Self-Adaptive Perturbation Radii for Adversarial Training
Authors: Huimin Wu
Zhang Chenkang
Bin Gu
Venue: Submitted to ICLR 2023 (2023)

Abstract: Adversarial training has been shown to be the most popular and effective  technique to protect models from imperceptible adversarial samples. Despite its success, it also accompanies the significant performance degeneration to clean data. To achieve a good performance on both clean and adversarial samples, the main effort  is searching for an adaptive perturbation radius for each training sample, which essentially suffers from a  conflict between exact searching  and  computational overhead. To address this conflict, in this paper, firstly we show the superiority of adaptive perturbation radii intuitively and theoretically regarding the   accuracy and robustness respectively. Then we propose our novel self-adaptive adjustment framework for perturbation radii without tedious searching. We also discuss this framework on both deep neural networks (DNNs) and kernel support vector machines (SVMs).  Finally, extensive experimental results show that our framework can improve not only natural generalization performance but also adversarial robustness. It is also competitive with existing searching strategies in terms of running time.

Under review as a conference paper at ICLR 2023
SELF-ADAPTIVE PERTURBATION RADII FOR ADVERSARIAL TRAINING
Anonymous authors Paper under double-blind review
ABSTRACT
Adversarial training has been shown to be the most popular and effective technique to protect models from imperceptible adversarial samples. Despite its success, it also accompanies the significant performance degeneration clean data. To achieve a good performance on both clean and adversarial samples, the main effort is searching for an adaptive perturbation radius for each training sample, which essentially suffers from a conflict between exact searching and computational overhead. To address this conflict, in this paper, firstly we show the superiority of adaptive perturbation radii intuitively and theoretically regarding the accuracy and robustness respectively. Then we propose our novel self adaative adjustment framework for perturbation radii without tedious searching. We also discuss this framework on both deep neural networks (DNNs) and kernel support vector machines (SVMs). Finally, extensive experimental results show that our framework can improve not only natural generalization performance but also adversarial robustness. It is also competitive with existing searching strategies in terms of running time.
INTRODUCTION
The security of machine learning models has long been questioned since most models are vulnerable to perturbations (Papernot et al. (016). Extremely tiny perturbations may be imperceptible to human beings but yet cause poor performance models such as deep neural networks (DNNs) (Goodfellow
et al. 2014 Madry et al. 2017; Papernot et al. (017), support vector machines (SVMs) (Xiao et al.
2012 Biggio et al. 2012 2, 2014) and logistic regression (LR) (Papernot et al.) 2016). Examples
attacked by such perturbations are generally called as adversarial examples.
To learn robust models, adversarial training has now become one of the most effective and widely- used methods, especially DNNs and SVMs (Zhou et al. 20122 Kurakin et al., 2017 Miyato et al.,
2018 Wang et al. 2019 Shafahi et al.
2019
Wu et al. [021] 1). However, the success of adversarial
training comes cost (Tsipras al.
2018 Zhang al. 2019). Specifically, as stated in (Tsipras)
et al. 2018), robustness may be at odds with accuracy, which means models after adversarial training may fail to generalize well unperturbed examples. It is generally believed that this phenomenon is due to the fixed strength of attack throughout the training process, which ignores the fact that every example may have different intrinsic robustness (Cheng et al. 2020 Zhang et al., 2020).
Naturally, the main effort to mitigate this issue is to find the suitable perturbation radius e; for each training sample with explicit or implicit searching strategies. For explicit searching strategies, IAAT (Balaji et al. 2019) uses the brute-force search to find the suitable perturbation radii. MMA (Ding al. 2018) aims to find the optimal et via the bisection search. For implicit searching strategy, Zhang et al. propose an early-stopped PGD strategy called FAT, which adjusts implicitly in essence. Although FAT skillfully skips the step of searching < it is sensitive hyperparameters such as steps of PGD attack and the uniform perturbation radius e. Thus, in this paper, mainly focus on explicit searching strategies. We also give a brief review of the above algorithms in Table [ From this table, we can that these searching strategies essentially have inherent conflict between exact searching and time complexity.
To solve this conflict, in this paper, we propose novel self-adaptive adjustment framework (SAAT) for perturbation radii. It achieves better trade-off between natural generalization performance and adversarial robustness without much computational overhead. Firstly, for the adaptive perturbation

---

Under review as a conference paper at ICLR 2023
Table 1: Comparisons of different adversarial training algorithms which aim at achieving better generalization performance on DNNs and SVMs. (Complexity here refers to the time complexity. the training size, the number of epochs, K and T are the numbers of steps for PGD attack, where S K, C1 and eg denote searching steps for eq-)
Finding suitable ej
Algorithm
Problem
Complexity
Solving inner problem
Searching strategy
Standard (Madry al.
201
Minimax
K-PGD attack
O(nkT)
IAAT (Balaji al.
2019)
Minimax
K-PGD attack
Brute-force search
O(cnnKT)
DNNs
MMA DDng ct al.
2018
Minimax
K-PGD attack
Bisection search
OCcnnkT)
FAT Zhang et al.
2020
Minimax
K-7-PGD attack
Etrly-stopped PGD attack
O(nTT)
SAAT-Kernel (Ours)
Minimization
Closed-form solution
Closed-form solution
(
SA.AT-mnnmmxx (Ours)
Minimax
K-PGD attack
Closed-form + fine search
(nKT)
adv-SVM (Wu et al.
2021)
Minimization
Closcd-form solution
O
SVMs
SAAT-SVM (Ours)
Minimization
Closed-form solution
Closed-form solution
(
Decision boundary after standard training
Decision boundary after udversarial training
Unitorm perturbation radius
Adaptive perturbation radius
Positive data
Negative
Adversarial data
(a) Standard training
(b) Standard advessriial training
(c) SAAT (ours)
Maximum perturbation houndary
Figure I: Conceptual illustration of standard adversarial training and our self-adaptive adversarial training (i.e., SAAT).
radius, we intuitively show its superiority in generalization and theoretically illustrate its strength in robustness. Then we design new learning objective that can construct self- adlf-ideetive perturbation radius for each sample inspired by self-paced learning (SPL) (Jiang et al. 2013). We discuss SAAT on not only DNNs but also kernel SVMs. Correspondingly, we propose algorithms. One built on the original minimax formulation of adversarial training. It determines the optimal perturbation radii based on the observation that the inner maximization piecewise approximately linear to perturbation radii. Then we use fine search to calibrate the values. The other is built on kernel perspective for SVMs and DNNs which transforms the original minimax objective function into an equivalent minimization one. Extensive experimental results show that our framework enjoys better natural generalization performance and higher adversarial robustness compared with other adversarial training algorithms. It is also competitive with existing searching strategies terms of training time. We summarize the main contributions as follows:
types of optimization
Theoretically, we prove that adaptive perturbation radi contribute to lower expected adversarial risk than fixed and uniform perturbation radii, which implics higher robustness against adversarial examples.
Our self-adaptive adversarial training algorithms can skillfully assign the optimal perturbation radius for each data, which avoids the step of exact searching and achieves a better trade-off between adversarial robustness and natural accuracy.
The adap-vde adversarial training strategy that we propose from the kernel perspective is applicable both SVMs and DNNs. It efficiently optimizes minimization problem instead of the conventional minimax one since we transform the inner maximization into a simplified and equivalent form.
2 PRELIMINARIES
2.1 NOTATIONS
We focus on C-class classification problems, then the dataset can be defined D (2,, Be ) where 3y E IRd is the input data, and y/ (1..... C. is the label. We will use [[a),, the 0-1 loss, to
2

---

Under review as a conference paper at ICLR 2023
represent indicator function, which returns 1 if a is true and 0 otherwise. We will use ((-) indicate the surrogate loss function 0-1 loss. The set ( e) = {ō ||1|p S <} means that the sample is constrained by an nn-noreed perturbation with the perturbation radius e. We denote the maximum adversarial loss as ((zz, y. f) )) = maX [[f + 6), 6). v). where f E F and F X R is one neural network class with depth- and width-Hi:
(I) Here p(-) is activation function with Lp-Lisschizz and W; is H2 x H matrix. Then, have H = max Ho. ... HD}. J. HD = 1 and Ho = d. Thus the class of the maximum ad adversarial loss can be formulated as if Vly FE
== + WDp(WD-1P(- Wix...)) )), |W:lle I M, [D]].
2.2 STANDARD ADVERSARTAL. TRAINING
The standard adversarial training considers a minimax problem as follows:
min
max 183 fw, + 6,)), ue n2 EB((),))))
(2)
where the model parameter, Iz + de is the adversarial example of r;. The inner maximization problem actually follows the principle of adversarial attack and aims to construct the most aggressive adversarial examples (Madry et al. 2017), while outer minimization to find model parameters to minimize the loss caused by the adversarial examples. It is notable that fixed and uniform perturbation radius is exerted for all training samples here.
ADAPTIDEE ADVERSARIAL TRAINING
In this section, we first show the superiority of adaptive perturbation radii intuitively and theoretically. Inspired by that, we formulate a novel framework for self-adaptive adversarial training. Then we propose SAAT-minimax to solve the objective.
3.1 SUPERIORITY OF ADAPTIVE PERTURBATION RADII
Although adversarial training with adaptive perturbation radii has been widely studied empirically, its theoretical advantages seldom explored. To fill this vacancy, in the following section, first intuitively show its superiority on natural generalization and then theoretically illustrate its strength on adversarial robustness.
Adaptive Perturbation Radii Contribute to Better Generalization Performance.
Intuitively, shown in Fig. Db. for standard adversarial training, the perturbation radii are kept the same for all training samples. However, for samples near the decision boundary, enforcing large perturbation radìi will lead to the cross-over mixture of samples in different classes. In this case, it leads to distorted and undesirable decision boundary and unavoidably destroy the accuracy on unperturbed examples. Thus, we come the idea of adversarial training with adaptive perturbation radii. As shown in Fig. []. the perturbation radii are set according to the specific location of the samples. effectively avoids the severe distortion of decision boundary and will not hurt natural generalization much.
Adaptive Perturbation Radií Contribute to Lower Adversarial Risk.
In this part, we theoretically prove that adaptive perturbation radii can lead to tighter upper bound of adversarial risk than fixed ones in the case of binary classification, which implies higher robustness against adversarial examples.
Firstly, we provide the definition of the expected adversarial risk Rrob as follows:
Definition 1. (Expected Adversarial Risk) Following Zhang et al. (2019): Schmidt et al.) (0018);
Bubeck et al. (2019). to characterize the robustness of a binary classifier f: R (0, 1). the expected
adversarial risk can be defined
Riob (f) ( (36 E B(6, e) yf(a + 6) < 0}
(3)
In this paper, we consider the Iy-norm ball of p > such that the region is convex.

---

Under review as a conference paper at ICLR 2023
Based Figure I above, do not want to further increase if the adversarial example already be misclassified by the classifier. This leads to the definition of the theoretically optimal adaptive perturbation radius ef follows:
Definition 2. (Optimal Adaptive Perturbation Radius) Theoretically, the optimal adaptive perturbation radius e for each sample can be defined as
(max::
if Vo; E Bi mmax), y:f( + 6,) > O, arg min 6G, s.t. 36; B(6,, E,), vzf(2; 6,) 0, Smaax
5- 5=
otherwise.
(4)
where Cmax is the maximum perturbation radius, 6 is the perturbation radius assigned to 2i--
Remark 3. A few examples of the optimal adaptive perturbation radius can be seen in Figure For the samples that are misclassified after adversarial attack, cf is the minimum radii that achieve this goal. For the samples that can be robustly classified even with Cmax: C equals Cuax-
Before giving our main theorem (i.c., Theorem 5), we provide Assumption 4 as follows.
Assumption For the binary classification surrogate loss function I(.), we assume can be written as (x)()))))) = o (x)), where @ is non-increasing function and is I -ipsscic
Examples of satisfied loss functions include hinge loss, logistic loss 2011), exponential loss (Wyner 2003) and many others. Based on Assumption the upper bound to the expected adversarial risk can be gotten as follows, the detailed proof is in the appendix.
Theorem When Assumption holds, for any w E (0, 1) and any i, ie, with probability least
1 - w, the following holds:
(f) I
Σ 1=1
i Vi Vi. S.G) + 3B
log 2/W
+
24B
IT D- max d m1 - (Xx + Cmax (
2n
vn
where
Xp
max 11p))))))
Q =
24B
D-1 max dà -b) L
Vn
(max)
log
IT
11 r( "4 +1)
M."
"T M; and means the gamma function.
Then we give Theorem to show that the maximum loss function i( Vi. f,6) increases with regard to The detailed proof provided in the appendix.
Theorem 6. The maximum loss function (x,, Mis f( is an increasing function with regard to the perturbation radius
Remark 7. Combing Theorem 5 with Theorem 6 it is evident that replacing Cuax with ot will contribute tighter upper bound for the expected adversarial risk Ryas. It indicates that adaptive perturbation radius in training stage is a better choice than fixed and uniform radius that can lead to higher adversarial robustness.
3.2 FRAMEWORK OF SELF-ADAPTIVE ADVERSARIAL TRAINING
Although several methods have been proposed to search for a suitable perturbation radius for each training sample, there exists conflict between exact searching and computational load, as mentioned in Section ! and Table To achieve fast self-adaptive adversarial training, we creatively introduce a self-adaptive regularizer of perturbation radii (i.e.. -Y1 >n j== < into formulation (2) and give our new formulation of self-adaptive adversarial training (SAAT) as follows:
12 min
max (y1i for (w 8.)) de; W.e [16lll
Σ
(5)
s.t. G [0, max), i= 1.....,,
where e, is the customized perturbation radius of x; achieved by the self-adaptive item and À is the regularization parameter. Thus e can update dynamically as the maximum adversarial loss of x; changes.
4

---

Under review as a conference paper at ICLR 2023
Remark 8. Note that similar term is used in self- learning (SPL) (Jiang al. 2015). The core idea of SPL to learn a model by gradually including samples from easy to complex according to their losses since SPL decides whether the samples can be selected into training via self-paced regularization. Inspired by SPI,, we aim to assign a specific perturbation radius 6 to each sample according to its loss. Formally, we design self-adaptive regularizer imposed on 6; and add it the original formulation of adversarial training.
3.3 SAAT-MINIMAX
In this part, we aim to optimize the SAAT framework ( Specifically, we propose a two-stage search strategy to find the approximate optimal perturbation radii. The first stage is built on the closed-form solution via the piecewise approximate linearity of i(2; yss fw; (3) wrt. the perturbation radii G,- The second stage is fine search to calibrate the results of the first stage. In the following, we will discuss the two-stage search strategy in detail.
Firstly, we observe that ((z,, Gi, fw) is piece- wise approximately linear with regard to e; for each sample as shown in Fig. 2 and propose Assumption 9 This assumption is verified in the appendix.
i( Mrs Jus Gi
Assumption 9, ((z;, fw, ed) is piecewise lin- ear with regard to 6 as follows:
-b/k
6,
[(r; Vis Swn 6s) = max(0, ke; + b)
(6)
Figure 2: The sketch map of ( (2,, 6i) wrt. ex
where & > 0 the slope of i with regard to 6 and denotes y y-intercept.
Then, with the aid of Assumption 9 we come to Theorem 10 which provides the approximate optimal
perturbation radii e, for optimizing objective function (5) Its proof presented in the appendix. The
detailed setting of k; and by can be seen in section 5.1.3.
Theorem 10, For the minimization problem min.,c(o.rm... Assumption 9 holds, we have the optimal et as follows:
((x,, Vis Sw: (4) - det, if fw is given, and
if by and K 2 X;
-=
G
if b < and K; 2 X;
Emazi
otherwise.
may The second stage is fine search to calibrate the results of Theorem TO Since Assumption may not hold exactly, we use simple search strategy with fixed step size to find more accurate values of eç Specifically, the PGD attack fails to find an adversarial image x; + ò, that can be misclassified, it implies cf too small. Thus, we set c n. Otherwise, set cf c 7, where 1) is pre-specified fixed step size.
Finally, combine the above two-stage search strategy with the standard adversarial training procedure and give the pseudo-code of our SAAT-minimax in Algorithm T
SELF- ADAPTIVEE ADVERSARIAL TRAINING FROM KERNEL PERSPECTIVE
As we all know, traditional adversarial training aims to optimize a minimax problem. It typically uses a gradient-based iterative solver such as multi-step PGD to approximately solve the inner problem, which often leads to high computational overhead. To solve this problem, we propose new self-adaptive adversarial training strategy from kernel perspective Specifically, efficiently transforms the minimax problem (5) into an equivalent minimization one. Then we discuss the detailed self-adaptive adversarial training algorithms via the kernel perspective for both DNNs and SVMs.
The kernel perspective means our function f in the reproducing kernel Hilhert space (RKHS)
Mi 2004
5

---

Under review as a conference paper at ICLR 2023
Algorithm 1 SAAT-minimax with -nomm constrained perturbations
Input: D training set; T number of epochs; éman maximum perturbation radius; 7 learning
rate; K PGD steps; a PGD step size; batch size.
Output: w.
1: for epoch= 1.... , do
2: Choose batch of training samples {(z, vi) D.
3: Obtain of via Theorem 10
4:
q max(min(c;; (.az):
5:
for k = ... do
6:
6; + sign( V (yi, for (x; 6.))).
7: 6 max(min(
-))
8: Calibrate ef via the fine search strategy.
9: end for
W w wus, (olos + 6:)).
11: end for
PRIMARY RESCLTS FROM KERNEL. PERSPECTIVE
The transformation of the minimax problem (5) contains two steps: firstly we map the perturbations from linear to kernel spaces, then we can solve the unconstrained equivalent form of the inner minimization.
We first discuss the kernelization of the perturbations 8. For an adversarial example + 5 in the linear space, it known that we map into the kernel space, the kernelized example o(x + + will be unpredictable, here oi.) is the feature mapping function. Fortunately, Theorem 14 in (Xu et al. 2009) provides a tight connection between perturbations the linear and kernel space, i.e., the perturbation range of ((x) + 8& tightly covers that of ő(x 6), where dø is the perturbation in the kernel space and ||61122 S (2)(0) 2f(e). Since we can use 12-norm ball to wrap ly-norm ball, c.g., 01 <) _ {110]]2 I / this theorem is applicable to other norms as well.
Based on it, our formulation of self-adaptive adversarial training 5 can be rewritten the following form the RKHS H:
max I (yi ((x))))) 5%) x
min SEHL
18
s.t. e [0, mmax, i == 1, ,...,
where e/ /2f(0) (es),, -f(ee)) énax (25(0)- 2 (Emax).
Then we can obtain the simplified and equivalent form of the inner maximization of Eq. Theorem 11 The detailed proof can be found in the appendix.
8 via
Theorem 11. f 185 Uyyi, (f, 6(z;) + 8%)1) in (8) is equivalent to the regularized loss function I (yr, f(x,) (1lll)) where 1-llx stands the norm in the RKHS.
function in an RKHS H. the inner maximization problem
According to this theorem, our goal turns optimize the following minimization problem:
min Σ ul (yi, f(x:) + + Xe() SEH,c' n
s.t. (0, <m,e i I,...,n.
For the new problem ( is obvious that Theorem 10 can easily applied here to get the optimal perturbation radius o as well, since we denote (ys, (zx) + < (l) as i(z, ys. f()).
In this case, we give the optimization framework of SAAT from the kernel perspective in Algorithm 2 which clearly shows the altermative updating for { i and function f. In the following subsection, will discuss its applications DNNs and kernel SVMs in detail.

---

Under review as a conference paper at ICLR 2023
Algorithm 2 SAAT on Kernel Perspective
Input: Smaz: Au pl. Output: 1x (G))==-
1: Initialize A= λo-
2: while not converged do
3: Update {e'")== via Theorem 10 with fixed f.
4: Update f with fixed Je on DNNs or kernel SVMs.
5: À μ.d.
6: end while
4.2
SPECIFIC ALGORITHMS ON DNNS AND SVMs
4.2.1
SAAT-KERNEL ON DNNS
Since the RKHS norm [ x cannot be computed on DNNs, we use the lower bound of fl
proposed in (Bietti al. 2019
to approximate its value:
llfllx 2 Ifll = sup f(x + 8) - f(z).
(10)
11812211
In this way, since the optimal solution for the perturbation radii e/ has already been attained, we easily optimize learning objective (9) via optimization algorithms such as SGD (Bottou 2010) and ADAM (Kingma Ba 2014). The procedures to alternatively optimize {c]- H= and the model function f is shown in Algorithm
4.2.2 SAAT-SVM ON KERNEL SVMS
Similar with SAAT on DNNs, SAAT on kernel SVMs can be formulated as the following problem:
I
min JEN
(1u, <llfll)) Xe.)
(11)
s.t. E E [0, <msx) I.
where } If is the added norm similar to the SVM formulation in (Dai et al. 2014). As the doubly stochastic gradient descent (DSG) algorithm (Dai et al. (014) has been proved to be a powerful technique for scalable kernel learning, here it optimize Eq. (11. The detailed optimization procedure is provided the appendix.
EXPERIMENTS
In this section, we compare SAAT with different adversarial training algorithms on MNIST (Lecun & Bottou 1998), CIFARIO and CIFAR 100 (Krizhevsky Hinton 2009) under ln/rm constrained perturbations on DNNs. Due to the page limit, we only show partial results of loo norm in the following, other results are presented the appendix. Experiments on kernel SVMs and the verification of Assumption 9 are also presented in the appendix.
5.1
EXPERIMENTAL SETUP
5.1.1 COMPARED ALGORITHMS:
Natural: Natural model training on DNNs which minimizes the cross entropy loss.
Standard Madry et al. 2017): The standard adversarial training method which uses the K K-step PGD attacker.
IAAT Balaji et al. 2019): Instance adaptive adversarial training which uses brute-force search to assign instance-specifi perturbation radius e; to each sample.
MMA (Ding et al.
2018): Max-margin adversarial training which directly maximizes the dis- tances from inputs to the decision boundary via binary search for the optimal perturbation radii.
FAT (Zhang et al. 2020): A friendly adversarial training strategy which generates friendly adversarial data by stopping the adversarial data searching algorithms early.

---

Under review as a conference paper at ICLR 2023
This method aims to achieve trade-off between robustness and accuracy via decomposing the robust error as the sum of natural error and boundary error.
TRADES Zhang et al. 2
SAAT-kernel: Our self-adaptive adversarial training algorithm on DNNs from the kernel perspec- tive. We apply both the hinge loss and the cross entropy loss in the experiments, i... SAAT-kernel,, and SAAT-kemell.
SAAT-minimax: Our self-adaptive adversarial training algorithm on the minimax problem for DNNSs. We apply both the hinge loss and the cross entropy loss in the experiments, i... SAAT-minimax; and SAAT-minimax.-
Table 2: Test accuracy (%) of various defense methods trained on MNIST with norm constrained perturbations on DNNs. (The results of Natural on clean data are just baselines for reference.)
Method
Clean
FGSM
10-PGD
CW
AutoAttack
Natural 98.83+0.29
14.84+0.66
0.00++0.00
0.00+E0.00
0.00=0.00
Standard
97.82=0.35
95.00=:0.78
89.55=0.89
87.27=0.44
86. 16.1410.81
IAAT
98.57=10.39
92.54
85.17+1104
83.64
79.13:10.64
MMA
98.85+00.3
92.87+11007
81.87+0..8
1.19
70.32:+0.94
FAT
97.08=0.59
94.11#0.94
80.47=0.86
78.9210.77
66.53=0.65
TRADES
98.78=0.47
97.07=20.52
90.4410.66
86.7410.67
88.09=10:46
SAAT-kemel,
98.47=00.3
78.92++0.72
6..76++0.85
62.45-00.46
52.79-t0.46
SAAT-kerne,,
98.61=0.29
80.55+00.68
62.86+0.55
63.39+0.74
53.64=0067
AAAT-minimax,
98.44=10.67
97.42:10.22
0.76
94.42:1.559
93.35++0.46
SAAT-minimax,
98.88
96.29+0..5
91.9710.69
92.77
90.03
Table 3: Test accuracy (%) of various defense methods trained on CIFARI 10 with 5 -nrm constrained perturbations DNNs. (The results of Natural on clean data are just baselines for reference.)
Method
Clean
FGSM
10-PGD
CW
AutoAttack
Natural 92.26:10.45
5.79:10.36
0.00+10.00
0.00+00.00
0.00+10.0
Standard
75.65=20.37
62.73=1.09
48.5140.64
40.37=10.84
42.44=0.63
IAAT
74.56=10.52
49.88=1082
38.02+0.69
36.79:10774
30.66:1.79
MMA
79.15-+0.67
62.83++0.74
45.73+0082
44.94
34.28++0668
FAT
86.80-+0.45
61.49+00.2
46.17+0.77
45.14
33.34++087
TRADES
86.74+1.27
63.42.10.64
49.76:20.65
45.3910.776
49.55
SAAT-kernll,
83,8910.37
24.9710.79
18.54
16.33+0.87
11.95=1.588
SAAT-kernl,,
83.06+0.733
27.8410.59
20.77+0.477
18.7540.64
14.33+1077
SAAT-mine AAT-miinimxx,
85.29:10688
6.852=0.85
53.86++1.77
47.00=10.96
49.84-10.3
SAAT-minimax,
86.98-0.52
63.73+0072
51.70::0.66
49.37=0.84
0..5
Table 4: Test accuracy (%) of various defense methods trained CIFAR100 with l.c norm strained perturbations on DNNs. (The results of Natural on clean data are just baselines for reference.)
Method 77.79-10.47
Clean
FGSM
10-PGD
CW
AutoAttack
Natural
1.16
0.00
0.00
0.00+10.00
Standard
18.33
35.49
27.20-10.72
23.64
22.63-+0.94
IAAT 59.47=0.37
27.2310.65
18.58-0.59
17.7910.34
13.73=0.88
MMA
49.03-10.77
27.79-10.74
20.50+1.67
18.9640.551
15.3940.74
FAT
61.28=00.88
25.03++0.72
19.73-10.56
19.92+0.81
13.09:t0.69
TRADES
50.71=0.67
28.99-40.84
21.59+10.55
17.41+0.57
16.47=0.77
SAAT-kemnll;
66.88-0.73
13.64
8.7710.61
7.65
7.98
SAAT-kernel,
68.56-10.53
12.71
6.79-10.75
6.8710052
5,3410069
BAAT-minimax,,
70.72:1047
47.18-10.33
39.68-0.51
34.70110.36
32.77=0.57
SAAT AAT-miiiimx,
18.11
43.80-10.44
35.33+1.39
31.69-00.77
30.83+0.62
5.1.2 ATTACK SETTINGS:
Four popular attack methods used in the experiments: FGSM (Goodfellow et al. 2014). 10-PGD (PGD with steps) (Madry et al. (017). CW (Carlini & Wagner (017)) and AutoAttack (Croce & Hein. 2020 All the attacks be performed with both 1/ and versions. In the ta version,
8

---

Under review as a conference paper at ICLR 2023
for FGSM and 10-PGD, the perturbation radius is set as Crest = 0.3 for MNIST and Cteat 8/255 for CIFARIO and CIFARIOG 100, the step size for 10-PGD is Etest/ /4, which a standard setting for adversarial attack (Madry al. 2017 Ding et al. 2018).
5.1.3 IMPLEMENTATION DETAILS:
Under loomn constrained perturbations, we set Emax 0.3 for MNIST, Emax 8/255 for CIFAR 10 and Tiny Imagenet, and the step size is set as émax/4 /4. For all algorithms, we set the batch size as 100 with 10 epochs. We use 5-fold cross validation to choose the optimal learning rate 7 2
We use the PreAct 8 architecture for CIFAR1O and CIFAR and use two convolutional networks with 16 and 32 convolutional filters followed by a fully connected layer of 100 units for MNIST, which are the same model structures provided by Wong et al. (2020). For all the compared algorithms, use the cross entropy loss function. For SAAT-minimx and SAAT-kernel,
gotten by I(T,; Yi, sw: fmax) - max: we set k; = 2, 7 = 0.05, linearly increase regularization parameter A from 1 to 3 on MNIST, set K; 0.15, 7) = 0.3/255, linearly increase À from O to 0.5 on CIFAR10 10, and set K; = 0.3, 1j = 0.3/255, linearly increase À from 0 to 0.6 on CIFARI00.
5.2 EXPERIMENTAL RESULTS AND ANALYSES
Robustness against various attacks. We first explore robustness of adversarial training algorithms against different attacks in Tables M It can be seen clearly that our SAAT-minimax not only improves natural generalization performance, but also enjoys stronger defensive ability against various adversarial examples. Moreover, it indicates that hinge loss contributes to higher adversarial robustness than cross entropy. Although SAAT-kernel is not as robustness as adversarial training algorithms on the minimax problem, largely improves accuracy clean data. As for the compared algorithms, although they improve the generalization performance on clean data to some extent, they sacrifice much robustness on strong attacks, especially CW and AutoAttack.
Running time with different sizes of training samples. Fig. shows the running time of various adversarial training algorithms when training samples of different sizes. We can find that SAAT-kernel much more efficient due to its one-layer objective function. For other algorithms on the minimax problem, the time-consuming factor lies on the K-step PGD attack. Among adversarial training algorithms with adaptive G, SAAT-minimax is superior to others since it avoids brute-force search for the optimal q, We also note that the time of SAAT-minimax costs a little longer than that of FAT since FAT applies the early-stopped PGD strategy. But the extra time can be ignored compared with the superiority we have in robustness and generalization.
300
Stanfard
1500
1500
IAAT
Rumning time (8)
Running time (5)
200
PXT
1000
1000
TRADES
kordel,
S.A.. Kernel
Running
100
SAAT SAXT-minimax
500
SAAT-mii
2
Training size
10
Training size
x10
Training size
x10'
(a) MNIST
(b) CIFARIO
(c) CIFAR100
Figure 3: Running time of adversarial training algorithms against different sizes of training samples.
6 CONCLUSION
To achieve better trade-off between robustness and accuracy without much computation overhead, in this paper, we propose an adversarial training framework with self-adaptive perturbation radii named SAAT. This framework can also get the closed-form solution of the optimal perturbation radii and avoids tedious searching compared with existing works, which is applicable to both DNNs and kernel SVMs. Comprehensive experimental results verify that our algorithms not only improve adversarial robustness and natural generalization, but also can be competitive with other adversarial training algorithms in terms of running time.
9

---

Under review as a conference paper at ICLR 2023
REFERENCES
Yogesh Balaji, Tom Goldstein, Judy Hoffman, and Ruitong Huang. Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets. arXiv preprint arXiv: 1tt.199000.0,11 2019.
Alberto Bietti, Grégoire Mialon, Dexiong Chen, and Julien Mairal. A kernel perspective for regu- larizing deep neural networks, In International Conference on Machine Learning, pp. 664-674. PMLR, 2019.
Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. International Conference Machine Learning, pp. 1467-1474, 2012.
Battista Biggio, Igino Corona, Blaine Nelson, Benjamin IP Rubinstein, Davide Maiorca, Giorgio Fumera, Giorgio Giacinto, and Fabio Roli. Security evaluation of support vector machines in adversarial environments. In Support Vector Machines Applications, pp. 105-153. Springer, 2014.
Léon Bottou. Large-scale machine learning with stochastic gradient descent. In Proceedings of COMPSTAT pp. 177-186. Springer, 2010.
Sébastien Bubeck, Yin Tat Lee, Eric Price, and Ilya Razenshteyn. Adversarial examples from computational constraints. In International Conference Machine Learning, pp- 831-840. PMLR, 2019.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. IEEE Symposium on Security and Privacy, pp. 39-57, 2017.
Minhao Cheng, Qi Lei, Pin-Yu Yu Chen, Inderjit Dhillon, and Cho-Jui Hsich. Cat: Customized adversarial training for improved robustness. arXiv preprint arXi::2002.06689, 2020.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206-2216 PMLR, 2020.
Bo Dai, Bo Xie, Niao Hc, Yingyu Liang, Anant Raj, Maria-Florina F Balcan, and Le Song. Scalable kernel methods via doubly stochastic gradients. In Advances in Neural Information Processing Systems, pp. 3041-3049, 2014.
Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training, arXiv preprint arXiv:1812.02637, 2018.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. International Conference Learning Representations, 2014.
Hal Daumé Iii. From zero to reproducing kernel hilbert spaces in twelve pages or less. http://legacydirs.mmiss wwt.:ddiissiiicss.iu. www.ac..md.edee wwd.edu/ halldocs/daumeOOAkkss.tte 2004.
Lu Jiang, Deyu Meng, Qian Zhao, Shiguang Shan, and Alexander G Hauptmann. Self-paced curriculum learning. In Twenty-Ninth AAAI Conference on Artificial Intelligence, pp. 2694-2700, 2015.
Diederik P Kingma and Jimmy Ba. Adam: method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
A. Krizhevsky and G. Hinton. Learning multiple layers of features from tiny images. Master's thesis, Department of Computer Science, University of Toronto, 2009.
Alexey Kurakin, Ian Goodfellow, Samy Bengio, and David Wagner. Adversarial machine learning at scale. International Conference on Learning Representations, 2017.
Lecun and Bottou. tradient-based learning applied to document recognition. Proceedings of the IEFE, 86(1) 86(11):2278 1)22722-3324, 1998.
10

---

Under review as a conference paper at ICLR 2023
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2017.
Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, and Shin Ishii. Virtual adversarial training: regularization method for supervised and semi-supervised learning. IEEE Transactions on Puttern Analysis and Machine Intelligence, 41(8):1979-199) 1993, 2018.
Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv: 2016.
Nicolas Papernot, Patrick Mcdaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. Computer and Communications Security, pp. 506-519, 2017.
L. Schmidt, S. Santurkar, D. Tsipras, K. Talwar, and Alcksander Mdry. Adversarially robust generalization requires more data. Neural Information Processing Systems, 2018.
Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! arXiv preprint arXiv:1904. 12843, 2019.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Tumee, and Aleksander Madry, Ro- bustness may be odds with accuracy. In International Conference Learning Representations, 2018.
Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. International Conference on Machine Learning, 2019.
Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint 1rXiv:2001.03994, 2020.
Huimin Wu, Zhengmian Hu, and Bin Gu. Fast and scalable adversarial training of kernel svm via doubly stochastic gradients. Proceedings of the AAAI Conference on Artificial Intelligence, 35(12): 10829-10337, May 2021.
Abraham J Wyner. On boosting and the exponential loss. In International Workshop on Artificial Intelligence and Statistics, pp. 323-329. PMLR, 2003.
Dao-Hong Xiang. Logistic classification with varying gaussians. Computers & Mathematics with Applications, 61(2):397-407, 2011.
Han Xiao, Huang Xiao, and Claudia Eckert. Adversarial label flips attack on support vector machines. European Conference on Artificial Intelligence, pp. 870-875, 2012.
Huan Xu, Constantine Caramanis, and Shie Mannor. Robustness and regularization of support vector machines. Journal of Machine Leurning Research, 10: 1485-1510, 2009.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pp. 7472-7482. PMLR, 2019.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In International Conference on Machine Learning, pp. 11278- 11287. PMLR, 2020.
Yan Zhou, Murat Kantarcioglu, Bhavani Thuraisingham, and Bowei Xi. Adversarial support vec- tor machine learning. In Proceedings of the 18th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD '12, pp. 1059-1067, 2012.
11


Reviews:
[{"review_id": "_nK6rHxDse0", "reviewer": "Reviewer_qfVT", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper advocate assigning adaptive perturbation constraint $\\epsilon$ to adversarial examples, during the inner maximization in adversarial training. Experiment results show that the SAAT method can improve the adversarial robustness compared with several existing methods.", "summary_of_the_review": "The contribution is limited, and the empirical comparisons are not convincing to me.", "strength_and_weaknesses": "How to find a suitable epsilon is a widely studied problem, including some methods mentioned in the paper, and [1]. [1] tested the effect of different epsilon variation strategies on robustness, including Constant, Linear, Cosine, and their version of period reset. This paper also adopts a linear schedule, hope the authors discuss and compare their method with [1].\nThe main mechanism of the proposed method is \"Specifically, if the PGD attack fails to find an adversarial image xi + δi that can be misclassified, it implies ε∗i is too small. Thus, we set ε∗i = ε∗i + η. Otherwise, we set ε∗i = ε∗i − η, where η is a pre-specified fixed step size.\" Actually, the method is not novel from my perspective, and it provides little insight. \n\nSome questions about the experiments:\n1. The result of the AA attack against AT and TRADES in Table 4 seems too low, some papers have tested under similar settings, and performs better results [2, 3]. Could the authors have a little check?\n2. What about the performance of TRADES + SAAT?\n3. How the robustness will increase when training on a larger model, e.g., WRN-34-10? And what about the effective improvement in robustness when training with additional data?\n\n\n[1] Liu C, et al. On the loss landscape of adversarial training: Identifying challenges and how to overcome them. In NeurIps 2020.\n\n[2] Dong Y, et al. Exploring Memorization in Adversarial Training. In ICLR 2022.\n\n[3] Wu D, et al. Adversarial weight perturbation helps robust generalization. In NeurIps 2020.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "FBW9wc0_Ja", "reviewer": "Reviewer_LAk2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a new method for searching for optimal perturbation radii for adversarial training, which is shown to be more efficient than existing works.  ", "summary_of_the_review": "Personally I appreciate the approach proposed by the authors, but the performance is not that significant. Thus I suggest weak acceptance. ", "strength_and_weaknesses": "Strength\n- Well written. \n- Propose an efficient approach for searching for adaptive perturbation radii for each data point. It has better performance thant the compared methods. \n\nWeakness\n- Regarding the robustness performance, the compared methods are far from SOTA. The current robustenss performance of the proposed approach is not significant. \n- It is claimed that the adaptive radii could help allievate the accuracy-robustness trade-off. However, according to the experimental results,  the natural accuracy does not change much except the cifar100 dataset. Could you explain why the case in this dataset? ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "5JucfcNt0QA", "reviewer": "Reviewer_CG7K", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a method to perform adversarial training with adaptive epsilon per training sample. Several heuristics are proposed to determine epsilon per sample. The benefit is improved accuracy-robustness trade-off.", "summary_of_the_review": "This paper is addressing a meaningful problem. However, the proposed method is a crude heuristic and may need improvement, and there are some questionable numbers in the experimental results.", "strength_and_weaknesses": "Strength: This paper is working on a meaningful problem. Finding adaptive epsilon per training sample could be the key to break the accuracy-robustness trade-off and do well on both clean and perturbed data.\n\nWeaknesses:\n\n1. The proposed heuristics involve substantial approximation.\nFirst of all, the proposed loss function (5) is already a heuristic, -- it's assuming that the optimal epsilon_i is such that the derivative of perturbed-loss with respect to epsilon_i is equal to lambda. There is no guarantee that the derivative of perturbed-loss with respect to epsilon is a good metric to use to determine optimal epsilon.\nOn top of that, the proposal is not to solve (5) directly but rather to use a crude heuristic described in section 3.3, equation (7) and the paragraph after it. There are more heuristics in section 4 but experimental results suggest that they are worse than that in section 3.3.\nWith such approximation on top of approximation, it's unclear whether the final algorithm is a meaningful solution to the original problem.\n\n2. In the main results tables 2 and 3, the \"Standard\" rows are substantially worse than the numbers reported in (Madry et al., 2017). Please explain. If compared with the original numbers in (Madry et al., 2017), it seems that the proposed method is only marginally better. Also for TRADES, tables 2 and 3 suggest that the proposed method is only marginally better. Results in table 4 are strong and it's worth adding detailed analysis on what makes CIFAR100 more favorable for the proposed method.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject