F AST ADVERSARIAL TRAINING FOR SEMI - SUPERVISED LEARNING
Anonymous authors
Paper under double-blind review
A BSTRACT
In semi-supervised learning, Bad GAN approach is one of the most attractive method due to the intuitional simplicity and powerful performances.
Bad GAN learns a classiﬁer with bad samples distributed on complement of the support of the input data.
But Bad GAN needs additional architectures, a generator and a density estimation model, which involves huge computation and memory consumption cost.
VAT is another good semi-supervised learning algorithm, which utilizes unlabeled data to improve the invariance of the classiﬁer with respect to perturbation of inputs.
In this study, we propose a new method by combining the ideas of Bad
GAN and VAT .
The proposed method generates bad samples of high-quality by use of the adversarial training used in VAT .
We give theoretical explanations why the adversarial training is good at both generating bad samples and semi-supervised learning.
An advantage of the proposed method is to achieve the competitive performances with much fewer computations.
We demonstrate advantages our method by various experiments with well known benchmark image datasets.
I NTRODUCTION
Deep learning has accomplished unprecedented success due to the development of deep architectures, learning techniques and hardwares (Krizhevsky et al., 2012; Ioffe & Szegedy, 2015; Szegedy et al., 2015; Hinton et al., 2012; Kingma & Ba, 2014).
However, deep learning has also suffered from collecting large amount of labeled data which requires both cost and time.
Thus it becomes important to develop semi-supervised methodologies that learn a classiﬁer (or discriminator) by using small labeled data and large unlabeled data.
Various semi-supervised learning methods have been proposed for deep learning.
Weston et al.
(2012) employs a manifold embedding technique using the pre-constructed graph of unlabeled data and Rasmus et al.
(2015) uses a specially designed auto-encoder to extract essential features for classiﬁcation.
Variational auto encoder (Kingma & Welling, 2013) is also used in the context of semi-supervised learning by maximizing the variational lower bound of both labeled and unlabeled data (Kingma et al., 2014; Maaløe et al., 2016).
Recently, semi-supervised learning based on generative adversarial networks ( GAN , Goodfellow et al.
(2014a)) has received much attention.
For K -class classiﬁcation problems, Salimans et al.
(2016) solves the ( K + 1) -class
classiﬁcation problem where the additional ( K + 1) th class consists of synthetic images made by a generator of the GAN learned by unlabeled data.
Dai et al.
(2017) notices that not a good generator but a bad generator which generates synthetic images much different from observed images is crucial for the success of semi-supervised learning.
Dai et al.
(2017) gives theoretical justiﬁcations of using a bad generator and develops a semi-supervised learning algorithm called Bad GAN which achieves the state-of-the-art performances over multiple benchmark datasets.
However, Bad GAN has several limitations.
It needs two additional deep architectures - bad generator and pre-trained density estimation model besides the one for the classiﬁer.
Learning these multiple deep architectures requires huge computation and memory consumption.
In particular, the PixelCNN++ (Salimans et al., 2017) is used for the pre-trained density estimation model which needs very large computational resources.
Another difﬁculty in Bad GAN is that it requires a two-step learning procedure - the ﬁrst step is to learn the PixelCNN++ model and the second step is to learn the classiﬁer and the bad generator.
The optimal learning of the ﬁrst step may not be optimal for the second step and hence the regularization of the both steps would need special techniques.
In this study, we propose a new semi-supervised learning method which competes well with other stateof-the-art semi-supervised learning algorithms and yet needs much smaller amount of computational resources.
In particular, the proposed method employs only one deep architecture and hence the corresponding learning phase is much easier and faster.
Our proposed method is motivated by close investigation of VAT ( Virtual Adversarial Training) method (Miyato et al., 2015; 2017).
VAT tries to ﬁnd a deep classiﬁer which has a good prediction accuracy on training data and at the same time is less sensitive to data perturbation toward the adversarial direction.
Here, the adversarial direction for a given datum is the direction to which the probabilities of each class change most.
In Section 3, we prove that the perturbed data toward their adversarial directions can serve as ‘good’ bad samples.
By using the adversarial directions for both measuring the invariance and generating the bad samples, the proposed method combines the advantages of Bad GAN and VAT together.
Note that only a deep architecture for classiﬁcation is needed to calculate the adversarial directions and thus the corresponding learning procedure is cheaper, easier and faster.
We call our proposed method FAT (Fast Adversarial Training).
Dai et al.
(2017) proves that bad samples play a role to pull the decision boundary toward the low density regions of data.
In Section 5, we give a theoretical explanation that VAT pushes the decision boundary away from the high density regions of data.
That is, FAT accelerates the learning procedure by using both pushing and pulling operations simultaneously.
In section 6, we show that FAT achieves almost the state-of-the-art performances with much fewer training epochs.
Especially, for the MNIST dataset, FAT achieves similar test accuracies to those of Bad GAN and VAT with 5 times and 7 times fewer training epochs, respectively.
This paper is organized as follows.
In Section 2, we review the Bad GAN and VAT methods brieﬂy.
In Section 3, the technique to generate bad samples using the adversarial directions is described, and our proposed semi-supervised learning method is presented in Section 4.
Theoretical analysis of
VAT is given in Section 5.
Results of various experiments are presented in Section 6 and conclusions follow in Section 7.
Bad GAN AND VAT 2. Bad GAN APPROACH
Bad GAN is a method that trains a good discriminator with a bad generator.
This procedure trains a generator as well as a discriminator simultaneously.
Let D G ( φ ) be generated bad samples with a bad generator p G ( · ; φ ) parametrized by φ.
Here, the ‘bad generator’ is a deep architecture to generate samples different from observed data.
Let p pt ( · ) be a pre-trained density estimation model.
For a given discriminator with a feature vector v ( x ; θ ) of a given input x parameterized by θ, Bad GAN learns the bad generator by minimizing the following:
[Equation]
with respect to φ, where τ > 0 is a tuning parameter, U tr is the unlabeled data, and (cid:98) θ is the current estimate of θ and (cid:107) · (cid:107) is the Euclidean norm.
In turn, to train the discriminator, we consider the K -class classiﬁcation problem as the ( K +1) -class classiﬁcation problem where the ( K + 1) -th class is an artiﬁcial label of the bad samples generated by the bad generator.
We estimate the parameter θ in the discriminator by minimizing the following:
[Equation]
for given φ, where L tr is the labeled set.
The second and the third terms in (1) are the cross-entropies between the unlabeled and the bad samples.
The fourth term is similar the entropy of the unlabeled data which is usually helpful for semi-supervised learning (Grandvalet & Bengio, 2005).
See Dai et al.
(2017) for details of the objective function (1).
2. VAT APPROACH
VAT is a regularization method which is inspired by the adversarial training (Goodfellow et al., 2014b).
The regularization term of VAT is given as:
[Equation]
where
[Equation]
(cid:15) > 0 is a tuning parameter, θ is the parameter in the discriminator to train, (cid:98) θ is the current estimate of θ and C is a constant.
Combining with the cross-entropy term of the labeled data, we get the ﬁnal objective function of VAT :
[Equation]
G ENERATION OF BAD SAMPLES BY ADVERSARIAL TRAINING
The key role of bad samples in Bad GAN is to enforce the decision boundary to be pulled toward the low density regions of the unlabeled data.
To do this, bad samples must be located at the valleys of the distribution of the unlabeled data.
In this section, we propose a novel technique to generate ‘good’ bad samples by use of only a given classiﬁer
. 3. M OTIVATION
In this subsection, we explain why the adversarial direction is toward the decision boundary.
For simplicity, we only consider the linear decision boundary.
For the decision boundary made by the
DNN model with ReLU activation function, see Appendix A.2. Let us consider the 2-class linear logistic regression model parametrized by η = { w, b } , that is, p ( y = 1 | x ; η ) = (cid:16) 1 + exp( − b − w (cid:48) x ) (cid:17) − 1 .
Note that the decision boundary is { x : b + w (cid:48)
x = 0 } , and for any given x, the distance between x and the decision boundary is | b + w (cid:48) x | / || w || .
The key result is that moving x toward the adversarial direction r advr ( x, (cid:15) ) is equivalent to moving x toward the decision boundary which is stated rigorously in the following proposition.
The proof is in the appendix.
Proposition 1 For a sufﬁciently small (cid:15) > 0 , we have
[Equation]
Proposition 1 implies that | b + w (cid:48) x | / || w || > | b + w (cid:48)
( x + r advr ( x, (cid:15) )
| / ||
w ||
unless | b + w (cid:48) x | = 0 .
Hence, we can treat x + δr advr ( x, (cid:15) ) /
||
r advr ( x, (cid:15) )
|| for appropriately choosing δ > 0 as a bad sample (a sample closer to the decision boundary).
3. B AD SAMPLE G ENERATION WITH GENERAL CLASSIFIER
Motivated by Proposition 1, we propose a bad sample generator as follows.
Let δ > 0 be ﬁxed and (cid:98) θ be the current estimate of θ.
For a given input x and a classiﬁer p ( ·| x ; (cid:98) θ ) , we calculate the adversarial direction r advr ( x, (cid:15) ) for given (cid:15) by (2).
Then, we consider x bad = x + δr advr ( x, (cid:15) ) / (cid:107) r advr ( x.(cid:15) )
(cid:107) as a bad sample (a sample closer to the decision boundary).
We generate bad samples for all unlabeled data.
In practice, we apply the same δ to all unlabeled data and choose δ based on the validation data accuracy.
In Figure 1, we illustrate how the bad samples generated by the proposed adversarial training are distributed for multi-class problem.
With a good classiﬁer, we can clearly see that most bad samples are located well in the low density regions of the data.
It may happen that a generated bad sample is not sufﬁciently close to the decision boundary to be a ’good’ bad sample, in particular when δ is too large or too small.
To avoid such a situation, we exclude x bad which satisﬁes the following condition:
[Equation]
for a prespeciﬁed τ > 0 .
In our experiments, we set the optimal τ with validation data.
F AST ADVERSARIAL TRAINING WITH BAD SAMPLES
Once we generate bad samples by the adversarial training, FAT updates θ by minimizing the following objective function:
[Equation]
where D bad ( (cid:98) θ, (cid:15), δ ) is the set of generated bad samples with (cid:98) θ, (cid:15) and δ, L true ( θ ; [Equation] = −
[Equation]
g ( x ; θ ) ∈ R K is a pre-softmax vector of a given deep architecture and λ > 0 .
We treat (cid:15) and δ as tuning parameters to be selected based on the validation data accuracy.
We minimize the objective function with one of the standard optimization algorithms such as Adam (Kingma & Ba, 2014) or
RMSProp (Tieleman & Hinton, 2012). The objective function (5) differs from the objective function (1) of Bad GAN in a way that the second term of (1), the cross-entropy of not being a bad sample, is deleted and the regularization term of VAT is added.
We delete the second term of (1) because it can be easily shown that a perfect classiﬁer of unlabeled data can be obtained from the minimizer of the objective function (1) without the second term under the conditions in Dai et al.
The regularization term of VAT is added to improve the bad sample generator based on adversarial training.
See Section 5.1 for detailed discussions.
Miyato et al.
(2017) proposes the fast approximation method to calculate the adversarial direction r advr ( x, (cid:15) ) by using the second-order Taylor expansion.
Let us deﬁne H ( x, (cid:98) θ ) =
∇∇ D KL (cid:16) p ( ·| x ; (cid:98) θ ) || p ( ·| x + r ; (cid:98) θ ) (cid:17) | r =0 .
They claim that r advr emerges as the ﬁrst dominant eigenvector u ( x, (cid:98) θ ) of H ( x, (cid:98) θ ) with magnitude (cid:15) .
But there always exist two dominant eigenvectors, ± u ( x, (cid:98) θ ) , and the sign should be selected carefully.
So, we slightly modify the approximation method of Miyato et al.
(2017) by
[Equation]
This modiﬁcation helps to improve convergence speed of the test accuracy, which will be demonstrated in the ablation experiments.
R OLE OF VAT FOR SEMI - SUPERVISED LEARNING
In this section, we investigate the roles of the regularization term of VAT in our method in detail. First, we verify that VAT regularization term does help to generate ’better’ bad samples with a simple experiment.
Furthermore, we give a theoretical insight for the role of the regularization term of VAT in semi-supervised learning.
We will show that the regularization term of VAT pushes the decision boundary from the high density regions of unlabeled data.
As a result, FAT uses pushing operations by VAT term as well as pulling operations by bad samples simultaneously, which makes it possible to accelerate the training process with improved performances.
5. I MPROVEMENT OF BAD SAMPLES WITH VAT
For generated samples by adversarial training to be ‘good’ bad samples, the adversarial directions should be toward the decision boundary. While this always happens for the linear model by Proposition 1, adversarial directions could be opposite to the decision boundary for deep model. To avoid such undesirable cases as much as possible, it would be helpful to smoothen the classiﬁer with a regularization term. In this section, we explain that the regularization term of VAT plays such a role.
The adversarial direction obtained by maximizing the KL divergence is sensitive to local ﬂuctuations of the class probabilities which is exampliﬁed in Figure 2.
The regularization term of VAT is helpful to ﬁnd a right adversarial direction which is toward the decision boundary by eliminating unnecessary local ﬂuctuations of the class probabilities.
In Figure 3, we compare bad samples generated by the adversarial training with and without the regularization term of VAT for the MNIST dataset.
While the bad samples generated without the regularization term of VAT are visually similar to the given input vectors, the bad samples generated with the regularization term of VAT look like mixtures of two different digits and thus serve as ‘better’ bad samples.
Suppose that X is partitioned by ( K + 1) mutually disjoint subsets X k for k = 1 , . .
, K + 1 such that y ( x )
=
k for all x ∈ X k , k ≤ K and p ∗ ( x ) = 0 for x ∈ X K +1 , where y ( x ) is the ground-truth label of x and p ∗ ( x ) is the true density of x. For a given feature map u : X → R m and weight vectors w 1 , . .
. , w k , let p ( y = k | x ) ∝ exp( w (cid:48) k u ( x )) for k = 1 , . .
, K and p ( y = K + 1 | x ) ∝ 1 .
Let L tr satisfy X k ∩ L tr (cid:54) = ∅ for k = 1 , ...
K. Suppose that (i) argmax h p ( y = h | x ) =
y for x ∈ L tr , (ii) argmax h p ( y =
h | x ) ≤ K for x ∈ ∪ Kk =1 X k and (iii) argmax h p ( y = h | x )
=
K + 1 for x ∈ X K +1 .
Under these three conditions, Dai et al.
(2017) proves that argmax h p ( y = h | x ) =
y ( x ) for all x ∈ ∪ Kk =1 X k .
That is, generating large ‘good’ bad samples is helpful for classifying unlabeled data correctly only with a small amount of labeled data.
A similar result can be obtained for VAT objective function itself under mild additional conditions.[-Deﬁnition 
-]
For given two subsets A 1 and A 2 of X , we deﬁne d
( A 1 , A 2 ) =
min x 1 ∈A 1 ,x 2 ∈A 2 d ( x 1 , x 2 ) for a given metric d. We deﬁne a tuple ( x, x (cid:48) ) is (cid:15) -connected if d ( x, x (cid:48) ) < (cid:15).
A ﬁnite subset A of X is called (cid:15) -connected iff for all x, x (cid:48)
∈ A , there exists a ﬁnite path ( x, x 1 , ..., x q , x (cid:48) )
such that x j ∈ A for j = 1 , . . .
, q and ( x, x 1 ) , ( x 1 , x 2 ) , ..., ( x q − 1 , x q ) , ( x q , x (cid:48) ) are all (cid:15) -connected .
Proposition 2 Assume that there exists (cid:15) > 0 such that 1) U tr k = U tr ∩ X k , k = 1 , . . .
, K are (cid:15) -connected, 2) d
( X k , X k (cid:48) ) ≥ 2 (cid:15) for all k (cid:54)
=
k (cid:48) ≤ K , and 3) for each k ≤ K , there exists at least one ( x, k ) ∈
L tr such that d ( { x } , U trk ) < (cid:15).
Suppose that there exists a classiﬁer f : X → { 1 , ..., K } such that f ( x ) =
y for all ( x, y ) ∈ L tr and f ( x )
=
f ( x (cid:48) ) for all x (cid:48)
[Equation]
for all x ∈ U tr , where B ( x, (cid:15) )
= { x (cid:48) :
d ( x, x (cid:48) ) ≤ (cid:15) } .
Then, the function f classiﬁes the unlabeled set perfectly, that is:
[Equation]
Condition 1) and 2) mean that the unlabeled data are dense enough and the supports of each class are separated sufﬁciently, respectively.
Condition 3) assumes that at least one labeled instance exists near the supports of each class.
The main condition of Proposition 2 is (6) which essentially assumes that the classiﬁer f does not change much locally.
That is, f is invariant with respect to all small perturbations of an input x. Note that the regularization term of VAT is devised to improve the invariancy of the classiﬁer and Proposition 2 explains why improving the invariancy is helpful for semi-supervised learning.
5. I NTERPRETATION OF VAT
Let f ( x ; θ ) =
argmax h p ( y = h
| x ; θ ) .
Proposition 2 implies that it would be good to pursue a classiﬁer which predicts the labeled data correctly and at the same time is invariant with respect to all local perturbations on the unlabeled data.
For this purpose, a plausible candidate of the objective function is
[Equation]
Note that a classiﬁer f which achieves 0 value of the objective function (7) satisﬁes the conditions of Proposition 2 and thus classiﬁes all unlabeled data correctly.
The objective function (7) is not practically usable since neither optimizing the indicator function nor checking f ( x ; θ ) (cid:54) =
f ( x (cid:48) ; θ ) for all x (cid:48) in B ( x, (cid:15) ) is possible.
To resolve these problems, we replace the indicator functions in (7) with the cross-entropies, and the neighborhood B ( x, (cid:15) ) in the second term with the adversarial direction.
By doing so, we have the following alternative objective function:
[Equation]
Finally, we replace p ( ·| x ; θ ) in the second term of (8) by p ( ·| x ; (cid:98) θ ) to have the objective function of
VAT (3).
The condition (6) in Proposition 2 means that the decision boundary is not located inside the support
X k of each class.
That is, the regularization term of VAT prevents the decision boundary from being located at the high density regions of data or equivalently pushes the decision boundary from the high density regions of data.
E XPERIMENTS 6. P REDICTION PERFORMANCES IN SEMI - SUPERVISED LEARNING
We compare prediction performances of FAT over the benchmark datasets with other semi-supervised learning algorithms.
We consider the most widely used datasets: MNIST (LeCun et al., 1998), SVHN (Marlin et al., 2010) and CIFAR10 (Krizhevsky & Hinton, 2009).
As in done by other works, we randomly sample 100, 1000 and 4000 labeled data from the MNIST, SVHN and CIFAR10 datasets, respectively and use them as the labeled data and the rest as the unlabeled data.
For fair comparison, we use the same architectures as those used in Miyato et al.
(2017) for MNIST, SVHN and CIFAR10.
The optimal tuning parameters ( (cid:15), τ, δ ) in FAT are chosen based on the validation data accuracy.
[Table]
[Table] We use Adam algorithm (Kingma & Ba, 2014) to update the parameters and do not use any data augmentation techniques.
The results are summarized in Table 1, which shows that FAT achieves the state-of-the-art accuracy for SVHN dataset and competitive accuracies with the state-of-the-art method (i.e. Bad GAN ) for MNIST and CIFAR10.
We conduct another experiments where the numbers of labeled data are much smaller and consider a more complex dataset CIFAR100 (Krizhevsky & Hinton, 2009), whose results are summarized in Table 2. Note that FAT still dominates mod. VAT for the all datasets and the margins become larger.
While FAT achieves the state-of-the-art performances for MNIST and SVHN, its performance degrades much for CIFAR10 compared to the accuracy for the case of 4000 labeled data.
Note that the quality of bad samples depends on the quality of the estimated classiﬁer. For CIFAR10 which is relatively more complex than MNIST and SVHN, the quality of the estimated classiﬁer is inﬂuenced much to the amount of labeled data and thus the accuracy of FAT is more sensitive to the amount of labeled data. However, it is interesting to see that FAT is superior to mod.
VAT for CIFAR10 and
CIFAR100, which suggests that bad samples are helpful for complex problems where the quality of bad samples might not be sufﬁciently good. The other advantage of FAT is its stability with respect to learning phase. With small labeled data, the test accuracies of each epoch tends to ﬂuctuate much for VAT and mod VAT , while FAT provides much more stable results. See Figure 7 in Appendix.
This may be partly because ’good’ bad samples keep the classiﬁer from ﬂuctuation. [Table] [Table] [Table]
E FFECTS OF TUNING PARAMETERS
FAT introduces two additional tuning parameters τ and δ compared to VAT , where τ is used to determine whether a bad sample is ’good’ and δ is the radius to generate bad samples.
We investigate the sensitivities of prediction performances with respect to the changes of the values of τ and δ with (cid:15) being ﬁxed at 1.5 that is the optimal value.
The results are reported in Table 3.
Unless τ is too small or too large, the prediction performances are not changed much.
For δ, care should be done.
Too small δ , smaller than (cid:15) , hampers the prediction performance much.
Apparently, a similar value of δ to that of (cid:15) (i [Table] e. δ = 2 ) gives the best result. 6. O BJECTIVE FUNCTION ANALYSIS
In this subsection
[Table]
we analyze the effects of L true and L VAT in this section. We do not consider the cross-entropy of the labeled data and L fake since they are necessary to reﬂect the idea utilizing bad data. Table 4 compares the performances without one or both of these terms. Note that L VAT is necessary for superior performances, which is because L VAT is indispensable to generate ‘good’ bad samples as explained in Section 5.1.
On the other hand, the term L true , which is devised to separate unlabeled data from bad samples, is not always helpful. A possible explanation is that sometimes the term L true would give an undesirable effect on the misclassiﬁed data. 6. C OMPUTATIONAL EFFICIENCY We investigate the computational efﬁciency of our method in view of learning speed and computation time per training epoch.
For Bad GAN , we did not use PixelCNN++ on SVHN and CIFAR10 datasets since the pre-trained PixelCNN++ models are not publicly available. Figure 4 draws the bar plots about the numbers of epochs needed to achieve the prespeciﬁed test accuracies. We can clearly see that FAT requires much less epochs We also calculate the ratios of the computing time of each semi-supervised learning algorithm over the computing time of the corresponding supervised learning algorithm for CIFAR10 dataset, whose results are summarized in Table 5.
These ratios are almost same for different datasets. The computation time of FAT is competitive to VAT and mod.
VAT , and hence we can conclude that FAT arrives at the prespeciﬁed performances much efﬁciently. Note that PixelCNN++ is not used for this experiment, and so comparison of computing time of FAT and Bad GAN with PixelCNN++ is meaningless [Table]
6. Q UALITY OF BAD SAMPLES GENERATED BY ADVERSARIAL TRAINING
We investigate how ‘good’ bad samples generated by the adversarial training are.
The upper panel of Figure 5 shows the scatter plot of the synthetic data and the trace plot of prediction accuracies of
FAT and VAT .
And the lower panel of Figure 5 draws the scatter plots with generated bad samples at various epochs.
We can clearly see that bad samples move to lower density regions as the epoch increases, which amply demonstrates that the adversarial training is good at generating bad samples.
We also compare bad images of the MNIST data generated by FAT and Bad GAN in Figure 6.
The bad images by FAT do not look like real images and do not seem to be collapsed, which indicates that FAT consistently generates diverse and good bad samples.
Bad GAN also generates diverse bad samples but some ‘realistic’ images can be found.
C ONCLUSION
In this paper, we propose a new method called FAT for semi-supervised learning which generates bad samples only with a given classiﬁer.
The objective function of FAT is devised to compromise the advantages of Bad GAN and VAT together, which makes FAT be faster and more accurate.
In numerical experiments, we show that FAT achieves almost the state-of-the-art performances with much fewer epochs.
Unlike Bad GAN , FAT only needs to learn a discriminator.
Hence, it could be extended without much effort to other learning problems.
For example, FAT can be modiﬁed easily for recurrent neural networks and hence can be applied to sequential data.
We will leave this extension as a future work.
It would be useful to combine FAT with a generative approach such as Bad GAN , in particular when the initial classiﬁer is bad.
Since FAT uses only a classiﬁer to generate bad samples, the initial estimate of the classiﬁer would be important.
Using the generator model learned by large unlabeled data would be helpful to ﬁnd a good initial estimate of the classiﬁer.
A CKNOWLEDGMENTS
This work is supported by Samsung Electronics Co., Ltd.
A A PPENDIX A. P ROOF OF P ROPOSITION
Without loss of generality, we assume that w (cid:48) x
+ b > 0 , that is, p ( y = 1 | x ; η ) > p ( y =
| x ; η ) .
We will show that there exists (cid:15) > 0 such that w (cid:48) r ∗ ( x, (cid:15) ) < 0 .
Note that argmax
[Equation]
[Equation]
(cid:48)
[Equation]
So all we have to do is to show
[Equation]
By simple calculation we can get the following:
[Equation]
Using the Taylor’s expansion up to the third-order
[Equation]
we obtain the following:
[Equation]
1 | x ; η ) p ( y = 0 | x ; η ) r (cid:48) ww (cid:48) r −6 p
{+( y = 1 | x ; η ) p ( y = 
+}
{+| x ; η ) { p ( y = 1 | x ; η ) − p ( y = 
 | x ; η ) } p (cid:88) i,j,k = w i w j w k r i r j r k+}
+ o ( || r
|| 3 ) .
So, log
[Equation]
Thus, we have the following equations:
[Equation]
Therefore, there exists (cid:15) ∗ > 0 such that KL ( x, r ∗ 2 ; η ) > KL ( x, r ∗ 1 ; η ) for ∀ 0 < (cid:15) < (cid:15) ∗ . (cid:3)
A. E XTENSION OF P ROPOSITION 1 FOR THE DNN CLASSIFIER
Consider a binary classiﬁcation DNN model with ReLU activation function p ( y = 1 | x ; θ ) = (1 + exp − g ( x ; θ ))) − 1 parameterized by θ.
Since g ( x ; θ ) is piecewise linear, we can write g ( · ; θ ) as
[Equation]
where A j is a linear region and N is the number of linear regions.
For given x, suppose g ( x ; θ ) > 0 .
If g ( x : θ ) is estimated reasonably, we expect that g ( x ; θ ) is decreasing if x moves toward the decision boundary.
A formal statement of this expectation would be that x − r ∇ x g ( x ; θ ) can arrive at the decision boundary for a ﬁnite value of r > 0 , where ∇ x is the gradient with respect to x. Of course, for x with g ( x ; θ ) < 0 , we expect that x + r ∇ x g ( x ; θ ) can arrive at the decision boundary for a ﬁnite value of r > 0 .
We say that x is normal if there is r > 0 such that x − r ∇ x g ( x : θ )sign { g ( x : θ ) } locates at the decision boundary.
We say that a linear region A j is normal if all x in A j are normal .
We expect that most of A j are normal if g ( x ; θ ) is reasonably estimated so that the probability decreases or increases depending on sign { g ( x : θ ) } if x is getting closer to the decision boundary.
The following proposition proves that the adversarial direction is toward the decision boundary for all x s in normal linear regions.
{+Proposition 
+}
If a linear region A j is normal.
Then for any x ∈ int ( A j ) , there exists (cid:15) > 0 and δ > 0 such that x bad = x + δr advr ( x, (cid:15) ) /
||
r advr ( x, (cid:15) )
|| is on the decision boundary.
Proof.
Take ˜ (cid:15) > 0 such that x + r ∈ A ˜ j for ∀ r ∈ B ( x, ˜ (cid:15) ) .
Then by Proposition 1, there exists 0 < (cid:15) ∗ < ˜ (cid:15) such that for ∀ 0 < (cid:15) < (cid:15) ∗ ,
[Equation]
sign { g ( x : θ ) } . x is normal , thus there exists δ > 0 such that x bad = x + δr advr ( x, (cid:15) ) / || r advr ( x, (cid:15) )
|| belongs to the decision boundary.
(cid:3)
A. P ROOF OF P ROPOSITION
It sufﬁces to show that ∀ x, x (cid:48) ∈ U trk , f ( x ) =
f
( x (cid:48) ) for all k = 1 , ..., K .
For given U trk , there exists (˜ x, ˜ y )
∈ L tr such that d ( { ˜ x } , U trk ) < (cid:15) .
So U trk ∪ { ˜ x } is (cid:15) -connected .
That is, for any x ∈ U trk , there exists a path (˜ x, x 1 , ..., x q , x ) such that (˜ x, x 1 ) , ..., ( x q , x ) are all (cid:15) -connected .
Therefore y ( x ) =
y (˜ x ) = ˜
y for ∀ x ∈ U trk , and the proof is done.
(cid:3)
[Figure]