Bayesian Learning with Information Gain Provably Bounds Risk for a Robust Adversarial Defense

1 INTRODUCTION . Deep neural networks ( DNNs ) have demonstrated impressive performance on multiple tasks , such as image recognition ( He et al. , 2016 ) or natural language processing ( Vaswani et al. , 2017 ) . However , despite the impressive performance , DNNs are poor at quantifying the predictive uncertainty and tend to produce overconfident predictions . Consequently , it has been shown to be vulnerable to adversarial examples ( AEs ) ( Goodfellow et al. , 2015 ; Madry et al. , 2018 ; Carlini & Wagner , 2017 ) where carefully crafted perturbations are added to the inputs to drive the performance of DNNs . These perturbations are imperceptible to human eyes ( Goodfellow et al. , 2015 ) ( in the context of image classification ) but can drastically degrade the performance of the DNNs . There are various methods to find such perturbations ( Madry et al. , 2018 ; Goodfellow et al. , 2015 ; Carlini & Wagner , 2017 ; Papernot et al. , 2016a ) . Importantly , these threats are also shown to be effective in the physical world ( Kurakin et al. , 2018 ; Eykholt et al. , 2018 ) and are shown to be effective in transferring across models to make black-box attacks ( Papernot et al. , 2016a ; 2017 ) . Therefore , adversarial perturbations present a realistic threat for DNN applications and motivate the need to develop robust DNNs . Despite the huge amount of effort to overcome the thread from AEs since its first introduction in 2014 ( Szegedy et al. , 2014 ) , training a robust DNN against AEs is challenging . Athalye et al . ( 2018 ) have shown that one of the most robust methods to defend against this threat is Adversarial Training ( Madry et al. , 2018 ) . In this method , the network is trained with adversarial examples in order to create robustness against the AEs at inference time . Nevertheless , as mentioned in Ye & Zhu ( 2018 ) , this method relies on the `` point estimate '' approach of the deep neural network ; hence it lacks the capability to deal with the uncertainty of the adversary at inference time i.e . adversaries beyond the pre-defined norm . In addition , using a point estimate only defines a single decision boundary that could be manipulated easily with an adversarial input . Alternatively , one can use multiple decision boundaries , or more precisely , integrate out the effects of parameters in the model . That is the premise of Bayesian learning methods Welling & Teh ( 2011 ) that define a distribution over the parameters leading to Bayesian Deep Neural Networks ( BNNs ) . Thus , the output of predictive distribution is obtained by integrating out the parameters w.r.t . their distribution . Motivated by the intuition that removing the effects of the parameter choice can lead to more robust models , ( Liu et al. , 2019 ) proposed adversarial training of BNNs and demonstrated impressive results . However , training BNNs pose a significant challenge : the exact solution of posterior distribution ( i.e . the parameter distribution after observing the data ) is often intractable . Efforts devoted to developing a suitable inference approach to approximate the posterior involve either using Markov Chain Monte Carlo ( MCMC ; asymptotically accurate but slow ; see e.g . ( Welling & Teh , 2011 ) ) or variational inference ( efficient but inaccurate ; see e.g . ( Blei et al. , 2017 ) ) . For instance , Liu et al . ( 2019 ) uses variational methods ( Blei et al. , 2017 ; Blundell et al. , 2015 ) to approximate the posterior with a unimodal Gaussian distribution . The issue with such a method for deep learning is that the parameters sampled are in the proximity of the mode and , consequently , does not capture the multi-modal aspect of the distribution . This leads to attaining only minor variations in parameters and sub-par robustness . In this study , inspired by BNNs , we consider a novel approach for robust learning . We hypothesize ( 1 ) a model that relies on the parameter distribution rather than a single point estimate which ( 2 ) predicts the same predictive distribution for both the given dataset and its adversarials , is more robust . Inspired by ( Liu & Wang , 2016 ) , to achieve ( 1 ) to remedy the lack of diversity in parameters we exploit Stein Variational Gradient Descent ( SVGD ) . SVGD marries MCMC and variational inference to attain the benefits of both . It leads to sampling a set of parameter `` particles '' that are encouraged to be diverse to fit the modes of the true posterior distribution . Further , by utilizing this approach for achieving ( 2 ) , we compute the Information Gain ( IG ) for each input instance . In other words , we measure value of knowing the label for an input given the posterior distribution for either the given benign training set versus the adversarial counterparts . This simply translates to matching the predictive distribution of the benign to the adversarial instances . Given our intuitions , we designed an objective that satisfies our hypothesis . Further , show that our conceptualization and formulation of information gain ( IG ) in the adversarial Bayesian learning context bounds the difference between the conventional empirical risk with the risk obtained from adversarial training . This is the first such bound that establishes the relation between Bayesian learning with information gain to the generalization of empirical risk minimization ( ERM ) . We summarize our results and contributions below : • We propose a novel method to learn a BNN robust against adversarial attacks that utilizes : i ) the information gain of the instances from the dataset ; and ii ) SVGD to generate parameter particles that are trained in parallel to be as diverse as possible while maintaining the same measure of information content for benign and adversarial training instances . Our learning approach enables the model to both reduce the effect of single parameter choice and learn the invariant patterns that are common between the training dataset and its corresponding adversarial samples . • We show that learning a BNN with an Information Gain formulation in the Bayesian context yields an upper bound on the difference between the empirical risk versus adversarial risk . As such , minimizing the learning objective we propose , provably approaches the same bounds as empirical risk minimization . This is the first time such a bound is devised and is significant as it provides a theoretically justified approach to reducing the uncertainty due to adversarial examples . • In the adversarial training approach we propose for BNNs , in contrast to using the predictive distribution ( i.e . as opposed to using the whole posterior distribution ) to obtain the adversarial instances using PGD , we use samples from the posterior . This method , not only allows for a more efficient implementation , but also encourages the parameter particles to remain diverse and generate dissimilar adversarial patterns . The result is a more effective approach to improve robustness during training . • Comprehensive evaluations on a set of neural architectures and datasets demonstrates our approach to result in up to 20 % improvement compared to the state-of-the-art in the robustness . 2 BACKGROUND & RELATED WORK . Primer on Bayesian Learning . Given a dataset D = { xi , yi } Ni=1 , a Bayesian Neural Network ( BNN ) aims to learn the posterior distribution : p ( θ | D ) = p ( D|θ ) p ( θ ) p ( D ) given the prior distribution p ( θ ) . However , the exact solution for the posterior is often intractable due to the high dimensional integral of the denominator even for moderately sized networks in the context of deep learning ( Blei et al. , 2017 ) . To overcome this , there are generally two approaches . The first one is to use Markov Chain Monte Carlo ( MCMC ) methods , which shows to be asymptotically accurate but slow ( Welling & Teh , 2011 ) . Alternatively , one can use variational inference methods to approach the true posterior distribution ( Blundell et al. , 2015 ) . However , in the case of BNN , the true Bayesian posterior is usually a complex multimodal distribution ( Izmailov et al. , 2021 ) as illustrated in Figure 1 . Variational inference , which relies on a parametric function , is too restrictive to resemble the true posterior and suffers from mode collapse ( Izmailov et al. , 2021 ; Jospin et al. , 2020 ) . MCMC methods Variational inference methods Stein variational gradient descent Adversarial Attacks . Attackers can add carefully crafted noise ( perturbations ) to the input image to fool the classifier at the inference stage . In general , the goal of the attacker—described in Equation ( 1 ) —is to degrade the performance of a neural network by crafting δ , such that : max ‖δ‖p < εmax ` ( f ( x + δ ; θ ) , y ) ( 1 ) where , p is the norm , εmax is the maximum attack budget ( perturbation ) , ` is the loss function ( typically cross-entropy ) , f is the network , x is the input , θ is the network parameter , and y is the ground-truth label . For a PGD ( Madry et al. , 2018 ) attack , an attacker starts from x0 = xo and conducts projected gradient descent iteratively to update the adversarial example following ( 2 ) : xt+1 = Πεmax { xt + α · sign ( ∇x ` ( f ( xt ; θ ) , yo ) ) } ( 2 ) where Πεmax is the projection to the set { x | ‖x− xo‖∞ ≤ εmax } Among all the attack methods , we decided to apply PGD in our experiments because : i ) PGD ( Madry et al. , 2018 ) is regarded as the strongest attack in terms of the ` ∞ norm and ii ) it gives us direct control over the distortion by changing εmax . However , Liu et al . ( 2019 ) showed that one can not directly apply a PGD attack in a BNN setting . Instead , the authors suggest using a stochastic approach and proposed an updated PGD method , described in ( 3 ) , for which they sample stochastic parameters θt in each update step t. xt+1 = Πεmax { xt + α · sign ( ∇x ` ( f ( xt ; θt ) , yo ) ) } ( 3 ) Adversarial Defenses . Significant research efforts describe methods to mitigate this threat , such as distillation ( Papernot et al. , 2016b ) , input denoising ( Song et al. , 2017 ) or feature denoising ( Xie et al. , 2019 ) , curious readers can find more from ( Kurakin et al. , 2018 ) . Among these methods , adversarial training ( Madry et al. , 2018 ) is shown to be one of the most effective and popular methods to defend against adversarial attacks . The goal of adversarial training is to incorporate the adversarial search within the training process and , thus , realize robustness against adversarial examples at test time . This is achieved by solving the following optimization problem : θ∗ = arg min θ E ( x , y ) ∼D { max ‖δ‖p < εmax E θ [ ` ( f ( x + δ ; θ ) , y ) ] } ( 4 ) where D is the training data . An approximate solution can be realized by generating the PGD adversarial examples from Equation ( 2 ) and then minimizing the classification loss based on the generated adversarial examples . Prior Art on Bayesian Defenses . Using Bayesian Neural Networks to detect adversarial attacks was proposed in ( Feinman et al. , 2017 ; Smith & Gal , 2018 ) . Ye & Zhu ( 2018 ) and Liu et al . ( 2019 ) tried to combine Bayesian learning with adversarial training . Particularly , Ye & Zhu ( 2018 ) present a method to jointly sample from the model ’ s parameter posterior and the distribution of adversarial samples given the current parameter posterior . Recently , Liu et al . ( 2019 ) further developed the direction in Random Self-Ensemble ( Liu et al. , 2018 ) to build an adversarially-trained Bayesian neural network method named Adv-BNN that can scales up to complex data by adding noise to each weight instead of input or hidden features as in RSE ( Liu et al. , 2018 ) . Adv-BNN also incorporates adversarial training to learn a variational posterior distribution to further improve model robustness against adversarial examples . However , using the variational inference method is likely to lead to mode collapse and limited the performance of the BNN ( Izmailov et al. , 2021 ) as we discussed earlier and demonstrate in our experiments in Section 4 . Hence , in this work , we proposed exploring SVGD ( Liu & Wang , 2016 ) as a Bayesian inference method to achieve a better approximation for the multi-modal posterior of a BNN . Using this approach , it is also easy to convert a traditional neural network to a Bayesian counterpart without much effort to modify the traditional neural network architecture . Further , by employing the repulsive force for encouraging exploration in the parameter space , we conceptualize the information gain in Bayesian learning .

Summary: This paper explores adversarial training for Bayesian Neural Networks. In contrast to prior work which used Gaussian variational posteriors to estimate BNN parameters during adversarial training, this work uses Stein Variational Gradient Descent (SVGD) on a loss potential that includes an adversarial term similar to standard adversarial training and a term encouraging similarity between the Information Gain (IG) on natural and adversarial images. They evaluate PGD and adaptive adversarial attacks and find significant performance improvement over standard adversarial training and adversarial BNN. A theoretical justification is presented.