A D ISTRIBUTIONAL R OBUSTNESS P ERSPECTIVE ON A DVERSARIAL T RAINING WITH THE ∞ -W ASSERSTEIN D ISTANCE
Anonymous authors
Paper under double-blind review
A BSTRACT
While ML tools are becoming increasingly used in industrial applications, adversarial examples remain a critical ﬂaw of neural networks.
These imperceptible perturbations of natural inputs are, on average, misclassiﬁed by most of the stateof-the-art classiﬁers.
By slightly modifying each data point, the attacker is creating a new distribution of inputs for the classiﬁer.
In this work, we consider the adversarial examples distribution as a tiny shift of the original distribution.
We thus propose to address the problem of adversarial training (AT) within the framework of distributional robustness optimization (DRO).
We show a formal connection between our formulation and optimal transport by relaxing AT into DRO problem with an ∞ -Wasserstein constraint.
This connection motivates using an entropic regularizer– a standard tool in optimal transport— for our problem.
We then prove the existence and uniqueness of an optimal regularized distribution of adversarial examples against a class of classiﬁer (e.g., a given architecture) that we eventually use to robustly train a classiﬁer.
Using these theoretical insights, we propose to use Langevin Monte Carlo to sample from this optimal distribution of adversarial examples and train robust classiﬁers outperforming the standard baseline and providing a speed-up of respectively × 200 for MNIST and × 8 for CIFAR-10.
I NTRODUCTION
We call adversarial example an input which is a human-imperceptible (cid:15) -perturbation 1 compared to a real example that results in an incorrect classiﬁcation from a classiﬁer [Goodfellow et al., 2014;
Sun et al., 2018; Athalye et al., 2018;
Santurkar et al., 2019; Nguyen et al., 2015a; Kurakin et al., 2016; Moosavi-Dezfooli et al., 2016].
The particularity of these examples, which justiﬁes their study, is the fact that most of the so-called adversarial examples are misclassiﬁed by a large majority of state-of-the-art neural networks.
Long seen as bugs, Santurkar et al.
[2019] asserts that the existence of adversarial examples is explained by the presence of easy-to-perturb patterns within the data distribution that are not perceptible by humans but useful for the classiﬁcation task.
In response to this discovery, different methods have been developed to train robust classiﬁers and to craft adversarial attacks by determining optimal perturbations [Nguyen et al., 2015b; Papernot et al., 2016a;
Goodfellow et al., 2014; Papernot et al., 2016b; Tramèr et al., 2017;
Madry et al., 2017].
Among these training methods, adversarial training [Goodfellow et al., 2014; Tramer et al., 2017;
Madry et al., 2018] has settled as one of the strongest baselines to train robust classiﬁers.
This method is relatively simple: it consists of training the classiﬁer directly on batches of adversarial examples, leading to the following optimization problem [Madry et al., 2018]:
[Equation]
where (cid:96) is usually the cross-entropy loss and p data is the dataset distribution.
Our goal is to rigorously connect adversarial training and robustness by providing a distributional robustness perspective
[Delage and Ye, 2010; Ben-Tal and Nemirovski, 1998; Sinha et al., 2018] for adversarial training.
Distributional robustness is a framework to study predictive models that aim at being robust against distribution shift.
Given a set of possible distribution P that a given predictive model f θ could encounter the distributionally robust classiﬁcation task is:
[Equation]
Note that while standard adversarial training aims to use the point-wise optimal adversarial ˜ x
j examples (i.e. for each natural input x i ), our perspective considers the optimal adversarial distribution.
Working at the scale of distributions leads us to draw inspiration from the Kantorovich relaxation in Optimal Transport theory.
To do so, we will deﬁne the set P using coupling measures between natural and adversarial distributions with the help of ∞ - ∞ -Wasserstein distance.
Contributions.
Our contributions are three-fold: First , we provide a strong connection between adversarial training and adversarial robustness and distributional robustness by using some tools from optimal transport, we call this formulation adversarial transport .
Our second contribution is to show that, in this speciﬁc setting, there exists, against any given classiﬁer f θ , an optimal distribution of adversarial examples and to provide a closed-form solution for this distribution.
Our third contribution is to use these theoretical insights to come up with a practical training method using
Langevin Monte-Carlo sampling to jointly ﬁnd the optimal classiﬁer and the optimal distribution of adversarial examples.
By using this new technique for adversarial training we obtain robust classiﬁers outperforming the standard baseline [Madry et al., 2018] in terms of robustness and clean accuracy.
Moreover, this training technique provides a speed-up of respectively × 200 for MNIST and × 8 for
CIFAR in terms of training time.
Related Work.
Among the various works about defenses and attacks in the context of adversarial examples, Adversarial Training [Madry et al., 2018] is the most common baseline.
However, in this procedure, adversarial examples are generated independently of the others by searching for the optimal perturbation for each one.
Thus, AT seeks point-wise optimality and not global optimality.
Here, the goal is to make our classiﬁer robust to any unknown adversarial example distribution.
It justiﬁes the consideration of the DRO framework.
DRO enables a mathematical formulation for dealing with uncertainty in complex systems [Delage and Ye, 2010; Lam, 2018; Rahimian and Mehrotra, 2019].
In ML, DRO tries to minimize the loss over the worst-case distribution in a neighborhood of the observed training data distribution [Duchi and Namkoong, 2016; 2018; Chouzenoux et al., 2019;
Duchi et al., 2016].
Thus, DRO is pertinent in the case of adversarial examples and allows to bring a principled distributional perspective on AT.
Within the DRO framework, one crucial point is to properly deﬁne the uncertainty set which contains the underlying data distribution.
The importance of this set lies in the fact that it allows to reduce the computation time and the search area of the underlying distribution [Delage and Ye, 2010; Ben-Tal and Nemirovski, 1998; Lam, 2018].
Different methods have been proposed to construct uncertainty sets.
Among them, one considers the help of OT operators and deﬁnes the set with all the probability measures such as the p -Wasserstein distance from the observed distribution is less than a given constant ( p -Wasserstein ball)[Blanchet and Murthy, 2019].
Some works have started to study p -Wasserstein DRO in the case of adversarial examples.
Zheng et al.
[2019] deﬁnes Distributionally Adversarial Attacks (DAA) which is a generalization of PGD attacks on the space of probability measures with W 2 -DRO and [Staib and Jegelka, 2017] did the W p -DRO generalization of AT.
E.Wong et al.
[2019] also considers the W p ball using an explicit formulation of the uncertainty set with coupling matrices.
However, while the previous works modiﬁed the AT problem—the W p constraint on the adversarial distribution does not correspond to the distribution of adversarial examples computed in AT—our work aims at overcoming that.
The original AT problem stays a the scale of the example and considers OT to deal with the displacement of pixels.
This perspective leads to the discovery that the standard AT problem corresponds to an ∞ -Wasserstein
DRO problem with the (cid:96) ∞ underlying geometry.
In the meantime, as in our paper, entropic regularization is used to ﬁnd closed forms of the coupling matrix.
To extend this understanding of adversarial examples in the case of distributions we generalize this uncertainty set with the ∞ - ∞ -Wasserstein distance and add entropic regularization.
2 - ∞ -
Wasserstein DRO has already started to receive consideration in the case of AT
[Gao et al., 2017].
Nevertheless, the use of the (cid:96) ∞ within the ∞ -Wasserstein distance allows both to consider the DRO problem at the dataset scale but also to ensure that the adversarial condition is respected for each element of the adversarial distribution.
Together with the use of coupling matrices in our formulation, we found a concave and tractable formulation of our problem which results in a different technique to sample from this distribution (namely Langevin Monte Carlo).
Finally, we propose to keep them in memory to reuse the past samples for the update of the robust classiﬁer.
Notations.
In this work, we will consider a measurable ﬁnite dimensional input space
X
⊂ R d .
We will note B ( X ) the Borel σ -algebra of X and M ( X ) 1+ the set of all probability measures on X .
If not precised, a map T : X → X is considered measurable.
We, recall that given a separable metric space X s.t.
any probability measure on X is a Radon measure, for T : X → X , the push-forward measure of β = T (cid:93) α ∈ M ( X ) 1+ of some α ∈ M ( X ) 1+ satisﬁes: ∀ h ∈ C ( X ) , (cid:82) X h
(˜ x ) dβ (˜ x ) =
(cid:82)
X h ( T ( x )) dα ( x ) .
A DVERSARIAL T RAINING , T RANSPORT , AND D ISTRIBUTIONAL R OBUSTNESS
In this work, we say that ˜ x ∈ X is an adversarial example of f at the data point ( x, y ) if (cid:107) ˜ x − x (cid:107) ∞ ≤ (cid:15)
[Goodfellow et al., 2014].
Given a loss function (cid:96) , an optimal adversarial example ˜ x aims at maximizing the following optimization problem:
[Equation]
In practice, a large value for (cid:96) ( f θ (˜ x ) , y ) will yield a misclassiﬁcation of the example y .
By considering the adversarial training problem (1), one can notice that the distribution of input-output pairs seen by the classiﬁer f θ depends on the value of its own parameters.
We will call this distribution p adv .
Such a distribution can be described as the pushforward of a transport map T that respect the adversarial example constraint (cid:107) T ( x ) − x (cid:107) ∞ ≤ (cid:15) , ∀ x ∈ X .
In other words we have,
[Equation]
This remark leads us to our ﬁrst proposition that explicitly proposes a distributional robust optimization (DRO) formulation of the adversarial training problem.
Proposition 2.1 (DRO formulation of adversarial training) .
The adversarial training problem (1) can be formulated as a DRO problem (2) where:
[Equation]
Interestingly, one can draw parallels with Monge’s formulation of optimal transport (OT), were given an initial measure µ and a target measure ν , the task is to solve the following problem
[Equation]
On the one hand, (6) and the DRO problem deﬁned in Proposition 2.1 are drastically different problems in essence.
It can be explained by the difference between the constraints on the transportation map and the fact that while Equation 6 aims at minimizing a function of the transportation map T , Equationaims at maximizing a function of the transported distribution p adv .
On the other hand, it is insightful to notice how both problems depend on a set of transportation maps to connect the initial and the target distributions.
The limitations of Monge’s problem are well known in the OT community: due to its non-linear constraint, the problem is often intractable and may not have a solution (i.e. the inﬁmum may not be achieved).
That is why Kantorovich [1940], proposed to relax (6) into a problem with linear constraints by considering coupling measures (an approach that allows a mass splitting from a natural example x i to different locations ˜ x j ).
Such a relaxation had the advantage to provide a better understanding of the original problem leading to novel theoretical guarantees (e.g., the existence of solutions for Kantorovich’s problem, duality, and in some situations equality between Monge’s problem and Kantorovich’s problem) as well as tractable algorithms [Sinkhorn, 1964; Cuturi, 2013b].
In a similar vein, we believe our perspective on adversarial examples that combine ideas from distributional robustness and adversarial transport leads to a better understanding of the problem of adversarial training.
Thus, we will use that insight to consider coupling measures to relax the adversarial training problem (1).
It will lead to a new DRO formulation for adversarial training that we call adversarial transport .
A DVERSARIAL T RANSPORT F ORMULATION
We ﬁrst deﬁne the notion of coupling measure, that we will use to deﬁne a relaxed version of the
DRO formulation described in Proposition 2.1.
Deﬁnition 3.1 (Transport plan) .
Let p adv and p data be two distributions on X .
π ∈ B ( X ) ⊗B
( X ) →
[0 , 1] is a transport plan between p adv and p data if:
[Equation]
The space of transport plan between p data and p adv is denoted Π( p data , p adv ) .
Informally, the coupling measure π : B ( X ) ⊗ B ( X ) describes the spatial modiﬁcation of the initial distribution p data to the adversarial distribution p adv .
For instance, in the discrete case where we have the datapoints ( x i ) and the potential adversarial examples (˜ x j ) , a coupling is a matrix P such that the value P
i,j represents the amount of mass ﬂowing from the natural example i to the adversarial example j .
3. I NCORPORATING THE PROXIMITY CONSTRAINT TO THE COUPLING .
Adversarial examples are tied to the original examples by a proximity constraint.
Thus, a DRO formulation of adversarial training must encompass such a constraint.
For a coupling measure it corresponds to the fact that it can transport ( x, y ) ∼ p data to (˜ x, y ) ∼ p adv only if (cid:107) x − ˜ x (cid:107) ∞ ≤ (cid:15) .
Proposition 3.1 (DRO relaxation of adversarial training) .
The DRO problem (2) can be relaxed by considering coupling measure.
In that case the constraint set P in Equation 2 take the form:
P conv = { p adv : ∃ π ∈ Π( p data | p adv ) with supp( π ) ⊂ { ( x, y, ˜ x, y ) | (cid:107) ˜ x − x
[Equation]
This proposition proposes a convex relaxation of the initial constrain set (5).
Intuitively, the set P constraints the distribution p adv to be (cid:15) -close to p data .
Because this set is convex we can hope it corresponds to a notion (cid:15) -ball.
We show in the next subsection that this intuition can be formalized by using the ∞ -Wasserstein distance.
3. C ONNECTION WITH ∞ -W ASSERSTEIN
Given two distributions µ and ν and a distance function d , the p - p (cid:48) -Wasserstein distance corresponds to the minimal average (cid:96) p norm to the power of p over the transport plans between µ and ν .
Formally, by calling z = ( x, y ) and Z := X × Y , it can be deﬁned as
[Equation]
The p - ∞ -Wasserstein distance can be deﬁned as the limiting case p (cid:48)
→ ∞ .
Thus, it can be seen as the minimal amount of point-wise transport (w.r.t.
the (cid:96) p norm) necessary to transport µ to ν ,
[Equation]
Thus by considering p = ∞ , we can establish that the set introduced in Proposition 3.1 can be described using the ∞ - ∞ -Wasserstein distance.
Proposition 3.2.
[convex relaxation of adversarial training]For any (cid:15) < 1 , 2 the convex DRO relaxation of adversarial training can be reformulated as
[Equation]
[Table]
[Equation]
[Table]
[Equation]
10) where B (cid:15) ( p data ) =
{ p | W ∞ , ∞ ( p, p data ) ≤ (cid:15) } and W p, ∞ is deﬁned in (9) .
In other words, adversarial training can be seen as a DRO problem restricted to the distributions that are (cid:15) -close to the data distribution with respect to the ∞ - ∞ -Wasserstein ( ∞ -Wasserstein distance within a space with the (cid:96) ∞ metric).
The p - p (cid:48)
-Wasserstein distance has been widely studied in the context of optimal transport [Champion et al., 2008; Villani, 2003].
The closeness of our formulation with OT encourages us to add an entropic regularization [Peyré and Cuturi, 2019; Cuturi, 2013a].
3. E NTROPY - REGULARIZED F ORMULATION
Entropic regularization has been a very successful approach for ﬁnding an approximate solution to
OT problems [Cuturi, 2013b; Genevay et al., 2016].
From a theoretical point of view, the entropic regularization prevents the sparsity of the coupling matrix, which is justiﬁed from a practical aspect in the context of transport by the fact that in practice the transport network is diffuse [Wilson, 1969].
In the context of adversarial examples, this is justiﬁed by the fact that the adversarial examples are mostly located in areas of low probability for the input distribution [Song et al., 2017; Ma et al., 2018].
We suppose that p data admits a density.
For an arbitrary coupling measure π , we can deﬁne a relative entropy function as H ( π ) =
− (cid:82) Z×Z (log( π ( z, ˜ z )) − 1) dπ ( z, ˜ z ) with H ( π ) = + ∞ is π does not admit a density.
Thus our entropy-regularized problem is:
[Equation]
The objective is strictly concave in π , therefore our regularized problem becomes strongly concave which ensures the existence and uniqueness of an optimal solution.
It will allow us to obtain an explicit formulation for the optimal coupling π
and then for the optimal adversarial distribution p adv .
The solution of this new problem will be an approximate solution of the original problem (A).
By calling the optimal coupling π ∗ λ associated to this regularized problem (11) we have the following property:
Proposition 3.3.
If λ → ∞ , then π ∗ λ → π ∗ .
3. S OLUTIONS TO THE A DVERSARIAL T RANSPORTATION P ROBLEM
In this section, we study the general framework where the two measures p data and p adv are deﬁned on metric spaces X .
No particular assumption is made on the form of p data and p adv .
The inner-objective of penalized adversarial transportation problem is the following:
[Equation]
where B (cid:15) ( p data ) = { p | W ∞ , ∞ ( p, p data ) ≤ (cid:15) } .
For any given θ ∈ R d , the function h θ is strictlyconcave and the constraints on π are convex (cf Appendix A for proof).
Then, by using convex duality, we can deduce that the problem (12) has a unique closed-form solution:
Proposition 3.4.
For any given θ ∈ R d , The optimization problem (12) has a unique solution,
[Equation]
For a given natural example x with a label y , π (( x, y ) , (˜ x, ˜ y )) grows with the propensity of ˜ x to be better than the other elements of B x ( (cid:15) )
(the (cid:96) ∞ -ball of radius (cid:15) ) to fool the classiﬁer.
We then deduce the explicit form of the adversarial distribution:
[Equation]
From this proposition, we notice that if ˜ x ∈ B x ( (cid:15) ) , then π ( z, ˜ z ) > 0 , i.e. any examples which satisﬁes the adversary condition has a non-zero probability to be considered as an adversarial example of x .
However, when λ is large enough, most of the mass of the distribution lies where (cid:96) ( f θ (˜ x ) , y ) is close to its maximum value.
Moreover it is interesting to notice that the mass of p adv (˜ x, y ) can come from the transport of several input data-points as a potentially inﬁnite number of input data-point x verify the constraint 1 (cid:107) x − ˜ x (cid:107) ∞ and thus could be transported to ˜ x .
We will seen in the next section that is never happens in practice.
As we noticed before, the inner maximization problem is strictly-concave in π and the constraints are convex.
By strong duality, we know that the dual form is equal to the primal.
The primal can be expressed with a min over a lagrange multiplier α s.t.
α ( x, y ) = − 1 λ log(
[Equation]
(c.f. Appendix A for proof) and is convex w.r.t.
this variable.
Thus, we can express the original min-max optimization problem as a convex minimizaion problem in θ which leads to our central theorem.
Theorem 3.1 (Characterization of the solutions) .
For any λ > 0 , the solution set of the regularized adversarial training problem (11) is:
[Equation]
and the optimal adversarial distribution associated with this adversarial training problem is
[Equation]
In order to solve (12) we would need to sequentially sample from π to compute the gradient of g (see §4) for the exact derivation of ∇ g ( θ ) .
Because of its normalization constant, the computation transport plan (29) for any given value of θ may be expensive to compute.
However we will see in the next sections that: a) in practice, one computes this plan simultaneously with the training on the classiﬁer and b) it has a simpler form in practice when dealing with a ﬁnite dataset.
A Zero-Sum game perspective on Adversarial Transport.
One perspective on (11) is that it corresponds to game between a classiﬁer f θ and a transport plan π that aims at transporting the data distribution p data into an adversarial distribution p
adv that is (cid:15) -close to p data with respect to the ∞ - ∞ -Wasserstein distance.
While the classiﬁer aims at minimizing the average cross-entropy loss over the adversarial dataset the transport plan aims at maximizing the errors of the classiﬁer and its own entropy.
This perspective is closely related to Adversarial examples games (AEG)
[Bose et al., 2020] where the authors tried to learn an adversarial distribution with a generator conditioned on the input examples.
This work differs from AEG by its perspective (we connect adversarial examples with DRO), the problem formulation (we look for a regularized transport plan while AEG focused on a generator), the algorithmic implementation (we consider Langevin to ﬁnd the transport plan), and the ﬁnale focus since AEG concentrated on the generation of transferable adversarial example while our focus is on training robust classiﬁers.
This perspective also gives us an insight: the optimal distribution of adversarial examples may provide adversarial attacks that transfer well across models.
The latter point can be supported by the following minimax theorem that is a simple extension of the result from [Bose et al., 2020, Prop. 1].
Proposition 3.5.
Let us call E (˜ x,y ) ∼ p
adv [ (cid:96) ( f θ (˜ x ) , y )]
+ 1 λ H ( π ) =
ϕ ( θ, π ) .
If { f θ | θ ∈ Θ } is a convex set, then we have that
[Equation]
P conv = { p adv : ∃ π ∈ Π( p data | p adv ) with supp( π ) ⊂ { ( x, y, ˜ x, y ) | (cid:107) ˜ x − x (cid:107) ∞ ≤ (cid:15), y ∈ Y }} . .
The assumption that the class of function { f θ | θ ∈ Θ } is convex is not always true in practice but it holds in the case of linear classiﬁer or when one assumes that we have inﬁnite capacity classiﬁers (i.e. we can achieve a measurable function).
Moreover, considering the class of neural networks, it has been argued that they were spanning a set that is almost convex [Gidel et al., 2021].
3. P RACTICAL CASE : SEMI - DISCRETE A DVERSARIAL T RANSPORTATION P ROBLEM
In practice, we do not have access to the true distribution p data but only to a ﬁnite dataset sampled from this distribution (e.g MNIST/ CIFAR-10, etc).
This can be seen as considering the empirical distribution p data = 1 n (cid:80) ni
δ x i .
However, even when considering empirical distributions, the distribution of adversarial examples p adv is an arbitrary measure on metric space X as an adversarial example could be any point in the (cid:96) ∞ -ball of radius (cid:15) ball from the initial point (for datapoint
x i we call that ball B (cid:15) ( x i ) ).
Its analysis is thus similar to the continuous case.
However, in such a practical case the optimal transport map has a simpler form under the following assumption
Assumption 3.1 (Empty intersection) .
We have that B (cid:15) ( x i ) ∩ B (cid:15) ( x j ) for all 1 ≤ i (cid:54) =
j ≤ n.
For real world dataset, this assumption is almost always true.
It means that two datapoints are not (cid:15) close which would mean that they are perceptually indistinguishable.
We can actually show that if the inputs are high dimensional Assumption 3.1 hold with an exponentially high probability,
Proposition 3.6.
Let us assume that the datapoints x i are independently sampled from a distribution p over [0 , 1] d that is absolutely continuous with respect to Lesbegue measure and has a upper-bounded value, i.e. p ( x ) ≤ M , x ∈ [0 , 1] d .
Then P ( ∃ i (cid:54) =
j ∈ [ n ] , (cid:107) ˜ x
j − x i (cid:107) ∞ ≤ (cid:15) )
=
O ( n 2 (cid:15) d ) .
such a proposition could be extended to the more challenging setting where the data distribution is supported by a manifold but this is out of the scope of this paper since its purpose is purely illustrative.
Theorem 3.2.
[Characterization of the solutions in the semi discrete case]
For any λ > 0 , the solution set of the regularized adversarial training problem (11) is:
[Equation]
and under Assumption 3.1 the optimal adversarial distribution associated with this adversarial training problem is
[Equation]
if ∃ i ∈ [ n ] s.t. (cid:107) x i − ˜ x (cid:107) ∞ ≤ (cid:15) otherwise.
The practical insight from this result is that the distribution of adversarial example can, in practice be generated example-wise.
Meaning that for each datapoint x i , i ∈ [ n ] one can generate the distribution of adversarial examples around x i distributed as p adv (˜ x, y )
∝ exp( λ(cid:96) ( f θ (˜ x ) , y )) , ∀ ˜ x
(cid:107) ˜ x − x i (cid:107) ≤ (cid:15) .
Practically, we will maintain a ﬁnite dataset of the adversarial examples (˜ x i,k ) associated with the datapoint x i .
A DVERSARIAL T RANSPORT A LGORITHM
We want to solve the minimization problem (40).
We can solve this problem using gradient descent: θ t +1 =
θ t − η ∇ θ g where ∇ θ g = 1 n
[Equation]
To evaluate this gradient we need to sample from the distribution ˜ q (˜ x ) ∝ exp( λ(cid:96) ( f θ (˜ x ) , y i )) deﬁned over B (cid:15) ( x i ) .
This can be done via Langevin Monte Carlo [Durmus and Moulines, 2016] as the next section explains.
4. L ANGEVIN M ONTE C ARLO
Unadjestued Langevin Algorithm [Durmus and Moulines, 2016] is convenient to sample highdimensional probability distribution q .
Having the following density w.r.t.
the Lesbegue measure q (˜ x ) ∝ exp( − U (˜ x )) , one can show that q is the stationnary measure of the following Stochastic
Differential Equation:
[Equation]
With ( ξ t ) t i.i.d N (0 , I d ) and ( γ t ) t constant or decreasing towards 0 .
L -smoothness of U gives existence and uniqueness of a solution.
Langevin MC can be seen as the sampling analog of gradient descent in optimization.
In this work, we consider a projected version of the Langevin algorithm since we need to sample within some (cid:96) ∞ balls.
Such an algorithm has been analyzed by Bubeck et al.
[2018] in the case where U ( x ) is convex.
In our practical setting we will consider U i (˜ x )
= − λ(cid:96) ( f θ (˜ x ) , y i )) for ˜ x ∈ B (cid:15) (
x i ) , i ∈ [ n ] which are non-convex function.
However, some results have been proven in that context by Ma et al.
Moreover, the Langevin algorithm has been recently used with great success in the context of diffusion models for deep learning for which the function U is not convex (see [Weng, 2021] for an overview).
4. P RACTICAL SETTING
As described in Algorithm 1, the training process has two loops:
Given a minibatch ( x i , y i ) i ∈ B , the inner loop samples the adversarial distributions
q i ( x ) against the current classiﬁer f θ via Langevin MC where each samples are then projected onto B i ( (cid:15) )
(operator P B i ( (cid:15) ) ) and onto the space X (operator P X ).
It allows us to estimate ∇ g .
Sign of the Gradient.
Similarly to standard adversarial training and attack methods we use the sign of the gradient of g to update θ .
It can be motivated by the fact that the sign of gradient is well suited to the geometry deﬁned by the (cid:96) ∞ ball since it corresponds to the steepest descent direction [Boyd et al., 2004] in the (cid:96) ∞ geometry [Balles et al., 2020].
Reusing the Examples.
In practice, we restart the Langevin MC from the adversarial examples found at the previous iterations , this allow us to only use one step of Langevin MC in the inner loop and signiﬁcantly speed-up training.
This idea is justiﬁed by the fact that the distribution p adv (˜ x, y ) ∝ exp( λ(cid:96) ( f θ (˜ x ) , y )) is actually a continuous function of θ .
It can be seen with duality argument from (12) where the function h
θ ( π ) is strictly concave with respect to π which implies the continuity of θ (cid:55)→ arg max
π h θ ( π ) .
We leave as a future work the formalization of this argument.
E XPERIMENTAL R ESULTS
1: input: dataset ( x i , y i ) ni
=1 , step-size: η , number of adversarial examples: K , noise variance σ .
2: Initialization: ˜ x i,k
= x
i , i ∈ [ n ] , k ∈
[ K ] 3: for n : nb of steps do 4:
Sample a minibatch: ( x i , y i ) i ∈ B , B ⊂ [ n ] 5:
Load the attacks: ˜ x (0) i,k ← ˜ x i,k , i ∈ B, k ∈
[ K ] 6: for T : nb langevin iter do 7: for i ∈ B, k ∈
[ K ] do 8: ˜ x ( t +1)
i,k ← ˜ x
( t ) i,k + η sign( ∇ x (cid:96) ( f θ (˜ x
( t +1)
i,k , y i )) 9: ˜ x
( t +1)
i,k ← P B i ( (cid:15) )
[˜ x ( t +1)
i,k + σξ ] 10: ˜ x ( t +1)
i,k ← P X
[˜ x ( t +1)
i,k ] 11: ∇ θ g = 1 | B | K (cid:80) i ∈ B,k ∈
[ K ] ∇ θ (cid:96) ( f θ (˜ x
( t +1)
i,k , y i )) 12: θ ← θ − η ∇ θ g 13:
Save the attacks: ˜ x i,k ← ˜ x ( T ) i,k , i ∈ B, k ∈ [ K ] 14: Return: θ
We investigate the Adversarial Transport Algorithm at training robust classiﬁers (for a given hypothesis class) against adversarial attacks on MNIST and CIFAR-10.
Experimental setup The experiments are realized on MNIST and CIFAR-10.
We perform all attacks and training with (cid:15) = 0 .
3 for MNIST and (cid:15) = 8 .
for CIFAR-10 (w.r.t.
to the (cid:96) ∞ norm).
We train our robustly trained classiﬁer using stochastic gradient descent with the cross-entropy loss.
We use a learning rate l r = 0 .
1 in the case of Adversarial Transport and update θ with the sign of the gradient.
For both datasets, we train our classiﬁer with 100 epochs, a batch size of 100 .
For Langevin MC parameters, we take K = 1 , η l ( λ ) = 0 .
2 and σ = 0 .
2 (i.e. λ = 2 η l σ 2 = 10 ).
In theory, we must take λ big enough to have a good approximate of the solution.
Appendix B.1 shows that in practice λ =is the best value to ensure convergence of our algorithm.
Baselines We test our robust classiﬁer
against
ﬁrst-order attacks
Fast Gradient Sign Method (FGSM) attacks [Goodfellow et al., 2014; Szegedy et al., 2014], Projected Gradient Descent (PGD) attacks with 40 iterations (PGD 40) and PGD attacks with 100 iterations (PGD 100)
[Madry et al., 2017; 2018].
We compare those results with the performance of classiﬁers adversarially trained with PGD [Goodfellow et al., 2014; Madry et al., 2017; 2018] on the same attacks (we trained PGD classiﬁers according to the method described in the paper and use the same parameters: l r = 0 .
01 , 100 epochs, trained with PGD 40 ).
All the attacks are generated via the library Advertorch of Pytorch 3 .
The attacks are (cid:96) ∞ bounded.
Additional details concerning the tuning of hyperparameters and hypothesis classes used are given in the Appendix B.1 4 .
We evalute white-box attacks (i.e. we have access to the gradient of the model we want to attack).
The results are provided below:
5. P ERFORMANCE ON MNIST
We ﬁrst compare both methods on MNIST, the architecture is the same for both frameworks and is described in the Appendix B.2.
We make two main observations, ﬁrst training the model using
Langevin improves the overall robustness of the classiﬁer against all attackers we tested against as shown in Table 1.
Secondly, by re-using the samples from the previous iterations we converge much faster, indeed for each update of the classiﬁers we only need to do one back-propagation instead.
This leads to a very important speed up as observed in Fig 2.
[Figure]
[Table]
[Figure]
5. P ERFORMANCE ON CIFARPerformance
[Table]
[Figure]
C ONCLUSION
In this paper we introduce the Adversarial Transport Framework.
We derived this framework from
Adversarial Training relaxation through regularized Distributionally Robust Optimization (DRO) with ∞ - ∞ -Wasserstein distance.
The outcome of this work provides a close form of the optimal adversarial distribution against a given classiﬁer which can be sampled via Langevin Monte-Carlo.
From that we have designed an algorithm that optimally trains (for a given hypothesis class) a classiﬁer against adversarial examples.
The major asset of our work, which surely justiﬁes these outstanding results is that it considers the problem at the scale of the entire dataset and not at the scale of the example.
Our algorithm brings several novelties: at each iteration, we perform a gradient ascent on the distribution and a gradient descent on the classiﬁer.
For this, we keep in memory the current distribution of adversarial examples and iterate on it at each step.
In addition, only one iteration of Langevin MC is necessary at each step.
As a result, our experiments show that the Adversarial
Transport classiﬁer outperforms PGD trained classiﬁer on MNIST and CIFAR-10, but also that our algorithm allows us to train it much faster than with PGD thanks to the novelties described above.
A P ROOFS OF THEORETICAL RESULTS
Proposition 2.1.
The adversarial training problem (1) can be formulated as a DRO problem (2) where:
[Equation]
Proof of Proposition 2.1.
Let us start with the original adversarial training problem:
[Equation]
Let us call T ( x ) :
= ˜ x , thus, we have
[Equation]
By deﬁnition of the pushforward measure we have that
[Equation]
which conclude our proof since then it is equivalent to maximize over T or p adv = T (cid:93) p data .
Proposition 3.1.
The DRO problem (2) can be relaxed by considering coupling measure.
In that case the constraint set P in Equation 2 take the form:
P conv = { p adv : ∃ π ∈ Π( p data | p adv ) with supp( π ) ⊂ { ( x, y, ˜ x, y ) | (cid:107) ˜ x − x (cid:107) ∞ ≤ (cid:15), y ∈ Y }} .
Proof of Proposition 3.1.
We will prove that
[Equation]
and that P conv is convex.
First let us start by showing that,
[Equation]
Let us consider p adv ∈ P .
By deﬁnition of P there exists T : X → X such that p adv =
T (cid:93) p data and (cid:107) T ( x ) − x (cid:107) ∞ ≤ (cid:15) .
Now, we can deﬁne the coupling measure π T :
=
( I d , I d , T, I d ) (cid:93) p data where ( I d , I d , T, I d )( x, y ) =
( x, y, T ( x ) , y ) .
We can verify that π T ∈ Π( p data | T (cid:93) p data ) and that by deﬁnition of T , we have supp π T ⊂ { ( x, y, ˜ x, y ) s.t.
(cid:107) ˜ x − x (cid:107) ∞ ≤ (cid:15), x, x (cid:48)
∈ X , y ∈ Y } .
Finally, let us prove that P conv is convex.
Let us consider p 1 , p 2 ∈ P conv and λ ∈ [0 , 1] .
By deﬁnition of P conv , we know that there exists π 1 ∈ Π( p data | p 1 ) and π 2 ∈ Π( p data | p 2 ) such that supp( π 1 ) and supp( π 2 ) are included in { ( x, y, ˜ x, y ) s.t.
(cid:107) ˜ x − x (cid:107) ∞ ≤ (cid:15), x, x (cid:48)
∈ X , y ∈ Y } .
By linearity of the marginalization we have that λπ 1 + (1 − λ )
π 2 ∈ Π( p data | λp 1 + (1 − λ ) p 2 ) .
Moreoevr, we have that supp( λπ 1 + (1 − λ )
π 2 )
= supp( π 1 ) ∪ supp( π 2 ) ⊂ { ( x, y, ˜ x, y ) s.t. (cid:107) ˜
x
− x (cid:107) ∞ ≤ (cid:15), x, x (cid:48) ∈
X , y ∈ Y } .
Thus we have λp 1 +(1 − λ ) p 2 ∈ P conv .
It concludes the fact that P conv is convex.
Proposition 3.2 (convex relaxation of adversarial training) .
The convex DRO relaxation of adversarial training can be reformulated as
[Equation]
where B (cid:15) ( p data ) = { p | W ∞ , ∞ ( p, p data ) ≤ (cid:15) } and W p, ∞ is deﬁned in (9) .
Proof of Proposition 3.2.
Under mild assumptions (see the assumption of [Villani, 2009, Prop 5.21])
B (cid:15) ( p data ) =
{ p | W ∞ , ∞ ( p, p data ) ≤ (cid:15) } =
P conv .
p adv ∈ P conv ⇐⇒ ∃ π ∈ Π( p data | p adv ) with supp( π ) ⊂ { ( x, y, ˜ x, y ) | (cid:107) ˜ x − x (cid:107) ∞ ≤ (cid:15), y ∈ Y } (26) ⇐⇒ ∃ π ∈ Π( p data | p adv ) with sup (
[Equation] [Equation]
(cid:107)
[Equation]
(cid:107)
[Equation]
≤ (cid:15) (27) ⇐⇒
[Equation]
Note that the second equivalence is possible because (cid:15) <
[Equation]
y (cid:54) =
y (cid:48) | y − y (cid:48) | and the third one because the minimum is achieved by compactness of Π( p data | p adv ) (see [Villani, 2009, Prop 5.21]).
Proposition 3.3.
If λ → ∞ , then π ∗ λ → π ∗ .
Proof of Proposition 3.3.
The proof is similar to the proof of Proposition 4.1 from Peyré and Cuturi [2019] since P is compact.
Proposition A.1.
For any given θ ∈ R d , the function h θ ( π ) =
E (˜ x,y ) ∼ p
adv [ [Equation] ( f θ (˜ x ) , y )]
+ 1 λ H ( π ) is strictly-concave and the constraints on P are convex.
Proof.
P and F are convex sets: both constraints of P are linear, and is convex by F by assumptions.
Moreover,
• h θ ( π ) is the sum of a concave term and a strongly concave term.
Indeed:
– π → E (˜ x,y ) ∼ p
adv [ (cid:96) ( f θ (˜ x ) , y )] concave in π by linearity.
– π → 1 λ H ( π ) is strongly concave in π . • θ
→ h θ ( π ) is convex by convexity of l (e.g. mean squared loss, cross entropy loss, ...).
Proposition 3.4.
For any given θ ∈ R d , The optimization problem (12) has a unique solution,
[Equation]
For a given natural example x with a label y , π ( z, ˜ z ) grows with the propensity of ˜ x to be better than the other elements of B x ( (cid:15) )
(the (cid:96) ∞ -ball of radius (cid:15) ) to fool the classiﬁer.
We then deduce the explicit form of the adversarial distribution:
[Equation]
Proof of Proposition 3.4.
The objective function is concave and at the optimum π ∗ (( x, y ) , (˜ x, y )) > 0 for each ( x, ˜ x, y ) s.t.
(cid:107) x − ˜ x (cid:107) ≤
(cid:15) .
The objective function is C 1 in the neighborhood of π ∗ .
Thus, we can introduce dual variable α : R → R s.t.
∇ π L ( π ∗ , α ) = 0 .
The Lagrangian function L is: L (
[Equation]
[Equation]
[Equation] [Equation]
[Equation]
So at the optimum, for each (( x, y ) , (˜ x, y )) s.t.
(cid:107) x − ˜ x (cid:107) ≤ (cid:15)
, we have π ∗ (( x, y ) , (˜ x, y )) = [Equation] x [Equation]
y ))
[Equation] λα [Equation] x
[Equation] y ))) . In addition, we know that (cid:82) [Equation]
[Equation] ( x, y [Equation] , (˜ x, y ))
=
p data ( x, y ) , thus exp( − λα ∗ ( x, y ))
=
p data ( x, y )
[Equation]
[Equation]
λ ( [Equation] [Equation] x
[Equation]
,y
[Equation]
d ˜ x .
Therefore, for each (( x, y ) , (˜ x, y ))
s.t. (cid:107) x − ˜ x (cid:107) ≤ (cid:15) :
π
[Equation]
[Equation]
x, y
[Equation]
[Table]
[Equation] [Table] [Equation] [Table]
[Equation]
[Table]
[Table]
And π (( x, y )(˜ x, y ))
=
for each (( x, y ) , (˜ x, y ))
s.t. (cid:107) x − ˜ x (cid:107) > (cid:15) , i.e.: π ∗ (( x, y ) , (˜ x, y )) =
p data ( x, y ) exp( λ ( (cid:96) ( f [Table] [Table] x ) , y ))) (cid:82)
[Table]
[Equation]
[Table]
x [Table] [Table] [Table]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table] [Equation] [Table]
[Equation]
π [Equation]
[Table]
y
[Equation]
[Table]
[Equation]
∝ p data
[Table]
[Equation]
Therefore
[Equation]
we have that:
[Equation]
Proposition 3.5.
Let us call E (˜ x,y ) ∼ p
adv [ (cid:96) ( f θ (˜ x ) , y )]
+ 1 λ H ( π ) =
ϕ ( θ, π ) .
If { f θ | θ ∈ Θ } is a convex set
[Equation]
then we have that
[Equation]
36) where P = { p adv : ∃ π ∈ Π( p x,data | x , p x,adv ) with π (( z ) , (˜ x, y ))
= 0 , ∀ x, ˜ x ∈ X s.t. (cid:107) ˜
x
− x (cid:107) ∞ > (cid:15) } .
Proof.
The proof is similar to the proof of Theorem 28 from Merigot and Thibert [2020].
Proposition 3.6.
Let us assume that the datapoints x i are independently sampled from a distribution p over [0 , 1] d that is absolutely continuous with respect to Lesbegue measure and has a upper-bounded value, i.e. p ( x ) ≤ M , x ∈ [0 , 1] d .
Then P ( ∃ i (cid:54) =
j ∈ [ n ] , (cid:107) ˜ x
j − x i (cid:107) ∞ ≤ (cid:15) )
=
O ( n 2 (cid:15) d ) .
Proof of Proposition 3.6.
Let us consider the quantity
[Equation]
Theorem 3.2 (Characterization of the solutions in the semi discrete case) .
For any λ > 0 , the solution set of the regularized adversarial training problem (11) is:
[Equation]
and under Assumption
[Equation]
1 the optimal adversarial distribution associated with this adversarial training problem is
[Equation]
otherwise.
[Equation]
[Equation]
Proof of Theorem 3.
[Equation]
From Proposition 3.5:
[Equation]
Finally
[Equation]
the probability distribution of the adversarial examples p adv is written:
[Equation]
In practice: ∀ i p data i = 1 n , so we have:
[Equation]
otherwise.
and then,
[Equation]
B A DDITIONAL RESULTS B. T UNING OF HYPERPARAMETERS
In this section, we detail the tuning of different hyperparameters.
Among them:
• T :
The number of Langevin iterations for crafting adversaries during the training process.
• σ : Represents the noise which is the particularity of the Langevin.
Indeed, it differs from the gradient descent by the addition of Gaussian noise.
The noise allows adding randomness in the crafting of adversarial examples.
Thus, the size of the noise, as well as its shape, are of primary importance in the performance of Langevin.
For example, a too important noise will generate totally random examples and will erase the weight of the gradient.
• η l = λ × γ : represents the learning rate of Langevin MC.
The parameter represents the learning rate of Langevin.
In general, even if T ≥ 2 , we only keep the last batch of adversarial examples for updating θ .
Here, all the results are presented for T = 1 which gives the best results and the best computation time.
A further study could analyze the inﬂuence of using more batches of adversarial examples at each epoch of the training.
The results for the inﬂuence of σ and η l ( λ ) are provided below:
We did the same experiment with other values of η l ( λ ) but whatever the value of σ , η l ( λ )
=
.gives the best result.
The two curves are similar.
We notice that the method converges only for small range of values of these hyperparameters.
Regarding that λ = 2 η l σ 2 , these experiments show that the best value for λ we can take is λ = 10 .
These graphs justify the fact that our whole study was conducted with η l ( λ ) = 0 .
2 and σ = 0 .
B. M ODELS ARCHITECTURE
We study the inﬂuence of the architecture of the neural network on the performance of our model.
We test our algorithm with the two models below.
Model B is the one used by Madry et al.
[2018] for the PGD framework.
[Table] [Table]
are better than for architecture A.
Especially, we notice that there is no loss of performance between PGD 40 attacks and PGD 100 attacks.
As explained in Madry et al.
[2018], networks with larger capacity are stronger against adversarial attacks. [Table]