Adversarial training with perturbation generator networks

1 INTRODUCTION . Deep learning has shown the impressive performance in all areas of artificial intelligence , such as image classification and speech recognition ( Hinton et al. , 2012 ; Krizhevsky et al. , 2012 ) . These advances lead to a broad application of deep neural networks in various real-life tasks . There are still , however , severe security issues such as adversarial examples , which hinder the use of machine learning system until a complete defense is constructed against multiple adversarial attacks . Adversarial examples are data samples that are close to real data samples , which cause a given neural network to misclassify . The basic idea of adversarial examples is to find a sample that increases the loss value of a neural network in the neighborhood of training data ( Szegedy et al. , 2014 ) . The perturbation on the original training data is so small that it makes the adversarial examples indistinguishable from the original examples . Many authors proposed methods that make neural networks robust to adversarial examples ( Papernot et al. , 2016 ; Goodfellow et al. , 2015 ; Szegedy et al. , 2014 ; Miyato et al. , 2016 ) . One of the methods is an adversarial training , which re-trains the neural network with adversarial examples generated by adversarial attacks . Adversarial training with powerful attacks would guarantee robustness , but the recent fatal attack methods ( Szegedy et al. , 2014 ; Papernot et al. , 2016 ; Carlini & Wagner , 2017 ; Moosavi-Dezfooli et al. , 2016 ) require high computational complexity because of their iterative optimization . Therefore , they are not compatible with adversarial training . Methods that quickly produce adversarial examples , such as fast gradient sign ( Goodfellow et al. , 2015 ) or projected gradient descent ( Kurakin et al . ( 2017 ) ; Madry et al . ( 2018 ) ) , have been used for practical adversarial training . While the above adversarial training methods are empirically successful , they might be susceptible to future attackers , and this makes the defense procedure useless . If an algorithm for generating an adversarial example is fixed in adversarial training , the network could overfit to the specific algorithm . In this paper , we introduce a novel adversarial training framework that increases the robustness against various adversarial attacks . Stemming from GAN framework , we devised a method in which the classifier network and a perturbation generator network are alternately trained . To be more specific , the generator network generates a perturbation image that maximizes the loss function of the classifier network , and the classifier network is trained through the corresponding adversarial image with the true label . Through this minimax optimization between the two networks , the classifier network can improve robustness against many different attacks , as the attack pattern of the generator network is constantly modified depending on the classifier network . This procedure can be used in practical adversarial training since adversarial perturbations can be produced by a forwardpropagation . We generalized Madry et al . ( 2018 ) ’ s research on adversarial loss to theoretically support our technique , and we also proposed a method that can fairly evaluate the performance of adversarial training algorithms . 2 RELATED WORKS . The goal of our work is to construct defensive mechanisms to adversarial attacks . To alleviate the security problem , the adversarial robustness of neural networks has been studied in the literature . One of the intuitive ways to increase robustness is to re-train with adversarial examples , which are called adversarial training . This method uniformly smoothen the ground-truth label decision region close to the original data points . In the context of smoothness , there exists adversarial examples that hold very low confidence on the ground-truth label in the vanilla decision region before applying robust optimization . Szegedy et al . ( 2014 ) first proposed a method to generate adversarial examples . They use boxconstraint L-BFGS optimization to find the examples . This holds the exact formulation of adversarial examples , but because of its exhausted optimization procedure , it is not suitable for practical adversarial training . Goodfellow et al . ( 2015 ) introduced an algorithm that quickly generates adversarial examples by using one-step gradient update , which is called fast gradient sign method . In addition , they first proposed a realistic adversarial training method which injects the adversarial examples into the training data . This method is not strong enough to generate high-quality examples and is far from robust optimization . Kurakin et al . ( 2017 ) suggested an iterative version of fast gradient method ( FGM ) attack called Projected Gradient Descent ( PGD ) , which is much closer to the optimal adversarial examples . Adversarial training can be formulated with the robust optimization problem which minimizes the loss of the optimal adversarial examples in the -ball of all the original data points . This gives rise to the following minimax game , which is the main theoretical background of our work : min θ ρ ( θ ) , where ρ ( θ ) = E ( x , y ) ∼D [ max δ∈S L ( θ , x+ δ , y ) ] . ( 1 ) They approximated the above minimax game by PGD based adversarial training to reduce computational complexity issue . The gradient descent based adversarial examples for robust optimization is not adaptive . Therefore , those neural networks are vulnerable to other types of adversarial attacks ( Athalye et al. , 2018 ) . Several works studied the methods that generate stronger adversarial attacks ( Athalye et al. , 2018 ; Lee et al. , 2017 ; Papernot et al. , 2017 ; Moosavi-Dezfooli et al. , 2016 ; Dong et al. , 2018 ; Song et al. , 2018 ) . Carlini & Wagner ( 2017 ) pin-points that defensive distillation network ( Papernot et al . ( 2016 ) ) is not practical in that it exploits gradient masking , so they devised a powerful attack algorithm that avoids this problem . In an attempt to eliminate the gradient masking problem of softmax function , they adopted logitsZ in objective function , and discovered an appropriate adversarial noise for each image utilizing line-search technique . However , most of these works have high computational cost , so they are difficult to be applied to adversarial training . There are many other defense methods that are not based on adversarial training ( Li et al. , 2019 ; , Junbo ) . The above robust optimization problem can be generalized as convex outer adversarial polytope , which relaxes the activation function as a convex form to prevent misclassification ( Wong & Kolter , 2018 ) . Certified defense algorithms guarantee at least a certain bounds of the proper label probability distributions against adversarial examples ( Cohen et al. , 2019 ; Liu et al. , 2019 ; Raghu- nathan et al. , 2018 ) . In addition , some researchers recently studied the theoretical backgrounds of adversarial robustness ( Dohmatob , 2019 ; Wang et al. , 2018 ; Roth et al. , 2019 ) . 3 PROPOSED METHOD . 3.1 NOTATIONS . We denote a labeled training set by ( x , y ) ∼ Pdata , where x ∈ RH×W×C represents input images with height H , width W , and channel C , and y ∈ { 1 , 2 , . . . , K } is a label for an input x . We use two neural networks in the proposed method . One is a standard K-class classifier network F ( x ; θ ) which is defined by : F : RH×W×C → RK , F ( x ; θ ) = [ F ( x ; θ ) 1 , Fθ ( x ; θ ) 2 , . . . , F ( x ; θ ) K ] T ( 2 ) Where F ( x ; θ ) represents the class probability vector computed using the softmax function . The other is a perturbation generating network G ( ∇xF , x , y ; φ ) , which is defined by : G : ( RH×W×C , RH×W×C , R ) → RH×W×C ( 3 ) Note that G ( ∇xF , x , y ; φ ) represents the perturbation of the input image x , where ∇xF = ∇xF ( x ; θ ) y denotes the gradient of class probability of the true label with respect to the input images x . 3.2 ADVERSARIAL TRAINING WITH GENERATIVE MODEL . The entire procedure of our algorithm is shown in Figure 1 . Goodfellow ’ s work on GAN inspired us to make the classifier and the perturbation generator compete with each other . Classifier F defines the network we are aiming to train and increase the robustness , and the perturbation generator G is the network which produces the perturbations that maximize the loss function of the classifier . The classifier network is trained with adversarial images produced by the generator network with the true label . The generator network assigns image x , label y , and a gradient image ∇xF as inputs , which is trained to maximize the loss function of the classifier . In other words , F and G play the following two-player minimax game : Ex , y∼Pdata min θ max φ [ Loss ( x+G ( ∇xF , x , y ; φ ) , y ; θ ) − cL‖G ( ∇xF , x , y ; φ ) ‖22 ] ( 4 ) By the time this minimax game is complete , the classifier will have been trained with various attacks produced by the generator with the enhanced robustness against powerful adversarial attacks , while the generator will no longer find any vulnerability in the classifier , therefore only producing random noises . In Equation ( 4 ) , cL is a hyper-parameter that adjusts the ratio between two cost functions . If cL is very low , it will only find trivial solutions with extremely large perturbation power , and if cL is very high , it will only generate zero-perturbation images . Therefore , it is crucial to determine an appropriate cL . The theoretical meaning of cL will be discussed in Appendix A . We believe that the strength of our algorithm is the flexibility of the generator ’ s attack method . Conventional adversarial training algorithms such as FGM have a fixed attack method . For example , adversarial perturbation in FGM is generated by normalizing the gradient of a data sample , which is scaled by . A classifier can be easily made robust against adversarial examples generated by these fixed methods . The following are two possible methods . CASE 1 . The classifier is trained to gradually reduce the gradient at data points . Gradually reducing the gradient prevents FGM from generating meaningful adversarial example from the gradient ( also known as a gradient masking problems ) . CASE 2 . The classifier can only be trained to reduce the loss under the surface of the -norm ball centered around a data point . As a result , the network would be robust against adversarial examples generated by FGM , but could still be very vulnerable against adversarial examples located inside the -norm ball . Through the above methods , a classifier can be easily overfit to FGM attacks , but it becomes more vulnerable to other powerful attacks such as Carlini & Wagner L2 attacks as shown in Figure 2 . Through our experiments under FGM adversarial training , we observed a CASE 1 overfitting problem when is small , and a CASE 2 overfitting problem when is large . The above gradient masking problem has also been discussed by other papers on adversarial training ( Tramèr et al. , 2018 ) . This problem also occurs when the iteration number of PGD is relatively low . On the other hand , our algorithm continuously updates the parameters of a generator to maximize the classifier loss , which tends to produce more general attacks to a given classifier . This means that a classifier can not easily overfit to attacks from a generator in our method . Experimental results also support our arguments .

Summary: This paper introduces a new adversarial training approach, where a generator is used to generate the most challenging adversarial examples and the classifier is trained to correctly classify the generated adversarial examples. In this way, the robustness of the classifier is expected to be improved. For the generator, the input includes the original data sample, the gradient of the classifier, and the true label of the data sample. The paper is clearly presented and easy to follow. The experimental results relatively support the main claims of the paper.