Pareto Adversarial Robustness: Balancing Spatial Robustness and Sensitivity-based Robustness

1 INTRODUCTION . Robust generalization can serve as an extension of tradition generalization , i.e. , Empirical Risk Minimization in the case of i.i.d . data ( Vapnik & Chervonenkis , 2015 ) , where the test environments might differ slightly or dramatically from the training environment ( Krueger et al. , 2020 ) . Improving the robustness of deep neural networks has been one of the crucial research topics , with various different threads of research , including adversarial robustness ( Goodfellow et al. , 2014 ; Szegedy et al. , 2013 ) , non-adversarial robustness ( Hendrycks & Dietterich , 2019 ; Yin et al. , 2019 ) , Bayesian deep learning ( Neal , 2012 ; Gal , 2016 ) and causality ( Arjovsky et al. , 2019 ) . In this paper , we focus on the adversarial robustness where adversarial examples are carefully manipulated by human to drastically fool the machine learning models , e.g. , deep neural networks , posing a serious threat especially on safety-critical applications . Currently , adversarial training ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ; Ding et al. , 2018 ) is regarded as one promising and widely accepted strategy to address this issue . However , similar to Out-of-Distribution ( OoD ) robustness , one crucial issue is that adversarial robustness also has many aspects ( Hendrycks et al. , 2020 ) , mainly including sensitivity-based robustness ( Tramèr et al. , 2020 ) , i.e . robustness against pixel-wise perturbations ( normally within the constraints of an lp ball ) , and spatial robustness , i.e. , robustness against multiple spatial transformations . Firstly , in the computer vision and graphics literature , there are two main factors that determine the appearance of a pictured object ( Xiao et al. , 2018 ; Szeliski , 2010 ) : ( 1 ) the lighting and materials , and ( 2 ) geometry . Most previous adversarial robustness focus on the ( 1 ) factor ( Xiao et al. , 2018 ) based on pixel-wise perturbations , e.g. , Projected Gradient Descent ( PGD ) attacks , assuming the underlying geometry stays the same after the adversarial perturbation . The other rising research branch tackled with the second factor , such as Flow-based ( Xiao et al. , 2018 ) and RotationTranslation ( RT ) -based attacks ( Engstrom et al. , 2017 ; 2019 ) . Secondly , by explicitly exploring the human perception , Sharif et al . ( 2018 ) pointed out that sensitivity-based robustness , i.e. , lp-distance measured robustness , is not sufficient to adversarial robustness in order to maintain the perceptual similarity . This is owing to the fact that although spatial attacks or geometric transformations also result in small perceptual differences , they yield large lp distances . In order to head towards the comprehensive adversarial robustness , we find that the crucial issue to investigate the aforementioned whole part of adversarial robustness is the relationships among accuracy , sensitivity-based robustness and spatial robustness . Prior to our work , a clear trade-off between sensitivity-based robustness and accuracy has been revealed by a series of works ( Zhang et al. , 2019 ; Tsipras et al. , 2018 ; Raghunathan et al. , 2020 ) . Besides , recent work ( Tramèr & Boneh , 2019 ; Kamath et al. , 2020 ) exhibited that there seems to exist an obscure trade-off between RotationTranslation and sensitivity-based robustness . However , this conclusion lacks considering Flowbased attacks ( Xiao et al. , 2018 ; Zhang & Wang , 2019 ) , another non-negligible part in the spatial robustness evaluation , making the previous conclusion less comprehensive or reliable . As such , the comprehensive relationships among all the quantities mentioned above are still unclear and remain to be further explored . More importantly , new robust strategy that can harmonize all the considered correlations is needed , in order to achieve optimal balance within the comprehensive robustness . In this paper , in order to design a new approach towards comprehensive robustness , we firstly explore the two main branches in the spatial robustness , i.e. , Flow-based spatial attack ( Xiao et al. , 2018 ) and Rotation-Translation ( RT ) attack ( Engstrom et al. , 2019 ) . By investigating the different impacts of these two attacks on the spatial sensitivity , we propose an integrated differentiable spatial attack framework , considering both local and global spatial vulnerability . Based on that , we present a comprehensive relationship among accuracy , sensitivity-based robustness and two branches of spatial robustness . Especially we show that the trade-off between sensitivity-based and RT robustness is fundamental trade-off as opposed to the highly interwoven correlation between sensitivity-based and Flow-based spatial robustness . We further provide strong evidence based on their different saliency maps from the perspectives of shape-bias , sparse or dense representation . Lastly , to balance these different kinds of mutual impacts within a unified adversarial training framework , we introduce the Pareto criterion ( Kim & De Weck , 2005 ; 2006 ; Zeleny , 2012 ) in the multi-objective optimization , thus developing an optimal balance between the interplay of natural accuracy and different adversarial robustness . By additionally incorporating the two-moment term capturing the interaction between losses of accuracy and different robustness , we finally propose a bi-level optimization framework called Pareto Adversarial Training . The resulting Pareto front provides the set of optimal solutions that balance perfectly all the considered relationships , outperforming other existing strategies . Our contributions are summarized as follows : • We propose an integrated spatial attack framework that incorporates both local and global spatial vulnerability based on Flow-based and RT attacks , paving the way towards the comprehensive spatial robustness analysis in the future . • We present comprehensive relationships within accuracy , sensitivity-based , different spatial robustness , supported by strong evidence from the perspective of representation . • We incorporate the Pareto criterion into adversarial robustness analysis , and are the first attempt to consider multiple adversarial robustness via the multi-objective optimization . 2 TOWARDS COMPREHENSIVE SPATIAL ROBUSTNESS . 2.1 MOTIVATION . In order to better investigate the relationships between accuracy and different kinds of adversarial robustness , we need to firstly provide a fine-grained understanding of spatial robustness , which has been less studied as opposed to sensitivity-based robustness . We summarize two major branches among a flurry of related work about spatial robustness ( Engstrom et al. , 2017 ; 2019 ; Xiao et al. , 2018 ; Zhang & Wang , 2019 ; Tramèr & Boneh , 2019 ; Kamath et al. , 2020 ) : ( 1 ) Flow-based Attacks , and ( 2 ) Rotation-Translation ( RT ) Attacks . Specifically , we find that the former mainly focuses on the local spatial vulnerability while the latter tends to capture the global spatial sensitivity . Our motivation is to firstly shed light on the fundamental difference between these two approaches , and then propose an integrated spatial robustness evaluation metric . 2.2 INTEGRATED SPATIAL ATTACK : COMBING LOCAL AND GLOBAL SPATIAL SENSITIVITY . Local Spatial Robustness : Flow-based Attacks The most representative Flow-based Attack is Spatial Transformed Attack ( Xiao et al. , 2018 ) , in which a differentiable flow vector wF = ( ∆µ , ∆v ) is defined in the 2D coordinate ( µ , v ) to craft adversarial spatial transformation . The vanilla targeted Flow-based attack ( Xiao et al. , 2018 ) ( κ = 0 ) follows the optimization manner : w∗F = arg min wF max i6=t f iθ ( xwF ) − f tθ ( xwF ) + τLflow ( wF ) , ( 1 ) where fθ ( x ) = ( f1θ ( x ) , . . . , f K θ ( x ) ) is the classifier in the K-classification problem . xwF is Flowbased adversarial example parameterized by flow vector wF . Lflow measures the local smoothness of spatial transformation further balanced by τ . Interestingly , in our empirical study shown in the left part of Figure 1 , we find that Flow-based attack tends to yield local permutations among pixels in some specific regions irrespective of the option of τ , rather than the global spatial transformation based on their shapes . We analyze that this phenomenon is owing to two factors : 1 ) Local permutations , especially in regions where colors of pixels change dramatically , are already sufficiently sensitive to manipulate , demonstrated by our empirical results shown above . 2 ) The optimization manner does not incorporate any sort of shape transformation information , e.g. , a parameter equation of rotation , as opposed to vanilla RotationTranslation attack , which we present in the following . Thus , Flow-based attacks tend to capture the local spatial vulnerability . Further , for the need to design the integrated spatial attack , we transform Eq 1 into its untargeted version under cross entropy loss with flow vector bounded by an F -ball : w∗F = arg max wF LCEθ ( xwF , y ) s.t . ‖wF ‖ ≤ F ( 2 ) where LCEθ ( x , y ) = log ∑ j exp ( f jθ ( x ) ) − fyθ ( x ) . One difference compared with Eq . 1 is that we replace local smoothness term Lflow with our familiar lp constraint . Moreover , vanilla Flowbased attack ( Xiao et al. , 2018 ) follows the max operation suggested in ( Carlini & Wagner , 2017 ) . However we leverage cross entropy loss instead in pursuit of a uniform optimization form in our integrated spatial attack . Proposition 1 reveals the correlation between the two loss , indicating that the smooth approximation version ofmax operation in Eq . 1 , denoted as LSθ , has a parallel updating direction with Cross Entropy loss regarding wF . Proof can be found in Appendix A.2 . Proposition 1 . For a fixed ( xwF , y ) and θ , consider LSθ ( x , y ) = log ∑ i 6=y exp ( f iθ ( x ) ) − fyθ ( x ) , the smooth version loss of Eq . 1 without local smoothness term , then we have ∇wFLCEθ ( xwF , y ) = r ( xwF , y ) ∇wFLSθ ( xwF , y ) , where r ( xwF , y ) = ∑ i6=y exp ( f iθ ( xwF ) ) ∑ i exp ( f iθ ( xwF ) ) . ( 3 ) Global Spatial Robustness : Rotation-Translation ( RT ) -based Attacks The original RotationTranslation attack ( Engstrom et al. , 2017 ; 2019 ) applies parameter equations constraint on the 2D coordinate , thus capturing the global spatial information : [ u′ v′ ] = [ cos θ − sin θ sin θ cos θ ] · [ u v ] + [ δu δv ] . ( 4 ) To design a generic spatial transformation matrix that can simultaneously consider rotation , translation , cropping and scaling , we re-parameterize the transform matrix as a generic 6-dimensional affine transformation matrix , inspired by ( Jaderberg et al. , 2015 ) : [ u′ v′ ] = ( [ 1 0 0 0 1 0 ] + [ w11RT w 12 RT w 13 RT w21RT w 22 RT w 23 RT ] ) · [ u v 1 ] , ( 5 ) where we denote AwRT as the generic 6-dimensional affine transformation matrix , in which each wRT indicates the increment on different spatial aspects . For example , ( w13RT , w 23 RT ) determines the translation . Finally , the optimization form of the resulting generic and differentiable RT-based attack bounded by RT -ball is exhibited as : w∗RT = arg max wRT LCEθ ( xwRT , y ) s.t . ‖wRT ‖ ≤ RT . ( 6 ) Integrated Spatial Robustness The key to achieve this goal is to design an integrated parameterized sampling grid TwRT , wF ( G ) that can warp the regular grid with both affine and flow transformation , where G is the generated grid . We show our integrated approach as follows : TwRT , wF ( G ) = AwRT [ u v 1 ] + [ wF 1 ] , xadv = TwRT , wF ( G ) ◦ x . ( 7 ) Then we sample new xadv by TwRT , wF ( G ) via differentiable bilinear interpolation ( Jaderberg et al. , 2015 ) . Then the loss function of the differentiable integrated spatial attack can be presented as : w∗ = arg max w LCEθ ( x+ ηw , y ) , s.t . ‖w‖ ≤ , ( 8 ) where w = [ wF , wRT ] T and ηw is the crafted integrated spatial perturbation . Note that ηw itself does not necessarily satisfy the lp constraint directly . For the implementation , we follow the PGD procedure ( Madry et al. , 2017 ) , a common practice in sensitivity-based attacks . We consider the infinity norm of w and different learning rates for the two sorts of spatial robustness : [ wt+1F wt+1RT ] = [ wtF wtRT ] + [ αF αRT ] clip ( sign ( ∇wLCEθ ( xtwt , y ) ) ) , xt+1wt+1 = Twt+1 ( G ) ◦ x t wt , ( 9 ) where we denote wt+1 = [ wt+1F , w t+1 RT ] T and = [ F , RT ] T . From Figure 1 , we can observe that our Integrated Spatial Attack can construct both local and global spatial transformations on images . Then , we visualize the loss surface under this Integrated Spatial Attack leveraging “ filter normalization ” ( Li et al. , 2018 ) as illustrated in Figure 2 . It is worth noting that the highly nonconcave loss landscape with respect to only rotation and translation raised by ( Engstrom et al. , 2019 ) has been largely alleviated by considering both local and global spatial vulnerability , verifying the efficiency of our Integrated Spatial Attack . Remote-look of Initial Landscape Close-look of Initial Landscape Landscape around the maxima example

Summary: This paper first provides explanations to the inherent tradeoff between rotation adversarial attack and sensitivity attacks/spatial transform attacks, through their differences in saliency maps. Further, the authors proposed to utilize pareto training to find the best tradeoff among the four dimensions: natural accuracy, robustness against sensitivity/rotation/spatial transformation attacks. Experimental results show the proposed pareto adversarial training achieves better tradeoff between clean accuracy and adversarial robustness averaged across three types of attacks.