T ACTICS ON R EFINING D ECISION B OUNDARY FOR I MPROVING C ERTIFICATION - BASED R OBUST
T RAINING
Anonymous authors
Paper under double-blind review
A BSTRACT
In certiﬁcation-based robust training, existing methods utilize relaxation based methods to bound the worst case performance of neural networks given certain perturbation.
However, these certiﬁcation based methods treat all the examples equally regardless of their vulnerability and true adversarial distribution, limiting the model’s potential in achieving optimal veriﬁable accuracy.
In the paper, we propose new methods to include the customized weight distribution and automatic schedule tuning methods on the perturbation schedule.
These methods are generally applicable to all the certiﬁable robust training with almost no additional computational cost.
Our results show improvement on MNIST with (cid:15) = 0 .
3 and
CIFAR on (cid:15) = 8 / 255 for both IBP and CROWN-IBP based methods.
I NTRODUCTION
Deep neural networks (DNNs) have been shown to be highly vulnerable to adversarial attacks, carefully-crafted inputs that are nearly indistinguishable from naturally-occurring data but are misclassiﬁed by the network (Goodfellow et al., 2014; Szegedy et al., 2014).
There exist many algorithms for both crafting adversarial attacks (Papernot et al., 2016) and building neural networks that are robust against such attacks.
Fast gradient sign method (FGSM)
(Goodfellow et al., 2014) was the very ﬁrst approach to generate strong adversary.
Projected gradient descent (PGD) (Madry et al., 2018) is one of the most successful and widely-used defense methods available.
Adversarial training seeks to minimize the worst-case loss under adversarial perturbations within a pre-deﬁned perturbation level, where multi-step PGD is used to estimate the worst-case attack during training.
Compared to standard training, the adversarial term introduces risk of over-ﬁtting (Moosavi-Dezfooli, 2021;
Rice et al., 2020; Wang et al., 2019) and training instability (Tsipras et al., 2019; Zhang et al., 2020b) for adversarial training.
There exist many related works on improving the model performance by additional regulation (Zhang et al., 2020b; Cisse et al., 2017) and customizing training curriculum (Zhang et al., 2019;
Wang et al., 2020; Cai et al., 2018) for attack-based scenario.
While adversarial training has been shown to be empirically effective against many types of attacks, it cannot be proven that the resultant models are robust against all adversaries.
In fact, it has been shown that many defense methods dependent on heuristic techniques, including adversarial training, can be bypassed by stronger adversaries (Athalye et al., 2018).
This has motivated a separate branch of research focused on robustness certiﬁcation/veriﬁcation: computing provable guarantees on the robustness performance of neural networks against inputs with arbitrary perturbations within some (cid:96) p norm-bounded ball.
There are two main types of veriﬁcation methods: complete and incomplete veriﬁcation.
The former computes exact robustness bounds using computationally-expensive methods such as mixed-integer programming (MIP) (Tjeng et al., 2019; Bunel et al., 2018), whereas the latter provides looser robustness bounds with different branches of methods like randomized smoothing (Cohen et al., 2019; Salman et al., 2019; Lecuyer et al., 2019), Lipschitz-based robustness(Trockman & Kolter, 2021; Tsuzuku et al., 2018) and convex adversarial polytype (Weng et al., 2018; Zhang et al.,
; Dvijotham et al., 2018b; Gowal et al., 2019) on which in this paper we mainly focus.
A sparsely related branch of research, called certiﬁed robust training (Dvijotham et al., 2018a; Gowal et al., 2019; Zhang et al., 2020a), aims to train a certiﬁably robust model.
These methods compute veriﬁed robustness bounds and incorporate them into the training process, such that the resultant models can then be proven to be robust using a veriﬁcation method.
Currently, the most efﬁcient certiﬁed training method is interval bound propagation (IBP) (Gowal et al., 2019), which requires only two additional forward passes during training.
It is important to note that IBP is signiﬁcantly more efﬁcient than adversarial training, which often require many PGD steps to achieve high robustness (Madry et al., 2018).
In standard certiﬁed training, a uniform (cid:15) and loss function weight are usually used across all the training examples, this is not ideal for optimal veriﬁed accuracy since the examples are not necessarily equivalent in terms of vulnerability.
1. O UR CONTRIBUTIONS
In this paper, we propose two novel methods to improve robustness via reﬁning certiﬁed decision boundary for veriﬁable adversarial training methods such as IBP and CROWN-IBP.
In particular, our algorithms are generally applicable to all the veriﬁable adversarial training methods at almost no additional computational cost.
We sum up the key contributions as following: 1.
Zeng et al.
(2020) pointed out the adversarial example distribution deviates from the clean data.
We further analyze the importance weight to correct empirical distribution from a novel perspective and theoretically prove more weight is needed for the examples closer to decision boundary if sampled from clean data distribution.
Building upon previous analysis, we come up with a symmetrical re-weighting function based on worst case margin of the correct labels, emphasizing the examples around the decision boundary.
For veriﬁable adversarial perturbation, empirically a slightly larger (cid:15) train achieves optimal evaluation robustness accuracy on (cid:15) eval , while this uniform setup is not ideal for examples around decision boundary.
To address the issue of large perturbation, we developed an auto-tuning algorithm to customize the (cid:15) train for each individual example.
B ACKGROUND 2. A DVERSARIAL A TTACKS AND T RAINING
Let D =
( x i , y i ) } ni =1 represent the dataset, where x i ∈ X and y i ∈ Y = { 0 , 1 , ..., C − 1 } .
Let
B ( x i , (cid:15) ) denote the set of points in the (cid:96) p -norm ball with radius (cid:15) around x i .
The objective function is min θ
[Equation]
n n
[Equation]
l
[Equation]
f θ
[Equation]
x
[Equation]
i ) , y i ) , where x
[Equation]
i
[Equation]
x
[Equation]
x
[Equation] [Equation]
f θ : X −→ R C is a score function and l : R C × Y −→ R is the loss function.
Adversarial training tackles this min-max problem by alternating between solving inner loop by attack method to estimate the worst-case adversarial scenario in B ( x i , (cid:15) ) and outer loop to update the model parameters and minimize loss function.
2. C ERTIFIED T RAINING
Robustness Veriﬁcation.
Different from attack-based training, certiﬁed training provides a guarantee for worst case scenario via bounding the neural network outputs.
The certiﬁed accuracy is the lower bound of robustness accuracy under any attack method, thus improving the certiﬁed accuracy helps in understanding the potential of the neural network in defending against adversarial attacks.
Interval Bound Propagation.
There have been many proposed neural network veriﬁcation algorithms that can be used to compute worst case output.
IBP (Gowal et al., 2019) utilizes a simple, interval arithmetic approach to propagate bounds through a network.
Let z k − 1 denote the input to a layer z k .
IBP bounds z k by computing lower and upper bounds z k , z
k
such that z k ≤ z k ≤ z k holds element-wise.
For afﬁne layers represented by h k ( z k − 1 ) =
W z k − 1 + b , IBP computes: z k
=
W
z k − 1 + z k −
[Equation]
and
[Equation] [Equation]
- gating the bounds through the network allows us to compute the upper and lower bound of last layer logits z K , z K and evaluate if an input x is veriﬁably robust.
The logit of the true class equals the lower bound and the logits of other classes equal to the upper bound:
[Equation]
if
[Equation]
IBP training uses a hyperparameter schedule on (cid:15) (starting from 0 and increasing to (cid:15) train , typically set at (cid:15) train which is slightly larger than (cid:15) eval ) and a mixed loss function that combines natural and robust cross-entropy loss: min
θ E ( x ,y ) ∼P [ κl ( z K , y )
+ (1 − κ ) l (ˆ z K , y )] , where P is the data distribution, l is the cross entropy loss, κ is a hyperparameter that balances the weight between natural and robust loss, and ˆ z K represents the worst case logits computed using IBP.
CROWN-IBP.
CROWN was introduced by Zhang et al.
and achieves a tight bound by adaptively selecting the linear approximation.
Zhang et al.
(2020a) proposed CROWN-IBP combining
IBP forward bounding pass and CROWN style backward bounding pass.
CROWN-IBP trained models has a tighter bound compared with IBP models under the IBP metric, with incurring cost on computational efﬁciency from CROWN backward propagation and generally requiring more epochs for training stability.
2. A TTACK - BASED RE - WEIGHTING
Motivated by the idea that all data points are not equally vulnerable to adversarial attack, researchers proposed methods to re-weight the minimax risk by adding a re-weighting term ω
( x i , y i ) ahead of individual example loss.
For instance, Zeng et al.
(2020) noted the adversarial distribution deviation from the clean examples and assigned weights that monotonically decreases with the examples’ conﬁdence margin.
The “conﬁdence margin” is calculated by attack methods such as PGD, then the risk is re-weighted by a parameterized exponential family as: min θ 1 n (cid:80) ni
=1 ω ( x i , y i ) l ( f θ ( x (cid:48) i ) , y i ) ,
s.t. ω
( x i , y i ) =
exp ( − α margin ( f θ , x i + δ i , y i )) , where α is a positive hyper-parameter and the new risk biases larger weights towards the mis-classiﬁed examples.
Zhang et al.
(2020c) propose GAIRAT (Geometry-Aware Adversarial Training), a method to reweight adversarial examples based on how close they are to the decision boundary.
During the training process, GAIRAT explicitly assigns larger/smaller weights to data points closer/farther to the decision boundary respectively: ω ( x i , y i )
=
(1 + tanh ( λ + 5 × (1 − 2 × κ ( x i , y i ) /K ) / 2 , where λ is a hyper-parameter, K is the maximal allowed attack iteration and κ is the least iteration number that the attack method requires to fool the classiﬁer.
Similar to re-weighting, Wang et al.
(2021) improves clean image performance by prioritizing the robustness between the most dissimilar groups
2. C USTOMIZED A DVERSARIAL T RAINING
In most adversarial training methods, the adversarial attack strength usually follows a pre-deﬁned scheduler throughout the training process.
For instance, the perturbation (cid:15) is a uniform number for all examples and usually gradually increases.
Cheng et al.
(2020) argued that this assumption may be problematic given the fact that adversarial examples are not equally vulnerable and proposed an auto-tuning (cid:15) method by assigning individual (cid:15) i to each data and increasing it if the current attack is successful.
In Zhang et al.
(2020b), they proposed friendly adversarial training (FAT) by progressively increasing the attack perturbation with early-stop PGD and alleviating the issue of strong adversarial attack and cross-over mixture.
O UR PROPOSED METHODS 3. B OUND - BASED W EIGHTED LOSS
In classical classiﬁcation tasks, training minimizes the following loss function: E
( x
[Equation]
y ) ∼ P [ l ( f θ ( x ) , y )] estimated by 1 n (cid:80)
ni =1 [ l ( f θ ( x i ) , y i )] .
For adversarial training, let x (cid:48) be the worst case input under veriﬁable adversary or perturbed example from attack, the adversarial examples ( x (cid:48) , y ) ∼ P (cid:48) , where P (cid:48) is an unknown distribution dependent on the clean example distribution P , perturbation method and neural network parameters.
In practice, the training objective is usually 1 n (cid:80) ni =1 [ l ( f θ ( x (cid:48) i ) , y i )] estimating E ( x ,y ) ∼ P [ l ( f θ ( x (cid:48) ) , y )] , while the true objective should be E ( x (cid:48) ,y ) ∼ P (cid:48)
[ l ( f θ ( x (cid:48) ) , y )] .
There exists a discrepancy between the true distribution and empirical sampling method.
To bridge this gap, we follow Zeng et al.
and introduce importance weight
[Equation]
As further exploration, we analyze the importance weight:
[Equation]
where the ﬁrst equality follows from the deﬁnition of conditional probability and second equality is from the fact that the label y i and its distribution does not change through the adversarial process.
The probability ratio gives us more insight in designing the parametric function for importance weight.
Given label y i , there exists a distribution of its corresponding clean image space P ( x | y i ) and similarly for worst case input space P (cid:48)
( x (cid:48) | y i ) .
If the distribution of its corresponding worst case x (cid:48)
i gets more concentrated compared to clean image distribution P ( x | y i ) , then more weight should be given to this example and vice versa.
Theorem 1.
Given a binary classiﬁcation task R n −→ { + , −} with equal prior probability, assume the corresponding examples x + and x − are uniformly distributed in region S + , S − ⊂ R n , S + ∩ S − = ∅ .
If there exists a bijection mapping m := S + (cid:55)→ S − , S − (cid:55)→ S + s.t.
the post-mapping example x (cid:48)
+ and x (cid:48)− distribution remains uniform in each region, the expectation of conditional distribution ratio P (cid:48)
( x (cid:48) | y ) P ( x | y ) over original distribution P ( x , y ) is great or equal than 1.
Example 1.
Figure 1 shows two extreme cases of adversarial example x (cid:48) distribution movement from clean x distribution given decision boundary in a simpliﬁed 2D scenario.
When x is far away from decision boundary, the direction of attack or movement towards worst case example under veriﬁable adversary is same for all the x .
In this case, P (cid:48)
( x (cid:48) | y ) P ( x | y )
≈ 1 .
In the second scenario, assume the decision boundary is a perfect semicircle representing the local curvature of decision boundary and perturbed examples from both classes follow a uniform distribution, then the examples with (cid:48) − (cid:48) label in the outer arc condensed into the inner arc and vice versa for examples with (cid:48) + (cid:48) label moving to the external arc.
Due to the existence of curvature, the area of the outer arc S in is greater than the inner arc S out .
Therefore, from Theorem 1 the expectation of P (cid:48) ( x (cid:48) | y ) P ( x | y ) is greater than 1 .
Another detailed example is illustrated in Appendix B.
In this later example, the uniform perturbation assumption replaced the post-mapping uniform distribution assumption, which is more realistic for adversarial scenario.
From the two extreme case analysis, we claim that the importance weight around decision boundary should be larger due to the local curvature, since any arbitrary x (cid:48) and x distribution pairs (local curvature is relatively larger than perturbation distance but its effect is not negligible on post adversarial distribution) can be seen as an intermediate case of two extremes.
Therefore, we design a parametric weight function emphasizing the examples around the decision boundary in a symmetrical manner.
Similar to Zhang & Liang (2019), we deﬁne the margin of classiﬁer f for a data point ( x , y ) as the probability difference between correct label and the most conﬁdent label among others.
Specially, we use bound-based method such as IBP to get the margin under perturbation: ˆ P = softmax (ˆ z K ) , where ˆ z K is the worst case logits as deﬁned in equation 2, ˆ P is the probability distribution calculated by softmax function given ˆ z K .
[Equation]
The margin is positive when the example can be certiﬁed robust, otherwise the margin is negative.
The magnitude of margin heuristically indicates the ”distance” of the example towards the current decision boundary.
Left half of Figure 2 shows our implementation of re-weighting against vulnerability of examples, where the size of the labels indicate the weights and corresponding perturbations on clean data points.
The most vulnerable examples are around the decision boundary, since the worst case scenario of a small perturbation could cross the decision boundary and fool the classiﬁer.
For the perturbed data points with smaller margin absolute value (closer to boundary), despite it being correctly classiﬁed, we assign larger weights to help the model focus on these data and accommodate more slightly mis-classﬁed data.
On the other hand, for the data points farther from decision boundary, if it is mis-classﬁed (large negative margin), there is no need to assign large weight since the model capacity is limited.
For correctly classiﬁed data, we also assign small weights because they are less related to the decision boundary.
We parameterize the importance weight in the following form:
[Equation]
where γ and α are both positive hyper-parameters to balance the effect of re-weighting.
The full loss function after re-weighting is then deﬁned as:
[Equation]
where κ is a hyper-parameter to balance the trade-off between clean loss and re-weighted robustness loss.
As comparison with other re-weighting techniques, Zhang et al.
(2020c) gives larger weights to the vulnerable points deﬁned by least attack iterations to fool the model.
Zeng et al.
(2020) parameterizes the weight with a similar exponential function given attack-based margin.
Both of their heuristic weight functions monotonically decrease against margin, in which case a heavily mis-classiﬁed point shares a large weight and a well classiﬁed point has a smaller weight.
Our bound-based method method, backed up by a qualitatively theoretical analysis, emphasizes the data points symmetrically around the decision boundary.
3. A UTO - TUNING (cid:15)
In certiﬁed training, the training perturbation magnitude (cid:15) train is usually larger than the (cid:15) eval for optimal test accuracy.
As Table 1 shows the robustness error against different (cid:15) train and (cid:15) eval , the optimal testing accuracy for (cid:15) test = 0 .
35 were both achieved at (cid:15) train = 0 .
4 while smaller (cid:15) train fails certifying larger (cid:15) test .
[Table] [Table]
With slightly larger perturbation during training, the model is more capable to handle unseen data in the testing.
This observation is empirical, however, due to the limitation of model capacity, it is difﬁcult for the model to handle all the examples with very large perturbation.
When (cid:15) train = 0 .
45 , we notice the training instability between different random seeds.
Our intuitive explanation is shown in the right half of Figure 2: With large perturbation, for the vulnerable points around decision boundary, the worst case prediction (indicated by orange dots) protrudes the ideal boundary with a large margin and it is sometimes impossible for the model to ﬁt these points.
Including these worst case scenarios in training encourages over-ﬁtting and compromises the model’s ability to ﬁnd the right boundary.
In implementation, very large perturbation does not help improve the veriﬁed accuracy.
Besides, during the training stage, a fast growing perturbation schedule may potentially cause instability.
Following the above discussion, a natural solution would be customizing perturbation for each example in the training set.
For the majority of points in the interior of decision zone, we would like to encourage large perturbation for the model to enforce a thick decision “gap” (grey colored thick line) for robustness consideration.
Ideally, we would like to have the interior points to see large perturbations for optimal robustness and boundary points with moderate perturbations to avoid over-ﬁtting.
In the following, we propose an adaptive procedure to customize the perturbation for each example based on veriﬁed bound.
The algorithm is shown in Algorithm 1.
E XPERIMENTS 4. D ATASETS AND I MPLEMENTATION
We directly use the code from (Zhang et al., 2020a) provided for IBP and CROWN-IBP and leverage the same CNN architecture(DM-Large) and training scheduler on MNIST and CIFAR-10 datasets.
For MNIST IBP schedule, the neural network is trained for 100 epochs with a batch size of 100.
The base scheduler of training (cid:15) starts from 0 after 3 warm-up epochs and linearly grows to desired maximum training (cid:15) with 17 ramp-up epochs, after which base (cid:15) stays at the targeted level.
The
Adam optimizer learning rate is initialized at 0.001 and decays by 10 times after 25 and 42 epochs.
With MNIST CROWN-IBP schedule, the model is trained for 200 epochs with a batch size of 256.
The ramp-up stage starts from epoch 10 and ends at epoch 50.
For CIFAR-10 dataset, a total of 3200 epochs including 320 warm-up epochs is used for training with a batch size of 1024 and learning rate of 0.0005 following two 10 × decay after epochand 3040.
As a standard treatment, random horizontal ﬂip and crops are used as data augmentation.
[Table]
Notice for CROWN-IBP implementation, we reduce the training batch size from 1024 to 256 due to memory constraint.
The hyper-parameter κ deﬁned in equation 8 linearly decreases from 1 to 0.5 during ramp-up stage.
According to Zhang et al.
(2020a), this scheduler ( κ start = 1 , κ end = 0 . 5 ) achieves better clean accuracy than ( κ start = 0 , κ end = 0 ) and ( κ start = 0 , κ end = 0 ) by ending up with weight on natural cross entropy loss.
All the experiments were performed on 3 random seeds for reproducibility.
Our methods are generally applicable to any certiﬁable adversarial training method.
In the next section, we ﬁrst leverage IBP for illustrative examples followed by CROWN-IBP results.
4. R ESULTS 4.2. E FFECTS OF R E - WEIGHTING
In Table
[Table]
we show the effect of hyper-parameters used for the re-weighting under IBP, where a larger γ indicates a stronger re-distribution of weight for examples and α is a small number to prevent weight vanish when | margin | is close to 1.
The hyper-parameters are evaluated on CIFAR10 at (cid:15) = 8 / 255 and MNIST at (cid:15)
= 0 .
Our optimal hyper-parameter turns out to be γ = 5 , α = 0 .for
both data sets.
Re-weighting method gains 0 .
24% veriﬁed accuracy on MNIST and 0 .
82% on
CIFAR-10.
The goal of re-weighting is to approximate the true adversarial distribution by sampling from clean data distribution.
Unfortunately, it is difﬁcult to visualize the intractable distribution.
From another perspective, we can interpret re-weighting as concentration on the robustness decision boundary and encouragement for larger margin.
Figure 3 shows the comparison of margin distribution for
CIFAR-10 testing data set under testing (cid:15) =
With the vanilla model, the example margins
[Table]
concentrate around the decision boundary.
The re-weighting dilutes the example frequency to both sides, thus the classiﬁcation results are less sensitive to perturbation change.
4.2. E FFECTS OF A UTO - TUNING (cid:15)
In robust training
[Table]
a (cid:15) train usually produces good defensive model for (cid:15) eval which is slightly smaller than itself.
Practitioners refrain from using an even larger (cid:15) due to the marginal gain of robustness accuracy with the cost of sacriﬁcing natural accuracy.
The idea of using auto-tuning (cid:15) is to prevent improperly large perturbation for vulnerable points around decision boundary.
When (cid:15) train is considerably larger than the testing (cid:15) , the worst case points exceed the decision boundary by a unrecoverable large margin due to model capacity.
Our autotuning (cid:15) method trims the unnecessary perturbation to alleviate the counter effect for robust training.
[Table]
Table 3 shows the hyper-parameters choice for auto-tuning (cid:15) .
For the MNIST data set, we found the optimal hyper-parameter (cid:15) maxoff around 0.15 where the certiﬁed accuracy gains by 0 .
3% from baseline.
For the CIFAR data set, the standard (cid:15) train 8 . 8 / 255 is only 10% larger than the (cid:15) eval .
In this case, our auto-tuning (cid:15) method performs worse compared to the baseline results because the extra 10% is necessary for certiﬁed training.
By using larger (cid:15) train , it is possible to reach even smaller testing error.
To show the effect of auto-tuning (cid:15) method, we will increase the (cid:15) train until the testing veriﬁed accuracy stabilizes.
For (cid:15) train = 10 / 255 , 14 / 255 , 18 / 255 , 22 / 255 , we come up with veriﬁed accuracy = 70 .
62% ± 0 .
50% ± 0 .
31% ± 0 .
19% ± 0 .
21% which are roughly 2% lower than the standard result.
We choose (cid:15) = 14 / 255 as the “sweet point”, beyond which any increase in (cid:15) does not provide any improvement in accuracy because the very large perturbation is harmful to training.
With the optimal (cid:15) maxoff = 0 . 01 , the veriﬁed accuracy is improved by 1 . 21% from baseline.
4.2. C OUPLING OF TWO METHODS
By coupling two methods
[Table]
we can further combine the improvements and achieve even better results.
As shown in Table 6, for MNIST, using both optimal hyper-parameters from above individual tests we reach a veriﬁed accuracy of 8 . 01% , gaining 0 .
65% from baseline.
For CIFAR-10, our best results beats the IBP baseline by 2 .
We performed more experiments on other (cid:15) eval and other architecture and defer the results to Appendix C.
[Table]
4.2. R ESULTS ON CROWN-IBP
To illustrate that our methods generally work for all the certiﬁable training
[Table]
we apply the same methods and optimal hyper-parameters from IBP setup directly to CROWN-IBP.
For MNIST data, we achieves 0 .
32% improvement from baseline by re-weighting and 0 .
13% from auto-eps, combining the two is similar to using auto-eps only though.
For CIFAR data, note that we use training batch size 256 instead of 1024 in Zhang et al.
(2020a), the standard (cid:15) train 8.8/255 has veriﬁed error 68 .
10% ± 0 .
12% at (cid:15) eval = 8 / 255 from our experiments.
By elevating the bulk (cid:15) train to 14/255, the veriﬁed error increases to 68 .
35% ± 0 .
After applying the two methods, we achieve 66 .
72% ± 0 .
7% and beat the baseline by 1 .
[Table]
C ONCLUSIONS
This paper proposed new methods to reﬁne the decision boundary to improve the certiﬁable robustness accuracy.
We prove the necessity to assign more weights towards adversarial examples around decision boundary by parameterizing the true adversarial distribution.
A future direction could be exploring the adversarial mechanism for better approximation of re-weight function and promoting the idea of re-weighting to other non-adversarial tasks.
For auto-tuning, our initial interest was to prevent extremely large (cid:15) train and a relatively large (cid:15) train is necessary to show the effect.
In practice, we can increase (cid:15) train until accuracy stabilizes and achieve further optimal veriﬁed error.
Our intuitive approach indeed ﬁnds a proper perturbation for each example.
Given the fact that a larger (cid:15) train achieves optimal certiﬁable accuracy still exists as an empirical ﬁnding (Gowal et al., 2019; Zhang et al., 2020a), a rigorous theoretical thinking is needed to justify this approach.
E THICS S TATEMENT
This paper does not contain ethics concerns.
A PPENDIX A P ROOF OF T HEOREM
Theorem 1 (Restated) .
Given a binary classiﬁcation task R n −→ { + , −} with equal prior probability, assume the corresponding examples x + and x − are uniformly distributed in region S + , S − ⊂ R n , S + ∩ S − = ∅ .
If there exists a bijection mapping m := S + (cid:55)→ S − , S − (cid:55)→ S + s.t.
the postmapping example x (cid:48)
+ and x (cid:48)− distribution remains uniform in each region, the expectation of conditional distribution ratio P (cid:48)
( x (cid:48) | y ) P ( x | y ) over original distribution P ( x , y ) is great or equal than 1.
Proof.
let x + , x − , x (cid:48)
+ , x (cid:48)− denote the pre-mapping and post-mapping examples for 2 labels, because both pre-mapping and post-mapping examples are uniformly distributed in each region,
P ( x + | y + ) , P ( x − | y − ) , P (cid:48)
( x (cid:48)
+ | y + ) , P (cid:48)
( x (cid:48)− | y − ) are constant.
let S + = (cid:72) x ∈ S + d x , S − = (cid:72) x ∈ S − d x be the ”volume” of set S + , S − .
Given total conditional probability equals 1:
[Equation]
Similarly we have other conditional probability equals the inverse of volume.
Hence,
[Equation]
where the second equality comes from the balanced prior assumption( P ( y + )
=
P ( y − ) )
Notice we cannot directly cancel the conditional probability on the numerator and denominator, otherwise integrating x (cid:48) over d x is not tractable.
The inequality holds when S − (cid:54) =
S + .
B A CONCRETE EXAMPLE ON IMPORTANCE WEIGHT EXPECTATION
Example 2.
We assume label-balanced data x ∈ R 2 and y ∈ { + , − } and positive constant σ , the clean data with label 1 were uniformly distributed in the inner ring C in = { x | σ < (cid:107) x (cid:107) 2 < 2 σ } and data with label 0 were uniformly distributed in the outer ring C out
= { x | 2 σ < (cid:107) x (cid:107) 2 < 3 σ } .
Then p ( y = + ) = p ( y = − )
= 0 .
5 and clean data distribution is: p ( x | y ) =
  1 3 πσif y
=
+ , σ < (cid:107) x (cid:107) 2 < 2 σ5 πσif y =
− , 2 σ < (cid:107) x (cid:107) 2 < 3 σ otherwise assume the linear classiﬁer f : R → R uses r = (cid:107) x (cid:107) 2 as feature and outputs the logit for probability, s.t.
the probability after sigmoid function is p f ( y | x ) = (cid:40)
+ e s if y =
+ 1
+ e − s if y = − where s = r + 2 σ
The negative log-likelihood
NLL = − E ( x ,y ) ∼ p
( x ,y )
[ log ( p f ( y | x ))]
= − p (
[Equation]
+ )
[Equation] [Equation]
+
[Equation]
x −
[Equation] [Equation]
(cid:90)
[Equation] [Equation]
=
[Equation] [Equation]
[Equation] [Equation]
x = − 0 .
[Equation] [Equation]
(cid:90) r =2 σ r = σ 1 + e s 2 πrdr + 5 πσ(cid:90) r =3 σ r =2 σ 1 + e
[Equation]
Notice the integral includes polylogarithm term thus the indeﬁnite integral is not elementary function and it is unnecessary to attack the ﬁnal integral.
Instead, we apply adversarial directly to the above equation for ( x , y ) distribution.
Calculate the adversarial gradient: for s ∈ [0 , σ ] , dNLL ( s ) ds = − 1 6 πσe s 1+ e − s 2 π
( s + 2 σ ) , let ∆ − ( s )
=
d 2 NLL ( s ) ds= − 13 σ 2 1+ e − s + e − s
( s +2 σ ) (1+ e − s ).
For s ∈ [ − σ, 0] , dNLL ( s ) ds =
[Equation] [Equation]
2 e
[Equation]
s
+ e
[Equation]
s 2 π
( s + 2 σ ) , let ∆ + ( s )
=
d 2 NLL ( s ) ds= − 13 σ 2 1+ e s − e s ( s +2 σ ) (1+ e s ).
∆ + ( s ) and ∆ − ( s ) denotes the attack gradient towards negative log-likelihood function on example ( x , y ) with s = (cid:107) x (cid:107) 2 + 2 σ .
Notice ∆ + ( s ) > 0 and ∆ − ( s ) < 0 because adversarial perturbs the correctly classiﬁed examples towards the decision boundary.
Assume the attack step α = σ , there exist a mapping of attack m : R 2 × R → R 2 × R .
Because this is a 1 step attack on a 2D plane with gradient towards radial direction without projection, the mapping also corresponds to a veriﬁable worst case adversarial with (cid:15) max = σ under (cid:96) 2 norm.
Rewrite ( x , y ) in the polar coordinate ( r
[Equation]
After the attack
[Equation]
the importance ratio P
[Equation]
x
[Equation]
P
[Equation]
x | y )
=
rr (cid:48) is inversely proportional to the radius change.
The expected importance ratio could be written as :
[Equation]
[Table]
C M ORE EXPERIMENTS
[Table]