Adversarial Robustness Through the Lens of Causality

The adversarial vulnerability of deep neural networks has attracted significant attention in machine learning . As causal reasoning has an instinct for modeling distribution change , it is essential to incorporate causality into analyzing this specific type of distribution change induced by adversarial attacks . However , causal formulations of the intuition of adversarial attacks and the development of robust DNNs are still lacking in the literature . To bridge this gap , we construct a causal graph to model the generation process of adversarial examples and define the adversarial distribution to formalize the intuition of adversarial attacks . From the causal perspective , we study the distinction between the natural and adversarial distribution and conclude that the origin of adversarial vulnerability is the focus of models on spurious correlations . Inspired by the causal understanding , we propose the adversarial distribution alignment method to eliminate the difference between natural and adversarial distributions by considering spurious correlations . Extensive experiments demonstrate the efficacy of the proposed method . Our work is the first attempt towards using causality to understand and mitigate adversarial vulnerability . 1 INTRODUCTION . The seminal work ( Szegedy et al. , 2014 ; Biggio et al. , 2013 ) shows that DNNs are vulnerable to adversarial examples , which consist of malicious perturbations imperceptible to humans yet fooling state-of-the-art models ( Krizhevsky et al. , 2012 ; Szegedy et al. , 2015 ; Simonyan & Zisserman , 2014 ; He et al. , 2016 ) . The lack of robustness hinders the applications of DNNs to some safetycritical areas such as automatic driving ( Tuncali et al. , 2018 ) and healthcare ( Finlayson et al. , 2019 ) . Therefore , mitigating the adversarial vulnerability is critical to the further development of DNNs . Human cognitive systems are immune to the distribution change induced by adversarial attacks because humans are more sensitive to causal relations than statistical associations ( Gopnik et al. , 2004 ) . Using causal language , causal reasoning can identify causal relation and ignore nuisance factors , i.e. , not the cause of labels , by intervention ( Pearl , 2009 ; Peters et al. , 2017 ) . As adversarial perturbations are usually imperceptible and make no impact on human decisions ( Szegedy et al. , 2014 ; Goodfellow et al. , 2014 ) , it is reasonable to assume that the difference between natural and adversarial examples comes from nuisance factors . This is because if task-relevant factors of some samples are changed , these samples will make both humans and DNNs change their decisions . From a causal viewpoint ( Zhang et al. , 2020a ) , adversarial attacks can be regarded as a specific type of distribution change resulting from the intervention on the natural data distribution . In summary , causal reasoning has the instinct for analyzing the effect of the intervention caused by adversarial attacks , so it is essential to leverage causality to understand and mitigate the adversarial vulnerability . However , there are two significant problems to overcome before using causality to understand and mitigate the adversarial vulnerability . Firstly , constructing a causal graph is arguably the fundamental premise for causal reasoning ( Pearl , 2009 ; Peters et al. , 2017 ) , but how to construct causal graphs in the context of adversarial attacks is still lacking in the literature . Secondly , using causal language to formalize the intuition of adversarial attacks is the key to connect causality and adversarial vulnerability , but it also remains to be solved . These two problems are fundamental obstacles , which prevent us from employing causality to contribute to adversarial learning . To address these challenges , we first construct a causal graph to model the perceived data generation process where nuisance factors are considered . The constructed causal graph can entail a specific intervention distribution , i.e. , the adversarial distribution . Moreover , the causal graph immediately shows that , given inputs , labels are statistically correlated with nuisance factors , which have no cause-effect to labels . The spurious correlation implies that if DNNs fit the conditional association between labels and nuisance factors , their performance on different conditional associations between labels and nuisance factors will change accordingly . Through investigating the distinction between these two distributions induced by nuisance factors , we conclude that adversarial distributions can be obtained by exploiting conditional associations between labels and nuisance factors , where the conditional association of adversarial distributions is drastically different from that of natural distributions . Namely , the origin of adversarial vulnerability is the focus of DNNs on the spurious correlation between labels and nuisance factors . According to the causal perspective , an adversarial distribution is crafted by exploiting a specific conditional association between labels and nuisance factors , this association is drastically different from that of natural distributions . Intuitively , eliminating the difference in such conditional associations between natural and adversarial distributions can promote the performance of models on adversarial distributions . Thus , we propose an adversarial distribution alignment method to eliminate the difference between these two distributions . Surprisingly , we find that the proposed method shares the same spirits to existing adversarial training ( Goodfellow et al. , 2014 ) variants , i.e. , Madry ( Madry et al. , 2017 ) and TRADES ( Zhang et al. , 2019 ) . We validate the efficacy of the proposed method on MNIST , CIFAR10 , and CIFAR100 ( Krizhevsky et al. , 2009 ) datasets under various adversarial attacks such as FGSM ( Goodfellow et al. , 2014 ) , PGD ( Madry et al. , 2017 ) , CW attack ( Carlini & Wagner , 2017 ) , and AutoAttack ( Croce & Hein , 2020 ) . Extensive experiments demonstrate that the proposed method can improve the adversarial robustness significantly . Our main contributions are : • We provide a causal perspective to understand and mitigate the adversarial vulnerability , which is the first attempt towards using causality to contribute adversarial learning . • To leverage causality to contribute adversarial learning , we solve two fundamental problems . Specifically , we construct a causal graph to model the adversarial data generation process and define the adversarial distribution to formalize adversarial attacks . • A defense method called adversarial distribution alignment is proposed to reduce adversarial vulnerability by eliminating the difference between adversarial distribution and natural distribution . Extensive experiments demonstrate that the proposed method can significantly improve the adversarial robustness . 2 A CAUSAL VIEW ON ADVERSARIAL DATA GENERATION . The ability of humans to perform causal reasoning is arguably an essential factor that makes human learning different from deep learning ( Schölkopf et al. , 2021 ; Zhang et al. , 2020a ; Gopnik et al. , 2004 ) . The superiority of causal reasoning endows humans with the ability to identify causal relations and ignore nuisance factors that are not relevant to the task . In contrast , DNNs are usually trained to fit the perceived information overlooking the ability to distinguish causal relations and statistical associations . This shortcut solution could lead to overfitting to these nuisance factors , which would further result in the sensitivity of DNNs to such factors . Therefore , we propose incorporating causal reasoning to mitigate the sensitivity of DNNs to these nuisance factors . Before using causal reasoning to analyze adversarial vulnerability , we need to construct a causal graph , as causal graphs are the key for formalizing causal reasoning ( Peters et al. , 2017 ) . In the context of adversarial learning , we desire the causal graph by which both the natural and the adversarial distributions can be generated . In addition , the graph is required to reflect the impact of nuisance factors on these two distributions , so that we can investigate the difference in nuisance factors between these two distributions . Consequently , we can formally establish the connection between nuisance factors and adversarial vulnerability . Therefore , we propose constructing a causal graph to model the adversarial generation process where the nuisance factors are considered . One approach is to use causal structure learning to infer causal graphs ( Pearl , 2009 ; Peters et al. , 2017 ) , but it is challenging to apply this kind of approach to high-dimensional data . Using external knowl- edge to construct causal graphs is another approach ( Zhang et al. , 2013 ; Tang et al. , 2020 ; Schölkopf et al. , 2021 ) . As automatically learning a precise causal graph is out of scope for this work , external human knowledge about the data generation process is employed to construct the causal graph . Specifically , we construct a causal graph G to formalize the image data generation process using the following knowledge for analyzing adversarial vulnerability . As there might be a number of different causes of natural data X , we propose to divide all the causes into two categories for simplicity . We group content-related causes into one category , called content variable C. The rest causes , i.e. , nuisance factors , are grouped into another category , called style variable S , which is contentindependent , i.e. , S ⫫ C. This implies that C → X ← S. It is noteworthy that , in this paper , we assume that only the content variable is relevant for the task we care about , i.e. , C → Y . Perceived data X̃ are usually composed of perturbations E and natural data X . When the perturbation E is designed carefully to fool DNNs , E should be a compound result of X ( the object to be perturbed ) , Y ( the reference for the perturbation ) , and θ ( the targets affected by the perturbation ) , e.g. , white-box attacks ( Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ; Moosavi-Dezfooli et al. , 2016 ) , which means that ( X , Y , θ ) → E 1 . Leverage all this background knowledge , we obtain the causal graph G formalizing the perturbed data generation process , depicted in Fig . 1 . Based on the causal graph , we can define valid interventions ( Pearl , 2009 ; Schölkopf et al. , 2021 ) and the corresponding intervention distributions . Defining valid interventions is equivalent to determining which variables or mechanisms in the causal graph can be intervened . In this work , we consider both hard and soft interventions ( Eberhardt & Scheines , 2007 ; Correa & Bareinboim , 2020 ) on the perturbation variable E. Specifically , we can use a structural causal model to represent the generating mechanism of E : E ≔M ( X , Y , θ , UE ) , ( 1 ) where the exogenous variable UE stands for other indeterminacies , e.g. , random start noise used in PGD attack ( Madry et al. , 2017 ) . By intervening E in different ways , we can obtain different intervention distributions , which could be either natural or adversarial , over the observed variables . For example , if we do a hard intervention on E , i.e. , do ( E = 0 ) in the graph , the generated data distribution corresponds to the natural distribution P ( X , Y ) . Different perturbations can be obtained by performing soft interventions on E , i.e. , modifying M. In the context of adversarial attacks , adversaries aim to maximize a certain objective function ` ( ⋅ ) to mislead a target model h ( X ; θ ) by searching for the worst perturbation for each instance ( Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ; Dong et al. , 2018 ; Madry et al. , 2017 ) , where θ stands for parameters of the target model . To formalize the intuition of adversarial attacks , we can first search for the adversarial perturbation Eadv , and then use a function to approximate the mechanism for generating Eadv . The adversarial perturbation Eadv can be obtained by maximizing ` ( ⋅ ) : Eadv = arg max E ′∈B ` ( h ( X + E ′ ; θ ) , Y ) . ( 2 ) 1These three causes are not indispensable . Deleting θ gives black-box attacks ( Papernot et al. , 2017 ; Dong et al. , 2018 ) that only use ( X , Y ) to perform attacks . Deleting X leads to universal adversarial attacks ( Moosavi-Dezfooli et al. , 2017 ; Hendrik Metzen et al. , 2017 ) , which assume that one adversarial perturbation is sufficient to fool DNNs . Recent works show that a specific transform to X effectively evaluates the sensitivity of DNNs within a small neighborhood ( Rahaman et al. , 2019 ; Zhang et al. , 2020c ) , which corresponds to deleting ( Y , θ ) from the cause set . where B is a set of valid perturbations , and the adversarial perturbation Eadv is the result of the mechanism Madv , i.e. , Eadv ≔Madv ( X , Y , θ , UE ) . The intervention distribution that corresponds to the adversarial mechanism Madv is defined as the adversarial distribution Pθ ( X̃ , Y ) , where the subscript θ indicates that Pθ ( X̃ , Y ) is crafted to attack the target model h ( X ; θ ) with parameter θ .

Summary: The paper shows a causal perspective to the adversarial robustness problem. It creates a graph over content and style variable sets. It identifies the spurious correlation between style and label as the main reason for adversarial examples, and then proposes a method to remove it from the trained model. Experiments on three datasets show that the proposed method is better than two baselines.