Understanding the robustness-accuracy tradeoff by rethinking robust fairness 

1 INTRODUCTION . 1.1 BACKGROUND . Deep neural networks ( DNNs ) have been proven to be vulnerable to the adversarial attacks , as demonstrated in ( Szegedy ; Goodfellow et al . ; Kurakin et al . ; Carlini & Wagner ) . By adding crafted imperceptible perturbations to the input , attackers can easily fool the model to give an incorrect prediction . To defend against adversarial attacks , tens of methods have been proposed , but most of them later proved to be ineffective ( Athalye et al. , 2018 ) . Among these many defense techniques , adversarial training ( AT ) ( Madry et al. , 2017 ) has been proven to be the most effective strategy against adversarial attacks . Although current AT algorithms can effectively improve model robustness , there are two confusing phenomena in AT models . First , there can be an inevitable robustness-accuracy tradeoff ( Tsipras et al. , 2018 ) in AT models in which increasing robustness is always accompanied by an accuracy drop . Second , recently Xu et al . ( 2021 ) found that AT tends to introduce severe disparities in accuracy and robustness between different classes . For example , as shown in Figure 1b , in a PGD-AT model ( Madry et al. , 2017 ) , both the accuracy and robustness of the 3rd class cat are much lower than those of the 1st class car , while the two classes have similar accuracies in the standard training model ( see Figure 1a ) . This phenomenon is defined as the robust fairness according to the authors . Additionally , as Xu et al . ( 2021 ) mentioned , the robust fairness problem is closely related to the robustness-accuracy tradeoff , because the average accuracy drop in the robustness-accuracy tradeoff could mainly come from the classes that are hard to classify in AT . To verify this , we have measured the accuracy drop for each class , and calculated their percentage in the total accuracy drop , as shown in Figure 1c . We can see that it only takes two classes ( the cat and bird ) to contribute almost half of the accuracy drop , while the two classes have the lowest accuracy and robustness than other classes in AT . That is , these hard classified classes have a significantly greater impact on the decline in accuracy , and to better understand the robustness-accuracy tradeoff , it should be determined why these classes are so difficult to classify in AT . To explain the phenomenon , Xu et al . ( 2021 ) argued that some classes are difficult to classify in AT because they are intrinsically “ harder ” to classify than other classes , and AT tends to hurt both accuracy and robustness of these “ hard ” classes . To verify this point of view , these authors studied the effect of AT on a binary classification task under a mixture Gaussian distribution , and the “ hard ” class is the one with larger variance in their case . They showed that AT will push the decision boundary closer to the larger variance class and further worsen both the accuracy and robustness of the class . However , although they showed that the class with a larger variance is more difficult to classify , there still remains a question ; that is , is variance enough to describe the “ hard ” degree of a class ? Imagine two Gaussian distributions both have a high variance , but also an extremely large difference of mean values , they should still be well classified . On the contrary , when the two Gaussian distributions both have a low variance , but the mean values of them are extremely similar , which makes the two distributions severely overlap , we can not satisfactorily classify them instead . That is , the inter-class similarity is also an important factor affecting the model ’ s accuracy . With this point in mind , we have measured both inter-class similarity and intra-class variance in standard training , PGD-AT and TRADES models ( Zhang et al. , 2019 ) for each class in the CIFAR10 test set , as shown in Figure 2 . The measurement is performed in the penultimate layer feature space . For each class , we use the variance of features as the class ’ s intra-class variance . To measure the inter-class similarity of each class , we first calculate the feature mean value vectors for all classes , and then the cosine similarity between the mean value vectors of the measured class and other classes . The largest cosine similarity is used as the inter-class similarity of the measured class in this paper . It is somewhat surprising to see that both PGD-AT and TRADES models have a lower variance than the standard training model in Figure 2b , while they have a worse accuracy instead . However , as shown in Figure 2a , both PGD-AT and TRADES can lead to a higher inter-class similarity than standard training . In particular , we notice that the “ hardest ” class cat does not have the largest variance no matter in PGD-AT , TRADES or the standard training model , but has the largest inter-class similarity . These observations have challenged Xu et al . ( 2021 ) ’ s theory that the “ hard ” classes are the large variance classes and indicate that inter-class similarity does matter in AT , thus motivated us to study both robust fairness phenomenon and robustness-accuracy tradeoff toward the increased inter-class similarity . 1.2 OUR CONTRIBUTIONS . Understand the robustness-accuracy tradeoff & robust fairness . To the best of our knowledge , we are the first to study the relationship between the robustness-accuracy tradeoff and the robust fairness , and we find that the two phenomena could both come from the increased inter-class similarity caused by AT . More specifically , through our single AT and binary classification AT experiments in section 2 , we find that : • AT will cause a general increase in inter-class similarity for each class , which even causes a feature overlap , and finally leads to the accuracy drop in the tradeoff . • The “ hard ” classes in AT are actually similar classes in standard training , and the increased inter-class similarity in AT makes them more similar and harder to be classified , which causes the robust fairness problem . Re-investigate the effect of smoothing regularizer in AT . Label smoothing ( LS ) ( Szegedy et al. , 2016 ) has been used as a trick to benchmark the robustness in AT by Pang et al . ( 2020 ) , however , we noticed that LS can not only help improve the robustness , but usually improve the accuracy too , which means a reduction in the robustness-accuracy tradeoff . In this paper , we find LS can help alleviate the tradeoff because it helps reduce the large inter-class similarity in AT , and also provides a lower intra-class variance . Then , we investigate the effect of the maximum entropy ( ME ) Pereyra et al . ( 2017 ) , which is also a classic smoothing regularizer , and we find ME can help reduce both inter-class similarity and intra-class variance too . In addition , we find that the state-of-the-art AT method TRADES can be seen as a special maximum entropy learning , which could explain why TRADES model have a lower intra-class variance than PGD-AT model in Figure 2 , and usually performs better than PGD-AT in terms of robustness . We proposed the maximum entropy PGD-AT ( ME-AT ) and the maximum entropy TRADES ( ME-TRADES ) , and experimental results show that our methods can significantly mitigate both tradeoff and robust fairness . 2 RETHINKING ROBUST FAIRNESS TOWARD INTER-CLASS SIMILARITY . In Figure 2a , we have shown that AT models have higher inter-class similarity than the standard training model . In this section , we design two experiments to see how the high inter-class similarity in AT is related to both the robustness-accuracy tradeoff and robust fairness phenomena . 2.1 SINGLE ADVERSARIAL TRAINING . AT causes a feature overlap . We design the single adversarial training ( single AT ) to see how AT affect one single class . In single AT , we only conduct adversarial training on one class while training other classes normally . For better visualization , we adjust the penultimate layer of a ResNet-18 model to output 2-D features . In Figure 3 , we show the single AT results of the two most representative classes : the “ hardest ” class cat and the “ easiest ” class car . The results of other classes and detailed settings are both provided in Appendix A.1 . In Figure 3b , when single adversarial train the 3rd class cat , the features of the cat severely overlap with those of the 5th class dog , and the overlapping features make the class cat almost impossible to classify ( only has 7.03 natural accuracy and 0 PGD-10 robustness ) . This observation intuitively shows how the inter-class similarity increases in AT , and proves that the accuracy drop part in the robustness-accuracy tradeoff could come from the increased inter-class similarity ( the overlapping features ) . The increase in inter-class similarity is general in AT . However , when single AT is carried out for the 1st class car , the features of the class car can still be split well from other classes , and both the accuracy and PGD-10 robustness of the class car achieve a high level ( 98.4 and 72.2 respectively , see Figure 3a ) . Does this mean that the “ easy ” classes can avoid an increase in inter-class similarity in AT ? To check this , we measure the inter-class similarity in the single AT models , and for comparison , we also measured the inter-class similarity of a standard training 2-D features ResNet-18 model . As shown in Figure 4 , each class in the blue line represents the inter-class similarity of the class in the corresponding single AT model ( e.g. , the point of the class car in the blue line represents the interclass similarity of the class car in the single car AT model ) , and the yellow line is the inter-class similarity of the standard training model . We can see that even the “ easiest ” class car in the single AT model can have a higher inter-class similarity than that in the standard training model . This observation turns out that the increase in inter-class similarity is general in AT for all classes . 2.2 BINARY CLASSIFICATION ADVERSARIAL TRAINING . “ Hard ” classes or similar classes ? Since the increase in inter-class similarity is general for all classes , we assume that some classes are difficult to classify in AT possibly because they are already similar in standard training , and the increased inter-class similarity caused by AT makes them more similar and become the “ hard ” classes . To verify this assumption , we conduct the binary classification AT experiments . We set the class cat to binary classify with other classes in CIFAR10 dataset , and we use both PGD-AT ( Madry et al. , 2017 ) and TRADES ( Zhang et al. , 2019 ) to train our binary classification ResNet-18 models ( 512-D features here ) . We plot the natural error and PGD-10 error of the PGD-AT and TRADES trained binary classification models in Figure 5a and Figure 5b respectively . Classes in the horizontal axis represent the classes that binary classified with the class cat , and is sorted from small to large by their similarity with the cat in standard training . We find that both natural error and PGD-10 error in the binary classification PGD-AT and TRADES models are highly positive correlated with the similarity in standard training . For example , the class car is the least similar class of the cat in standard training , when binary classified cat with the car , model can get both low natural error and PGD-10 error ( 4.6 and 11.0 ) ; However , when binary classified cat with the most similar class dog , the ResNet-18 model even failed to converge in PGD-AT ( 49.7 for both natural and PGD-10 error ) , and even model can converge in TRADES , it is also in both highest natural error and PGD-10 error ( 23.4 and 44.0 ) . This observation indicates that the “ hard ” classes in AT could actually be the similar classes in standard training .

Summary: This paper identifies how adversarial training (AT) algorithms for robustness may negatively affect the notion of robust fairness and proposes two methods ME-AT and ME-TRADES, which combine existing AT methods with a maximum entropy (ME) term, to improve the accuracy-robustness tradeoff and robustness fairness. Although AT algorithms improve model robustness, they also increase inter-class similarities, which make certain classes more difficult to classify, leading to unfair accuracies. The paper then shows that label smoothing (LS) mitigates this effect and in particular investigates the ME technique. The authors show that a method called TRADES outperforms another method called PGD-AT because it is a special version of ME. Experiments show that combining ME with these AT methods outperforms PGD-AT.