Pareto Adversarial Robustness: Balancing Spatial Robustness and Sensitivity-based Robustness

1 INTRODUCTION . Robust generalization can serve as an extension of tradition generalization , i.e. , Empirical Risk Minimization in the case of i.i.d . data ( Vapnik & Chervonenkis , 2015 ) , where the test environments might differ slightly or dramatically from the training environment ( Krueger et al. , 2020 ) . Improving the robustness of deep neural networks has been one of the crucial research topics , with various different threads of research , including adversarial robustness ( Goodfellow et al. , 2014 ; Szegedy et al. , 2013 ) , non-adversarial robustness ( Hendrycks & Dietterich , 2019 ; Yin et al. , 2019 ) , Bayesian deep learning ( Neal , 2012 ; Gal , 2016 ) and causality ( Arjovsky et al. , 2019 ) . In this paper , we focus on the adversarial robustness where adversarial examples are carefully manipulated by human to drastically fool the machine learning models , e.g. , deep neural networks , posing a serious threat especially on safety-critical applications . Currently , adversarial training ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ; Ding et al. , 2018 ) is regarded as one promising and widely accepted strategy to address this issue . However , similar to Out-of-Distribution ( OoD ) robustness , one crucial issue is that adversarial robustness also has many aspects ( Hendrycks et al. , 2020 ) , mainly including sensitivity-based robustness ( Tramèr et al. , 2020 ) , i.e . robustness against pixel-wise perturbations ( normally within the constraints of an lp ball ) , and spatial robustness , i.e. , robustness against multiple spatial transformations . Firstly , in the computer vision and graphics literature , there are two main factors that determine the appearance of a pictured object ( Xiao et al. , 2018 ; Szeliski , 2010 ) : ( 1 ) the lighting and materials , and ( 2 ) geometry . Most previous adversarial robustness focus on the ( 1 ) factor ( Xiao et al. , 2018 ) based on pixel-wise perturbations , e.g. , Projected Gradient Descent ( PGD ) attacks , assuming the underlying geometry stays the same after the adversarial perturbation . The other rising research branch tackled with the second factor , such as Flow-based ( Xiao et al. , 2018 ) and RotationTranslation ( RT ) -based attacks ( Engstrom et al. , 2017 ; 2019 ) . Secondly , by explicitly exploring the human perception , Sharif et al . ( 2018 ) pointed out that sensitivity-based robustness , i.e. , lp-distance measured robustness , is not sufficient to adversarial robustness in order to maintain the perceptual similarity . This is owing to the fact that although spatial attacks or geometric transformations also result in small perceptual differences , they yield large lp distances . In order to head towards the comprehensive adversarial robustness , we find that the crucial issue to investigate the aforementioned whole part of adversarial robustness is the relationships among accuracy , sensitivity-based robustness and spatial robustness . Prior to our work , a clear trade-off between sensitivity-based robustness and accuracy has been revealed by a series of works ( Zhang et al. , 2019 ; Tsipras et al. , 2018 ; Raghunathan et al. , 2020 ) . Besides , recent work ( Tramèr & Boneh , 2019 ; Kamath et al. , 2020 ) exhibited that there seems to exist an obscure trade-off between RotationTranslation and sensitivity-based robustness . However , this conclusion lacks considering Flowbased attacks ( Xiao et al. , 2018 ; Zhang & Wang , 2019 ) , another non-negligible part in the spatial robustness evaluation , making the previous conclusion less comprehensive or reliable . As such , the comprehensive relationships among all the quantities mentioned above are still unclear and remain to be further explored . More importantly , new robust strategy that can harmonize all the considered correlations is needed , in order to achieve optimal balance within the comprehensive robustness . In this paper , in order to design a new approach towards comprehensive robustness , we firstly explore the two main branches in the spatial robustness , i.e. , Flow-based spatial attack ( Xiao et al. , 2018 ) and Rotation-Translation ( RT ) attack ( Engstrom et al. , 2019 ) . By investigating the different impacts of these two attacks on the spatial sensitivity , we propose an integrated differentiable spatial attack framework , considering both local and global spatial vulnerability . Based on that , we present a comprehensive relationship among accuracy , sensitivity-based robustness and two branches of spatial robustness . Especially we show that the trade-off between sensitivity-based and RT robustness is fundamental trade-off as opposed to the highly interwoven correlation between sensitivity-based and Flow-based spatial robustness . We further provide strong evidence based on their different saliency maps from the perspectives of shape-bias , sparse or dense representation . Lastly , to balance these different kinds of mutual impacts within a unified adversarial training framework , we introduce the Pareto criterion ( Kim & De Weck , 2005 ; 2006 ; Zeleny , 2012 ) in the multi-objective optimization , thus developing an optimal balance between the interplay of natural accuracy and different adversarial robustness . By additionally incorporating the two-moment term capturing the interaction between losses of accuracy and different robustness , we finally propose a bi-level optimization framework called Pareto Adversarial Training . The resulting Pareto front provides the set of optimal solutions that balance perfectly all the considered relationships , outperforming other existing strategies . Our contributions are summarized as follows : • We propose an integrated spatial attack framework that incorporates both local and global spatial vulnerability based on Flow-based and RT attacks , paving the way towards the comprehensive spatial robustness analysis in the future . • We present comprehensive relationships within accuracy , sensitivity-based , different spatial robustness , supported by strong evidence from the perspective of representation . • We incorporate the Pareto criterion into adversarial robustness analysis , and are the first attempt to consider multiple adversarial robustness via the multi-objective optimization . 2 TOWARDS COMPREHENSIVE SPATIAL ROBUSTNESS . 2.1 MOTIVATION . In order to better investigate the relationships between accuracy and different kinds of adversarial robustness , we need to firstly provide a fine-grained understanding of spatial robustness , which has been less studied as opposed to sensitivity-based robustness . We summarize two major branches among a flurry of related work about spatial robustness ( Engstrom et al. , 2017 ; 2019 ; Xiao et al. , 2018 ; Zhang & Wang , 2019 ; Tramèr & Boneh , 2019 ; Kamath et al. , 2020 ) : ( 1 ) Flow-based Attacks , and ( 2 ) Rotation-Translation ( RT ) Attacks . Specifically , we find that the former mainly focuses on the local spatial vulnerability while the latter tends to capture the global spatial sensitivity . Our motivation is to firstly shed light on the fundamental difference between these two approaches , and then propose an integrated spatial robustness evaluation metric . 2.2 INTEGRATED SPATIAL ATTACK : COMBING LOCAL AND GLOBAL SPATIAL SENSITIVITY . Local Spatial Robustness : Flow-based Attacks The most representative Flow-based Attack is Spatial Transformed Attack ( Xiao et al. , 2018 ) , in which a differentiable flow vector wF = ( ∆µ , ∆v ) is defined in the 2D coordinate ( µ , v ) to craft adversarial spatial transformation . The vanilla targeted Flow-based attack ( Xiao et al. , 2018 ) ( κ = 0 ) follows the optimization manner : w∗F = arg min wF max i6=t f iθ ( xwF ) − f tθ ( xwF ) + τLflow ( wF ) , ( 1 ) where fθ ( x ) = ( f1θ ( x ) , . . . , f K θ ( x ) ) is the classifier in the K-classification problem . xwF is Flowbased adversarial example parameterized by flow vector wF . Lflow measures the local smoothness of spatial transformation further balanced by τ . Interestingly , in our empirical study shown in the left part of Figure 1 , we find that Flow-based attack tends to yield local permutations among pixels in some specific regions irrespective of the option of τ , rather than the global spatial transformation based on their shapes . We analyze that this phenomenon is owing to two factors : 1 ) Local permutations , especially in regions where colors of pixels change dramatically , are already sufficiently sensitive to manipulate , demonstrated by our empirical results shown above . 2 ) The optimization manner does not incorporate any sort of shape transformation information , e.g. , a parameter equation of rotation , as opposed to vanilla RotationTranslation attack , which we present in the following . Thus , Flow-based attacks tend to capture the local spatial vulnerability . Further , for the need to design the integrated spatial attack , we transform Eq 1 into its untargeted version under cross entropy loss with flow vector bounded by an F -ball : w∗F = arg max wF LCEθ ( xwF , y ) s.t . ‖wF ‖ ≤ F ( 2 ) where LCEθ ( x , y ) = log ∑ j exp ( f jθ ( x ) ) − fyθ ( x ) . One difference compared with Eq . 1 is that we replace local smoothness term Lflow with our familiar lp constraint . Moreover , vanilla Flowbased attack ( Xiao et al. , 2018 ) follows the max operation suggested in ( Carlini & Wagner , 2017 ) . However we leverage cross entropy loss instead in pursuit of a uniform optimization form in our integrated spatial attack . Proposition 1 reveals the correlation between the two loss , indicating that the smooth approximation version ofmax operation in Eq . 1 , denoted as LSθ , has a parallel updating direction with Cross Entropy loss regarding wF . Proof can be found in Appendix A.2 . Proposition 1 . For a fixed ( xwF , y ) and θ , consider LSθ ( x , y ) = log ∑ i 6=y exp ( f iθ ( x ) ) − fyθ ( x ) , the smooth version loss of Eq . 1 without local smoothness term , then we have ∇wFLCEθ ( xwF , y ) = r ( xwF , y ) ∇wFLSθ ( xwF , y ) , where r ( xwF , y ) = ∑ i6=y exp ( f iθ ( xwF ) ) ∑ i exp ( f iθ ( xwF ) ) . ( 3 ) Global Spatial Robustness : Rotation-Translation ( RT ) -based Attacks The original RotationTranslation attack ( Engstrom et al. , 2017 ; 2019 ) applies parameter equations constraint on the 2D coordinate , thus capturing the global spatial information : [ u′ v′ ] = [ cos θ − sin θ sin θ cos θ ] · [ u v ] + [ δu δv ] . ( 4 ) To design a generic spatial transformation matrix that can simultaneously consider rotation , translation , cropping and scaling , we re-parameterize the transform matrix as a generic 6-dimensional affine transformation matrix , inspired by ( Jaderberg et al. , 2015 ) : [ u′ v′ ] = ( [ 1 0 0 0 1 0 ] + [ w11RT w 12 RT w 13 RT w21RT w 22 RT w 23 RT ] ) · [ u v 1 ] , ( 5 ) where we denote AwRT as the generic 6-dimensional affine transformation matrix , in which each wRT indicates the increment on different spatial aspects . For example , ( w13RT , w 23 RT ) determines the translation . Finally , the optimization form of the resulting generic and differentiable RT-based attack bounded by RT -ball is exhibited as : w∗RT = arg max wRT LCEθ ( xwRT , y ) s.t . ‖wRT ‖ ≤ RT . ( 6 ) Integrated Spatial Robustness The key to achieve this goal is to design an integrated parameterized sampling grid TwRT , wF ( G ) that can warp the regular grid with both affine and flow transformation , where G is the generated grid . We show our integrated approach as follows : TwRT , wF ( G ) = AwRT [ u v 1 ] + [ wF 1 ] , xadv = TwRT , wF ( G ) ◦ x . ( 7 ) Then we sample new xadv by TwRT , wF ( G ) via differentiable bilinear interpolation ( Jaderberg et al. , 2015 ) . Then the loss function of the differentiable integrated spatial attack can be presented as : w∗ = arg max w LCEθ ( x+ ηw , y ) , s.t . ‖w‖ ≤ , ( 8 ) where w = [ wF , wRT ] T and ηw is the crafted integrated spatial perturbation . Note that ηw itself does not necessarily satisfy the lp constraint directly . For the implementation , we follow the PGD procedure ( Madry et al. , 2017 ) , a common practice in sensitivity-based attacks . We consider the infinity norm of w and different learning rates for the two sorts of spatial robustness : [ wt+1F wt+1RT ] = [ wtF wtRT ] + [ αF αRT ] clip ( sign ( ∇wLCEθ ( xtwt , y ) ) ) , xt+1wt+1 = Twt+1 ( G ) ◦ x t wt , ( 9 ) where we denote wt+1 = [ wt+1F , w t+1 RT ] T and = [ F , RT ] T . From Figure 1 , we can observe that our Integrated Spatial Attack can construct both local and global spatial transformations on images . Then , we visualize the loss surface under this Integrated Spatial Attack leveraging “ filter normalization ” ( Li et al. , 2018 ) as illustrated in Figure 2 . It is worth noting that the highly nonconcave loss landscape with respect to only rotation and translation raised by ( Engstrom et al. , 2019 ) has been largely alleviated by considering both local and global spatial vulnerability , verifying the efficiency of our Integrated Spatial Attack . Remote-look of Initial Landscape Close-look of Initial Landscape Landscape around the maxima example

Summary: This paper first studies the tradeoffs between two forms of spatial robustness, including robustness against Flow-based spatial attack and Rotation-Translation (RT) attack. In particular, it proposes an approach to account for both local and global spatial transformations in an integrated framework. In addition, the paper investigates the relationship between the sensitivity-based (lp-norm based) and spatial robustness, and proposes a training method called ‘Pareto Adversarial Training’ to find optimal combination between natural accuracy, sensitivity-based and spatial robustness.