Adversarial Robustness without Adversarial Training: A Teacher-Guided Curriculum Learning Approach

1 Introduction . Ever since deep neural network ( DNN ) models have emerged as the de facto technique to be applied for many vision problems , adversarial robustness has emerged as a critical need . Goodfellow et al . [ 1 ] identified this serious issue to show very different predictive behavior of a DNN model with similar looking images . Many efforts have followed since either to come up with fooling techniques [ 1 , 2 , 3 , 4 , 5 , 6 ] or defend deep models against them [ 3 , 7 , 8 , 9 , 10 , 11 , 12 , 13 , 14 , 15 , 16 , 17 , 18 , 19 , 20 , 21 , 22 , 23 , 24 , 25 , 26 ] . Nevertheless , both these research directions are important at this moment and require more attention . In this work , our effort lies on devising an adversarially robust training technique . Adversarial training ( AT ) [ 3 ] is the most widely used method for adversarial robustness and most of the improvements have since come by adding regularizers without changing the min-max formulation . The regularizers are added either in the inner maximization [ 27 , 8 , 15 ] or outer minimization [ 19 , 14 ] term . Though AT-based methods are shown to perform well , they incur additional cost due to an iterative inner maximization step . Our proposed robust training method circumvents this fundamental issue . With an objective of not following the costly min-max optimization of AT , we revisit adversarial robustness in terms of standard model training . Adversarially robust models are shown to satisfy ∗equal contribution 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . better alignment between saliency and object features in [ 28 ] . We enforce such alignment through training to achieve model robustness . This is accomplished by forcing saliency of the main model to follow the object features , provided by saliency of a pre-trained reference model . We hypothesize that perturbing only the most discriminative part of an image should trigger a model to change its decision about that image . In other words , perturbing other non-important pixels shouldn ’ t affect model decision , and such a model can achieve adversarial robustness . This approach is achieved by progressively narrowing the object-discriminative region according to its importance in a curriculum learning sense and forcing an adversary to perturb only those pixels while changing model ’ s decision . A model trained with this approach restricts the perturbation only to the object pixels when attacked . This diminishes the range of possible perturbations and limits the attack strength , reducing the chance of the model to change its decision for the perturbed image . Being a non-iterative method , our approach not only takes considerably less time for training compared to AT , but also outperforms iterative methods ( such as [ 3 , 7 , 8 , 27 , 16 , 13 , 14 , 11 , 12 , 17 , 15 ] ) and non-iterative methods ( such as [ 29 , 10 , 9 , 18 ] ) significantly in both natural and adversarial accuracies . Our key contributions are summarized as below . • We propose a non-iterative novel robust training method , which outperforms recently proposed SOTA techniques , irrespective of their type being iterative or non-iterative , in terms of both natural and adversarial accuracies against a wide range of attacks . • Being a non-iterative method makes it easily applicable to any large dataset to achieve an adversarially robust model . Our method takes 10-20 % of time compared to any adversarial training technique . • Our method attains a clean accuracy which is much closer to the performance of naturally trained models compared to other robust models . • We perform extensive experimentation on CIFAR-10 , CIFAR-100 , TinyImageNet datasets and report comparative results against all other , including recently proposed , adversarial robustness techniques . We also present various studies in detail to analyze the effectiveness of our method . 2 Background . Adversarial robustness : Naturally trained deep models are shown to be fooled easily by image perturbations which are human-imperceptible [ 1 ] . Extra measures need to be taken to make them adversarially robust when they stick to their decision even an image is perturbed . Consider an image classifier F ( x ; θ ) : x −→ Rc with parameters θ , that maps input image x to a c-dimensional output . The network f is called adversarially robust if : argmax i∈c fi ( x ; θ ) = argmax i∈c fi ( x+ δ ; θ ) ( 1 ) where δ ∈ B ( ) i.e . δ : ||δ||p ≤ . Adversarial training ( AT ) : AT [ 3 ] was proposed for achieving robustness against adversarial examples , which is represented as the below loss function : L ( x , y ) = E ( x , y ) D [ max δ∈B ( ) L ( x+ δ , y ) ] ( 2 ) δ is found by projected gradient descent ( PGD ) which is given by the iterative gradient step as below : δ ←− proj [ δ − ηsign ( ∇δL ( x+ δ , y ) ) ] ( 3 ) where Proj ( x ) = argmin e∈B ( ) ||x − e|| . Effectively , AT is comprised of an inner maximization which generates a perturbed image within an ball and the outer minimization tunes the model parameters based on the perturbed images . 3 Related Work . Robust model training . Many efforts on making DNN models adversarially robust have been proposed in the last few years and shown to perform well against adversarial attacks . [ 27 ] proposed TRADES , which perturbs an image by maximizing the L2 distance of the logits and used that as a regularizer to smoothen the decision boundary . Misclassification Aware adveRsarial Training ( MART ) [ 14 ] , on the other hand , treats the misclassified examples differently and adds a regularizer term to weight them by the misclassification score for better robustness . Recently , [ 13 ] found a strong positive correlation between robust generalization gap and flatness of weight loss landscape . This motivated an Adversarial Weight Perturbation ( AWP ) mechanism which adversarially perturbs both inputs and weights in the adversarial training framework to regularize the flatness of weight loss landscape . Zhang et al proposed Geometry aware Instance Reweighted adversarial training ( GAIRAT ) [ 16 ] method , which assigns larger weights on the losses of adversarial data , whose natural counterparts are closer to the decision boundary . Contrastively , GAIRAT gives smaller weights on the losses of adversarial data , whose natural counterparts are further away from the decision boundary . Curriculum learning-based adversarial training . A few recent works have modified the adversarial training strategy incorporating a curriculum learning strategy . Curriculum Adversarial Training ( CAT ) [ 11 ] proposed a curriculum-based adversarial training strategy by progressively increasing the number of PGD steps during training . [ 12 ] proposed a dynamic training strategy to gradually increase the convergence quality of the generated adversarial examples , and also a method to quantitatively evaluate the convergence quality of adversarial examples motivated by the Frank-Wolfe optimality gap . [ 17 ] tried to employ the fact that , during initial phase of training , fitting with most difficult adversarial data makes the learning extremely hard for DNNs . They hence proposed Friendly Adversarial Training ( FAT ) , adhering to the spirit of curriculum learning , which learns initially from the least adversarial and progressively utilizes increasingly more adversarial data . Another recent method Adversarial Training with Early Stopping ( ATES ) [ 15 ] proposed curriculum loss as the inner maximization step which depends on a difficulty parameter that are gradually increased as the training progresses . Our method is very different from these methods on how the curriculum learning strategy is employed . Non-iterative adversarial robustness training . There are very few efforts in devising a robust model through a non-iterative approach that differs from AT [ 3 ] . [ 30 ] showed that models trained using single-step adversarial training methods are susceptible to multi-step white box attacks , such as PGD [ 3 ] . Recently , [ 22 ] proposed a single-step adversarial training method using Dropout Scheduling , which improves adversarial robustness against multi-step white box attacks and achieves par results compared to [ 3 ] . But all these single-step adversarial robustness methods still lag far behind current state-of-the-art ( SOTA ) methods that use the Adversarial Training framework . In terms of methods that use saliency , Jacobian Adversarially Regularized Network ( JARN ) [ 10 ] improves model robustness by matching the gradient of loss w.r.t . the attacked image to the actual image . A very similar method was proposed by [ 9 ] which employs a discriminator to compare between the Jacobian and the image saliency , while JARN [ 10 ] compares the image to the transformed version of the Jacobian through an adaptive network . Our method differs from these as we enforce localization of saliency ( w.r.t true class score ) and restrict the perturbation set to pixels of the most discriminative part of the object . We explain our proposed method in detail below . 4 Methodology . Adversarial robustness targets to improve model robustness against adversarially perturbed images . Also for adversarially robust models , attribution maps tend to align more to actual image compared to naturally trained models . We study this connection below . Robustness and alignment : For an n-class classifier F ( x ) = argmax i Ψi ( x ) where Ψ = ( Ψ1 , ... , Ψn ) : X −→ Rn be differentiable in x . Then we call ∇ΨF ( x ) the saliency map of F and the alignment [ 28 ] with respect to Ψ in x is represented by α ( x ) : = |〈x , ∇ΨF ( x ) ( x ) 〉| ||∇ΨF ( x ) ( x ) || ( 4 ) Connection of robustness with alignment was studied in [ 28 ] . This connection is specifically formalized in Theorem 2 , which states that a network ’ s linearized robustness ( ρ̂ ) around an input x is upper bounded by the binarized alignment term α+ as : ρ̂ ( x ) ≤ α+ ( x ) + C ||g|| ( 5 ) Here C is a constant , the linearized robustness ρ̂ ( x ) is given by ρ̂ ( x ) : = min j 6=i∗ Ψi∗ ( x ) −Ψj ( x ) ||∇Ψi∗ ( x ) −∇Ψj ( x ) || ( 6 ) Also , g is the Jacobian of the top two logits i.e . g = ∇ ( Ψi∗ ( x ) −Ψj∗ ( x ) ) and binarized alignment i.e . α+ is given by α+ ( x ) = |〈x , ∇ ( Ψi∗ −Ψj∗ ) ( x ) 〉| ||∇ ( Ψi∗ −Ψj∗ ) ( x ) || ( 7 ) Here j∗ is the minimizer of Eqn 6 . We also have α ( x ) = α+ ( x ) for linear model and binary classifier . Eqn 5 explains the deviation of different terms for linearized robustness in case of neural network . Also , a small error term in Eqn 5 implies that robust networks yield better alignment i.e . more interpretable saliency maps . Adversarial robustness can also be viewed from an angle where an image can be perturbed , to change the model decision , only through perturbing the pixels of the object and not through any pixel outside of the object in the image . We incorporate these ideas through our two-phase training method to achieve an adversarially robust model . Current methods for adversarial robustness in literature have two key drawbacks : ( a ) Adversarially robust models are shown to perform poorly on clean data . There exists a clear trade-off between adversarial and natural accuracies which is explored in [ 31 ] . ( b ) Almost all SOTA adversarial robustness methods rely on iterative adversarial training frameworks , which makes them very costly to apply . In the proposed method , we aim to solve both these issues , as the model , trained by our method , pushes the bar of both adversarial accuracy and natural accuracy . At the same time , our training strategy does not rely on the iterative adversarial training framework , and thus is very fast .

Summary: The paper proposes an AT based defense method, which only focuses on the salient image regions to perturb and attack. Saliency is computed from a pertained teacher model; and is gradually reduced during the training (hence the name curriculum learning). A two phase approach is proposed: phase-1 computes the saliency map; and phase-2 generates adversaries by altering the salient pixels only (by gradually reducing the salient pixels from 90% upto 50%). Experiments are given on CIFAR-10/100 and TinyImageNet.