Consistency Regularization for Adversarial Robustness
Abstract
Adversarial training (AT) is currently one of the most successful methods to obtain the adversarial robustness of deep neural networks.
However, the phenomenon of robust overﬁtting, i .
e ., the robustness starts to decrease signiﬁcantly during AT, has been problematic, not only making practitioners consider a bag of tricks for a successful training, e .
g ., early stopping, but also incurring a signiﬁcant generalization gap in the robustness.
In this paper, we propose an effective regularization technique that prevents robust overﬁtting by optimizing an auxiliary ‘consistency’ regularization loss during AT.
Speciﬁcally, it forces the predictive distributions after attacking from two different augmentations of the same instance to be similar with each other.
Our experimental results demonstrate that such a simple regularization technique brings signiﬁcant improvements in the test robust accuracy of a wide range of AT methods.
More remarkably, we also show that our method could signiﬁcantly help the model to generalize its robustness against unseen adversaries, e .
g ., other types or larger perturbations compared to those used during training.
1. Introduction
Recent studies have demonstrated that deep neural networks (DNNs) are vulnerable to adversarial examples, i e ., inputs crafted by an imperceptible perturbation which confuse the network prediction (Szegedy et al., 2014; Goodfellow et al., 2015).
This vulnerability of DNNs raises serious concerns about their deployment in the real-world (Chen et al., 2015;
Kurakin et al., 2016; Li et al., 2019).
Adversarial training (AT) is currently one of the most promising ways to obtain the adversarial robustness of dence to: Jinwoo Shin <jinwoos@kaist.ac.kr>. Accepted by the ICML 2021 workshop on A Blessing in Disguise: The Prospects and Perils of Adversarial Machine Learning. Copyright 2021 by the author(s).
[Figure]
DNNs, i .
e ., directly augmenting the training set with adversarial examples (Goodfellow et al., 2015; Madry et al., 2018;
Athalye et al., 2018).
However, one of the major downsides that most AT methods suffer from, is a signiﬁcant generalization gap of adversarial robustness between the train and test datasets (Yang et al., 2020).
More importantly, it has been observed that such a gap gradually increases from the middle of training (Rice et al., 2020), i .
e ., robust overﬁtting, which makes practitioners to consider heuristic approaches for a successful optimization, e .
g ., early stopping (Zhang et al., 2019).
Only recently, a few proposed more advanced regularization techniques, e .
g ., self-training
(Chen et al., 2021) and weight perturbation (Wu et al., 2020), but it is still largely unknown to the community that why and how only such sophisticated training schemes could be effective to prevent the robust overﬁtting of AT.
Contribution.
In this paper, we suggest to optimize an auxiliary ‘ consistency ’ regularization loss, as a simpler and easy-to-use alternative for regularizing AT.
To this end, we ﬁrst found that the existing data augmentation (DA) schemes are already quite effective to reduce the robust overﬁtting in
AT.
Upon the observation, we optimize a consistency regularization loss during AT which forces adversarial examples from two independent augmentations of the same input to have similar predictions.
Here, it looks highly non-trivial at ﬁrst glance whether matching such attack directions over
DA is useful in any sense.
Our ﬁnding is that the attack direction provides intrinsic information of the sample (other than its label), where the most frequently attacked class is the most confusing class of the ‘clean’ input, i .
e ., class with the maximum softmax probability disregarding the true label.
The proposed regularization loss injects a strong inductive bias to the model that such ‘dark’ knowledge (Hinton et al., 2015) over DA should be consistent.
We verify the efﬁcacy of our scheme through extensive evaluations on CIFAR-10/100 (Krizhevsky et al., 2009) and
Tiny-ImageNet.
For example, our regularization could improve the robust accuracy of WideResNet (Zagoruyko and
Komodakis, 2016) trained via standard AT (Madry et al., 2018) on CIFAR-10 from 45.62% → 50.37%.
Moreover, we show that our regularization could even notably improve the robustness against unforeseen adversaries (Tramer and
Boneh, 2019), i .
e ., when the adversaries assume different threat models from those used in training: e .
g ., our method could improve the l 1 -robustness of TRADES (Zhang et al., 2019) from 28.64% → 46.73% on PreAct-ResNet (He et al., 2016).
Finally, we also observe that our method could be even beneﬁcial for the corruption robustness (Hendrycks and Dietterich, 2019).
2. Consistency regularization for adversarial robustness 2.1. Preliminaries: Adversarial training
We consider a classiﬁcation task with a given K -class dataset D = { ( x i , y i ) }
ni =1 ⊆
X × Y , where x ∈ R d represents an input sampled from a certain data-generating distribution P in an i.i.d.
manner, and Y :
= { 1 , . . .
, K } represents a set of possible class labels.
Let f θ : R d → ∆ K −be a neural network modeled to output a probability simplex ∆ K − 1 ∈ R K , e .
g ., via a softmax layer.
Concretely, the adversarial robustness we primarily focus in this paper is the (cid:96) p -robustness : i .
e ., for a given p ≥ 1 and a small (cid:15) > 0 , we aim to train a classiﬁer f
θ that correctly classiﬁes ( x + δ, y ) for any (cid:107) δ (cid:107) p ≤ (cid:15) , where ( x, y ) ∼ P .
The high level idea of adversarial training (AT) is to directly incorporate adversarial examples to train the classiﬁer (Goodfellow et al., 2015).
In general, AT methods formalize the training of f θ as an alternative min-max optimization with respect to θ
and || δ || p ≤ (cid:15) , respectively; i .
e ., one minimizes a certain the classiﬁcation loss L with respect to θ while an adversary maximizes L by perturbing the given input to x + δ during training.
Here, for a given L , we denote the inner maximization procedure of AT as L adv ( x, y ; θ ) :
[Equation]
2.2. Effect of augmentations in adversarial training
Now, we investigate the utility of data augmentations in AT.
Throughout this section, we train PreAct-ResNet-18 (He
[Figure]
et al., 2016) on CIFAR-10 (Krizhevsky et al., 2009) using standard AT (Madry et al., 2018), following the training details of Rice et al.
We use projected gradient descent (PGD) with 10 iterations under (cid:15) = 8 / 255 (step size of 2 / 255 ) with l ∞ constraint to perform adversarial attacks for both training and evaluation.
Formally, for a given training sample ( x, y ) ∼ D , and augmentation T ∼
T , the training loss is:
[Equation]
Unless otherwise speciﬁed, we assume the set of baseline augmentations T :
= T base ( i .
e ., random crop with 4 pixels zero padding and horizontal ﬂip) by default for this section.
Role of base augmentations in adversarial training.
We observe that the base augmentations T base are already somewhat useful for relaxing the robust overﬁtting in AT.
To this end, we conduct a controlled experiment by removing each augmentation from the pre-deﬁned augmentation set T base and train the network.
Figure 2a summarizes the result of the experiment.
As each augmentation is removed, not only the robustness degrades, but also the adversarial overﬁtting is getting signiﬁcant.
This result implies that there may exist an augmentation family that effectively prevents the robust overﬁtting as the base augmentation is already useful.
Reducing robust overﬁtting with data augmentations.
We further ﬁnd that the existing data augmentation schemes are already quite effective to reduce the robust overﬁtting in AT.
Speciﬁcally, we additionally utilize Cutout (DeVries and Taylor, 2017), color distortion, and gray scale augmentation, which are commonly used in other vision domains (Chen et al., 2020; Khosla et al., 2020)
(we denote such augmentation family as T CCG ).
As shown in Figure 2b, the robust overﬁtting is gradually reduced as more diverse augmentations are used, and even the best accuracy improves.
2.3. Consistency regularization for adversarial training
We suggest to optimize a simple auxiliary consistency regu-
[Table]
larization during AT that further improve the robust generalization.
Speciﬁcally, our regularization forces adversarial examples from two independent augmentations of an instance to have a similar prediction (see Figure 1).
It is highly non-trivial whether matching such attack directions via consistency regularization is useful, which we essentially investigate in this paper.
Our major ﬁnding is that the attack direction itself contains intrinsic information of the instance, as in Appendix E.
For example, the most frequently attacked class is the most confusing class of the ‘clean’ input, i .
e ., class with the maximum softmax probability disregarding the true label.
Hence, our regularization utilize this dark knowledge (other than the true labels) of samples and induce a strong inductive bias to the classiﬁer.
Formally, for a given data point ( x, y ) ∼ D and augmentations T 1 , T 2 ∼ T , we denote δ i as an adversarial noise of T i ( x ) , i .
e .,
δ i := arg max (cid:107) δ (cid:107) p ≤ (cid:15)
L (cid:0) T i ( x ) , y, δ ; θ (cid:1) .
We consider regularizing the temperature-scaled distribution ˆ f θ ( x ; τ ) (Guo et al., 2017) over the adversarial examples across augmentations to be consistent, where τ is the temperature hyperparameter; ˆ f θ ( x ; τ ) =
Softmax ( z θ ( x ) /τ ) where z θ ( x ) is the logit value of f θ ( x ) , i .
e ., activation before the softmax layer of f θ ( x ) .
Then the proposed regularization loss is given by:
[Equation]
where JS ( · (cid:107) · ) denotes the Jensen-Shannon divergence.
Since the augmentations are randomly sampled in every training step, adversarial example’s predictions become consistent regardless of augmentation selection when minimizing the proposed objective.
We note that the motivation behind the temperature scaling is that the conﬁdence of prediction ( i .
e ., maximum softmax value) is relatively low on
AT than the standard training.
Hence, we compensate this issue by enforcing the sharp distribution by using a small temperature.
Comparison to other consistency regularization loss over DA.
There has been prior works that suggested a consistency regularization loss to better utilize DA (Hendrycks et al., 2020; Zhang et al., 2020;
Sohn et al., 2020), which can be expressed with the following form:
[Equation]
where D is a discrepancy function.
The regularization term used in (4) has a seemingly similar formula to ours but there is a fundamental difference: our method (3) does not match the predictions directly for the ‘clean’ augmented samples, but does after attacking them independently, i .
e ., f θ ( T ( x ) + δ ) .
To examine which one is better, we compare (3) with (4) under the same discrepancy function, D :=
JS and same augmentation familiy T CCG .
As shown in Table 1, our design choice (3) improves both clean and robust accuracy compare to the baseline (2), while the prior consistency regularization (4) only improves the clean accuracy.
Overall training objective.
In the end, we derive a ﬁnal training objective, L total : an AT objective combined with the consistency regularization loss (3).
To do so, we consider the average of inner maximization objective on AT
L adv (1) over two independent augmentations T 1 , T 2 ∼ T , as minimizing (1) over the augmentations T ∼ T is equivalent to an average of (1) over T 1 and T 2 :
[Equation]
We then combine our regularizer (3) with a given hyperparameter λ , into the average of inner maximization objectives (5).
Then the ﬁnal training objective L total is as follows:
[Equation]
Note that our regularization scheme is agnostic to the choice of AT objective, hence, can be easily incorporated into wellknown AT methods (Madry et al., 2018; Zhang et al., 2019;
Wang et al., 2020).
We introduce explicit forms of other variants of ﬁnal objective L total for various AT methods, integrated with our regularization loss, in Appendix A.
3. Experiments
We verify the effectiveness of our simple technique on image classiﬁcation datasets: CIFAR-10/100 (Krizhevsky et al., 2009) and Tiny-ImageNet.
Our results exhibit that incorporating simple consistency regularization scheme into the existing adversarial training (AT) methods signiﬁcantly improve adversarial robustness against various attack methods (Carlini and Wagner, 2017; Madry et al., 2018; Croce and
Hein, 2020b), including data corruption (Hendrycks and
Dietterich, 2019).
Intriguingly, our method shows better robustness against unseen adversaries compared to other baselines.
Moreover, our method shows comparable or somewhat surpass the performance of the recent regularization technique (Wu et al., 2020)
(see Appendix D).
The detailed experimental setups, e . g ., training details, datasets, and hyperparameters, are speciﬁed in Appendix C.
[Table]
[Table]
Evaluation setup.
Throughout the section, we mainly report the results where the clean accuracy converges,
i
[Table]
e ., fully trained model, to focus on the robust overﬁtting problem (Rice et al., 2020).
Nevertheless, we also note that our regularization method achieves better best robust accuracy compare to the AT methods (see Table 4 in Appendix D)
[Table]
Considered adversarial attack.
We consider a wide range of adversarial attacks in order to measure the robustness of models without gradient obfuscation (Athalye et al., 2018):
PGD (Madry et al., 2018) with 100 iterations (step size with 2 (cid:15)/k , where k is the iteration number), CW ∞ (Carlini and
Wagner, 2017) [Table] and AutoAttack (Croce and Hein, 2020b).
3.1. Main results
Seen adversaries.
As shown in Table 2, incorporating our regularization scheme into existing AT methods consistently improves accuracies against various adversaries across different models and datasets.
In particular, for standard AT, our method relatively improves 17.40% of robust accuracy against the AutoAttack.
More intriguingly, consideration of our regularization technique into the AT methods boosts the clean accuracy as well in most cases.
We notice that such improvement is non-trivial, as some works have reported a trade-off between a clean and robust accuracies in AT (Tsipras et al., 2019; Zhang et al., 2019).
Unseen adversaries.
We evaluate our method against unforeseen adversaries, e .
g ., robustness on different norm constraints of l 2 and l 1 , as reported in Table 2.
We observe that combining our regularization method could consistently and signiﬁcantly improve the robustness against all the considered unseen adversaries tested.
It is remarkable that our method is especially effective against l 1 adversaries compared to the baselines, regarding the fundamental difﬁculty of achieving the mutual robustness against both l 1 and l ∞ attacks (Tramer and Boneh, 2019; Croce and Hein, 2020a).
We also show that our regularization scheme improves on different types of unseen adversaries: attack under different radii of (cid:15) with l ∞ in Appendix D.
Common corruption.
We also validate the effectiveness of our method on corrupted CIFAR-10 dataset (Hendrycks and Dietterich, 2019), i .
e ., consist of 19 types of corruption such as snow, zoom blur.
We report the mean corruption error (mCE) of each model in Table 3.
The results show that the mCE consistently improves combined with our regularization loss regardless of AT methods.
Interestingly, our method even reduces the error (from the standard cross-entropy training) of corruptions that are not related to the applied augmentation or noise, e .
g ., zoom blur error 25.1% → 20.2%.
We note that common corruption is also important and practical defense scenario (Hendrycks and Dietterich, 2019), therefore, obtaining such robustness should be a desirable property for a robust classiﬁer.
4. Conclusion
In this paper, we propose a simple yet effective regularization technique to tackle the robust overﬁtting in adversarial training (AT).
Our regularization forces the predictive distributions after attacking from two different augmentations of the same input to be similar to each other.
Our experimental results demonstrate that the proposed regularization brings signiﬁcant improvement in various defense scenarios including unseen adversaries.
Consistency Regularization for Adversarial Robustness A. Overview on adversarial training objectives
In this section, we provide an overview of adversarial training (AT) objectives: standard AT (Madry et al., 2018), TRADES (Zhang et al., 2019), and MART (Wang et al., 2020).
We use the same notation as in Section 2.
A.1. Standard adversarial training
One of the most basic form of AT method (Madry et al., 2018) considers to design L adv with the standard cross-entropy loss
L CE , and directly force the generated adversarial example to have the original label.
Formally, for a given sample ( x, y ) ∼ D , a classiﬁer f θ and a ball constraint with (cid:15) the loss is as follows: [Equation]
[Equation]
Standard AT with consistency regularization.
By considering standard AT loss as the AT objective, i .
e ., L adv =
L AT [Equation] 6), one can deﬁne the ﬁnal objective L ATtotal .
For a given data augmentations T 1 , T 2 ∼ T and sharpening temperature τ , the ﬁnal objective is as follows:
[Equation]
where δ i = [Equation]
(cid:1) , and ˆ f θ ( x ; τ ) is the temperature scaled classiﬁer.
A.2. TRADES
Zhang et al.
(2019) showed that there can exist a trade-off between clean and adversarial accuracy and decomposed the objective of standard AT into clean and robust objectives.
By combining two objectives with a balancing hyperparameter, one can control such trade-offs.
For a given sample ( x, y ) ∼ D , and a classiﬁer f θ the proposed training objective is:
[Equation]
(8) where KL ( · (cid:107) · ) denotes the Kullback–Leibler divergence, L CE is the cross-entropy loss, and β is the hyperparameter to control the trade-off between clean accuracy and robust accuracy.
For all experiments, we set the hyperparameter β = 6 by following the original paper.
TRADES with consistency regularization.
By utilizing L TRADES as the base AT objective, one can also adapt our regularization scheme for the ﬁnal objective L TRADES total .
We also apply the consistency regularization loss between adversarial examples with the Jensen-Shannon divergence, JS ( · (cid:107) · ) .
For given sampled data augmentations T 1 , T 2 ∼ T and sharpening temperature τ , the ﬁnal objective is as follows:
[Equation]
where δ i = arg max (cid:107) δ (cid:107) p ≤ (cid:15) KL (cid:0) f
θ ( T i ( x )) (cid:107) f
θ ( T i ( x ) + δ ) (cid:1) , and ˆ f θ ( x ; τ ) is the temperature scaled classiﬁer (Guo et al., 2017).
A.3. MART
Wang et al.
(2020) observed that addressing more loss on the misclassiﬁed sample during training can improve the robustness.
Let f ( k ) θ
( x ) as the prediction probability of class k of a given classiﬁer f θ .
For a given sample ( x, y ) ∼ D , the proposed training objective is as follows:
[Equation]
where
[Equation]
and γ is a hyperparam
[Equation]
eter.
For all experiments, we set the hyperparameter γ = 6 by following the original paper.
MART with consistency regularization.
One can also utilize L MART as the base AT objective and adapt our regularization scheme for the ﬁnal objective L MARTtotal .
For a given data augmentations T 1 , T 2 ∼ T and sharpening temperature τ , the ﬁnal objective is as follows:
[Equation]
where δ i = arg max
[Equation]
L CE ( f θ (cid:0) T i ( x ) + δ ) , y (cid:1) , and ˆ f θ ( x ; τ ) is the temperature scaled classiﬁer.
B. Algorithm
Require: Batch of samples B = { ( x n , y n ) } Nn =1 , model f θ , data augmentation family T , classiﬁcation loss L , regularization hyperparamater λ , and sharpening temperature τ 1: for all n ∈ { 1 , ..., N } do 2:
Sample T 1 , T 2 ∼ T # sample two augmentation funtions 3: ( δ 1 , δ 2 ) ← (arg max (cid:107) δ (cid:107) p ≤ (cid:15)
L ( T i ( x n ) , y n , δ ; θ ))
2 i =1 # perturb each augmentation 4:
L ( n ) adv ← 12 (cid:80) 2 i =
1 L ( T i ( x n ) , y n , δ i ; θ ) # adversarial training with augmentations 5:
L ( n ) con ← JS (cid:16) ˆ f θ (cid:0) T 1 ( x n ) + δ 1 ; τ (cid:1) (cid:107) ˆ f θ (cid:0) T 2 ( x n ) + δ 2 ; τ (cid:1)(cid:17)
# consistency regularization 6:
L ( n ) total ← L ( n ) adv + λ · L ( n ) con 7: end for 8: L total ← 1 N (cid:80) Nn
=1 L ( n ) total 9: θ ← SGD ( θ, L total )
Algorithm
Require: Batch of samples B = { ( x n , y n ) } Nn =1 , model f θ , data augmentation family T , cross-entropy loss L CE , regularization hyperparamater λ , and sharpening temperature τ 1: for all n ∈ { 1 , ..., N } do 2:
Sample T 1 , T 2 ∼ T # sample two augmentation funtions 3: ( δ 1 , δ 2 ) ← (arg max (cid:107) δ (cid:107) p ≤ (cid:15)
L CE ( f θ (cid:0) T i ( x n ) + δ ) , y n (cid:1) )
2 i =1 # perturb each augmentation 4:
L ( n ) adv ← 12 (cid:80) 2 i =
1 L CE ( f θ (cid:0) T i ( x n ) + δ i ) , y n (cid:1)
# standard adversarial training with augmentations 5:
L ( n ) con ← JS (cid:16) ˆ f θ (cid:0) T 1 ( x n ) + δ 1 ; τ (cid:1) (cid:107) ˆ f θ (cid:0) T 2 ( x n ) + δ 2 ; τ (cid:1)(cid:17)
# consistency regularization 6:
L ( n ) total ← L ( n ) adv + λ · L ( n ) con 7: end for 8: L total ← 1 N (cid:80) Nn
=1 L ( n ) total 9: θ ← SGD ( θ, L total )
C. Detailed description of experimental setups
Training details.
We use PreAct-ResNet-18 (He et al., 2016) architecture in all experiments, and additionally use
WideResNet-34-10 (Zagoruyko and Komodakis, 2016) for white-box adversarial defense on CIFAR-10.
We consider augmentation family CCG T CCG as in Section 2.2, which consists of random crop (with 4 pixels zero padding), random horizontal ﬂip (with 50% of probability), Cutout (DeVries and Taylor, 2017) (with half of the input width), color jitter, and grayscale for our method.
For regularization parameter λ , we set to λ = 1 .
in all cases except for applying on
WideResNet-34-10 with TRADES and MART where we use λ = 2 . 0 .
The temperature is ﬁxed to τ = 0 . 5 in all experiments.
For other training setups, we mainly follow the hyperparameters suggested by the previous studies (Pang et al., 2021; Rice et al., 2020).
In detail, we train the network for 200 epochs 2 using stochastic gradient descent with momentum 0.9, and weight decay of 0.0005.
The learning rate starts at 0.1 and is dropped by a factor of 10 at 50%, and 75% of the training progress.
For the inner maximization for all AT, we set the (cid:15) = 8 / 255 , step size 2 / 255 , and 10 number of steps with l ∞ constraint (see the supplementary material for the l 2 constraint AT results).
Resource description.
All experiments are processed with a single GPU (NVIDIA RTX 2080 Ti) and 24 instances from virtual CPU (Intel Xeon Silver 4214 CPU @
2.20GHz).
Dataset description.
For the experiments, we use CIFAR-10, CIFAR-100 (Krizhevsky et al., 2009), and Tiny-ImageNet.
CIFAR-10 and CIFAR-100 consist of 50,000 training and 10,000 test images with 10 and 100 image classes, respectively.
All CIFAR images are 32 × 32 × 3 resolution (width, height, and RGB channel, respectively).
Tiny-ImageNet contains 100,000 train and 10,000 test images with 200 image classes, and all images are 64 × 64 × 3 resolution.
For all experiments, we do not assume the existence of a validation dataset.
Data augmentation description.
We use the augmentations family T base for baseline adversarial training methods and jointly use T base , T CCG for our regularization.
T base includes random crop with padding and horizontal ﬂip, and T CCG includes
Cutout (DeVries and Taylor, 2017), color jitter, and grayscale in addition to the augmentations in T base .
The detailed description of each augmentation in the family are as follows:
• Random crop with padding.
Randomly crops the padded image with the same size of input image.
We zero pad the input image in all sides by 4 pixels.
• Horizontal ﬂip.
Flips the image horizontally with 50% of probability.
• Cutout.
Randomly mask out the square regions of input image, with square width of half of the input width.
• Color jitter.
Change the brightness, contrast, saturation, and hue of the image.
We apply color jitter with 80% of probability.
We used the same color jitter strength as Chen et al.
• Grayscale.
Convert into a gray image.
Randomly apply a gray scale with 20% of probability.
[Figure]
[Table]
D. More experimental results D.1. Main results
White-box attack.
We consider a wide range of white-box adversarial attacks, in order to extensively measure the robustness of trained models without gradient obfuscation (
): PGD 2018) with 20 and 100 iterations (step size with 2 (cid:15)/k , where k is the iteration number), CW ∞ (Carlini and Wagner, 2017), and AutoAttack (Croce and Hein, 2020b).
We report the fully trained model’s accuracy and the result of the checkpoint with the best PGD accuracy (ofiterations), where each checkpoint is saved per epoch.
As shown in Table 4, incorporating our regularization scheme into existing AT methods consistently improves both best and last white-box accuracies against various adversaries across different models and datasets.
The results also demonstrates that our method effectively prevents robust overﬁtting as the gap between the best and last accuracies has been signiﬁcantly reduced in all cases.
In particular, for TRADES with WideResNet-34-10, our method’s robust accuracy gap under the
AutoAttack is only 0.71%, while the baseline’s gap is 6.85%, which is relatively 10 times smaller.
Moreover, we observed that our method almost remains the same test accuracy when even one further train the model, e .
g ., 50% more training epochs from the current setup.
Unseen adversaries.
We also evaluate our method against unforeseen adversaries including the robustness on different attack radii of (cid:15) (the results on different norm constraints of l 2 and l 1 is already reported in Table 2, nonetheless, we report all values in Table 5 for better presentation).We observe that combining our regularization method could consistently and signiﬁcantly improve the robustness against all the considered unseen adversaries tested.
We remark that there exist fundamental difﬁculty of achieving the mutual robustness against both l 1 and l ∞ attacks (Tramer and Boneh, 2019; Croce and Hein, 2020a).
Also, note that it is important to achieve robustness against unseen adversaries which is a more realistic scenario.
Hence, we believe our regularization scheme can also be adapted to AT methods for training robust classiﬁers against multiple perturbations (Tramer and Boneh, 2019; Maini et al., 2020).
Black-box transfer attack.
We attempt to test the model under black-box transfer attack, i .
e ., adversarial examples generated from a different model (typically from a larger model).
We test PreAct-ResNet-18 trained under baselines and our regularization loss, with crafted adversarial examples from WideResNet34-10 trained with standard AT (we consider
PGD-100 and CW ∞ as black-box adversaries).
Results in Table 6 demonstrate that our method indeed improves robustness
[Table]
[Table]
[Table]
under black-box attacks across baselines.
These results not only imply that our regularization method does not suffer from the gradient obfuscation but also show that our method is effective in practical defense scenarios where the target model is hidden from the attackers.
D.2. Comparison with Wu et al. (2020)
In this section, we consider a comparison with Adversarial weight perturbation (AWP) (Wu et al., 2020) 6 , another recent work which also addresses the overﬁtting problem of AT by regularizing the ﬂatness of the loss landscape with respect to weights via an adversarial perturbation on both input and weights.
We present two experimental scenarios showing that our method can work better than AWP.
[Figure]
White-box attack and unseen adversaries.
We consider various white-box attacks and unseen adversaries for measuring the robustness.
As shown in Table 7, our method shows comparable results with AWP in l ∞ defense, and better results in most cases of unseen adversaries defense, e .
g .,
l 2 , l 1 constraint attack.
In particular, our regularization technique consistently surpass
AWP in the defense against the l 1 constraint attack.
In addition, our method shows consistent improvement in clean accuracy, while AWP somewhat suffers from the trade-off between clean and robust accuracy.
Training with limited data.
We also demonstrate that our method is data-efﬁcient: when only a small number of training points are accessible for training the classiﬁer.
To this end, we reduce the training dataset’s fraction to 10%, 20%, and 50% and train the classiﬁer in each situation.
As shown in Figure 4, our method shows better results compare to AWP, especially learning from the small sized dataset, as our method efﬁciently incorporates the rice space of data augmentations.
In particular, our method obtained 35.6% robust accuracy even in the case where only 10% of the total dataset is accessible.
We note such efﬁciency is worthy for practitioners, since in such cases, validation dataset for early stopping is insufﬁcient.
D.3. Adversarial training on l 2 constraint ball
In this subsection, we demonstrate that our regularization scheme is also effective under different types of constraint ball.
In particular, we consider adversarial training (AT) on l 2 constraint ball.
Training details.
We use the same training conﬁguration as in Section 3, except for the inner maximization constraint.
For inner maximization for all AT, we set the ball radius to (cid:15) =
128 / 255 , step size α = 15 / 255 , and 10 number of steps with lconstraint.
We use PreAct-ResNet-18 (He et al., 2016) architecture in all experiments.
White-box attack.
For l 2 constraint AT, we consider white-box adversarial attacks, including PGD (Madry et al., 2018) with 20 and 100 iterations (step size with 2 (cid:15)/k , where k is the iteration number) and AutoAttack (Croce and Hein, 2020b).
We report the fully trained model’s accuracy and the result of the checkpoint with the best PGD accuracy (of 10 iterations), where each checkpoint is saved per epoch.
The results are shown in Table 8.
In l 2 constraint AT, our regularization scheme also signiﬁcantly improves white-box accuracy against various adversaries and also reduces the overﬁtting as the best and last robust accuracy gap has been reduced.
Interestingly, our regularization scheme also increases the clean accuracy for lconstraint AT.
This result implies that our method can be a promising method for improving both clean and robust accuracy in various scenarios regardless of the constraint type of the ball.
Unseen adversaries.
We also evaluate our method against unforeseen adversaries, e .
g ., robustness on different attack radii of (cid:15) or even on different norm constraints of l ∞ and l 1 .
As shown in Table 9, our regularization technique also consistently, and signiﬁcantly improves the robustness accuracy against unseen adversaries, in the case of l 2 constraint AT.
We believe our method may also improve the robustness against unforeseen attack for other types of constraint ball ( e .
g ., l 1 ).
One intriguing direction is to further develop our method toward defensing against multiple perturbations (Tramer and Boneh, 2019; Maini et al., 2020) which is also an important research ﬁeld.
Common corruption.
We also validate the effectiveness of our method on corrupted CIFAR-10 dataset (Hendrycks and
Dietterich, 2019).
We report the mean corruption error (mCE) of each model in Table 10.
Our method also shows consistent improvement in corruption dataset even for l 2 constraint AT.
Interestingly, l 2 constraint AT shows better performance of mCE compare to l ∞ constraint AT across all corruption types.
Moreover, the improvement of our method is more signiﬁcant in l 2 constraint AT.
While l ∞ constraint AT’s relative improvement is 8.27%, l 2 constraint AT shows 14.26% relative improvement in standard AT (Madry et al., 2018).
Hence, when the target problem is more focus on the corruption robustness, considering l 2 AT can be a one option.
[Table]
[Table]
[Table]
D.4. Learning dynamics of adversarial training with additional augmentations
Figure 5 shows the test robust and clean accuracy of standard AT (Madry et al., 2018) with additional augmentations from the common practice ( i .
e ., random crop and horizontal ﬂip).
We denote such common practice augmentation set as base augmentation.
As shown in Figure 5a, further use of Cutout (DeVries and Taylor, 2017) or color augmentation from the base augmentation improves robust accuracy.
However, one can observe that it still overﬁts in the end.
In contrast, jointly using two augmentations with the base augmentation can train the classiﬁer without overﬁtting.
We note that the clean accuracy slightly decreases when using CCG augmentation (see Figure 5b) [Table] nonetheless, by optimizing our regularization loss simultaneously, the clean accuracy improves from the standard AT with base augmentation (see Table 8)
[Table]
[Figure]
D.5. Variance of results over multiple runs
In our experiments
[Figure]
we compare single-run results following other baselines considered in this paper (Madry et al., 2018;
Wang et al., 2020).
In Table
[Figure] we report the mean and standard deviation of clean and robust accuracy of CIFAR-10 results for standard AT (Madry et al., 2018) [Figure] and our method.
In general, we observe both accuracies of a given training method are fairly robust to network initialization
[Figure]
[Table]
E. Ablation study
We perform an ablation study on each of the components in our method.
Throughout the section, we apply our method to the standard AT (Madry et al., 2018) and use PGD with 100 iterations for the evaluation.
Component analysis.
We perform an analysis on each component of our method, namely the use of (a) data augmentations, and (b) the consistency regularization loss, by comparing their robust accuracy and mean corruption error (mCE).
The results in Table 12 demonstrate each component is indeed effective, as the performance improves step by step with the addition of the component.
We note that the proposed regularization method could not only improve the robust accuracy but also signiﬁcantly improve the mCE.
As shown in Figure 6, simply applying augmentation to the standard AT can reduce the error in many cases (11 types out of 19 corruptions) and even reduce the error of corruptions that are not related to the applied augmentation ( e .
g ., motion blur, zoom blur).
More interestingly, further adapting the consistency regularization loss can reduce the corruption error in all cases from the standard AT with augmentation.
It suggests that the consistency prior is indeed a desirable property for classiﬁers to obtain robustness (for both adversarial and corruption).
Temperature scaling.
We also investigate the effect of the temperature τ for the consistency regularization.
As shown in Table 13, the temperature in our method does matter in the robust accuracy of trained models.
As shown in Table 13, sharpening the prediction into more sparse, one-hot like distributions with small temperature τ < 1 on regularization shows an signiﬁcant improvement.
This results somewhat support our claim that the sharp distribution is important in our case, as the conﬁdence ( i .
e ., maximum softmax value) is relatively low on AT than the standard training.
Analysis on attack directions.
To analyze the effect of our regularization scheme, we observe the attacked directions of the adversarial examples.
We ﬁnd that the most confusing class of the ‘clean’ input, is highly like to be attacked.
Formally, we deﬁne the most confusing class of the given sample ( x, y ) as arg max k (cid:54) =
y f ( k ) θ ( x ) where f ( k ) θ is the softmax probability of class k .
We observe that 77.45% out of the misclassiﬁed adversarial examples predicts the most confusing class (under standard AT with CCG augmentation).
This result implies that the attack direction itself contains the dark knowledge of the given input (Hinton et al., 2015), which supports our intuition to match the attack direction.
[Table]
[Table]
[Figure]
F. Additional analysis on the consistency regularization loss F.1. Design choices of discrepancy function in the consistency regularization loss
We examine two other popular designs of discrepancy function for the consistency regularization instead of Jensen-Shannon divergence, namely, mean-squared-error and KL-divergence as follow:
[Equation]
where δ i is the adversarial noise of T i ( x ) .
We use the same setup as in Section 3 ( e . g ., use T CCG ) and jointly train the
TRADES (Zhang et al., 2019) objective with different choices of consistency losses.
The results are presented in Table 14.
In general, we observe that the L MSE regularizer can improve both clean and robust accuracies, but it could not achieve better robustness than the Jensen-Shannon divergence.
Moreover, we observed that L KL signiﬁcantly degrade the robustness against the AutoAttack (Croce and Hein, 2020b).
The interesting point is that the L KL regularizer extremely lowers the conﬁdence ( i .
e ., maximum softmax probability) of the classiﬁer, e .
g ., average conﬁdence of the clean examples is 0.39 while other model’s conﬁdences are larger than 0.55.
Based on our empirical ﬁnding, we conjecture that models with very low conﬁdence lead to the venerability against the AutoAttack.
[Table]
F.2. Design choices of data augmentations in the consistency regularization loss
We observed that the design choice of data augmentations in the consistency loss should be done deliberately.
To be speciﬁc, when utilizing base augmentation ( i .
e ., the augmentation set that cannot prevent overﬁtting) in the regularization loss, it may induce robust overﬁtting.
To this end, we modify AugMix (Hendrycks et al., 2020), which utilizes base augmentation in the consistency regularization scheme.
We extend AugMix loss to match the attack direction of the given instance.
Concretely, for a given sample ( x, y ) , T ∼ T base and T 1 , T 2 ∼ T CCG 7 , the extension version is:
[Equation]
where JS indicates the Jensen-Shannon divergence, δ, δ 1 , δ 2 is the adversarial noise of T ( x ) , T 1 ( x ) , T 2 ( x ) , respectively.
As shown in Table 15, we ﬁnd utilizing base augmentation in to the consistency loss, only shows marginal improvement on the adversarial robustness compared to ours.
We conjecture that not exposing base augmentations, is crucial for designing the consistency regularization scheme in AT.
[Table]
F.3. Runtime analysis
One might concern the training cost of our method, as it is being doubled compared to baseline AT methods due to the two independent adversarial examples.
However, we found that our method maintains almost the same robust accuracy even under the same computational budget as the baselines by reducing the training epochs in half.
To this end, we train standard
AT (Madry et al., 2018) objective jointly with our regularization loss under CIFAR-10.
As shown in Table 16, the gap of robust accuracy (between 100 and 200 epoch trained models) under PGD-100, and AutoAttack is only 0.19% and 0.02%, respectively.
[Table]