MMA Training: Direct Input Space Margin Maximization through Adversarial Training

1 INTRODUCTION Despite their impressive performance on various learning tasks , neural networks have been shown to be vulnerable to adversarial perturbations ( Szegedy et al. , 2013 ; Biggio et al. , 2013 ) . An artificially constructed imperceptible perturbation can cause a significant drop in the prediction accuracy of an otherwise accurate network . The level of distortion is measured by the magnitude of the perturbations ( e.g . in ` ∞ or ` 2 norms ) , i.e . the distance from the original input to the perturbed input . Figure 1 shows an example , where the classifier changes its prediction from panda to bucket when the input is perturbed from the blue sample point to the red one . Figure 1 also shows the natural connection between adversarial robustness and the margins of the data points , where the margin is defined as the distance from a data point to the classifier ’ s decision boundary . Intuitively , the margin of a data point is the minimum distance that x has to be perturbed to change the classifier ’ s prediction . Thus , the larger the margin is , the farther the distance from the input to the decision boundary is , the more robust the classifier is w.r.t . this input . Although naturally connected to adversarial robustness , “ directly ” maximizing margins has not yet been thoroughly studied in the adversarial robustness literature . Instead , the method of minimax adversarial training ( Huang et al. , 2015 ; Madry et al. , 2017 ) is arguably the most common defense to adversarial perturbations due to its effectiveness and simplicity . Adversarial training attempts to minimize the maximum loss within a fixed sized neighborhood about the training data using projected gradient descent ( PGD ) . Despite advancements made in recent years ( Hendrycks et al. , 2019 ; Zhang et al. , 2019a ; Shafahi et al. , 2019 ; Zhang et al. , 2019b ; Stanforth et al. , 2019 ; Carmon et al. , 2019 ) , adversarial training still suffers from a fundamental problem , the perturbation length has to be set and is fixed throughout the training process . In general , the setting of is arbitrary , based on assumptions on whether perturbations within the defined ball are “ imperceptible ” or not . Recent work ( Guo et al. , 2018 ; Sharma et al. , 2019 ) has demonstrated that these assumptions do not ∗Work done at Borealis AI . consistently hold true , commonly used settings assumed to only allow imperceptible perturbations in fact do not . If is set too small , the resulting models lack robustness , if too large , the resulting models lack in accuracy . Moreover , individual data points may have different intrinsic robustness , the variation in ambiguity in collected data is highly diverse , and fixing one for all data points across the whole training procedure is likely suboptimal . Instead of improving adversarial training with a fixed perturbation magnitude , we revisit adversarial robustness from the margin perspective , and propose Max-Margin Adversarial ( MMA ) training for “ direct ” input margin maximization . By directly maximizing margins calculated for each data point , MMA training allows for optimizing the “ current robustness ” of the data , the “ correct ” at this point in training for each sample individually , instead of robustness w.r.t . a predefined magnitude . While it is intuitive that one can achieve the greatest possible robustness by maximizing the margin of a classifier , this maximization has technical difficulties . In Section 2 , we overcome these difficulties and show that margin maximization can be achieved by minimizing a classification loss w.r.t . model parameters , at the “ shortest successful perturbation ” . This makes gradient descent viable for margin maximization , despite the fact that model parameters are entangled in the constraints . We further analyze adversarial training ( Huang et al. , 2015 ; Madry et al. , 2017 ) from the perspective of margin maximization in Section 3 . We show that , for each training example , adversarial training with fixed perturbation length is maximizing a lower ( or upper ) bound of the margin , if is smaller ( or larger ) than the margin of that training point . As such , MMA training improves adversarial training , in the sense that it selects the “ correct ” , the margin value for each example . Finally in Section 4 , we test and compare MMA training with adversarial training on MNIST and CIFAR10 w.r.t . ` ∞ and ` 2 robustness . Our method achieves higher robustness accuracies on average under a variety of perturbation magnitudes , which echoes its goal of maximizing the average margin . Moreover , MMA training automatically balances accuracy vs robustness while being insensitive to its hyperparameter setting , which contrasts sharply with the sensitivity of standard adversarial training to its fixed perturbation magnitude . MMA trained models not only match the performance of the best adversarially trained models with carefully chosen training under different scenarios , it also matches the performance of ensembles of adversarially trained models . In this paper , we focus our theoretical efforts on the formulation for directly maximizing the input space margin , and understanding the standard adversarial training method from a margin maximization perspective . We focus our empirical efforts on thoroughly examining our MMA training algorithm , comparing with adversarial training with a fixed perturbation magnitude . 1.1 RELATED WORKS . Although not often explicitly stated , many defense methods are related to increasing the margin . One class uses regularization to constrain the model ’ s Lipschitz constant ( Cisse et al. , 2017 ; Ross & Doshi-Velez , 2017 ; Hein & Andriushchenko , 2017 ; Sokolic et al. , 2017 ; Tsuzuku et al. , 2018 ) , thus samples with small loss would have large margin since the loss can not increase too fast . If the Lipschitz constant is merely regularized at the data points , it is often too local and not accurate in a neighborhood . When globally enforced , the Lipschitz constraint on the model is often too strong that it harms accuracy . So far , such methods have not achieved strong robustness . There are also efforts using first-order approximation to estimate and maximize input space margin ( Matyasko & Chau , 2017 ; Elsayed et al. , 2018 ; Yan et al. , 2019 ) . Similar to local Lipschitz regularization , the reliance on local information often does not provide accurate margin estimation and efficient maximization . Such approaches have also not achieved strong robustness so far . Croce et al . ( 2018 ) aim to enlarge the linear region around a input example , such that the nearest point , to the input and on the decision boundary , is inside the linear region . Here , the margin can be calculated analytically and hence maximized . However , the analysis only works on ReLU networks , and the implementation so far only works on improving robustness under small perturbations . We defer some detailed discussions on related works to Appendix B , including a comparison between MMA training and SVM . 1.2 NOTATIONS AND DEFINITIONS . We focus on K-class classification problems . Denote S = { xi , yi } as the training set of inputlabel data pairs sampled from data distribution D. We consider the classifier as a score function fθ ( x ) = ( f1θ ( x ) , . . . , f K θ ( x ) ) , parametrized by θ , which assigns score f iθ ( x ) to the i-th class . The predicted label of x is then decided by ŷ = arg maxi f iθ ( x ) . Let L01θ ( x , y ) = I ( ŷ 6= y ) be the 0-1 loss indicating classification error , where I ( · ) is the indicator function . For an input ( x , y ) , we define its margin w.r.t . the classifier fθ ( · ) as : dθ ( x , y ) = ‖δ∗‖ = min ‖δ‖ s.t . δ : L01θ ( x+ δ , y ) = 1 , ( 1 ) where δ∗ = arg minL01θ ( x+δ , y ) =1 ‖δ‖ is the “ shortest successful perturbation ” . We give an equivalent definition of margin with the “ logit margin loss ” LLMθ ( x , y ) = maxj 6=y f j θ ( x ) − f y θ ( x ) . 1 The level set { x : LLMθ ( x , y ) = 0 } corresponds to the decision boundary of class y . Also , when LLMθ ( x , y ) < 0 , the classification is correct , and when LLMθ ( x , y ) ≥ 0 , the classification is wrong . Therefore , we can define the margin in Eq . ( 1 ) in an equivalent way by LLMθ ( · ) as : dθ ( x , y ) = ‖δ∗‖ = min ‖δ‖ s.t . δ : LLMθ ( x+ δ , y ) ≥ 0 , ( 2 ) where δ∗ = arg minLLMθ ( x+δ , y ) ≥0 ‖δ‖ is again the “ shortest successful perturbation ” . For the rest of the paper , we use the term “ margin ” to denote dθ ( x , y ) in Eq . ( 2 ) . For other notions of margin , we will use specific phrases , e.g . “ SLM-margin ” or “ logit margin . ” 2 MAX-MARGIN ADVERSARIAL TRAINING . We propose to improve adversarial robustness by maximizing the average margin of the data distribution D , called Max-Margin Adversarial ( MMA ) training , by optimizing the following objective : min θ { ∑ i∈S+θ max { 0 , dmax − dθ ( xi , yi ) } + β ∑ j∈S−θ Jθ ( xj , yj ) } , ( 3 ) where S+θ = { i : LLMθ ( xi , yi ) < 0 } is the set of correctly classified examples , S − θ = { i : LLMθ ( xi , yi ) ≥ 0 } is the set of wrongly classified examples , Jθ ( · ) is a regular classification loss function , e.g . cross entropy loss , dθ ( xi , yi ) is the margin for correctly classified samples , and β is the coefficient for balancing correct classification and margin maximization . Note that the margin dθ ( xi , yi ) is inside the hinge loss with threshold dmax ( a hyperparameter ) , which forces the learning to focus on the margins that are smaller than dmax . Intuitively , MMA training simultaneously minimizes classification loss on wrongly classified points in S−θ and maximizes the margins of correctly classified points in dθ ( xi , yi ) until it reaches dmax . Note that we do not maximize margins on wrongly classified examples . Minimizing the objective in Eq . ( 3 ) turns out to be a technical challenge . While ∇θJθ ( xj , yj ) can be easily computed by standard back-propagation , computing the gradient of dθ ( xi , yi ) needs some technical developments . In the next section , we show that margin maximization can still be achieved by minimizing a classification loss w.r.t . model parameters , at the “ shortest successful perturbation ” . For smooth functions , a stronger result exists : the gradient of the margin w.r.t . model parameters can be analytically calculated , as a scaled gradient of the loss . Such results make gradient descent viable for margin maximization , despite the fact that model parameters are entangled in the constraints .

Summary: This paper proposes a method, Max-Margin Adversarial (MMA) training, for robust learning against adversarial attacks. In the MMA, the margin in the input space is directly maximized. In order to alleviate an instability of the learning, a softmax variant of the max-margin is introduced. Moreover, the margin-maximization and the minimization of the worst-case loss are studied. Some numerical experiments show that the proposed MMA training is efficient against several adversarial attacks.