PaperlayerView exact revision on arXiv

Source-linked AI summary

A Unified Gradient Regularization Family for Adversarial Examples

Chunchuan Lyu, Kaizhu Huang, Hai-Ning Liang

arXiv:1511.06385v1cs.LGstat.ML

TL;DR

Adversarial perturbations can change neural-network predictions, motivating the question of why such vulnerabilities exist. The paper formulates robustness as a min-max problem and develops gradient regularization methods, reporting 0.39 % for a Conv. Maxout model with gradient p = 2 on MNIST.

  • Problem

    The existence of adversarial examples raises the question of why imperceptible perturbations can change neural-network predictions.

  • Method

    The paper formulates robust training as a min-max problem and develops a unified family of gradient-based regularization methods, including fast gradient sign as a special case.

  • Results

    0.39 % is reported for Conv. Maxout + dropout + gradient p = 2 on MNIST.

  • Takeaways & Limitations

    The framework provides a unified approach to robust modeling, while visualizations give gradient perturbations physical meaning and support their cross-model generalization.

  • Takeaways & Limitations

    The discussion assumes each data point is associated with Gaussian noise, which bounds the scope of its probabilistic analysis.

Abstract

from arXiv · show

Adversarial examples are augmented data points generated by imperceptible perturbation of input samples. They have recently drawn much attention with the machine learning and data mining community. Being difficult to distinguish from real examples, such adversarial examples could change the prediction of many of the best learning models including the state-of-the-art deep learning models. Recent attempts have been made to build robust models that take into account adversarial examples. However, these methods can either lead to performance drops or lack mathematical motivations. In this paper, we propose a unified framework to build robust machine learning models against adversarial examples. More specifically, using the unified framework, we develop a family of gradient regularization methods that effectively penalize the gradient of loss function w.r.t. inputs. Our proposed framework is appealing in that it offers a unified view to deal with adversarial examples. It incorporates another recently-proposed perturbation based approach as a special case. In addition, we present some visual effects that reveals semantic meaning in those perturbations, and thus support our regularization method and provide another explanation for generalizability of adversarial examples. By applying this technique to Maxout networks, we conduct a series of experiments and achieve encouraging results on two benchmark datasets. In particular,we attain the best accuracy on MNIST data (without data augmentation) and competitive performance on CIFAR-10 data.

I. INTRODUCTION · II. GRADIENT REGULARIZATION FAMILY · A. General Framework

The paper develops a unified gradient-regularization framework for training models robust to small adversarial perturbations, motivated by their transferability and unresolved causes. It converts adversarial training into an approximated min–max objective whose closed-form perturbation induces a gradient-based regularizer, encompassing prior methods as special cases.

  • I. INTRODUCTION: Small, often imperceptible image perturbations can change neural-network predictions, and perturbations learned on one model can transfer across classifiers.These effects motivate robust modeling against adversarial examples.
  • I. INTRODUCTION: Adversarial examples raise questions about their existence, cross-model generalizability, rarity in naturally generated data, and how machine-learning systems should address them.The paper identifies robustness as the most important practical issue.
  • I. INTRODUCTION: Prior work links adversarial examples to high-dimensional linearity and limited class distinguishability, motivating a more rigorous unified linear perspective.The paper develops the linear view proposed in earlier work.
  • II. GRADIENT REGULARIZATION FAMILY: The proposed framework transforms robust training into a min–max problem and defines a family of gradient-based perturbations that regularize models against adversarial changes.The family varies with the norm parameter and is reported to produce highly robust models.
  • A. General Framework: The general framework replaces ordinary loss minimization with minimizing loss under a worst-case perturbation constrained by a norm, yielding a unified extension of earlier regularization techniques.The inner problem seeks the perturbation maximizing loss for the data and constraints.
  • A. General Framework: Training alternates between finding a loss-maximizing constrained perturbation and updating model parameters to minimize loss, although the joint problem is generally non-convex.The framework then approximates the inner problem using a first-order Taylor expansion.
  • A. General Framework: Solving the linearized inner problem in closed form and substituting its optimal perturbation into the objective produces a norm-parameterized regularization term based on the input gradient.The resulting objective minimizes L(x + ǫ) rather than only L(x), with ǫ defined by the perturbation family.
  • A. General Framework: The authors present the approach as a general method for penalizing loss gradients with respect to inputs in complex models and examine three special cases, including another prior method.They distinguish this from Gaussian-noise regularization, which penalizes the Hessian trace.

B. Case p = ∞ · C. Case p = 1

For p = ∞, the unified method reduces to the fast gradient sign method, inducing the regularization term σ ∥∇L∥1. For p = 1, the perturbation budget is concentrated in one direction, inducing ∥∇L∥∞ regularization that penalizes only that direction.

  • B. Case p = ∞: For p = ∞, the method reduces to the fast gradient sign method proposed in [2].
  • B. Case p = ∞: When |∇L| = 0, sign(0) is defined as 0.
  • B. Case p = ∞: The corresponding p = ∞ regularization term is σ ∥∇L∥1.
  • B. Case p = ∞: This regularization is mathematically unnatural because it does not penalize the gradient isotropically.
  • C. Case p = 1: For p = 1, the worst perturbation follows from constraining the sum of the absolute perturbation values.
  • C. Case p = 1: The p = 1 constraint intuitively allocates the entire perturbation budget to one direction.
  • C. Case p = 1: The induced regularization term is ∥∇L∥∞, which penalizes the gradient in only one direction.

D. Case p = 2

The section introduces standard gradient regularization with p = 2 and analyzes its perturbation using a second-order Taylor expansion. This expansion resembles the regularization induced by marginalizing over Gaussian noise, while a generalized second-order term offers little additional insight because it duplicates the first-order term in general.

  • D. Case p = 2: The authors introduce standard gradient regularization with p = 2 because the extreme settings p = 1 and p = ∞ may not be optimal.They then derive a second-order Taylor expansion to provide theoretical insight into this case.
  • D. Case p = 2: The second-order Taylor expansion of the loss includes a quadratic perturbation term involving ǫ, Jy(x), HL(y), and JT y (x).The displayed expansion also contains a trace term, 2 T r(Jy(x)HL(y)JT y (x)).
  • D. Case p = 2: The second-order Taylor expansion resembles the term induced by marginalizing over Gaussian noise.This connects the p = 2 perturbation analysis to Gaussian-noise marginalization.
  • D. Case p = 2: A generalized second-order regularization term, σ2 2 ∥∇xL∥2 p∗, generally duplicates the first-order term and therefore provides no further insight.The paper presents this as a remark about the generalized form.

E. Exact Solution Is Non-Trivial … A. Visualizing Adversarial examples

The paper argues that exact optimization is difficult even for linear regression, while gradient-perturbation computation has substantial training overhead. Visualizations show that these perturbations are initially imperceptible but can reveal meaningful physical-shape changes when magnified.

  • E. Exact Solution Is Non-Trivial: The original minmax problem is generally difficult to solve exactly, even in the simplest linear regression model.The paper presents exact solution as a non-trivial objective rather than relying only on approximation.
  • E. Exact Solution Is Non-Trivial: In linear regression, finding the worst perturbation becomes a convex-function maximization problem, making exact optimization non-trivial.The optimization is formulated using the desired output t and weight matrix Θ.
  • E. Exact Solution Is Non-Trivial: A first-order expansion approximately solves the maximization but makes the minimization non-convex because of the additional regularization term.The paper therefore concludes that obtaining an exact solution remains hard even for this simple model.
  • F. Computational Cost: Naively computing adversarial noise with backpropagation roughly doubles training time because computing ǫ requires ∇xL and converting ∇L into ǫ.The implementation uses built-in functionality provided by reference.
  • III. VISUALIZATION AND INTERPRETATION OF GRADIENT PERTURBATION: The paper visualizes gradient perturbations for p = 2 to provide physical intuition and mathematical structure behind them.This visualization is intended to support gradient perturbation effectiveness and explain cross-model generalization of adversarial examples.
  • A. Visualizing Adversarial examples: For MNIST, the paper compares randomly selected original samples with images perturbed by gradient perturbation using p = 2 and σ = 1.The original images appear in Figure 1 and the perturbed images in Figure 2.
  • A. Visualizing Adversarial examples: At first glance, the perturbed examples are indistinguishable from the originals, but magnifying perturbations by a factor of 10 makes the exaggerated examples more meaningful to the naked eye.The paper presents the magnified perturbations in Figure 3 and the exaggerated adversarial examples in Figure 4.

B. Mathematical Structure … A. MNIST

The paper interprets gradient perturbations through local class structure and meaningful semantic changes, then evaluates gradient regularization on MNIST and CIFAR-10 benchmarks. On MNIST, the method achieves 78 errors for permutation-invariant inputs and 39 errors with convolutional architecture, without data augmentation.

  • B. Mathematical Structure: Gradient perturbations can be interpreted by decomposing the p = 2 perturbation and relating the softmax error to local class structure encoded by the Jacobian.When prediction confidence is high, y−t is small and negative, matching clear perturbed examples such as digits 0, 1, and 9.
  • B. Mathematical Structure: The Jacobian assumption is supported by convolutional neurons encoding natural image statistics, though it may not hold strictly for complex or other-domain data.The paper presents this as a reasonable but non-universal modeling assumption.
  • C. Generalization of Adversarial Examples: Visualization suggests adversarial examples minimally morph images toward other classes, explaining cross-model generalization through meaningful, class-specific changes.The related explanation attributes this generalization to models resembling linear classifiers that encode local semantic image information.
  • A. MNIST: MNIST experiments use 60,000 training and 10,000 testing examples of 28 × 28 greyscale digits, testing sigmoid MLP, Maxout, and Convolutional Maxout architectures.Inputs are rescaled to [0, 1]784 without further preprocessing.
  • A. MNIST: The sigmoid MLP selects two hidden layers of 600 units with σ = 1, using only a max-norm constraint alongside gradient regularization.Candidate hidden-layer widths were [400,400], [600,600], and [800,800], with max norm set to the square root of 15.
  • A. MNIST: The Maxout experiments apply σ = 1, while Convolutional Maxout with p = ∞ performs better at σ = 0.1 than at σ = 0.25.The latter value was reported as the best parameter for the nonconvolutional Maxout network in [2].
  • A. MNIST: 78 errors among 10, 000 test samples are achieved on permutation-invariant MNIST with p = 2, while 39 errors are achieved on the convolutional architecture.The convolutional result ties the recently proposed convolutional kernel network, and standard gradient regularization consistently outperforms the fast gradient sign method.

B. CIFAR-10 · C. Robustness · V. DISCUSSION

The proposed gradient regularization improves performance on CIFAR-10 and robustness to Gaussian perturbations. The discussion models adversarial examples under Gaussian noise, showing how perturbation size, dimensionality, and probability interact.

  • B. CIFAR-10: The CIFAR-10 experiment uses 60,000 32 × 32 RGB images across 10 object categories, with 50,000 training and 10,000 testing examples.The network is a small convolutional Maxout model.
  • B. CIFAR-10: On CIFAR-10, gradient regularization improves the performance of a small convolutional Maxout network.The experiment follows the Maxout procedure and compares test error after both training stages.
  • C. Robustness: Gaussian-noise testing errors are used to evaluate whether gradient regularization improves model robustness against perturbations.This criterion is motivated by a reported theoretical relationship between adversarial examples and Gaussian noise.
  • C. Robustness: Gradient regularization improves models’ ability to resist perturbations, while convolutional architectures appear more severely affected than standard Maxout networks.The observation is consistent with reports that convolutional architectures have larger operator norms than fully connected networks.
  • V. DISCUSSION: High dimensionality can provide probabilistic protection: although it enables prediction-changing directions, events many standard deviations from the mean become exponentially less probable.The discussion frames this as an intuition rather than a fully strict analysis.
  • V. DISCUSSION: Adversarial-example occurrence is analyzed through the minimum perturbations required to change predictions across n effective directions.The corresponding minimum perturbations are denoted a_i, with direction e_i = a_i/∥a_i∥.
  • V. DISCUSSION: The discussion assumes each data point is perturbed by Gaussian noise, (x + η) ∼ N(x, σ^2I_d), with σ the per-dimension standard deviation.Under this assumption, adversarial examples do not occupy a particularly low-probability region.
  • V. DISCUSSION: Given ∥a_i∥, increasing input dimensionality does not increase adversarial-example probability, which depends on perturbation size; the model parameters are n, ∥a∥, and σ.The analysis assumes all minimum perturbation norms are equal and denotes each by a.

A. Estimating Misclassification Rate under Gaussian Noise

The subsection estimates Gaussian-noise misclassification rates by modeling minimum perturbations probabilistically, and finds that theoretical predictions track empirical rates across noise levels despite simplifying assumptions.

  • A. Estimating Misclassification Rate under Gaussian Noise: The analysis approximates minimum perturbation norms with a Gaussian distribution rather than using only their mean.This distributional treatment is intended to provide a reasonable numerical estimate of misclassification rates.
  • A. Estimating Misclassification Rate under Gaussian Noise: The framework assumes the dominant perturbation direction controls the predicted probability and sets n = 1.3.Minimum perturbation statistics are estimated through gradient-direction line searches on sufficiently large training data.
  • A. Estimating Misclassification Rate under Gaussian Noise: A larger regularization parameter corresponds to better robustness, while the theoretical Gaussian-noise rate is computed assuming noise does not correct existing misclassifications.Actual and estimated rates are reported in Tables VII and VIII, respectively.
  • A. Estimating Misclassification Rate under Gaussian Noise: The probability model fits the actual misclassification rate well, with qualitative changes remaining consistent across different Gaussian-noise levels despite imperfect numerical agreement.The comparison uses empirical results from Table VII and theoretical estimates from Table VIII.
  • A. Estimating Misclassification Rate under Gaussian Noise: Dominant-direction modeling may underestimate misclassification, whereas Gaussian approximation may overestimate the no-noise rate; it yields roughly P(A) ≈3%.The Gaussian approximation can be problematic for small noise because the actual perturbation distribution is supported only in the positive region.

B. Estimating the Probability of Adversarial Examples

The paper estimates adversarial-example probability by modeling natural-image randomness and minimum-perturbation distributions near zero. The analysis suggests such examples occur rarely and negligibly relative to model classification errors, with theoretical and empirical support.

  • Estimation setup: The probability estimate requires characterizing randomness in natural images and the distribution of minimum perturbations, especially for perturbations near zero.The authors choose σ large enough to reduce overestimation while remaining hardly perceptible.
  • Distributional assumption: Imperceptible Gaussian noise produces a minimum-perturbation distribution that appears linear near zero, motivating a linear probability-density assumption.The passage contrasts this noise with significantly larger σ values, which are perceptible.
  • Theoretical prediction: The resulting theoretical analysis predicts the increase in misclassification rate caused by Gaussian perturbations using statistics gathered from the observed distribution.The paper reports these predictions in comparison with actual misclassification rates.
  • Conclusion: Adversarial examples’ natural occurrence is theoretically and empirically verified to be rare and negligible compared with the classification errors of the models.The authors characterize concern that adversarial examples endanger machine-learning models as somewhat overcautious.

VI. CONCLUSION

The paper proposes a unified framework for robust models against adversarial examples, including broadly applicable gradient regularization techniques and a special case with a second-order Gaussian-noise interpretation. It also visualizes adversarial effects to explain their cross-model generalization, while noting that the linear view requires more empirical support.

  • VI. CONCLUSION: The paper proposes a unified framework for building robust models against adversarial examples and derives gradient regularization techniques applicable to various machine learning models.The framework is presented as a general approach to adversarial robustness.
  • VI. CONCLUSION: A special case of the gradient regularization family has a second-order interpretation that approximately marginalizes over Gaussian noise.This interpretation provides a mathematical perspective on the regularization method.
  • VI. CONCLUSION: Visualizing adversarial effects is used to explain their ability to generalize across models.The visualization is presented as an explanation for adversarial examples’ cross-model generalization.
  • VI. CONCLUSION: The linear view is described as plausible and fruitful but still requires more empirical support.The discussion connects this limitation to the manifold hypothesis and the possibility of leaving a low-dimensional manifold through slight changes.

APPENDIX A SOLVING ǫ

The appendix formulates adversarial perturbation selection as a constrained optimization problem, showing that the optimal perturbation has norm σ and can be solved using Lagrange multipliers.

  • Solving ǫ: The optimal ǫ has norm σ; otherwise, normalizing it would produce a greater loss.This reduces the problem to perturbations satisfying the norm constraint ∥ǫ∥p = σ.
  • Solving ǫ: The constrained problem is solved with standard Lagrange multipliers by defining f(ǫ) ≡ ∇xL^Tǫ and g(ǫ) ≡ ∥ǫ∥p = σ.The method imposes ∇f(ǫ) = λ∇g(ǫ).
  • Solving ǫ: Combining equations (38) and (43) yields the resulting solution expression.The preceding formulation begins from the fact that L(x) is independent of ǫ.

APPENDIX B LEMMA

The appendix lemma establishes an equality between the input-gradient outer product and a Jacobian–loss-Hessian product. Its proof uses the chain rule and the one-hot cross-entropy structure to show matching diagonal terms and zero off-diagonal terms.

  • Lemma statement: GN(x) is defined as Jy(x)HL(y)JT, where y is the model output, t is the desired output, and N is the number of classes.The Gaussian-Newton matrix approximates the Hessian of L with respect to x; Jy(x) is the output Jacobian and HL(y) is the loss Hessian with respect to y.
  • Lemma statement: The lemma states ∇xL∇xL^T = Jy(x)HL(y)JT.This follows by reducing the claim, via cancellation of Jy(x), to ∇yL∇yL^T = HL(y).
  • Proof: For one-hot targets, the gradient outer product has zero off-diagonal entries and one nonzero diagonal term, (∇yL^T∇yL)ll = 1.The target condition specifies an index l such that ti = δli.
  • Proof: The loss Hessian likewise has only one nonzero diagonal term, (HL(y))ll = 1, yielding the required equality.The proof concludes equality after matching this Hessian structure with the gradient outer product.
Loading 1511.06385v1…