Adversarially Robust Generalization Just Requires More Unlabeled Data

1 INTRODUCTION . Deep learning ( LeCun et al. , 2015 ) , especially deep Convolutional Neural Network ( CNN ) ( LeCun et al. , 1998 ) , has led to state-of-the-art results spanning many machine learning fields , such as image classification ( Simonyan & Zisserman , 2014 ; He et al. , 2016 ; Huang et al. , 2017 ; Hu et al. , 2017 ) , object detection ( Ren et al. , 2015 ; Redmon et al. , 2016 ; Lin et al. , 2018 ) , semantic segmentation ( Long et al. , 2015 ; Zhao et al. , 2017 ; Chen et al. , 2018 ) and action recognition ( Tran et al. , 2015 ; Wang et al. , 2016 ; 2018 ) . Despite the great success in numerous applications , recent studies show that deep CNNs are vulnerable to some well-designed input samples named as Adversarial Examples ( Szegedy et al. , 2013 ; Biggio et al. , 2013 ) . Take image classification as an example , for almost every commonly used well-performed CNN , attackers are able to construct a small perturbation on an input image . The perturbation is almost imperceptible to humans but can fool the model to make a wrong prediction . The problem is serious as some designed adversarial examples can be transferred among different kinds of CNN architectures ( Papernot et al. , 2016 ) , which makes it possible to perform black-box attack : an attacker has no access to the model parameters or even architecture , but can still easily fool a machine learning system . There is a rapidly growing body of work on studying how to obtain a robust neural network model . Most of the successful methods are based on adversarial training ( Szegedy et al. , 2013 ; Madry et al. , 2017 ; Goodfellow et al. , 2015 ; Huang et al. , 2015 ) . The high-level idea of these works is that during training , we predict the strongest perturbation to each sample against the current model and use the perturbed sample together with the correct label for gradient descent optimization . However , the learned model tends to overfit on the training data and fails to keep robust on unseen testing data . For example , using the state-of-the-art adversarial robust training method ( Madry et al. , 2017 ) , the defense success rate of the learned model on the testing data is below 60 % while that on the training data is almost 100 % , which indicates that the robustness fails to generalize . Some theoretical results further show that it is challenging to achieve adversarially robust generalization . Fawzi et al . ( 2018 ) proves that adversarial examples exist for any classifiers and can be transferred across different models , making it impossible to design network architectures free from adversarial attacks . Schmidt et al . ( 2018 ) shows that adversarially robust generalization requires much more labeled data than standard generalization in certain cases . Tsipras et al . ( 2019 ) presents an inherent trade-off between accuracy and robust accuracy and argues that the phenomenon comes from the fact that robust classifiers learn different features . Therefore it is hard to reach high robustness for standard training methods . Given the challenge of the task and previous findings , in this paper , we provide several theoretical and empirical results towards better adversarially robust generalization . In particular , we show that we can learn an adversarially robust model which generalizes well if we have plenty of unlabeled data , and the labeled sample complexity for adversarially robust generalization in Schmidt et al . ( 2018 ) can be largely reduced if unlabeled data is used . First , we show that the expected robust risk can be upper bounded by the sum of two terms : a stability term which measures whether the model can output consistent predictions under perturbations , and an accuracy term which evaluates whether the model can make correct predictions on natural samples . Given the stability term does not rely on ground truth labels , unlabeled data can be used to minimize this term and thus improve the generalization ability . Second , we prove that for the Gaussian mixture problem defined in Schmidt et al . ( 2018 ) , if unlabeled data can be used , adversarially robust generalization will be almost as easy as the standard generalization in supervised learning ( i.e . using the same number of labeled samples under similar conditions ) . Inspired by the theoretical findings , we provide a practical algorithm that can learn from both labeled and unlabeled data for better adversarially robust generalization . Our experiments on MNIST and Cifar-10 show that the method achieves better performance , which verifies our theoretical findings . Our contributions are in three folds . • In Section 3.2.1 , we provide a theorem to show that unlabeled data can be naturally used to improve the expected robust risk in general setting and thus leveraging unlabeled data is a way to improve adversarially robust generalization . • In Section 3.2.2 , we discuss a specific Gaussian mixture problem introduced in Schmidt et al . ( 2018 ) . In Schmidt et al . ( 2018 ) , the authors proved that in this case , the labeled sample complexity for robust generalization is significantly larger than that for standard generalization . As an extension of this work , we prove that in this case , the labeled sample complexity for robust generalization can be the same as that for standard generalization if we have enough unlabeled data . • Inspired by our theoretical findings , we provide an adversarial robust training algorithm using both labeled and unlabeled data . Our experimental results show that the algorithm achieves better performance than baseline algorithms on MNIST and Cifar-10 , which empirically proves that unlabeled data can help improve adversarially robust generalization . 2 RELATED WORKS . Adversarial attacks and defense Most previous works study how to attack a neural network model using small perturbations under certain norm constraints , such as l∞ norm or l2 norm . For the l∞ constraint , Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2015 ) finds a direction to which the perturbation increases the classification loss at an input point to the greatest extent ; Projected Gradient Descent ( PGD ) ( Madry et al. , 2017 ) extends FGSM by updating the direction of the attack in an iterative manner and clipping the modifications in the norm range after each iteration . For the l2 constraint , DeepFool ( Moosavi-Dezfooli et al. , 2016 ) iteratively computes the minimal norm of an adversarial perturbation by linearizing around the input in each iteration . C & W attack ( Carlini & Wagner , 2016 ) is a comprehensive approach that works under both norm constraints . In this work , we focus on learning a robust model to defend the white-box attack , i.e . the attacker knows the model parameters and thus can use the algorithms above to attack the model . There are a large number of papers about defending against adversarial attacks , but the result is far from satisfactory . Remarkably , Athalye et al . ( 2018 ) shows most defense methods take advantage of so-called “ gradient mask ” and provides an attacking method called BPDA to correct the gradients . So far , adversarial training ( Madry et al. , 2017 ) has been the most successful white-box defense al- gorithm . By modeling the learning problem as a mini-max game between the attacker and defender , the robust model can be trained using iterative optimization methods . Some recent papers ( Wang et al. , 2019 ; Gao et al. , 2019 ) theoretically prove the convergence of adversarial training . Moreover , Shafahi et al . ( 2019 ) ; Zhang et al . ( 2019a ) propose ways to accelerate the speed of adversarial training . Adversarial logit pairing ( Kannan et al. , 2018 ) and TRADES ( Zhang et al. , 2019b ) further improve adversarial training by decomposing the prediction error as the sum of classification error and boundary error , and Wang et al . ( 2019 ) proposes to improve adversarial training by evaluating the quality of adversarial examples using the FOSC metric . Semi-supervised learning Using unlabeled data to help the learning process has been proved promising in different applications ( Rasmus et al. , 2015 ; Zhang & Shi , 2011 ; Elworthy , 1994 ) . Many approaches use regularizers called “ soft constraints ” to make the model “ behave ” well on unlabeled data . For example , transductive SVM ( Joachims , 1999 ) uses prediction confidence as a soft constraint , and graph-based SSL ( Belkin et al. , 2006 ; Talukdar & Crammer , 2009 ) requires the model to have similar outputs at endpoints of an edge . The most related work to ours is the consistencybased SSL . It uses consistency as a soft constraint , which encourages the model to make consistent predictions on unlabeled data when a small perturbation is added . The consistency metric can be either computed by the model ’ s own predictions , such as the Π model ( Sajjadi et al. , 2016 ) , Temporal Ensembling ( Laine & Aila , 2016 ) and Virtual Adversarial Training ( Miyato et al. , 2018 ) , or by the predictions of a teacher model , such as the mean teacher model ( Tarvainen & Valpola , 2017 ) . Semi-supervised learning for adversarially robust generalization There are three other concurrent and independent works ( Carmon et al. , 2019 ; Uesato et al. , 2019 ; Najafi et al. , 2019 ) which also explore how to use unlabeled data to help adversarially robust generalization . We describe the three works below , and compare them with ours . See also Carmon et al . ( 2019 ) and Uesato et al . ( 2019 ) for the comparison of all the four works from their perspective . Najafi et al . ( 2019 ) investigate the robust semi-supervised learning from the distributionally robust optimization perspective . They assign soft labels to the unlabeled data according to an adversarial loss and train such images together with the labeled ones . Results on a wide range of tasks show that the proposed algorithm improves the adversarially robust generalization . Both Najafi et al . ( 2019 ) and we conduct semi-supervised experiments by removing labels from the training data . Uesato et al . ( 2019 ) study the Gaussian mixture model of Schmidt et al . ( 2018 ) and theoretically show that a self-training algorithm can successfully leverage unlabeled data to improve adversarial robustness . They extend the self-training algorithm to the real image dataset Cifar10 , augment it with unlabeled Tiny Image dataset and improve state-of-the-art adversarial robustness . They show strong improvements in the low labeled data regimes by removing most labels from CIFAR-10 and SVHN . In our work , we also study the Gaussian mixture model and show that a slightly different algorithm can improve adversarially robust generalization as well . We observe similar improvements using our algorithm on Cifar-10 and MNIST . Carmon et al . ( 2019 ) obtain similar theoretical and empirical results as in Uesato et al . ( 2019 ) , and offer a more comprehensive analysis of other aspects . They show that by using unlabeled data and robust self-training , the learned models can obtain better certified robustness against all possible attacks . Moreover , they study the impact of different training components on the final model performance , such as the size of unlabeled data . We also study the influence of different factors in our experiments and have similar observations .

Summary: The authors study the sample complexity of adversarially robust learning with access to unlabeled samples. Theoretically, they consider the setting of Schmidt et al. 2018 (separating two class-conditional Gaussians) and present an algorithm which can learn a robust classifier with only a few labeled samples and a large number of unlabeled samples (circumventing the sample complexity separation of the original work). Then, the authors propose a modification of the VAT algorithm (Miyato et al. 2018) to train deep networks utilizing unlabeled samples. They find that, empirically, their algorithm achieves better performance compared to standard adversarial training on the labeled samples.