PaperlayerView exact revision on arXiv

Source-linked AI summary

Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network

Xuanqing Liu, Yao Li, Chongruo Wu, Cho-Jui Hsieh

arXiv:1810.01279v2cs.LGcs.AIcs.CRstat.ML

TL;DR

Deep neural networks are vulnerable to adversarial perturbations, and blindly adding noise is not an optimal way to use randomness. Adv-BNN learns stochastic network weights with Bayesian modeling and combines this with adversarial mini-max training. The method reports improved robustness over adversarial training and random self-ensemble across CIFAR-10, STL-10, and ImageNet143, while the optimal defense remains open.

  • Problem

    Deep neural networks are vulnerable to adversarial perturbations, while indiscriminate layer noise is not an optimal randomness-based defense.

  • Method

    Adv-BNN models all network weights as stochastic Bayesian variables and combines Bayesian learning with adversarial mini-max training.

  • Results

    Adv-BNN reports significant robustness improvements over adversarial training and random self-ensemble on CIFAR-10, STL-10, and ImageNet143.

  • Takeaways & Limitations

    Within the evaluated settings, combining Bayesian randomness with adversarial training provides a stronger defense than either approach alone.

  • Takeaways & Limitations

    The mean-field approximation can substantially deviate from correlated true posteriors, especially for convolutional neural networks.

Abstract

from arXiv · show

We present a new algorithm to train a robust neural network against adversarial attacks. Our algorithm is motivated by the following two ideas. First, although recent work has demonstrated that fusing randomness can improve the robustness of neural networks (Liu 2017), we noticed that adding noise blindly to all the layers is not the optimal way to incorporate randomness. Instead, we model randomness under the framework of Bayesian Neural Network (BNN) to formally learn the posterior distribution of models in a scalable way. Second, we formulate the mini-max problem in BNN to learn the best model distribution under adversarial attacks, leading to an adversarial-trained Bayesian neural net. Experiment results demonstrate that the proposed algorithm achieves state-of-the-art performance under strong attacks. On CIFAR-10 with VGG network, our model leads to 14\% accuracy improvement compared with adversarial training (Madry 2017) and random self-ensemble (Liu 2017) under PGD attack with $0.035$ distortion, and the gap becomes even larger on a subset of ImageNet.

1 INTRODUCTION

The paper introduces Adv-BNN, combining Bayesian weight randomness with adversarial training to improve neural-network robustness. It replaces indiscriminate layer noise with learned stochastic weights and formulates a Bayesian mini-max defense.

  • 1 INTRODUCTION: Adversarial attacks can add imperceptible input perturbations that drive deep-network predictions toward the wrong class or chance-level performance.
  • 1 INTRODUCTION: Adv-BNN combines adversarial training with Bayesian neural networks to defend against adversarial attacks.The paper presents this combination as its central defense algorithm.
  • 1 INTRODUCTION: Bayesian modeling treats network weights as stochastic and learns their posterior rather than adding randomness blindly to each layer.This contrasts with the noise-layer strategy used by random self-ensemble.
  • 1 INTRODUCTION: The proposed mini-max formulation combines adversarial training with Bayesian neural networks and is solved by alternating projected gradient descent and SGD.
  • 1 INTRODUCTION: The method is evaluated on CIFAR10, STL10, and ImageNet143 against random self-ensemble and adversarial training.

2 BACKGROUNDS

The background covers gradient-based attacks, adversarial training, randomized defenses, and Bayesian neural networks. It motivates Adv-BNN by combining robust optimization with learned distributions over network weights.

  • 2.1 ADVERSARIAL ATTACK AND DEFENSE: PGD generates adversarial examples by iteratively updating inputs with loss gradients and projecting them into a γ-bounded perturbation set.The projection gives direct control over distortion through γ.
  • 2.1 ADVERSARIAL ATTACK AND DEFENSE: Adversarial training incorporates adversarial-example search into training by minimizing loss under worst-case perturbations.Madry et al.'s formulation is presented as a robust optimization problem.
  • 2.1 ADVERSARIAL ATTACK AND DEFENSE: Random self-ensemble applies Gaussian noise to input features and uses model ensembles to improve robustness without additional memory cost.The noise layer is used during both training and testing.
  • 2.2 BAYESIAN NEURAL NETWORKS (BNN): Bayesian neural networks estimate a posterior distribution over hidden weights from observed features and labels, often approximating the posterior with a parametric distribution.Exact posterior inference is difficult because it involves a high-dimensional integral.
  • 2.2 BAYESIAN NEURAL NETWORKS (BNN): Mean-field variational inference is efficient but can poorly approximate correlated posteriors, especially for convolutional neural networks.The paper identifies this correlation mismatch as a limitation of the chosen approximation.

3 METHOD

Adv-BNN combines Bayesian weight randomness with adversarial training by optimizing a robust variational objective, using reparameterized stochastic optimization and PGD-generated adversarial examples.

  • Variational model: The model assumes a fully factorized Gaussian posterior over weights and a Gaussian prior for simplicity and closed-form KL divergence.More complex priors are possible but require higher-variance Monte Carlo KL estimates and may converge more slowly.
  • Robust Bayesian objective: Adv-BNN combines adversarial training with Bayesian neural networks by optimizing an evidence-based objective over adversarial examples.The robust objective minimizes loss within a perturbation ball while adapting the ELBO to adversarial data.
  • Stochastic optimization: Weights are sampled through reparameterization, w = µ + exp(s) ⊙ϵ, enabling unbiased stochastic gradients during backpropagation.The method can also use local reparameterization to sample activations and reduce sampling variance.
  • Training procedure: Training alternates PGD adversarial-example generation with stochastic Bayesian updates using cross-entropy and KL-divergence losses.Algorithm 1 samples new weights, evaluates adversarial examples, and combines classification and scaled KL terms.
  • Regularization: A scaling factor 0 < α ≤ 1 weakens KL regularization when the original penalty is too large for small datasets or large models.The authors report little to no performance degradation relative to the same network without randomness when α and the prior are suitably chosen.
  • Motivation: The motivation is that adversarial training controls local Lipschitz behavior on training data, while test-set behavior can remain problematic on complex datasets such as CIFAR-10.This motivates combining randomized models with adversarial training rather than relying on either mechanism alone.

4 EXPERIMENTAL RESULTS

Adv-BNN is evaluated against strong white-box and black-box attacks across CIFAR-10, STL-10, and ImageNet-143. The experiments report improved robustness, transfer-attack behavior, efficient prediction, and stability under longer PGD runs.

  • Experimental setup: Experiments compare Adv-BNN with adversarial training, BNN, RSE, and undefended models across CIFAR-10, STL-10, and ImageNet-143.STL-10 uses the smaller Model A network, while CIFAR-10 and ImageNet-143 use VGG.
  • White-box PGD attack: Adv-BNN improves testing accuracy by approximately 10% across several datasets when combined with adversarial training, while BNN alone does not increase robustness.The reported overhead is small: parameter storage doubles for means and variances, and training time increases little.
  • Black-box transfer attack: Transfer affinity is approximately 0.85 between undefended and BNN models, but approximately 0.5–0.6 among RSE, Adv-BNN, and adversarial-training models.The latter group is described as robust to black-box transfer attacks to some extent.
  • Prediction efficiency: Averaging 10–20 stochastic forward propagations is sufficient for robust and accurate ImageNet-143 prediction across tested perturbation scales.The result is reported for ImageNet-143 with a VGG network, and the required ensemble size appears independent of distortion.
  • PGD-step stability: Testing accuracy changes little when PGD iterations increase from 20 to 1000, indicating negligible marginal benefit from substantially more attack iterations.The experiment addresses whether 20 PGD steps are sufficient for evaluating the model.

5 CONCLUSION & DISCUSSION

Adv-BNN combines Bayesian neural networks with adversarial training, substantially increasing robustness, while the optimal defense remains unresolved.

  • 5 CONCLUSION & DISCUSSION: Combining Bayesian neural networks with adversarial training significantly increases robustness against adversarial attacks.The authors contrast this with standalone BNNs, which they state have no defense functionality.
  • 5 CONCLUSION & DISCUSSION: Robust classification relies on controlled local Lipschitz values, whereas adversarial training alone does not generalize this property well enough to the test set.
  • 5 CONCLUSION & DISCUSSION: The optimal defense solution remains an open problem, and the proposed method is still far from ideal.

A HOW TO ATTACK THE RANDOMIZED NETWORK

The paper derives attacks for randomized networks by maximizing loss over the input perturbation while sampling network randomness during optimization.

  • A HOW TO ATTACK THE RANDOMIZED NETWORK: The white-box attack represents randomized networks as f(w; ϵ), with fixed parameters w and a random vector ϵ.Adv-BNN is included by setting w = (µ, s).
  • A HOW TO ATTACK THE RANDOMIZED NETWORK: The optimal white-box attack maximizes the loss on the ground-truth label.
  • A HOW TO ATTACK THE RANDOMIZED NETWORK: The adversarial example is formed as xadv = x + ξ∗ after optimizing the perturbation with SGD while sampling ϵ at each iteration.
  • A HOW TO ATTACK THE RANDOMIZED NETWORK: The iterative attack procedure approximately solves the stated optimization problem.

B FORWARD & BACKWARD IN RANDLAYER

The implementation introduces a RandLayer for stochastic parameter sampling and builds variational network layers on top of it for forward and backward propagation.

  • B FORWARD & BACKWARD IN RANDLAYER: RandLayer integrates Bayesian neural network forward and backward propagation into major deep-learning frameworks.The paper illustrates the implementation using PyTorch.
  • B FORWARD & BACKWARD IN RANDLAYER: The RandLayer function receives mu, sigma, eps, sigma_0, and N, and saves mu, sigma, and eps for backward propagation.
  • B FORWARD & BACKWARD IN RANDLAYER: The RandLayer forward pass samples weights as mu + exp(sigma) * eps.
  • B FORWARD & BACKWARD IN RANDLAYER: The implementation returns gradients for mu, sigma, eps, sigma_0, and N.
  • B FORWARD & BACKWARD IN RANDLAYER: A variational Linear layer uses RandLayer to sample weights before applying a linear transformation.Convolutional and BatchNorm layers are implemented similarly.

C HYPER-PARAMETERS

The experiments use the hyper-parameters listed in Table 2, but the authors caution that these settings were not extensively tuned.

  • C HYPER-PARAMETERS: The authors did not tune the hyper-parameters very hard, so better settings may be possible.
  • C HYPER-PARAMETERS: The experiments use the hyper-parameter settings listed in Table 2.
Loading 1810.01279v2…