A U NIFIED W ASSERSTEIN D ISTRIBUTIONAL R OBUSTNESS F RAMEWORK FOR A DVERSARIAL T RAINING
A BSTRACT
It is well-known that deep neural networks (DNNs) are susceptible to adversarial attacks, exposing a severe fragility of deep learning systems.
As the result, adversarial training (AT) method, by incorporating adversarial examples during training, represents a natural and effective approach to strengthen the robustness of a DNN-based classiﬁer.
However, most AT-based methods, notably PGD-AT and TRADES, typically seek a pointwise adversary that generates the worst-case adversarial example by independently perturbing each data sample, as a way to “probe” the vulnerability of the classiﬁer.
Arguably, there are unexplored beneﬁts in considering such adversarial effects from an entire distribution.
To this end, this paper presents a uniﬁed framework that connects Wasserstein distributional robustness with current state-of-the-art AT methods.
We introduce a new Wasserstein cost function and a new series of risk functions, with which we show that standard AT methods are special cases of their counterparts in our framework.
This connection leads to an intuitive relaxation and generalization of existing AT methods and facilitates the development of a new family of distributional robustness AT-based algorithms.
Extensive experiments show that our distributional robustness AT algorithms robustify further their standard AT counterparts in various settings.
I NTRODUCTION
Despite remarkable performances of DNN-based deep learning methods, even the state-of-the-art (SOTA) models are reported to be vulnerable to adversarial attacks (Biggio et al., 2013; Szegedy et al., 2014;
Goodfellow et al., 2015; Madry et al., 2018;
Athalye et al., 2018; Zhao et al., 2019b; 2021a), which is of signiﬁcant concern given the large number of applications of deep learning in real-world scenarios.
Usually, adversarial attacks are generated by adding small perturbations to benign data but to change the predictions of the target model.
To enhance the robustness of DNNs, various adversarial defense methods have been developed, recently Pang et al.
Dong et al.
(2020); Zhang et al. (2020b); Bai et al.
Among a number of adversarial defenses, Adversarial Training (AT) is one of the most effective and widely-used approaches (Goodfellow et al., 2015; Madry et al., 2018; Shafahi et al., 2019; Tramèr & Boneh, 2019; Zhang & Wang, 2019; Xie et al., 2020).
In general, given a classiﬁer, AT can be viewed as a robust optimization process (Ben-Tal et al., 2009) of seeking a pointwise adversary (Staib & Jegelka, 2017) that generates the worst-case adversarial example by independently perturbing each data sample.
Different from AT, Distributional Robustness (DR) (Delage & Ye, 2010; Duchi et al., 2021; Gao et al., 2017; Gao & Kleywegt, 2016; Rahimian & Mehrotra, 2019) looks for a worst-case distribution that generates adversarial examples from a known uncertainty set of distributions located in the ball centered around the data distribution.
To measure the distance between distributions, different kinds of metrics have been considered in DR, such as f -divergence (Ben-Tal et al., 2013; Miyato et al., 2015; Namkoong & Duchi, 2016) and Wasserstein distance (Shaﬁeezadeh-Abadeh et al., 2015;
Blanchet et al., 2019; Kuhn et al., 2019), where the latter has shown advantages over others on efﬁciency and simplicity (Staib & Jegelka, 2017; Sinha et al., 2018).
Therefore, adversary in DR does not look for the perturbation of a speciﬁc data sample, but moves the entire distribution around the data distribution, thus, is expected to have better generalization than AT on unseen data samples (Staib & Jegelka, 2017; Sinha et al., 2018).
Conceptually and theoretically, DR can be viewed as a generalization and better alternative to AT and several attempts (Staib & Jegelka, 2017; Sinha et al., 2018) have shed light on connecting AT with DR.
However, to the best of our knowledge, practical DR approaches that achieve comparable peformance with SOTA AT methods on adversarial robustness have not been developed yet.
To bridge this gap, we propose a uniﬁed framework that connects distributional robustness with various SOTA AT methods.
Built on top of Wasserstein Distributional Robustness (WDR), we introduce a new cost function of the Wasserstein distances and propose a uniﬁed formulation of the risk function in WDR, with which, we can generalize and encompass SOTA AT methods in the DR setting, including PGD-AT (Madry et al., 2018), TRADES (Zhang et al., 2019), MART (Wang et al., 2019) and AWP (Wu et al., 2020).
With better generalization capacity of distributional robustness, the resulted AT methods in our DR framework are shown to be able to achieve better adversarial robustness than their standard AT counterparts.
The contributions of this paper are in both theoretical and practical aspects, summarized as follows: 1) Theoretically, we propose a general framework that bridges distributional robustness and standard robustness achieved by AT.
The proposed framework encompasses the DR versions of the SOTA AT methods and we prove that these AT methods are special cases of their DR counterparts.
2) Practically, motivated by our theoretical study, we develop a novel family of algorithms that generalize the AT methods in the standard robustness setting, which have better generalization capacity.
3) Empirically, we conduct extensive experiments on benchmark datasets, which show that the proposed AT methods in the distributional robustness setting achieve better performance than standard AT methods.
P RELIMINARIES 2. D ISTRIBUTIONAL R OBUSTNESS
Distributional Robustness (DR) is an emerging framework for learning and decision-making under uncertainty, which seeks the worst-case expected loss among a ball of distributions, containing all distributions that are close to the empirical distribution (Gao et al., 2017).
Wasserstein DR has been one of the most widely-used variant of DR, which has rich applications in (semi)-supervised learning (Blanchet & Kang, 2020; Chen & Paschalidis, 2018;
Yang, 2020), generative modeling (Huynh et al., 2021; Dam et al., 2019), transfer learning and domain adaptation (Lee & Raginsky, 2018; Duchi et al., 2019; Zhao et al., 2019a; Nguyen et al., 2021a;b; Le et al., 2021b;a), topic modeling (Zhao et al., 2021b), and reinforcement learning (Abdullah et al., 2019; Smirnova et al., 2019; Derman & Mannor, 2020).
For more comprehensive review, please refer to the surveys of Kuhn et al.
; Rahimian & Mehrotra (2019).
Here we consider a generic Polish space S endowed with a distribution P .
Let f : S
→ R be a real-valued (risk) function and c : S × S → R + be a cost function.
Distributional robustness setting aims to ﬁnd the distribution Q in the vicinity of P and maximizes the risk in the E form (Sinha et al., 2018; Blanchet & Murthy, 2019):
[Equation]
where (cid:15) > 0 and W c denotes the optimal transport (OT) cost, or a Wasserstein distance if c is a metric, deﬁned as:
[Equation]
where Γ ( P , Q ) is the set of couplings whose marginals are P and Q .
With the assumption that f ∈ L 1 ( P ) is upper semi-continuous and the cost c is a non-negative lower semi-continuous satisfying c ( z, z (cid:48) )
= {+
+}
iff z
=
z (cid:48) , Sinha et al.
; Blanchet & Murthy (2019) show that the dual form for Eq.
(1) is:
[Equation]
Sinha et al.
(2018) further employs a Lagrangian for Wasserstein-based uncertainty sets to arrive at a relaxed version with λ ≥ 0 :
[Equation]
2. A DVERSARIAL R OBUSTNESS WITH A DVERSARIAL T RAINING
In this paper, we are interested in image classiﬁcation tasks and focus on the adversaries that add small perturbations to the pixels of an image to generate attacks based on gradients, which are the most popular and effective.
FGSM (Goodfellow et al., 2015) and PGD (Madry et al., 2018) are the most representative gradient-based attacks and PGD is the most widely-used one, due to its effectiveness and simplicity.
Now we consider a classiﬁcation problem on the space S =
X × Y where X is the data space, Y is the label space.
We would like to learn a classiﬁer that predicts the label of a datum
well h θ : X → Y .
Learning of the classiﬁer can be done by minimising its loss: (cid:96) ( h θ ( x ) , y ) , which can typically be the the cross-entropy loss.
In addition to predicting well on benign data, an adversarial defense aims to make the classiﬁer robust against adversarial examples.
As the most successful approach, adversarial training is a straightforward method that creates and then incorporates adversarial examples into the training process.
With this general idea, different AT methods vary in the way of picking which adversarial examples one should train on.
Here we list three widely-used AT methods.
PGD-AT (Madry et al., 2018) seeks the most violating examples to improve model robustness:
[Equation]
where B (cid:15) ( x ) = { x (cid:48) :
c X ( x, x (cid:48) ) ≤ (cid:15) } , β > 0 is the trade-off parameter and cross-entropy loss CE.
TRADES (Zhang et al., 2019) seeks the most divergent examples to improve model robustness:
[Equation]
where x (cid:48) ∈ B (cid:15) ( x ) and D KL is the usual Kullback-Leibler (KL) divergence.
MART (Wang et al., 2019) takes into account prediction conﬁdence:
[Equation]
where BCE ( h θ ( x ) , y ) is deﬁned as: − log (cid:16)
[ h θ ( x )] y (cid:17) − log (1 − max k (cid:54) =
y [ h
[Equation]
( x )] k ) .
2. C ONNECTING D ISTRIBUTIONAL R OBUSTNESS TO A DVERSARIAL T RAINING
To bridge distributional and adversarial robustness, Sinha et al.
(2018) proposes an AT method, named Wasserstein Risk Minimization (WRM), which generalizes PGD-AT through the principled lens of distributionally robust optimization.
For smooth loss functions, WRM enjoys convergence guarantees similar to non-robust approaches while certifying performance even for the worst-case population loss.
Speciﬁcally, assume that P is a joint distribution that generates a pair z
= ( x, y ) where x ∈ X and y ∈ Y .
The cost function is deﬁned as: c ( z, z (cid:48) )
=
c X ( x, x (cid:48) )
+ ∞ × 1 { y (cid:54) =
y (cid:48) } where z (cid:48)
=
( x (cid:48) , y (cid:48) ) , c X : X × X
→ R + is a cost function on X , and 1 {·} is the indicator function.
One can deﬁne the risk function f as the loss of the classiﬁer, i.e., f ( z ) :
= (cid:96) ( h θ ( x ) , y ) .
Together with Eq.
(1), attaining a robust classiﬁer is to solve the following min-max problem:
[Equation]
The above equation shows the generalisation of WRM to PGD-AT.
With Eq.
(3) and Eq.
(4), one can arrive at Eq.
(9) as below where λ ≥ 0 is a trade-off parameter:
[Equation]
P ROPOSED U NIFIED D ISTRIBUTION R OBUSTNESS F RAMEWORK
Although WRM (Sinha et al., 2018) sheds light on connecting distributional robustness with adversarial training, its framework and formulation is limited to PGD-AT, which cannot encompass more advanced AT methods including TRADES and MART.
In this paper, we propose a uniﬁed formulation for distributional robustness, which is a more general framework connecting state-of-the-art AT and existing distributional robustness approaches where they become special cases.
Let P d be the data distribution that generates instance x ∼ P d and P l. | x the conditional to generate label y ∼ P l. | x given x where x ∈ X , y ∈ Y .
For our purpose, we consider the space S =
X ×X ×Y and a joint distribution P (cid:52) on S consisting of samples ( x, x, y ) where x ∼ P d and y ∼ P l. | x .
Now consider a distribution Q on S such that W c ( Q , P (cid:52) ) <
(cid:15) .
A draw z ∼ P (cid:52) will take the form z
=
( x, x, y ) whereas z (cid:48) ∼ Q will be z (cid:48) =
( x (cid:48) , x (cid:48)(cid:48) , y (cid:48) ) .
We propose cost function c ( z, z (cid:48) ) deﬁned as:
[Equation]
where we note that this cost function is non negative, satisﬁes c ( z, z )
= 0 and lower semi-continuous, i.e., lim
[Equation]
With our new setting, it is useful to understand the “vicinity”of P ∆ via the distribution OT-ball condition W c ( Q , P (cid:52) ) <
(cid:15) .
Since there exists a transport plan γ ∈ Γ ( P (cid:52) , Q ) s.t.
(cid:82) cdγ <
(cid:15) and c ( z, z (cid:48) ) is ﬁnite a.s. γ , this implies that if ( z, z (cid:48) ) ∼ γ , then ﬁrst, it is easy to see that x (cid:48)(cid:48)
= x and y (cid:48)
=
y , and second, x (cid:48) tends to be close to x .
To see why the later is the case, since P d is a marginal of P (cid:52) on the ﬁrst x in ( x, x, y ) , therefore if Q d is the marginal of Q on x (cid:48) in ( x (cid:48) , x (cid:48)(cid:48) , y (cid:48) )
then W d (cid:0) Q d , P d (cid:1) ≤ W d ( Q , P (cid:52) )
< (cid:15) , which explains the closeness between of x and x (cid:48) .
Given z (cid:48) =
( x (cid:48) , x (cid:48)(cid:48) , y (cid:48) ) ∼ Q where W c ( Q , P (cid:52) ) < (cid:15) , we deﬁne a uniﬁed risk function g θ ( z (cid:48) ) w.r.t a classiﬁer h
θ that encompasses the uniﬁed distributional robustness (UDR) version for PGD-AT,
TRADES, and MART (cf Section 2.2):
• UDR-PGD :
g θ
( z (cid:48) ) :
=
CE ( h θ ( x (cid:48)(cid:48) ) , y (cid:48) )
+ βCE
( h θ ( x (cid:48) ) , y (cid:48) ) .
• UDR-TRADES :
g θ
( z (cid:48) ) :
=
CE ( h θ ( x (cid:48)(cid:48) ) , y (cid:48) )
+ βD KL ( h θ ( x (cid:48) )
, h θ ( x (cid:48)(cid:48) )) .
• UDR-MART :
g θ
( z (cid:48) ) :
= BCE (
[Equation]
Now we derive the primal and dual objectives for the proposed UDR framework.
With the UDR risk function g θ ( z (cid:48) ) deﬁned previously, following Eq.
(1) and Eq.
(3), the primal (left) and dual (right) forms of our UDR objective are:
[Equation]
With the cost function c deﬁned in Eq.
(10), the dual form in (11) can be rewritten as:
[Equation]
where we note that P is a distribution over pairs ( x, y ) for which x ∼ P d and y ∼ P l. | x .
The min-max problem in Eq.
(12) encompasses the PGD-AT, TRADES, and MART distributional robustness counterparts on the choice of the function g θ ( x (cid:48) , x, y ) by simply choosing an appropriate g θ ( x (cid:48) , x, y ) as shown in Section 2.3.
In what follows, we prove that standard PGD-AT, TRADES, and MART presented in Section 2 are speciﬁc cases of their UDR counterparts by specifying corresponding cost functions.
Given a cost function c X (e.g., L 1 , L 2 , and L ∞ ), we deﬁne a new cost function ˜ c
X as:
[Equation]
The cost function ˜
c
X is lower semi-continuous.
By deﬁning the ball B (cid:15) ( x ) :=
{ x (cid:48) :
c X ( x, x (cid:48) ) ≤ (cid:15) } = { x (cid:48) :
˜ c
X ( x, x (cid:48) ) ≤ (cid:15) } , we achieve the following theorem on the relation between distributional and standard robustness.
Theorem 1.
With the cost function ˜ c x deﬁned as above, the optimization problem:
[Equation]
is equivalent to the optimization problem:
[Equation]
Proof.
See Appendix A for the proof.
Theoretical contribution and comparison to previous work.
Theorem 1 says that the standard
PGD-AT, TRADES, and MART are special cases of their UDR counterparts, which indicates that our
UDR versions of AT have a richer expressiveness capacity than the standard ones.
Different from
WRM (Sinha et al., 2018) , our proposed framework is developed based on theoretical foundation of (Blanchet & Murthy, 2019).
It is worth noting that the theoretical development is not trivial because theory developed in Blanchet & Murthy (2019) is only valid for a bounded cost function, while the cost function ˜ c is unbounded.
More speciﬁcally, the transformation from primal to dual forms in
Eq.
(11) requires the cost function c to be bounded.
In Theorem 2 in Appendix A, we prove this primal-dual form transformation for the unbounded cost function ˜ c X , which is certainly not trivial.
Moreover, our UDR is fundamentally distinctive from WRM in its ability to adapt and learn λ , while this is a hyper-parameter in WRM.
As a result of a ﬁxed λ , WRM is fundamentally same as PGD in the sense that these methods can only utilize local information of relevant benign examples when crafting adversarial examples.
In contrast, our UDR can leverage both local and global information of multiple benign examples when crafting adversarial examples due to the fact that λ is adaptable and captures the global information when solving the outer minimization in (14).
Further explanation can be found in Appendix B.
L EARNING R OBUST M ODELS WITH UDR
In this section we introduce the details of how to learn robust models with UDR.
To do this, we ﬁrst discuss the induced cost function ˜
c X deﬁned as in Eq (13), which assists us in understanding the connection between distributional and standard robustness approaches.
We note that ˜ c X is nondifferential outside the perturbation ball (i.e., c X ( x (cid:48) , x ) ≥ (cid:15) ).
To circumvent this, we introduce a smoothed version ˆ c X to approximate ˜ c
X as follows:
[Equation]
where τ > 0 is the temperature to control the growing rate of the cost function when x (cid:48) goes out of the perturbation ball.
It is obvious that ˆ c X
( x, x (cid:48) ) is continuous and approaches ˜
c X ( x, x (cid:48) )
when τ → 0 .
Using the smoothed function ˆ c X ( x, x (cid:48) ) from Eq.
(16), the ﬁnal object of our UDR becomes:
[Equation]
With this ﬁnal objective, our training strategy involves three iterative steps at each iteration w.r.t.
a batch of data examples, which are shown in Algorithm 1.
Craft adversarial examples w.r.t.
the current model and the parameter λ .
Given the current model θ
and the parameter λ , we ﬁnd the adversarial examples by solving:
[Equation]
where different methods (i.e., UDR-PGD, UDR-TRADES, etc.) speciﬁes g θ ( x (cid:48) , x, y ) differently.
Similar to other AT methods like PGD-AT, we employ iterative gradient ascent update steps to optimise to ﬁnd x a .
Speciﬁcally, we start from a random example inside the ball B (cid:15) and update in k steps with the step size η > 0 .
Since the magnitude of the gradient ∇ x (cid:48) g θ ( x (cid:48) , x, y ) is signiﬁcantly smaller than that of ∇ x (cid:48)
ˆ c X
( x (cid:48) , x ) , we use sign ( ∇ x (cid:48)
ˆ c X
( x (cid:48) , x )) in the update formula rather than ∇ x (cid:48)
ˆ c X
( x (cid:48) , x ) .
These steps are shown in 2(a) to 2(c) of Algorithm 1.
An important difference from ours to other AT methods is that at each update step, we do not apply any explicit projecting operations onto the ball B (cid:15) .
Indeed, the parameter λ controls how distant x a to its benign counterpart x .
Thus, this can be viewed as implicitly projecting onto a soft ball governed by the magnitude of the parameter λ and the temperature τ .
Specifically, when λ becomes higher, the crafted adversarial examples x a stay closer to their benign counterparts x and vice versa.
When τ is set closer to 0 , the smoothed cost function ˆ c X approximates the cost function ˜
c
X more tightly.
Thus, our soft-ball projection is more identical to the hard ball projection as in projected gradient ascent.
Update the parameter λ .
Given current model θ , we craft a batch of adversarial examples { x ai } Ni =1 corresponding to the benign examples { x i } Ni =1 crafted as above.
Inspired by the Danskin’s theorem , we update λ as follows:
[Equation]
where η λ > 0 is a learning rate and λ n represents the new value of λ .
The proposed update of λ is intuitive: if the adversarial examples stay close to their benign examples, i.e., (cid:80) Ni
=1 ˆ c X
( x ai , x i ) <
(cid:15) , λ decreases to make them more distant to the benign examples and vice versa .
Therefore the adversarial examples are crafted more diversely, which can further strengthen the robustness of the model.
Update the model parameter θ .
Given the set of adversarial examples { x ai } Ni =1 crafted as above and their benign examples { x i } Ni =1 with the labels { y i } Ni =1 , we update the model parameter θ to minimize E P [ ∇ g θ ( x a , x, y )] using the current batches of adversarial and benign examples:
[Equation]
where η θ > 0 is a learning rate and θ n speciﬁes the new model parameter.
E XPERIMENTS
We use MNIST (LeCun et al., 1998), CIFAR10 and CIFAR100 (Krizhevsky et al., 2009) as the benchmark datasets in our experiment.
The inputs were normalized to [0 , 1] .
We apply paddingpixels at all borders before random cropping and random horizontal ﬂips as used in Zhang et al.
We use both standard CNN architecture (Carlini & Wagner, 2017) and ResNet architecture (He et al., 2016) in our experiment.
The architecture and training setting are provided in Appendix D.
We compare our UDR with the SOTA AT methods, i.e., PGD-AT (Madry et al., 2018), TRADES (Zhang et al., 2019) and MART (Wang et al., 2019).
Because TRADES and MART performances are strongly dependent on the trade-off ratio (i.e., β in Eq.
(6) and (7)) between natural loss and robust loss, we use the original setting in their papers (CIFAR10/CIFAR100: β = 6 for
TRADES/UDR-TRADES, β = 5 for MART/UDR-MART; MNIST: β = 1 for all the methods).
We also tried with the distributional robustness method WRM (Sinha et al., 2018).
However, WRM did not seem to obtain reasonable performance in our experiments.
Its results can be found in
Appendix F.
For all the AT methods, we use { k = 40 , (cid:15) = 0 .
3 , η = 0 .
01 } for the MNIST dataset,
[Table] [Table]
MART 49.
UDR-MART 52.
(a) Natural/robust accuracy trade-off (b) Robustness in correlation with τ
{ k = 10 , (cid:15) = 8 / 255 , η = 2 / 255 } for the CIFAR10 dataset and { k = 10 , (cid:15) = 0 .
01 , η = 0 .
001 } for the CIFAR100 dataset, where k is number of iteration, (cid:15) is the distortion bound and η is the step size of the adversaries.
We use different SOTA attacks to evaluate the defense methods including: 1) PGD attack (Madry et al., 2018) which is one of the most widely-used gradient based attacks.
For PGD, we set k =and (cid:15)
= 0 .
3 , η = 0 .
01 for MNIST, (cid:15) = 8 / 255 , η = 2 / 255 for CIFAR10, and (cid:15)
= 0 .
01 , η = 0 .for
CIFAR100, which are the standard settings.
2) B&B attack (Brendel et al., 2019) which is a decision based attack.
Following Tramer et al.
(2020), we initialized with the PGD attack with k =and corresponding { (cid:15), η } then apply B&B attack with 200 steps. 3) Auto-Attack (AA) (Croce &
Hein, 2020b) which is an ensemble methods of four different attacks.
We use (cid:15) = 0 .
01 , for MNIST, CIFAR10, and CIFAR100, respectively.
The distortion metric we use in our experiments is l ∞ for all measures.
We use the full test set for PGD and 1000 test samples for the other attacks.
[Table]
5. M AIN R ESULTS
Whitebox Attacks with ﬁxed (cid:15) .
First, we compare the natural and robust accuracy of the AT methods and their counterparts under our UDR framework, against several SOTA attacks.
Note that in this experiment, the attacks are with their standard settings.
The result of this experiment is shown in Table 1.
It can be observed that for all the AT methods, our UDR versions are able to boost the model robustness signiﬁcantly against all the strong attack methods in comparison on all the three datasets.
These improvements clearly show that our UDR empowered AT methods achieve the SOTA adversarial robustness performance.
Speciﬁcally, our UDR-PGD’s improvement over PGD on both CIFAR10 and CIFAR100 is over 3% against all the attacks.
Similarly, our UDR-MART also improves over MART with a 3% gap on CIFAR100.
Whitebox Attacks with varied (cid:15) .
Recall that UDR is designed to have better generalization capacity than standard adversarial robustness.
In this experiment, we exam the generalization capacity by attacking the AT methods (including our UDR variants) with PGD with varied attack strength (cid:15) while keeping other parameters of PGD attack the same.
This is a highly practical scenario where attackers may use various attack strengths that are different from that the model is trained with.
The results of this experiment are shown in Table 2.
We have the following remarks of the results: 1) All AT methods perform reasonably well (our UDR variants are better than their counterparts) when PGD attacks with the same (cid:15) that these methods are trained on.
This is shown in the ﬁrst column on all the datasets, whose results are in line with these in Table 1. 2) With increased (cid:15) , the performance of all the AT methods deteriorates, which is natural.
However, the advantage of our UDR methods over their counterparts becomes more and more signiﬁcant.
For example, when (cid:15) = 0 .
375 , all of our UDR methods can achieve at least 80% robust accuracy on MNIST, while others can barely defend.
This clearly demonstrates the beneﬁt of our UDR framework on generalization capacity.
[Table]
Blackbox Attacks.
To further exam the generalization of the UDR framework, we conduct the experiment with the blackbox setting via transferred attacks.
Speciﬁcally, we use PGD to generate adversarial examples according to the model trained with a speciﬁc AT method, i.e., the source method.
Next, we use the generated adversarial examples to attack another
AT method, i.e., the target method.
This is to see whether an AT method can defend against attacks generated from other models.
We report the results in Table 3.
It can be seen that with better generalization capacity, our UDR methods also outperform their standard counterparts with a margin of 2% in the blackbox setting.
Results with WideResNet architecture.
We would like to provide further experimental results on the CIFAR10 dataset with WideResNet (WRN-34-10) as shown in Table 4.
It can be seen that our distributional frameworks consistently outperform their standard AT counterparts in both metrics.
More speciﬁcally, our improvement over PGD-AT against Auto-Attack is around 0.8%, while that for TRADES is 0.5%.
To make a more concrete conclusion, we deploy our framework on a recent SOTA standard AT which is AWP-AT Wu et al.
The result shows that our distributional
[Table] [Table]
robustness version (UDR-AWP-AT) also improves its counterpart by 0.5%.
With the same setting (i
[Table]
e., same architecture and without additional data), our UDR-TRADES and UDR-AWP-AT achieve better robustness than recently listed methods on RobustBench (Croce et al., 2020).
3 Remarkably, the additional experiment with C&W (L2) attack shows a signiﬁcant improvement of our distributional methods over standard AT by around 5%.
More discussion can be found in Appendix F.
5. A NALYTICAL R ESULTS
Beneﬁt of the soft-ball projection.
Here we would like to analytically study why our UDR methods are better than standard AT methods, by taking UDR-PGD and PGD-AT as examples.
The visualization on the synthetic dataset can be found in Appendix E. Recall that one of the key differences between UDR-PGD and PGD-AT is that the former uses the soft-ball projection and the later use the hard-ball one, discussed in the second paragraph under Eq.
More speciﬁcally, Table 5 reports the average norm ( L 1 and L ∞ ) of the perturbation δ = | x a − x | p in PGD and our UDR-PGD.
It can be seen that: (i) At the beginning of the training process, there is no difference between the norms of the perturbations generated by PGD and our UDR-PGD.
More speciﬁcally, most of the pixels lie on the edge of the hard-ball projection (i.e., p (0 .
9 (cid:15) ≤ δ ≤ (cid:15) )
= p ( δ ≤ (cid:15) ) − p ( δ ≤ 0 .
9 (cid:15) ) > 80% ).
(ii) When our model converges, there are 77.9% pixels lying slightly beyond the hard-ball projection (i.e., p ( δ > (cid:15) ) ).
It is because our soft-ball projection can be adaptive based on the value of .
This ﬂexibility helps the adversarial examples reach a better local optimum of the prediction loss, therefore, beneﬁts the adversarial training.
Next, we show that doing PGD adversarial training with larger (cid:15) cannot achieve the same defence performance as our methods with the soft-ball projection.
We conduct more experiments with
PGD-AT with (cid:15) = 0 .
034 (the ﬁnal when our model converages) and (cid:15) = 0 .
037 to show that simply extending the hard-ball projection doesn’t beneﬁt adversarial training.
More speciﬁcally, the average robustness improvement with (cid:15) = 0 .
034 is 0.75%, while there is no improvement with (cid:15)
= 0 .
Parameter sensitivity of τ .
Figure 1a and 1b show the our framework’s sensitivity to τ on CIFAR under the PGD attack.
It can be observed that overly small values of τ can hardly improve adversarial robustness while overly big values of τ may hurt the natural performance ( acc nat = 68 .
7% with τ = 1 . 0 ).
Empirically, we ﬁnd that τ
= 2 η performs well in our experiments.
C ONCLUSIONS
In this paper, we have presented a new uniﬁed distributional robustness framework for adversarial training, which uniﬁes and generalizes standard AT approaches with improved adversarial robustness.
By deﬁning a new family of risk functions, our framework facilitates the development of the distributional robustness counterparts of the SOTA AT methods including PGD-AT, TRADES, MART and AWP.
Moreover, we introduce a new cost function, which enables us to bridge the connections between standard AT methods and their distributional robustness counterparts and to show that the former ones can be viewed as the special cases of the later ones.
Extensive experiments on the benchmark datasets including MNIST, CIFAR10, CIFAR100 show that our proposed algorithms are able to boost the model robustness against strong attacks with better generalization capacity.
A CKNOWLEDGEMENT
This work was partially supported by the Australian Defence Science and Technology (DST) Group under the Next Generation Technology Fund (NGTF) scheme.
The authors are grateful to the anonymous (meta) reviewers for their helpful comments
A T HEORETICAL D EVELOPMENT
Theorem 1.
With the cost function ˜ c
X deﬁned as above , the optimization problem:
[Equation]
[Equation]
is equivalent to the optimization problem:
[Equation]
Proof.
We need to prove that
[Equation]
By the deﬁnition of the cost function ˜ c
X
[Equation]
the LHS of (23) can be rewritten as:
[Equation]
Given any λ > 0 and x (cid:48) ∈ B (cid:15) ( x ) , we have λ(cid:15) + g [Equation] x
[Equation]
x, y ) −
[Equation]
x
[Equation]
, x ) = g [Equation] x
[Equation]
x
[Equation] E [Equation] [ g
[Equation]
( x
[Equation]
x, y )] .
Hence, we arrive at
[Equation]
which follows that
[Equation]
We now prove the inequality
[Equation]
Take a sequence { λ n } n ≥ 1 → 0 + .
Given a feasible pair ( x
[Equation]
y )
[Equation]
we deﬁne
[Equation]
It is evident that f n ( x (cid:48) ; x, y ) converges pointwise to g θ ( x (cid:48) , x, y ) over the compact set B (cid:15) ( x ) .
Therefore, f n ( x (cid:48) ; x, y ) converges uniformly to g θ ( x (cid:48) , x, y ) on this set.
This follows that
[Equation]
Hence
[Equation]
we obtain for all x (cid:48) ∈ B (cid:15) ( x ) and n ≥ n 0 :
[Equation]
This leads to the following for all n ≥ n 0 :
[Equation]
Therefore
[Equation]
we obtain:
[Equation]
for all feasible pairs ( x, y ) , which further means that
[Equation]
or equivalently
[Equation]
Because Eq.
(26) holds for every sequence { λ n } n ≥ 1 → 0 + , we reach
[Equation]
By combining (25) and (27)
[Equation]
we reach inf
[Equation]
Finally
[Equation]
we have
[Equation]
That concludes our proof
[Equation]
One of most technical challenge we need to bypass in our work is that in theory developed in Blanchet & Murthy (2019)
[Equation]
to equivalently transform the primal form to the dual form, it requires the cost function to be ﬁnite.
In the following theorem, we reprove the equivalence of the primal and dual forms in our context.
Theorem 2.
Assume that the function g is upper-bounded by a number L .
We have the following equality between the primal form and dual form
[Equation]
, where z = ( x, x, y )
[Equation]
z (cid:48) =
( x (cid:48) , x (cid:48)(cid:48) , y (cid:48) )
[Equation]
and we have deﬁned
[Equation]
for which we have deﬁned
[Equation]
∞ otherwise .
Proof.
Given a positive integer number n >
[Equation]
we deﬁne the following metrics:
[Equation]
n otherwise .
We have ˜ c n X (cid:37) ˜ c
X and c n (cid:37) c .
We now prove that
[Equation]
: W cn ( Q , P
[Equation]
(cid:15)
[Equation]
g
[Equation]
z [Equation]
In fact, for each n , we have c n ≤ c .
Therefore, W c n ( Q , P (cid:52) ) ≤ W c ( Q , P (cid:52) ) , hence { Q : W c ( Q , P (cid:52) ) < (cid:15) } ⊂ { Q : W c n ( Q , P (cid:52) ) < (cid:15) } , implying that
[Equation]
E Q [ g ( z
[Equation] [Equation]
Let us deﬁne
A = ∪ ( x,y ) ∈D { ( z, z (cid:48) ) :
z = ( x, x, y ) , z (cid:48) =
( x (cid:48) , x (cid:48)(cid:48) , y (cid:48) ) , c X ( x, x (cid:48) ) < (cid:15), x (cid:48)(cid:48)
=
x, y (cid:48)
=
y } ,
B = ∪ ( x,y ) ∈D { ( z, z (cid:48) ) :
z = ( x, x, y ) , z (cid:48) = ( x (cid:48) , x (cid:48)(cid:48) [Equation] y (cid:48) )
[Equation] c X ( x [Equation] x (cid:48) ) ≥ (cid:15), x (cid:48)(cid:48)
=
x, y (cid:48)
= y } .
To simplify our proof, without generalization ability, for each n , we denote Q n as the distribution in { Q : W c n ( Q , P (cid:52) ) < (cid:15) } that peaks E Q
[ g θ ( z (cid:48) )] and γ n as the optimal transport plan of W c n ( Q n , P (cid:52) ) which admits P (cid:52) and Q n as its marginals.
Note that because W c n ( Q n , P (cid:52) ) < (cid:15) , the support of γ n almost surely determines on A ∪ B .We then have
[Equation]
Therefore, we obtain: γ n ( B ) < (cid:15)n .
We now deﬁne ¯ γ n as a restricted measure of γ n on A , meaning that ¯ γ n ( C ) = γ n ( A )+ γ n ( B ) γ n ( A ) γ n [Equation] C ) =[-(cid:0) 
-]
[Equation]
1 + o (cid:0) n − 1 (cid:1)(cid:1) γ n ( C ) for any measure set C ⊂ A , where lim n →∞ o (cid:16) n − 1 (cid:17) = 0 .
Let P n as marginal distribution of Q n corresponding to the dimensions of z (cid:48) .
It appears that
[Equation]
Note that we have (1) = because ¯ γ n ( B ) = 0 .
This implies that P n ∈ { Q : W c ( Q , P (cid:52) ) < (cid:15) }
[Equation]
which follows that
[Equation]
Note that we have (1) =
due to ¯ γ n ( B ) =
and (2) ≥ due to γ n ( B ) <
(cid:15)n .
Therefore
[Equation]
we reach the conclusion
[Equation]
( z
[Equation]
[Equation]
n sup
[Equation] [Equation]
Next, we apply primal-dual form in Blanchet & Murthy (2019) for the ﬁnite metric ˜ c n X to reach sup W cn ( Q , P
[Equation]
(cid:21)(cid:27) .
Finally, taking n → ∞ and noting that c n (cid:37) c , we reach the conclusion.
B F URTHER E XPLANATION W HY O UR UDR CAN UTILIZE G LOBAL I NFORMATION AND THE A DVANTAGE OF S OFT - BALL
Algorithm
The pseudocode of our proposed method.
Input : training set D , number of iterations T , batch size N , adversary parameters { k, (cid:15), η } for t = 1 to T do
i. x interi = x ni + η sign ∇ x g θ x ii.
x n +1 i x interi − ηλ ∇ x ˆ x x
clip Update The advantage of our soft ball comes from the adaptive capability of λ , which is controlled by a global effect regarding how far adversarial examples x ai from benign examples x i .
Let us revisit
Algorithm 1.
In the step 2.(b).i, we update
[Equation]
y
[Equation]
)) with the aim to ﬁnd x interi that can maximize g θ ( · , x i , y i ) as in the standard versions.
Furthermore, in the step 2.(b).ii, we update
[Equation]
where we assume L2 cost c ( x, x (cid:48) )
= 12 (cid:107) x − x (cid:48) (cid:107) 2 is used.
It is evident that x n +
i is an interpolation point of x interi and x i , hence x n +
i is drawn back to x
i wherein the drawn-back amount is proportional to ηλ .
We now revisit the formula to update λ as Eq.
[Equation]
which indicates that λ is globally controlled.
More speciﬁcally, if average distance from x a i to x i (i.e., 1 N (cid:80) Ni =
ˆ c X
( x ai , x i ) ) is less than (cid:15) (i.e., adversarial examples are globally close to benign examples), λ is adapted decreasingly.
Linking with the formula in Eq.
(29), in this case, x n +
i gets back to x i less aggressively to maintain the distance between x ai and x i .
Otherwise, adversarial examples are globally far from benign examples, λ is adapted increasingly.
In this case, x n +1 i gets back to x i more aggressively to reduce more the distance between x a i and x i .
C R ELATED W ORK
Adversarial Attacks.
In this paper, we are interested in image classiﬁcation tasks and focus on the adversaries that add small perturbations to the pixels of an image to generate attacks based on gradients, which are the most popular and effective.
FGSM (Goodfellow et al., 2015) and PGD (Madry et al., 2018) are the most representative gradient-based attacks and PGD is the most widelyused one, due to its effectiveness and simplicity.
Recently, there are several variants of PGD that achieve improved performance, for example, Auto-Attack by ensembling PGD with other attacks (Croce & Hein, 2020a) and the B&B method (Brendel et al., 2019) by attacking with decision-based boundary initialized with PGD.
Along with PGD, these attacks have been considered as benchmark attacks for adversarial robustness.
Adversarial defenses.
Among various kinds of defense approaches, Adversarial Training (AT), originating in Goodfellow et al.
(2015), has drawn the most research attention.
Given its effectiveness and efﬁciency, many variants of AT have been proposed with (1) different types of adversarial examples (e.g., the worst-case examples as in Goodfellow et al. (2015) or most divergent examples as in Zhang et al.
, (2) different searching strategies (e.g., non-iterative FGSM and Rand FGSM (Madry et al., 2018)), (3) additional regularizations (e.g., adding constraints in the latent space (Zhang & Wang, 2019; Bui et al., 2020; 2021a; Hoang et al., 2020)), and (4) different model architectures (e.g., activation function (Xie et al., 2020) or ensemble models (Pang et al., 2019; Bui et al., 2021b)).
Distributional robustness.
There have been a few works attempting to connect DR with adversarial machine learning or improve adversarial robustness based on the ideas of DR (Sinha et al., 2018;
Staib & Jegelka, 2017; Miyato et al., 2018; Zhang & Wang, 2019; Najaﬁ et al., 2019; Levine &
Feizi, 2020; Le et al., 2022; Thanh et al., 2022).
A recent work of Dong et al.
(2020) proposes a new AT algorithm by constructing a distribution over each data sample to model the adversarial examples around it, which is still in the category of pointwise adversary (Sinha et al., 2018) and has no relations to DR.
Although its aim of enhancing adversarial robustness is visually related ours, its mythology is different from ours.
Therefore, we consider Sinha et al.
; Staib & Jegelka (2017) as the most relevant ones to ours.
Speciﬁcally, both works leverage the dual form of Wasserstein DR (Blanchet & Murthy, 2019) for searching worst-case perturbations for AT, where Sinha et al.
(2018) (WRM) focuses on certiﬁed robustness with comprehensive study on the tradeoffs between complexity, generality, guarantees, and speed, while Staib & Jegelka (2017) (FDRO) points out that Wasserstein robust optimization can be viewed as the generalization to standard AT.
Although our study is inspired by the two works, there are signiﬁcant differences and new results of ours: 1) We introduce a new Wasserstein cost function and a new series of risk functions in WDR, which facilitate our framework to generalize and encompass many SOTA AT methods.
While WRM can be viewed as the generalization to PGD-AT only. 2) Most importantly, although WDR has been demonstrated to have superior properties over standard AT in the two papers, unfortunately, WRM and FDRO have not been observed to outperform standard AT methods.
For example, the experiments of FDRO show that adversarial robustness on MNIST of WRM and FDRO is worse than that of AT with PGD and iterative-FGSM (Staib & Jegelka, 2017).
Moreover, WRM and FDRO’s effectiveness either on more complex colored images (e.g., CIFAR10) or against more advanced attacks (e.g.,
Auto-Attack) has not been carefully studied yet.
On the contrary, we conduct extensive experiments to show the SOTA performance of our proposed algorithms.
D E XPERIMENTAL S ETTINGS
For MNIST dataset.
We use a standard CNN architecture for the MNIST dataset which is identical with that in Carlini & Wagner (2017).
We use the SGD optimizer with momentum 0.9, starting learning rate 1e-2 and reduce the learning rate ( × 0 . 1 ) at epoch {55, 75, 90}.
We train withepochs.
For CIFAR10 and CIFAR100 dataset with ResNet18 architecture.
We use the ResNet18 for the CIFAR10 and CIFAR100 dataset.
We use the SGD optimizer with momentum 0.9, weight decay 3.5e-3 as in the ofﬁcial implementation from Wang et al.
The starting learning rate 1e-2 and reduce the learning rate ( × 0 . 1 ) at epoch {75, 90, 100}.
We train with 200 epochs.
For hard/soft-ball projection experiments.
For PGD-AT, we use the following three adhoc strategies for (cid:15) : 1) Fixing (cid:15) = 8 / 255 ; 2) Fixing (cid:15)
= 16 / 255 ; 3) Gradually increasing/decreasing (cid:15) from 8 / 255 to 16 / 255 , from epoch 20 to epoch 70, with the changing rate δ = 8 / 255 / 50 per epoch.
For example, the perturbation bound of the increasing strategy at epoch i is: (cid:15) i = min( 16255 , max( 8255 , 8255 +
( i − 20) δ )) ; the perturbation bound for decreasing strategy is: (cid:15)
i = max( 8255 , min( 16255 , 16255 − ( i − 20) δ )) .
For CIFAR10 with WideResNet architecture.
We follow the setting in Pang et al.
(2020) for the additional experiments on CIFAR10 with WideResNet-34-10 architecture.
More speciﬁcally, we train with 200 epochs with SGD optimizer with momentum 0.9, weight decay 5e-4.
The learning rate is 0.1 and reduce at epoch 100th and 150th with rate 0.1 (Rice et al., 2020; Wu et al., 2020).
More importantly, to match the performance as reported in Croce et al.
(2020), we omit the cross-entropy loss of the natural images in PGD-AT and UDR-PGD.
More speciﬁcally, the objective function of PGD-AT in Eq.
(5) has been replaced by: inf θ E P (cid:104)
β
sup x (cid:48) ∈ B (cid:15) ( x ) CE ( h θ ( x (cid:48) ) , y ) (cid:105) while the uniﬁed risk function for UDR-PGD to be:
g θ
( z (cid:48) ) :
= βCE ( h θ ( x (cid:48) ) , y (cid:48) ) .
We also switch Batch
Normalization layer to evaluation stage when crafting adversarial examples as adviced in Pang et al.
E V ISUALIZING THE B ENEFIT OF D ISTRIBUTIONAL R OBUSTNESS
Synthetic dataset setting.
We conduct an experiment on a synthetic dataset with a simple MLP model to visualize the beneﬁt of our UDR framework over the standard AT methods, by taking UDRPGD and PGD-AT as examples.
The synthetic dataset consists of three clusters A, B1, B2 where A,
B are two classes as shown in Figure 2c.
The data points are sampled from normal distributions, i.e.,
A ∼ N (( − 2 , 0) , Σ) , B 1 ∼ N ((2 , 0) , Σ) and B 2 ∼ N ((6 , 0) , Σ) where Σ = 0 .
5 ∗ I with I is the identity matrix.
There are total 10k training samples and 2k testing samples with densities of three clusters are 10%, 50% and 40%, respectively.
We use a simple model of 4 Fully-Connected (FC) layers as follows: Input
[Equation]
, where FC(k) represents for FC with k hidden units.
We use Adam optimizer with learning rate 1eand train with 30 epochs.
We use { k = 20 , (cid:15) = 1 . 0 , η = 0 .
1 } for adversarial training (either PGD-AT or UDR-PGD) and PGD attack with { k = 200 , (cid:15)
= 2 . 0 , η = 0 .
1 } for evaluation.
It is a worth noting that while the distance between clusters is 2, we limit the perturbation (cid:15)
=
1 for the adversarial training to show the advantage on the ﬂexibility of the soft-ball projection on the same/limited perturbation budget.
Intuitively, cluster A has the lowest density (10%), therefore, the ideal decision boundary should be surrounded cluster A which sacriﬁces the robustness of the cluster
A but increases the overall robustness eventually.
Comparison between UDR-PGD and PGD-AT.
First, we visualize the trajectory of adversarial example from PGD and our UDR-PGD as in Figures 2b,2a to compare behaviors of two adversaries on the same pre-trained model.
It can be seen that: (i) the PGD’s adversarial examples and ours are pushed toward the lower conﬁdent region to maximize the prediction loss g θ ( x (cid:48) , x, y ) ; (ii) however, while the adversarial examples of PGD are limited on the hard-projection ball, our adversarial examples have more ﬂexibility.
Speciﬁcally, those are close to the decision boundary (cluster A, B1) can go further, while those are distant to the decision boundary (cluster B2) stay close to the original input.
This ﬂexibility helps the adversarial examples reach better local optimum of the prediction loss, hence, beneﬁts the adversarial training.
Consequently, as shown in Figure 2c the ﬁnal decision boundary of our UDR-PGD is closer to the ideal decision boundary than that of PGD-AT, hence, achieving a better robustness.
Quantitative result shows that the robust accuracy of our UDR-PGD is 82.6%, while that of PGD-AT is 74.5% with the same PGD attack { k = 200 , (cid:15)
= 2 . 0 , η = 0 . 1 } .
Comparison among UDR-PGD settings.
Here we would like to provide more understanding about our framework through the experiment with PGD-AT as shown in Figure 3.
First, we compare the trajectories of the adversarial examples of UDR-PGD with different λ as shown in Figures 3a,3b.
It can be seen that the crafted adversarial examples stay closer to their benign counterparts when λ becomes higher (i.e., λ = 0 .
1 in Figure 3a).
In contrast, the soft-projection ball is extended when λ becomes smaller (i.e., λ = 0 .
01 in Figure 3b).
On the other hand, with the same λ but smaller τ as
[Figure]
shown in Figure 3c, the soft-ball projection is more identical to the hard ball projection as shown in
Figure 2b.
These behaviors concur with the theoretical expectation as discussed in Section 4.1 in the main paper.
Figure 3d shows the learning progress of parameter λ .
It can be observed that (i) the λ converges toregardless of its initialization value and (ii) the convergence rate of λ depends on the parameter τ (i.e., smaller τ slower convergence).
We choose τ = 2 η for the experiments on real-world image datasets.
[Figure]
Further results of soft-ball projection.
In Figure 4, we compare our UDR-PGD with the soft-ball projection to PGD-AT with the hard-ball projection with different settings against the PGD attack on
CIFAR10.
For PGD-AT, we use the following three ad-hoc strategies for (cid:15) : 1) Fixing (cid:15) = 8 / 255 ; 2)
Fixing (cid:15) = 16 / 255 ; 3) Gradually increasing/decreasing (cid:15) from 8/255 to 16/255 (Refer to Appendix
D for details).
It can be seen that it is hard to ﬁnd an effective strategy of the perturbation boundary of the hard-ball projection for PGD-AT, which can outperform ours.
This demonstrates the beneﬁt of our soft-project operation.
F M ORE RESULTS AND ANALYSIS
Further results with C&W (L2) attack.
We enrich the comprehensiveness of the experiments by further evaluating the defense methods with C&W (L2) attack (Carlini & Wagner, 2017) which is a very strong optimization based attack.
The experiment has been conducted on the CIFAR10 dataset with WideResNet architecture.
The hyper-parameters are c ∈ { 0 . 5 , 0 .
, kappa = 0 , steps = 1000 , lr = 0 .
01 where kappa is the conﬁdence coefﬁcient and c is box-constraint coefﬁcient.
As shown in Table 7, our distributional robustness version signiﬁcantly outperform the standard ones in term of robust accuracy.
For example, against C&W (c=0.5) attack, the robust accuracy gap between UDR-PGD and PGD-AT is 6% while that for UDR-AWP-AT and AWP-AT is around 5% .
The average improvement of robust accuracies against different levels of attack strengths is around
[Table]
This result strongly emphasizes the contribution of our distributional robustness and the soft-ball projection over the standard adversarial training
[Table]
Experimental results of WRM (Sinha et al., 2018).
The performance of WRM highly depends on the Lagrange dual parameter γ (or (cid:15)
= 0 .
5 /γ in their implementation 6 ), which controls the robustness level.
As mentioned in their paper, with large γ [Table] the method is less robust but more tractable.
Generally, decreasing γ will reduce the natural accuracy but increase the robustness of the model as shown in Table 8.
We obtained the best performance on MNIST with γ = 0 .
05 (CNN), while on CIFAR10 and CIFAR100 with γ = 0 .
5 (ResNet18).
The best results with three benchmark datasets have been reported as in Table 9 (recall results from Table 1).
It is a worth mentioning that while we could obtain a similar performance as reported Sinha et al.
(2017) on the MNIST dataset with their architecture (3 Convolution layers + 1 FC layer), however, WRM seems much less effective with larger architectures.
[Table] [Table]
Further results of whitebox attacks with varied (cid:15) .
Here we would like to provide more results on defending against whitebox attacks with a bigger range of (cid:15) as shown in Figure 5.
It can be seen that in a wide range of attack strengths our DR methods consistently outperform their AT counterparts.
[Figure]
The convergence of the algorithm.
During the training, we observed that while adversarial examples distribute inside/outside the hard ball (cid:15) differently (i.e., as shown in Figure 2a ), but generally the average distance to original input is less than (cid:15) .
Therefore, according to the update formulation in
Eq.
(19), λ tends to decrease to 0 and eventually is stable at 0 because of very small learning rate as shown in Figure 3d.
In addition, we visualize the training progress as shown in Figure 6 to show the convergence of our method.
It can be seen that, the error-rate reduces over training progress and converges at the end of the training progress.
[Figure]
Further experiment result on CIFAR100.
We would like to provide additional experiment result on CIFAR100 dataset such that all defenses are adversarially trained with (cid:15) = 8255 .
Our UDR-PGD outperforms PGD 3.7% at (cid:15) = 8255 and 2.3% on average, while our UDR-TRADES and UDR-MART outperform their counterparts by around 0.5% and 0.7%, respectively.
It is worth noting that, in our experiment, MART is quite sensitive with changes of (MART’s natural accuracy drops to a lower
[Table] [Table]
0 , otherwise performance than that of TRADES); that might explain the lower gap between UDR-MART and
MART with the new (cid:15) .
G C HOOSING T HE C OST F UNCTION
In this section, we provide the technical details of our learning algorithm in Section 4 in the main paper, especially, the important of choosing cost function ˆ c ( x, x (cid:48) ) .
Given the current model θ
and the parameter λ , we ﬁnd the adversarial examples by solving:
[Equation]
We employ multiple gradient ascent update steps without projecting onto the hard ball B (cid:15) .
Speciﬁcally, the updated adversarial at step t + 1 as follows:
[Equation]
Given the smoothed cost function as in Equation (19), the updating step is as follows:
[Equation]
It shows that, the pixels that are out-of-perturbation ball B (cid:15) will be traced back with a longer step, depending on the parameter τ .
We consider three popular distance functions of c X ( x (cid:48) , x ) with their gradient as Table 11.
It is worth noting that, while the norm L 1 , L 2 have gradient in all pixels, the
L ∞ has gradient in only one pixel per image.
It means that, when using L ∞ norm as the cost function c
X ( x, x (cid:48) ) , only single pixel has been traced back at each iteration.
In contrast, using L 2 will project all pixels toward the original input x with the step size of each.
As in the discussion in Section F, only small part of an MNIST image contributes to the prediction, while in contrast, most of pixels of a CIFAR10 image affect to the prediction.
Based on this observation, we use the L ∞ for the MNIST dataset and L 2 for the CIFAR10 dataset in the updating step.
However, the perturbation strength (cid:15) has been measured in L ∞ , therefore, we still use L ∞ in the Equation (22) to update λ .
We also visualize the histogram of gradient ∇ x (cid:48)
g θ ( x (cid:48) , x, y ) and ∇ x (cid:48)
ˆ c X
( x (cid:48) , x ) as shown in Figure 7.
It can be seen that the strength of gradient grad 1 = ∇ x (cid:48) g θ ( x (cid:48) , x, y ) is much smaller than grad 2 = ∇ x (cid:48)
ˆ c X
( x (cid:48) , x ) , for example, on the MNIST dataset, grad 1 ∈ [ − 5 × 10 − 4 , 5 × 10 − 4 ] while grad 2 ∈ [ − 0 .
3 , 0 . 3] which is 600 times larger.
Therefore, if using single update step, the gradient ∇ x (cid:48) ˆ c X ( x (cid:48) , x ) dominates the other and pulls the adversarial examples close to the natural input.
These adversarial examples are weaker and do not helps to improve the robustness.
Alternatively, we break single update step for solving Equation (21) to two sub-steps as shown in Algorithm 1 to balance between push/pull steps.
It also can be seen that the grad 2 corresponds with the perturbation boundary (cid:15) and the step size η .
For example, on the MNIST dataset, grad 2 has the range from [ − 0 .
3 , 0 . 3] and has the highest density around [ − 0 .
01] where {0.3, 0.01} are the perturbation boundary and step size in the experiment.
[Figure]