Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?

1 INTRODUCTION . Deep neural networks are powerful tools but their success depends strongly on the amount of training data ( Sun et al. , 2017 ; Mahajan et al. , 2018 ) . Recent works show that for improving robust training against adversarial examples ( Biggio et al. , 2013 ; Szegedy et al. , 2014 ; Biggio & Roli , 2018 ) , additional training data is helpful ( Carmon et al. , 2019 ; Schmidt et al. , 2018a ; Uesato et al. , 2019 ; Deng et al. , 2021 ) . However , curating more real-world data from the actual data distribution is usually challenging and costly ( Recht et al. , 2019 ) . To circumvent this challenge , we ask : can robust training be enhanced using a proxy distribution , i.e. , an approximation of the real data distribution ? In particular , can additional samples from a proxy distribution , that is perhaps cheaper to sample from , improve robustness . If so , can generative models that are trained on limited training images in small scale datasets ( LeCun & Cortes , 2010 ; Krizhevsky et al. , 2014 ) , act as such a proxy distribution ? 1 When training on synthetic samples from generative models , a natural question is whether robustness on synthetic data will also transfer to real world data . Even if it does , can we determine the features of synthetic data that enable this synthetic-to-real robustness transfer and optimize our selection of generative models based on these features ? Finally , can we also optimize the selection of individual synthetic samples to maximize the robustness transfer ? Q.1 When does robustness transfer from proxy distribution to real data distribution ? This question is fundamental to develop a better understanding of whether a proxy distribution will help . For a classifier trained on only synthetic samples , we argue that in addition to empirical and generalization error , distribution shift penalty also determines its robustness on the real data distribution . We 1Proxy distributions may not necessarily be modeled by generative models . When a proxy distribution is the output of a generative model , we call it synthetic distribution and refer to data sampled from it as synthetic data . prove that this penalty is upper bounded by the conditional Wasserstein distance between the proxy distribution and real data distribution . Thus robustness will transfer from proxy distributions that are in close proximity to real data distribution with respect to conditional Wasserstein distance . Q.2 How effective are proxy distributions in boosting adversarial robustness on real-world dataset ? Our experimental results on five datasets demonstrate that the use of samples from PrOxy distributions in Robust Training ( PORT ) can significantly improve robustness . In particular , PORT achieves up to to 7.5 % improvement in adversarial robustness over existing state-of-the-art ( Croce et al. , 2020 ) . Its improvement is consistent across different threat models ( ` ∞ or ` 2 ) , network architectures , datasets , and robustness criteria ( empirical or certified robustness ) . We also uncover that synthetic images from diffusion-based generative models are most helpful in improving robustness on real datasets . We further investigate the use of proxy distributions in robust training . In particular , we investigate why current state-of-the-art in diffusion-based models are significantly more helpful than their counterparts , such as generative adversarial networks ( GANs ) . Q.3 Can we develop a metric to characterize which proxy distribution will be most helpful in robust training ? Our theory motivates the design of a measure of proximity between two distributions that incorporates the geometry of the distributions and can empirically predict the transfer of robustness . We propose a robust learning based approach where we use the success of a discriminator in distinguishing adversarially perturbed samples of synthetic and real data as a measure of proximity . Discriminating between synthetic and real data is a common practice ( Goodfellow et al. , 2014 ; Gui et al. , 2020 ) , however , we find that considering adversarial perturbations on synthetic and real data samples is the key to making the discriminator an effective measure for this task . We demonstrate that the rate of decrease in discriminator success with an increasing size of perturbations can effectively measure proximity and it accurately predicts the relative transfer of robustness from different generative models . We also leverage our robust discriminators to identify most helpful synthetic samples . We use the proximity of each synthetic sample to real data distribution , referred to as synthetic score , as a metric to judge their importance . This score can be computed using output probability from a discriminator that is robustly trained to distinguish between adversarially perturbed samples from proxy and real data distribution . We demonstrate that selecting synthetic images based on their synthetic scores can further improve performance . Contributions . We make the following key contributions . • We provide an analytical bound on the transfer of robustness from proxy distributions to real data distribution using the notion of conditional Wasserstein distance and further validate it experimentally . • Overall , using additional synthetic images , we improve both clean and robust accuracy on five different datasets . In particular , we improve robust accuracy by up to 7.5 % and 6.7 % in ` ∞ and ` 2 threat models , respectively , and certified robust accuracy ( ` 2 ) by 7.6 % on the CIFAR-10 dataset . • When selecting a proxy distribution , we show that existing metrics , such as FID , fail to determine the synthetic-to-real transfer of robustness . We propose a new metric ( ARC ) based on the distinguishability of adversarially perturbed synthetic and real data , that accurately determines the performance transfer . • We also develop a metric , named synthetic score , to determine the importance of each synthetic sample in synthetic-to-real robustness transfer . We demonstrate that choosing samples with lower synthetic scores provide better results than randomly selected samples . 2 INTEGRATING PROXY DISTRIBUTIONS IN ROBUST TRAINING . In this section we propose to use samples from proxy distributions to improve robustness . We first provide analytical bounds on the transfer of adversarial robustness from proxy to real data distribution . Next , using robust discriminators we provide a metric based on our analytical bound , which can accurately determine the relative ranking of different proxy distributions in terms of robustness transfer . Our metric can be calculated empirically ( using samples from both distributions ) and does not require the knowledge of the proxy or real data distribution . Finally , we present our robust training formulation ( PORT ) which uses synthetic samples generated by the generative model , together with real samples . Notation . We represent the input space by X and corresponding label space as Y . Data is sampled from a joint distribution D that is supported on X × Y . For a label y , we use D | y to denote the conditional distribution of class y . We denote the proxy distribution as D̃ . We denote the neural network for classification by f : X → Z , parameterized by θ , which maps input images to output probability vectors ( z ) . We use h to refer to the classification functions that output labels . For a set S sampled from a distribution D , we use Ŝ to denote the empirical distribution with respect to set S. We use S ∼ D to denote the sampling of a dataset from a distribution D. We use ( x , y ) ← D to denote the sampling of a single point from D . 2.1 UNDERSTANDING TRANSFER OF ADVERSARIAL ROBUSTNESS BETWEEN DATA DISTRIBUTIONS . Since our goal is to use samples from proxy distribution to improve robustness on real data distribution , we first study the transfer of adversarial robustness between two data distributions . Definition 1 ( Average Robustness ) . We define average robustness for a classifier h on a distribution D according to a distance metric d as follows : Robd ( h , D ) = E ( x , y ) ←D [ infh ( x′ ) 6=y d ( x′ , x ) ] . where classifier h : X → Y predicts class label of an input sample 2 . This definition refers to the expected distance to the closest adversarial example for each sample . Formalizing transfer of robustness from proxy to real data distribution . In robust learning from a proxy distribution , we are interested in bounding the average robustness of the classifier obtained by a learning algorithm ( L ) , on distribution D , when the training set is a set S of n labeled examples sampled from a proxy distribution D̃ . In particular we want to provide a lower bound on the transferred average robustness i.e , E S∼D̃ h←L ( S ) [ Robd ( h , D ) ] . In order to understand this quantity better , suppose h is a classifier trained on a set S that is sampled from D̃ , using algorithm L. We decompose Robd ( h , D ) to three quantities as follows : Robd ( h , D ) = ( Robd ( h , D ) − Robd ( h , D̃ ) ) + ( Robd ( h , D̃ ) − Robd ( h , Ŝ ) ) + Robd ( h , Ŝ ) . Using this decomposition , by linearity of expectation and triangle inequality we can bound transferred average robustness from below by E S←D̃n h←L ( S ) [ Robd ( h , Ŝ ) ] ︸ ︷︷ ︸ Empirical robustness − ∣∣ E S←D̃n h←L ( S ) [ Robd ( h , D̃ ) − Robd ( h , Ŝ ) ] ∣∣ ︸ ︷︷ ︸ Generalization penalty − ∣∣ E S←D̃n h←L ( S ) [ Robd ( h , D ) − Robd ( h , D̃ ) ] ∣∣ ︸ ︷︷ ︸ Distribution-shift penalty . As the above decomposition suggests , in order to bound the average robustness , we need to bound both the generalization penalty and the distribution shift penalty . The generalization penalty has been rigorously studied before in multiple works ( Cullina et al. , 2018 ; Montasser et al. , 2019 ; Schmidt et al. , 2018b ) . Hence , we focus on bounding the distribution shift penalty . Our goal is to provide a bound on the distribution-shift penalty that is independent of the classifier in hand and is only related to the properties of the distributions . With this goal , we define a notion of distance between two distributions . Definition 2 ( Conditional Wasserstein distance ) . For two labeled distributions D and D̃ supported on X × Y , we define cwd according to a distance metric d as follows : cwdd ( D , D̃ ) = E ( · , y ) ←D [ inf J∈J ( D|y , D̃|y ) E ( x , x′ ) ←J [ d ( x , x′ ) ] ] where J ( D , D̃ ) is the set of joint distributions whose marginals are identical to D and D̃ . 2This notion of robustness is also used in Gilmer et al . ( 2018 ) ; Diochnos et al . ( 2018 ) and Mahloujifar et al . ( 2019a ) . It is simply the expectation of Wasserstein distance between conditional distributions for each class . Now , we are ready to state our main theorem that bounds the distribution shift penalty for any learning algorithm based only on the Wasserstein distance of the two distributions . Theorem 1 ( Bounding distribution-shift penalty ) . Let D and D̃ be two labeled distributions supported on X × Y with identical label distributions , i.e. , ∀y∗ ∈ Y , Pr ( x , y ) ←D [ y = y∗ ] = Pr ( x , y ) ←D̃ [ y = y ∗ ] . Then for any classifier h : X → Y |Robd ( h , D̃ ) − Robd ( h , D ) | ≤ cwdd ( D , D̃ ) . Theorem 1 shows how one can bound the distribution-shift penalty by minimizing the conditional Wasserstein distance between the two distributions . We provide its proof and empirical validation in Appendix A . Even if we successfully reduce the generalization penalty , the distribution-shift penalty may remain the dominant factor in transferred robustness . This theorem enables us to switch our attention from robust generalization to creating generative models for which the underlying distribution is close to the original distribution . In Appendix A , we also provide two other theorems about the tightness of Theorem 1 and the effect of combining clean and proxy data together .

Summary: The paper investigates if generative models can be used to improve the robust accuracy of image models. The authors show that the current SOTA across multiple attack models and commonly used datasets can be significantly improved by using generative models. They show that the conditional Wasserstein difference between the test distribution and the one learned by the generative model is an upper bound for the difference in robustness achieved by models trained on either distribution.  They investigate what generative models provide good proxy distributions by robustly training discriminators and using their accuracy at different attack strengths as a metric. The discriminators are also shown to be helpful to order generated samples by their effectiveness for adversarial training.