F LEXIBLE R ELATION P RESERVING FOR A DVERSARIAL T RAINING
Anonymous authors
Paper under double-blind review
A BSTRACT
In this study, we revisit the representation learning problem for adversarial training from the perspective of relation preservation.
Typical adversarial training methods tend to pull clean and adversarial samples closer to improve robustness.
However, our experimental analysis reveals that such operation would lead to cluttered feature representations thus decreasing the accuracy for both clean and adversarial samples.
To alleviate the problem, we build a robust discriminative feature space for both clean and adversarial samples by taking into account a relational prior which preserves the relationship between features of clean samples.
A flexible relationship preserving adversarial training (FRPAT) strategy is proposed to transfer the well-generalized relational structure of the standard training model into the adversarial training model.
Moreover, it acts as an extra regularization term mathematically, making it easy to be combined with various popular adversarial training algorithms in a plug-and-play way to achieve the best of both worlds.
Extensive experiments on CIFAR10 and CIFAR100 demonstrate the superiority of our algorithm.
Without additional data, it improves clean generalizability up to 8.78% and robust generalizability up to 3.04% on these datasets.
I NTRODUCTION
Deep neural networks have a tremendous impact on various research directions, such as selfdriving (Bojarski et al., 2016), speech recognition (Nassif et al., 2019), machine translation (Stahlberg, 2020), and more.
However, DNNs are observed to be vulnerable to adversarial examples, which are normal data with human imperceptible perturbations (Szegedy et al., 2014).
Recently, various adversarial defense methods (Madry et al., 2017; Xie et al., 2017; Dhillon et al., 2018; Zhang et al., 2019; Bashivan et al., 2021; Sarkar et al., 2021) have been proposed.
Adversarial training proves to be the most powerful way to improve adversarial robustness by generating adversarial examples as data augmentation during training (Schott et al., 2018; Pang et al., 2021; Maini et al., 2020).
Compared with standard training, adversarial training methods (Madry et al., 2017; Zhang et al., 2019; Wang et al., 2019; Li et al., 2021) improve the model robustness by aligning the representations of clean data and adversarial samples or classifying the adversarial data correctly.
As illustrated in Fig.
1a, generated adversarial samples are distributed differently to natural samples and misclassified by standard training models; by narrowing the distance between natural and corresponding adversarial samples, adversarial training models could handle part of adversarial samples.
As shown in Fig.
1b, the feature representation for clean samples are influenced by adversarial training and thus results in cluttered over-smoothing feature space.
Some existing works try to mitigate the over-smoothing representation by distilling the logits of the standard training model (Cui et al., 2021; Chen & Lee, 2021; Arani et al., 2020).
However, these point-wise distilling models ignore the geometric properties of the feature space which is important for improving the model generalization (Belkin et al., 2006).
In this paper, we qualitatively and quantitatively analyzed the correlation between the adversarial strengths and the inter-sample relationships.
Visualizations also proof that standard training will make the features for clean and adversarial samples distributed unevenly while adversarial training tends to make the features less discriminate.
We build k -nearest neighbor graph with the features of clean and adversarial samples and then measure the manifold quality by conducting k -NN classification on the graph.
Different adversarial strengths under various neighbor numbers are tested.
Results show an
CleanData
Clean Distribution
Adversarial Data
Inter-samples Relationship
Decision Boundary 𝑎𝑎𝑎𝑎𝑎𝑎𝑏𝑏𝑏𝑏𝑏𝑏�𝑏𝑏�𝑏𝑏�𝑏𝑏�𝑎𝑎�𝑎𝑎�𝑎𝑎(a)
Standard training 𝑎𝑎𝑎𝑎𝑎𝑎 1 𝑏𝑏𝑏𝑏𝑏𝑏�𝑏𝑏�𝑏𝑏�𝑏𝑏�𝑎𝑎�𝑎𝑎�𝑎𝑎(b)
Adversarial training 𝑎𝑎𝑎𝑎𝑎𝑎𝑏𝑏𝑏𝑏𝑏𝑏�𝑏𝑏�𝑏𝑏 2 �𝑏𝑏�𝑎𝑎�𝑎𝑎�𝑎𝑎(c)
Ours obvious connection between the adversarial strength and the quality of geometric structure of the feature space (See Sec.
2.2 for more details).
Based on these observations, we propose a flexible relation preserving adversarial training (FPRAT) approach to keep the feature relation of standard training models.
Two models are involved for
FRPAT: one for standard training on clean samples and the other for adversarial training.
Graph for each model is built based on the relationship of different samples.
Considering the great gap between standard and adversarial models because of adversarial training smoothness effects, we define flexibly the relationship of samples as the probability that different samples are neighbors, and relational distillation is achieved by aligning the probability distributions of the two graphs.
As illustrated in Fig.
1c, FPRAT preserves well-generalizable inter-sample relationships of clean samples from the standard model, to avoid the clean representations being pulled away by the adversarial representations during adversarial training.
Our contributions are as follows:
• We reveal that adversarial training strength is negatively correlated with inter-sample relationships in representation spaces, which provides a new view for solving the generalization problem of adversarial robustness.
• We propose a flexible relation preserving regularization to flexibly preserve the inter-sample relationship structure during adversarial training, which could work in a plug-and-play way combined with various adversarial training approaches.
• Extensive quantitative and qualitative experiments on both CIFAR10 and CIFAR100 datasets show the effectiveness of the proposed FRPAT (maximum 8 .
78% improvement for the clean sample accuracy and 3 .
04% for the robust accuracy).
M ETHODS 2. P RELIMINARY
Adversarial training generates adversarial examples as training data to defend against adversarial attacks.
Madry et al.
(2017) makes use of projected gradient descent (PGD) to generate adversarial data, and for the first time formally define the goal of adversarial training as:
[Equation]
where D is the data distribution for input x and its corresponding label y , θ is the model parameters.
δ stands for the perturbation applied to x and is usually limited by perturbation size ϵ .
S =
[Figure]
15 6 3384042 k = 50 k = 30 k =
R e l a t i o n s h
i p S
c
o r e
Adversarial Strength (d
[Figure]
Correlation between adver- sarialtrainingstrengthandintersamplerelationships
(cid:110) δ | ∥
δ ∥ p ≤ ϵ (cid:111) is the feasible domain for δ .
L ( · ) usually is the cross-entropy loss for classification.
By min-max gaming, adversarial training aims to correctly recognize all adversarial examples ( (cid:101) x
= x + δ ).
2. E MPIRICAL A NALYSIS OF THE FEATURE STRUCTURE FOR ADVERSARIAL TRAINING
In this section, we analyze how adversarial training influences feature relationships compared with standard training models.
Here standard training models refer to the model without adversarial training, and their architectures are ResNet18.
Adversarial training models are trained by TRADES with different β which means different adversarial training strengths.
We choose the penultimate layer representations (before logits) of the standard training model and adversarial training models for qualitative and quantitative experimental analysis.
As shown in Fig.
2a, compared with the standard training model both on the test set and training set, the representation visualization for adversarial training models shows more robustness, but worse relationships among different data resulting in lower discrimination in different classes.
To accurately analyze the correlation between adversarial training strength and the relationship between samples, we conduct quantitative analysis by setting the β = 1 , 2 , ..., 6 for TRADES.
The larger β represents the greater strength of adversarial training.
We use k -NN to evaluate the quality of inter-sample relationships for different models, which is often used in manifold learning (Van der
Maaten & Hinton, 2008; McInnes et al., 2018) to evaluate the quality of manifolds.
Specifically, we first use PGD- 20 ( ϵ = 0 .
to generate adversarial data for CIFAR-100 dataset, then we use both clean and adversarial data in the training set as the support set to predict the labels of all the examples in the test set.
To verify the reliability of the observation conclusion, we choose k = 5 , 30 , 50 , respectively.
Finally, the k -NN accuracy is used as the relationship score for the learned feature space.
The higher the score, the more reasonable the relationship between the samples.
Fig.
2d shows the strength of adversarial training for different models and their corresponding relationship qualities for different k .
A negative correlation between the strength of adversarial training and the relationship quality between samples could be observed.
Why does adversarial training destroy inter-sample relationships?
Adversarial representations are usually far away from their true class distribution.
Therefore, the existing adversarial training algorithms will make the representation of clean samples further away from true class distribution while narrowing the adversarial representation and clean representation.
Compared with the standard training model, the relationship between samples of the adversarial training model is worse.
Zhang et al.
(2021) point out that adversarial training is equivalent to a special kind of regularization and has a strong smoothing effect, which also supports our view.
To mitigate the negative impact of close adversarial samples and clean samples, and maintain the inter-sample relationship, we use the inter-sample relationship of the standard training model as prior knowledge to guide the adversarial training and improve the generalization of the model.
2. F LEXIBLE R ELATION P RESERVING A DVERSARIAL T RAINING
To relieve the overwhelming smoothing effect Zhang et al.
(2021) caused by adversarial training, we consider building a robust discriminative feature space for both clean samples and adversarial samples by transferring the structure prior contained in the model trained on clean data to the adversarial training model.
We train two models simultaneously: a standard training model M on clean input x with cross-entropy loss L st ( · ) and an adversarial training model (cid:102) M on (cid:101) x which is updated by a specific adversarial training algorithm.
Furthermore, to prevent the feature space of (cid:102) M from being over smoothing, we transfer the knowledge of M to (cid:102) M .
The overall optimizing objective L at ( · ) of (cid:102) M is formulated as:
[Equation]
where L robust ( · ) stands for the adversarial training loss and L RP ( · ) works as a regularization item to bound the over smoothing feature distribution of (cid:102) M by the learned discriminative feature space of M .
Absolute Relationship Preservation.
The geometry/structural knowledge means the relationship graph constructed by the similarity between samples or approximated as the manifolds they form.
It can be formalized as:
[Equation]
where P and Q stand for the relationship graph constructed by the inter-sample similarity for M and (cid:102) M , respectively.
F ( · ) measures the similarity of two relationships.
A straightforward way to construct the relation graph P and Q could be directly applying cosine distance to calculate the distances of any two samples in the high dimensional feature space of M and (cid:102) M :
[Equation]
where d ij and (cid:101) d ij are defined as:
[Equation]
However, there is a huge difference in the feature space between adversarial training and standard training due to the over-smoothing in adversarial training.
Thus direct absolute relationship distillation is difficult to optimize.
Flexible Relationship Preservation.
Considering the great gap between standard and adversarial models because of adversarial training smoothness effects, we define flexibly the relationship of samples as the probability that different samples are neighbors, and relational distillation is achieved by aligning the probability distributions of the two graphs; we model the conditional probability distribution with a cosine similarity-based affinity metric for relation graph construction:
[Equation]
where p i | j is the conditional probability that the i th clean sample is the neighbor of the j th clean sample in the feature space of M .
ρ j represents the distance from the j th data point to its nearest neighbor.
Subtracting ρ
j ensures the local connectivity of the manifold, avoiding isolated points and thus better preserves the global structure (McInnes et al., 2018).
Similarly, the relationship graph for (cid:102)
M is:
[Equation]
We use cross-entropy loss to measure the similarity of P and Q for such flexible relationships.
Finally, the L RP for FRPAT is:
[Equation]
Note that the proposed FRPAT could be applied to other adversarial training methods in a plug-andplay way.
Alg.
1 shows the overall process for the flexible relation preserving adversarial training method.
Discussion LBGAT (Cui et al., 2021) also involves two models and transfers the prior knowledge of M to (cid:102) M .
By directly distilling the logits of clean samples x from M to the logits of corresponding adversarial sample (cid:101) x on (cid:102) M , LBGAT guides the adversarial training model’s feature boundary of different categories to inherit from the clean model.
Since the clean model is trained independently from (cid:101) x , the logits of x by M is quite different from that for (cid:101) x by (cid:102) M .
Thus LBGAT needs to update not only (cid:102) M but also M by L RP ( · ) , which conversely introduces the smoothing effect to M (see
Sec.
2.2 for more details).
In this study, we propose to build a robust discriminative feature space for (cid:102) M by transferring the geometry/structural knowledge of M .
Require: the step size of perturbations ϵ , batch size n , learning rate α , attack algorithm optimization iteration times K , the number of training epochs T , adversarial training model (cid:102) M with its parameters (cid:101) θ , standard training model M with its parameters θ , loss weight λ and training dataset ( x
, y ) ∈ D
Ensure: robust model (cid:102) M with (cid:101) θ 1: Randomly initialize , (cid:101) θ 2: for i do 3:
Sampling a random mini-batch X
= { x 1 , x 2 , ..., x n } and corresponding labels Y =
{ y 1 , y 2 , ... y n } D 4:
Generating adversarial data (cid:101)
X
= { (cid:101) x 1 , (cid:101) x 2 , ..., (cid:101) x n } through attack algorithms (such as PGD,
FGSM) 5:
X = (cid:102) M
( (cid:101) X ) 7:
Evaluate L st = CE ( softmax ( logit X )) 8:
Evaluate L at = λL RP + L robust 9:
Update model parameters: 10: θ = θ − α 1 n (cid:80) ni
=1 ∇ θ L st 11: (cid:101) θ = (cid:101) θ − α 1 n (cid:80) ni
=1 ∇ (cid:101) θ
L at 12: end for
E XPERIMENTS 3. E XPERIMENTAL S ETTINGS
Datasets We choose CIFAR10 and CIFAR100 datasets (Krizhevsky et al., 2009) to validate our algorithm.
CIFAR10 contains 60 , 000 images with the category number of ten in total, in which 50 , 000 are in the training set and 10 , 000 in the test set.
CIFAR100 contains 60 , 000 images from 100 categories, and the numbers of images in the training and testing set are the same as CIFAR10.
Following Cui et al.
(2021), the input size of each image is 32 × 32 , and the training data is normalized to [0 , 1] after standard data augmentation: random crops of 4 pixels padding size and random horizontal flip.
The test set is normalized to [0 , 1] without any extra augmentation.
We also report the results of Tiny ImageNet (Deng et al., 2009) in supplementary materials.
Training details For fair comparisons with LBGAT (Cui et al., 2021) which also involves two models for adversarial training, we follow the same network configurations: ResNet18 for standard training and WideResNet-34-10 for adversarial training.
Following LBGAT, the adopted adversarial attacking method during training is PGD-10, with a perturbation size ϵ = 0 .
031 , a step size of perturbations ϵ 1 = 0 .
The initial learning rate is set to 0 .
1 with a total of 100 epochs for training and reduced to 0 .
1 x at the 75 -th and 90 -th epochs.
The optimization algorithm is SGD, with the momentum of 0 .
9 and weight decay of 2 × 10 − 4 .
Baselines We choose three strong baselines to show our method’s effectiveness:
Vanilia AT (Madry et al., 2017), TRADES (Zhang et al., 2019), and LBGAT (Cui et al., 2021).
For TRADES, we set β = 6 . 0 .
For LBGAT, we conduct experiments based on Vanilla AT and TRADES ( β = 6 . 0 ).
[Table] [Table]
In addition
[Table]
we combine FRPAT with them to demonstrate the superiority of our approach.
All experiments were done on GeForce RTX 3090 with the same training configurations such as the number of epochs and learning rate schedule
[Table]
Evaluation metrics
In order to evaluate the generalization of the model on clean and adversarial samples, our evaluation metrics are clean data accuracy (Clean Acc.) and robust accuracy (Robust
Acc.).
Robust accuracy is the model classification accuracy under adversarial attacks.
We choose three representative adversarial attack methods for evaluation: PGD-20, C&W-20 (Carlini & Wagner, 2017) and Auto Attack (Croce & Hein, 2020).
We denote the model’s defense success rate under their attacks separately as PGD-20 Acc. , C&W-20 Acc. , and AA Acc.
What’s more, we use training sets as support sets and make KNN test accuracy as a relationship score following manifold analysis methods (Van der Maaten & Hinton, 2008; McInnes et al., 2018) under the PGD-20 attack.
3. M AIN R ESULTS
We conducted adequate quantitative analysis on CIFAR10 and CIFAR100, and the results show that the proposed flexible relation preserving knowledge transfer can be combined with other adversarial training algorithms to improve the data relational structure of the feature space and increase the accuracy of both clean and adversarial samples.
In the following, we will present the experimental results for each of the two datasets.
Results on CIFAR-10 According to Table.
1, our FRPAT gets an improvement by 2 .
16% compared to Vanilla AT baseline on clean data.
It surpasses Vanilla AT on PGD-20, C&W and AA accuracy by 2 .
46% , 1 . 94% respectively, indicating its high robustness.
Our method also has an edge on LBGAT by 3 . 6% to 1 . 3% in all aspects.
For another common baseline, TRADES, FRPAT also gets competitive results on both clean and adversarial data.
Note that clean accuracy decreases when applying LBGAT to TRADES, so it also brings a large enhancement when combined with our method.
For the relationship score which is measured by KNN accuracy, FRPAT could boost the performance by a large margin.
Since KNN classification is based only on inter-sample relationships, such results prove that FRPAT could help build a discriminative feature space for both clean and adversarial samples.
[Figure]
Results on CIFAR-
The overall results on CIFAR-100 are similar to CIFAR-10.
As shown in Table.
2, FRPAT performs better than Vanilla AT and LBGAT and gets a further improvement when deployed with LBGAT simultaneously.
For TRADES, our method surpasses LBGAT by a large margin ( 4 . 85% ) on clean data, with the cost of slight drops (around 1% ) on robust data.
Adding LBGAT to FRPAT causes a decrease in clean accuracy but achieves the best accuracy in
PGD-20 and C&W-20.
The above results show that the proposed FRPAT could be applied to popular adversarial training pipelines for achieving SOTA performance on both clean accuracy and robust accuracy.
Furthermore, we report the results of using the experimental setting as Jia et al.
(2022) in supplementary materials.
Qualitative analysis To demonstrate that our algorithm can indeed help the adversarial training model construct a uniform discriminative feature space, we use t-SNE to visualize samples from ten randomly selected categories in CIFAR-100 test set and all categories of the CIFAR-10 test set for qualitative analysis.
Fig.
3 shows the results.
For standard training (Fig. 3a), the clean data are well clustered, however, the adversarial samples are out of place, resulting in poor performance in robust accuracy.
TRADES guides the clean and adversarial data to be close to each other, which could improve the robust accuracy but the feature space is less discriminative (Fig. 3b).
As shown in Fig.
3c, applying the proposed FRPAT to TRADES could drive the cluster for each category be more compact.
Compared with TRADES+LBGAT (Fig. 3d), we have fewer misclassified samples in the middle section.
Finally, Fig.
3e shows the result of the combination of FRPAT and LBGAT on
TRADES, and the visualization for the clustering effect is also a composite of them.
3. A BLATION S TUDIES
In this section, we delve into FPRAT to study its effectiveness in many aspects.
All the ablation experiments are based on CIFAR-100 dataset.
The experimental settings are the same as the main results.
Different relation preserving approaches.
In this study, we propose a flexible relation preserving knowledge transfer approach to learn discriminative features for both clean samples and robust samples.
In this section, we compare our method with possible alternatives: one metric learning approach MCA (Yang et al., 2021) and two absolute relationship distillation methods RKD (Park et al., 2019) and CRD (Tian et al., 2019).
MCA applies supervised contrastive loss into adversarial training.
RKD takes the absolute value of the cosine distance between samples as the relationship as discussed in Sec. 2.3.
To distill the teacher model’s structure in feature space, CRD requires that the same sample representation of the student model is closer to the teacher model, and farther from the representation of other samples in the teacher model.
Table 4 shows the statistics.
Compared with vanilla AT, MCA improves robustness while decreasing clean generalization, which is consistent with our conjecture: only supervised contrastive loss will exacerbate the negative influence of the clean samples from the adversarial samples in the feature space.
Compared with RKD, CRD prefers to be exactly the same as the teacher model, but this is not necessary for the adversarial training task: we only need to maintain the relative relationship between the clean examples of the standard trained model.
What’s more, adversarial training models are very different from standard training models, and forcing samples to have exactly the same features is detrimental to learning.
It can also be seen from the results that our method of maintaining the relative relationship between samples achieves the optimum results.
Time costing for training.
Table 3 shows the time statistics for training one epoch (with batch size equals 128 ) by different baselines.
It takes additional 28 seconds when combined with Vanilia AT and 30 seconds on TRADES for FRPAT, which is as fast as LBGAT.
[Table]
The impact of different batch sizes.
As shown in Table 5, we tried 128 , 256 , 384 samples per batch for relation calculating.
Among them, a batch size of 256 achieves the best results, but the difference among different configurations is not large.
Overall our method is not sensitive to different batch sizes.
[Table]
ablation experiment about different batch sizes.
[Table]
Sensitivity analysis of hyper-parameter λ .
As Table 6 shows, with the increase of λ in Eq.
2, clean accuracy always gets higher, while the PGD-20 accuracy rises at first and then decreases.
It is reasonable because a large λ forces the manifold to be highly close to that of standard training, thus the robustness of the model is weakened.
[Table]
R ELATED W ORK
Adversarial Training Adversarial training is known as one of the most effective methods to improve the adversarial robustness of DNNs.
Most adversarial training algorithms (Madry et al., 2017; Zhang et al., 2019; Wang et al., 2019; Wong et al., 2020; Wu et al., 2020; Li et al., 2021;
Jia et al., 2022) focused on getting clean samples close to the representation of the adversarial samples they generate.
Madry et al.
(2017) generated adversarial examples by PGD attack method as model input during training, and based on that, Zhang et al.
(2019) proposed TRADES by punishing the model for outputting different logits of adversarial examples and their corresponding natural images, which as a regularization term adding to the cross-entropy loss.
Considering the influence of misclassified data, Wang et al.
introduced Misclassification Aware adveRsarial Training (MART), which emphasizes misclassified examples by higher weights.
Due to the large computational cost of adversarial training, Wong et al.
; Li et al.
(2021) use single-step attacks to obtain adversarial examples that greatly reduce training time.
Wu et al.
(2020) improved the adversarial robustness by flattening the weight loss landscape.
Jia et al.
(2022) proposed LAS from the view of automatically generating adversarial examples of proper epsilon.
However, They all ignored the impact of adversarial training on the relationship between samples, resulting in cluttered feature space.
There are also works (Mao et al., 2019; Yang et al., 2021; Fan et al., 2021; Bui et al., 2021) that relate to the relationship between different samples.
Mao et al.
introduced metric learning in the field of adversarial training, using triplet loss to enhance model generalization.
Yang et al.
; Fan et al.
; Bui et al.
(2021) further used contrastive learning.
However, they recognized the huge difference in the distribution of adversarial and clean samples, but did not notice the excessive impact on clean samples when narrowing them, which resulted in that they did not effectively improve the sample relationship.
Knowledge Distillation in Adversarial Training Knowledge distillation (Passalis & Tefas, 2018; Tung & Mori, 2019; Park et al., 2019; Zhu et al., 2021) can transfer the ability of the teacher network to the student network and is often used to achieve model compression.
Goldblum et al.
Zi et al.
(2021) distilled large robust models for robust model compression.
Arani et al.
; Cui et al.
; Chen & Lee (2021) distilled the clean data logits of the standard training model to enhance adversarial training on clean accuracy.
Chen & Lee (2021) considered additional temperature factor during distillation.
However, they did not constrain the relationship between samples, and their distillation loss updates both standard and adversarially-trained models at the same time.
Therefore, they were also negatively affected by adversarial examples.
C ONCLUSIONS AND F UTURE W ORK
Adversarial training shows significant over smoothing in the model feature space and results in poor generalization.
Different from previous algorithms, we propose Flexible Relation Preserving for
Adversarial Training (FRPAT) from the perspective of inter-sample relationships.
It improves the clustering in the adversarial training feature space by migrating the relationships between clean samples of the standard training model.
Because the adversarial training will make the clean samples close to the feature distribution of their generated adversarial samples, the clean sample generalization and robust generalization will be improved.
FRPAT is simple yet effective.
On the CIFAR10 and
CIFAR100 datasets, we get a maximum improvement of 8 . 78% in clean sample accuracy and 3 .
04% in robust accuracy, demonstrating that our method does help the adversarial training model to constitute a better inter-sample relationship through visualization.
There are a few future directions we plan to pursue.
First, FRPAT is a label-free algorithm, so it can be naturally applied to various unlabeled data.
Second, we can distill the inter-sample relationships of pre-trained models, even across modalities, since FRPAT is only related to the feature space regardless of the label space and the model architecture.
Third, FRPAT introduces a new perspective to the combination of transfer learning and adversarial robustness.
We transfer the relationship between samples as a whole instead of one-to-one, which could be an inspiration for other works.
REPRODUCIBILITY STATEMENT
We provide core source codes in the supplementary material, and detailed experimental settings in the paper.
ETHICS STATEMENT
FRPAT can be used in combination with other adversarial training algorithms to further improve the classification accuracy of the model for unknown samples, enhance the robust security of the model, and reduce the possibility of criminals using adversarial attacks to cause nefarious effects.
But there is still a lot of room for improvement to achieve a fully robust model.
Supplementary Materials for “FLEXIBLE RELATION PRESERVING FOR ADVERSARIAL TRAINING”
Here we will introduce more details about our method and experiments.
A M ORE D ETAILS ABOUT O UR M ETHODS
Here we show more details about how we get the relationships between samples.
Inspired by t-SNE and UMAP (Van der Maaten & Hinton, 2008; McInnes et al., 2018), we want to use the conditional probability distribution to represent relationships between samples.
t-SNE and UMAP make use of the regular Kernel Density Estimation (KDE) for approximations of the conditional probabilities.
It has too many hyper-parameters to tune, and the training cost is unacceptable for us.
So followed by
PKT (Passalis & Tefas, 2018), we use the cosine similarity-based affinity metric.
[Equation]
where f ( x i ) is the feature of the i -th sample, d ij is the cosine distance between x i and x j , and K cos is cosine similarity-based affinity metric value for x i and x j .
Moreover, we are also inspired by UMAP to better preserve the global structure of feature space by adding ρ j , which is the distance between x j and its nearest neighbor.
[Equation]
Finally, after normalization, we can get the probability that x i is a neighbor of x j by K cos for the standard training model.
[Equation]
Similarly, for the adversarial training model:
[Equation]
To make it easier for the reader to understand our method, we show the pipeline of the method in
Fig.
What’s more, when combined with Vanilla AT, L robust = CE ( softmax ( (cid:102) M
( (cid:101) X ))) ; when combined with LBGAT and Vanilla AT, L robust [Equation]
MSE ( M ( (cid:101) X ) , (cid:102) M ( (cid:101) X )) ; when combined with TRADES, L robust = CE ( softmax ( (cid:102) M ( X ))) + β ∗ KL ( (cid:102)
M ( X ) , (cid:102) M
( (cid:101) X )) ; and when combined with LBGAT and TRADES, L robust = MSE ( M ( (cid:101) X ) , (cid:102) M ( (cid:101) X )) + β ∗ KL ( (cid:102) M ( X ) , (cid:102) M ( (cid:101) X ))
StandardTraining
Model
[Table]
�𝑋𝑋 𝑋𝑋 𝐷𝐷 𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐴𝐴 𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝐵𝐵 𝐷𝐷 𝑐𝑐𝑎𝑎𝑎𝑎 𝑓𝑓 𝑓𝑓 & ̃𝑓𝑓 𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝐶𝐶𝑃𝑃𝑃𝑃𝐶𝐶𝑃𝑃𝐶𝐶𝑃𝑃𝑃𝑃𝑃𝑃 𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝑃𝐶𝐶𝑃𝑃𝑃𝑃𝐶𝐶𝑃𝑃𝐶𝐶𝑃𝑃𝑃𝑃𝑃𝑃 𝐿𝐿 𝑆𝑆𝑆𝑆 𝐿𝐿 𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟 𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝑓𝑓𝑃𝑃𝑃𝑃𝐶𝐶𝑃𝑃𝑃𝑃𝑃𝑃𝐶𝐶𝐻𝐻𝐻𝐻𝐶𝐶𝐻𝐻 𝐶𝐶𝐶𝐶𝐶𝐶𝐶𝑓𝑓𝑃𝑃𝑃𝑃𝐶𝐶𝑃𝑃𝑃𝑃𝑃𝑃𝐶𝐶𝐻𝐻𝐻𝐻𝐶𝐶𝐻𝐻 𝑃𝑃 𝑄𝑄
Standard Training
Adversarial Training
Ours
Flexible Relation Preserving Knowledge Transfer
[Table]
B M ORE R ESULTS
Training details Here we will add more training details.
Firstly, for different experiment settings, we choose different λ .
We set λ
= 5 on CIFAR-10 dataset
[Table]
and λ = 20 γ on CIFAR-100 dataset, where γ = 1+ e − 10 t 100 − 1 and t is the current t -th epoch during training.
Moreover, all our experimental results are reproducible with random seed = 1 .
Finally, we also provided our core code in the supplementary material
[Table]
and all the existing assets we used chose MIT license.
Experiments on Tiny ImageNet.
To verify the effectiveness of our method on a larger dataset
[Table]
we conduct new experiments on Tiny ImageNet (Deng et al., 2009), which contains 120 , 000 64 ×color images in classes.
Experimental settings are the same as LBGAT.
* are the results directly quoted from LBGAT.
For the training set, we resize the image from 64 × 64 to 32 ×
[Table]
and the data augmentation is random crops with 4 pixels of padding; finally, we normalize pixel values to [0,1].
For test set, we resize the image to 32 × 32 , and normalize pixel values to [0,1].
Others are the same as CIFAR-100 and CIFAR-10.
As shown in Table.
1, combined with our algorithm can further improve the clean sample generalization and robustness of TRADSES and LBGAT. [Table] [Table]
Ablations on Different teacher architectures.
As shown in Table.
[Table] our approach is not sensitive to standard training model architectures [Table] as ResNet18 has achieved comparable results to
WideresNet34-10 on the CIFAR datasets.
Here we also show that our algorithm can further improve the performance of the LBGAT algorithm under the TRADES ( β = 0 ) experimental setting (Table. 3)
[Table]
Moreover
[Table]
we also show our methods can alleviate the overfitting of adversarial training and get better performance both on the best epoch model and the last epoch model.
(Table.
5 and Table.
More discussion about LBGAT.
As shown in Table.
[Table]
we find that if only the adversarial training model is updated for the distillation loss of LBGAT ( LBGAT detach ), the clean accuracy of the model will be further improved
[Table]
but the robustness will be decreased
[Table]
and it is difficult to converge in the training stage, which verifies our speculation.
C N EW R ESULTS
New experimental settings To compared with LAS (Jia et al., 2022), a state-of-the-art adversarial training method, we also follow Jia et al.
(2022) to rerun our experiments.
ϵ is 8/255.
The initial learning rate is set to 0.1 with a total of 110 epochs for training and reduced to 0.1x at the 100-th and 105-th epochs.
Weight decay is 5e-4; other experimental Settings are the same as in the main text.
Quantitative experiment results As shown in Table.
7 and Table.
8, our algorithm has obvious advantages in clean accuracy and achieves better or comparable results in defense accuracy of different attack methods compared with most popular adversarial training algorithms.
TRADES and LBGAT achieve significant improvement in clean sample generalization by combining with our algorithm, and the robust generalization is also relatively improved or maintained. Compared
[Table] [Table] [Table] with SOTA method LAS-TRADES, We also have clear advantages in clean sample accuracy and robustness.
[Table]
[Table]