PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Logit Pairing

Harini Kannan, Alexey Kurakin, Ian Goodfellow

arXiv:1803.06373v1cs.LGstat.ML

TL;DR

Adversarial examples expose vulnerabilities in deep-learning vision models, while scaling adversarial training to ImageNet remained an open question. The paper scales adversarial training and introduces logit pairing, with adversarial logit pairing improving ImageNet white-box accuracy and damaging a black-box defense.

  • Problem

    Deep-learning vision models can misclassify images modified by small, often imperceptible perturbations, motivating robust defenses and leaving ImageNet-scale adversarial training an open question.

  • Method

    The paper scales adversarial training to ImageNet and introduces clean and adversarial logit pairing, which encourages logits for paired examples to be similar.

  • Results

    27.9% white-box accuracy was achieved with adversarial logit pairing versus 3.9% for adversarial training, while a transfer attack reduced Ensemble Adversarial Training from 66.6% to 47.1% Top-1 black-box accuracy.

  • Takeaways & Limitations

    Adversarial logit pairing provides a stronger ImageNet defense against the evaluated PGD white-box attacks and exposes weakness in the evaluated black-box defense.

  • Takeaways & Limitations

    The authors state that these defense mechanisms are not yet sufficient to secure machine learning in a real system and that future attacks could be developed against them.

Abstract

from arXiv · show

In this paper, we develop improved techniques for defending against adversarial examples at scale. First, we implement the state of the art version of adversarial training at unprecedented scale on ImageNet and investigate whether it remains effective in this setting - an important open scientific question (Athalye et al., 2018). Next, we introduce enhanced defenses using a technique we call logit pairing, a method that encourages logits for pairs of examples to be similar. When applied to clean examples and their adversarial counterparts, logit pairing improves accuracy on adversarial examples over vanilla adversarial training; we also find that logit pairing on clean examples only is competitive with adversarial training in terms of accuracy on two datasets. Finally, we show that adversarial logit pairing achieves the state of the art defense on ImageNet against PGD white box attacks, with an accuracy improvement from 1.5% to 27.9%. Adversarial logit pairing also successfully damages the current state of the art defense against black box attacks on ImageNet (Tramer et al., 2018), dropping its accuracy from 66.6% to 47.1%. With this new accuracy drop, adversarial logit pairing ties with Tramer et al.(2018) for the state of the art on black box attacks on ImageNet.

1. Introduction

The paper addresses adversarial examples by investigating scalable defenses and introducing clean and adversarial logit pairing. These methods improve robustness, with adversarial logit pairing achieving state-of-the-art results against white-box and black-box attacks.

  • Adversarial examples are intentionally optimized inputs that cause misclassification, motivating models robust to adversarial perturbations.Robustness is motivated by secure deployment, model-based optimization, distribution-shift guarantees, and smoothness assumptions.
  • The paper scales state-of-the-art adversarial training to ImageNet and investigates its effectiveness there.
  • Logit pairing encourages logits for pairs of examples to be similar, with clean and adversarial variants proposed.
  • Clean logit pairing defends against PGD black-box attacks almost as well as adversarial training for two datasets, with minimal computational cost.
  • Adversarial logit pairing achieves state-of-the-art defense performance against white-box and black-box attacks.The paper also reports that attacks constructed with adversarially trained models damage the current state-of-the-art black-box defense, while the authors’ models resist those attacks.

2. Definitions and threat models

The paper evaluates defenses under threat models defined by the adversary’s information and by limited L∞ perturbations. It distinguishes white-box attackers from black-box attackers.

  • The threat model specifies the adversary’s capabilities, while this paper assumes perturbations constrained by a limited L∞ norm.The norm-ball setting is chosen because it is more amenable to benchmark evaluation.
  • White-box attackers have full information about the model, including its architecture and parameters.
  • Black-box attackers have no model architecture or parameter information and cannot query the model for additional information.

3. The challenges of defending ImageNet classifiers

ImageNet defenses had not established scalable robustness against strong white-box attacks, leaving the scaling of adversarial training unresolved. The paper applies that defense at ImageNet scale and introduces an improved alternative.

  • Madry et al.’s defense had withstood intensive scrutiny, but its ability to scale to ImageNet had not been shown.
  • The paper implements the Madry et al. defense at ImageNet scale using the same attack methodology used at smaller scale.
  • PGD initializes adversarial-example search randomly within the allowed norm ball and iteratively applies a basic iterative method.The noisy initialization makes PGD stronger than earlier iterative methods such as BIM.
  • Previous ImageNet defenses reported 99 percent error rates on strong, multi-step white-box attacks, while the paper scales adversarial training successfully and improves over that baseline.

4. Methods

The methods use PGD-based adversarial training and add logit-pairing penalties to encourage similarity between selected logits. Clean pairing offers lower-cost robustness, while adversarial pairing gives the strongest reported defense.

  • Adversarial training: The paper uses adversarial training with PGD as the underlying basis for its defense methods.PGD is treated as a universal first-order adversary in the paper’s setup.
  • Adversarial training: Mixed-minibatch PGD trains on a mixture of clean and adversarial examples to maintain good clean-example accuracy.
  • Logit pairing: Logit pairing adds a penalty that encourages logits from two images to be similar, with the penalty strength controlled by λ.The paper uses L2 loss for the pairing term, while noting that L1 or Huber losses could also be suitable.
  • Adversarial logit pairing: Adversarial logit pairing matches logits from a clean image with those from its corresponding adversarial image.It adds information about the relationship between the clean and adversarial versions of the same example beyond their shared class label.
  • Clean logit pairing: Clean logit pairing matches logits from randomly selected clean examples, typically from different classes, and has significantly lower computational cost than adversarial training or ALP.
  • Clean logit squeezing: Logit squeezing penalizes logit norms; on MNIST, it produced better results than logit pairing.The paper motivates this variant by hypothesizing that clean pairing encourages smaller-magnitude logits and discourages overconfidence.

5.1. Results on MNIST

On MNIST, adversarial logit pairing improves robustness over vanilla adversarial training across both white-box and black-box PGD attacks.

  • On MNIST, pairing weights roughly between 0.2 and 1 produced similar results, with weight 1 used in Table 1.Weight 1 gives equal weighting to adversarial logit pairing and cross-entropy losses.
  • 96.4% white-box accuracy improves over vanilla adversarial training's 93.2% on MNIST PGD attacks.
  • 97.5% black-box accuracy improves over vanilla adversarial training's 96.0% on MNIST PGD attacks.
  • Adversarial logit pairing reaches state-of-the-art MNIST accuracy against the PGD attack.

5.2. Results on SVHN

On SVHN, adversarial logit pairing substantially improves adversarial accuracy when added at moderate weight, while excessive weighting provides no benefit over vanilla adversarial training.

  • SVHN experiments used RevNet-9, selected for constant memory usage that supports larger batches and quicker convergence.
  • Adding some logit pairing greatly improved SVHN adversarial accuracies compared with vanilla adversarial training.
  • Logit pairing weights from 0.5 to 1 generally worked, whereas weights above 2 were roughly equivalent to vanilla adversarial training.
  • The final adversarial logit pairing weight used for SVHN Table 2 was 0.5.

5.3. Results on ImageNet

The ImageNet experiments scale multi-step adversarial training and show that adversarial logit pairing substantially improves white-box and black-box robustness, while exposing weaknesses in existing defenses and one-step training.

  • Damaging Ensemble Adversarial Training: A transfer attack from an adversarial-logit-pairing-trained model reduces Ensemble Adversarial Training from 66.6% to 47.1% Top-1 black-box accuracy.
  • Results and discussion: Multi-step adversarial training improves ImageNet white-box accuracy from the previous state of the art, 1.5%, to 3.9%.
  • Scaling adversarial training: ImageNet adversarial training converges when scaled with synchronous gradient updates and large batch sizes.
  • Results and discussion: 27.9% white-box accuracy with adversarial logit pairing improves over the adversarial-training baseline of 3.9%.
  • Results and discussion: 47.1% black-box accuracy with adversarial logit pairing improves over the M-PGD baseline of 36.5%.
  • Scope: The ImageNet results primarily study InceptionV3, leaving other model architectures for future investigation.

5.4. Clean logit pairing results

Clean logit pairing and squeezing achieve adversarial robustness competitive with adversarial training while substantially reducing computational cost. Training-time Gaussian noise alone also raises PGD accuracy on MNIST to around 25%.

  • Evaluation scope: The clean-logit-pairing experiments cover MNIST, SVHN, and ImageNet comparisons using white-box and black-box accuracy evaluations.The supplied tables identify ImageNet white-box and black-box validation accuracies and SVHN clean-logit-pairing results.
  • MNIST results: Clean logit squeezing is competitive with vanilla adversarial training on MNIST under PGD despite a large reduction in computational cost.
  • MNIST results: 25% PGD accuracy results from adding Gaussian noise during training, about 2.5 times better than random guessing.The noise is applied during training rather than test time.
  • Computational cost: Clean logit pairing is competitive with adversarial training for black-box results at substantially lower computational cost.Multi-step adversarial training scales roughly as kN with k attack steps, whereas clean logit pairing has O(1) cost with respect to model layers, image size, and attack steps.

6. Comparison to other possible approaches

The paper compares adversarial logit pairing with label smoothing, mixup, and virtual adversarial training. It reports stronger ImageNet defense than label smoothing or mixup and better MNIST performance than VAT across tested hyperparameters.

  • Related defenses: Label smoothing uses soft targets, assigning 1 −δ to the correct class and distributing δ uniformly across incorrect classes.
  • Related defenses: Mixup trains on interpolated inputs with targets formed by interpolating the corresponding target distributions.The cited work reports increased robustness to adversarial examples for mixup.
  • Related defenses: Adversarial logit pairing provides a much stronger ImageNet PGD defense than label smoothing or mixup.The comparison uses ResNet-101 on ImageNet and evaluates all methods with PGD.
  • Virtual adversarial training: ALP and VAT both encourage similar predictions for clean and adversarial examples, but ALP uses a symmetric logit loss while VAT uses a non-symmetric probability loss.VAT constructs adversarial examples by maximizing KL divergence and trains by minimizing KL divergence between clean and adversarial predictions.
  • Virtual adversarial training: On MNIST, adversarial logit pairing consistently outperformed VAT across several tested hyperparameters.

7. Conclusion and Future Work

The paper establishes adversarial training at ImageNet scale and presents logit-pairing defenses that achieve state-of-the-art results against white-box and black-box attacks. It also identifies certification and real-world security as important remaining boundaries.

  • Adversarial training scales to ImageNet, answering an open question about whether this defense strategy remains effective at larger scale.
  • Adversarial logit pairing (ALP) extends adversarial training and greatly increases its effectiveness.
  • Clean logit pairing and logit squeezing provide low-cost alternatives to adversarial training that require very few resources.
  • ALP-trained models generate attacks that significantly damage the previously state-of-the-art Ensemble Adversarial Training defense.
  • Adversarial logit pairing achieves state-of-the-art defense performance for both white-box and black-box attacks on ImageNet.
  • The defenses are not currently certified or verified, and the authors note they are not yet sufficient to secure machine learning in a real system.
Loading 1803.06373v1…