Robustness via Curvature Regularization, and Vice Versa

By Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Jonathan Uesato, Pascal Frossard. Computer Vision and Pattern Recognition, 2018

345 citations recorded by the source corpus.

State-of-the-art classifiers have been shown to be largely vulnerable to adversarial perturbations. One of the most effective strategies to improve robustness is adversarial training. In this paper, we investigate the effect of adversarial training on the geometry of the classification landscape and decision boundaries. We show in particular that adversarial training leads to a significant decrease in the curvature of the loss surface with respect to inputs, leading to a drastically more "linear" behaviour of the network. Using a locally quadratic approximation, we provide theoretical evidence on the existence of a strong relation between large robustness and small curvature. To further show the importance of reduced curvature for improving the robustness, we propose a new regularizer that directly minimizes curvature of the loss surface, and leads to adversarial robustness that is on par with adversarial training. Besides being a more efficient and principled alternative to adversarial training, the proposed regularizer confirms our claims on the importance of exhibiting quasi-linear behavior in the vicinity of data points in order to achieve robustness.

Subfields: Artificial Intelligence, Molecular Biology

View Paper: https://www.semanticscholar.org/paper/5ae786deaa875613e85ed2df0dbeec4301109f74

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

Citations in the corpus

Geometry-aware Instance-reweighted Adversarial Training (2020, background): “Besides, Moosavi-Dezfooli et al. (2019) even show that the low curvatures can lead to the enhanced robustness, which echoes our results in Figure 4.”
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (2020, neutral): “71 15 (Moosavi-Dezfooli et al., 2019) 83.”
A Primer on Zeroth-Order Optimization in Signal Processing and Machine Learning: Principals, Recent Advances, and Applications (2020, methodology): “In addition, ZO optimization provides computationallyefficient alternatives for second-order optimization such as robust training by curvature regularization [28], meta-learning”
Adversarial Weight Perturbation Helps Robust Generalization (2020, methodology): “AT explicitly flattens the input loss landscape by training on adversarially perturbed examples, while there are other methods doing this by gradient regularization [25, 41], curvature regularization [29], and local linearity regularization [39].”
Learning Smooth Neural Functions via Lipschitz Regularization (2022, methodology): “Then we can encourage smoothness at these input samples by penalizing the norm of the Jacobian [Drucker and Le Cun 1991; Gulrajani et al. 2017; Hoffman et al. 2019; Jakubovitz and Giryes 2018; Varga et al. 2017] or the Hessian [Moosavi-Dezfooli et al. 2019].”
Adversarial Robustness through Local Linearization (2019, methodology): “We compare LLR training to ADV [16], CURE [19] and TRADES [28], both with our re-implementation and the published models 8 .”
Understanding and Improving Fast Adversarial Training (2020, methodology): “Previous works also considered local linearity of deep networks [25, 28], however rather with the goal of introducing regularization methods that improve robustness as an alternative to adversarial training.”
Achieving Robustness in the Wild via Adversarial Mixing With Disentangled Representations (2019, methodology): “Generating pixel-level adversarial perturbations has been and remains extensively studied [16, 18–20, 27, 28].”
Sharpness-aware Quantization for Deep Neural Networks (2021, background): “Following that, several studies have been proposed to investigate the relation between the geometry of the loss landscape and the generalization performance of the models [6, 18, 27, 29, 42, 52, 63].”
Bag of Tricks for Adversarial Training (2020, methodology): “Following the examples in Moosavi-Dezfooli et al. (2019), we craft PGD-10 perturbation as the normal direction v, and r be a random direction, under the `∞ constraint of 8/255.”
Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples (2020, methodology): “, 2017), and also include the definition of new regularizers (Moosavi-Dezfooli et al., 2018; Xiao et al., 2018; Qin et al., 2019).”