ALFA: Adversarial Feature Augmentation for Enhanced Image Recognition

1 INTRODUCTION . Neural networks often fall vulnerable when presented adversarial examples injected with imperceptible perturbations , and suffer significant performance drop when facing such attacks ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015b ) . Such susceptibility has motivated abundant studies on adversarial defense mechanisms for training robust neural networks ( Schmidt et al. , 2018 ; Sun et al. , 2019 ; Nakkiran , 2019 ; Stutz et al. , 2019 ; Raghunathan et al. , 2019 ) , among which adversarial training based methods ( Madry et al. , 2018b ; Zhang et al. , 2019a ) have achieved consistently superior robustness than others . The general focus of adversarial training is to enhance the robustness of gradient-based adversarial examples . A few recent studies ( Zhu et al. , 2020 ; Gan et al. , 2020 ) turn to investigate the generalization ability of adversarial training on language models . However , in-depth exploration of extending this to the vision domain is still missing . Xie et al . ( 2020 ) proposes to utilize adversarial examples with an auxiliary batch normalization to improve standard accuracy for image recognition , but it still suffers from expensive computational cost from the generation of pixel-level perturbations . To address this issue , we propose AdversariaL Feature Augmentation ( ALFA ) as a natural extension of adversarial training , with a focus on leveraging adversarial perturbations in the feature space to improve image recognition on clean data . As illustrated in Figure 1 , ALFA introduces adversarial perturbations to multiple intermediate layers . These perturbed feature embeddings act as a special feature augmentation and implicit regularization to enhance the generalization ability of deep neural networks . Consequently , two challenges arise : ( i ) how to efficiently find the best locations to introduce adversarial perturbations ; and ( ii ) how to decide on the strength of the created perturbations . Although a few recent works ( Zhu et al. , 2020 ; Gan et al. , 2020 ; Sankaranarayanan et al. , 2017 ) look into this field , they either add perturbations in the input embeddings or all the intermediate features , yet have not reached a coherent conclusion . To efficiently learn an optimal strategy of perturbation injection , we further propose a learnable adversarial feature augmentation ( L-ALFA ) framework , which is capable of automatically adjusting the position and strength of introduced feature perturbations . The proposed approach not only circumvents laborious hyper-parameter tuning , but also fully unleashes the power of adversarial feature augmentation . Experiments show that this strategy gains a substantial performance margin over existing feature augmentation methods ( Li et al. , 2020 ) . In addition , we find that learnable ALFA and exhaustively-tuned ALFA exhibit consistent patterns : applying weak adversarial feature augmentations to the last layers of deep neural networks can boost generalization performance . The main contributions are summarized as follows . ( i ) We introduce a new approach of adversarial feature augmentation ( ALFA ) to improve the generalization ability of neural networks , which applies adversarial perturbations to the feature space rather than raw image pixels . ( ii ) To tackle the dilemma of laborious hyper-parameter tuning in generating adversarial features , we propose learnable adversarial feature augmentation ( L-ALFA ) to automatically tailor target perturbations and their locations . ( iii ) Comprehensive experiments on CIFAR-10 , CIFAR-100 , and ImageNet datasets across multiple backbone networks demonstrate the superiority of the proposed methods . 2 RELATED WORK . Adversarial Training Deep neural networks are notoriously vulnerable to adversarial samples ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015b ) , which are crafted with malicious yet negligible perturbations ( Goodfellow et al. , 2015a ; Kurakin et al. , 2016 ; Madry et al. , 2018a ) . In order to improve the robustness against adversarial samples , various defense mechanisms have been proposed ( Zhang et al. , 2019a ; Schmidt et al. , 2018 ; Sun et al. , 2019 ; Nakkiran , 2019 ; Stutz et al. , 2019 ; Raghunathan et al. , 2019 ) . Among these works , adversarial-training-based methods ( Madry et al. , 2018b ; Zhang et al. , 2019a ) have achieved consistently superior performance in defending stateof-the-art adversarial attacks ( Goodfellow et al. , 2015a ; Kurakin et al. , 2016 ; Madry et al. , 2018a ) . Although adversarial training substantially improves model robustness , it usually comes at the price of compromising the standard accuracy ( Tsipras et al. , 2019 ) , which has been demonstrated both empirically and theoretically ( Zhang et al. , 2019a ; Schmidt et al. , 2018 ; Sun et al. , 2019 ; Nakkiran , 2019 ; Stutz et al. , 2019 ; Raghunathan et al. , 2019 ) . Recently , researchers start to investigate improving clean set accuracy with adversarial training ( Xie et al. , 2020 ; Zhu et al. , 2020 ; Wang et al. , 2019a ; Gan et al. , 2020 ; Wei & Ma , 2019 ) ( Ishii & Sato , 2019 ) . Xie et al . ( 2020 ) shows that performance on the clean dataset can be enhanced by using adversarial samples with pixel-level perturbation generation . Zhu et al . ( 2020 ) and Wang et al . ( 2019a ) apply adversarial training to natural language understanding and language modeling , both successfully achieving better standard accuracy . Gan et al . ( 2020 ) achieves similar success on many vision-and-language tasks . There also exist parallel studies that employ handcrafted or auto- generated perturbed features to ameliorate generalization ( Wei & Ma , 2019 ) ( Ishii & Sato , 2019 ) or robustness ( Sankaranarayanan et al. , 2017 ) . However , two key issues remain unexplored : ( i ) which layers to introduce adversarial feature augmentations ; ( ii ) how strong the perturbations should be . For the former , Zhu et al . ( 2020 ) ; Wang et al . ( 2019a ) ; Gan et al . ( 2020 ) try to perturb the input embeddings of transformer models , while Wei & Ma ( 2019 ) ; Sankaranarayanan et al . ( 2017 ) insert perturbations to all layers of a convolutional network . Regarding the above issue , all the methods need arduous and heuristic tunings . In our paper , we present a different observation that augmenting the last layers ’ feature embeddings with weak adversarial feature perturbations can gain higher standard accuracy . The L-ALFA framework inspired by this observation can effectively alleviate laborious tuning , which otherwise is inevitable . Feature Augmentation Although pixel-level data augmentation techniques ( Simard et al. , 1993 ; Schölkopf et al. , 1996 ) have been widely adopted , feature space augmentations have not received the same level of attention . A few pioneering works propose generative-based feature augmentation approaches for domain adaptation ( Volpi et al. , 2018 ) , imbalance classification ( Zhang et al. , 2019b ) , and few-shot learning ( Chen et al. , 2019 ) . Another loosely related field is feature normalization ( Ioffe & Szegedy , 2015 ; Li et al. , 2020 ) . MoEx ( Li et al. , 2020 ) is a newly proposed method that can be regarded as a feature augmentation technique , which leverages the first and second-order moments extracted and re-injected by feature normalization . It is worth mentioning that all the approaches aforementioned are orthogonal to our proposed method , and can be combined for further generalization improvement , which is left as future work . 3 ADVERSARIAL FEATURE AUGMENTATIONS ( ALFA ) . In the proposed ALFA framework , we generate adversarial perturbations in the intermediate feature embedding space , rather than applying perturbations to raw image pixels as in common practice . Thus , adversarial training can be formulated as an effective regularization to improve the generalization ability of deep neural networks . 3.1 NOTATIONS . Given a dataset D = { x , y } , where x is the input image and y is the corresponding one-hot groundtruth label . Let f ( x ; Θ ) represents predictions of a deep neural networks , and fi ( x ; Θ ( i ) ) |r+1i=1 is the intermediate feature embedding from the i-th layer . The ( r + 1 ) -th layer denotes the classifier , therefore fr+1 ( x ; Θ ( r+1 ) ) = f ( x ; Θ ) . Adversarial training can be formulated as the following min-max optimization problem : min Θ E ( x , y ) ∈D [ max ||δ||p≤ Lat ( f ( x + δ ; Θ ) ; Θ ; y ) ] , ( 1 ) where δ is the adversarial perturbation bounded by the ` p norm ball , which is centered at x with radius which is the maximum perturbation magnitude . Lat is the cross-entropy loss for adversarial training ( AT ) . E ( x , y ) ∈D takes the expectation over the empirical objective on the training dataset D. The inner optimization generates adversarial perturbation δ via maximizing the empirical objective . It can be reliably solved by multi-step projected gradient descent ( PGD ) ( Madry et al. , 2018b ) ( without loss of generality , we take || · ||∞ perturbation as an example ) : δt+1 = Π||δ||∞≤ [ δt + α · sgn ( ∇xLat ( f ( x + δt ; Θ ) ; Θ ; y ) ] , ( 2 ) where t is the number of steps , α denotes the learning rate of inner maximization , sgn is the sign function , and Lat is the adversarial training objective on adversarial images . 3.2 PERTURBATIONS IN THE EMBEDDING SPACE VIA ALFA . Here , we extend the conventional adversarial perturbations to the feature embedding space . We start from the training objective of ALFA as follows : min Θ E ( x , y ) ∈D [ Lstd ( x ; Θ ; y ) + λ · ∑ i max ||δ ( i ) ||∞≤ Lat ( fi ( x ; Θ ( i ) ) + δ ( i ) ; Θ ; y ) ] , ( 3 ) where Lstd is the cross-entropy ( XE ) loss on clean images , Lat here is the cross-entropy loss for adversarial training ( AT ) on adversarial augmented feature embeddings . λ is the hyperparamter to control the influence of AT regularization , which is tuned by grid search . δ ( i ) is the adversarial perturbation on the feature of layer i , generated as follows : δ ( i ) t+1 = Π||δ||∞≤ [ δ ( i ) t + α · sgn ( ∇xLat ( fi ( x ; Θ ( i ) ) + δ ( i ) t ; Θ ; y ) ) ] . ( 4 ) It is worth noting that , for crafting δ ( i ) , at each step , the gradient is only back-propagated to the i-th layer without going further , which is much more computationally efficient compared to generating perturbations in the input embedding space . In practice , we set the maximum magnitude of crafted feature perturbation to be unbounded , and the projected gradient descent will be replaced by gradient descent . In ALFA , the two most essential factors are : ( i ) where to introduce adversarial perturbations ; and ( ii ) how strong the perturbations should be . Table 1 and Figure 2 present some preliminary results to understand this . Results shows that the performance of ALFA relies particularly on the location ( i.e. , which blocks ) and strength ( i.e. , step size α ) of the introduced feature perturbations . An inadequate configuration ( e.g. , applying ALFA to all blocks 1 , 2 and 3 as shown in Figure 2 ) might cause accuracy degradation . More analyses are provided in Section 4.3 . To determine the best configuration , we further design a learnable adversarial feature augmentation ( L-ALFA ) approach to automatically adjusting the location and strength of perturbations for best augmentation performance , which will be explained in the next sub-section .

Summary: Overview of paper: this work tackles the task of adversarial augmentation for better generalization. Instead of augmentation the pixels space, which is expensive and potentially harder, they augment the intermediate feature representation. As the choice of the particular layer for application of the perturbations affects performance, the authors, optimize it jointly with the rest of the parameters. Experiments show this method  improves accuracy over standard training.