A MATA : A N A NNEALING M ECHANISM FOR A DVERSARIAL T RAINING A CCELERATION
Anonymous authors
Paper under double-blind review
A BSTRACT
Despite of the empirical success in various domains, it has been revealed that deep neural networks are vulnerable to maliciously perturbed input data that much degrade their performance.
This is known as adversarial attacks.
To counter adversarial attacks, adversarial training formulated as a form of robust optimization has been demonstrated to be effective.
However, conducting adversarial training brings much computational overhead compared with standard training.
In order to reduce the computational cost, we propose a simple yet effective modiﬁcation to the commonly used projected gradient descent (PGD) adversarial training by increasing the number of adversarial training steps and decreasing the adversarial training step size gradually as training proceeds.
We analyze the optimality of this annealing mechanism through the lens of optimal control theory, and we also prove the convergence of our proposed algorithm.
Numerical experiments on standard datasets, such as MNIST and CIFAR10, show that our method can achieve similar or even better robustness with around 1/3 to 1/2 computation time compared with PGD.
I NTRODUCTION
Recently, the revival of deep neural networks has led to breakthroughs in various ﬁelds, including computer vision, natural language processing, game playing, etc.
Despite these advancements, deep neural networks were found to be vulnerable to malicious perturbations on the original input data.
While the perturbations remain almost imperceptible to humans, they can lead to wrong predictions over the perturbed examples (Szegedy et al., 2013; Goodfellow et al., 2014; Akhtar & Mian, 2018).
These maliciously crafted examples are known as adversarial examples, which have caused serious concerns over the reliability and security of deep learning systems, particularly when deployed in the life-critical scenarios, such as autonomous driving systems and health/medical domains.
Several defense mechanisms have been proposed, such as input reconstruction (Meng & Chen, 2017;
Song et al., 2018), input encoding (Buckman et al., 2018), and adversarial training (Goodfellow et al., 2014; Tram ` er et al., 2017;
He et al., 2017; Madry et al., 2017).
Among these methods, adversarial training is the most effective defense method so far.
Adversarial training can be posed as a robust optimization problem (Ben-Tal & Nemirovski, 1998), where a min-max optimization problem is solved (Madry et al., 2017; Kolter & Wong, 2017).
For example, given a C -class dataset
S = { ( x 0 i , y i ) } ni =1 with x 0 i ∈ R d as a normal or clean example in the d -dimensional input space and y i ∈ R C as its associated one-hot label, the objective of adversarial training is to solve the following min-max optimization problem:
[Equation]
where h θ : R d → R C is the deep neural network (DNN) function, (cid:96) is the loss function and (cid:15) is the maximum perturbation constraint.
The inner maximization problem is to ﬁnd an adversarial example x i , within the (cid:15) -ball around a given normal example x 0 i that maximizes the classiﬁcation loss (cid:96) .
On the other hand, the outer minimization problem is to ﬁnd model parameters that minimizes the loss (cid:96) on the adversarial examples { x i } ni =1 that are generated from the inner maximization.
The inner maximization problem is commonly solved by projected gradient descent (PGD).
PGD perturbs a normal example x 0 by iteratively updating it in the steepest ascent direction for a total of K times.
Each ascent step is modulated by a small step size and a projection step back onto the (cid:15) -ball of x 0 to prevent the updated value fall outside the (cid:15) -ball of x 0 (Madry et al., 2017):
[Equation]
where α is the step size, (cid:81) ( · ) is the orthogonal projection function onto { x (cid:48) :
(cid:107) x 0 − x (cid:48) (cid:107) ≤ (cid:15) } , and x k is the adversarial example at k -th step.
However, a major problem prohibiting adversarial training to be practically applicable is the huge computational burden associated with the inner maximization steps: we need to iteratively solve the inner maximization problem to ﬁnd good adversarial examples for DNN to be robust.
Recently, to accelerate adversarial training, a few methods have been proposed.
For example, YOPO estimated the gradient on the input by only propagating the ﬁrst layer (Zhang et al., 2019a), and parallel adversarial training utilized multiple graphics computation units (GPUs) for acceleration (Bhat &
Tsipras, 2019; Shafahi et al., 2019).
A common drawback of these methods are their implementation complexity or their need for multiple GPUs for acceleration.
On the other hand, an empirical observation made by (Wang et al., 2019), indicated that we might not need to ﬁnd good solutions to the inner maximization at the initial stages of adversarial training to achieve even better robustness.
In line of such observations, in this paper we propose a simple yet effective Annealing Mechanism for Adversarial Training Acceleration, which we call Amata , that gradually controls the degree of which the inner maximization is solved as the training proceeds.
This annealing algorithm only takes 1/3 to 1/2 the time to achieve comparable or even better robustness with the addition of only two lines of code.
To motivate the present approach, we develop a general formulation of adversarial training as an optimal control problem, from which an approximate optimality criterion can be derived based on the Pontryagin’s maximum principle.
This criterion is related to but different from the empirical FOSC criterion (Wang et al., 2019) that improves the robustness of adversarial training by determining the number of adversarial training steps according to the empirical criterion.
We will also demonstrate in our experiments that unlike FOSC, algorithms derived from our proposed criterion leads to acceleration.
Our contributions are as follows:
We propose an adversarial training algorithm, Amata, that gradually increases the number of iterations and decreases the step size for the inner maximization.
We show that comparable or even better robustness can be achieved with much reduced computational overhead.
We also prove the convergence of our algorithm.
To obtain more theoretical insight, we develop a general formulation of adversarial training subject to hyper-parameters in the inner maximization loop as an optimal control problem.
This includes the PGD-based methods considered in this work
but potentially encompasses a larger class of annealed or adaptive adversarial training algorithms.
Using the Pontryagin’s maximum principle from optimal control theory, we provide a principled criterion to measure the near-term optimality of an annealing schedule for inner maximization, thereby guiding and validating our proposed algorithm in balancing the trade-off between robustness and computational cost.
A CCELERATING A DVERSARIAL T RAINING BY A NNEALING M ECHANISM
In this section, we will ﬁrst introduce the proposed adversarial training algorithm, which aims to balance the computational cost and the accuracy of solving inner maximization.
A proof of the convergence of the algorithm can be found in the Appendix.
We then develop a general optimal control formulation of adversarial training and derive a criterion based on the Pontryagin’s maximum principle (Boltyanskii et al., 1960).
The criterion is shown to be effective in quantifying adversarial training performance both on accuracy and computational efﬁciency, justifying the superiority of the proposed algorithm.
P ROPOSED ANNEALING ADVERSARIAL TRAINING ALGORITHM
The proposed adversarial training algorithm Amata is found in Algorithm 1.
Compared with PGD, we only need to add two lines of code that are shown in blue.
The intuition behind Amata is that, at the initial stage, the neural network focus on learning features, which might not require very accurate adversarial examples.
Therefore, we only need coarse approximations of the inner maximization problem solutions.
With this consideration, we set a small number of update steps but with a large step size for inner maximization, and then gradually increase K and decreases α to improve the quality of inner maximization solutions.
This adaptive annealing mechanism would largely reduce the computational cost in the early iterations while still maintaining reasonable accuracy for the entire optimization.
Algorithm
Input: T :training epochs; K min : the minimum number of adversarial perturbations; K max : the maximum number of adversarial perturbations; θ : parameter of neural network to be adversarially trained; B :mini-batch; α : adversarial training time step; η : learning rate of neural network parameters.
τ : constant, maximum perturbation: (cid:15) .
Initialization θ = θfor t = 0 to T − 1 do
Compute the annealing number of adversarial perturbations:
[Equation]
Compute adversarial perturbation step size: α t = τK t for each mini-batch x 0 B do for k = 1 to K t do
Compute adversarial perturbations: x k B = x k − 1 B + α t · sign ( ∇ x (cid:96) ( h θ ( x k B ) , y ) x k B = clip( x k B , x 0 B − (cid:15), x 0 B + (cid:15) ) end for θ t +
=
θ t − η ∇ θ (cid:96) ( h θ t ( x K t B ) , y ) end for end for
Collect θ T as the parameter of adversarially-trained neural network.
In the following section, we develop a general formulation of adversarial training based on optimal control theory and derive a novel criterion to quantify the optimality of a training strategy, taking into account the trade-off between accuracy and efﬁciency.
Importantly, we show that our proposal, Amata, performs favorably under this criterion, thus providing theoretical justiﬁcation for our approach.
2. O PTIMAL CONTROL FORMULATION OF ADVERSARIAL TRAINING
In essence, the PGD-based adversarial training algorithm (Madry et al., 2017) represents a sequence of relaxations of the original min-max problem (1).
First, the outer minimization over θ is replaced by gradient descent.
Then, a full solution of the inner maximization is replaced by a number of PGD steps in the steepest ascent direction.
Consequently, a natural question is how to choose the number of steps, the step size or any other hyper-parameters associated with this relaxed version of the inner maximization, and how their choices affect the performance of the overall algorithm.
This is the central point of analysis in this paper and the basis of the algorithm proposed.
It turns out that this question can be systematically formulated in the framework of optimal control theory (Bertsekas, 1995).
We now introduce the general setup of our problem and establish connections with optimal control, and in particular the classical maximum principle in the calculus of variations.
For simplicity of presentation, let us consider just one ﬁxed input-label pair ( x 0 , y ) , since the nsample case is similar.
The original min-max adversarial training problem is
[Equation]
The ﬁrst relaxation is to replace the outer minimization with gradient descent so that we obtain the iteration
[Equation]
Then, the remaining maximization in each outer iteration step is replaced by an abstract algorithm
[Equation]
which solves the inner maximization approximately.
Here, we assume that the algorithm depends on the parameters of our neural network, as well as hyper-parameters u which takes values in a closed subset G of a Euclidean space.
No further assumptions is placed on G , which may be a continuum, a discrete set, or even a ﬁnite set.
This relaxation leads to the following general iterations
[Equation]
Observe that Algorithm 1 is a particular realization of (6) where A θ t ,u t represents the inner PGD loop and u t = { α t , K t } are the hyper-parameters we pick at each t .
Nevertheless, Equation (6) represents a general formulation of an inner-outer loop adversarial training algorithm.
For small η , we can replace (6) by an ordinary differential equation with the identiﬁcation s ≈ tη :
[Equation]
Formulated this way, it is immediately clear that we can approach this problem from a control perspective: the dynamics of the trainable parameters are given by (7) and the hyper-parameter choices at each inner algorithm u
s are the controls.
Our goal is two-fold: on a training interval [ T 1 , T 2 ] in the outer loop, we want to minimize some loss under adversarial training measured by a real-valued function Φ( θ ) while minimizing training cost associated with each inner algorithm loop under the hyper-parameter u , which is measured by another real-valued function R ( u ) .
We thus arrive at the general optimal control formulation of our problem:
[Equation]
subject to:
[Equation]
where
[Equation]
where we have deﬁned the shorthand u T 1 : T 2 = { u s : s ∈ [ T 1 , T 2 ] } and L ∞ T 1 : T 2 :
= L ∞ ([ T 1 , T 2 ] , G ) .
In this paper, we take Φ to be the DNN’s prediction loss given the adversarial example (adversarial robustness), and R is set as γK t where γ is the coefﬁcient for adversarial robustness and training time trade-off.
This is to account for the fact that when K t increases, the cost of the inner loop training increases accordingly.
The integral over t of R is taken so as to account for the total computational cost corresponding to a choice of hyper-parameters { u s } .
The objective function taken as a sum serves to balance the adversarial robustness and computational cost, with γ a balancing coefﬁcient.
2. P ONTRYAGIN ’ S M AXIMUM P RINCIPLE
In the last section, the problem of choosing hyper-parameters in the inner loops of adversarial training has been formulated as an optimal control problem in (8).
Now, we show how this connection can help us design and validate algorithms.
A classical result in calculus of variations gives the following necessary conditions for optimality.
For more background on the theory of calculus of variations and optimal control, we refer the reader to Boltyanskii et al.
Bertsekas et al. Theorem 1 (Pontryagin’s Maximum Principle (PMP) (Boltyanskii et al., 1960)) .
Let u ∗ T 1 : T 2 ∈
L ∞ T 1 ,T 2 be a solution to (8) .
Suppose F ( θ , u ) is Lipschitz in θ and measurable in u .
Deﬁne the
Hamiltonian function
[Equation]
Then, there exists an absolutely continuous co-state process p ∗ T 1 : T 2 such that
[Equation]
In short, the maximum principle says that a set of optimal parameter choices { u ∗ s } (in our speciﬁc application, these are the optimal choices of inner-loop hyper-parameters as the training proceeds) must globally maximize the Hamiltonian deﬁned above for each outer iteration.
This statement is especially appealing for our application because unlike ﬁrst-order gradient conditions, the PMP holds even when our hyper-parameters can only take a discrete set of values, or when there are nontrivial constraints amongst them.
The maximization criterion holds generally under these conditions.
Moreover, we now show that it gives us a quantitative measure of deviation from optimality, from which we can analyze and design algorithms.
Quantitative Measure of Sub-optimality.
Given any hyper-parameter choice u T 1 : T 2 over the training interval, let us deﬁne its “distance” from optimality as
[Equation]
where { θ u s , p u s : s ∈ [ T 1 , T 2 ] } represents the solution of the equations (10) and (11) with u s in place of u ∗ s .
Observe that C ( u T 1 : T 2 ) ≥ 0 for any u T 1 : T 2 with equality if and only if u T 1 : T 2 satisﬁes the PMP for almost every s ∈ [ T 1 , T 2 ] .
Hence, C can be used as a measure of sub-optimality.
When C is small, our annealing strategy { u s } is close to at least an locally optimal strategy, where as when it is large, our annealing strategy is far from an optimal one.
One-step Approximation and Adversarial Training Criterion.
Equation (13) requires information on the entire training interval and may be expensive to compute.
In this paper, we use a one-step approximation where we take T 1 = t (current iteration) and T 2 = t + η with η (cid:28) 1 .
In this small interval, we can also take u s to be constant and thus equal to some u .
This is in some sense a greedy approximation, where we evaluate in the immediate short term the optimality of a piece-wise constant choice of hyper-parameters.
From (13) we then obtain via a Taylor expansion and our particular choices of Φ and R (See Appendix D)
[Equation]
[Equation]
with A θ t ,α,K denoting the inner PGD loop starting form x with K steps and step size α .
Criterion (14) is a greedy version of the general criterion derived from the maximum principle.
It can be used to either evaluate the near-term sub-optimality of some choice of hyper-parameters u , or to ﬁnd an approximately optimal hyperparameter greedily by solving C ( u , t )
= 0 for u , which amounts to maximizing the ﬁrst term.
In this paper, we use Bayesian optimization 2 to perform the maximization in (14) to evaluate and select strategies from the controllable space G .
Remark.
By applying the method of successive approximations (MSA) (Chernousko &
Lyubushin, 1982; Li et al., 2017; Li & Hao, 2018; E et al., 2019), we can also obtain a solution of the PMP by iterating
[Equation]
Subsequent work will explore adaptive adversarial training acceleration based on this approach.
We remark that although we appeal to control theory tools here, the application scenario is very different from prior work in Li et al.
; Li & Hao (2018); E et al.
For the latter, the controlled dynamics are idealized forward propagation through a deep neural network and the controls are the trainable weights of the network.
In contrast, in the current setting the controlled dynamics are the evolution of weights under gradient descent in the outer loop and controls are the hyper-parameters for the adversarial perturbation inner loop.
Comparison with FOSC criterion: Wang et al.
(2019) proposed an empirical criterion to measure the convergence of inner maximization:
[Equation]
There are some similarities between our criterion and FOSC when we do not consider the computational cost term R .
For example, when the stationary saddle point is achieved, both our criterion and FOSC reach the minimum.
However, our proposed criterion is quite different from FOSC in the following aspects:
Our criterion is derived from the optimal control theory, whereas FOSC is concluded from empirical observations.
Our criterion takes computation costs into consideration, whereas FOSC only considers the convergence of adversarial training.
Our criterion is based on the gradient of DNN parameters, whereas FOSC is based on the gradient of the input.
Measuring the gradient of DNN parameters is arguably more suitable for considering robustness-training time trade-off as the variance of the DNN parameters is much larger than the input during training.
2. N UMERICAL JUSTIFICATION OF A MATA
For simple linear-quadratic control problems, we can typically derive some analytical representations of an optimal control.
However, for highly-nonconvex DNNs, we can only use a numerical form of the optimal control criterion (Equation 14) to analyze Amata for robustness and computational efﬁciency trade-off.
We use the LeNet neural network 3 for MNIST classiﬁcation as an example.
As a sanity check, we ﬁrst consider only adversarial robustness and neglect computational cost by setting γ = 0 and use the criterion to evaluate different adversarial training settings for PGD.
Recalling Algorithm 1, we will vary the other hyper-parameters in the inner loop: α (step-size of
PGD) and K (number of PGD steps). In each case, we compute the optimal control criterion values on the training dataset and evaluate the adversarially trained networks’ performance against PGDattack on the test dataset.
Sanity check 1 In this case, we ﬁx K = 5 and set α in [0 . 01 , 0 .
Sanity check 2 In this case, we ﬁx α = 0 .
and set K in [5 , 10 , 20 , 30 , 40 , 50] .
The results are shown in Figure 1 (a)(b), where robustness is the prediction accuracy of the trained networks under PGD-40 attack on the test dataset.
From these results, we can observe that the robustness and the criterion value C are negatively correlated under varying α and K , as expected.
Now, we will use the same setting as sanity checks but with different values of γ to numerically analyze the trade-off between robustness and training time for Amata and PGD.
Setting 1: ﬁxed α , varying K and γ : in this case, we set α as 0.01, K in [5 , 20 , 40] and γ in [0 . 02 , 0 . 04 , 0 . 06 , 0 . 08] .
The result for Setting 1 is shown in Figure 1 (c).
From this result, we can observe that with the increase of γ , reducing the computation time becomes more important.
For example, when γ is 0.02, using PGD-40 is the best strategy (the lowest C value).
When γ increases to 0.06 or 0.08, using PGD-20 achieves the best trade-off under the criterion.
[Figure]
[Table]
Amata( K min = 5 , K max = 40 )
[Table]
Amata( K min = 10 , K max = 40 )
[Table]
Next, we set γ as 0.04 and 0.08 and use the criterion to evaluate the Amata and compare it with other settings of PGD. It can be seen that Amata is better than PGD with ﬁxed numbers of perturbation steps.
Note that Amata also achieves better robustness than the highest robustness of PGD settings (PGD-40) with 91 .
47% adversarial accuracy compared to 90 .
56% adversarial accuracy.
Remark:
Although computing the exact optimal control strategy for DNN adversarial training is inapplicable for real-time applications, with the criterion derived from the PMP, we are able to numerically compare the optimality of different adversarial training strategies.
From this numerical evaluation, we have demonstrated that the proposed Amata algorithm is close to an optimal adversarial training strategy, or at least one that satisﬁes the maximum principle.
We will show that our algorithm can achieve similar or even better adversarial accuracy much faster with empirical experiments on popular DNN models later in Section 3.
E XPERIMENTS
To demonstrate the effectiveness of Amata, we conduct experiments on MNIST and CIFAR10.
We ﬁnd that the models trained with Amata have comparable or even better performance with that of the PGD adversarial training, but with much less computational cost.
For our experiment, we use
PyTorch 1.0.0 and a GTX1080 Ti GPU.
We evaluate the adversarial trained networks against PGD and Carlini-Wagner (CW) attack (Carlini & Wagner, 2017).
3. MNIST CLASSIFICATION
We consider the standard MNIST classiﬁcation using the “smallCNN” architecture that was used in (Zhang et al., 2019b).
We set τ to be 0.4 for Amata.
In the experiment, We achieve 96% adversarial accuracy within 275 seconds while it takes PGD-40 1019 seconds to reach the same level.
We also experimented with the FOSC adversarial training method in (Wang et al., 2019) and found that it took FOSC 3663 seconds to achieve the same level, which conﬁrms our previous analysis that our optimal control criterion is more suitable for accelerating adversarial training.
The error-time curve is shown in Figure 2 (a).
Then, we run all methods for 57 epochs for full convergence.
The robustness of convergence results are shown in Table 2.
From Table 2, we can see that naively reducing the number of adversarial perturbations will hurt the robustness of DNNs.
[Figure]
[Table]
3. CIFAR10 CLASSIFICATION
For the more complex CIFAR10 classiﬁcation task
[Table]
we use the PreAct-Res-18 network (Madry et al., 2017).
We set τ to be 20/255 for Amata.
The proposed Amata method took 3045 seconds to achieve less than 55% robust error while for PGD-10, it took 6944 seconds.
We also tested FOSC adversarial training and found that it took 8385 seconds to reach the same level, which is a bit longer than PGD10.
The error-time curve is shown in Figure 2 (b).
We further run all methods for 100 epochs for convergence.
The results are shown in Table 3.
[Table]
C ONCLUSION
We have proposed a modiﬁcation amounting to two lines of code to PGD adversarial training that achieves comparable or even better robustness with only 1/3 to 1/2 the computational cost over a variety of benchmarks.
Moreover, a general optimal control formulation of adversarial training with hyper-parameters is developed to analyze this procedure and justify its superior performance through a numerical criterion based on the Pontryagin’s maximum principle.
A proof of convergence of our algorithm is also provided in Appendix C. As a point of future work, we will explore adaptive methods for adversarial training based on the optimal control formulation we introduced here.
This approach can also lead to algorithms that can be combined with YOPO or parallel adversarial training methods for maximal efﬁciency.
An example is shown in Appendix B.3.
A A PPENDIX :A DDITIONAL EXPERIMENT DETAILS
We use similar experiment settings as in (Zhang et al., 2019a).
A. MNIST CLASSIFICATION
In this experiment, for PGD adversarial training, we set the adversarial constraint (cid:15) as 0.3, the step size as 0.01.
For CW attack results in this experiment, we set the parameter eps to be 100 and run for 100 iterations in this reference implementation https://github.com/xuanqing94/BayesianDefense/ blob/master/attacker/cw.py.
For display the error-time curve, we use the smoothing function used in
Tensorboard for all methods.
The smoothing parameter is set as 0.09.
For outer minimization, we use the stochastic gradient descent method and set the learning rate as 0.1, the momentum as 0.9, and the weight decay as 5e-4.
A. C IFAR 10 CLASSIFICATION
In this experiment, for PGD adversarial training, we set the adversarial constraint (cid:15) as 8/255, the step size as 2/255.
For CW attack results in this experiment, we set the parameter eps to be 0.5 and run for 100 iterations in this reference implementation https://github.com/xuanqing94/BayesianDefense/ blob/master/attacker/cw.py.
For display the error-time curve, we use the smoothing function used in Tensorboard for all methods.
The smoothing parameter is set as 0.6.
For outer minimization, we use the stochastic gradient descent method and set the learning rate as 5e-2, the momentum as 0.9, and the weight decay as 5e-4.
We also use a piece-wise constant learning rate scheduler in PyTorch by setting the milestones at the 75-th and 90-th epoch with a factor of 0.1.
B A PPENDIX :A DDITIONAL EXPERIMENT RESULTS B. W IDE R ES N ET -34 RESULTS
We experiments using WideResNet-34 networks for CIFAR10 classiﬁcation.
We use the same experiment setting as the CIFAR10 classiﬁcation task in the paper.
We run all methods for 100 epochs for full convergence.
The result is shown in Table 4. Training
[Figure]
[Table]
Amata( K min = 2 , K max = 10 )
[Table]
B . A DDITIONAL MNIST RESULTS
We further plot the MNIST results in Figure 2 but with the x-axis denoting the number of training epochs.
The results are shown in Figure 3.
From this ﬁgure, we can see that the time-saving of our method is mainly due to the savings in the adversarial examples generation step.
This is expected as if we achieve faster convergence rates with regard to the number of epochs, it may indicate that the adversarial examples generated by the proposed mechanism is signiﬁcantly weaker and the outer minimization step converges faster.
[Figure]
B
A MATA +YOPO
To demonstrate that our method can be incorporated in other acceleration method to further improve the performance, we implement the Amata in YOPO MNIST classiﬁcation experiment 4 .
For Amata incorporation, we gradually increase the K and decrease σ in the codes that is similar to the case of modifying the PGD algorithm.
We run Amata+YOPO and YOPO for 40 epochs as in the original setting.
The results are shown in Figure 4.
From Figure 4, we can see that Amata+YOPO takes 294 seconds to reach the adversarial accuracy of 94%, which is only around half of the time for
YOPO to achieve the same adversarial accuracy.
It is also worth noting that Amata+YOPO achieves even better adversarial accuracy when converged.
From this example, we can see that Amata can be seamlessly incorporated in other adversarial training acceleration algorithm to provide further acceleration.
[Figure]
B
E VALUATION AGAINST DIFFERENT SETTINGS OF PGD
The reason we choose PGD-40 for evaluation is that is a strong adversarial attack that is also used in other papers (Zhang et al., 2019a).
We also try other settings, such as PGD-20 and PGD-60.
Other settings are the same as our original settings in MNIST classiﬁcation experiment.
The results are shown in Figure 5.
We can see that compared with the case of PGD-40 for evaluation, both
Amata and PGD-40 are able to achieve above the 96% adversarial accuracy but at different speeds.
In the case of PGD-
[Figure]
Amata takes around 28% training time of the PGD-40 to achieve the 96% adversarial accuracy.
In the case of PGD-60, Amata takes around 60% training time of the PGDto achieve the 96% adversarial accuracy
[Figure]
B. O THER DECAY SCHEME FOR CONTROLLING ADVERSARIAL TRAINING
Finding better decay scheme is an interesting future direction.
However, using more complex schemes may introduce extra parameters, while one of the major challenges for machine learning methods to be practically useful for industry practitioners is the complexity of the method.
We tried another exponential scheme:
[Equation]
(17) where K t is the number of PGD adversarial training steps at t -th epoch, K min is the minimum number of PGD steps in the beginning, K max is the maximum number of PGD steps in the last epoch, η is the hyper-parameter controlling the shape of the scheme.
This design ensures that when
K 0 =
K min and K T =
K max to make the exponential decay scheme comparable with the linear scheme used in our paper.
However, we tried different parameters of eta ranging from 0.1 to 5, but did not performance improvements.
The results are shown in Figure 6.
The ”Amata (Exp eta)” in the legend denotes the exponential decay scheme and the ”Amata” in the legend denotes the original linear decay scheme.
From Figure 6, we can see that the the new exponential decay scheme cannot outperform the linear decay scheme.
[Figure]
C A PPENDIX :P ROOF OF CONVERGENCE
We provide a convergence analysis of our proposed Amata algorithm for solving the min-max problem.
The proof of convergence in this paper largely follows (Wang et al., 2019; Sinha et al., 2018).
First, we will introduce some notations ﬁrst for clarity.
We denote x ∗ i ( θ )
=
arg max x i ∈X i f ( θ , x i ) where f ( θ , x i ) is a short hand notation for the classiﬁcation loss function,
X i = { x | (cid:13)(cid:13) x − x 0 i (cid:13)(cid:13) ≤ (cid:15) } , and ¯ f i ( θ ) =
max x i ∈X i f ( θ , x i ) , then ˜ x i ( θ ) is a δ -approximate solution by our algorithm to x ∗
i ( θ ) , if it satisﬁes that:
[Equation]
In addition, denote the objective function in Equation 1 by L S ( θ ) , and its gradient by ∇ L S ( θ ) =n (cid:80) ni
=1 ∇ ¯ f i ( θ ) .
Let g ( θ ) = 1 |B| (cid:80) i ∈B ∇ θ ¯ f ( θ ) be the stochastic gradient of L S ( θ ) , where B is the mini-batch.
Then, we have E [ g ( θ )]
= ∇ L S ( θ ) .
Let ∇ θ f ( θ , ˜ x
( θ )) be the gradient of f ( θ , ˜ x
( θ )) with respect to θ , and ˜ g
( θ ) = 1 |B| (cid:80) i ∈B ∇ θ f
( θ , ˜ x i ( θ ) be the approximate stochastic gradient of
L S ( θ ) .
Before we prove the convergence of the algorithm, we have following assumptions.
Assumption 1.
The function f ( θ , x ) satisﬁes the gradient Lipschitz conditions:
[Equation]
where L θθ , L θ x , and L x θ are positive constants.
Assumption 1 was used in (Sinha et al., 2018;
Wang et al., 2019).
Assumption 2.
The function f ( θ , x ) is locally µ -strongly concave in X
= { x : (cid:13)(cid:13) x − x
i (cid:13)(cid:13) ∞ ≤ (cid:15) } for all i ∈ [ n ] , i.e., for any x 1 , x 2 ∈ X i :
[Equation]
where µ is a positive constant which measures the curvature of the loss function.
This assumption was used for analyzing distributional robust optimization problems (Sinha et al., 2018).
Assumption 3.
The variance of the stochastic gradient g ( θ ) is bounded by a constant σ 2 > 0 :
[Equation]
where ∇ L S ( θ ) is the full gradient.
The Assumption 3 is commonly used for analyzing stochastic gradient optimization algorithms.
Theorem 2.
Suppose Assumptions 1,2, and 3 holds.
Denote ∆ =
L S ( θ 0 ) − min θ L S ( θ ) .
If the step size of outer minimization is η t = min(1 /L, (cid:113) ∆ TLσ 2 ) .
Then, we have:
[Equation]
where L = L θ x L x θ /µ + L θθ .
The proof of this theorem can be found in the Appendix.
Theorem 2 indicates that if the Amata ﬁnds solutions of the inner maximization problem closer enough to the maxima, Amata can converge at a sublinear rate.
Lemma 1.
Under Assumption 1 and Assumption 2, we have L S ( θ ) is L -smooth where L =
L θ x L x θ /µ
+ L θθ , i.e., for any θ 1 and θ 2 it holds:
[Equation]
The proof of Lemma 1 can be found in Wang et al.
Lemma 2.
Under Assumption 1 and Assumption 2, the norm of difference between the approximate stochastic gradient g ( θ ) and the stochastic gradient ˜ g ( θ ) is bounded, i.e., it holds that:
[Equation]
Proof.
We have
[Equation]
where the ﬁrst inequality is from the triangle inequality
[Equation]
and the second inequality is from Assumption 1.
Next [Equation] we insert Equation 18 into the above inequality then:
[Equation]
which completes the proof.
Now we can prove the Theorem 2:
Proof.
From Lemma
[Equation]
we have:
[Equation]
Note that E
[ g ( θ t )]
= ∇ L S ( θ ) , taking expectation on both sides of the inequality conditioned on θ t .
Then we use Assumption 3 and Lemma 2 and simplify the above inequality:
[Equation]
Taking the telescope sum of the above equation from t = 0 to t =
T − 1 , we have
[Equation]
−
[Equation] We set η t = min(1 /L, (cid:113) ∆ TLσ 2 ) , we have
[Equation]
Thus, we complete the proof.
D A PPENDIX :A PPROXIMATION OF THE OPTIMAL CONTROL CRITERION
In this section we show how to derive the approximation (14) from (13).
The primary assumption we make is that T 2 − T 1 = η (cid:28) 1 , which allows one to use a local approximation for various functions to derive a simple-to-compute criterion.
For this reason, the derivation here will be largely heuristic.
First, we assume that we consider a constant control u s ≡ u on the interval s ∈ [ T 1 , T 2 ] ≡ [ t, t + η ] .
Next, recall that the adversarial robustness which serves as our terminal loss function for the control problem is Φ( θ ) = max z (cid:96) ( h θ
[ A θ , z ( x )] , y ) .
In practice, any control that sufﬁciently conducts the adversarial perturbation serves as a good approximation.
This is because the DNNs are very prone to adversarial attacks before the convergence of adversarial training and the real-time adversarial loss is close to the worst-case adversarial loss.
Thus, we can approximate Φ( θ ) by (cid:96) ( h θ
[ A θ , z ( x )] , y ) by some chosen z that makes practical computations easy.
Now, Assuming regularity we can expand the state equation (10) to get to leading order as η → [Equation]
[Equation]
On the other hand, the co-state equation (11) gives
[Equation]
But, by deﬁnition F ( θ , u ) =
−∇ θ (cid:96) ( h θ
[ A θ , u ( x )] , y ) .
Then, for any s ∈ [ t, t + η ] , we have from (21) and (22) that
[Equation]
Note that the point of which the various expressions the above are expanded from appears arbitrarily chosen from a strict mathematical sense, but these choices enable fast practical computation.
Any of such expansions, assuming enough regularity, are equivalent in the limit η → 0 .
Plugging the above into the expression for C (Eq. 13), we have
[Equation]
As discussed in the beginning of this section, to ease computation, we may replace z by v in the ﬁrst term and u in the second term, assuming that they give sufﬁcient adversarial perturbations to get
[Equation]
[Equation] Upon substituting v = ( K, α ) and u = ( K t , α t ) gives the desired result [Equation]