S CALEABLE INPUT GRADIENT REGULARIZATION FOR ADVERSARIAL ROBUSTNESS
Anonymous authors
Paper under double-blind review
A BSTRACT
In this work we revisit gradient regularization for adversarial robustness with some new ingredients.
First, we derive new per-image theoretical robustness bounds based on local gradient information.
These bounds strongly motivate input gradient regularization.
Second, we implement a scaleable version of input gradient regularization which avoids double backpropagation: adversarially robust ImageNet models are trained in 33 hours on four consumer grade GPUs.
Finally, we show experimentally and through theoretical certiﬁcation that input gradient regularization is competitive with adversarial training.
Moreover we demonstrate that gradient regularization does not lead to gradient obfuscation or gradient masking.
I NTRODUCTION
Neural networks are vulnerable to adversarial attacks .
These are small (imperceptible to the human eye) perturbations of an image which cause a network to misclassify the image (Biggio et al., 2013;
Szegedy et al., 2013; Goodfellow et al., 2014).
The threat posed by adversarial attacks must be addressed before these methods can be deployed in error-sensitive and security-based applications (Potember, 2017).
Building adversarially robust models is an optimization problem with two objectives: (i) maintain test accuracy on clean unperturbed images, and (ii) be robust to large adversarial perturbations.
The present state-of-the-art method for adversarial defence, adversarial training (Szegedy et al., 2013;
Goodfellow et al., 2014; Tramèr et al., 2018; Madry et al., 2017; Miyato et al., 2018), in which models are trained on perturbed images, offers robustness at the expense of test accuracy (Tsipras et al., 2018).
Up until the recent method of Shafahi et al. (2019b), multi-step adversarial training had taken many days to train on large datasets (Kannan et al., 2018; Xie et al., 2018).
Assessing the empirical effectiveness of an adversarial defence requires careful testing with multiple attacks (Goodfellow et al., 2018).
Furthermore, existing defences are vulnerable to new, stronger attacks: Carlini & Wagner (2017a) and Athalye et al.
(2018) advocate designing specialized attacks to circumvent prior defences, while Uesato et al.
(2018) warn against using weak attacks to evaluate robustness.
This has led the community to develop theoretical tools to certify adversarial robustness.
Several certiﬁcation approaches have been proposed: through linear programming (Wong & Kolter, 2018;
Wong et al., 2018) or mixed-integer linear-programming (Xiao et al., 2018); semi-deﬁnite relaxation (Raghunathan et al., 2018b;a); randomized smoothing (Li et al., 2018;
Cohen et al., 2019); or estimates of the local Lipschitz constant (Hein & Andriushchenko, 2017; Weng et al., 2018; Tsuzuku et al., 2018).
The latter two approaches have scaled well to ImageNet-1k.
Notably, randomized smoothing with adversarial training has shown great promise for rigorous certiﬁcation against attacks in the (cid:96) 2 norm (Salman et al., 2019), although it is not yet clear how randomized smoothing may be adapted to other norms.
In practice, certiﬁably robust networks often perform worse than adversarially trained models, which in general lack theoretical guarantees.
In this article, we work towards bridging the gap between theoretically robust networks and empirically effective training methods.
Our approach relies on minimizing a loss regularized against large input gradients
[Equation]
where (cid:107) · (cid:107) ∗ is dual to the one measuring adversarial attacks (for example the (cid:96) 1 norm for attacks measured in the (cid:96) ∞ norm).
Heuristically, making loss gradients small should make gradient based attacks more challenging.
Drucker & LeCun (1991) implemented gradient regularization using ‘double backpropagation’, which has been shown to improve model generalization (Novak et al., 2018).
It has been used to improve the stability of GANs (Roth et al., 2017; Nagarajan & Kolter, 2017) and to promote learning robust features with contractive auto-encoders (Rifai et al., 2011).
While it has been proposed for adversarial attacks robustness (Lyu et al., 2015; Ross & Doshi-Velez, 2018; Roth et al., 2018; Ororbia
II et al., 2017; Hein & Andriushchenko, 2017; Jakubovitz & Giryes, 2018; Simon-Gabriel et al., 2018), experimental evidence has been mixed, in particular, input gradient regularization has so far not been competitive with multi-step adversarial training.
In particular, the heuristic that “gradients should be small” has motivated several other approaches to adversarial robustness which were later shown to suffer from problems of gradient obfuscation (Athalye et al., 2018).
This is the phenomenon whereby gradients are in some sense hidden or minimized, so that gradient-based attacks fail to produce adversarial examples.
Due to this phenomenon, the community now greets adversarial robustness methods based on notions of small gradients with a healthy dose of skepticism.
It is therefore necessary to demonstrate new methods do not suffer from gradient obfuscation (Carlini et al., 2019), both empirically and theoretically: empirically, by attacking models with gradient-free methods or non-local attacks; and theoretically using tight certiﬁcation techniques.
Our main contributions in this work are the following.
First, we motivate using input gradient regularization of the loss by deriving new theoretical robustness bounds.
These bounds use the gradient of the loss, and an estimate of the error of the linear approximation of the loss, called the modulus of continuity .
These theoretical bounds show that small loss gradient and a small modulus of continuity are sufﬁcient conditions for adversarial robustness.
Second, we empirically show that input gradient regularization is competitive with standard adversarial training (Madry et al., 2017), at a fraction of the training time.
We verify that training with gradient regularization does not lead to gradient obfuscation, by attacking our trained models with gradient-free methods, and through certiﬁcation bounds.
Finally, we scale input gradient regularization to ImageNet-1k (Deng et al., 2009) by using ﬁnite differences to estimate the gradient regularization term, rather than double backpropagation (which does not scale).
This allows us to train adversarially robust networks on
ImageNet-1k with only 50% more training time than that of standard (non robust) training.
A DVERSARIAL ROBUSTNESS BOUNDS FROM THE LOSS 2. B ACKGROUND
Much effort has been directed towards determining theoretical lower bounds on the minimum sized perturbation necessary to perturb an image so that it is misclassiﬁed by a model.
One promising approach, proposed by Hein & Andriushchenko (2017) and Weng et al.
(2018), and which has scaled well to ImageNet-1k, is to use the Lipschitz constant of the model.
In this section, we build upon these ideas: we propose using the Lipschitz constant of a suitable loss, designed to measure classiﬁcation errors.
Additionally, we propose a tighter lower bound which uses the local gradient information of the loss, and an error bound on the ﬁrst-order approximation of the loss.
Our notation is as follows.
Write y =
f ( x ; w ) for a model which takes input vectors x to label probabilities, with parameters w .
Let L ( y 1 , y 2 ) be the loss and write (cid:96) ( x ) :
= L ( f ( x, w ) , y ) , for the loss of a model f .
Finding an adversarial perturbation is interpreted as a global minimization problem: ﬁnd the closest image to a clean image, in some speciﬁed norm, that is is also misclassiﬁed by the model
[Equation]
However, (1) is a difﬁcult and costly non-smooth, non-convex optimization problem.
Instead,
Goodfellow et al.
(2014) proposed solving a surrogate problem: ﬁnd a perturbation v of a clean image x that maximizes the loss, subject to the condition that the perturbation be inside a norm-ball of radius δ around the clean image.
The surrogate problem is written
[Equation]
); where c ( v )
[Equation]
The hard constraint c ( v ) forces perturbations to be inside the norm-ball centred at the clean image x .
Ideally, solutions of this surrogate problem (2) will closely align with solutions of the original more difﬁcult global minimization problem.
However, the hard constraint in (2) forces a particular scale: it may miss attacks which would succeed with only a slightly bigger norm.
Additionally, the maximization problem (2) does not force misclassiﬁcation, it only asks that the loss be increased.
The advantage of (2) is that it may be solved with gradient-based methods: present best-practice is to use variants of projected gradient descent (PGD), such as the iterative fast-signed gradient method (Kurakin et al., 2016; Madry et al., 2017) when attacks are measured in the (cid:96) ∞ norm.
However, gradient-based methods are not always effective: on non-smooth networks, such as those built of ReLU activation functions, a small gradient does not guarantee that the loss remains small locally.
That is, ReLU networks may increase rapidly with a very small perturbation, even when local gradients are small.
This deﬁciency was identiﬁed in (Papernot et al., 2016) and expanded on by Athalye et al.
In this scenario, PGD methods will fail to locate these worst-case perturbations, and give a false impression of robustness.
Carlini & Wagner (2017b) avoid this scenario by incorporating decision boundary information into the loss; others solve (1) directly (Brendel et al., 2018; Chen & Jordan, 2019; Finlay et al., 2019) using gradient-free methods or non-local attacks.
2. D ERIVATION OF THEORETICAL LOWER BOUNDS
This leads us to consider the following compromise between (1) and (2).
Consider the following modiﬁcation of the Carlini & Wagner (2017b) loss (cid:96) ( x ) = max i (cid:54)
=
c f i ( x ) − f c ( x ) , where c is the index of the correct label, and f i ( x ) is the model output for the i -th label.
This loss has the appealing property the sign of the loss determines if the classiﬁcation is correct.
Adversarial attacks are found by minimizing
[Equation]
The constant (cid:96) 0 determines when classiﬁcation is incorrect; for the modiﬁed Carlini-Wagner loss, (cid:96)
= 0 .
Problem (3) is closer to the true problem (1), and will always ﬁnd an adversarial image.
We use (3) to derive theoretical lower bounds on the minimum size perturbation necessary to misclassify an image.
Suppose the loss is L -Lipschitz with respect to model input.
Then we have the estimate
[Equation]
Now suppose v is adversarial, with minimum adversarial loss (cid:96) ( x + v ) =
(cid:96) 0 .
Then rearranging (4), we obtain the lower bound (cid:107) v (cid:107) ≥ 1 L ( (cid:96) 0 − (cid:96) ( x )) .
Unfortunately, the Lipschitz constant is a global quantity, and ignores local gradient information; see for example Huster et al.
Thus this bound can be quite poor, even when networks have small Lipschitz constant.
A tighter theoretical bound may instead be achieved by using (i) the local gradient, and (ii) a bound on the error of a ﬁrst order approximation of the loss.
At image x and perturbations up to size ε , the error of a ﬁrst order approximation of the loss is bounded above by the modulus of continuity
[Equation]
Intuitively, this measures the maximum amount the gradient can change over perturbations of size ε .
Note that the quantity is deﬁned for any norm.
Using this quantity, for perturbations of size ε we have the estimate
[Equation]
As before, assume v is adversarial, with minimum adversarial loss (cid:96) ( x + v ) =
(cid:96) 0 .
Rearranging (6), we obtain the lower bound (cid:107) v (cid:107) ≥
[Equation]
Remark 2.1 .
If the model and the loss are twice continuously differentiable, the modulus of continuity can be derived from the maximum curvature.
However ω ( ε ) is deﬁned even when the model and the loss are not twice differentiable.
We have proved the following.
Proposition 2.2.
Suppose the loss (cid:96) ( x ) is Lipschitz continuous with respect to model input x , with
Lipschitz constant L .
Let (cid:96) 0 be such that if (cid:96) ( x ) < (cid:96) 0 , the model is always correct.
Then a lower bound on the minimum magnitude of perturbation v necessary to adversarially perturb an image x is
[Equation]
Suppose in addition the modulus of continuity ω ( ε ) is deﬁned as in (5) .
Then the minimum adversarial distance is bounded below by ε provided the following inequality holds
[Equation]
Proposition 2.2 motivates the need for input gradient regularization.
The Lipschitz constant L is the maximum gradient norm of the loss over all inputs.
Therefore ( L -bound) says that a regularization term encouraging small gradients (and so reducing L ) should increase the minimum adversarial distance.
This aligns with (Hein & Andriushchenko, 2017), who proposed the cross-Lipschitz regularizer, penalizing networks with large Jacobians in order to shrink the Lipschitz constant of the network .
However, this is not enough: the gap (cid:96) 0 − (cid:96) ( x ) must be large as well.
Together ( L -bound) explains one form of ‘gradient masking’ (Papernot et al., 2017).
Shrinking the magnitude of gradients while also closing the gap (cid:96) 0 − (cid:96) ( x ) effectively does nothing to improve adversarial robustness.
For example, in one form of defense distillation, the magnitude of the model Jacobian is reduced by increasing the temperature of the ﬁnal softmax layer of the network.
However, this has the detrimental side-effect of sending the model output to ( 1 N , · · · , 1 N ) , where N is the number of classes, which effectively shrinks the loss gap to zero.
An alternative form sends the temperature of the ﬁnal softmax layer to zero, which pushes the model output to a one-hot vector; however this sends the Lipschitz constant to ∞ .
In either form, the lower bound provided by Proposition 2.2 approaches zero.
Moreover, ( ω -bound) states that even supposing the loss’s gradient is small, and the gap (cid:96) 0 − (cid:96) ( x ) is large, there may still be adversarially vulnerable images nearby due to errors in the ﬁrst order approximation.
Taken together, Proposition 2.2 provides three sufﬁcient conditions for training robust networks: (i) the loss gap (cid:96)
− (cid:96) ( x ) should be large; (ii) the gradients of the loss should be small; and (iii) the error of the ﬁrst-order approximation, measured by ω ( ε ) , should also be small.
The ﬁrst point will be satisﬁed by default when the loss is minimized.
The second point will be satisﬁed by training with a loss regularized to penalize large input gradients.
In Section 4 we provide experimental evidence that the third point is satisﬁed with input gradient regularization implemented using ﬁnite differences.
These robustness bounds are most similar in spirit to Weng et al.
(2018), who derive bounds using an estimate of the local Lipschitz constant of the model by sampling the model gradient norm locally.
Indeed, in practice, L and ω ( ε ) can only be estimated and are not exactly computable on all but the simplest networks.
We estimate L and ω ( ε ) using the Extreme Value Theory approach outlined by Weng et al.
To estimate L , we sample the maximum gradient norm over batches from the data distribution, and estimate an upper bound by ﬁtting a generalized extreme value (GEV) distribution to these samples through maximum likelihood estimation (MLE).
Similarly, we estimate ω ( ε ) by sampling the maximum of (5) over batches of the data distribution and (cid:107) v (cid:107) ≤ ε , and then ﬁtting a GEV using MLE.
The values of L and ω ( ε ) used in our bounds are estimated from the ﬁtted GEV distribution with threshold p = 0 .
Because these quantities are estimates, in practice the theoretical bounds of Proposition 2.2 can only be implemented approximately, providing a heuristic measure of adversarial robustness.
Notably however, these bounds are valid in any norm with corresponding dual.
Furthemore, upon estimating L and ω ( ε ) , we emphasize that these quantities only require one gradient evaluation and one model evaluation to provide an estimate on the robustness of an image.
To date, the theoretical bounds in the Euclidean norm that show the greatest promise have arguably been those obtained through randomized smoothing (Li et al., 2018;
Cohen et al., 2019;
Salman et al., 2019).
In randomized smoothing, models are trained with inputs perturbed through Gaussian noise; robust prediction is achieved by averaging model predictions over inputs again perturbed with
Gaussian noise, which requires many tens of thousands of model evaluations.
It is well known that training with Gaussian noise is equivalent to squared (cid:96) 2 norm gradient regularization (Bishop, 1995).
Therefore we expect that models trained with squared norm gradient regularization, should have similar adversarial robustness as those trained through randomized smoothing.
S QUARED NORM GRADIENT REGULARIZATION
Proposition 2.2 provides strong motivation for input gradient regularization as a method for promoting adversarial robustness.
However, it does not tell us what form the gradient regularization term should take.
In this section, we show how norm squared gradient regularization arises from a quadratic cost .
In adversarial training, solutions of (2) are used to generate images on which the network is trained.
In effect, adversarial training seeks a solution of the minimax problem
[Equation] [Equation]
where P is the distribution of images.
This is a robust optimization problem (Wald, 1945; Rousseeuw & Leroy, 1987).
The cost function c ( v ) penalizes perturbed images from being too far from the original.
When the cost function is the hard constraint from (2), perturbations must be inside a norm ball of radius δ .
This leads to adversarial training with PGD (Kurakin et al., 2016; Madry et al., 2017).
However this forces a particular scale: it is possible that no images are adversarial within radius δ , but that there are adversarial images with only a slightly larger distance.
Instead of using a hard constraint, we can relax the cost function to be the quadratic cost c ( v ) = 12 δ (cid:107) v (cid:107) 2 .
The quadratic cost allows attacks to be of any size, but penalizes larger attacks more than smaller attacks.
With a quadratic cost, there is less of a danger that a local attack will be overlooked.
Solving (7) directly is expensive: on ImageNet-1k, both Kannan et al.
(2018) and Xie et al.
(2018) required large-scale distributed training with many dozens or hundreds of GPUs, and over a week of training time.
Recent research suggests this hurdle may be surmounted (Shafahi et al., 2019b; Zhang et al., 2019).
However we take the view that (7) may be bounded above, and solved approximately.
When the loss is smooth, the modulus of continuity is ω ( ε ) =
ε 2 C , where C is the maximum positive
Hessian norm over all inputs.
By using the bound (6) with the quadratic loss c ( v ) = 12 δ (cid:107) v (cid:107) 2 , the optimal value of max v (cid:96) ( x + v ) − c ( v ) is
[Equation]
<
[Equation]
This gives the following proposition.
Proposition 3.1.
Suppose both the model and the loss are twice continuously differentiable.
Suppose attacks are measured with quadratic cost
[Equation]
(cid:107) v (cid:107) 2 .
Then the optimal value of (7) is bounded above by
[Equation]
(8) where λ = δ 1 − δC .
That is, we may bound the solution of the adversarial training problem (7) by solving the gradient regularization problem (8), when the cost function is quadratic.
It is not necessary to know δ or compute C ; they are absorbed into λ .
Input gradient regularization using the squared (cid:96) 2 norm was proposed for adversarial robustness in
Ross & Doshi-Velez (2018).
It was expanded by Roth et al.
(2018) to use a Mahalanobis norm with the correlation matrix of adversarial attacks.
When c ( v ) is the hard constraint forcing attacks inside the δ norm ball and C is small, supposing the curvature term is negligible, we can estimate the maximum in (7) by (cid:96) ( x ) + 1 δ (cid:107) ∇ x (cid:96) ( x ) (cid:107) ∗ , using the dual norm for the gradient.
This is norm gradient regularization (not squared), and has been used for adversarial robustness on both CIFAR-10 (Simon-Gabriel et al., 2018), and MNIST (Seck et al., 2019).
3. F INITE DIFFERENCE IMPLEMENTATION
Norm squared input gradient regularization has long been used as a regularizer in neural networks:
Drucker & LeCun (1991) ﬁrst showed its effectiveness for generalization.
Drucker & LeCun
[Figure]
implemented gradient regularization with ‘double backpropagation’ to compute the derivatives of the penalty term with respect to the model parameters w , which is needed to update the parameters during training.
Double backpropagation involves two passes of automatic differentiation: one pass to compute the gradient of the loss with respect to the inputs x , and another pass on the output of the ﬁrst to compute the gradient of the penalty term with respect to model parameters w .
In neural networks, double backpropagation is the standard technique for computing the parameter gradient of a regularized loss.
However, it is not currently scaleable to large neural networks.
Instead we approximate the gradient regularization term with ﬁnite differences.
Proposition 3.2 (Finite difference approximation of squared (cid:96) 2 gradient norm) .
Let d be the normalized input gradient direction: d = ∇ x (cid:96) ( x ) / (cid:107) ∇ x (cid:96) ( x ) (cid:107) 2 when the gradient is nonzero, and set d =otherwise.
Let h be the ﬁnite difference step size.
Then, the squared (cid:96) 2 gradient norm is approximated by
[Equation]
The vector d is normalized to ensure the accuracy of the ﬁnite difference approximation: as can be seen by (6), the error of the ﬁnite difference is bounded by ω ( h ) /h .
Without normalizing the gradient, this term can be large, which is undesirable in general.
However, the ﬁnite difference error term does play a role in promoting adversarial robustness.
Proposition 2.2 shows it is necessary for ω ( ε ) to be small.
By using ﬁnite differences, minimizing (8) also implicitly minimizes ω ( h ) , due to the error term.
Therefore the ﬁnite difference approximation provide an indirect means for controlling the modulus of continuity ω ( ε ) necessary for adversarial robustness, through the ﬁnite difference error.
This would otherwise be unavailable with an exact method computing the gradient norm.
The ﬁnite differences approximation (9) allows the computation of the gradient of the regularizer (with respect to model parameters w ) to be done with only two regular passes of backpropagation, rather than with double backpropagation.
On the ﬁrst, the input gradient direction d is calculated.
The second computes the gradient with respect to model parameters by performing backpropagation on the right-hand-side of (9).
Double backpropagation is avoided by detaching d from the computational graph after the ﬁrst pass.
In practice, for large networks, we have found that the ﬁnite difference approximation of the regularization term is considerably more efﬁcient than using double backpropagation.
On networks sized for MNIST, we have observed roughly a 10% speed improvement by using ﬁnite differences; on CIFAR-10 networks ﬁnite differences are roughly 50% faster than double backpropagation.
Our proposed training algorithm, with squared Euclidean input gradient regularization, is presented in Algorithm 1 of Appendix A. Other gradient penalty terms can be approximated as well.
For example, when defending against attacks measured in the (cid:96) ∞ norm, the squared (cid:96) 1 norm penalty can approximated by setting instead d = sign( ∇ x (cid:96) ( x )) / √ N when the gradient is nonzero.
[Table]
E XPERIMENTAL RESULTS
In this section we provide empirical evidence that input gradient regularization is an effective tool for promoting adversarial robustness.
We attack networks with gradient-free attacks, and demonstrate gradient regularization does not lead to gradient obfuscation.
Moreover our results show that gradient regularization is comparable to adversarial training, both experimentally and through rigorous certiﬁcation.
We train networks on the CIFAR-10 dataset (Krizhevsky & Hinton, 2009), and ImageNet-1k (Deng et al., 2009).
On the CIFAR dataset we use the ResNeXt-34 (2x32) architecture; on ImageNet-1k we use a ResNet-50 (He et al., 2016).
The CIFAR networks were trained with standard data augmentation and learning rate schedules on a single GeForce GTI 1080 Ti.
On ImageNet-1k, we modiﬁed the training code of Shaw et al.’s
[44] submission to the DAWNBench competition (Coleman et al., 2018) and train with four GPUs.
Training code and trained model weights will be made available.
We train an undefended network as a baseline to compare various types of regularization.
On CIFAR10, networks are trained with squared (cid:96) 2 and squared (cid:96) 1 gradient norm regularization.
The former is appropriate for defending against attacks measured in (cid:96) 2 ; the latter for attacks measured in (cid:96) ∞ .
We set the regularization strength to be either λ = 0 .
1 or 1; and set ﬁnite difference discretization h = 0 .
unless otherwise speciﬁed.
(For a study of the effect of ﬁnite difference size h , refer to
Table 4.)
We compare each network with the most common form of adversarial training, where models are trained using the hyperparameters in Madry et al.
(2017) (7-steps of FGSM, projected onto an (cid:96) ∞ ball of either radius 8255 or 2255 ).
On CIFAR-10 we also compare against the ‘For Free’ implementation of Shafahi et al. (2019a), using the same hyperparameters.
On ImageNet-1k we only train adversarially robust models with squared (cid:96) 2 regularization.
On each dataset, we attack 1000 randomly selected images.
We perturb each image with attacks in both the Euclidean and (cid:96) ∞ norms, with a suite of current state-of-the-art attacks: the Carlini-Wagner attack (Carlini & Wagner, 2017b); the Boundary attack (Brendel et al., 2018) (a gradient-free attack); the LogBarrier attack (Finlay et al., 2019) (a non-local attack); and PGD (Madry et al., 2017) (in both the (cid:96) ∞ norm or the (cid:96) 2 norm).
The former three attacks have all been shown effective at evading gradient masking and gradient obfuscation.
PGD excels at ﬁnding images close to the original when gradients are not close to zero.
We report our results using the best adversarial distance on a per image basis , in each norm.
On the majority of test images, PGD ﬁnds the closest adversarial image.
However on a signiﬁcant portion of inputs, the closest adversarial image is found by one of the three other attacks.
[Table] norm, λ = [Table] Adversarial robustness results for networks attacked in the (cid:96) ∞ norm are presented in Table 1.
These results are for networks built of standard ReLU s. Table 1 and Figure 1 demonstrate a clear trade-off between test accuracy and adversarial robustness, as the strength of the regularization is increased.
On CIFAR-10, the undefended network achieves test error of 4.36%, but is not robust to attacks even at (cid:96) ∞ distance 2255 .
However with a strong regularization parameter ( λ = 1 ), test error increases to 9.02% on clean images.
At both adversarial distance ε = 2255 and 8255 adversarial training achieves slightly better robustness (by about 5% percent) than our best models, yet comes at over double the training time.
In Table 1 we also report heuristic measures of robustness using ( ω -bound).
We skip reporting bounds using ( L -bound), for this bound returned vacuous results (an upper bound of 100% test error at all distances).
On some test images the heuristic bound fails; this is due to the inherent difﬁculty of estimating ω ( ε ) accurately.
In Table 2 we report results on models trained for attacks in the (cid:96) 2 norm.
On CIFAR-10, the most robust model is trained with regularization strength λ = 1 , and outperforms even the adversarially trained model.
On ImageNet-1k, we see the same pattern: the model trained with λ = 1 offers the best protection against adversarial attacks.
Due to the long training time, we were not able to train ImageNet-1k with standard multi-step adversarial training.
In Table 2 we also report our heuristic measure of bounds on the minimum distance required to adversarially perturb, using the
Carlini-Wagner loss.
1 Further ω -bound results on CIFAR-10 are presented in Table
Both ( L -bound) and ( ω -bound) provide reasonable estimates of the minimum adversarial distance, though ( ω -bound) is closer to empirical results.
These heuristic measures of robustness are further corroborated by Table 3 of Appendix B, which shows that both adversarial training and gradient regularization signiﬁcantly decrease model gradients and the modulus of continuity ω ( ε ) .
We also use randomized smoothing, a tight and exact bound on robustness, to verify our heuristic measures, see Table 5.
C ONCLUSION
We have provided motivation for training adversarially robust networks through input gradient regularization, by bounding the minimum adversarial distance with gradient statistics of the loss.
We have shown that gradient regularization is scaleable to ImageNet-1k, and provides adversarial robustness competitive with adversarial training, both theoretically and empirically.
Moreover we have demonstrated that gradient regularization does not lead to gradient obfuscation.
Networks may be trained using gradient regularization in fractions of the training time of standard adversarial training.
We gave theoretical per-image bounds on the minimum adversarial distance, for non-smooth models, using the Lipschitz constant of the loss and its modulus of continuity, which measures the error of a ﬁrst order approximation of the loss.
These bounds were empirically compared against state-of-the-art attacks and other theoretical bounds.
Although in practice these bounds give heuristic measures of robustness, they are valid in any norm, and provide per-image robustness measures at the cost of only one model evaluation and one gradient evaluation
A T RAINING ALGORITHM
1: Input: Initial model parameters w
Hyperparameters: Regularization strength λ ; batch size m ; ﬁnite difference discretization h 2: while w t not converged do 3: sample minibatch of data (cid:8) ( x ( i ) , y ( i ) )
(cid:9) i =1 ,...,m from empirical distribution ˆ P 4: for i = 0 to m do 5: g ( i ) =
∇ x (cid:96) ( x ( i ) , y ( i ) ; w t ) 6: d ( i ) = (cid:40) g
( i ) (cid:107) g
( i ) (cid:107)if g ( i ) (cid:54) =
otherwise (cid:46) for (cid:96) 1 -norm use normalized signed gradient 7: detach d ( i ) from computational graph 8: z ( i ) =
x ( i ) + hd ( i ) 9: end for 10:
L ( w ) = 1 m (cid:80) mi =1 (cid:96) ( x ( i ) , y ( i ) ; w ) 11:
R ( w ) =
1 m (cid:80) mi
=1 1 h 2 (cid:0) (cid:96) ( z ( i ) , y ( i ) ; w ) − (cid:96) ( x ( i ) , y ( i ) ; w ) (cid:1)12: w t +1 ← w t − τ t ∇ w ( L ( w t ) + λ R ( w t )) 13: end while
B A DDITIONAL EMPIRICAL RESULTS
[Figure]
[Table]
norm as a function of ﬁnite difference size h .
All models here trained with squared (cid:96) 1 norm gradient penalty, with regularizer strength λ = 1 .
[Table]
1e
[Table]
1e [Table] [Table] [Table]
ε
[Table] [Table]