Improved resistance of neural networks to adversarial images through generative pre-training

1 INTRODUCTION . In an adversarial attack on a classification system one seeks inputs that lie very close ( according to some norm or measure ) to a regular input , but give a completely different classification result . Adversarial attacks on machine learning systems have been studied for over a decade , starting from the study of attacks on spam filtering systems ( for a historical review see Biggio and Roli ( 2018 ) ) . Adversarial attacks on deep learning image recognition models have first been discussed by Szegedy et al . ( 2013 ) . In addition to highlighting security implications adversarial images have acquired a new meaning in this context , presenting us with a fundamental conundrum : How can deep learning systems succesfully generalise and at the same time be extremely vulnerable to minute changes in the input ? The topic of adversarial images in neural nets has been studied intensely with attacks and defences leapfrogging each other ( for an overview see Kurakin et al . ( 2018 ) ) . All common neural network models suffer from susceptibility to adversarial attacks . It has even been shown by Moosavi-Dezfooli et al . ( 2017 ) that adversarial attack patterns can be transferred between different models , suggesting some common underlying mechanism . Despite the intense study of the subject a solution remains elusive , with Jetley et al . ( 2018 ) suggesting that classification performance and vulnerability to adversarial attacks are correlated , while Gilmer et al . ( 2018 ) present evidence for the opposite in a simple model . The difficulty in finding neural networks robust against adversarial attacks suggest that the standard discriminative neural network training procedure and the resulting networks ’ vulnerability are linked . Making use of generative methods ( e.g variational autoencoders , introduced in this context by Gu and Rigazio ( 2014 ) ) has resulted in creating the most adversarially robust classifications but with added computational cost at inference time ( Schott et al . ( 2018 ) ) . Another state of the art approach to increasing adversarial resistance applies denoising to image patches to achieve strong robustness ( Moosavi-Dezfooli et al . ( 2018 ) ) . In this article we concentrate on one common generative model , Boltzmann machines , and the impact of its use on adversarial resistance . We examine the adversarial resistance on the standard MNIST dataset . Boltzmann machines are a stochastic model with binary units ( see e.g . Hinton ( 2007 ) ) . A number of “ hidden ” units form a model for the data distribution over the “ visible ” units . In a classification scenario one would fix the visible units and use the probability distribution over the hidden units for further processing . In a restricted Boltzmann machine the hidden units are independent and therefore the distribution over the hidden units in a classification scenario becomes a product distribution fully characterised by the average values of the individual hidden units . Pretraining using restricted Boltzmann machines has been used in early neural networks ( Hinton et al . ( 2006 ) ) but was abandoned as it became clear that good training can be achieved without it . Here we follow a slightly different path . We will use a Boltzmann machine to model image patches only . We do the modelling in a hierarchical fashion : train one Boltzmann machine for small image patches , then add more hidden units to model the joint distribution over larger patches , similar to the stacked RBM approach of Norouzi et al . ( 2009 ) . This forces us to depart from a simple restricted Boltzmann machine model and therefore we can not obtain the hidden probability distribution as easily as for a restricted Boltzmann machine . Extended mean field methods developed for the description of spin glasses in physics ( Thouless et al . ( 1977 ) ; Georges and Yedidia ( 1991 ) ; Kühn and Helias ( 2017 ) ) have been applied succesfully to train a restricted Boltzmann machine by Gabrié et al . ( 2015 ) and Budzianowski ( 2016 ) . We use these methods to arrive at a description of the hidden units in terms of their average values , where now we replace the single neural network layer resulting from the restricted Boltzmann machine with a many-layer iteration derived from the mean field description . This pre-trained building block can be used as a fixed input layer in a neural network trained in the usual discriminatory fashion . In summary the contributions of this article are as follows : • We construct a new neural network building block , based on the mean field description of a Boltzmann machine . The result is a deep feed forward neural network with shared weights and a structure derived from the energy function of the underlying Boltzmann machine . • We use this building block in a neural network to achieve state of the art resistance to adversarial attacks on MNIST and show a correlation between the loss function of the Boltzmann machine ( i.e . it ’ s generative capability ) and the adversarial resistance of the resulting neural network . • We show that the function mapping visible unit inputs to hidden unit outputs implemented by the new building block is strongly dependent on the input . A ball of random distortions around a training example gets mapped to a smaller output volume compared to the same mapping starting from a random input . 2 BOLTZMANN MACHINES AS FEATURE EXTRACTORS . Let us review the the mean field description of a Boltzmann machine ( Budzianowski ( 2016 ) ; Gabrié et al . ( 2015 ) ) . Boltzmann machines are stochastic , energy based models derived from the statistical physics of interacting spins . Boltzmann machines are a generative model , the generated probability distribution being the thermal equilibrium probability distribution over all possible spin combinations s = ( s1 , s2 , . . . , sN ) with sn = ±1 , as determined by the energy function through its parameters θ = ( b , J ) E ( θ , s ) = s · J · s+ b · s , so that the probability of realising the configuration s is proportional to the Boltzmann factor p ( θ , s ) ∝ e−E ( θ , s ) . The spins are divided into two sets , the visible units v and the hidden units h. When training a Boltzmann machine we want to generate a target probability distribution p0 ( v ) over the visible units , as defined by example configurations v ( 0 ) j , j = 1 , . . . , nJ . This can be achieved by adjusting the parameters of the energy function to minimise the relative entropy between the marginal distribution over the visible units p ( v , θ ) = Trh p ( v , h , θ ) . and the target distribution : D ( p0||p ) = nJ∑ j=1 p0 ( v ( 0 ) j ) log p0 ( v ( 0 ) j ) − p0 ( v ( 0 ) j ) log p ( θ , v ( 0 ) j ) . ( 1 ) The gradient of the relative entropy with respect to the parameters of the energy function θ can be expressed in terms of expectation values of spins dD ( p0||p ) dbk = nJ∑ j=1 p0 ( v ( 0 ) j ) p ( θ , v ( 0 ) j ) 〈sk〉C ( j ) − 〈sk〉F , ( 2 ) and spin-spin correlators dD ( p0||p ) dJkl = nJ∑ j=1 p0 ( v ( 0 ) j ) p ( θ , v ( 0 ) j ) 〈sksl〉C ( j ) − 〈sksl〉F , ( 3 ) where 〈. . .〉F denotes the expectation value of the model without constraints ( free ) and 〈. . .〉C ( j ) the expectation value if the visible units are fixed to example vj ( clamped ) . This gradient can be used in a first order optimisation method to arrive at an optimal parameter configuration θ0 . While the expression for the gradient looks simple , evaluating the probabilities and expectation values is not , and some approximation scheme needs to be used . Two schemes are usually used , one based on sampling ( Hinton and E. ( 2002 ) ) , the other one based on a mean field approximation . Here we will concentrate on the mean field approximation . The central quantity in mean field theory is the free energy . We can obtain the free energy of our model as an expansion in the order of the coupling J as derived by a number of authors ( Georges and Yedidia ( 1991 ) ; Kühn and Helias ( 2017 ) ) . F = ∑ n Fn To lowest order the free energy is given by the entropy of independent spins . F0 = N∑ i=1 ( 1−mi 2 ) log ( 1−mi 2 ) + ( 1 +mi 2 ) log ( 1 +mi 2 ) , where mi is the magnetisation of spin i . Up to second order we obtain F1 = ∑ 〈ij〉 Jijmimj + ∑ i bimi , F2 = ∑ 〈ij〉 J2ij ( 1−m2i ) ( 1−m2j ) , where the notation 〈ij〉 denotes summation over unequal indices . For orders up to four see appendix A . From the free energy we can derive an equation to obtain the mean field values mi in the approximation up to order N mi = tanh ( N∑ n=1 R ( n ) i ) ( 4 ) with R ( n ) i = dFn dmi . In particular , the first two orders are R ( 1 ) i = bi + 2 ∑ j Jijmj and R ( 2 ) i = −4mi ∑ j J2ij ( 1−m2j ) . Higher orders can be found in the appendix A . In the free case , the transcendental equation , Eq . 4 can be solved by iteration , starting from zero or random magnetisations , until the magnetisations converge . In the clamped case we keep the visible magnetisations fixed , while iterating over the hidden units . This results in two sets of distinct magnetisations : the free magnetisations mF and the clamped magnetisations mC ( j ) , where example j is fixed on the visible units . We also get a set of corresponding free energies FF and FC ( j ) . The correlation functions can be obtained from the free energies 〈sksl〉F/C ( j ) = 1 2 dFF/C ( j ) dJkl , and the expectation values are given directly by 〈sk〉F/C ( j ) = mF/C ( j ) , k. These expectation values can be inserted in the expressions for the gradient , Eqs . 2 and 3 , and used to minimise the relative entropy Eq . 1 . Probabilities can be estimated from the free energies p ( θ , v ( 0 ) j ) = e FC ( j ) −FF . The training of a Boltzmann machine emphasises the main task of the machine as generating examples from the target distribution , but one can look at the machine from a different point of view : using the hidden units for constructing a model of the example data . The probability distribution over the hidden units if an example is fixed on the visible units then tells us something about the model required to describe the example . In a restricted Boltzmann machine ( RBM ) the probability distribution is a product distribution over the hidden units and features , but one can imagine introducing couplings between hidden units to account for correlations between individual features to arrive at a better/simpler description of the data . In the remaining article we will discuss machines that have bipartite connectivity between visible and hidden units and full connectivity between hidden units . During inference we want to obtain the hidden magnetisations given the magnetisations of the visible units . We split the magnetisations into visible and hidden parts m = ( mv , mh ) . Similarly we split the magnetic fields b = ( 0 , bh ) and the couplings J = ( 0 W W Jh ) , where W now describes the bipartite connectivity between visible and hidden units and Jh the coupling between hidden units . Keeping terms to second order the mean field equations become mh = tanh [ 2W ·mv + bh + 2Jh ·mh − 4mhJ2h · ( 1−m2h ) ] . ( 5 ) Solving the mean field equation Eq . 5 requires iteration , e.g . starting from the initial magnetisations mh = 0 . The iteration can be unrolled into an r layer neural network , where r is greater than the number of iterations necessary for convergence ( see Fig . 1 ) . We will refer to this neural network as the mean field Boltzmann network .

Summary: The recent work of Schott et al (which the authors compare results to) proposed the use of Bayes rule inversion as a more robust mechanism for classification under different types of adversarial attacks. The probabilities are approximated with variational autoencoders. During training the inference network is used, but during testing optimization based inference is carried out to compute loglikelihoods.