Can standard training with clean images outperform adversarial one in robust accuracy?

1 INTRODUCTION . The seminal work of ( Goodfellow et al. , 2015 ) pointed out a surprising weakness of modern deep neural networks : although they can perform on par with human beings , their reliability is far from satisfaction . Almost imperceptibly added perturbations will be enough to mislead the network to output a wrong class label with high confidence . It will dramatically undermine the deployment of networks in some safety-critical applications : autonomous driving , image-based ID verification , and medical image analysis . Since then , researchers have heavily investigated this risk exposure and proposed different defense strategies . One direction is some prepossessing techniques such as bit-depth reduction ( Xu et al. , 2018 ) , JPEG compression , total variance minimization , image quilting ( Guo et al. , 2018 ) , and Defense-GAN ( Samangouei et al. , 2018 ) . The idea is to mitigate the effect of added noise and save the network to some extent . Unfortunately , ( Athalye et al. , 2018 ) showed that most of these approaches are based on obfuscated gradients and can be defeated . The other line of research adopts various adversarial training techniques where malicious examples are generated and fed to the network . A simple rationale behind this is if the network has this knowledge , it will become wise in test time . While there are different mechanisms such as Mixup inference ( Pang et al. , 2020 ) , feature scattering ( Zhang & Wang , 2019 ) , feature denoising ( Xie et al. , 2019 ) , geometry-aware instance reweighting ( Zhang et al. , 2021 ) , and channel-wise activation suppressing ( Bai et al. , 2021 ) , they all share the same philosophy . While people are astonished by the fact that imperceptibly added perturbations can fool the network , some theoretical works such as ( Tsipras et al. , 2019 ; Schmidt et al. , 2018 ) showed that it is not entirely unexpected . Unfortunately , there are no solutions without the awareness of attack models . Ideally , all defenses should be ignorant of this . However , this knowledge is essential to the adversarial training method that remains most effective , although at the cost of a large computation load . Now the big question arises : “ Can standard training with clean images outperform adversarial one in robust accuracy ? ” Here “ clean images ” means there is no manipulation of inputs even by adding some random noise such as ( Jin & Rinard , 2020 ) , although it is for manifold regularization rather than adversarial training . At first glance , it seems hopeless , as a widely accepted principle in the adversarial learning community is that a network can be clever only if it has been exposed to deceptions before . However , on the other hand , the networks are supposed to generalize well after standard training . How can it perform so badly for adversarial attacks ? As a possible answer to this , ( Ilyas et al. , 2019 ) investigated the cause of adversarial examples and concluded that neural networks tend to exploit predictive yet brittle features to make classifications . These features are incomprehensible to humans and thus can be modified by adversarial attackers to mislead the networks , but ( Ilyas et al. , 2019 ) did not show how to teach the network to disregard these non-robust features and discover the robust ones to make final decisions . From this perspective , as it is difficult to tell the network to learn robust features , what if we add some hints in the loss function and let the network become robust in an implicit way ? More specifically , in addition to the classical cross-entropy loss , we use a feature smoothing term that encourages the features in an intermediate layer to be uniform , as shown in the left of Figure 1 . It sounds counterintuitive as this term will constrain the space of features that may lead to a wrong classification . However , due to the high capacity of networks , a very high standard accuracy can still be achieved with this additional term . When training completes , given an input , whether clean or crafted , extra perturbations can always be created by some added random noise followed by the promotion of feature smoothing at the cost of reduced accuracy . So long as these intentional perturbations overweight the adversary ’ s and the reduction in accuracy is affordable , the model will become robust . We call this procedure Active Defense , as shown in the right of Figure 1 . We find experimentally , a clean example from CIFAR10/CIFAR-100 can be perturbed with l∞ = 25/255 ∼ 32/255 , three to four times of l∞ = 8/255 usually adopted by an adversary , yet be classified with a high success rate . This fact sets up the adequate space for Active Defense for eliminating the effects of attacks . Our approach is independent of any attack models compared with other state-of-the-art methods , and its performance is much more stable under attacks with different budgets . The contributions of this work are summarized as follows : • We propose a novel training scheme with an extra feature smoothing loss term that only takes clean images as inputs , fundamentally different from all existing adversarial training methods that need supplementary crafted data . •We present Active Defense that adds the second round of perturbations through random noise and feature smoothing . It modifies the malicious examples in a way that is friendly to the network . This deviates from conventional passive ones that keep the input intact . 2 RELATED WORKS . Due to adversarial threats to deep learning applications , there are many works to improve the robustness . Most of them adopt adversarial training . Among them , only a few take care of the features in intermediate layers as listed in the following . Feature denoising in ( Xie et al. , 2019 ) found that small perturbations in pixel space can lead to very substantial noise in the feature maps of the network and proposed various filters to denoise . ( Zhang & Wang , 2019 ) proposed to generate adversarial images for training through feature scattering in the latent space . In essence , perturbed images are produced collaboratively via optimal transport distance minimization . ( Zhang & Wang , 2019 ) used the feature maps as a guide to making new examples . Compared with these two , we are trying to force the intermediate feature map to be uniform through an additional loss term within the standard training framework without any modification of the network as in ( Xie et al. , 2019 ) or any other manipulations of features as in ( Zhang & Wang , 2019 ) . Regarding Active Defense , we have not seen any similar work . Perhaps the most related one is ( Yang et al. , 2019 ) , which used sophisticated matrix completion techniques to reconstruct the random masked images . Our motivation is very different , as we try to exploit the deep network itself to enhance robustness without borrowing any third-party algorithms . 3 BACKGROUND . In the classification problem , given the training data set of image-label pairs D = { ( xi , yi ) } ni=1 where yi ∈ { 1 , 2 , ... , M } , the goal is to find an output probability vector F ( x ) of length M indexed by j , ideally such that y = argmaxjFj ( x ) . Of course , there is always a mismatch between these two terms . The key thing here is to find a suitable loss function such that the empirical risk minimization ( ERM ) of 1n n∑ i=1 L ( F ( xi ) , yi ) can be implemented with loss function L. Note that F ( xi ) is a vector , while yi is a scalar of the label , the very first thing is to transform yi into a vector through a vector function G ( yi ) . People usually adopt the one-hot coding H ( yi ) of length M with all elements being 0 except Hyi ( yi ) = 1 . The two probability distribution vectors F ( xi ) and H ( yi ) can be compared with cross-entropy . An adversary crafts an adversarial example xadv which is closest to x with ‖xadv − x‖p ≤ ε but misclassified as some other class . In this paper , we only consider attacks with p = ∞ . The most commonly used strategy is the iterative projected gradient descent method ( PGD ) xt+1adv = P ( x t adv + β × sign ( ∇xL ( xtadv , G ( y ) ) ) ) , ( 1 ) where β is the step size and P projects the generated example to the feasible region . Please note that L in adversarial attack may be different from L in training . People may choose traditional crossentropy loss with one-hot coding or CW loss ( Carlini & Wagner , 2017 ) to implement Equation 1 . Currently , a budget-aware step size-free variant of PGD has been proposed by ( Croce & Hein , 2020 ) , and since that , an ensemble of diverse parameter-free attacks called AutoAttack has become the de facto routine for robust accuracy evaluation . 4 METHOD . In general , our method is very simple . In training , for feature map F l of a particular layer l with W ×H × C , we use the loss L = Lce +max ( LF l , δ ) ( 2 ) LF l = 1 W ×H × C W∑ i=1 H∑ j=1 C∑ k=1 ∣∣F li , j , k −mean ( F l ) ∣∣ . ( 3 ) Here L has two terms . Lce is for cross-entropy loss , and LF l is our novel feature smoothing loss function . It is quite similar to the L1 norm of the particular feature cube and encourages the cube to be uniform . In order to avoid overfitting to the feature smoothing loss , we use max ( LF l , δ ) which disables the derivative of LF l when it drops below δ . In summary , we have two parameters , the feature layer l and the smoothing upper bound δ . Although this loss function sounds straightforward for our purpose to make the intermediate feature map smooth , there is a novel insight from the perspective of the trade-off between these two terms . In order to get low LF l , Lce will increase . In other words , after training , the network somehow understands that feature smoothing is not very annoying , and it only causes accuracy to drop to some extent . There is a huge implication in terms of robust accuracy . If we only use Lce , the network has no idea to deal with the crafted example except to be fooled . However , in our case , LF l gives us a dissipation channel of malicious perturbations that we can take via feature smoothing . Hopefully , this will remove most of the perturbations generated by an adversary , which we will elaborate on in our Active Defense design . The other concern may relate to the feature space constraints . Actually , due to the high capacity of networks , there is almost no difference in standard training accuracy between ours and cross-entropy loss . From the discussion above , our Active Defense is very intuitive . It consists of four steps depicted in the right of Figure 1 . In Step 1 , we add some random noise to an input which can somehow reduce the effect of adversarial disruptions ; more importantly , this will ensure sufficient iterations of feature smoothing . Otherwise , the attacker can bypass this and our Active Defense will fail . Steps 2 and 3 are just forward/backward passes related to LF l . In Step 4 , the noisy image get smoothed via gradient descent for LF l , and feeds into the network for another round of feature smoothing . The overall procedure of the proposed approach is in Algorithm 1 . There are only three parameters , i.e. , σ for uniform noise , β for the updating step size , and δ̃ for the upper bound of feature loss in test that is usually lower than δ for training in Equation 2 , as we pursue extra feature smoothing to deal with adversarial attacks . The updated example through Active Defense will feed into the network for final class decision . This algorithm can run a few times which we denoted as outerloop in the following sections . Algorithm 1 Active Defense Algorithm 1 : procedure ACTIVE DEFENSE ( t , LF l ) . t is a test example . 2 : t = t+ uniform ( −σ , σ ) . Step 1 , σ is the parameter of the uniform distribution . 3 : l = LF l ( t ) . Step 2 4 : while l > δ̃ do . δ̃ is the upper bound of feature loss in test . 5 : d = ∂l∂t . Step 3 6 : t = t− β × d . Step 4 , β is the step size . 7 : l = LF l ( t ) . Step 2 8 : end while 9 : return t 10 : end procedure

Summary: This paper proposes a defense against adversarial attacks that does not involve using attacks in the defense process. The defense consists of two parts: first, a feature smoothing loss is added to the main objective function during training. Then, when defending against attacks, noise is added to the input followed by additional perturbations to the input designed to decrease the feature smoothing loss. The proposed method achieves favorable accuracies relative to baseline defenses.