Adversarial Robustness through Local Linearization

By Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy (Dj) Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, Pushmeet Kohli. 2019

333 citations recorded by the source corpus.

Adversarial training is an effective methodology for training deep neural networks that are robust against adversarial, norm-bounded perturbations. However, the computational cost of adversarial training grows prohibitively as the size of the model and number of input dimensions increase. Further, training against less expensive and therefore weaker adversaries produces models that are robust against weak attacks but break down under attacks that are stronger. This is often attributed to the phenomenon of gradient obfuscation; such models have a highly non-linear loss surface in the vicinity of training examples, making it hard for gradient-based attacks to succeed even though adversarial examples still exist. In this work, we introduce a novel regularizer that encourages the loss to behave linearly in the vicinity of the training data, thereby penalizing gradient obfuscation while encouraging robustness. We show via extensive experiments on CIFAR-10 and ImageNet, that models trained with our regularizer avoid gradient obfuscation and can be trained significantly faster than adversarial training. Using this regularizer, we exceed current state of the art and achieve 47% adversarial accuracy for ImageNet with l-infinity adversarial perturbations of radius 4/255 under an untargeted, strong, white-box attack. Additionally, we match state of the art results for CIFAR-10 at 8/255.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Training for Large Neural Language Models (2020, background): “Note that a larger K leads to better approximation (Madry et al., 2017; Qin et al., 2019), but it is more expensive.”
SMART: Robust and Efficient Fine-Tuning for Pre-trained Natural Language Models through Principled Regularized Optimization (2019, methodology): “, 2019) for harnessing the adversarial examples in image classification with p = ∞; [B] was first used in (Qin et al., 2019) for harnessing the adversarial examples in image classification with p = ∞.”
FreeLB: Enhanced Adversarial Training for Natural Language Understanding (2019, methodology): “Athalye et al. (2018) to avoid obfuscated gradients, Qin et al. (2019) shows that PGD-based adversarial training still leads to highly convolved and non-linear loss surfaces when K is small, which could be readily broken under stronger adversaries.”
Adversarial Defense Via Local Flatness Regularization (2019, positive): “…Selection We select trade-off inspired adversarial defense via surrogate-loss minimization (TRADES) [13], lo-cal linearization Regularization (LLR) [18] and PGD-based adversarial training (AT) [12] as the baseline methods in the following experiments, since they are the representative of the…”
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (2020, methodology): “25% for the model of (Qin et al., 2019), getting only 0.”
Do Wider Neural Networks Really Help Adversarial Robustness? (2020, background): “Recent works in [65, 50] focus on creating adversarial robust networks with faster training protocol.”
Smooth Adversarial Training (2020, methodology): “With EfﬁcientNet-L1, SAT reports the state-of-the-art adversarial robustness on ImageNet, which largely outperforms the prior art [49] by 9.5% for accuracy and 11.6% for robustness.”
Achieving Robustness in the Wild via Adversarial Mixing With Disentangled Representations (2019, background): “Goodfellow et al. [16] and Madry et al. [19] laid down foundational principles to train robust networks, and recent works [29, 30] continue to ﬁnd novel approaches to enhance robustness.”
Globally-Robust Neural Networks (2021, methodology): “There has also been prior work seeking to use Lipschitz bounds, or close analogues, during training to promote robustness (Tsuzuku et al., 2018; Raghunathan et al., 2018; Cisse et al., 2017; Cohen et al., 2019b; Anil et al., 2019; Pauli et al., 2021; Qin et al., 2019; Finlay & Oberman, 2019; Lee et ”
Data Augmentation Can Improve Robustness (2021, methodology): “To circumvent this issue, the naive ensembling approach is replaced by model weight averaging as we exploit the commonly known fact [8, 19, 42] that models trained with adversarial training tend to be locally linear.”
Understanding and Improving Fast Adversarial Training (2020, methodology): “Unlike [28] and [49], with the training scheme of [47] and α = ε/2 we could successfully train a PGD-2 model with ε = 8/255 on CIFAR-10 with robustness better than that of their methods that use the same number of PGD steps (see Appendix D.”
FreeLB: Enhanced Adversarial Training for Language Understanding (2019, methodology): “Athalye et al. (2018) to avoid obfuscated gradients, Qin et al. (2019) shows that PGD-based adversarial training still leads to highly convolved and non-linear loss surfaces when K is small, which could be readily broken under stronger adversaries.”
A Closer Look at Accuracy vs. Robustness (2020, methodology): “The loss function for Locally-Linear Regularization (LLR) model is We use our own implementation of LLR.”
Regularizing Black-box Models for Improved Interpretability (2019, methodology): “First, Qin et al. [2019] proposed a method for local linearization in the context of adversarial robustness.”
Understanding invariance via feedforward inversion of discriminatively trained classifiers (2021, methodology): “In particular we direct the reader to columns 2, 4, and 5 of each image set, which correspond to reconstructions using a robustly trained ResNet152 (Qin et al., 2019), a standard ResNet-152 (He et al.”
Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples (2020, methodology): “Qin et al. (2019) also experimented with softplus activations with success.”
Towards Robust Image Classification Using Sequential Attention Models (2019, background): “Another way of making sure gradients are not obfuscated is by visualizing the loss landscapes [42, 49].”
Adversarial Weight Perturbation Helps Robust Generalization (2020, methodology): “AT explicitly ﬂattens the input loss landscape by training on adversarially perturbed examples, while there are other methods doing this by gradient regularization [23, 38], curvature regularization [27], and local linearity regularization [36].”
Intriguing properties of adversarial training (2019, background): “Subsequent works are then proposed to further improve the model robustness (Xie et al., 2019b; Zhang et al., 2019b; Hendrycks et al., 2019a; Qin et al., 2019; Zhang & Wang, 2019; Carmon et al., 2019; Hendrycks et al., 2019b; Alayrac et al., 2019; Zhai et al., 2019) or accelerate the adversarial…”