Adversarial Robustness with Semi-Infinite Constrained Learning

1 Introduction . Learning is at the core of many modern information systems , with wide-ranging applications in clinical research [ 1–4 ] , smart grids [ 5–7 ] , and robotics [ 8–10 ] . However , it has become clear that learning-based solutions suffer from a critical lack of robustness [ 11–17 ] , leading to models that are vulnerable to malicious tampering and unsafe behavior [ 18–22 ] . While robustness has been studied in statistics for decades [ 23–25 ] , this issue has been exacerbated by the opacity , scale , and non-convexity of modern learning models , such as convolutional neural network ( CNNs ) . Indeed , the pernicious nature of these vulnerabilities has led to a rapidly-growing interest in improving the so-called adversarial robustness of modern ML models . To this end , a great deal of empirical evidence has shown adversarial training to be the most effective way to obtain robust classifiers , wherein models are trained on perturbed samples rather than directly on clean data [ 26–31 ] . While this approach is now ubiquitous in practice , adversarial training faces two fundamental challenges . ⋆ Alexander Robey and Luiz F. O. Chamon contributed equally to this work . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . Firstly , it is well-known that obtaining worst-case , adversarial perturbations of data is challenging in the context of deep neural networks ( DNNs ) [ 32 , 33 ] . While gradient-based methods have been shown to be empirically effective at finding perturbations that lead to misclassification , there are no guarantees that these perturbations are truly worst-case due to the non-convexity of most commonlyused ML function classes [ 34 ] . Moreover , whereas optimizing the parameters of a DNNs is typically an overparameterized problem , finding worst-case perturbations is severely underparametrized and therefore does not enjoy the benign optimization landscape of standard training [ 35–39 ] . For this reason , state-of-the-art adversarial attacks increasingly rely on heuristics such as random initializations , multiple restarts , pruning , and other ad hoc training procedures [ 40–49 ] . The second challenge faced by adversarial training is that it engenders a fundamental trade-off between robustness and nominal performance [ 50–52 ] . In practice , penalty-based methods that incorporate clean data into the training objective are often used to overcome this issue [ 53–56 ] . However , while empirically successful , these methods can not typically guarantee nominal or adversarial performance outside of the training samples . Indeed , classical learning theory [ 57 , 58 ] provides generalization bounds only for the aggregated objective and not each individual penalty term . Additionally , the choice of the penalty parameter is not straightforward and depends on the underlying learning task , making it difficult to transfer across applications and highly dependent on domain expert knowledge . Contributions . To summarize , there is a significant gap between the theory and practice of robust learning , particularly with respect to when and why adversarial training works . In this paper , we study the algorithmic foundations of robust learning toward understanding the fundamental limits of adversarial training . To do so , we leverage semi-infinite constrained learning theory , providing a theoretical foundation for gradient-based attacks and mitigating the issue of nominal performance degradation . In particular , our contributions are as follows : • We show that adversarial training is equivalent to a stochastic optimization problem over a specific , non-atomic distribution , which we characterize using recent non-convex duality results [ 59 , 60 ] . Further , we show that a myriad of previous adversarial attacks reduce to particular , sub-optimal choices of this distribution . • We propose an algorithm to solve this problem based on stochastic optimization and Markov chain Monte Carlo . Gradient-based methods can be seen as limiting cases of this procedure . • We show that our algorithm outperforms state-of-the-art baselines on MNIST and CIFAR-10 . In particular , our approach yields a ResNet-18 classifiers which simultaneously achieves greater than 50 % adversarial accuracy and greater than 85 % clean accuracy on CIFAR-10 , which represents a significant improvement over the previous state-of-the-art . • We provide generalization guarantees for the empirical version of this algorithm , showing how to effectively limit the nominal performance degradation of robust classifiers . 2 Problem formulation . Throughout this paper , we consider a standard classification setting in which the data is distributed according to an unknown joint distribution D over instance-label pairs ( x , y ) . In this setting , the instances x ∈ X are assumed to be supported on a compact subset of Rd , and each label y ∈ Y : = { 1 , . . . , K } denotes the class of a given instance x . By ( Ω , B ) we denote the underlying measurable space for this setting , where Ω = X ×Y and B denotes its Borel σ-algebra . Furthermore , we assume that the joint distribution D admits a density p ( x , y ) defined over the sets of B . At a high level , our goal is to learn a classifier which can correctly predict the label y of a corresponding instance x . To this end , we letH be a hypothesis class containing functions fθ : Rd → SK parameterized by vectors θ ∈ Θ ⊂ Rp , where we assume that the parameter space Θ is compact and by SK we denote the ( K − 1 ) -simplex . We also assume that fθ ( x ) is differentiable with respect to θ and x.1 To make a prediction ŷ ∈ Y , we assume that the simplex SK is mapped to the set of classes Y via ŷ ∈ argmaxk∈Y [ fθ ( x ) ] k with ties broken arbitrarily . In this way , we can think of the k-th output of the classifier as representing the probability that y = k. Given this notation , the statistical problem of learning a classifier that accurately predicts the label y of a given instance x 1Note that the classes of support vector machines , logistic classifiers , and convolutional neural networks ( CNNs ) with softmax outputs can all be described by this formalism . drawn randomly from D can be formulated as follows : min θ∈Θ E ( x , y ) ∼D [ ℓ ( fθ ( x ) , y ) ] . ( P-NOM ) Here ℓ is a [ 0 , B ] -valued loss function and ℓ ( · , y ) is M -Lipschitz continuous for all y ∈ Y . We assume that ( x , y ) 7→ ℓ ( fθ ( x ) , y ) is integrable so that the objective in ( P-NOM ) is well-defined ; we further assume that this map is an element of the Lebgesgue space Lp ( Ω , B , p ) for some fixed p ∈ ( 1 , ∞ ) . Formulating the robust training objective . For common choices of the hypothesis class H , including DNNs , classifiers obtained by solving ( P-NOM ) are known to be sensitive to small , normbounded input perturbations [ 61 ] . In other words , it is often straightforward to find a relatively small perturbations δ such that the classifier correctly predicts the label y of x , but misclassifies the perturbed sample x+ δ . This has led to increased interest in the robust analog of ( P-NOM ) , namely , P ⋆R ≜ min θ∈Θ E ( x , y ) ∼D [ max δ∈∆ ℓ ( fθ ( x+ δ ) , y ) ] . ( P-RO ) In this optimization program , the set ∆ ⊂ Rd denotes the set of valid perturbations2 . Typically , ∆ is chosen to be a ball with respect to a given metric on Euclidean space , i.e. , ∆ = { δ ∈ Rd : ∥δ∥ ≤ ϵ } . However , in this paper we make no particular assumption on the specific form of ∆ . In particular , our results apply to arbitrary perturbation sets , such as those used in [ 62–66 ] . Analyzing conditions under which ( P-RO ) can be ( probably approximately ) solved from data remains an active area of research . While bounds on the Rademacher complexity [ 67 , 68 ] and VC dimension [ 67–71 ] of the robust loss ℓadv ( fθ ( x ) , y ) = max δ∈∆ ℓ ( fθ ( x+ δ ) , y ) ( 1 ) have been derived for an array of losses ℓ and hypothesis classesH , there are still open questions on the effectiveness and sample complexity of adversarial learning [ 68 ] . Moreover , because in general the map δ 7→ ℓ ( fθ ( x+ δ ) , y ) is non-concave , evaluating the maximum in ( 1 ) is not straightforward . To this end , the most empirically effective strategy for approximating the robust loss is to leverage the differentiability of modern ML models with respect to their inputs . More specifically , by computing gradients of such models , one can approximate the value of ( 1 ) using projected gradient ascent . For instance , in [ 27 , 72 ] an perturbation δ is computed for a fixed parameter θ and data point ( x , y ) by repeatedly applying δ ←Π∆ [ δ + η sign [ ∇δ ℓ ( fθ ( x+ δ ) , y ) ] ] , ( 2 ) where Π∆ denotes the projection onto ∆ and η > 0 is a fixed step size . This idea is at the heart of adversarial training , in which ( 2 ) is iteratively applied to approximately evaluate the robust risk in the objective of ( P-RO ) ; the parameters θ can then be optimized with respect to this robust risk . Common pitfalls for adversarial training . Their empirical success notwithstanding , gradient-based approaches to adversarial training are not without drawbacks . One pitfall is the fact that gradient-based algorithms are not guaranteed to provide optimal ( or even near-optimal ) perturbations , since x 7→ ℓ ( fθ ( x ) , y ) is typically not a concave function . Because of this , heuristics [ 73 , 74 ] are often needed to improve the solutions obtained from ( 2 ) . Furthermore , adversarial training often degrades the performance of the model on clean data [ 52 , 75 , 76 ] . In practice , penalty-based approaches are used to empirically overcome this issue [ 53 ] , although results are not guaranteed to generalize outside of the training sample . Indeed , classical learning theory guarantees generalization in terms of the aggregated objective and not in terms of the robustness requirements it may describe [ 57 , 58 , 60 ] . In the remainder of this paper , we address these pitfalls by leveraging semi-infinite constrained learning theory . To do so , we explicitly formulate the problem of finding the most robust classifier among those that have good nominal performance . Next , we show that ( P-RO ) is equivalent to a stochastic optimization problem that can be related to numerous adversarial training methods ( Section 3 ) . We then provide generalization guarantees for the constrained robust learning problem when solve using empirical ( unconstrained ) risk minimization ( Section 4 ) . Finally , we derive an algorithm based on a Langevin MCMC sampler of which ( 2 ) is a particular case ( Section 5 ) . 2Note that fθ must now be defined on X ⊕∆ , where ⊕ denotes the Minkowski ( set ) sum . In a slight abuse of notation , we will refer to this set as X from now on .

Summary: The paper provided a novel connection between the well-known adversarial training problem and a statistical problem over perturbation distributions. The former requires obtaining worst-case adversarial perturbations of a neural network as an inner optimization procedure, which has been known as a challenging task. The later can avoid this but needs to solve a new inner optimization over perturbation distributions instead. The authors demonstrated that the statistical problem recovered several existing adversarial training problems with sub-optimal perturbation distributions. Inspired by this connection, the paper introduced an alternative adversarial training algorithm that used a smoothed version of the optimal perturbation distribution and showed that the proposed algorithm can achieve competitive or even better performance compared to previous approaches in terms of empirical adversarial robustness (evaluated using empirical attacks) on image classification tasks such as MNIST and CIFAR-10.