Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networks

1 Introduction . Neural network ( NN ) models have achieved state-of-the-art performance on several image tasks over the last few years . However , they have been known to be vulnerable to adversarial attacks that make small , imperceptible pixel-wise perturbations to images [ 39 , 5 ] . Most pixel-wise adversarial perturbations studied in previous work are carefully constructed , model-dependent and , in most cases also input-dependent , perturbations of small ` ∞ norm ( and sometimes ` 1 or ` 2 norm ) . To achieve adversarial robustness , a popular , principled , and effective defense against ` ∞ adversarial attacks known at present is adversarial training [ 17 , 29 , 37 , 49 ] . From another perspective , recent work has also shown natural , physical-world attacks on neural network models using 2D and 3D spatial transformations such as translations , rotations and pose [ 47 , 14 , 42 , 1 ] . Even random spatial transformations such as random translations and random rotations degrade the accuracy of neural network models considerably [ 12 ] . Recent benchmarks also measure the robustness of NN models to the average-case , model-agnostic perturbations ( e.g. , noise , blur , brightness , contrast ) or natural distribution shifts , and not only to the worst-case adversarial perturbations [ 21 , 40 ] . Spatial robustness or robustness to spatial transformations ( e.g. , translations , rotations ) has been long studied as a problem of model invariance , and is generally addressed using equivariant models or training augmentation . While standard Convolutional Neural Networks ( StdCNNs ) are translation-equivariant , recent efforts have resulted in equivariant NN models for other transformations such as rotation , flip [ 16 , 8 , 10 , 45 , 31 , 26 , 27 , 13 ] , and scaling [ 30 , 46 , 38 ] . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . Such group-equivariant NN models ( GCNNs ) are designed to be invariant to a specific group of transformations , so they need training augmentation to attain spatial robustness to random or averagecase transformations . However , aided by clever weight-sharing , these recent works have achieved good spatial robustness performance with lesser training augmentation than their non-equivariant counterparts . In this paper , we address an inevitable trade-off between the average-case spatial robustness and the worst-case ` ∞ adversarial robustness in neural network models , and show results theoretically as well as empirically . On the one hand , as we attain better spatial robustness via equivariant models and larger training augmentation , the adversarial robustness worsens . On the other hand , as we attain better adversarial robustness via adversarial training against larger pixel-wise perturbations , the spatial robustness worsens . We then provide a curriculum learning-based approach to mitigate this issue and achieve a certain degree of Pareto-optimality in this trade-off . Our work extends recent progress on two important questions , namely , the robustness to multiple attacks and the robustness vs accuracy trade-off . The robustness to translations ( up to ±3 pixels ) and rotations ( up to ±30◦ ) has been shown to have a fundamentally different loss landscape than the robustness to adversarial ` p perturbations [ 12 ] . A trade-off between robustness to adversarial ` ∞ perturbations and adversarial translations and rotations up to ±3 pixels and ±40◦ , respectively , was also recently noted [ 42 ] . Adversarial attacks on ` p adversarially robust models by exploiting invariance at intermediate layers have also been of interest in recent work [ 23 , 41 ] . A key difference of our work with these efforts is that : ( i ) we study spatial robustness to random translations and rotations ( which is more closely related to practice when training NN models and has not been studied in these earlier efforts ) , instead of adversarial translations or rotations ; ( ii ) we study spatial robustness w.r.t transformations over their entire range , and do not restrict ourselves to a ±30 − 40◦ range , for instance ; and ( iii ) we consider the use of group-equivariant models with training augmentation ( which are designed for spatial robustness ) in our studies , beyond just StdCNN models . Our results show a progressive decline in spatial robustness as adversarial robustness improves , and vice versa – a trend that was not explicitly noted in previous results . Our result can also be interpreted as a progressive trade-off between adversarial robustness and generalization accuracy itself [ 43 , 49 , 48 ] , where generalization performance measures accuracy on a test distribution that includes natural data augmentation such as random translations , rotations , etc . Given the nature of this trade-off , we then ask the question of how one can obtain a model close to the Pareto-optimal frontier for adversarial and random spatial robustness . Are there training strategies that can help achieve a balance between both ? We observe that the obvious solutions of training in two stages – first , adversarial training and then training augmentation by spatial transformations , or vice versa – does not help address this issue . This results in a version of catastrophic forgetting , where as the model learns robustness on one of these fronts , it loses robustness on the other . We instead show that a curriculum learning-based strategy , where the model is trained by applying an adversarial perturbation to a randomly transformed input with gradually increased difficulty levels , gives solutions consistently closer to the Pareto-optimal frontier across well-known datasets and models . This strategy reflects the progressive nature noted of the trade-off itself , and highlights the importance of the observation of this trend . Our key contributions can be summarized as follows : • We study a trade-off between adversarial robustness and spatial robustness ( with a focus on random spatial transformations ) both theoretically and empirically , on a setting closer to natural neural network training , which to the best of our knowledge , has not been considered before . We explain the trade-off between spatial and adversarial robustness with a well-motivated theoretical construction . • We conduct a comprehensive suite of experiments across popularly used models and datasets , and find that models trained for spatial robustness ( StdCNNs and GCNNs ) progressively improve spatial robustness when their training is augmented with larger random spatial transformations but while doing so , their ` ∞ adversarial robustness drops progressively . Similarly , models adversarially trained using progressively larger ` ∞-norm attacks improve their adversarial robustness but while doing so , their spatial robustness drops progressively . • We provide a simple yet effective approach based on curriculum learning that gives better-balanced , Pareto-optimal spatial and adversarial robustness compared to several natural baselines derived from combining adversarial training and training augmentation by random spatial transformations . 2 Problem Setting and Formulation . We begin by describing our problem formally . Let ( X , Y ) denote a random input-label pair from a given data distribution over the input-label pairs ( x , y ) ∈ X ×Y . Let f be a neural network classifier . The accuracy of f is given by Pr ( f ( X ) = Y ) , the fraction of inputs where the prediction matches the true label . For > 0 , an ` ∞ adversarial attack A maps each input x to x + A ( x ) such that ‖A ( x ) ‖∞ ≤ , for all x ∈ X . The fooling rate of A is given by Pr ( f ( X +A ( X ) ) 6= f ( X ) ) , the fraction of inputs where the prediction changes after adversarial perturbation . For a given spatial transformation T , the classifier f is said to be T -invariant if the predicted label remains unchanged after the transformation T for all inputs ; in other words , f ( Tx ) = f ( x ) , for all x ∈ X . The spatial transformations such as translation , rotation and flip preserve the ` ∞ norm , so TA ( x ) is an adversarial perturbation of small ` ∞ norm for the input Tx for a T -invariant classifier . Therefore , for a given perturbation bound > 0 , the maximum fooling rate for any T -invariant classifier f on the transformed data { Tx : x ∈ X } must be equal to the maximum fooling rate for f on the original data X . It is a bit more subtle when f is not truly invariant , that is , f ( Tx ) = f ( x ) for most inputs x but not all x . We define the rate of invariance of a classifier f to a transformation T as Pr ( f ( TX ) = f ( X ) ) or the fraction of test images whose predicted labels remain unchanged under the transformation T . For a class of transformations , e.g. , random rotation r from the range [ −θ◦ , +θ◦ ] , we define the rate of invariance as the average rate of invariance over transformations T in this class , i.e. , Pr ( f ( r ( X ) ) = f ( X ) ) , where the probability is over the random input X as well as the random transformation r. The rate of invariance is 100 % if the model f is truly invariant . When f is not truly invariant , the interplay between the invariance under transformations and robustness under adversarial perturbations of small ` ∞-norm is subtle . This interplay is exactly what we investigate . In this paper , we study neural network models and the simultaneous interplay between their spatial robustness , viz , rate of invariance for spatial transformations ( such as random rotations between [ −θ◦ , +θ◦ ] for θ varying in the range [ 0 , 180 ] ) , and their adversarial robustness to pixel-wise perturbations of ` ∞ norm at most . Measuring the robustness of a model to adversarial perturbations of ` p norm at most is NP-hard [ 24 , 37 ] . Previous work on the comparison of different adversarial attacks has shown the Projected Gradient Descent ( PGD ) attack to be among the strongest [ 2 ] . Hence , we use PGD-based adversarial training as the methodology for adversarial robustness in a model , as commonly done . We show that our conclusions also hold for other forms of adversarial training such as TRADES [ 49 ] , which gives a trade-off between adversarial robustness and natural accuracy ( on the original unperturbed data ) . Theoretically speaking , we prove a quantitative trade-off between spatial and adversarial robustness in a simple , natural statistical setting proposed in previous work [ 43 ] . Our theoretical results ( described in Sec 3 ) show that there is a trade-off between spatial and adversarial robustness , and that it is not always possible to have both in a given model . Empirically , we study the following : ( a ) change in ` ∞ adversarial robustness as we improve only the rate of spatial robustness using training augmentation with progressively larger transformations ; ( b ) change in spatial invariance as we improve only adversarial robustness using PGD adversarial training with progressively larger ` ∞-norm of pixelwise perturbations . We study StdCNNs , group-equivariant GCNNs , as well as popular architectures used to assess adversarial robustness [ 29 , 49 ] . Our empirical studies are conducted on MNIST , CIFAR10 , CIFAR100 as well as Tiny ImageNet datasets , thus showing the general nature of these results ( described in Sec 4 ) . Importantly , as stated earlier , we consider random spatial transformations that are more commonplace than adversarial rotations in previous work [ 42 ] . We look at the entire possible range for spatial transformations . Similarly , we normalize the underlying dataset , and compute the accuracy of a given model on test inputs adversarially perturbed using PGD attack of ` ∞ norm at most , for varying over [ 0 , 1 ] . In contrast with the certifiable lower bounds on robustness [ 3 , 15 , 35 , 28 , 32 ] , we study upper bounds on spatial and adversarial robustness , respectively .

Summary: This paper studies the properties of spatial and adversarial $\epsilon$-bounded robustness of convolutional neural networks. Throughout the paper, the authors focus on __random__ spatial transformations, as opposed to __targeted__ (adversarial) rotations/translations. Their key hypothesis is that spatial robustness and adversarial $\epsilon$-bounded robustness are inimical to each other, and increasing one must be at the cost of decreasing the other.  They derive theoretical results for a specific distribution, and derive upper and lower bounds for the spatial robustness of an adversarially trained network on this distribution. They also show that high accuracy on the original data does not imply high spatial robustness.  Through a set of elaborately designed experiments, they provide empirical evidence for their main hypothesis. Finally, they propose a curriculum-learning based approach to find a pareto-optimal solution that achieves the optimal trade-off between the two types of robustness.