the sample importance in the adversarial training. The authors firstly revealed that over-parameterized deep models on natural data may have insufficient model capacity for adversarial data, because the training loss is hard to zero for adversarial training. Then, the authors argued that limited capacity should be used for these important samples, that is, we should not treat samples equally important. They used the distance to the decision boundary to distinguish important samples and proposed geometry-aware instance-reweighted adversarial training. Experiments show the superiority over baselines.