B RIDGING ADVERSARIAL SAMPLES AND ADVERSARIAL NETWORKS
Anonymous authors
Paper under double-blind review
A BSTRACT
Generative adversarial networks have achieved remarkable performance on various tasks but suffer from sensitivity to hyper-parameters, training instability, and mode collapse.
We ﬁnd that this is partly due to gradient given by non-robust discriminator containing uninformative adversarial noise, which can hinder generator from catching the pattern of real samples.
Inspired by defense against adversarial samples, we introduce adversarial training of discriminator on real samples that does not exist in classic GANs framework to make adversarial training symmetric, which can balance min-max game and make discriminator more robust.
Robust discriminator can give more informative gradient with less adversarial noise, which can stabilize training and accelerate convergence.
We validate the proposed method on image generation tasks with varied network architectures quantitatively.
Experiments show that FID score of generated samples is improved by 10% − 50% relative to the baseline with additional 25% computation cost.
Training stability is improved and mode collapse is alleviated.
I NTRODUCTION
Generative adversarial networks (GANs) have been applied successfully in various research ﬁelds such as natural image modeling (Radford et al., 2015), image translation (Isola et al., 2016; Zhu et al., 2017), cross-modal image generation (Dash et al., 2017), image super-resolution (Ledig et al., 2016), semi-supervised learning (Odena, 2016) and sequential data modeling (Mogren, 2016; Yu et al., 2016).
Different from explicit density estimation based models (Kingma et al., 2014; Oord et al., 2016; Hinton, 2012), GANs are implicit generative models with two neural networks playing min-max game to ﬁnd a map from random noise to target distribution, in which the generator tries to generate fake samples to fool discriminator and the discriminator tries to distinguish them from real samples (Goodfellow et al., 2014).
In original GANs formula, optimal discriminator measures the
Jensen-Shannon divergence between real data distribution and generated distribution.
The discrepancy measure can be generalized to f-divergence (Nowozin et al., 2016) or replaced by earth-mover distance (Arjovsky et al., 2017).
Despite the success, GANs are notoriously difﬁcult to train(Kodali et al., 2018; Arjovsky & Bottou, 2017), which are very sensitive to hyper-parameters.
When the support of these two distributions are approximately disjoint, gradient given by discriminator with standard objective may vanish, and training becomes unstable (Arjovsky et al., 2017).
More seriously, generated distribution can fail to cover the whole data distribution and collapse to a single mode in some cases (Dumoulin et al., 2017; Che et al., 2016).
The condition of discriminator determines the training stability and performance to a great extent.
On the one hand, representation capacity of discriminator realized by a neural network is not inﬁnite.
Meanwhile, the discriminator is usually not optimal to measure true discrepancy when trained in an alternative manner practically.
On the other hand, discriminator as a classiﬁer is also vulnerable to adversarial samples (Appendix D): benign samples added by imperceptible perturbation can mislead classiﬁer to give wrong prediction (Szegedy et al., 2014)(Goodfellow et al., 2015).
Adversarial samples can be easily crafted by gradient-based method such as Fast Gradient Sign Method (FGSM)
(Goodfellow et al., 2015) or Basic Iterative Method (BIM) (Kurakin et al., 2017).
It should be noted that the gradient given by discriminator that guides update of the generator is exactly the same as gradient used to craft adversarial samples of the discriminator .
In other words, the gradient contains uninformative adversarial noise which is imperceptible but can mislead the generator.
However, generator can still generate meaningful samples in classic GANs training procedure.
This is because discriminator is adversarially trained with diverse generated fake samples.
Nevertheless, adversarial training on real samples does not exist in classic training framework.
As a consequence, training will become unstable when generated distribution approximates target distribution because the gradient given by non-robust discriminator around real samples contains more adversarial noise.
To this end, we introduce adversarial training on real samples into classic GANs training framework to further improve the robustness of discriminator, which can reduce adversarial noise contained in gradient.
It can be proved by results shown in Figure 1 empirically that the noise in gradient of adversarially trained discriminator is partly eliminated.
Meanwhile, our proposed method can regularize the capability discriminator by performing adversarial training both on real samples and fake samples to alleviate training collapse.
We validate the proposed method on image generation tasks with widely adopted DCGAN (Radford et al., 2015) and ResNet (He et al., 2015; Gulrajani et al., 2017) architecture, which shows consistent improvement of training stability and acceleration of convergence.
To our best knowledge, this is the ﬁrst work to consider GANs from the perspective of adversarial samples, besides which we make GANs training scheme symmetric and improve performance efﬁciently with acceptable computation cost.
We term the proposed method as adversarial symmetric GAN (AS-GAN).
R ELATED W ORK
There is a large body of work on how to stabilize GANs training and alleviate mode collapse.
(Arjovsky & Bottou, 2017) proved that the widely adopted non-saturating loss function for the generator can be decomposed into Kullback–Leibler divergence minus two Jensen-Shannon divergence when discriminator trained to be optimal, which accounts for training instability and mode dropping during GANs training.
(Metz et al., 2016) proposed to unroll the optimization of discriminator as surrogate objective to guide update of the generator, which shows improvement of training stability with relatively large computation overhead.
(Kodali et al., 2018) claimed that the existence of undesirable local equilibria is responsible for mode collapse and proposed to regularize the discriminator around real data samples with gradient penalty.
Integral probability metric (IPM) based GANs such as Wasserstein GAN (Arjovsky et al., 2017) and its variants (Gulrajani et al., 2017; Wu et al., 2018) can solve gradient vanishing in GANs training theoretically but it is not simple to make discriminator 1-Lipschitz required by the duality conversion practically.
Wasserstein GAN (Arjovsky et al., 2017) suggests earth-mover (EM) distance as a measure of discrepancy between two distributions and adopts weight clip to make the discriminator 1-Lipschitz constrained.
WGAN-GP (Gulrajani et al., 2017) adopts gradient penalty to regularize discriminator in a less rigorous way, but it requires calculation of the second order derivative with remarkable computation overhead.
Spectral normalization on the weight of discriminator proposed by (Miyato et al., 2018) can make discriminator 1-Lipschitz constrained efﬁciently, but capacity of discriminator is signiﬁcantly constrained.
Adversarial vulnerability is an intriguing property of neural network-based classiﬁer (Szegedy et al., 2014).
A well-trained neural network can give totally wrong prediction to adversarial samples that human can recognize accurately.
Small-magnitude adversarial perturbation added to benign data can be easily calculated based on gradient (Goodfellow et al., 2015; Carlini & Wagner, 2017; Dong et al., 2018).
(Goodfellow et al., 2015) proposed to augment training data with adversarial samples to improve the robustness of neural networks, which can smooth the decision boundary of classiﬁer around training samples.
Gradient of adversarially trained classiﬁer contains more semantic information and less adversarial noise (Tsipras et al., 2018;
Kim et al., 2019).
Some work tried to craft or defense against adversarial samples using GANs.
(Xiao et al., 2018) proposed to generate adversarial samples efﬁciently with GANs, in which a generator is used to generate adversarial perturbation for target classiﬁer given original samples.
(Shen et al., 2017) proposed AE-GAN to eliminate adversarial perturbation in an adversarial training manner, which can output images with better perceptual quality.
Different from their motivations, our work aims at improving the robustness of discriminator by introducing adversarial training on real samples, which does not exist in classic GANs training framework.
Similar to our motivation, (Liu & Hsieh) proposed to perform projected gradient attack in supervised GAN training to robustify discriminator.
In addition to that, our work clariﬁes that standard GAN training is approximately equivalent to adversarial training on fake samples.
Moreover, we incorporate the proposed adversarial training scheme into unsupervised GAN and achieve improvement of FID score by a large margin.
[Figure]
proposed AS-GAN.
Standard GAN training is illustrated as the ﬁrst forward pass and the ﬁrst backward pass.
In addition to standard GAN training procedure, we introduce adversarial training of discriminator on real samples, illustrated as the second forward pass and the second backward pass, which is equivalent to train discriminator with robust optimization.
M ETHOD 3. C LASSIC GAN TRAINING FRAMEWORK
In GAN training framework proposed by (Goodfellow et al., 2014), the generator G φ ( z ) parameterized by φ tries to generate fake samples to fool discriminator and the discriminator
D θ ( x ) parameterized by θ tries to distinguish generated samples between real samples.
The formulation using min-max optimization is as follows:
[Equation]
where V ( θ, φ ) is the objective function.
Equation 1 can be formulated as a binary classiﬁcation problem with cross entropy loss:
[Equation]
where P data is real data distribution and noise z obeys standard Gaussian distribution.
When discriminator is trained to be optimal, the training objective for the generator can be reformulated as
Jensen-Shannon divergence, which can measure dissimilarity between two distributions.
In practice, we use mini-batch gradient descent to optimize generator and discriminator alternatively.
At each iteration, update rule can be derived as follows:
[Equation]
where η θ and η φ are the learning rate of discriminator and generator, respectively.
V m ( θ, φ, x, z ) denotes the objective function of mini-batch with m real samples and m fake samples, which is:
[Equation]
After updating parameters of networks, fake samples generated by G φ (cid:48)
( z ) are adjusted as following equation according to chain rule:
[Equation]
where ∂G φ ( z ) ∂φ is a Jacobian matrix.
The updated G φ (cid:48) ( z ) can be seen as adversarial samples of the discriminator at this iteration because η φ is usually small.
These samples will be fed into the discriminator at future iteration to perform adversarial training.
From this point of view, the classic training framework mainly includes adversarial training on fake samples, which is illustrated as the ﬁrst pass in Figure 2.
Nevertheless, adversarial training of discriminator on real samples does not exist in this framework, which makes adversarial training unsymmetric and unbalanced.
Adversarial noise contained in the gradient of non-robust discriminator can make training unstable because of the unsmoothed decision boundary of discriminator around real data.
3. R OUBUST OPTIMIZATION
In order to make discriminator more robust, we propose the following objective for robust optimization of discriminator:
[Equation]
In fact, when training data of real samples is inﬁnite, the above objective is approximately equivalent to the original.
However, in practice, training data is always limited, which partly accounts for the existence of adversarial samples.
With the proposed objective, discriminator is not only required to classify real data correctly but also should not be vulnerable to small perturbation.
This robust optimization training scheme can smooth the decision boundary of discriminator and prevent it from being stuck in a local minimum.
3. A DVERSARIAL TRAINING ON REAL SAMPLES
In this paper, we select adversarial training as implementation to solve the proposed robust optimization problem with L ∞ -norm constraint.
Speciﬁcally, we introduce adversarial training on real data that does not exist in the original framework, which can make adversarial training symmetric and stabilize GAN training.
Practically, we perform adversarial training after Equation 3 at each iteration as the following equation:
[Equation]
where ˆ x is an adversarial sample of discriminator, perturbation of which can be obtained by backward propagation of Equation 5 with respect to x with negligible computation overhead.
The adversarial sample can be calculated with constant ε as follows:
[Equation]
This adversarial training formulation is adopted from (Goodfellow et al., 2015), which calculates
L ∞ -norm constrained perturbation by linearizing objective function.
Adversarial training on real samples of discriminator is illustrated as the second pass in Figure 2, where L D denotes the minus of V m ( θ, φ, x, z ) .
We make adversarial training procedure symmetric by performing adversarial training both on fake samples and real samples.
In this way, discriminator can provide more informative gradient with less adversarial noise, which can stabilize training and accelerate convergence.
Please refer to Algorithm 1 for more details about symmetric adversarial training.
3. E FFECTIVE MAGNITUDE OF PERTURBATION
It is crucial to set an appropriate magnitude of perturbation to make adversarial training effective.
When perturbation set to zero, the proposed method degrades to updating discriminator twice on the same real data.
When perturbation set to a too large value, real data will be drastically perturbed.
Semantic information and quality will be changed, which can mislead discriminator to recognize degraded samples as real data incorrectly.
In a sense, adversarial training on real samples regularizes discriminator by augmenting training data, which prevents discriminator from being too strong to alleviate training collapse.
The capability of two networks become more balanced with adversarial training both on real samples and fake samples.
Noteworthily, the network capacity of discriminator should be larger or at least equivalent to that of generator because discriminator is further constrained with additional adversarial training.
In addition, we suggest to set pertubation to zero in the begining of training in case discriminator is too weak.
We do extensive experiments on how perturbation affects training in the next section.
E XPERIMENTS
For the purpose of evaluating our method and investigating the reason behind its efﬁcacy, we test our adversarial training method on image generation tasks on CIFAR-10, CelebA and LSUN with
DCGAN and ResNet architecture.
CIFAR-10 is a well-studied dataset of 32 x 32 natural images, containing 10 categories of objects and CelebA is a large-scale face attributes dataset with more than 200k images.
In addition, We validate the proposed method on 3000k images labeled as bedroom in
LSUN .
For fast validation, We resize images in CelebA and LSUN to 64 x 64.
The effectiveness of the proposed method can be proved empirically by results on these distinct datasets with two widely adopted architectures.
In section 4.1, we ﬁrst conduct hyper-parameter experiments on the magnitude of perturbation for unsupervised generation task on CIFAR-10.
In order to study transferability on different network structure, we conduct some extensive experiments with multiple architectures and settings in section 4.2, which also demonstrate the advantages of our method that can stabilize training and accelerate convergence in section 4.3.
Lastly, we compare our adversarial symmetric training method with some latest state-of-the-art GAN variants.
With the same experimental settings of some classic models, our method can produce diverse images with better ﬁdelity.
In this paper, we use standard GAN objective function as the adversarial loss.
In order to alleviate gradient vanishing at the beginning of training, we adopt non-saturating loss suggested by (Goodfellow et al., 2014).
Furthermore, we use Fr´echet inception distance (FID)(Heusel et al., 2017) and inception score (Salimans et al., 2016) to measure model performance, both of which are wellstudied metric of image quality.
Please refer to Appendix F for more details about implementation.
Our source code will be released on Github.
4. E VALUATION WITH DIFFERENT HYPER - PARAMETERS
In order to ﬁnd an appropriate magnitude of adversarial perturbation, we do unsupervised image generation experiments on CIFAR-10 with DCGAN architecture at different settings of perturbation.
Due to the large searching space, we select several typical values for experiments such as { 0,1,2,3,4 } /255.
Furthermore, we do ablation study by replacing gradient used to craft perturbation by Gaussian noise.
All experiments are run three times independently to reduce randomness.
Figure 3 shows the FID results in the different hyper-parameter setting, Our method performs far better than baseline when ε lies in interval 0 .
5 / 255 ∼ 3 / 255 .
However, no matter the perturbation amplitude is too small ( ε = 0 .
2 / 255 ) or a little large ( ε = 4 / 255 ), the method improves original model slightly.
In addition, when the imposed perturbation is too strong, the model performs even worse than the baseline.
This is because samples perturbed drastically can mislead discriminator to recognize degraded samples as real data incorrectly, which hinders discriminator from catching true characteristic of real data distribution.
With appropriate perturbation, discriminator can be regularized to balance training, which can alleviate the bothersome collapse of training loss and generate samples in standard GAN.
Only when the attacking intensity is suitable, discriminator will become more robust owning to adversarial training, facilitating itself to produce more accurate and informative gradient to generator, which can promote the capability of generator tremendously.
In this way, generator obtains more meaningful and reliable update information, accounting for generating better samples.
Still and all, too much perturbation is harmful to discriminator when exceeding its endurance, leading discriminator to the ground defeated by generator, which is not a favorable scene.
Similarly, when the imposed perturbation is too tiny, on which condition the adversarial sample of real data is almost close to the benign, the effect of adversarial training is limited.
In particular, when ε is zero, the model degrades into regular GAN algorithm, the only change of which is updating discriminator twice on same real data.
This setting is only slightly better than the baseline but far worse than the version with appropriate ε .
Overall, results show that discriminator adversarially trained with appropriate perturbation can stabilize training and improve performance of generator.
[Figure]
Best FID results under different settings of three independent runs (Lower is better).
(b) Mean FID of last 20 epoch.
With appropriate perturbation and adversarial updating policy, the quality of generated samples can go beyond baseline by a large margin.
Besides, the annotation ‘Gaussian’ in Figure 3 means that the gradient used to craft adversarial samples is replaced by Gaussian noise, whose poor performance proves that perturbation direction of gradient is important for effectiveness.
In the following sections, we use ε = 1 / 255 as default option for simplicity.
4. E VALUATION WITH DIFFERENT ARCHITECTURES
To explore the transferability and compatibility of the proposed method, we test with widely adopted
DCGAN and ResNet architecture on CIFAR-10 and CelebA. Figure 4 plots the comparison results.
Additionally, two groups of contrast experiments with different setttings are performed (see Appendix E).
We ﬁnd that our method can largely accelerate convergence and improve the ﬁdelity of generated samples.
By applying our method, stability can also be improved vastly (Appendix A.1).
Even with the setting in which baseline GAN collapse thoroughly, our model can still converge toward optimization objective.
Generally, GANs collapse when discriminator is too strong or too weak; the former situation is more common during training.
WGAN and a series of its variants solve the problem theoretically by using
Wasserstein distance to measure the discrepancy between two distributions with constraining the discriminator.
Different from their approach, we address training instability in a practical point of view that discriminator as a classiﬁer is not ideal and robust.
Adversarial training on real samples is introduced into classiﬁc GAN to make discriminator more robust.
Experimental results prove our method is effective with marginal computation cost and can be applied to different network architectures on different datasets.
[Figure]
4. I MPROVED PERFORMANCE
We perform image generation experiments to verify the effectiveness of our method.
As shown in
Table 2, through unsupervised training on CIFAR-10, CelebA and bedroom in LSUN, our model can achieve comparable performance to state of the art on FID and inception score (Higher is better).
It should be noted that the four rows at the bottom show the results of our implementation.
We further validate on ImageNet (Russakovsky et al., 2015) resized to 64 x 64 with unsupervised AS-DCGAN and achieve a FID of 60.65 relative to 65.78 of baseline.
Generated samples are shown in Appendix
C.1.
4. A NALYSIS
To show how our method works, we perform some analytical experiments on CIFAR-10.
Notice that in our algorithm, the only signiﬁcant change for vanilla GAN is adversarial training on real samples during the two-players game.
Gradient given by discriminator is the key to update generator.
Hence, we visualize the gradient as Figure 1, which shows that the gradient of adversarially trained discriminator contains more semantic information, eg, proﬁles of face, but the gradient of standard discriminator looks like uninformative noise.
We further show the histogram of the gradient of discriminator with respect to real samples as Figure 5a.
Our method can obtain more sparse gradient
[Table]
and lower L1 norm (Figure 5b) as training iteration increases, which means adversarial noise in gradient is partly eliminated.
What’s more, the proposed method can augment training data and smooth the decision boundary of discriminator, which can alleviate mode collapse to a large extent shown as Appendix C.2.
By means of adversarial training evenly on both real and fake samples, we make the training scheme symmetric and stable.
[Figure]
The computation overhead of the proposed method is about 25% relative to the baseline, which is comparable to that of spectral normalization and much smaller than that of gradient penalty.
Comparison of average training time of one epoch of different methods is shown as Table 4.4.
[Table]
C ONCLUSION
The relationship between GANs and adversarial samples has been a open question since both models emerged.
In this paper, we analyze that adversarial training on fake samples is already taken into account in standard GAN training framework but adversarial training on real samples does not exist, which can make training unbalanced and unstable.
This is because gradient given by nonrobust discriminator contains more adversarial noise, which can mislead update of the generator.
In order to make training scheme symmetric and discriminator robust, we introduce adversarial training on real samples.
We validate the proposed method on image generation tasks on CIFAR10, CelebA and bedroom in LSUN with varied network architectures.
Experiments show that the gradient of discriminator adversarially trained both on real and fake samples contains less adversarial noise.
Convergence speed and performance are improved with marginal computation overhead.
Moreover, mode collapse is alleviated.
With simple DCGAN network architecture and standard objective function, we can achieve comparable FID to state of the art on these datasets
A A NALYSIS A. T RAINING STABILITY
We further demonstrate the superiority of our algorithm over traditional GAN methods about training stability.
During training on CIFAR-10, we plot the prediction conﬁdence of discriminator about real data and adversarial samples of real data.
The detailed conﬁdence and loss value of discriminator with the training process are depicted as Figure 6.
It clearly exhibits that the discriminator of traditional DCGAN has very unstable output conﬁdence and loss curve during training.
With our method, both of the variables D θ ( x ) and errD become more smooth and stable.
Moreover, when adversarial perturbation ε is appropriate for training, the conﬁdence about adversarial samples D θ (ˆ x ) will be basically lower than D θ ( x ) by a large margin.
Because in the beginning, the discriminator is non-robust and sensitive to adversarial samples.
With more iterations, discriminator will become robust to adversarial samples, thus D θ (ˆ x ) converges to be higher than before, but still inferior to D θ ( x ) due to non-eliminated perturbation.
As shown in Appendix D, discriminator with adversarial training is more robust than standard discriminator.
Similarly, the loss is also stabilized with our algorithm (Figure 6b), leading to a more easy-training, less-sensitive to hyper-parameters and high-performance model.
[Figure]
A. A BLATION STUDY
In addition
[Figure]
we visualize the convergence process through evaluation by inception score and FID.
As described in Figure
[Figure]
when updating discriminator on real samples twice ( ε = 0 ) or giving the perturbation of a random direction (‘Gaussian’), the models achieve similar performance to baseline.
Only with the appropriate setting of perturbation and symmetric training scheme, desirable results can be realized.
[Figure]
B A LGORITHM OF AS-GAN
1: for number of training iterations do 2:
Sample mini-batch of m noise samples { z i , ..., z m } from Gaussian distribution N (0 , I ) .
Sample mini-batch of m data samples { x i , ..., x m } from real data distribution P data .
Update the discriminator by gradient ascent, this step can be regarded as adversarial training of discriminator on fake samples:
[Equation]
Craft adversarial samples of real samples for discriminator based on gradient :
[Equation]
Perform adversarial training of discriminator on real samples :
[Equation]
Update generator by gradient descent, this step can be regarded as crafting adversarial samples of fake data:
[Equation]
z
[Equation]
(14) 8: end for
C R ESULTS PRESENTATION C. G ENERATED SAMPLES
[Figure]
[Figure] [Figure]
C. A LLEVIATED MODE COLLAPSE
[Figure] [Figure]
D A DVERSARIAL SAMPLES OF DISCRIMINATOR
E C OMPARISON IN DIFFERENT SETTINGS
[Table]
Here, ‘standard’ means using same setting with Appendix F. From table 3 and table 4, under different conditions, our model is always better than baseline.
[Table]
F I MPLEMENTATION AND TRAINING DETAILS
Our models are implemented by Pytorch with acceleration of RTX 2080ti GPUs, only when evaluating inception score we use Tensorﬂow.
Before fed into discriminator, we rescale images within [ − 1 , 1] .
Dimension of the latent vector is set to 100 for all implementations.
We train models on
CelebA for 100 epoch, CIFAR-10 for 200 epoch, LSUN for 10 epoch and Imagenet for 10 epoch.
FID and inception score are computed from 22400 generated samples, and inception score is calculated by 10 independent partitions.
In ResNet architecture, the residual block is organized as BatchNorm-ReLU-Resample-ConvBatchNorm-ReLU-Conv with skip connection.
We use bilinear interpolation for upsampling and average pooling for downsampling.
Batch normalization (Ioffe & Szegedy, 2015) is used both for generator and discriminator.
Parameters of network are initialized by Xavier method.
We train networks with Adam optimizer with learning rate 2e-4.
β 1 is set to 0.5 and β 2 is set to 0.999.
In DCGAN architecture, the basic block is organized as Conv-BatchNorm-LeakyReLU for discriminator or ConvTransposed-BatchNorm-ReLU for generator.
The weights of convolution are initialized by normal disitribution with zero mean and 0.02 standard deviation.
We do not use bias in convolution.
We train DCGAN with Adam optimizer with learning rate 2e-4.
β 1 is set to 0.5 and βis set to 0.999.
Because training standard GAN on CelebA is unstable, we decrease learning rate of discriminator to 5e-5 to balance training as TTUR training strategy (Heusel et al., 2017).
[Table]
Residual
[Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]