Adversarial robustness against multiple $l_p$-threat models at the price of one and how to quickly fine-tune robust models to another threat model

1 INTRODUCTION . The problem of adversarial examples , that is small adversarial perturbations of the input ( Szegedy et al. , 2014 ; Kurakin et al. , 2017 ) changing the decision of a classifier , is a serious obstacle for the use of machine learning in safety-critical systems . Many adversarial defenses have been proposed but most of them could be broken either by stronger attacks with a higher computational budget ( Carlini & Wagner , 2017 ; Athalye et al. , 2018 ; Mosbach et al. , 2018 ) or using adaptive attacks ( Tramèr et al. , 2020 ) . Apart from provable adversarial defenses which are however still restricted to rather simple CNNs ( Wong et al. , 2018 ; Gowal et al. , 2018 ) , the only successful technique so far remains adversarial training ( Madry et al. , 2018 ) and its improvements ( Zhang et al. , 2019 ; Carmon et al. , 2019 ; Wu et al. , 2020 ; 2021 ) . We refer to Gowal et al . ( 2020 ) for a recent overview of “ tricks of the trade ” for improving adversarial training yielding the currently most robust models for l2 and l∞ on CIFAR-10 . While the community initially focused on adversarial examples for l∞-perturbations , there has been recently more interest in other lp-attacks , such as l1 and l2 , or perceptual threat models ( Stutz et al. , 2019 ; Wong & Kolter , 2021 ; Laidlaw et al. , 2021 ) . It is well known that robustness in one lp-ball does not necessarily generalize to some other lq-ball for p 6= q ( Kang et al. , 2019a ; Tramèr & Boneh , 2019 ) . However , in safety-critical systems we need robustness against all lp-norms simultaneously which has triggered recent extensions of adversarial training for multiple lp-norms ( Tramèr & Boneh , 2019 ; Maini et al. , 2020 ) and provable defenses for all lp with p ≥ 1 ( Croce & Hein , 2020b ) . In this paper we show that , using the geometry of the lp-balls , the computationally expensive multiple norm training procedures of Tramèr & Boneh ( 2019 ) ; Maini et al . ( 2020 ) , which cost up to three times as much as normal adversarial training , can be replaced by a very effective and simple form of adaptively alternating between the two extreme norms , namely l1 and l∞ . This simple scheme achieves similar robustness for the union of the threat models as more costly previous approaches . Moreover , we show that already 3 epochs of fine-tuning with our extreme norms adversarial training ( E-AT ) are enough to turn any lp-robust model for p ∈ { 1 , 2 , ∞ } into a model which is robust against all lp-threat models for p ∈ { 1 , 2 , ∞ } , even if the original classifier was completely nonrobust against one of the threat models . We apply the proposed method to many existing models originally trained to be robust in a single norm : fine-tuning the currently most robust network in the l∞-threat model from Gowal et al . ( 2020 ) for CIFAR-10 we improve the current state-of-the-art performance for multiple norm robustness by more than 6 % ( robustness over the union of l1 , l2 and l∞-balls ) . Moreover , we employ our E-AT fine-tuning scheme with just a single epoch to yield the first ImageNet model which is robust against multiple attacks at the same time . Finally , we show that fine-tuning with just 3 epochs for CIFAR-10 and one epoch for ImageNet is sufficient to transfer robustness from one threat model to another one which very quickly yields baselines for all threat models . In this way we achieve SOTA l1-robustness on CIFAR-10 by fine-tuning the most robust l∞-model from Gowal et al . ( 2020 ) to become l1-robust , and get an ImageNet model robust wrt l1 . These results are quite striking as the original classifiers show no or only very little l1-robustness . Fig . 1 summarizes the results of robust fine-tuning on CIFAR-10 ( see Table 2 and 4 for details ) . 2 RELATED WORK . Adversarial training : In image classification adversarial examples were first described by Szegedy et al . ( 2014 ) even though earlier discussion of adversarial examples in email spam classification can be found in Dalvi et al . ( 2004 ) ; Lowd & Meek ( 2005 ) . An early approach of adversarial training was the Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2015 ) , which then was extended to a multi-step attack in Kurakin et al . ( 2017 ) . Nowadays , adversarial training as formulated in Madry et al . ( 2018 ) as a min-max optimization problem has been one of the few adversarial defenses which could not be broken by stronger attacks ( Athalye et al. , 2018 ) . Other types of defenses use more sophisticated techniques , typically preventing the direct optimization of the attack . However , adaptive attacks specifically designed for these defenses have often shown that these alternative techniques are non-robust or much less robust than claimed ( Tramèr et al. , 2020 ) . Thus adversarial training remains the only general method ensuring adversarial robustness across architectures and datasets . Recent improvements have been achieved by using different objectives ( Zhang et al. , 2019 ) , unlabeled data ( Carmon et al. , 2019 ) , adversarial weights perturbations ( Wu et al. , 2020 ) and wider networks Wu et al . ( 2021 ) . In Gowal et al . ( 2020 ) several recent variants were systematically explored and for a very large architecture , a WideResNet-70-16 , they obtain the most robust models for l∞ ( radius 8255 ) and l2 ( radius 0.5 ) for CIFAR-10 , which we use for our fine-tuning experiments . Multiple norm robustness : It was early on discovered that adversarial robustness against a specific lp threat model does typically not transfer to lq threat models for p 6= q ( see Kang et al . ( 2019a ) ; Tramèr & Boneh ( 2019 ) for extensive studies ) . On the other hand to achieve really reliable machine learning models lp-robustness wrt all p is necessary . The first approach to such a generally robust model was done in Schott et al . ( 2019 ) which uses multiple variational auto-encoders for an analysis by synthesis ( ABS ) architecture . While this model is restricted to MNIST , it is robust against l0 , l2 and l∞-attacks . However , it has been recently shown that with a stronger black-box attack ( Croce et al. , 2020b ) the l0-robustness is significantly lower than originally claimed . Tramèr & Boneh ( 2019 ) ; Maini et al . ( 2020 ) ; Madaan et al . ( 2021 ) use variants of adversarial training to achieve robustness in multiple norms . Since these are the most similar methods to ours , we present them in detail below . Madaan et al . ( 2021 ) additionally proposes a meta-learning approach where one learns optimal noise to augment the samples and uses consistency regularization to enforce similar predictions on clean , augmented and adversarial samples . Finally , Stutz et al . ( 2020 ) combine adversarial training with a reject option for the classifier by down-weighting the confidence of adversarial samples . Their models generalize to other threat models but the comparison to normal adversarially trained models is difficult as their model is non-robust without the reject option . Provable robustness : In the area of provably robust defenses , Croce & Hein ( 2020b ) motivated a regularization approach based on the geometry of the lp-balls which enforces multiple-norm robustness during training which allows then to derive provable guarantees for multiple-norm robustness in contrast to the empirical evaluation of adversarial training . However , their approach works only for small network architectures and relatively small radii of the lp-balls . Fine-tuning of robust models : Fine-tuning of an existing neural network is a commonly used technique in deep learning ( Goodfellow et al. , 2016 ) to quickly adapt an existing model to a different objective e.g . for language models ( Howard & Ruder , 2018 ) . More recently , it has been shown in the area of adversarial robustness that fine-tuning of pre-trained models , possibly using self-supervision , yields better adversarial robustness ( Hendrycks et al. , 2019 ; Chen et al. , 2020 ; Xu & Yang , 2020 ) . In Jeddi et al . ( 2020 ) it is shown that fine-tuning of non-robust models with 10 epochs can yield robust models with the caveat that their robustness evaluation is done using only a single run of PGD with 20 steps . We are not aware of any prior work discussing fine-tuning to transform an existing robust model wrt a single lp into a robust model wrt multiple threat models or wrt another lq-threat model . In particular , we show that one can fine-tune an l∞-robust model so that it becomes l1-robust even though the original model has not been l1-robust at all . Evaluation of adversarial robustness : Many white-box attacks for l∞ ( Madry et al. , 2018 ; Gowal et al. , 2019 ) , l2 ( Madry et al. , 2018 ; Carlini & Wagner , 2017 ) and l1 ( Chen et al. , 2018 ; Modas et al. , 2019 ; Rony et al. , 2021 ) have been proposed as well as several black box attacks ( Brendel et al. , 2018 ; Liu et al. , 2019 ; Cheng et al. , 2019 ; Al-Dujaili & O ’ Reilly , 2020 ; Meunier et al. , 2019 ; Zhao et al. , 2019 ; Andriushchenko et al. , 2020 ) for different threat models . It has recently been shown that AutoAttack ( Croce & Hein , 2020c ) , a parameter-free ensemble of the white-box attacks APGD for the cross-entropy and DLR-loss , FAB-attack ( Croce & Hein , 2020a ) and the black-box Square-attack ( Andriushchenko et al. , 2020 ) is reliably evaluating adversarial robustness for l2 and l∞ . AutoAttack has recently been extended to l1 ( Croce & Hein , 2021 ) outperforming all existing state-of-the art attacks for l1 . Croce & Hein ( 2020c ; 2021 ) showed that on models defended with adversarial training the two versions of APGD ( with budget as in AutoAttack ) already give an accurate robustness evaluation . As we have to evaluate very large models always for three threat models , we use those as a strong standard attack in our experiments . 2.1 ADVERSARIAL TRAINING FOR THE UNION OF l1- , l2- AND l∞-BALLS Let us denote by fθ : Rd → RK the classifier parameterized by θ ∈ Rn , with input x ∈ Rd and fθ ( x ) ∈ RK where K is the number of classes of the task . Let further D = { ( xi , yi ) } i be the training set , with yi the correct label of xi , and L : RK × RK → R a given loss function . The aim is to enforce adversarial robustness in all multiple lp-balls simultaneously , i.e. , defining Bp ( p ) = { x ∈ Rd : ‖x‖p ≤ p } , the threat model is the union of the individual lp-balls ∆ = B1 ( 1 ) ∪B2 ( ) ∪B∞ ( ∞ ) , which is a non convex set , since in practice the p are chosen such that no lp-ball contains any of the others . In adversarial training the worst case loss for input perturbation in the threat model , maxδ∈∆ L ( fθ ( xi + δ ) , yi ) , is minimized . Efficiently maximizing the loss L in the union of threat models is non-trivial and different approaches to extend adversarial training to this setting have been proposed . They basically differ in the way how the inner maximization problem is tackled . MAX : Tramèr & Boneh ( 2019 ) suggest to run the three attacks for each Bp ( p ) for p ∈ { 1 , 2 , ∞ } independently and then use the one which realizes the highest loss , that is max δ∈∆ L ( fθ ( xi + δ ) , yi ) = max p∈ { 1,2 , ∞ } max δ∈Bp ( p ) L ( fθ ( xi + δ ) , yi ) . This training optimizes directly the worst case in the union but comes at the price of being nearly three times as expensive as normal adversarial training wrt a single lp-ball . AVG : In their AVG alternative Tramèr & Boneh ( 2019 ) suggest to run the three attacks for each Bp ( p ) for p ∈ { 1 , 2 , ∞ } independently but replace the inner maximization problem with∑ p∈ { 1,2 , ∞ } max δ∈Bp ( p ) L ( fθ ( xi + δ ) , yi ) , and thus one basically averages the updates of all lp-balls with the motivation of not “ wasting ” the computed attacks , in particular when the attained loss values are rather similar and thus the max is ambiguous . Again this costs three times as much as normal adversarial training . MSD : Maini et al . ( 2020 ) argue that the correct way to maximize the loss in the union is to test during the PGD attacks all the three steepest ascent updates corresponding to the three norms ( sign of the gradient for l∞ , normalized gradient for l2 and a smoothed l1-step by using the top-k components in magnitude of the gradient ) and then take the step which yields the highest loss . Maini et al . ( 2020 ) report that MSD outperforms both AVG and MAX , also in terms of a more stable training . As all three updates ( forward passes ) are tested but only one backward pass is needed ( gradient is the same ) this costs roughly two times as much as normal adversarial training . SAT : Madaan et al . ( 2021 ) introduce Stochastic Adversarial Training ( SAT ) which randomly samples p ∈ { 1 , 2 , ∞ } for each batch and performs PGD only for the corresponding lp-norm . While SAT has the same cost as standard adversarial training , Madaan et al . ( 2021 ) report that it does not perform very well .

Summary: This paper addresses the problem of multiple perturbation adversarial robustness for attacks subsumed within $\ell_p$ regions for $p\in{1,2,\infty}$. The main contribution of this work is to show how a model robust to a particular attack type (typically $\ell_\infty$) can be fine-tuned (at low cost) to be robust against multiple (or alternate) perturbation types. The authors build on prior formalization about the geometry of $\ell_p$ balls (by Croce et. al.) to empirically demonstrate its effect. The results are convincing and evaluated against AutoAttack which is