Adversarial Robustness Through the Lens of Causality

The adversarial vulnerability of deep neural networks has attracted significant attention in machine learning . As causal reasoning has an instinct for modeling distribution change , it is essential to incorporate causality into analyzing this specific type of distribution change induced by adversarial attacks . However , causal formulations of the intuition of adversarial attacks and the development of robust DNNs are still lacking in the literature . To bridge this gap , we construct a causal graph to model the generation process of adversarial examples and define the adversarial distribution to formalize the intuition of adversarial attacks . From the causal perspective , we study the distinction between the natural and adversarial distribution and conclude that the origin of adversarial vulnerability is the focus of models on spurious correlations . Inspired by the causal understanding , we propose the adversarial distribution alignment method to eliminate the difference between natural and adversarial distributions by considering spurious correlations . Extensive experiments demonstrate the efficacy of the proposed method . Our work is the first attempt towards using causality to understand and mitigate adversarial vulnerability . 1 INTRODUCTION . The seminal work ( Szegedy et al. , 2014 ; Biggio et al. , 2013 ) shows that DNNs are vulnerable to adversarial examples , which consist of malicious perturbations imperceptible to humans yet fooling state-of-the-art models ( Krizhevsky et al. , 2012 ; Szegedy et al. , 2015 ; Simonyan & Zisserman , 2014 ; He et al. , 2016 ) . The lack of robustness hinders the applications of DNNs to some safetycritical areas such as automatic driving ( Tuncali et al. , 2018 ) and healthcare ( Finlayson et al. , 2019 ) . Therefore , mitigating the adversarial vulnerability is critical to the further development of DNNs . Human cognitive systems are immune to the distribution change induced by adversarial attacks because humans are more sensitive to causal relations than statistical associations ( Gopnik et al. , 2004 ) . Using causal language , causal reasoning can identify causal relation and ignore nuisance factors , i.e. , not the cause of labels , by intervention ( Pearl , 2009 ; Peters et al. , 2017 ) . As adversarial perturbations are usually imperceptible and make no impact on human decisions ( Szegedy et al. , 2014 ; Goodfellow et al. , 2014 ) , it is reasonable to assume that the difference between natural and adversarial examples comes from nuisance factors . This is because if task-relevant factors of some samples are changed , these samples will make both humans and DNNs change their decisions . From a causal viewpoint ( Zhang et al. , 2020a ) , adversarial attacks can be regarded as a specific type of distribution change resulting from the intervention on the natural data distribution . In summary , causal reasoning has the instinct for analyzing the effect of the intervention caused by adversarial attacks , so it is essential to leverage causality to understand and mitigate the adversarial vulnerability . However , there are two significant problems to overcome before using causality to understand and mitigate the adversarial vulnerability . Firstly , constructing a causal graph is arguably the fundamental premise for causal reasoning ( Pearl , 2009 ; Peters et al. , 2017 ) , but how to construct causal graphs in the context of adversarial attacks is still lacking in the literature . Secondly , using causal language to formalize the intuition of adversarial attacks is the key to connect causality and adversarial vulnerability , but it also remains to be solved . These two problems are fundamental obstacles , which prevent us from employing causality to contribute to adversarial learning . To address these challenges , we first construct a causal graph to model the perceived data generation process where nuisance factors are considered . The constructed causal graph can entail a specific intervention distribution , i.e. , the adversarial distribution . Moreover , the causal graph immediately shows that , given inputs , labels are statistically correlated with nuisance factors , which have no cause-effect to labels . The spurious correlation implies that if DNNs fit the conditional association between labels and nuisance factors , their performance on different conditional associations between labels and nuisance factors will change accordingly . Through investigating the distinction between these two distributions induced by nuisance factors , we conclude that adversarial distributions can be obtained by exploiting conditional associations between labels and nuisance factors , where the conditional association of adversarial distributions is drastically different from that of natural distributions . Namely , the origin of adversarial vulnerability is the focus of DNNs on the spurious correlation between labels and nuisance factors . According to the causal perspective , an adversarial distribution is crafted by exploiting a specific conditional association between labels and nuisance factors , this association is drastically different from that of natural distributions . Intuitively , eliminating the difference in such conditional associations between natural and adversarial distributions can promote the performance of models on adversarial distributions . Thus , we propose an adversarial distribution alignment method to eliminate the difference between these two distributions . Surprisingly , we find that the proposed method shares the same spirits to existing adversarial training ( Goodfellow et al. , 2014 ) variants , i.e. , Madry ( Madry et al. , 2017 ) and TRADES ( Zhang et al. , 2019 ) . We validate the efficacy of the proposed method on MNIST , CIFAR10 , and CIFAR100 ( Krizhevsky et al. , 2009 ) datasets under various adversarial attacks such as FGSM ( Goodfellow et al. , 2014 ) , PGD ( Madry et al. , 2017 ) , CW attack ( Carlini & Wagner , 2017 ) , and AutoAttack ( Croce & Hein , 2020 ) . Extensive experiments demonstrate that the proposed method can improve the adversarial robustness significantly . Our main contributions are : • We provide a causal perspective to understand and mitigate the adversarial vulnerability , which is the first attempt towards using causality to contribute adversarial learning . • To leverage causality to contribute adversarial learning , we solve two fundamental problems . Specifically , we construct a causal graph to model the adversarial data generation process and define the adversarial distribution to formalize adversarial attacks . • A defense method called adversarial distribution alignment is proposed to reduce adversarial vulnerability by eliminating the difference between adversarial distribution and natural distribution . Extensive experiments demonstrate that the proposed method can significantly improve the adversarial robustness . 2 A CAUSAL VIEW ON ADVERSARIAL DATA GENERATION . The ability of humans to perform causal reasoning is arguably an essential factor that makes human learning different from deep learning ( Schölkopf et al. , 2021 ; Zhang et al. , 2020a ; Gopnik et al. , 2004 ) . The superiority of causal reasoning endows humans with the ability to identify causal relations and ignore nuisance factors that are not relevant to the task . In contrast , DNNs are usually trained to fit the perceived information overlooking the ability to distinguish causal relations and statistical associations . This shortcut solution could lead to overfitting to these nuisance factors , which would further result in the sensitivity of DNNs to such factors . Therefore , we propose incorporating causal reasoning to mitigate the sensitivity of DNNs to these nuisance factors . Before using causal reasoning to analyze adversarial vulnerability , we need to construct a causal graph , as causal graphs are the key for formalizing causal reasoning ( Peters et al. , 2017 ) . In the context of adversarial learning , we desire the causal graph by which both the natural and the adversarial distributions can be generated . In addition , the graph is required to reflect the impact of nuisance factors on these two distributions , so that we can investigate the difference in nuisance factors between these two distributions . Consequently , we can formally establish the connection between nuisance factors and adversarial vulnerability . Therefore , we propose constructing a causal graph to model the adversarial generation process where the nuisance factors are considered . One approach is to use causal structure learning to infer causal graphs ( Pearl , 2009 ; Peters et al. , 2017 ) , but it is challenging to apply this kind of approach to high-dimensional data . Using external knowl- edge to construct causal graphs is another approach ( Zhang et al. , 2013 ; Tang et al. , 2020 ; Schölkopf et al. , 2021 ) . As automatically learning a precise causal graph is out of scope for this work , external human knowledge about the data generation process is employed to construct the causal graph . Specifically , we construct a causal graph G to formalize the image data generation process using the following knowledge for analyzing adversarial vulnerability . As there might be a number of different causes of natural data X , we propose to divide all the causes into two categories for simplicity . We group content-related causes into one category , called content variable C. The rest causes , i.e. , nuisance factors , are grouped into another category , called style variable S , which is contentindependent , i.e. , S ⫫ C. This implies that C → X ← S. It is noteworthy that , in this paper , we assume that only the content variable is relevant for the task we care about , i.e. , C → Y . Perceived data X̃ are usually composed of perturbations E and natural data X . When the perturbation E is designed carefully to fool DNNs , E should be a compound result of X ( the object to be perturbed ) , Y ( the reference for the perturbation ) , and θ ( the targets affected by the perturbation ) , e.g. , white-box attacks ( Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ; Moosavi-Dezfooli et al. , 2016 ) , which means that ( X , Y , θ ) → E 1 . Leverage all this background knowledge , we obtain the causal graph G formalizing the perturbed data generation process , depicted in Fig . 1 . Based on the causal graph , we can define valid interventions ( Pearl , 2009 ; Schölkopf et al. , 2021 ) and the corresponding intervention distributions . Defining valid interventions is equivalent to determining which variables or mechanisms in the causal graph can be intervened . In this work , we consider both hard and soft interventions ( Eberhardt & Scheines , 2007 ; Correa & Bareinboim , 2020 ) on the perturbation variable E. Specifically , we can use a structural causal model to represent the generating mechanism of E : E ≔M ( X , Y , θ , UE ) , ( 1 ) where the exogenous variable UE stands for other indeterminacies , e.g. , random start noise used in PGD attack ( Madry et al. , 2017 ) . By intervening E in different ways , we can obtain different intervention distributions , which could be either natural or adversarial , over the observed variables . For example , if we do a hard intervention on E , i.e. , do ( E = 0 ) in the graph , the generated data distribution corresponds to the natural distribution P ( X , Y ) . Different perturbations can be obtained by performing soft interventions on E , i.e. , modifying M. In the context of adversarial attacks , adversaries aim to maximize a certain objective function ` ( ⋅ ) to mislead a target model h ( X ; θ ) by searching for the worst perturbation for each instance ( Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ; Dong et al. , 2018 ; Madry et al. , 2017 ) , where θ stands for parameters of the target model . To formalize the intuition of adversarial attacks , we can first search for the adversarial perturbation Eadv , and then use a function to approximate the mechanism for generating Eadv . The adversarial perturbation Eadv can be obtained by maximizing ` ( ⋅ ) : Eadv = arg max E ′∈B ` ( h ( X + E ′ ; θ ) , Y ) . ( 2 ) 1These three causes are not indispensable . Deleting θ gives black-box attacks ( Papernot et al. , 2017 ; Dong et al. , 2018 ) that only use ( X , Y ) to perform attacks . Deleting X leads to universal adversarial attacks ( Moosavi-Dezfooli et al. , 2017 ; Hendrik Metzen et al. , 2017 ) , which assume that one adversarial perturbation is sufficient to fool DNNs . Recent works show that a specific transform to X effectively evaluates the sensitivity of DNNs within a small neighborhood ( Rahaman et al. , 2019 ; Zhang et al. , 2020c ) , which corresponds to deleting ( Y , θ ) from the cause set . where B is a set of valid perturbations , and the adversarial perturbation Eadv is the result of the mechanism Madv , i.e. , Eadv ≔Madv ( X , Y , θ , UE ) . The intervention distribution that corresponds to the adversarial mechanism Madv is defined as the adversarial distribution Pθ ( X̃ , Y ) , where the subscript θ indicates that Pθ ( X̃ , Y ) is crafted to attack the target model h ( X ; θ ) with parameter θ .

Summary: The work presents a causal perspective of adversarial attacks on image-based machine learning models by studying a causal graph of the adversarial data creation process and highlighting how such a process makes the learned models vulnerable. It argues that the main reason for adversarial vulnerability is the reliance of models on spurious correlations between labels and style. Accordingly, it proposes a method to learn models for which the conditional distribution of label given style and image does not vary much when attacked. Empirically, the method is shown to be more robust than two baselines on three datasets.