Improved resistance of neural networks to adversarial images through generative pre-training

1 INTRODUCTION . In an adversarial attack on a classification system one seeks inputs that lie very close ( according to some norm or measure ) to a regular input , but give a completely different classification result . Adversarial attacks on machine learning systems have been studied for over a decade , starting from the study of attacks on spam filtering systems ( for a historical review see Biggio and Roli ( 2018 ) ) . Adversarial attacks on deep learning image recognition models have first been discussed by Szegedy et al . ( 2013 ) . In addition to highlighting security implications adversarial images have acquired a new meaning in this context , presenting us with a fundamental conundrum : How can deep learning systems succesfully generalise and at the same time be extremely vulnerable to minute changes in the input ? The topic of adversarial images in neural nets has been studied intensely with attacks and defences leapfrogging each other ( for an overview see Kurakin et al . ( 2018 ) ) . All common neural network models suffer from susceptibility to adversarial attacks . It has even been shown by Moosavi-Dezfooli et al . ( 2017 ) that adversarial attack patterns can be transferred between different models , suggesting some common underlying mechanism . Despite the intense study of the subject a solution remains elusive , with Jetley et al . ( 2018 ) suggesting that classification performance and vulnerability to adversarial attacks are correlated , while Gilmer et al . ( 2018 ) present evidence for the opposite in a simple model . The difficulty in finding neural networks robust against adversarial attacks suggest that the standard discriminative neural network training procedure and the resulting networks ’ vulnerability are linked . Making use of generative methods ( e.g variational autoencoders , introduced in this context by Gu and Rigazio ( 2014 ) ) has resulted in creating the most adversarially robust classifications but with added computational cost at inference time ( Schott et al . ( 2018 ) ) . Another state of the art approach to increasing adversarial resistance applies denoising to image patches to achieve strong robustness ( Moosavi-Dezfooli et al . ( 2018 ) ) . In this article we concentrate on one common generative model , Boltzmann machines , and the impact of its use on adversarial resistance . We examine the adversarial resistance on the standard MNIST dataset . Boltzmann machines are a stochastic model with binary units ( see e.g . Hinton ( 2007 ) ) . A number of “ hidden ” units form a model for the data distribution over the “ visible ” units . In a classification scenario one would fix the visible units and use the probability distribution over the hidden units for further processing . In a restricted Boltzmann machine the hidden units are independent and therefore the distribution over the hidden units in a classification scenario becomes a product distribution fully characterised by the average values of the individual hidden units . Pretraining using restricted Boltzmann machines has been used in early neural networks ( Hinton et al . ( 2006 ) ) but was abandoned as it became clear that good training can be achieved without it . Here we follow a slightly different path . We will use a Boltzmann machine to model image patches only . We do the modelling in a hierarchical fashion : train one Boltzmann machine for small image patches , then add more hidden units to model the joint distribution over larger patches , similar to the stacked RBM approach of Norouzi et al . ( 2009 ) . This forces us to depart from a simple restricted Boltzmann machine model and therefore we can not obtain the hidden probability distribution as easily as for a restricted Boltzmann machine . Extended mean field methods developed for the description of spin glasses in physics ( Thouless et al . ( 1977 ) ; Georges and Yedidia ( 1991 ) ; Kühn and Helias ( 2017 ) ) have been applied succesfully to train a restricted Boltzmann machine by Gabrié et al . ( 2015 ) and Budzianowski ( 2016 ) . We use these methods to arrive at a description of the hidden units in terms of their average values , where now we replace the single neural network layer resulting from the restricted Boltzmann machine with a many-layer iteration derived from the mean field description . This pre-trained building block can be used as a fixed input layer in a neural network trained in the usual discriminatory fashion . In summary the contributions of this article are as follows : • We construct a new neural network building block , based on the mean field description of a Boltzmann machine . The result is a deep feed forward neural network with shared weights and a structure derived from the energy function of the underlying Boltzmann machine . • We use this building block in a neural network to achieve state of the art resistance to adversarial attacks on MNIST and show a correlation between the loss function of the Boltzmann machine ( i.e . it ’ s generative capability ) and the adversarial resistance of the resulting neural network . • We show that the function mapping visible unit inputs to hidden unit outputs implemented by the new building block is strongly dependent on the input . A ball of random distortions around a training example gets mapped to a smaller output volume compared to the same mapping starting from a random input . 2 BOLTZMANN MACHINES AS FEATURE EXTRACTORS . Let us review the the mean field description of a Boltzmann machine ( Budzianowski ( 2016 ) ; Gabrié et al . ( 2015 ) ) . Boltzmann machines are stochastic , energy based models derived from the statistical physics of interacting spins . Boltzmann machines are a generative model , the generated probability distribution being the thermal equilibrium probability distribution over all possible spin combinations s = ( s1 , s2 , . . . , sN ) with sn = ±1 , as determined by the energy function through its parameters θ = ( b , J ) E ( θ , s ) = s · J · s+ b · s , so that the probability of realising the configuration s is proportional to the Boltzmann factor p ( θ , s ) ∝ e−E ( θ , s ) . The spins are divided into two sets , the visible units v and the hidden units h. When training a Boltzmann machine we want to generate a target probability distribution p0 ( v ) over the visible units , as defined by example configurations v ( 0 ) j , j = 1 , . . . , nJ . This can be achieved by adjusting the parameters of the energy function to minimise the relative entropy between the marginal distribution over the visible units p ( v , θ ) = Trh p ( v , h , θ ) . and the target distribution : D ( p0||p ) = nJ∑ j=1 p0 ( v ( 0 ) j ) log p0 ( v ( 0 ) j ) − p0 ( v ( 0 ) j ) log p ( θ , v ( 0 ) j ) . ( 1 ) The gradient of the relative entropy with respect to the parameters of the energy function θ can be expressed in terms of expectation values of spins dD ( p0||p ) dbk = nJ∑ j=1 p0 ( v ( 0 ) j ) p ( θ , v ( 0 ) j ) 〈sk〉C ( j ) − 〈sk〉F , ( 2 ) and spin-spin correlators dD ( p0||p ) dJkl = nJ∑ j=1 p0 ( v ( 0 ) j ) p ( θ , v ( 0 ) j ) 〈sksl〉C ( j ) − 〈sksl〉F , ( 3 ) where 〈. . .〉F denotes the expectation value of the model without constraints ( free ) and 〈. . .〉C ( j ) the expectation value if the visible units are fixed to example vj ( clamped ) . This gradient can be used in a first order optimisation method to arrive at an optimal parameter configuration θ0 . While the expression for the gradient looks simple , evaluating the probabilities and expectation values is not , and some approximation scheme needs to be used . Two schemes are usually used , one based on sampling ( Hinton and E. ( 2002 ) ) , the other one based on a mean field approximation . Here we will concentrate on the mean field approximation . The central quantity in mean field theory is the free energy . We can obtain the free energy of our model as an expansion in the order of the coupling J as derived by a number of authors ( Georges and Yedidia ( 1991 ) ; Kühn and Helias ( 2017 ) ) . F = ∑ n Fn To lowest order the free energy is given by the entropy of independent spins . F0 = N∑ i=1 ( 1−mi 2 ) log ( 1−mi 2 ) + ( 1 +mi 2 ) log ( 1 +mi 2 ) , where mi is the magnetisation of spin i . Up to second order we obtain F1 = ∑ 〈ij〉 Jijmimj + ∑ i bimi , F2 = ∑ 〈ij〉 J2ij ( 1−m2i ) ( 1−m2j ) , where the notation 〈ij〉 denotes summation over unequal indices . For orders up to four see appendix A . From the free energy we can derive an equation to obtain the mean field values mi in the approximation up to order N mi = tanh ( N∑ n=1 R ( n ) i ) ( 4 ) with R ( n ) i = dFn dmi . In particular , the first two orders are R ( 1 ) i = bi + 2 ∑ j Jijmj and R ( 2 ) i = −4mi ∑ j J2ij ( 1−m2j ) . Higher orders can be found in the appendix A . In the free case , the transcendental equation , Eq . 4 can be solved by iteration , starting from zero or random magnetisations , until the magnetisations converge . In the clamped case we keep the visible magnetisations fixed , while iterating over the hidden units . This results in two sets of distinct magnetisations : the free magnetisations mF and the clamped magnetisations mC ( j ) , where example j is fixed on the visible units . We also get a set of corresponding free energies FF and FC ( j ) . The correlation functions can be obtained from the free energies 〈sksl〉F/C ( j ) = 1 2 dFF/C ( j ) dJkl , and the expectation values are given directly by 〈sk〉F/C ( j ) = mF/C ( j ) , k. These expectation values can be inserted in the expressions for the gradient , Eqs . 2 and 3 , and used to minimise the relative entropy Eq . 1 . Probabilities can be estimated from the free energies p ( θ , v ( 0 ) j ) = e FC ( j ) −FF . The training of a Boltzmann machine emphasises the main task of the machine as generating examples from the target distribution , but one can look at the machine from a different point of view : using the hidden units for constructing a model of the example data . The probability distribution over the hidden units if an example is fixed on the visible units then tells us something about the model required to describe the example . In a restricted Boltzmann machine ( RBM ) the probability distribution is a product distribution over the hidden units and features , but one can imagine introducing couplings between hidden units to account for correlations between individual features to arrive at a better/simpler description of the data . In the remaining article we will discuss machines that have bipartite connectivity between visible and hidden units and full connectivity between hidden units . During inference we want to obtain the hidden magnetisations given the magnetisations of the visible units . We split the magnetisations into visible and hidden parts m = ( mv , mh ) . Similarly we split the magnetic fields b = ( 0 , bh ) and the couplings J = ( 0 W W Jh ) , where W now describes the bipartite connectivity between visible and hidden units and Jh the coupling between hidden units . Keeping terms to second order the mean field equations become mh = tanh [ 2W ·mv + bh + 2Jh ·mh − 4mhJ2h · ( 1−m2h ) ] . ( 5 ) Solving the mean field equation Eq . 5 requires iteration , e.g . starting from the initial magnetisations mh = 0 . The iteration can be unrolled into an r layer neural network , where r is greater than the number of iterations necessary for convergence ( see Fig . 1 ) . We will refer to this neural network as the mean field Boltzmann network .

Summary: Authors propose a novel combination of RBM feature extractor and CNN classifiers to gain robustness toward adversarial attacks. They first train a small mean field boltzmann machine on 4x4 patches of MNIST, then combine 4 of these into a larger 8x8 feature extractor. Authors use the RBM 8x8 feature representation as a fixed convolutional layer and train a CNN on top of it. The intuition behind the idea is that since RBMs are generative, the RBM layer will act as a denoiser.