Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networks

1 Introduction . Neural network ( NN ) models have achieved state-of-the-art performance on several image tasks over the last few years . However , they have been known to be vulnerable to adversarial attacks that make small , imperceptible pixel-wise perturbations to images [ 39 , 5 ] . Most pixel-wise adversarial perturbations studied in previous work are carefully constructed , model-dependent and , in most cases also input-dependent , perturbations of small ` ∞ norm ( and sometimes ` 1 or ` 2 norm ) . To achieve adversarial robustness , a popular , principled , and effective defense against ` ∞ adversarial attacks known at present is adversarial training [ 17 , 29 , 37 , 49 ] . From another perspective , recent work has also shown natural , physical-world attacks on neural network models using 2D and 3D spatial transformations such as translations , rotations and pose [ 47 , 14 , 42 , 1 ] . Even random spatial transformations such as random translations and random rotations degrade the accuracy of neural network models considerably [ 12 ] . Recent benchmarks also measure the robustness of NN models to the average-case , model-agnostic perturbations ( e.g. , noise , blur , brightness , contrast ) or natural distribution shifts , and not only to the worst-case adversarial perturbations [ 21 , 40 ] . Spatial robustness or robustness to spatial transformations ( e.g. , translations , rotations ) has been long studied as a problem of model invariance , and is generally addressed using equivariant models or training augmentation . While standard Convolutional Neural Networks ( StdCNNs ) are translation-equivariant , recent efforts have resulted in equivariant NN models for other transformations such as rotation , flip [ 16 , 8 , 10 , 45 , 31 , 26 , 27 , 13 ] , and scaling [ 30 , 46 , 38 ] . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . Such group-equivariant NN models ( GCNNs ) are designed to be invariant to a specific group of transformations , so they need training augmentation to attain spatial robustness to random or averagecase transformations . However , aided by clever weight-sharing , these recent works have achieved good spatial robustness performance with lesser training augmentation than their non-equivariant counterparts . In this paper , we address an inevitable trade-off between the average-case spatial robustness and the worst-case ` ∞ adversarial robustness in neural network models , and show results theoretically as well as empirically . On the one hand , as we attain better spatial robustness via equivariant models and larger training augmentation , the adversarial robustness worsens . On the other hand , as we attain better adversarial robustness via adversarial training against larger pixel-wise perturbations , the spatial robustness worsens . We then provide a curriculum learning-based approach to mitigate this issue and achieve a certain degree of Pareto-optimality in this trade-off . Our work extends recent progress on two important questions , namely , the robustness to multiple attacks and the robustness vs accuracy trade-off . The robustness to translations ( up to ±3 pixels ) and rotations ( up to ±30◦ ) has been shown to have a fundamentally different loss landscape than the robustness to adversarial ` p perturbations [ 12 ] . A trade-off between robustness to adversarial ` ∞ perturbations and adversarial translations and rotations up to ±3 pixels and ±40◦ , respectively , was also recently noted [ 42 ] . Adversarial attacks on ` p adversarially robust models by exploiting invariance at intermediate layers have also been of interest in recent work [ 23 , 41 ] . A key difference of our work with these efforts is that : ( i ) we study spatial robustness to random translations and rotations ( which is more closely related to practice when training NN models and has not been studied in these earlier efforts ) , instead of adversarial translations or rotations ; ( ii ) we study spatial robustness w.r.t transformations over their entire range , and do not restrict ourselves to a ±30 − 40◦ range , for instance ; and ( iii ) we consider the use of group-equivariant models with training augmentation ( which are designed for spatial robustness ) in our studies , beyond just StdCNN models . Our results show a progressive decline in spatial robustness as adversarial robustness improves , and vice versa – a trend that was not explicitly noted in previous results . Our result can also be interpreted as a progressive trade-off between adversarial robustness and generalization accuracy itself [ 43 , 49 , 48 ] , where generalization performance measures accuracy on a test distribution that includes natural data augmentation such as random translations , rotations , etc . Given the nature of this trade-off , we then ask the question of how one can obtain a model close to the Pareto-optimal frontier for adversarial and random spatial robustness . Are there training strategies that can help achieve a balance between both ? We observe that the obvious solutions of training in two stages – first , adversarial training and then training augmentation by spatial transformations , or vice versa – does not help address this issue . This results in a version of catastrophic forgetting , where as the model learns robustness on one of these fronts , it loses robustness on the other . We instead show that a curriculum learning-based strategy , where the model is trained by applying an adversarial perturbation to a randomly transformed input with gradually increased difficulty levels , gives solutions consistently closer to the Pareto-optimal frontier across well-known datasets and models . This strategy reflects the progressive nature noted of the trade-off itself , and highlights the importance of the observation of this trend . Our key contributions can be summarized as follows : • We study a trade-off between adversarial robustness and spatial robustness ( with a focus on random spatial transformations ) both theoretically and empirically , on a setting closer to natural neural network training , which to the best of our knowledge , has not been considered before . We explain the trade-off between spatial and adversarial robustness with a well-motivated theoretical construction . • We conduct a comprehensive suite of experiments across popularly used models and datasets , and find that models trained for spatial robustness ( StdCNNs and GCNNs ) progressively improve spatial robustness when their training is augmented with larger random spatial transformations but while doing so , their ` ∞ adversarial robustness drops progressively . Similarly , models adversarially trained using progressively larger ` ∞-norm attacks improve their adversarial robustness but while doing so , their spatial robustness drops progressively . • We provide a simple yet effective approach based on curriculum learning that gives better-balanced , Pareto-optimal spatial and adversarial robustness compared to several natural baselines derived from combining adversarial training and training augmentation by random spatial transformations . 2 Problem Setting and Formulation . We begin by describing our problem formally . Let ( X , Y ) denote a random input-label pair from a given data distribution over the input-label pairs ( x , y ) ∈ X ×Y . Let f be a neural network classifier . The accuracy of f is given by Pr ( f ( X ) = Y ) , the fraction of inputs where the prediction matches the true label . For > 0 , an ` ∞ adversarial attack A maps each input x to x + A ( x ) such that ‖A ( x ) ‖∞ ≤ , for all x ∈ X . The fooling rate of A is given by Pr ( f ( X +A ( X ) ) 6= f ( X ) ) , the fraction of inputs where the prediction changes after adversarial perturbation . For a given spatial transformation T , the classifier f is said to be T -invariant if the predicted label remains unchanged after the transformation T for all inputs ; in other words , f ( Tx ) = f ( x ) , for all x ∈ X . The spatial transformations such as translation , rotation and flip preserve the ` ∞ norm , so TA ( x ) is an adversarial perturbation of small ` ∞ norm for the input Tx for a T -invariant classifier . Therefore , for a given perturbation bound > 0 , the maximum fooling rate for any T -invariant classifier f on the transformed data { Tx : x ∈ X } must be equal to the maximum fooling rate for f on the original data X . It is a bit more subtle when f is not truly invariant , that is , f ( Tx ) = f ( x ) for most inputs x but not all x . We define the rate of invariance of a classifier f to a transformation T as Pr ( f ( TX ) = f ( X ) ) or the fraction of test images whose predicted labels remain unchanged under the transformation T . For a class of transformations , e.g. , random rotation r from the range [ −θ◦ , +θ◦ ] , we define the rate of invariance as the average rate of invariance over transformations T in this class , i.e. , Pr ( f ( r ( X ) ) = f ( X ) ) , where the probability is over the random input X as well as the random transformation r. The rate of invariance is 100 % if the model f is truly invariant . When f is not truly invariant , the interplay between the invariance under transformations and robustness under adversarial perturbations of small ` ∞-norm is subtle . This interplay is exactly what we investigate . In this paper , we study neural network models and the simultaneous interplay between their spatial robustness , viz , rate of invariance for spatial transformations ( such as random rotations between [ −θ◦ , +θ◦ ] for θ varying in the range [ 0 , 180 ] ) , and their adversarial robustness to pixel-wise perturbations of ` ∞ norm at most . Measuring the robustness of a model to adversarial perturbations of ` p norm at most is NP-hard [ 24 , 37 ] . Previous work on the comparison of different adversarial attacks has shown the Projected Gradient Descent ( PGD ) attack to be among the strongest [ 2 ] . Hence , we use PGD-based adversarial training as the methodology for adversarial robustness in a model , as commonly done . We show that our conclusions also hold for other forms of adversarial training such as TRADES [ 49 ] , which gives a trade-off between adversarial robustness and natural accuracy ( on the original unperturbed data ) . Theoretically speaking , we prove a quantitative trade-off between spatial and adversarial robustness in a simple , natural statistical setting proposed in previous work [ 43 ] . Our theoretical results ( described in Sec 3 ) show that there is a trade-off between spatial and adversarial robustness , and that it is not always possible to have both in a given model . Empirically , we study the following : ( a ) change in ` ∞ adversarial robustness as we improve only the rate of spatial robustness using training augmentation with progressively larger transformations ; ( b ) change in spatial invariance as we improve only adversarial robustness using PGD adversarial training with progressively larger ` ∞-norm of pixelwise perturbations . We study StdCNNs , group-equivariant GCNNs , as well as popular architectures used to assess adversarial robustness [ 29 , 49 ] . Our empirical studies are conducted on MNIST , CIFAR10 , CIFAR100 as well as Tiny ImageNet datasets , thus showing the general nature of these results ( described in Sec 4 ) . Importantly , as stated earlier , we consider random spatial transformations that are more commonplace than adversarial rotations in previous work [ 42 ] . We look at the entire possible range for spatial transformations . Similarly , we normalize the underlying dataset , and compute the accuracy of a given model on test inputs adversarially perturbed using PGD attack of ` ∞ norm at most , for varying over [ 0 , 1 ] . In contrast with the certifiable lower bounds on robustness [ 3 , 15 , 35 , 28 , 32 ] , we study upper bounds on spatial and adversarial robustness , respectively .

Summary: The authors study the trade-off between spatial (translation and rotation) robustness and adversarial robustness. They show theoretical proofs and empirical evidence that two properties may be at odds with each other. A curriculum lraining based method is proposed to mitigate the problem.