Towards Defending Multiple Adversarial Perturbations via Gated Batch Normalization

1 INTRODUCTION . Deep neural networks ( DNNs ) have achieved remarkable performance across a wide areas of applications ( Krizhevsky et al. , 2012 ; Bahdanau et al. , 2014 ; Hinton et al. , 2012 ) , but they are susceptible to adversarial examples ( Szegedy et al. , 2013 ) . These elaborately designed perturbations are imperceptible to humans but can easily lead DNNs to wrong predictions , threatening both digital and physical deep learning applications ( Kurakin et al. , 2016 ; Liu et al. , 2019a ) . To improve model robustness against adversarial perturbations , a number of adversarial defense methods have been proposed ( Papernot et al. , 2015 ; Engstrom et al. , 2018 ; Goodfellow et al. , 2014 ) . Many of these defense methods are based on adversarial training ( Goodfellow et al. , 2014 ; Madry et al. , 2018 ) , which augment training data with adversarial examples . However , most adversarial defenses are designed to counteract a single type of perturbation ( e.g. , small ` ∞-noise ) ( Madry et al. , 2018 ; Kurakin et al. , 2017 ; Dong et al. , 2018 ) . These defenses offer no guarantees for other perturbations ( e.g. , ` 1 , ` 2 ) , and sometimes even increase model vulnerability ( Kang et al. , 2019 ; Tramèr & Boneh , 2019 ) . To address this problem , other adversarial training strategies have been proposed with the goal of simultaneously achieving robustness against multiple types of attacks , i.e. , ` ∞ , ` 1 , and ` 2 attacks ( Tramèr & Boneh , 2019 ; Maini et al. , 2020 ) . Although these methods improve overall model robustness against adversarial attacks in multiple ` p balls , the performance for each individual perturbation type is still far from satisfactory . In this work , we propose the multi-domain hypothesis , which states that different types of adversarial perturbation arise in different domains , and thus have separable characteristics . Training on data from multiple domains can be regarded as solving the invariant risk minimization problem ( Ahuja et al. , 2020 ) , in which an invariant predictor is learnt to achieve the minimum risk for different environments . For a deep learning model , instance-related knowledge can be stored in the weight matrix 1Our code will be available upon publication . of each layer , whereas domain-related knowledge can be represented by the batch normalization ( BN ) layer statistics ( Li et al. , 2017 ) . Inspired by the multi-domain hypothesis , we propose to improve model robustness against multiple perturbation types by separating domain-specific information for different perturbation types , and using BN layer statistics to better align data from the mixture distribution and learn domain-invariant representations for multiple adversarial examples types . In particular , we propose a novel building block for DNNs , referred to as Gated Batch Normalization ( GBN ) , which consists of a gated subnetwork and a multi-branch BN layer . GBN first learns to separate perturbations from different domains on-the-fly and then normalizes them by obtaining domain-specific features . Specifically , each BN branch handles a single perturbation type ( i.e. , domain ) . Then , features computed from different branches are aligned as domain-invariant representations that are aggregated as the input to subsequent layers . Extensive experiments on MNIST , CIFAR-10 , and Tiny-ImageNet demonstrate that our method outperforms previous defense strategies by large margins , i.e. , 10-20 % . 2 BACKGROUND AND RELATED WORK . In this section , we provide a brief overview of existing work on adversarial attacks and defenses , as well as batch normalization techniques . 2.1 ADVERSARIAL ATTACKS AND DEFENSES . Adversarial examples are inputs intentionally designed to mislead DNNs ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ) . Given a DNN fΘ and an input image x ∈ X with the ground truth label y ∈ Y , an adversarial example xadv satisfies fΘ ( xadv ) 6= y s.t . ‖x− xadv‖ ≤ , where ‖ · ‖ is a distance metric . Commonly , ‖ · ‖ is measured by the ` p-norm ( p ∈ { 1,2 , ∞ } ) . Various defense approaches have been proposed to improve model robustness against adversarial examples ( Papernot et al. , 2015 ; Xie et al. , 2018 ; Madry et al. , 2018 ; Liao et al. , 2018 ; Cisse et al. , 2017 ) , among which adversarial training has been widely studied and demonstrated to be the most effective ( Goodfellow et al. , 2014 ; Madry et al. , 2018 ) . Specifically , adversarial training minimizes the worst case loss within some perturbation region for classifiers , by augmenting the training set { x ( i ) , y ( i ) } i=1 ... n with adversarial examples . However , these defenses only improve model robustness for one type of perturbation ( e.g. , ` ∞ ) and typically offer no robustness guarantees against other attacks ( Kang et al. , 2019 ; Tramèr & Boneh , 2019 ; Schott et al. , 2019 ) . To address this problem , recent works have attempted to improve the robustness against several types of perturbation ( Schott et al. , 2019 ; Tramèr & Boneh , 2019 ; Maini et al. , 2020 ) . Schott et al . ( 2019 ) proposed Analysis by Synthesis ( ABS ) , which used multiple variational autoencoders to defend ` 0 , ` 2 , and ` ∞ adversaries . However , ABS only works on the MNIST dataset . Croce & Hein ( 2020a ) proposed a provable adversarial defense against all ` p norms for p ≥1 using a regularization term . However , it is not applicable to the empirical setting , since it only guarantees robustness for very small perturbations ( e.g. , 0.1 and 2/255 for ` 2 and ` ∞ on CIFAR-10 ) . Tramèr & Boneh ( 2019 ) tried to defend against multiple perturbation types ( ` 1 , ` 2 , and ` ∞ ) by combining different types of adversarial examples for adversarial training . Specifically , they introduced two training strategies , “ MAX ” and “ AVG ” , where for each input image , the model is either trained on its strongest adversarial example or all types of perturbations . More recently , Maini et al . ( 2020 ) proposed multi steepest descent ( MSD ) , and showed that a simple modification to standard PGD adversarial training improves robustness to ` 1 , ` 2 , and ` ∞ adversaries . In this work , we follow ( Tramèr & Boneh , 2019 ; Maini et al. , 2020 ) to focus on defense against ` 1 , ` 2 , and ` ∞ adversarial perturbations , which are the most representative and commonly used perturbations . However , we propose a completely different perspective and solution to the problem . 2.2 BATCH NORMALIZATION . BN ( Ioffe & Szegedy , 2015 ) is typically used to stabilize and accelerate DNN training . Let x ∈ Rd denote the input to a neural network layer . During training , BN normalizes each neuron/channel within m mini-batch data by x̂j = BN ( xj ) = γj xj − µj√ σ2j + ξ + βj , j = 1 , 2 , ... , d , ( 1 ) where µj = 1m ∑m i=1 x ( i ) j and σ 2 j = 1 m ∑m i=1 ( x ( i ) j − µj ) 2 are the mini-batch mean and variance for each neuron , respectively , and ξ is a small number to prevent numerical instability . The learnable parameters γ and β are used to recover the representation capacity . During inference , the population statistics of mean µ̂ and variance σ̂2 are used in Eqn . 1 , which are usually calculated as the running average over different training iterations t with update factor α : µ̂t = ( 1− α ) µ̂t−1 + αµt−1 , ( σ̂t ) 2 = ( 1− α ) ( σ̂t−1 ) 2 + α ( σt−1 ) 2 . ( 2 ) A number of normalization techniques have been proposed to improve BN for style-transfer ( Huang & Belongie , 2017 ) and domain adaption ( Li et al. , 2017 ; Chang et al. , 2019 ; Deecke et al. , 2019 ) . Compared to studies for domain adaptation , our GBN does not require input domain knowledge during inference . In contrast to Mode Normalization ( Deecke et al. , 2019 ) , which aims to learn a mixture distribution for multi-task learning , GBN separates domain-specific statistics for different input types and then aligns the data to build domain-invariant representations . Recently , Xie & Yuille ( 2020 ) ; Xie et al . ( 2020 ) applied separate BNs to clean and adversarial examples for statistics estimation . In contrast to the above two studies that improve image recognition or analyze the properties of BN to adversarial training , we aim to defend against multiple adversarial perturbations . Furthermore , GBN can predict the domain for an input sample and then jointly incorporate the outputs of multiple BN branches to provide the final classification result . Conversely , Xie & Yuille ( 2020 ) ; Xie et al . ( 2020 ) manually selected the BN branch for each input image , which requires prior knowledge of whether the input is an adversarial or clean example ( the same as domain adaptation ) . 3 GATED BATCH NORMALIZATION . In this section , we present our proposed Gated Batch Normalization ( GBN ) approach , to improve the model robustness against multiple adversarial perturbations . We first illustrate our multi-domain hypothesis , which states that adversarial examples of different perturbation types are drawn from different domains . Motivated by this hypothesis , we demonstrate the architecture of our GBN block , then describe the training and inference procedures . 3.1 MOTIVATION : MULTI-DOMAIN HYPOTHESIS . We assumeN adversarial perturbation types2 , each characterized by a set Sk of perturbations for an input x . Let D0 denote the set of clean examples , and Dk ( k = 1 , ... , N ) denote the set of adversarial examples generated by the k-th adversarial perturbation type Sk . An adversarial example of the k-th type xkadv is generated by the pixel-wise addition of the perturbation δ k , i.e. , xkadv = x + δ k. Our multi-domain hypothesis states that different types of perturbations Dk ( for all k ≥ 0 , including the clean examples ) are drawn from different domains , inspired by the following observations : ( 1 ) Training on a single perturbation type is insufficient for achieving the robustness against other perturbations . Further , training on a mixture of different perturbation types still fail to achieve acceptable performance for each type of perturbation ( Tramèr & Boneh , 2019 ; Maini et al. , 2020 ) . ( 2 ) Adversarial examples are separable from clean examples ( Metzen et al. , 2018 ) . Xie & Yuille ( 2020 ) also suggested that clean and adversarial examples are drawn from two different domains . We first empirically investigate the hypothesis for deep neural networks . Specifically , we train separate BNs for different input domains Dk ( k ≥ 0 ) . As illustrated in Figure 1 ( b ) , we construct separate mini-batches to estimate BN statistics for different Dk , i.e. , ` 1 , ` 2 , and ` ∞ adversarial images , as well as for clean images . We defer the implementation details to Appendix A . Figure 1 ( c ) and 1 ( d ) show that different Dk induce significantly different running statistics , according to the running means and variances of different BN branches . 2In this work , we consider N = 3 adversarial perturbation types : ` 1 , ` 2 and ` ∞ . We further theoretically demonstrate that for a linear classifier f ( x ) = sign ( wTx + b ) , different types of adversarial perturbations belong to different domains , with pair-wise Wasserstein distances greater than 0 ( c.f . Appendix B ) . These theoretical and empirical results support our multi-domain hypothesis , and motivate our design of GBN , as discussed below .

Summary: Existing defenses are usually robust against certain types of attacks. This paper proposes to build a defense against different types of norm-bounded attacks via gated batch normalization. This work treats different types of adversarial attacks as data from different domains and proposes to use gated batch normalization to improve the robustness across different domains. The idea is interesting. The result shows the effectiveness of the defense.