Optimization for Robustness Evaluation beyond ℓ p Metrics
Abstract
Empirical evaluation of deep learning models against adversarial attacks entails solving nontrivial constrained optimization problems.
Popular algorithms for solving these constrained problems rely on projected gradient descent (PGD) and require careful tuning of multiple hyperparameters.
Moreover, PGD can only handle ℓ 1 , ℓ 2 , and ℓ ∞ attack models due to the use of analytical projectors.
In this paper, we introduce a novel algorithmic framework that blends a general-purpose constrainedoptimization solver
PyGRANSO , W ith C onstraint-
F olding (PWCF), to add reliability and generality to robustness evaluation.
PWCF 1) finds good-quality solutions without the need of delicate hyperparameter tuning, and 2) can handle general attack models, e.g., general ℓ p ( p > 0 ) and perceptual attacks, which are inaccessible to PGD-based algorithms.
Future updates on this topic will be posted at https://arxiv.org/abs/2210.
1. Introduction
In visual recognition, deep neural networks (DNNs) are not robust against perturbations that are easily discounted by human perception—either adversarially constructed or naturally occurring [2, 10, 11, 13–15, 26, 28, 29].
A popular way of finding an adversarial perturbation (a.k.a adversarial attack) is by solving the adversarial loss formulation [19]:
[Equation]
Here, f θ is the DNN model, and ∆( x ) is an allowable perturbation set with radius ε as measured by the metric d .
Early works assume ∆( x ) is the ℓ p norm ball intersected with the natural image box, i.e., { x ′ ∈ [0 , 1] n : ∥ x − x ′ ∥
p ≤ ε } , where p = 1 , 2 , ∞ are popular choices [11, 19].
To capture visually realistic perturbations, recent works have also modeled nontrivial transformations using non- ℓ p metrics [2, 10, 13–16, 28, 29].
As for empirical robustness evaluation (RE), solutions of Eq.
(1) lead to the worst-case perturbations to fool f θ .
But solving Eq.
(1) is not easy: the objective is non-concave for typical choices of loss ℓ and model f θ ; for non- ℓ p metrics, ∆( x ) is often a complicated nonconvex set.
In practice, there are two major lines of algorithms: (a) direct numerical maximization that takes differentiable ℓ and f θ , and tries direct maximization, e.g., using gradient-based methods [8, 19].
This often only produces a suboptimal solution and can lead to overoptimistic RE; (b) upper-bound maximization that constructs tractable upper bounds for the margin loss ℓ ML = max i ̸
= y f i θ ( x ′ )
− f y θ ( x ′ ) , where y is the true class of x , and then optimizes against the upper bounds [25].
Improving the tightness of the upper bounding while maintaining tractability is still an active area of research.
Another formalism of robustness is the robustness radius (or minimum distortion radius), defined as the minimal level of perturbation that causes f θ to change its predicted class:
[Equation]
Solving Eq.
(2) produces not only a minimally distorted perturbation x ′ , but also a robustness radius, which makes it another popular choice for RE [7, 8, 24].
In fact, [7, 24, 31] perform adversarial attacks by trying to solve Eq.
In this paper, we focus on numerical optimization of Eq.
In particular, we (I) adapt the constrained-optimization solver PyGRANSO [9, 18] with a constraint-folding (PWCF) technique— crucial for making PyGRANSO solve Eq.
(1) with reasonable speed and quality, and (II) show that PWCF can handle attacks other than the ℓ 1 , ℓ 2 , and ℓ ∞ ones —beyond the reach of PGD-based methods.
This can lead to considerably improved RE as PWCF (I) can serve as a reliable supplement to the state-of-the-art (SOTA) RE packages on ℓ 1 , ℓ 2 , and ℓ ∞ attacks,
e.g. AutoAttack [8], and (II) opens up the possibility of RE over a much wider range of attack models, e.g., general ℓ p attacks with any p > 0 and more complicated ones such as perceptual attacks [16].
We remark that PWCF is also general enough to solve Eq.
(2), but due to the limited preliminary results currently at hand, we leave it as future work.
2. Technical background
Eq.
(1) is often solved by the projected gradient descent (PGD) 1 method.
The basic update reads x ′ new =
P ∆( x ) ( x ′ old + t ∇ ℓ ( x ′ old )) , where P ∆( x ) is the projection operator onto ∆( x ) .
When ∆( x ) = { x ′ ∈ [0 , 1] n : ∥ x ′ − x ∥ p ≤ ε } with p = 1 , ∞ , P ∆( x ) takes simple forms. For p = 2 , sequential projection onto the box and then the norm ball at least finds a feasible solution. Hence,
PGD is feasible for these cases.
For other choices of p and general non- ℓ p metrics d where analytical projection is not so intuitive to derive, existing PGD based algorithms does not apply.
For practical PGD methods, previous works have shown that the solution quality is sensitive to the tuning of multiple hyperparameters, e.g., step-size schedule and iteration budget [4, 8, 22].
The SOTA PGD variants, APGD-CE and APGD-DLR, try to make the tuning automatic by combining a heuristic adaptive step-size schedule and momentum acceleration under fixed iteration budget [8]—both are built into the popular AutoAttack package 2 .
2.1. PyGRANSO for constrained optimization
In principle, as an instance of nonlinear optimization (NO) problems [1]
[Equation]
Eq.
(1) can be solved by general-purpose NO solvers such as Knitro [23], Ipopt [27], and
GENO [17].
However, there are two caveats: (1) the above solvers only handle continuously differentiable objective and constraint functions, i.e., g , c i ’s, and h j ’s, but non-differentiable g , c i ’s, and h j ’s are common in Eq.
(1), e.g., when d is the ℓ 1 or ℓ ∞ distance, or f θ uses non-differentiable activations; (2) they require analytical gradients of g , c i ’s, and h j ’s, which are impractical to derive when DNN models f θ are involved.
PyGRANSO 3 [9, 18] is a recent PyTorch -port of the powerful MATLAB package GRANSO [9] which can handle general NO problems of form Eq.
(3) and potentially with non-differentiable g , c i ’s,
and h j ’s. It only requires these functions to be almost everywhere differentiable , which is satisfied by almost all forms of Eq.
(1) proposed so far in the literature.
GRANSO employs a quasi-Newton sequential quadratic programming (BFGS-SQP) to solve Eq.
(3), and features a rigorous adaptive step-size rule via line search and a principled stopping criterion inspired by gradient sampling [3].
PyGRANSO equips GRANSO with auto-differentiation and GPU computing powered by
PyTorch —crucial for deep learning problems.
The stopping criterion is controlled by stationarity, total constraint violation, and optimization tolerance—all can be transparently controlled, but is typically unnecessary to tune.
3. PyGRANSO with constraint folding as a generic solver for Eq. (1)
Though PyGRANSO can serve as a promising solver for Eq.
(1) with general metric d , we find in practice that naive deployment can suffer from slow convergence, or low quality solutions due to numerical issues.
Below, we introduce PyGRANSO W ith C onstraint- F olding (PWCF), and other techniques that can substantially speed up the optimization process, and improve the solution quality.
3.1. Reformulating ℓ ∞ constraint to avoid sparse subgradients
The BFGS-SQP algorithm inside PyGRANSO relies on the subgradients of the objective and the constraint functions to approximate the (inverse) Hessian and to compute the search direction.
Hence, when the subgradients are sparse, updating all optimization variables may take many iterations, leading to slow convergence.
For the ℓ ∞ metric,
[Equation]
where e k ’s are the standard basis vectors, conv denotes convex hull, and sign( z k )
=
z k / | z k | if z k ̸ = 0 , else [ − 1 , 1] .
The subgradient in Eq.
(4) contains no more than n k
= |{ k : z k = ∥
z ∥ ∞ }| nonzeros, and hence is sparse when n k is small.
To avoid this issue, we propose a reformulation
[Equation]
3.2. Constraint-folding to reduce the number of constraints
The natural image constraint x ′ ∈ [0 , 1] n is a set of n box constraints.
The reformulation described in Section 3.1 introduces another Θ( n ) box constraints.
Although all these are just simple linear constraints, the Θ( n ) -growth is daunting: for natural images, n is the number of pixels that can easily get into hundreds of thousands.
Typical NO problems become more difficult the number of constraints grows, e.g., leading to slow convergence for numerical algorithms.
To combat this, we introduce a folding technique that can reduce the number of constraints into a small constant.
To see how this is possible, first note that any equality constraint h ( x ) = 0 or inequality constraint c ( x ) ≤ 0 can be reformulated as
[Equation]
We can then fold them together as
[Equation]
where F : R 2+ (cid:55)→ R + ( R + .
= { t : t ≥ 0 } ) can be any function satisfying F ( z ) =
= ⇒ z
= 0 , e.g., any ℓ p ( p ≥ 1 ) norm.
It is easy to verify the equivalence of Eq.
(7) and the original constraints in Eq.
The folding technique can be used to a subset or all of the constraints; one can group and then fold constraints according to their physical meanings.
We note that folding or aggregating constraints is not a new idea and has been popular in engineering design.
For example, [21] uses ℓ ∞ folding and its log-sumexponential approximation to deal with numerous design constraints.
However, applying folding into NO problems in machine learning seems rare, potentially because producing non-differentiable constraint(s) due to the folding seems counterproductive.
In our experiments, we use F = ∥·∥ 2 to fold the Θ( n ) box constraints from ℓ ∞ reformulation into a single constraint, enforce the x ′ ∈ [0 , 1] n constraints in f θ by direct clipping.
Fig.
1 shows clearly that combining folding and reformulation can substantially speed up convergence and boost the solution quality for our algorithm.
3.3. Loss clipping when solving Eq. (1) with PWCF
For Eq.
(1) with the popular cross-entropy (CE) and margin losses, the objective value can easily dominate constraint violation during the maximization process.
Since PyGRANSO tries to balance the objective value and constraint violation when making progress, it can persistently prioritize optimizing the objective over constraint satisfaction, resulting in very slow progress in finding a feasible solution.
To resolve this numerical difficulty, we propose using clipped margin loss ℓ ML with maximal value 0 .
01 , as any ℓ ML ≥ 0 indicates a successful attack.
For the same reason, we use clipped CE loss with maximal value at 10 in PWCF 4 .
4. Experiments and results: solving Eq. (1) with PWCF
PWCF offers competitive and complementary attack performance to Eq.
We take SOTA ℓ 1 -, ℓ 2 -, and ℓ ∞ -adversarially trained models on CIFAR10 56 , and an adversariallytrained model with respect to the LPIPS distance 7 on ImageNet [16] 8 , to compare the attack performance by solving Eq.
(1) between PWCF and the APGD 9 [6] method from AutoAttack package.
The attack radii ε ’s are set following the common practice of adversarial RE 10 .
[Table]
[Table]
From Table 1, we can conclude that: (1) PWCF performs strongly and comparably to APGD on ℓ 1 , ℓ 2 and ℓ ∞ attacks, especially using margin loss as the objective; (2) PWCF is weak on ℓ 1 and ℓ ∞ attacks using CE loss, likely due to the bad numerical scaling of the CE loss; (3) Combining all successful attack samples found by APGD and PWCF (APGD+PWCF) can further reduce the robust accuracy compared to any single APGD or PWCF attack—PWCF and APGD are complementary.
Note that [4] also remarks that the diversity of solutions matters much more than the superiority of individual solvers, which is the reason why AutoAttack includes Square Attack–a zero-th order black-box attack method that does not perform strongly itself as shown in Table 1. [Table]
PWCF works for general (almost everywhere) differentiable ℓ p and non- ℓ p distances
As highlighted in Section 2, a major limitation of the PGD based solvers is that they cannot handle distances other than ℓ 1 , ℓ 2 , and ℓ ∞ 11 .
By contrast, PWCF stands out as a convenient choice for general distances.
To show this, we apply PWCF to solve Eq.
(1) with ℓ 1 . 5 and ℓ 8 distances.
In addition, we also solve Eq.
(1) with the LPIPS perceptual metric [16, 30], i.e., perceptual attack (PAT) with
[Equation]
8) where (cid:98) g 1 ( x ) , . . .
, (cid:98) g L ( x ) are the vectorized intermediate feature maps from pretrained DNNs.
PWCF handles them seamlessly, as shown in Table 2.
Here we do not strive to set the most reasonable perturbation radii, especially for ℓ 1 . 5 and ℓ 8 that have not been tested before, and hence we also do not stress the attack rates.
Our point is that PWCF is able to handle these general ℓ p distances .
Table 3 further summarizes the details of performing the perceptual attack with ε = 0 .
Existing methods to compare are Perceptual Projected Gradient Descent (PPGD), Lagrangian perceptual attack (LPA) and its variant fast Lagrangian perceptual attack (Fast-LPA) methods, all developed in [16], based on iterative linearization and projection (PPGD), or penalty method (LPA, Fast-LPA) respectively.
In addition to the objective values and attack success rates, we also report their chances of finding infeasible solutions.
As observed in Table 3, our PWCF is the clear winner.
5. Conclusion
In this paper, we propose PWCF to solve the maximization problem Eq.
(1) in robustness evaluations, blending the SOTA constrained optimization solver PyGRANSO with constraint folding and other tweaks.
Our experimental results show that 1) PWCF can provide competitive and complementary performance compared with the SOTA methods on ℓ 1 , ℓ 2 , and ℓ ∞ attacks; 2) PWCF can deal with general attack models such as ℓ p with p ≥ 1 and perceptual attacks, which are beyond the reach of existing PGD-based methods; 3) PWCF involves little to zero parameter-tuning and obtains reliable solutions based on a principled stopping criterion.
Our preliminary experiments also show that the proposed PWCF is general enough to solve Eq.
(2) with good quality, which we will present in forthcoming papers. [Table]