Understanding the Interaction of Adversarial Training with Noisy Labels

1 INTRODUCTION . In practice , the process of data labeling is usually noisy . Thus , it seems inevitable to learn with noisy labels ( Natarajan et al. , 2013 ) . To combat noisy labels , researchers have designed robust label-noise learning methods , such as sample selection ( Jiang et al. , 2018 ) and loss/label correction ( Patrini et al. , 2017 ; Nguyen et al. , 2019 ) . Meanwhile , safety-critical areas ( e.g. , medicine and finance ) require deep neural networks to be robust against adversarial examples ( Szegedy et al. , 2014 ; Nguyen et al. , 2015 ) . To combat adversarial examples , adversarial training methods empirically generate adversarial data on the fly for updating the model ( Madry et al. , 2018 ; Zhang et al. , 2019a ) . An interesting fact is that , the research community is exploring label-noise learning and adversarial training independently . For example , Ding et al . ( 2020 ) and Zhang et al . ( 2021b ) demonstrated that the non-robust data that are close to the nearest class boundary are easy to be attacked : their adversarial variants easily cross over the decision boundary . To fine-tune the decision boundaries for adversarial robustness , Ding et al . ( 2020 ) adaptively optimized small margins for non-robust data , while Zhang et al . ( 2021b ) gave more weights on them . However , both methods in adversarial training explored the adversarial robustness with an implicit assumption that data have clean labels . Obviously , it is not realistic in practice . To this end , we figure out the interaction of adversarial training with noisy labels . We discover that when noisy labels occur in adversarial training ( the right panel of Figure 1 ) , incorrect data ( square points ) are more likely to be non-robust ( i.e. , the predicted labels of their adversarial variants disagree with the given labels ) . Specifically , Figure 1 compares the difference between standard training ( ST ( Zhang et al. , 2017 ) ) and adversarial training ( AT ( Madry et al. , 2018 ) ) with noisy labels . Commonly , a small number of incorrect data ( square points ) are surrounded by a large number of correct data ( round points ) . In ST , deep networks shape two small clusters ( the left panel of Figure 1 ) around the two incorrect data due to memorization effects ( Zhang et al. , 2017 ) . In contrast , AT has strong smoothing effects , i.e. , smoothing out the small clusters around incorrect data and letting incorrect data alone ( the right panel of Figure 1 ) . To explain the above phenomenon in AT , we believe that the adversarial counterparts generated by ( majority ) correct data can help to smooth the local neighborhoods of correct data , which encourages deep networks to be locally constant within the neighborhood ( Papernot et al. , 2016 ) . Therefore , in AT , it becomes difficult for deep networks to form small but separated clusters around each incorrect data . Consequently , these incorrect data are non-robust , which echos the parallel findings that robust training avoids memorization of label noise ( Sanyal et al. , 2021 ) . Furthermore , we make quantitative comparisons between ST and AT in the presence of label noise . Zhang et al . ( 2017 ) showed that ST indeed overfits noisy labels , which definitely degrade the generalization performance of deep networks . From Figure 3 , it can be seen that the training accuracy of deep networks on incorrect data is obviously lower than that on correct data in AT . Nonetheless , the performance gap totally disappeared in ST . Therefore , compared to ST , AT can always distinguish correct data and incorrect data . Observing Figure 4 , the test accuracy of deep networks first increases then decreases in ST . Nonetheless , such a trend has been largely alleviated or totally eliminated in AT . Therefore , AT can mitigate negative effects of noisy labels , since the smoothing effects of AT can prevent memorizing such incorrect data . Moreover , under noisy labels , we realize that AT provides a new measure—how difficult it is to attack data to generate adversarial variants whose predictive labels are different from the given labels— which can distinguish correct/incorrect data ( Figures 7 ( a ) and 7 ( b ) ) and typical/rare data ( Figure 8 ) well . This new measure can be approximately realized by the number of projected gradient descent ( PGD ) steps ( Madry et al. , 2018 ) , i.e. , how many PGD iterations we need to generate misclassified adversarial variants . Compared with the commonly used measure , i.e. , the loss value ( Jiang et al. , 2018 ; Han et al. , 2018 ) , we find that the number of PGD steps could be an alternative or even better measure in AT ( Figures 7 ( a ) and 7 ( b ) ) . In addition , we discover that this new measure can easily pick up rare ( atypical ) data among typical data ( Figure 8 ) , where modern datasets often follow long-tailed distributions ( Feldman & Zhang , 2020 ) . Main contributions . To sum up , our contributions can be summarized in three aspects as follows . 1 . We explore the in-depth interaction of AT with noisy labels . Namely , we take a closer look at the smoothing effects of AT under label noise ( Section 3 ) . Subsequently , we conduct quantitative comparisons : compared with ST , AT can always distinguish correct and incorrect data and mitigate negative effects of label noise ( Section 4 ) . 2 . We realize that AT naturally provides a new measure called the number of PGD steps , i.e. , how many PGD iterations are needed to generate misclassified adversarial examples . Such a new measure can clearly differentiate the correct/incorrect data and typical/rare data ( Section 5 ) . 3 . We provide two simple examples of the applications of our new measure : a ) we develop a robust annotator , which can robustly annotate unlabeled ( U ) data considering that U data could be adversarially perturbed ( Section 6.1 ) ; b ) our new measure could be an alternative to the predictive probability for providing the confidence of annotated labels ( Section 6.2 ) . 2 BACKGROUND AND RELATED WORK . Adversarial training ( AT ) . As one of the primary defenses against adversarial examples ( Goodfellow et al. , 2015 ; Carlini & Wagner , 2017 ; Athalye et al. , 2018 ) , AT has been widely studied to improve the adversarial robustness of deep neural networks ( DNNs ) ( Cai et al. , 2018 ; Wang et al. , 2020b ; a ; Jiang et al. , 2020b ; Wu et al. , 2020 ; Chen et al. , 2020 ; Bai et al. , 2021 ; Chen et al. , 2021 ; Tian et al. , 2021 ) . The key objective of AT is to minimize the training loss on the adversarial variants of training data . We review the details of AT ( Madry et al. , 2018 ) used in this paper . Let ( X , d∞ ) denote the input feature space X with the infinity distance metric dinf ( x , x′ ) = ‖x− x′‖∞ , and B [ x ] = { x′ ∈ X | dinf ( x , x′ ) ≤ } be the closed ball of radius > 0 centered at x in X . S = { ( xi , yi ) } ni=1 is a dataset and ( xi , yi ) are i.i.d . from an underlying distribution , where xi ∈ X , yi ∈ Y = { 0 , 1 , . . . , C − 1 } , and C denotes the number of classes . The objective function of AT is min fθ∈F 1 n n∑ i=1 ` ( fθ ( x̃i ) , yi ) , ( 1 ) where x̃i is an adversarial variant of input data xi within the -ball centered at x and fθ ( · ) : X → RC is a score function . ` : RC × Y → R is a loss function which is a composition of a base loss ` B : ∆ C−1 × Y → R ( e.g. , the cross-entropy loss ) and an inverse link function ` L : RC → ∆C−1 ( e.g. , the soft-max activation ) , in which ∆C−1 is the corresponding probability simplex—in other words , ` ( fθ ( · ) , y ) = ` B ( ` L ( fθ ( · ) ) , y ) . To generate the adversarial variants x̃ for natural data x , AT employs the PGD method ( Madry et al. , 2018 ) . Given a starting point x ( 0 ) ∈ X and step size α > 0 , PGD works as follows : x ( t+1 ) = ΠB [ x ( 0 ) ] ( x ( t ) + α sign ( ∇x ( t ) ` ( fθ ( x ( t ) ) , y ) ) ) , ( 2 ) until a certain stopping criterion is satisfied . In the above equation , t ∈ N , ` is the loss function , x ( 0 ) refers to natural data or natural data perturbed by a small Gaussian or uniform random noise , y is the corresponding label for natural data x , x ( t ) is an adversarial data point at step t , and ΠB [ x0 ] ( · ) is the projection function that projects the adversarial data back into the -ball centered at x ( 0 ) if necessary . It is common to use PGD to generate adversarial variants x̃ in AT methods ( Wang et al. , 2019 ; Zhang et al. , 2020 ) . Recently , Zhang et al . ( 2021b ) explored adversarial robustness by giving more weights on the non-robust data with the assumption that all labels are correct . Specifically , the non-robust data are geometrically close to the class boundaries , which can easily go across the class boundaries by a small perturbation . To approximate the distance between the data and the class boundaries , they proposed the geometry-aware projected gradient descent ( GA-PGD ) to calculate the geometry value κ , which is the least number of iterations that PGD needs to find misclassified adversarial variants of input data . In this paper , we utilize the geometry value κ to represent our proposed measure ( i.e. , the number of PGD steps ) ; we further explore its applications such as selecting correct/incorrect and typical/rare data ( Section 5 ) , assisting to develop a robust annotator ( Section 6.1 ) and providing the annotation confidence ( Section 6.2 ) . Label-noise learning . We consider a training set with X = ( x1 , . . . , xN ) and its associated labels Y = ( y1 , . . . , yN ) , where yi ∈ Y is the one-hot label for the instance xi and ( xi , yi ) are drawn i.i.d . from some unknown distribution . In the setting of label noise , we observe noisy labels Ỹ = ( ỹ1 , . . . , ỹN ) where ỹi ∈ Ỹ might be different from the corresponding ground-truth label yi ∈ Y . In this paper , we mainly focus on typical class-conditional noise : 1 ) symmetric-flipping noise ( Van Rooyen et al. , 2015 ) , where noisy labels are corrupted at random with the uniform distribution ; 2 ) pair-flipping noise ( Han et al. , 2018 ) , where noisy labels are corrupted between adjacent classes that are prone to be mislabeled . Note that pair-flipping noise is an extremely hard case of asymmetric-flipping noise ( Patrini et al. , 2017 ) . To combat noisy labels , researchers have designed robust label-noise learning methods , such as sample selection ( Malach & Shalev-Shwartz , 2017 ; Jiang et al. , 2020a ; Han et al. , 2020a ) , loss correction ( Han et al. , 2020b ; Liu & Guo , 2020 ) , and label correction ( Wang et al. , 2018 ) . Among them , sample selection is emerging due to its simplicity . The key idea of sample selection is to back-propagate clean samples ( regarded as correct data ) during training . Since DNNs learn simple patterns first ( Zhang et al. , 2017 ; Arpit et al. , 2017 ) , the loss value is used as a general criterion for selecting clean samples ( Han et al. , 2018 ; Yao et al. , 2020 ) . Specifically , the data with small-loss values are considered as clean samples , which are used to update the model . In contrast , the data with large-loss values are considered as noisy samples , which should be discarded or utilized in another way ( Han et al. , 2020a ) . Note that this paper proposes a new criterion—the number of PGD steps—for sample selection ( Section 5 ) . Co-existence of adversarial examples and noisy labels ( NL ) . Some work has previously studied adversarial examples and noisy labels ( NL ) jointly . Alayrac et al . ( 2019 ) empirically showed that NL negatively affects AT ’ s performance , but AT ’ s robust accuracy apparently suffers less than AT ’ s natural accuracy . Sanyal et al . ( 2021 ) empirically found that AT can avoid the memorization of NL . Damodaran et al . ( 2019 ) proposed to use Wasserstein adversarial regularization to combat NL for benefiting ST ’ s generalization . In contrast , we advocate the AT ’ s smoothing effect by making quantitative comparisons between AT and ST under NL . Specifically , ST has a memorization effect that gradually memorizes NL and degrades generalization in the end , while AT has a smoothing effect that avoids the memorization of NL and combats NL for benefiting generalization . In addition , we propose a new measure called the number of PGD steps for sample selection , which can differentiate the correct/incorrect data and typical/rare data , and we provide two exemplar applications for our new measure . Furthermore , in Appendix A , we provide extensive comparisons between our study and the existing literature .

Summary: This paper studies the connection between noisy labels (NL) and adversarial training (AT). The contribution of this paper is two-fold. The first one is to adopt the number of PGD attack steps as a criterion for sample selection to correct noisy labels. The second one is that adversarial training can serve as a way to correct noisy labels. These two contributions indicate that adversarial training can be applied to more general model robustness problems.