Invariance-inducing regularization using worse-case transformations sufﬁces to boost accuracy and spatial robustness
Abstract
This work provides theoretical and empirical evidence that adding an invariance-inducing regularizer to standard and adversarial training increases predictive accuracy for worst-case spatial transformations (spatial robustness).
In fact, with the same computational budget, it achieves a relative reduction of the spatially robust error of 20% for
CIFAR10, even surpassing hand-crafted spatialequivariant networks.
For SVHN, we additionally observe that regularized training improves both the standard test and robust accuracy against spatial transformations.
1. Introduction
As deployment of machine learning (ML) systems in the real world has steadily increased over recent years, more and more emphasis is placed on the reliability of the algorithms.
It is for example important to understand the properties of commonly used neural networks including invariances to certain types of perturbations from both a security and interpretability point of view.
As expressivity of neural networks has been shown both theoretically and empirically,in this paper we study how we can ﬁnd good predictors that are also invariant against small spatial transformations like rotations and translations.
We measure invariance by evaluating the robust loss , that is prediction performance on worst-case transformations ( attacks ) of each test image.
This robust (also called adversarial ) loss has recently gathered a lot of attention in the ﬁeld of adversarially robust learning [31, 22, 16, 26, 4, 19, 29, 30, 28, 35, 21], motivated by security considerations.
As a basis for our proposed regularized methods, we observe the author(s). in Appendix B that when perturbations are from transformation groups, predictors that optimize the robust loss are in fact invariant. Although recent works show a fundamental trade-off between robust and standard accuracy in constructed (cid:96) ∞ perturbation settings (see e.g. [33, 39]), we prove that this is fundamentally different for spatial transformations due to their group structure.
For deep neural networks, there are two main approaches to achieve invariance and robustness (used interchangeably in this paper): one relies on regularization using additionally artiﬁcially modiﬁed training data [2, 38], such as adversarial training or plain data augmentation. A more transformation speciﬁc approach is to carefully design specialized architectures to incorporate spatial equivariance [13, 17, 6, 20, 36, 34, 10, 32].
Given the above two lines of work, we want to explore the following questions: (a) how far can we push augmentation based methods for common deep neural networks to be more robust against spatial transformations?
(b) how robust are specialized architectures designed to achieve invariance against entire transformation groups?
In order to explore (a) and (b) we implemented various training methods with an explicit invariance-inducing regularizer as described in Section 2 and compare spatial robustness for these augmentation-based methods and specialized neural network architectures and SVHN test images.
We ﬁnd that regularized methods can achieve ∼ 20% relative adversarial error reduction compared to previously proposed augmentation-based methods (including adversarial training) without requiring additional computational resources.
They empirically even outperform a few traditional spatialequivariant networks on CIFAR10 and SVHN.
Finally, we observe that on SVHN, not only does the robust test accuracy increase with invariance-promoting regularization but it helps to boost standard accuracy as well.
2. Experimental setup
We now present the details of our methods that we compare in terms of robustness against spatial transformations.
2.1. Regularization based methods
Denoting by B ( x ) the perturbation (also called transformation invariant ) set of images that result from translations of maximally 3 pixels and rotations of at most 30 degrees, we consider SGD applied to the following loss functions
[Equation]
where the expectation is with respect to the empirical distribution and we consider the following different choices for R that are encouraging invariance
• R (cid:96) 2 ( f, X, Y ) =
[Equation]
x (cid:48) [Equation] ( x ) (cid:107) f
( X ) − f ( x (cid:48) )
(cid:107)• R KL ( f, X, Y )
[Equation] x (cid:48) ∈B ( x ) D KL ( f ( x (cid:48) ) , f ( X ))
(same as [39] for L nat ) • R ALP ( f, X, Y )
= (cid:107) f
( x (cid:48) )
− f ( X ) (cid:107) 22 with x (cid:48)
=
arg max u ∈ G X (cid:96) ( f ( u ) , Y ) (ALP[15])
We describe the different methods we used to calculate the supremum over the perturbation set in Section C.1 under defenses and refer to the maximizers of both regularizers and cross entropy loss as adversarial examples .
2.2. Attacks and defenses
The attacks and defenses we choose largely follow the setup in [9].
Recall that the defense refers to the (efﬁcient) procedure at training time which aims to make the resulting model robust to adversarial examples and generally differs from the (extensive) attack mechanism performed at evaluation time to assess the model’s robustness.
Grid search attack Following [9], during test time we use grid search with 775 distinct combinations of translation and rotations to ﬁnd the most adversarial example in the perturbation set for each test image.
Although projected gradient descent methods are effective in increasing adversarial test accuracy for (cid:96) ∞ perturbations, we conﬁrm previous observations [9] that they are worse than grid search in this small dimensional perturbation set.
Defenses For the adversarial example which maximizes either the loss or regularization function, we use the following defense mechanisms:
Wo- k : the worst of k randomly drawn transformation • S-PGD:
Several steps of Projected Gradient Descent with respect to the spatial transformation parameters.
• Random:
A randomly drawn transformation
More details about the attack and defense methods can be found in Section C.1 in the Appendix.
For clarity of presentation of our different methods we use a naming convention consisting of the following components: (a) Reg : refers to what regularizer was used (ALP, (cid:96) 2 , KLor AT) where ATrefers to standard unregularized adversarial training(b) batch : refers to using the gradient of the loss on the adversarial examples (rob), natural examples (nat) or both (mix), and (c) def : the mechanism used to ﬁnd the adversarial example, including random (rnd), worst-of- 10 (Wo- 10 ) and spatial PGD (S-PGD) as described in Section C.1.
Thus, Reg ( batch , def ) corresponds to using Reg as a regularizing function, the examples deﬁned by batch in the gradient of the loss and the defense def to ﬁnd the inner maximizer.
2.3. Spatial equivariant networks
We compare the robust prediction accuracies from the regularized networks with three specialized architectures GResNet, ETN and STN, designed to be equivariant against spatial transformations and translations.
(see Section C.2 in the Appendix for more details).
3. Empirical Results
This section is devoted to comparing the natural test accuracy (standard accuracy on the test set) and test grid accuracy (as deﬁned in Section C.1) achieved by standard, regularized (adversarial) training techniques and specialized spatial equivariant architectures described in Section 2.3.
In Table 1 we report results for a subset of the experiments to facilitate comparisons.
Results for a more complete set of methods can be found in Appendix, Tables 7–11.
For each method, we report averages (standard errors are contained in Tables 7–11) computed over ﬁve training runs with identical hyperparameter settings.
We compare all methods by computing absolute and relative error reductions (deﬁned as absolute error drop prior error ).
It is insightful to present both numbers since the absolute values vary drastically between datasets.
The experiments are conducted choosing deep neural networks as the function space F and (cid:96) is the cross-entropy loss.
In the main paper we consider the datasets SVHN [25] and CIFAR-10.
For the regularized methods, we train a ResNet-32 [11], implemented in TensorFlow [1].
The precise training procedure is described in Sec.
C.3.
For training with adversarial examples we augment the data using random lef-tright ﬂips and add random translations of ± 4 px for non-adversarially trained models. .
In Table 1 (top), the three leftmost columns represent unregularized methods which all perform worse in grid accuracy than regularized methods.
When considering the three regu- [Table] larizers with the same batch and def (here chosen to be “rob” and Wo- 10 ) regularized adversarial training improves the grid accuracy from 71 .
17% to 77 .
47% on CIFAR-10 and 90 .
35% to 92 .
71% on SVHN, corresponding to a relative error reduction of 22% and 24% respectively.
Computational considerations In Figure 1, we plot the grid accuracy vs. the runtime (in hours) for a subset of regularizers and defense mechanisms on CIFAR-10 for clarity of presentation.
How much overhead is needed to obtain the reported gains?
Comparing AT(rob, Wo- k ) and ALP(rob, Wo- k ) shows that signiﬁcant improvements in grid accuracy can be achieved by regularization with only a small computational overhead.
What if we make the defense stronger?
Improving the adversarial example search in unregularized methods by increasing k to 20 is not effective: AT(rob, Wo- 20 ) achieves 72 .
31% instead of 71 .
17% grid accuracy for AT(rob, Wo- 10 ) while requiring 3 × more training time.
Although regularizing with KL generally achieves the best results, the adversarial example search requires two forward passes and is hence slow.
Hence, we consider KL-C(mix,
S-PGD) which computes the adversarial example with respect to the classiﬁcation cross entropy loss like ALP.
This approach achieves a similar accuracy as KL(nat, S-PGD) while being 2 × faster.
In fact, this variant achieves the best overall grid accuracy of 78 .
93% at a similar runtime as AT(rob, Wo- 20 ) with 72 .
93% , translating into a relative error reduction of 22%.
Comparison with spatial equivariant networks Although the rotation-augmented G-ResNet44 obtains higher grid ( 84 .
9% , 71 . 64% ) and natural accuracies ( 95% , 93 .
than the rotation-augmented Resnet32 on both SVHN ( 82 .
97% ) and CIFAR ( 58 .
, regularizing augmentation (i.e. regularizers with “rnd”, see Table 2 (right)) using both the (cid:96) 2 distance and the KL divergence matches the G-ResNet44 on CIFAR10 ( 71 .
50% respectively)
and surpasses it
[Figure]
T e s t
g r i d a c c u r a c y
ALP ( [Figure] KL (nat, S-PGD) KL-
[Figure]
(mix
[Figure]
S-PGD)
ALP (rob, Wo-k)
AT (rob, Wo-k)
KL (nat, Wo-k)
The connected points correspond to Wo- k defenses with k ∈ { 1 , 10 , on SVHN on grid ( 90 .
69% ) and natural accuracies by a relative grid error reduction of ∼ 37% .
The same phenomenon is observed for the augmented ETN and STN on SVHN.
In conclusion, invariance-oblivious regularized augmentation based methods match or outperform state-of-theart end-to-end networks handcrafted to be equivariant to spatial transformations.
relative error
Trade-off natural vs. adversarial accuracy SVHN is one of the main datasets (without artiﬁcial augmentation like in rot-MNIST [18]) where spatial equivariant networks have reported improvements on natural accuracy.
This is due to the inherent orientation variance in the data.
In our mathematical framework, this corresponds to the assumption of the marginal conditional distribution of an transformations of an image having support on the transformation-invariant set.
Furthermore, as all numbers in SVHN have the same label irrespective of small rotations of at most 30 degrees, the second assumption in Theorem 2 is also fulﬁlled.
Table [Table] conﬁrms the statement in the Theorem that improving robust accuracy may not hurt natural accuracy or even improve it.
A similar trend can be seen for CIFAR10 for which the methods with highest grid accuracies such as KL ( rob , Wo- 10) also have close to the highest natural accuracy.
Comparing the different regularizers and L nat ( f ; R ) vs. L rob ( f ; R )
We are interested in disentangling the underlying reasons behind differences between the grid accuracy performances of different combinations of regularization methods.
Tables 1 and 2 shed some light on this quest.
In particular we can observe that, ﬁxing any regularizer, the robust regularized loss Reg (rob, def ) (i.e., L rob ( f ; R ) ) does better (or not statistically signiﬁcantly worse) than Reg (nat, def ) (i.e., L nat ( f ; R ) ).
Second, the KL regularizer is better than (cid:96) 2 for a large number of settings.
Choice of λ
The different regularization methods peak at different λ .
However, they outperform unregularized methods in a large range of λ values, suggesting that wellperforming values of λ are not difﬁcult to ﬁnd in practice.
These can be seen in Figures 4 and 3 in the Appendix
Many more insightful experiments can be found in Section C.6. 4. Related work
Group equivariant networks There are in general two types of approaches to incorporate spatial invariance into the network.
In one of the earlier works in the neural net era, Spatial Transformer Networks were introduced [13] which includes of a transformer module that predicts transformation parameters followed by a transformer.
Later on, one line of work proposed multiple ﬁlters that are discrete group transformations of each other [17, 20, 6, 41, 36]. For continuous transformations, steerability [34, 7] and coordinate transformation [10, 32] based approaches have been suggested. Regularized training Using penalty regularization to encourage robustness and invariance when training neural networks has been studied in different contexts: for distributional robustness [12], domain generalization [23], (cid:96) p adversarial training [24, 15, 39], robustness against simple transformations [5] and semi-supervised learning [40, 37]. These approaches are based on augmenting the training data either statically [12, 23, 5, 37], ie.
before ﬁtting the model, or adaptively in the sense of adversarial training, with different augmented examples per training image generated in every iteration [15, 24, 39].
Robustness against simple transformations Approaches targeting adversarial accuracy for simple transformations have used attacks and defenses in the spirit of PGD (either on transformation space [9] or on input space projecting to transformation manifold [14]) and simple random or grid search [9, 27].
Recent work [8] has also evaluated some rotation-equivariant networks with different training and attack settings which reduces direct comparability with e.g. adversarial based defenses [9].
5. Conclusion
In this work, we have explored how regularized augmented and adversarial training compares against specialized spatial equivariant networks in terms of robustness against spatial transformations consisting of translations and rotations.
Strikingly, even though the method of augmentation can be applied to encourage any desired invariance, the regularized methods adapt well and perform similarly or better than specialized networks.
We showed that for transformation invariances and under certain practical assumptions on the distribution, there is no trade-off between natural and adversarial accuracy which stands in contrast to the debate around (cid:96) p -perturbation sets.
In summary, it is advantageous to replace unregularized with regularized augmented/adversarial training in a large variety of setings. 6. Acknowledgements
We thank Nicolai Meinshausen and Ludwig Schmidt for helpful discussions and Luzius Brogli for experimental contributions.
FY was supported by the Institute for Theoretical
Studies ETH Zurich and the Dr. Max Rössler and the Walter
Haefner Foundation.
A. Supplementary material B. Theoretical results
In this section, we ﬁrst introduce our notion of transformation sets to formalize robustness against a small range of translations and rotations.
We then prove that on a population level constraining or regularizing for transformation invariance yields models that minimize the robust loss.
Moreover, under reasonable assumptions on the true distribution, we show the set of robust minimizers not only minimizes the natural loss, but under mild conditions on the distribution over the transformations, is even equivalent to the set of natural minimizers.
Although the framework can be applied to general problems and transformation groups, we consider image classiﬁcation for concreteness.
In the following, X ∈ R d are the observed images and Y ∈ R p the one-hot vector for multiclass labels and both are random variables from a joint distribution P .
The function f : R d → R p in function space F (e.g. deep neural network in experiments) maps the input image to a logit x
→ f ( x ) that is then used for prediction via a softmax layer.
B.1. Transformation sets
Invariance against spatial transformations is often thought of in terms of group equivariance of the representation and prediction.
Instead of invariance with respect to all spatial transformations in a group, we impose a weaker requirement, that is invariance against transformation sets, deﬁned as follows.
We denote by G z a compact subset of images in the support of P that can be obtained by transformation of an image z ∈ X in the space of all possible observable images X .
G z is called a transformation set and by requiring the technical assumption on the space of real images that the sampling operator is bijective, the mapping z → G z is also bijective.
We can hence deﬁne G , a set of transformation sets, by G = ∪ z ∈X G z for a given transformation group. It is important to note that G z are disjoint for different images z ∈ X . More details on the aforementioned concepts and deﬁnitions can be found in Sec.
B.5.
The above deﬁnition is distribution dependent and G partitions the support of the distribution (cid:101) X .
As a consequence, each x ∈ (cid:101) X is uniquely mapped to an element in G which we denote by G x ∈ G .
We say that a function f is (transformation- )invariant if f ( x ) = f
( x (cid:48) ) for all x, x (cid:48) ∈ U for all U ∈ G .
Equivalently, the set of all invariant functions can be described by
[Equation]
where R ( f, x ) = sup x (cid:48) ∈ G x h
( f ( x ) , f (cid:48) ( x )) for any semimetric h on R p .
For all choices of semimetrics the spaces V ( R ) are identical which we denote by V .
Using this notation, ﬁtting a model with high accuracy under “small” transformations of the input can be mathematically captured by the robust optimization formulation [3] of minimizing the robust loss
[Equation]
We call the solution of this problem the robust minimizer.
While adversarial training aims to optimize the empirical version of Eq.
(1), the converged predictor might be far from the global population minimum in particular in the case of nonconvex landscapes for neural networks.
Furthermore, we show in the following section that for robustness against transformation sets, constraining the model class to invariant functions leads to the same optimizer of the robust loss. These facts motivate invariance-inducing regularization in the next section that we then show to exhibit improved robust test accuracy in practice.
B.2. Regularization to encourage invariance
In the sequel, F is the function space of the models that we are using to ﬁt the data. Instead of the speciﬁc deﬁnition of R via semimetrics we now allow for general R and consider constrained optimization problems of the form [Equation] O1)
[Equation]
The following theorem shows that the optimization programs (O2) are equivalent to solving (1) if the set of all invariant functions V is a subset of the function space F .
Theorem 1.
If V ⊂ F , all minimizers of the adversarial loss (1) are in V .
If furthermore V ( R ) ⊆
V , any solution of the optimization programs (O1) , (O2) minimizes the adversarial loss.
The proof of Theorem 1 can be found in the Appendix in Sec.
B.6.
Since projection onto the constrained set is not computationally feasible for neural network function spaces, a common workaround is to relax the constraints by only requiring f ∈ { f : R ( f, x ) ≤ (cid:15) ∀ x ∈ (cid:101) X} . Then, by Lagrangian duality, (O1) and (O2) can be rewritten in penalized form as
[Equation]
for some scalar λ > 0 . In Sec. B.4 we discuss how ordinary adversarial training and modiﬁed variants that have been proposed thereafter can be viewed as special cases of (2).
B.3. Trade-off between natural and robust accuracy
Even though low robust accuracy (1) might be the main goal in some applications, one might wonder whether the robust minimizer exhibits lower accuracy on untransformed images ( natural accuracy ) deﬁned as L nat ( f ) :
= E X,Y (cid:96) ( f ( X ) , Y ) [33, 39].
In this section we tackle this question and identify the conditions for transformation based perturbations under which minimizing robustness does not lead to decreased natural accuracy. Under mild assumptions it even increases.
One reason why adversarial examples have attracted a lot of interest is because the prediction of a given classiﬁer can change in a perturbation set in which all images appear the same to the human eye.
Mathematically, in the case of transformation sets, the latter can be modeled by a property of the true distribution, namely that the conditional distribution Y given x is constant for all x belonging to the same subset U ∈ (cid:101) G , or in other words, Y is conditionally independent of X given G X , i.e. Y ⊥⊥ X | G X .
Under this assumption one can show that there is no trade-off in natural accuracy for the transformation robust minimizer.
Theorem 2 (Trade-off natural vs. robust accuracy) .
Under the assumption of Theorem 1 and if Y ⊥⊥ X | G X holds, the adversarial minimizer also minimizes the natural loss.
If moreover, the probability distribution of X conditioned on every transformation set G z has support G z and the loss (cid:96) is injective, then every minimizer of the natural loss also has to be invariant.
As a consequence, minimizing the constrained optimization problem (O1) could potentially help in ﬁnding the optimal solution to the unconstrained loss minimization. Practically, the assumption on the distribution on the transformation sets
G z corresponds to inherent transformation variance in the natural distribution of the dataset. This could be a possible explanation why we observe a boost in natural accuracy for robust invariance-inducing methods in Sec. 3 on SVHN, a commonly used benchmark dataset for spatial-equivariant networks for this reason.
One might wonder how this result relates to several recent publications such as [39], [33] that presented toy examples for which the (cid:96) ∞ robust solution must have higher natural loss than the Bayes optimal solution.
On a fundamental level, (cid:96) ∞ perturbation sets are of different nature compared to transformation sets on generic distributions of X . In the distribution they consider, there is no unique mapping from x ∈ X to a perturbation set and thus the conditional independence property cannot generally hold.
B.4. Different regularizers and practical implementation
In order to improve robustness against spatial transformations we consider different choices of R ( f, x ) in the regularized objective (2) that we then compare in Sec. 3.
First of all, we relax the deﬁnition to include explicit dependence on y which allows us to view common adversarial training as a special variant of our regularized framework.
In particular, common adversarial training as in [31, 19] corresponds to L nat with R ( f, X, Y ) =
sup x (cid:48) ∈
G X (cid:96) ( f ( x (cid:48) ) , Y ) − (cid:96) ( f ( X ) , Y ) .
In this paper we compare common adversarial training with regularized variants that use the following regularizers
• R (cid:96) 2 ( f, X, Y ) =
sup x (cid:48) ∈
G X (cid:107) f
( X ) − f ( x (cid:48) )
(cid:107)• R KL ( f, X, Y ) =
sup x (cid:48) ∈
G X D KL ( f ( x (cid:48) ) , f ( X ))
(equivalent to [39] for L nat )
• R KL-C ( f, X, Y ) =
D KL ( f ( x (cid:48) ) , f ( X )) with x (cid:48)
=
arg max u ∈ G X (cid:96) ( f ( u ) , Y ) • R ALP ( f, X, Y ) =
(cid:107) f
( x (cid:48) )
− f ( X ) (cid:107) 22 with x (cid:48)
=
arg max u ∈ G X (cid:96) ( f ( u ) , Y ) (see [15])
where D KL is the KL divergence on the softmax of the vectors f ∈ R p .
Furthermore, standard data augmentation can also be used in conjunction with a regularizer by adding R ( f, X ) =
E x (cid:48) ∈
G X h ( f, X, X (cid:48) ) for any semimetric h .
All of the above regularizers involve a maximization over the invariance set. In the ﬁrst two cases the maximization is performed with respect to the regularization function h while in the latter two regularizers the maximum is taken with respect to the loss function (cid:96) . In all cases we refer to the maximizer as an adversarial example .
For the regularizers R (cid:96) 2 , R KL the assumption in Theorem 1 is satisﬁed and hence the solution of the corresponding constrained problem (O1) is a minimizer of the adversarial loss.
In contrast, for ALP and KL-C, the statements of the theorems do not hold since V ( R ) (cid:54)⊂ V .
Adversarial example for spatial transformation sets Since G X is not a closed group and we do not know whether the drawn X ∈ G X lies at the boundary of G X or in the interior, we cannot solve the maximization constrained to G X .
However, for an appropriate choice of set S (see Sec.
B.5 in the Appendix), we can instead minimize an upper bound of (1) which reads
[Equation]
[Equation]
) where S is the set of transformations that we search over and T ( X, ∆) denotes the transformed image with transformation ∆ .
The left hand side in (3) is hence what we aim to solve in practice where the expectation is over the empirical joint distribution of X, Y .
The relaxation of G X to a range of transformations of X that is {T ( X, ∆) : ∆ ∈ S} is also used for the maximization within the regularizers.
B.5. Rigorous deﬁnition of transformation sets and choice of S
Let us deﬁne a “potential” image as a function I : R 2 → [0 , 255] 3 in the function space I . For practical purposes the images become ﬁnite-dimensional vectorized matrices by sampling functions in I and hence some of the properties that allow clean handling of spatial transformations only hold somewhat approximately.
We deﬁne transformation sets as subsets of the function space I .
Let us deﬁne the symmetric group G of all rotations and horizontal and vertical translation acting on I . It consists of elements g ∆ uniquely parameterized by ∆ ∈ R 3 and can be represented by a coordinate transform matrix, see e.g. [6].
The ﬁrst two dimensions represent the values for the translations and the third represents rotation.
The transformed image (function) g ∆ ( I ) ∈ I can be expressed by g ∆ ( I )( v )
=
I ( G − 1 v ) for each v ∈ R 2 where G ∆ is the coordinate transform matrix associated with ∆ ∈ R 3 as in [6].
For each I ∈ I , the group orbit is G I
= { g ( I ) : g ∈ G } .
By deﬁnition of I , the group orbits partition the space I .
Subsets of orbits For our problem setting, requiring invariance in the entire orbit (i.e. with respect to all translations and rotations) is too restrictive.
First of all, large transformations rarely occur in nature because of physical laws and common human perspectives (an upside down tower for example). Secondly, in image classiﬁcation robustness is usually only required against adversarial attacks which would not fool humans, i.e. lead them to mislabel the image.
If the transformation set is too large, this requirement is not fulﬁlled anymore.
For this purpose we now deﬁne compact subsets of G
I
[Equation]
where S I could be different for every I ∈ I .
By assumption on I , the subsets G S ( I ) are disjoint. In fact, they partition I .
We now deﬁne for each I the set of “maximal” transformations ∆ (cid:63)I such that ( − ∆ (cid:63)I , ∆ (cid:63)I ) ⊃ S
I .
Now deﬁne ∆ (cid:63) = arg max ∆ (cid:63)I (cid:107) ∆ (cid:63)I (cid:107) to be the largest transformation over all images.
Note that the conventional deﬁnitions for invariance or equivariance in the group-sense as in [6] do not carry over to subsets of orbits.
Our deﬁnition of an invariant function f : X → R d is instead
[Equation]
paper. For the group of rotation and translation on images, this property translates to f having the same value for all images that are only slightly translated and/or rotated versions of each other. Sampling issues In reality, the observed image is not a function on R 2 but a vector z ∈ R w × h that is the result of a sampling operator Φ : I → R w × h evaluated at an image I , i.e. z =
Φ( I ) that is a vectorized version of the matrix Z with elements
[Equation]
In order to counter the problem that the sampling operator is in general not injective, we add another constraint to I by requiring that Φ is bijective.
Hence, the quantity I z = Φ − 1 ( z ) is well-deﬁned. We denote by X the image of Φ . In the main text, we also refer to T ( z, ∆) =
Φ( g ∆ ( I z ))
∈ X as the image corresponding to the sampled image
z transformed by the group element g ∆ .
We can now analogously deﬁne subsets in the ﬁnite dimensional vector space G z ⊂ X by G z :=
{ Φ( I ) : I ∈ G S
( I z ) } .
By deﬁnition of G S ( I ) , the sets G z are also disjoint.
Any G z with P ( { X ∈ G z } ) ≥ P ( { X ∈ G z } ) and G z = { Φ( I ) : I ∈
G I z } we call a transformation set .
B.6. Proof of Theorem
Please refer to Section B.5 for the necessary notation for this section.
Furthermore, deﬁne L adv ( f ) =
L rob ( f ; 0 , 0) , L nat ( f ) =
L nat ( f ; 0 , 0) .
We prove the theorem by contradiction.
Let us assume that f rob (cid:54)∈ V for exactly one element G z ∈ (cid:101) G and the marginal distribution over (cid:101) G that can be deﬁned as P ( { G X
= U } )
=
P ( { X ∈ U } ) for any U ∈ (cid:101) G , is discrete(for simplicity of presentation) and G z has non-zero probability.
Let’s assume that there is at least one invariant set G z , on which f rob is not constant and collect all different values in the set
A = { f rob ( x ) : x ∈ G z } (with cardinality strictly bigger than 1 since f not-constant) and denote the distribution over x ∈ G z by P z .
Since G z is assumed to be a subset of a group orbit and G -orbits partition X , there is a mapping Ψ that maps each x ∈ X to a unique invariant set (see Section B.5).
This property allows us to lower bound of the robust loss as follows for any z ∈ X :
[Equation]
where the function H is speciﬁc to G z and deﬁned as H ( x, a )
=
E Y | x (cid:96) ( a, Y ) and the inequality follows from [Equation] (cid:96)
[Equation]
The right hand side is minimized with respect to the set A by choosing A = { a (cid:63) } with a (cid:63) =
arg min a (cid:82) H ( x, a )
dP z ( x ) because setting f ( x ) = a (cid:63) for all x ∈ G z leads to equality in equation (5).
Since P ( { X ∈ G z } ) > 0 by assumption, choosing f (cid:63) ( x ) = a (cid:63) for all x ∈ G z implies L adv ( f (cid:63) ) <
L adv ( f rob ) which contradicts optimality of f rob and thus proves the ﬁrst statement of the theorem.
For the second statement let us rewrite
[Equation]
By the ﬁrst statement we know that the set
[Equation]
is non-empty.
For all f ∈ F rob , it holds by deﬁnition of V that ˜ R ( f ) = 0 .
Since V ( R ) ⊂ V , the minimizers f min of (O1) satisfy L nat ( f min )
≤ L nat ( f ) for all f ∈ V .
But since in V we have L adv ( f ) =
L nat ( f ) it directly follows that f min ∈ F rob .
The same argument goes through for (O2) since for all f ∈ V , we have L adv ( f )
=
L nat ( f ) .
This concludes the proof of the theorem.
B.7. Proof of Theorem
Similar to the proof of Theorem 1, we can const minimizer f (cid:63) of the natural loss that is in V given the assumption that Y ⊥⊥ X | G z .
Hence since on V both losses are the same, together with Theorem 1 the robust minimizer also minimizes the unconstrained natural loss.
Assume f nat (cid:54)∈ V minimizes L nat ( f ) , in particular, it is constant on all invariant sets except G z for some z ∈ X .
Again by existence of a mapping Ψ and hence since by assumption, the joint conditional distribution P z ( Y, X ) =
P z ( Y ) P z ( X ) , we can write for any f L nat ( f [Equation] =
[Equation]
z } ) .
Note that
[Equation]
[Equation]
Then, setting f (cid:63) ( x ) =
min x ∈ G z E Y (cid:96) ( f nat ( x ) , Y )
| G z for all x ∈ G z yields
L nat ( f (cid:63) ) =
L nat ( f nat ) ≤
L nat ( f ) for all f ∈ F by deﬁnition of f nat .
If additionally the support of P z is equal to G z and (cid:96) is injective, the inequality (6) becomes a strict inequality for f nat (cid:54)∈ F and hence we have L nat ( f (cid:63) ) <
L nat ( f nat ) which contradicts the deﬁnition of f nat being the minimizer of the natural loss.
C. Experimental details C.1. Attacks and defenses
Grid search attack We consider a default grid of 5 values per translation direction and 31 values for rotation, yieldingtransformed examples that are evaluated for each X i .
We refer to the accuracy attained under this attack as grid accuracy .
Defenses worst-of- k
In worst-of- k
(Wo- k ) adversarial training, at iteration t , we sample k different perturbations for each image in the batch.
The one resulting in the highest function value is chosen to be the maximizer.
Most of our experiments are conducted with k = 10 consistent with [9] as a higher k only improved performance minimally.
Spatial PGD.
In analogy to common practice for (cid:96) p adversarial training as in e.g. [31, 19], the S-PGD mechanism uses projected gradient descent with respect to the translation and rotation parameters with projection on the constrained set S of transformations.
We consider 5 steps, starting from a random initialization, with step sizes of [0 . 03 , 0 . 03 , 0 . 3] (following [9]) for horizontal-, vertical translation and rotation respectively.
Random.
Data augmentation with a distinct random perturbation per image and iteration as ubiquitously used in practice.
This can be seen as the most naive “adversarial” example as it corresponds to worst-of-
k with k = 1 .
Note that the empty space that results from translating and rotating an image is ﬁlled with black pixels ( constant padding ) if not otherwise noted, and reﬂections in some cases (see Section C.5).
See Fig.
2 for an example.
C.2. Spatial-equivariant networks
In our experiments, we report spatial robustness for the following spatial-equivariant networks: (a) G-ResNet44 (GRN ) [6] using p4m convolutional layers (90 degree rotations, translations and mirror reﬂections) on CIFAR10; (b) Equivariant
Transformer Networks (ETN) [32], a generalization of Polar Transformer Networks (PTN) [10], on SVHN; and (c) Spatial Transformer Networks (STN) [13] on SVHN.
A more comprehensive discussion of previous literature on equivariant networks against translations and rotations can be found in Section 4.
We choose the architectures listed above based on availability of reproducible code and previously reported state-of-the art accuracies for the respective datasets.
We train GRN, STN and ETN end-to-end using standard augmentation as described in Section ??
(std) and random rotations in addition (std (cid:63) ).
In order to compute the grid accuracies, the adversarial attacks using grid search are then computed by evaluating the entire architecture.
Out of curiosity we also trained a two-stage STN where we train the localization network separately on a supervised randomly transformed set of the training data to predict the transformation parameters treated as labels.
Details about the implementation and results can be found in Section C.5.
We had difﬁculties to train both ETN and STN to higher than 86% natural accuracy for CIFAR10 even after an extensive learning rate and schedule search so we do not report the numbers here.
C.3. Training procedure
All models are trained using a single-GPU on a node equipped with an NVIDIA GeForce GTX 1080 Ti and two 10-core
Xeon E5-2630v4 processors.
We run a standard minibatch SGD update with a momentum term with parameter 0 .
9 and weight decay parameter 0 . 0002 .
We use an initial learning rate of 0.1 which is divided by 10 after half and three-quarters of the training steps.
Independent of the defense method, we ﬁx the number of iterations to 80000 for SVHN and CIFAR-10, and to 120000 for CIFAR-100.
For comparability across all methods, we ﬁx the number of unique original images in each iteration to 64.
For the baselines, we additionally trained with a batch size of 128 and report the higher accuracy.
C.4. Example images
One pair of example images is shown in panels (b) and (c) in Fig.
2, where the original image is depicted along with a transformed version T ( · , ∆) with ∆ ∈ S .
[Figure]
C.5. Design choices for two-stage STN
Since STNs are known to be sensitive to hyperparameter settings and thus difﬁcult to train end-to-end [32], we apply the following two-stage procedure to simulate its functionality: (1) we ﬁrst train a ResNet-32 as a localization regression network (LocNet) to predict the attack perturbation separately by learning from a training set, which contains perturbed images and uses the transformations as the prediction targets; (2) at the same time we train a ResNet-32 classiﬁer with data augmentation, namely random translations and rotations; (3) during the test phase, the output of the LocNet is used by a spatial transformer module that transforms the image before entering the pretrained classiﬁer.
We refer to this two-stage STN as STN+.
For the classiﬁers, we take the two trained models for CIFAR10 and SVHN from our previous experiments for AT(rob, rnd).
Since we do not expect the regressors to be perfect in terms of prediction capability, there will still be some transformation left after the regression stage.
Thus, the classiﬁers should have a certain degree of robustness.
Their training procedure is described in Section C.3.
The regressor is trained on zero padded – sufﬁx ( c ) – as well as reﬂect padded inputs – sufﬁx ( r ) – for comparison.
The former possibly yields an unfair advantage of this approach compared to other methods as the neural network can exploit the edges (induced through zero padding) to learn the transformation parameters.
Therefore, we also consider reﬂection padding to assess the effect of the different paddings on ﬁnal performance.
Nonetheless, zero padding is consistent with the augmentation setting for the end-to-end trained networks and regularized methods and was also the choice considered by [9].
For completeness we also show results when using reﬂection padding for training LocNet although it lacks comparability with the other methods since attacks should be reﬂection-padded as well.
[9] additionally analyze a “black canvas“ setting where the images are padded with zeros prior to applying the transformation, ensuring that no information is lost due to cropping.
Their experiments show that the reduced accuracy of the models cannot be attributed to this effect.
Since both versions yield similar results, we report results on the ﬁrst version of pad and crop choices, having input images of the same size as the original.
In the spatial transformer module we compares two variants of handling the labels predicted by the regressor.
We can either tilt the transformed image with the opposite transformation of the predicted labels, which will, under the assumption that the regressor successfully learnt object orientations, turn back the image but potentially result in extra padding space before we feed the images into the classiﬁer.
Alternatively, we can subtract the predicted transformation from the attack transformation, then use the remaining transformation as the new “attack transformation”.
The latter will result in much smaller padding areas, if the regressor is performing well.
From the experimental results we do see a big drop if we naively transform images twice.
We denote the former method as “naive” and latter as “trick”.
For CIFAR-10, this two-stage classiﬁer achieved relatively high grid accuracies.
However, the obtained accuracies are still lower than expected, given that the regressor is allowed to learn rotations with a separately trained regressor on the transformed training set.
For SVHN we also see a gain compared to adversarial training without regularizer.
However, the performance still lags behind the accuracies obtained by the regularizers.
The results are summarized in Table 3.
[Table]
C.6. Additional experimental results
In this section we discuss additional experimental results we collected and analyses we performed.
Weakness of ﬁrst order attack.
Table 5 shows the accuracies of various models trained with S-PGD defenses and evaluated against the S-PGD and the grid search attack on all datasets.
We observe that the S-PGD attack constitutes are very weak attack since the associated accuracies are much larger than for the grid search attack.
In other words, the S-PGD attack only yields a very loose upper bound on the adversarial accuracy.
This stands in stark contrast to (cid:96) ∞ attacks and has ﬁrst been noted and discussed in [9].
Interestingly, using the ﬁrst order method as a defense mechanism proves to be very effective in terms of grid accuracy.
When used in combination with a regularizer this defense yields the largest overall accuracies as shown and discussed in Section 3.
Recall that due to computational reasons grid search cannot be used as a defense mechanism.
Therefore, the strongest computationally feasible defense does not use the same mechanism as the strongest attack in our setting.
[Figure]
[Figure]
[Table]
[Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Figure]
[Figure]