# Improving Adversarial Robustness of CNNs via Maximum Margin
## 3 Proposed Method
### At-Svm
#### 3.3.2 Algorithm Implementation  
In order to pick out the important examples close to the decision boundary, AT-SVM adds an SVM auxiliary classifier before the last layer. For each mini-batch, adversarial examples will be generated using the gradient of the original network, and a mask of all examples is obtained according to the results of the SVM auxiliary classifier to pick out the more important examples. Finally, the original network trains only on these selected examples. In the final inference, the SVM auxiliary is removed. In each mini-batch, first, we train the SVM auxiliary classifier with all parameters of the original model fixed. When training the SVM layer, the loss is as Equation (10) including both hinge loss and the weights' \(l_{2}\) norm as a regularization term. Then we set the SVM layer fixed and recalculate the hinge loss \(L_{hinge}\) and compute loss \(L_{margin}\) from SVM auxiliary classifier using Equation (13), send them to backpropagation. At the same time, use whether this loss is 0 to generate a binary mask, and multiply the output from the original model with the mask before calculating the cross-entropy loss. The procedure is summarized in Algorithm 1. ```
0: network \(f_{\theta}\), SVM auxiliary classifier, training dataset \(S=\left\{\left(\mathbf{x}^{(i)},\mathbf{y}^{(i)}\right)\right\}_{i=1}^{n}\), loss function \(L(.,. )\), learning rate \(\eta\), number of epochs \(T\), batch size \(m\), number of batches \(M\), weight of loss from SVM auxiliary classifier \(\lambda\)
0: robust network \(f_{\theta}\)
1: Initialize \(f_{\theta}\), \(h_{\theta}\)
2:for\(epoch=1,2,\ldots,T\)do
3:for\(minibatch=1,2,\ldots,M\)do
4: Sample a mini-batch \(\left\{\left(\mathbf{x}^{(i)},\mathbf{y}^{(i)}\right)\right\}_{i=1}^{m}\) from training dataset \(S\)
5:for\(i=1,2,\ldots,m\)do
6: Use Equation (1) to generate PGD attack examples \(\hat{\mathbf{x}}^{(i)}\)
7: Get the feature \(\phi^{(i)}\) before the last FC layer
8:endfor
9: Use Algorithm 2 to train an SVM auxiliary classifier
10: Use the SVM auxiliary classifier to obtain a mask for all \(\mathbf{x}\) as well as compute loss \(L_{margin}\) using Equation (13)
11:\(L^{\prime}=\sum_{i=1}^{m}L\left(f\left(\hat{\mathbf{x}}^{(i)}\right),\mathbf{y}^{(i) }\right)\cdot mask\)
12:\(\mathbf{\theta}\leftarrow\mathbf{\theta}-\mathbf{\eta}\
abla_{\theta}\frac{1}{m}\left(L^ {\prime}+\lambda L_{margin}\right)\)
13:endfor
14:endfor
```  
**Algorithm 2** SVM auxiliary classifier  
Algorithm 2 is an SVM auxiliary classifier, which is trained using both the adversarial data and the natural data and returns a mask for them at the same time. AT-SVM leverages Algorithm 2 for obtaining the mask for all examples. For each mini-batch, AT-SVM selects examples that will be misclassified by the SVM auxiliary classifier and then updates the model parameters by minimizing the sum of the selected examples' loss. ```
0: input feature and labels \(\left\{\left(\mathbf{\phi}^{(i)},\mathbf{y}^{(i)}\right)\right\}_{i=1}^{n}\), number of classes \(k\), weights \(\mathbf{\omega}\) and bias \(\mathbf{b}\) for SVM auxiliary classifier, weight of regularization term \(C\) in Equation (10)
0: a\(mask\) for all input data, new weights \(\mathbf{\omega}\) and bias \(\mathbf{b}\) for SVM auxiliary classifier
1: Initialize \(L(i,j)=0\)
2:for\(i=1,2,\ldots,n\)do
3:for\(j=1,2,\ldots,k\) and \(j\
eq\mathbf{y}^{(i)}\)do
4:\(L(i,j)=\max\left(0,1-\left(\mathbf{\omega}_{y^{(i)},j}^{T}\phi^{(i)}+b_{y^{(i)}, j}^{T}\right)\right)\)
5:if\(L(i,j)>0\)then\(mask[i]=1\)
6:endif
7:endfor
8:endfor
9:\(\mathbf{w}\leftarrow\mathbf{w}-\eta\
abla_{\mathbf{w}}\sum_{i}\sum_{j}\left(L(i,j)+C\cdot \|\mathbf{\omega}_{y^{(i)},j}\|_{2}^{2}\right)\)
10:\(\mathbf{b}\leftarrow\mathbf{b}-\eta\
abla_{\mathbf{b}}\sum_{i}\sum_{j}\left(L(i,j)+C\cdot \|\mathbf{\omega}_{y^{(i)},j}\|_{2}^{2}\right)\)
```  
**Algorithm 3** SVM auxiliary classifier  
Algorithm 4 is an SVM auxiliary classifier, which is trained using both the adversarial data and the natural data and returns a mask for them at the same time.