O N THE S ENSITIVITY OF A DVERSARIAL R OBUSTNESS TO I NPUT D ATA D ISTRIBUTIONS
Anonymous authors
Paper under double-blind review
A BSTRACT
Neural networks are vulnerable to small adversarial perturbations.
Existing literature largely focused on understanding and mitigating the vulnerability of learned models.
In this paper, we demonstrate an intriguing phenomenon about adversarial training, arguably the most popular robust training method in the literature:
Adversarial robustness, unlike clean accuracy, is sensitive to the input data distribution.
Even a semantics-preserving transformations on the input data distribution can cause a signiﬁcantly different robustness for the adversarial trained model that is both trained and evaluated on the new distribution.
Our discovery of such sensitivity on data distribution is based on a study which disentangles the behaviors of clean accuracy and robust accuracy of the Bayes classiﬁer.
Further empirical investigation on MNIST and CIFAR10 conﬁrms our ﬁnding that numerous MNIST and CIFAR10 variants achieve comparable clean accuracies in various different neural nets under standard training but signiﬁcantly different robustness under adversarial training.
This counter-intuitive phenomenon indicates that input data distribution alone can affect the adversarial robustness of trained neural networks, not necessarily the tasks themselves.
Lastly, we discuss the practical implications on evaluating adversarial robustness, and make initial attempts to understand this complex phenomenon
I NTRODUCTION
Neural networks are vulnerable to adversarial examples (Szegedy et al., 2013; Biggio et al., 2013).
Since the ﬁrst discovery of adversarial examples, great progress has been made in constructing stronger adversarial attacks (Goodfellow et al., 2014; Moosavi-Dezfooli et al., 2016; Madry et al., 2017; Carlini and Wagner, 2017). In contrast, defenses fell behind in the arms race (Carlini and Wagner, 2016; Athalye et al., 2017; 2018).
Recently a line of works have been focusing on understanding the difﬁculty in achieving adversarial robustness from the perspective of data distribution.
In particular, Tsipras et al. (2018) demonstrated the inevitable tradeoff between robustness and clean accuracy in some particular examples.
Schmidt et al. (2018) showed that the sample complexity of “learning to be robust” learning could be signiﬁcantly higher than that of “learning to be accurate”.
In this paper, we contribute to this growing literature from a new angle, by studying the relationship between adversarial robustness and the input data distribution.
We focus on the adversarial training method, which is the most popular defense method so far due to its simplicity, effectiveness and scalability (Goodfellow et al., 2014; Huang et al., 2015; Kurakin et al., 2016; Madry et al., 2017; Erraqabi et al., 2018).
Our main contribution is the ﬁnding that adversarial robustness is highly sensitive to the input data distribution: A semantically lossless shift on the data distribution could result in a drastically different robustness for adversarially trained models.
Note that this is different from the transferability of a ﬁxed model that is trained on one data distribution but tested on another distribution. Even retraining the model on the new data distribution may give us a completely different adversarial robustness on the same new distribution. To our best knowledge, our paper is the ﬁrst work in the literature that demonstrates such sensitivity.
This is also in sharp contrast to the clean accuracy of standard training, which, as we show in later sections, is insensitive to such shifts. Our investigation is motivated by the empirical observations on the MNIST dataset and the CIFAR dataset.
In particular, while comparable SOTA clean accuracies (the difference is less than 3%) are achieved by MNIST and CIFAR10 (Gastaldi, 2017), CIFAR10 suffers from much lower achievable robustness than MNIST in practice.
1 Our main contribution is twofold, both theoretical and empirical. In theory, we start with analyzing the difference between the regular Bayes error and the robust error, and show that the regular Bayes error is invariant to invertible transformations of the data distribution, but the robust error is not.
We further prove that if the input data is uniformly distributed, then the perfect decision boundary cannot be robust.
Such results suggest the difﬁculty in ﬁnding a truly robust model. However, we manage to ﬁnd a robust model for the binarized MNIST dataset (semantically almost identical to MNIST, later described in Section 3).
The certiﬁcation method by
Kolter and Wong (2017) guarantees that this model achieves at most 3% robust error. Such a sharp contrast suggests the important role of the data distribution in adversarial robustness, and leads to our second contribution on the empirical side: we design a series of augmented MNIST and CIFAR datasets to demonstrate the sensitivity of adversarial robustness to the input data distribution.
Our ﬁnding raises the question of how to properly evaluate adversarial robustness.
In particular, the sensitivity of adversarial robustness suggests that certain datasets may not be sufﬁciently representative when benchmarking different robust learning algorithms.
It also raises serious concerns about the deployment of believed-to-be-robust training algorithm in a real product.
In a standard development procedure, various models (for example different network architectures) would be prototyped and measured on the existing data.
However, the sensitivity of adversarial robustness makes the truthfulness of the performance estimations questionable, as one would expect that future data will be slightly shifted.
We illustrate the practical implications in Section 4 with two practical examples: 1) the robust accuracy of PGD trained model is sensitive to gamma values of gamma-corrected CIFAR10 images.
This indicates that image datasets collected under different light conditions may have different robustness properties; 2) both as a “harder” version of MNIST, the fashion-MNIST (Xiao et al., 2017) and edge-fashion-MNIST (an edge detection variant described in Section 4.2) exhibit completely different robustness characteristics.
This demonstrates that different datasets may give completely different evaluations for the same algorithm.
Moreover, our ﬁnding opens up a new angle and provides novel insights to the adversarial vulnerability problem, complementing several recent works on the issue of data distributions’ inﬂuences on robustness.
Tsipras et al.
(2018) hypothesize that there is an intrinsic tradeoff between clean accuracy and adversarial robustness.
Our studies complement this result, showing that there are different levels of tradeoffs depending on the characteristics of input data distribution, under the same learning settings (training algorithm, model and training set size).
Schmidt et al.
(2018) show that different data distributions could have drastically different properties of adversarially robust generalization, theoretically on Bernoulli vs mixtures of Gaussians, and empirically on standard benchmark datasets.
From the sensitivity perspective, we demonstrate that being from completely different distributions (e.g. binary vs Gaussian or MNIST vs CIFAR10) may not be the essential reason for having large robustness difference. Gradual semantics-preserving transformations of data distribution can also cause large changes to datasets’ achievable robustness. We make initial attempts in Section 5 to further understand this sensitivity.
We investigated perturbable volume and inter-class distance as the natural causes of the sensitivity; model capacity and sample complexity as the natural remedies. However, the complexity of the problem has so far deﬁed our efforts to give a deﬁnitive answer.
1. N OTATION AND PROBLEM SETUP
We speciﬁcally consider the image classiﬁcation problem where the input data is inside a high dimensional unit cube.
We denote the data distribution as a joint distribution P ( X, Y ) , where
X ∈ [0 , 1] d , d is the number of pixels, and Y ∈ { 1 , 2 , . . .
, k } is the discrete label.
Note that here we assume the support of X is the whole pixel space [0 , 1] d .
When X is a random noise (or human perceptually unclassiﬁable image), one can think of P ( y | X ) being closed to uniform distribution on labels.
In the standard setting, the samples ( x i , y i ) can be interpreted as x i is independently sampled from the marginal distribution P ( X ) , and then y i is sampled from P ( Y | X
= x i ) .
In this paper, we discuss P ( X ) ’s inﬂuences on adversarial robustness, given a ﬁxed P ( y | X ) .
In our experiments, we only discuss the whitebox robustness, as it represents the “intrinsic” robustness.
We use models learned by adversarially augmented training (Madry et al., 2017)
(PGD training), which has the SOTA whitebox robustness.
We consider bounded (cid:96) ∞ attack as the attack for evaluating robustness for 2 reasons: 1) PGD training can defend against (cid:96) ∞ relatively well, while for other attacks, how to train a robust model is still an open question; 2) in the image domain (cid:96) ∞ attack is the mostly widely researched attack.
T HEORETICAL A NALYSES AND P ROVABLE C ASES
As mentioned in the introduction, although the SOTA clean accuracies are similar for MNIST and
CIFAR10, empirical investigations suggest that robust accuracy on CIFAR10 is much more difﬁcult to achieve, which indicates the different behaviors of clean accuracy and robust accuracy.
The ﬁrst result in this section is to further conﬁrm this indication in a simple setting, where clean accuracy remains the same but robust accuracy completely changes under distribution shift.
Based on results from the concentration of measure literature, we then show that under uniform distribution basically no algorithm can achieve good robustness, as long as they have high clean accuracy.
Such theoretical results are in sharp contrast to our practical experience.
Therefore, we further examine the performance of a veriﬁable defense method on binarized MNIST (pixels values rounded toand 1), and the result suggests the exact opposite: provable adversarial robustness on MNIST-like dataset is achievable.
Such contrast thus clearly suggests the important role of the data distribution in achieving adversarial robustness.
2. D ISENTANGLE C LEAN A CCURACY AND R OBUST A CCURACY
Let H denote the universal set of all the measurable functions.
Given a joint distribution P ( x , y ) on the space X × Y , we deﬁne the Bayes error R ∗ = inf h ∈H E P ( x , y ) L ( y ; h ( x ))
=
R ∗ ( P ( x , y )) , where L is the objective function.
In other words, Bayes error is the error of the best possible classiﬁer we can have, h ∗ , without restriction on the function space of classiﬁers.
We further deﬁne (adversarial) robust error RR ( h ) =
E P ( x , y ) max (cid:107) δ (cid:107) ∞
<
(cid:15) L ( y ; h ( x + δ ))
=
RR ( P ( x , y )) .
We denote
RR ∗ = RR ( h ∗ ) to be the robust error achieved by the Bayes classiﬁer h ∗ .
For simplicity, we assume our algorithm can always learn h ∗ , which reduces clean accuracy to be (1 − Bayes error ) , and robust accuracy of the Bayes classiﬁer to be (1 − RR ∗ ) .
One immediate result is that Bayes error remains the same under any distribution shift induced by an injective map T :
X → X .
To see that, simply note that T − 1 exists and h ∗ ◦ T − 1 gives the same Bayes error for the shifted distribution.
However, such invariance property does not hold for the robust error of the Bayes classiﬁer.
Furthermore, the following two examples show that Bayes error can have completely different behavior from its robust error.
Although both examples have
Bayes error, they have completely different robust errors.
Example 1.
Assume x is uniformly distributed in [0 , 1] d and y = 1 , for all x with x (cid:62) e 1 > 1 / 2 and y = 0 , for x (cid:62) e 1 ≤ 1 / 2 , where e 1 is the one-hot vector.
We use the 0-1 loss here.
Note that the Bayes error decision boundaries are given by the following hyperplane: HP 1 = { x ∈ [0 , 1] d : x 1 = 0 } , and thus
[Equation]
under the budget (cid:107) δ (cid:107) ∞
<
(cid:15) .
In this case, the robust error is tolerable and relatively robust measured by the fraction of points that are successfully attacked, 2 (cid:15) .
Moreover, consider an injective map T which maps { x : x (cid:62) e 1 > 1 / 2 } to { x : x (cid:62) 1 > d 2 } , and { x : x (cid:62) e 1 ≤ 1 / 2 } to { x : x (cid:62) 1 ≤ d 2 } 2 .
The Bayes error on the new distribution remains 0 , as T is invertible.
In contrast, the robust error is much worse.
As shown in Proposition 2.1,
[Equation]
Remark 2.1.
Note that here the robust error of the Bayes classiﬁer will grow to 1 as the dimensionality increases, for a ﬁxed budget (cid:15) .
Proposition 2.1 (Existence of Non-Adversarially Robust Decision Boundary) .
Let x be uniformly distributed on [0 , 1] d and y = 1 , for all x such that x (cid:62) 1 > d 2 and y = 0 otherwise.
Consider adversarial attack under budget (cid:107) δ (cid:107) ∞
<
(cid:15) .
Then for zero-one loss L :
[Equation]
2. D IFFICULTY IN ACHIEVING ROBUSTNESS
Example 1 shows that good clean accuracy does not necessary lead to good robust accuracy.
In contrast, we will show in this section that achieving a good robust accuracy is impossible given uniformly distributed data, as long as we ask for good clean accuracies.
Our tool are classical results from the concentration of measure (Ledoux, 2005).
Let A (cid:15) :
=
{ x ∈ R N | d ( x, A ) < (cid:15) } denote the (cid:15) -neighborhood of the nonempty set A .
Theorem 2. provides a lower bound on the mass in A (cid:15) .
Theorem 2.1 (Concentration of Measure on the Unit Cube and the Unit Ball) .
Let [0 , 1] d denote the unit d -cube and B d denote the Euclidean unit d -ball, both equipped with uniform probability distributions.
Let (cid:15) > 0 .
Then for any A ⊂ [0 , 1] d with P ( A ) ≥ 1 / 2 , we have:
[Equation]
For any B ⊂ B d , with P ( B ) ≥ 1 / 2 ,
[Equation]
where δ (cid:96) 2 ( (cid:15) )
= 1 − (cid:113) 1 − (cid:15) 2 4 and Φ is the standard normal cumulative distribution function.
Based on Theorem 2.1 we can now show that under some circumstances, no algorithm that achieves can perfect clean accuracy can also achieve a good robust accuracy.
Example 2 (Vulnerability Guarantee) .
Consider the joint distribution P ( x , y ) , where the input data x is uniformly distributed on [0 , 1] d and label y has 10 classes.
Further assume the marginal distribution of y is also uniform 3 .
Theorem 2.1 implies that under (cid:96) 2 adversarial attack with (cid:15) = 0 .
5 , at least 94 % of the samples are ether wrongly classiﬁed or can be successfully attacked for a classiﬁer with perfect clean accuracy.
Furthermore, if d = 3 ∗ 32 ∗ 32 , A parallel calculation for P ( x , y ) on the B d domain gives: under (cid:96) 2 adversarial attack with (cid:15) = 0 . 09 , at least 97 % of the the samples are ether wrongly classiﬁed or can be successfully attacked for a classiﬁer with perfect clean accuracy.
On the one hand, Theorem 2.1 and Example 2 suggest that uniform distribution on a [0 , 1] d enjoys more robustness and is not affected by the high dimensionality.
This may partially explain why
MNIST is more adversarially robust than CIFAR10, as the distribution of x in CIFAR10 is “closer” to B d than to [0 , 1] d .
On the other hand, while not completely sharp, they also suggest the intrinsic difﬁculty in achieving good robust accuracy.
Note that one limit of Theorem 2.1 and Example 2 is the uniform distribution assumption, which is surely not true for natural images.
Indeed, although rigorously developed, Theorem 2.1 and Example 2 do not explain certain empirical observations.
Following Kolter and Wong (2017), we train a provably 4 robust model on a binarized MNIST dataset (bMNIST) 5 .
Our experiments shows that the learned model is (rigorously) guaranteed to achieve less than 3.00% robust error on bMNIST test data, while maintains 97.65% clean accuracy.
Details of this experiments in described in Appendix
B.2.
Such experiment clearly suggests the essential role of the data distribution in achieving good robust and clean accuracy.
While it is hard to completely answer the question what geometric properties differentiate the concentration rates between the ball/the cube in high dimension, and the distribution of bMNIST.
We remark that one obvious difference is the distance distributions in both spaces.
Could the distance distributions explain the differences in achievable clean and robust accuracy?
Note that the same method can only achieve 37.70% robust error on original MNIST data, and even higher error on CIFAR10, which further supports this hypothesis.
In the rest of this paper, we further investigate the dependence of robust accuracy on the distribution of real data.
R OBUSTNESS ON D ATASETS V ARIANTS WITH D IFFERENT I NPUT D ISTRIBUTIONS
Section 2.2 clearly suggests that the data distribution plays an essential role in the achievable robust accuracy.
In this section we carefully design a series of datasets and experiments to further study but their joint distribution not necessary uniform. its inﬂuence.
One important property of our new datasets is that they have different P ( x ) ’s while keep P ( y | x ) reasonably ﬁxed, thus these datasets are only different in a "semantic-lossless" shift.
Our experiments reveal an unexpected phenomenon that while standard learning methods manage to achieve stable clean accuracies across different data distributions under "semantic-lossless" shifts, however, adversarial training, arguably the most popular method to achieve robust models, loses this desirable property, in that its robust accuracy becomes unstable even under a "semantic-lossless" shift on the data distribution.
We emphasize that different from preprocessing steps or transfer learning, here we treat the shifted data distribution as a new underlying distribution.
We both train the models and test the robust accuracies on the same new distribution.
3. S MOOTHING AND S ATURATION
We now explain how the new datasets are generated under "semantic-lossless" shifts.
In general,
MNIST has a more binary distribution of pixels, while CIFAR10 has a more continuous spectrum of pixel values, as shown in Figure 1a and Figure 1b.
To bridge the gap between this two datasets that have completely different robust accuracies, we propose two operations to modify their distribution on x: smoothing and saturation, as described below.
We apply different levels of "smoothing" on
MNIST to create more CIFAR-like datasets, and different levels of "saturation" on CIFAR10 to create more "binary" ones.
Note that we would like to maintain the semantic information of the original data, which means that such operations should be semantics-lossless and not arbitrarily wide.
Smoothing is applied on MNIST images, to make images “less binary”.
Given an image x i , its smoothed version ˜ x i ( s ) is generated by ﬁrst applying average ﬁlter of kernel size s to x i to generate an intermediate smooth image, and then take pixel-wise maximum between x i and the intermediate smooth image.
Our MNIST variants include the binarized MNIST and smoothed MNIST with different kernel sizes.
As shown in Figure 1c, all MNIST variants still maintain the semantic information in MNIST, which indicates that P ( y | ˜ x ( s ) ) should be similar to P ( y | x ) .
It is thus reasonable to assume that y i is approximately sampled from P ( y | ˜ x
( s ) ) , and as such we assign y i as the label of ˜ x
( s ) .
Note that all the data points in the binarized MNIST are on the corners of the unit cube.
For the smoothed versions, pixels on the digit boundaries are pushed off the corner of the unit cube.
Saturation of the image x
i is denoted by (cid:98)
x i ( p ) , and the procedure is deﬁned as below: for each pixel of x , v , its corresponding pixel of (cid:98) x ( p ) is deﬁned as
[Equation]
Saturation is used to generate variants of the CIFAR10 dataset with less centered pixel values.
For different saturation level p ’s, one can see from Figure 1d that (cid:98) x ( p ) is still semantically similar to x in the same classiﬁcation task.
Similarly we assign y i as the label of (cid:98) x ( p ) .
One immediate property about (cid:98) x
( p ) is that it pushes x to the corners of the data domain where the pixel values are either 0 or 1 when p ≥ 2 , and pull the data to the center of 0 .
5 when p ≤ 2 .
When p = 2 it does not change the image, and when p = ∞ it becomes binarization.
3. E XPERIMENTAL S ETUPS
In this section we use the smoothing and saturation operations to manipulate the data distributions of MNIST and CIFAR10, and show empirical results on how data distributions affects robust accuracies of neural networks trained on them.
Since we are only concerned with the intrinsic robustness of neural networks models, we do not consider methods like preprocessing that tries to remove perturbations or randomizing inputs.
We perform standard neural network training on clean data to measure the difﬁculty of the classiﬁcation task, and projected gradient descent (PGD) based adversarial training (Madry et al., 2017) to measure the difﬁculty to achieve robustness.
By default, we use LeNet5 on all the MNIST variants, and use wide residual networks (Zagoruyko and Komodakis, 2016) with widen factor 4 for all the CIFAR10 variants.
Unless otherwise speciﬁed,
PGD training on MNIST variants and CIFAR10 variants all follows the settings in Madry et al.
Details of network structures and training hyperparameters can be found in Appendix B.
We evaluate the classiﬁcation performance using the test accuracy of standardly trained models on clean unperturbed examples, and the robustness using the robust accuracy of PGD trained model, [Figure] [Figure] [Figure]
[Figure]
[Figure] [Figure] which is the accuracy on adversarially perturbed examples. Although not directly indicating robustness, we report the clean accuracy on PGD trained models to indicate the tradeoff between being accurate and robust.
To understand whether low robust accuracy is due to low clean accuracy or vulnerability of model, we also report robustness wrt predictions , where the attack is used to perturb against the model’s clean prediction, instead of the true label.
We use (cid:96) ∞ untargeted PGD attacks (Madry et al., 2017) as our adversary, since it is the strongest attack in general based on our experiments.
Unless otherwise speciﬁed, PGD attack on MNIST variants runs with (cid:15) = 0 .
3 , step size of 0 .
01 and 40 iterations, and runs with (cid:15)
= 8 / 255 , step size of 2 / 255 and 10 iterations on CIFAR variants , same as in Madry et al.
3. S ENSITIVITY OF R OBUST A CCURACY TO D ATA T RANSFORMATIONS
[Figure]
Results on MNIST variants are presented in Figure 2a 6 .
According to the results, the clean accuracy of standard training is very stable across different MNIST variants.
This indicates that their classiﬁcation tasks have similar difﬁculties,if the training has no robust considerations.
When performing
PGD adversarial training, clean accuracy drops only slightly.
However, both robust accuracy and robustness wrt predictions drop signiﬁcantly.
This indicates that as smooth level goes up, it is signiﬁcantly harder to achieve robustness.
Note that for binarized MNIST with adversarial training, the clean accuracy and the robust accuracy are almost the same.
Indicating that getting high robust accuracy on binarized MNIST does not face a conﬂict against achieving high clean accuracy.
This result conforms with results of provably robust model having high robustness on binarized MNIST described in Section 2.
Different results on CIFAR10 variants are reported in Figure 2b.
7 , which tells a similar story.
For standard training, the clean accuracy maintains almost at the original level until saturation level 16, despite that it is already perceptually very saturated.
In contrast, PGD training has a different trend.
Before level 16, the robust accuracy signiﬁcantly increases from 43.2% until 79.7%, while the clean test accuracy drops only in a comparatively small range, from 85.4% to 80.0%.
After level 16,
PGD training has almost the same clean accuracy and robust accuracy.
However, robustness w.r.t.
predictions still keeps increasing, which again indicates the instability of the robustness.
On the other hand, if the saturation level is smaller than 2, we get worse robust accuracy after PGD training, e.g. at saturation level 1 the robust accuracy is 33.0%.
Simultaneously, the clean accuracy maintains almost the same.
Note that after saturation level 64 the standard training accuracies starts to drop signiﬁcantly.
This is likely due to that high degree of saturation has caused “information loss” of the images.
Models trained on highly saturated CIFAR10 are quite robust and the gap between robust accuracy and robustness w.r.t.
predictions is due to lower clean accuracy.
In contrast, In MNIST variants, the robustness wrt predictions is always almost the same as robust accuracy, indicating that drops in robust accuracy is due to adversarial vulnerability.
From these results, we can conclude that robust accuracy under PGD training is much more sensitive than clean accuracy under standard training, to the differences in input data distribution.
More importantly, a semantically-lossless shift on the data transformation, while does not introduce any unexpected risk for the clean accuracy of standard training, can lead to large variations in robust accuracy.
Such previously unnoticed sensitivity raised serious concerns in practice, as discussed in the next section.
P RACTICAL I MPLICATIONS
Given adversarial robustness’ sensitivity to input distribution, we further demonstrate two practical implications: 1) Robust accuracy could be sensitive to image acquisition condition and preprocessing.
This leads to unreliable benchmarks in practice; 2) When introducing new dataset for benchmarking adversarial robustness, we need to carefully choose datasets with the right characteristics.
4. R OBUST A CCURACY IS S ENSITIVE TO G AMMA C ORRECTION
The natural images are acquired under different lighting conditions, with different cameras and different camera settings.
They are also preprocessed in different ways.
All these factors could lead to mild shift on input distribution.
Therefore, we might get very different performance measures when performing adversarial training on images taken under different conditions.
In this section, we use gamma mapping to transform CIFAR10 images to different variants.
These variants are then used to represent image dataset acquired under different conditions.
Gamma mapping is a simple element-wise operation that takes the original image x , and output the gamma mapped image ˜ x ( γ ) by performing ˜ x ( γ ) =
x γ .
Gamma mapping is commonly used to adjust the exposure of an images.
We refer the readers to Szeliski (2010) on more details about gamma mappings.
Figure 3a shows variants of the same image processed with different gamma values.
Lower gamma value leads to brighter images and higher gamma values gives darker images, since pixel values range from 0 to 1.
Despite the changes in brightness, the semantic information is preserved.
We perform the same experiments as in the saturated CIFAR10 variants experiment in Section 3.
The results are displayed in Figure 3a.
Accuracies on clean data almost remain the same across different gamma values.
However, under PGD training, both accuracy and robust accuracy varies largely following different gamma values.
These results should raise practitioners’ attention on how to interpret robustness benchmark “values”.
For the same adversarial training setting, the robustness measure might change drastically between image datasets with different “exposures”.
Note that this is not to use a trained model on slightly varied datasets.
The discrepancies of robust performance measures is between models trained on slightly varied datasets separately.
In other words, if an training algorithm achieves good robustness on one image datasets, it doesn’t necessarily achieve similar robustness on another semantically-identical but slightly varied datasets.
Therefore, the actual robustness could either be signiﬁcantly underestimated or overestimated.
This raises the questions on whether we are evaluating image classiﬁer robustness in a reliable way, and how we choose benchmark settings that can match the real robustness requirements in practice.
This is an important open question and we defer it to future research.
4. C HOICE OF D ATASETS FOR E VALUATING R OBUSTNESS
As discussed, evaluating robustness on a suitable dataset is important.
Here we use fashion-MNIST (fMNIST) (Xiao et al., 2017) and edge-fashion-MNIST (efMNIST) as examples to analyze characteristics of “harder” datasets.
The edge-fashion MNIST is generated by running Canny edge detector [Figure] [Figure] (Canny, 1986) with σ = 1 on the fashion MNIST images.
Figure 3b shows examples of fMNIST and efMNIST.
We performed the same standard training and PGD training experiments on both fMNIST and efMNIST as we did on MNIST.
Figure 3b shows the results.
We can see that fMNIST exhibit similar behavior to CIFAR10, where the test accuracy is signiﬁcantly affected by PGD training and the gap between robust accuracy and accuracy is large.
On the other hand, efMNIST is closer to the binarized MNIST: the accuracy is affected very little by PGD training, along with an insigniﬁcant difference between robust accuracy and accuracy.
Both fMNIST and efMNIST can be seen as a “harder” MNIST, but they are harder in different ways.
One one hand, since efMNIST results from the edge detection run on fMNIST, it contains less information.
It is therefore harder to achieve higher accuracy on efMNIST than on fMNIST, where richer semantics is accessible.
However, fMNIST’s richer semantics makes it better resembles natural images’ pixel value distribution, which could lead to increased difﬁculty in achieving adversarial robustness.
efMNIST, on the other hand, can be viewed as a set of “more complex binary symbols” compared to MNIST or binarized MNIST.
It is harder to classify these more complex symbols.
However, it is easy to achieve high robustness due to the binary pixel value distribution.
To sum up, when introducing new dataset for adversarial robustness, we should not only look for a “harder” one, but we also need to consider whether the dataset is “harder in the right way”.
A TTEMPTS TO U NDERSTAND THE P HENOMENON
In this section, we make initial attempts to understand the sensitivity of adversarial robustness.
We use saturated CIFAR10 as the running example.
These analyses also apply to smoothed MNIST.
Saturation pushes pixel values towards 0 or 1, thus pushing data points towards the corner of unit cube.
This immediately leads to: 1) the “perturbable volume” decreases; 2) distances between data examples increases.
Intuitively, both could be related to the increasd robustness.
We analyze them and show that although they are correlated with robustness change, none of them can fully explain the observed phenomena.
We then further examine the possibility of increasing robust accuracy on less robust datasets by having larger models and more data.
5. O N THE I NFLUENCE OF P ERTURBABLE V OLUME
Saturation moves the pixel values towards 0 and 1, therefore pushing the data points to the corners of the unit cube input domain.
This makes the valid perturbation space to be smaller, since the space of perturbation is the intersection between the (cid:15) - (cid:96) ∞ ball and the input domain.
Due to high dimensionality, the volume of “perturbable region” changes drastically across different saturation levels.
For example, the average log perturbable volume 8 of original CIFAR10 images are -12354, and the average log perturbable volume of ∞ -saturated CIFAR10 is -15342, which means that the perturbable volume differs by a factor of 2 2990 = 2 ( − 12352 − ( − 15342)) . If the differences in perturbable
[Table]
volume is a key factor on the robustness’ sensitivity, then by allowing the attack to go beyond the domain boundary 9 , then the robust accuracies across different saturation levels should behave similarly again, or at least signiﬁcantly differ from the case of box constrained attacks.
We performed
PGD attack allowing the perturbation to be outside of the data domain boundary, and compare the robust accuracy to what we get for normal PGD attack within domain boundary.
We found that the expected difference is not observed, which serves as evidence that differences in perturbable volume are not causing the differences in robustness on the tested MNIST and CIFAR10 variants.
5. O N THE I NFLUENCE OF I NTER -C LASS D ISTANCE
When saturation pushes data points towards data domain boundaries, the distances between data points increase too.
Therefore, the margin, the distance from data point to the decision boundary, could also increase.
Since the margin is difﬁcult to measure, we use the “inter-class distance” as an approximate measure.
Inter-class distance 10 characterizes the distances between each class to rest of classes in each dataset.
Intuitively, if the distances between classes are larger, then it should be easier to achieve robustness.
We also observed (in Appendix D.2.1 Figure 5) that inter-class distances are positively correlated with robust accuracy.
However, we also ﬁnd counter examples where datasets having the same inter-class distance exhibit different robust accuracies.
Speciﬁcally,
We construct scaled variants of original MNIST and binarized MNIST, such that their inter-class distances are the same as smooth-3, smooth-4, smooth-5 MNIST.
The scaling operation is deﬁned as ˜ x ( α ) =
α ( x − 0 .
5) + 0 .
5 , where α is the scaling coefﬁcient.
When α < 1 .
each dimension of x is pushed towards the center with the same rate.
Table 1 shows the results.
We can see that although having the same interclass distances, the smoothed MNIST is still less robust than the their correspondents of scaled binarized MNIST and original MNIST.
This indicates the complexity of the problem, such that a simple measure like inter-class distance cannot fully characterize robustness property of datasets, at least on the variants of MNIST.
5. O N THE R EQUIRED M ODEL C APACITY AND S AMPLE C OMPLEXITY
In practice, it is unclear how far robust accuracy of PGD trained model is from adversarial Bayes error RR ∗ for the given data distribution.
In the case RR ∗ is not yet achieved, this is a non-exhaustive list that we can improve upon: 1) better training/learning algorithm; 2) increase model capacity; 3) train on more data.
Finding a better learning algorithm is beyond the scope of this paper.
Here we inspect 2) and 3) to see if it is possible to improve robustness by having larger model and more data.
For model capacity, we use differently sized LeNet5 by multiplying the number of channels at each layer with different widen factors.
These factors include 0.125, 0.25, 0.5, 1, 2, 4.
On CIFAR variants, we use WideResNet with widen factors 0.25, 1 and 4.
For sample complexity, we follow the practice in Section 3 except that we use a weight decay value of 0.002 to prevent overﬁtting.
For both MNIST and CIFAR10, we test on 1000, 3000, 9000, 27000 and entire training set.
Both model capacity and sample complexity results are shown in Figure 4.
For MNIST, both training and test accuracies of clean training are invariant to model sizes, even we only use a model with widen factor 0.125.
In slight contrast, both the training and test accuracy of PGD training increase as the model capacity increases, but it plateaus after widen factor 1 at an almost 100% accuracy.
For robust accuracy, training robust accuracy kept increasing as model gets larger until the value is close to 100%.
However, test robust accuracy stops increasing after widen factor 1, additional model capacity leads to larger (robust) generalization gap.
When we [Figure] vary the size of training set, the model can always ﬁt the training set well to almost 100% clean training accuracy under standard training.
The clean test accuracy grows as the training set size get larger.
Training set size has more signiﬁcant impact on robust accuracies of PGD trained models.
For most MNIST variants except for binarized MNIST, training robust accuracy gradually drops, and test robust accuracy gradually increases as the training set size increases.
This shows that when training set size is small, PGD training overﬁts to the training set.
As training set gets larger, the generalization gap becomes smaller.
Both training and test robust accuracies plateau after training set size reaches 27000.
Indicating that increasing the training set size might not help in this setting.
In conclusion, for MNIST variants, increasing training set size and model capacity does not seem to help beyond a certain point.
Therefore, it is not obvious on how to improve robustness on MNIST variants with higher smoothing levels.
CIFAR10 variants exhibit similar trends in general.
One notable difference is that for PGD training, the training robust accuracy does not plateau as model size increases.
However the test robust accuracy plateaus after wide factor 1.
Also when training set size increases, the training robust accuracy drops and test robust accuracy increases with no plateau present.
These together suggest that having more training data and training a larger model could potentially improve the robust accuracies on CIFAR10 variants.
One interesting phenomenon is that binarized MNIST and ∞ -saturated CIFAR has different sample complexity property, despite both being “cornered” datasets.
This indicates that the although binarization can largely inﬂuence robustness, it does not decide every aspect of it, such as sample complexity.
This complex interaction between the classiﬁcation task and input data distribution is still to be understood further.
C ONCLUSION
Our theoretical analyses shows the signiﬁcance of input data distribution in adversarial robustness, which further motivates our systematic experiments on MNIST and CIFAR10 variants.
We discover that, counter-intuitively, robustness of adversarial trained models are sensitive to semanticallypreserving transformations on data.
We then discuss the difﬁculties on evaluating robust learning algorithms.
Finally, we make initial attempts to understand this sensitivity, and believe deeper understanding requires non-trivial future efforts.
Appendix A P ROOFS A. P ROOF FOR P ROPOSITION 2.
Proof.
The argument is well-known in concentration of measure.
We provide here for the sake of completeness and adapt it to the context.
The hyperplane HP 2 = { x ∈ [0 , 1] d : X (cid:62) 1 =
[Equation]
2 } deﬁnes the decision boundary.
We ﬁrst compute the orthogonal distance of a given point y =
( y 1 , y 2 , · · · , y d )
=
( x 1 + δ 1 , x 2 + δ 2 , · · · , x d + δ d ) to HP 2 .
The point y is the perturbed point within budget (cid:107) δ (cid:107) ∞
< (cid:15) .
The vector 1 is orthogonal to HP 2 .
Pick any point x ∈ HP 2 , the orthogonal distance from y to HP 2 is:
[Equation]
The last two equations show that the (cid:96) 2 distance under an (cid:96) ∞ attack can grow at the rate of (cid:15) √ d , for this particular hyperplane HP 2 .
Now we take the expectation over [0 , 1] d , and note that expectation of the uniform distribution over a product space [0 , 1] d is the same as taking expectation on each dimension (Fubini’s theorem), picking each random variable coordinatewise uniformly from [0 , 1] .
[Equation]
Then we apply Markov’s inequality, for all real number t > 0 :
[Equation]
Finally, we observe that the longest (in terms of (cid:96) 2 norm) such (cid:15) (cid:96) ∞ attacks vector to HP 2 are parallel to the normal vector 1 to HP 2 .
They have (cid:96) 2 distance (cid:15) √ d .
The set these attacks cover is characterized by { x ∈ [0 , 1] d : (cid:96) ∞ ( x, H ) ≤ (cid:15) } = { x ∈ [0 , 1] d : (cid:96) 2 ( x, H ) ≤ (cid:15) √ d } .
Let t = (cid:15) 2 d , we have:
[Equation]
In the case of zero-one loss, RR ∗ =
P ( (cid:96)
[Equation] [Equation]
A. P ROOF FOR T HEOREM 2.
Proof.
(First Inequality for Cube)
The proof here follows that of Ledoux (2005), but we track of the tight constants so as to give tighter adversarial robustness calculations.
Let Φ be one dimensional standard normal cumulative distribution function and let µ d denote d dimensional Gaussian measures.
Consider the map T : R d −→ (0 , 1) d :
[Equation]
T pushes forward µ d deﬁned on R d into a probability measure P on (0 , 1) d :
[Equation]
for A ⊂ (0 , 1) d .
Next we have the following Gaussian isoperimetric/concentration inequality (Ledoux, 2005):
[Equation]
for all B ⊂ R d measureable.
Now for A ⊂ (0 , 1) d , we have:
[Equation]
where the ﬁrst inequality follows from that T has Lipschitz constant 1 √ 2 π , and thus T − 1 has Lipschitz constant √ 2 π ; and the second one follows from Gaussian isoperimetric inequality.
When P ( A ) ≥ 1 / 2 ,
[Equation]
Additionally, the inequality Φ( x ) ≥ 1 − e x 2 2 implies the last inequality in the theorem.
(Second Inequality for Ball)
We ﬁrst deﬁne the notion of modulus of convexity for a normed space, in this case (cid:96) 2 :
[Equation]
The important property about δ (cid:96) 2 ( (cid:15) ) is that there is a constant C such that:
[Equation]
By elementary algebraic calculuation, We can take C = 2 −√ 3 3 .
By Equation (2.25) in (Ledoux, 2005),
[Equation]
B D ETAILED S ETTINGS FOR T RAINING B. D ETAILED SETTINGS OF ADVERSARIAL TRAINING
The LeNet5 (widen factor 1) is composed of 32-channel conv ﬁlter + ReLU + size 2 max pooling + 64-channel conv ﬁlter + ReLU + size 2 max pooling + fc layer with 1024 units + ReLU + fc layer with 10 output classes.
We do not preprocess MNIST images before feeding into the model.
For training LeNet5 on MNIST variants, we use the Adam optimizer with an initial learning rate of 0.0001 and train for 100000 steps with batch size 50.
We use the WideResNet-28-4 as described in Zagoruyko and Komodakis (2016) for our experiments, where 28 is the depth and 4 is the widen factor.
We use “per image standardization” 11 to preprocess
CIFAR10 images, following Madry et al.
[Table] [Table]
For training WideResNet on CIFAR10 variants, we use stochastic gradient descent with momentum 0.9 and weight decay 0.0002.
We train 80000 steps in total with batch size 128.
The learning rate is set to 0.1 at step 0, 0.01 at step 40000, and 0.001 at step 60000.
We performed manual hyperparameter search for our initial experiment and do not observe improvements over the above settings.
Therefore we used these settings throughout the all the experiments in the paper unless otherwise indicated.
B. LP ROBUST MODEL DESCRIBED IN S ECTION
For the linear programming based provably robust model (Kolter and Wong, 2017) (LP-robust model).
We trained a ConvNet identical to the one in the original paper.
It has 2 convolutional layers, with 16 and 32 channels, each with a stride of 2; and 2 fully connected layers, the ﬁrst one maps the ﬂattened convolution features to hidden dimension 100, the second maps to 10 logit units.
We use ReLUs as the nonlinear activation and there is no max pooling in the network.
We train for 100 epochs with batch size 50.
The ﬁrst 50 epochs are warm start epochs where epsilon increases from 0.01 to 0.3 linearly.
We use Adam optimizer (Kingma and Ba, 2014) with a constant learning rate of 0.001.
C D ETAILED E XPERIMENTAL R ESULTS
We listed exact numbers of experiments involved in the main body in Table 2, 3, 4 and 5.
[Table]
D D ETAILED A NALYSES D. D ETAILED A NALYSIS OF E FFECTS OF D ATA D OMAIN B OUNDARY
One natural hypothesis about the reason of achieving better robustness could be that it is the effect of the boundaries.
Indeed, if the data distribution is closer to the data domain boundary, the valid perturbation space, the (cid:15) - (cid:96) ∞ ball may be restricted since it will intersect with the boundary.
We then test the correlation between "how close the data distribution is to the boundary" and its achievable robustness, by examining the volume of the allowed perturbed box across different datasets.
The intersection of the data domain, unit cube [0 , 1] d , with the allowed perturbation space, (cid:15) - (cid:96) ∞
ball [ x i − (cid:15), x i + (cid:15) ]
d , is the hyperrectangle [max { x i − (cid:15), 0 } , min { x i + (cid:15), 1 } ] d , where i = 1 , · · · , d are the indexes over input dimensions.
The size of the available perturbation space at x and (cid:15) is deﬁned by the volume of this hyperrectangle:
[Equation]
In high dimensional space, when (cid:15) is ﬁxed, this volume varies greatly based on the location of x .
For example, if x is on one of the corners of the unit cube, Vol( x corner , (cid:15) )
= (cid:15) d .
If each dimension of x is at least (cid:15) away from all the data boundaries, then the volume of the hyperrectangle is
Vol( x inside , (cid:15) )
= (2 (cid:15) )
d .
Therefore there can be 2 d times difference of perturbable space between different data points.
As shown in the average log perturbable volumes Table 6, we can see that different variations of datasets has signiﬁcantly different perturbable volumes, with the same trend with previously described.
It is notable that for the original CIFAR10 datasets has log volume -12354, which is very close to the -12270.
The different of 84 bits indicates on average, the perturbation space is 2 84 smaller than the full (cid:15) - (cid:96) ∞ ball if there is no intersection with the data domain boundary.
Volume differences between different saturation or smooth level can be interpreted in the similar
[Table] [Table]
way.
Note that for CIFAR10 images with large saturation, although they appear similar to human, they actually have very large differences in terms of perturbable volumes.
If the perturbable volume hypothesis holds, then we should observe signiﬁcantly lower accuracy under PGD attack if we allow perturbation outside of data domain boundary.
Since this greatly increases the perturbable volume.
We measure the accuracy under PGD attack with and without considering data domain boundary for both MNIST and CIFAR10 variants.
The results are shown in Table 7.
“With considering boundary” corresponds to regular PGD attacks.
We can see that allowing PGD to perturb out of bound do not reduce accuracy under attack.
This means that PGD
[Table]
is not able to use the signiﬁcantly larger additional volumes even for binarized MNIST or highly saturated CIFAR10, whose data points are on or very close to the corner.
In some cases, allowing perturbation outside of domain boundary makes the attack slightly less effective.
This might be due to that data domain boundary constrained the perturbation to be in an “easier” region.
This might seem surprising considering the huge difference in perturbable volumes, these results conform with empirical results in previous research (Goodfellow et al., 2014; Warde-Farley and Goodfellow, 2016) that adversarial examples appears in certain directions instead of being distributed in small pockets across space.
Therefore, the perturbable volume hypothesis is rejected
[Table]
D. D ETAILED A NALYSES OF I NTER - CLASS D ISTANCE D.2. C ALCULATION OF I NTER - CLASS D ISTANCE
We calculate inter-class distance as follows.
Let D = { x i } denote the set of all the input data points,
D c = { x i | y i
=
c } denote the set of all the data points in class c , and D ¬ c = { x i
|
y i (cid:54) =
c } denote all the data points not in class c .
Our goal is to calculate d ( D c , D ¬ c ) for all the classes, where d ( D c , D ¬ c ) approximates the margin between class c and the rest.
To estimate d ( D c , D ¬ c ) , we ﬁrst compute the margin for each data point x in class c .
To do that, we calculate the average (cid:107) x − x j (cid:107) 2 , where
x j ∈ D ¬
c is one of x ’s 10% nearest neighbors in D ¬ c .
Lastly, the inter-class distance of class c , d ( D c , D ¬ c ) , is then calculated as the average of smallest 10% d ( x, D ¬ c ) for x ∈ D c .
Note that we choose (cid:96) 2 distance for inter-class distance, instead of using the (cid:96) ∞ which measures the robustness.
This is because (cid:96) ∞ -distance between data examples is essentially max over the per pixel differences, which is always very close to 1.
Therefore the (cid:96) ∞ -distance between data examples is not really representative / distinguishable.
Figure 5 shows the inter-class distances (averaged over all classes) calculated on MNIST and CIFAR10 variants.
The binarized MNIST has a signiﬁcantly larger inter-class distance.
As smoothing kernel size increases, the distance also decrease slightly.
On CIFAR10 variants, as the saturation level gets higher, the inter-class distance increases monotonically.
We also directly plot inter-class distance vs robust accuracy on MNIST and CIFAR10 variants.
In general, inter-class distance shows strong positive correlation with robust accuracy under these transformations.
With one exception that original MNIST has smaller inter-class distance, but is sightly more robust than smooth-2 MNIST.
This, together with the counter examples we gave in Table 1, suggests that interclass distance cannot fully explain the robust variation across different dataset variants.
D.2. I NTER -C LASS D ISTANCE C OULD P OTENTIALLY I NFLUENCE R EQUIRED M ODEL C APACITY
We attempt to understand the relation between the inter-class distance of a dataset and its achievable robustness in this section.
We ﬁrst illustrate our intuition in a synthetic experiment, where a ReLU network is trained to perfectly separate 2 concentric spheres (Gilmer et al., 2018), as shown in Figure 6.
Here the inter-class distance is the width of the ring between two spheres.
In such example, adversarial training is actually closely related to the inter-class distance of the data.
In fact, in the simple setting where the classiﬁer is linear, it has been shown in Xu et al.
(2009) that adversarial training, as a particular form of robust optimization, is equivalent to maximizing the classiﬁcation margins.
Following this intuition, one can easily see that the effect of adversarial training is to push two spheres close to each other, and requires the network to perfectly separate the new spheres with much smaller inter-class.
[Figure]
Intuitively, when the inter-class distance is large, i.e. the gap between two spheres are large, reasonable model should be able to achieve good standard accuracy.
We have also observed such phenomenon on original MNIST and saturated CIFAR (say level 16).
As the inter-class gets smaller, although the model capacity could still be enough for the standard training, it may no longer be enough for adversarial training, upon which we would observe that although the test accuracies stay similar, accuracies under adversarial attack signiﬁcantly would drop.
We have also seen similar behavior on smooth MNIST data and smaller level of saturated CIFAR data.
Finally, when the inter-class distance is so small such that even a high clean test accuracy may be difﬁcult to achieve.
Considering robust accuracy as the clean accuracy with smaller gap between the spheres, the next theorem provides a theoretical guarantee in relating together the difﬁculty of attaining good accuracy under attack and the model capacity (Ball, 1997), verifying our intuition above.
Note that one way to measure the capacity of a ReLU network is by counting the number of its induced piece-wise linear region, which is closely related to the number of facets of its decision boundary.
Theorem D.1.
Let d ( K, L ) between symmetric convex bodies K and L denote the least positive d for which there is a linear image ˜
L of L such that ˜ L ⊂ K ⊂ d ˜ L .
Let K be a (symmetric) polytope in R n with d ( K, B n 2 ) =
d .
Then K has at least e n/ (2 d 2 ) facets.
On the other hand, for each n , there is a polytope with 4 n facets whose distance from the ball is at most 2.
The above analysis is partially supported by our experiments on model capacity in Section 5.3.
However, as we’ve shown in Section 5.2, the nature of the problem is complex and more conclusive statements requires further research.