PaperlayerView exact revision on arXiv

Source-linked AI summary

MMA Training: Direct Input Space Margin Maximization through Adversarial Training

Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, Ruitong Huang

arXiv:1812.02637v4cs.LGcs.NEstat.ML

TL;DR

Neural networks are vulnerable to adversarial perturbations, while fixed-magnitude adversarial training must choose one ϵ despite differing example-wise robustness. The paper introduces MMA training to directly maximize input margins using adaptive per-example perturbations, and reports stronger, less hyperparameter-sensitive robustness on MNIST and CIFAR10 across ℓ∞ and ℓ2 settings.

  • Problem

    Fixed-magnitude adversarial training must use one perturbation length ϵ even though perturbations that are too small or too large have different robustness and accuracy consequences, and examples differ in intrinsic robustness.

  • Method

    MMA training directly maximizes input-space margins by adapting the perturbation magnitude throughout training and individually for each training example.

  • Results

    Experiments on MNIST and CIFAR10 under ℓ∞ and ℓ2 robustness empirically confirmed the theory and showed higher average robustness with less sensitivity to perturbation-magnitude settings than adversarial training.

  • Takeaways & Limitations

    MMA is presented as a better defense choice when the adversary is unknown because it is less sensitive to hyperparameter settings and variable attack lengths.

  • Takeaways & Limitations

    Finding the shortest successful perturbation requires solving a non-convex optimization problem, so optimality cannot be guaranteed in practice.

Abstract

from arXiv · show

We study adversarial robustness of neural networks from a margin maximization perspective, where margins are defined as the distances from inputs to a classifier's decision boundary. Our study shows that maximizing margins can be achieved by minimizing the adversarial loss on the decision boundary at the "shortest successful perturbation", demonstrating a close connection between adversarial losses and the margins. We propose Max-Margin Adversarial (MMA) training to directly maximize the margins to achieve adversarial robustness. Instead of adversarial training with a fixed $ε$, MMA offers an improvement by enabling adaptive selection of the "correct" $ε$ as the margin individually for each datapoint. In addition, we rigorously analyze adversarial training with the perspective of margin maximization, and provide an alternative interpretation for adversarial training, maximizing either a lower or an upper bound of the margins. Our experiments empirically confirm our theory and demonstrate MMA training's efficacy on the MNIST and CIFAR10 datasets w.r.t. $\ell_\infty$ and $\ell_2$ robustness. Code and models are available at https://github.com/BorealisAI/mma_training.

1 INTRODUCTION

The paper connects adversarial robustness to input-space margins and proposes MMA training to maximize each example’s margin instead of using one fixed perturbation magnitude. It also analyzes fixed-magnitude adversarial training as optimizing margin bounds and reports stronger, less hyperparameter-sensitive robustness across settings.

  • Motivation: Input-space margin is the distance from a data point to the classifier’s decision boundary, so larger margins indicate greater per-input robustness.The margin is also the minimum perturbation distance needed to change the classifier’s prediction.
  • Motivation: Fixed-magnitude adversarial training can underperform because too-small perturbations reduce robustness, too-large perturbations reduce accuracy, and examples have different intrinsic robustness.The paper identifies a single ϵ shared across data points and training as likely suboptimal.
  • MMA training: MMA training directly maximizes input margins by selecting the current, individually appropriate ϵ for each data point rather than using a predefined magnitude.The method adapts perturbation magnitudes throughout training and across distinct training examples.
  • Theory: Margin maximization can be implemented by minimizing classification loss at the shortest successful perturbation, making gradient descent viable despite parameter-dependent constraints.This establishes the paper’s connection between adversarial loss minimization and direct margin maximization.
  • Theory: With fixed perturbation length ϵ, adversarial training maximizes a lower or upper margin bound when ϵ is smaller or larger than the example’s margin.MMA improves this formulation by selecting the margin value for each example as the correct ϵ.
  • Experiments: Experiments on MNIST and CIFAR10 under ℓ∞ and ℓ2 attacks found higher average robustness across perturbation magnitudes, alongside automatic accuracy–robustness balancing and reduced hyperparameter sensitivity.MMA matched carefully tuned adversarial-training models and ensembles in the reported scenarios.

2 MAX-MARGIN ADVERSARIAL TRAINING

MMA training directly maximizes per-example input margins, using loss minimization at the shortest successful perturbation and a smooth surrogate to make gradient-based optimization practical. The analysis explains how fixed-ϵ adversarial training maximizes different margin bounds depending on ϵ, while experiments motivate clean-loss stabilization.

  • MMA objective: MMA maximizes the average margin by combining classification with hinge-focused maximization of correctly classified examples up to dmax.The objective excludes wrongly classified examples from margin maximization and uses β to balance classification and margin terms.
  • Margin maximization: Gradient descent on the loss at the shortest successful perturbation increases the classifier margin, making direct margin maximization viable despite parameter-dependent constraints.For smooth settings, the margin gradient is proportional to the loss gradient at that perturbation; the result also holds without smoothness under the stated theorem.
  • Surrogate loss: The soft logit margin loss replaces max with LogSumExp, yielding a smooth convex surrogate whose SLM-margin is a lower bound of the margin.MMA therefore maximizes the SLM-margin rather than directly optimizing the nonsmooth logit margin loss.
  • Practical limitation: Finding the shortest successful perturbation requires solving a non-convex optimization problem, so optimality cannot be guaranteed in practice.The paper reports that MMA nevertheless achieves the desired individual-margin-maximization behavior empirically.
  • Training stabilization: Adding clean loss steepens MMA's input-space loss landscape, addressing flatter curves that can weaken PGD and hamper approximation of the shortest successful perturbation.The comparison uses OMMA-32, PGD-8, and MMA-32 visualizations; MMA-32 has more tilted curves and lower perturbed-example losses.
  • Adversarial-training analysis: Fixed-ϵ adversarial training exactly maximizes the margin when ϵ equals the margin, a lower bound when ϵ is smaller, and an upper bound when ϵ is larger.When ϵ exceeds the margin, increasing the upper bound need not increase the margin; the paper suggests starting smaller and gradually increasing ϵ.

4 EXPERIMENTS

Experiments compare MMA with fixed-magnitude adversarial training across datasets, norms, attack lengths, and hyperparameters. MMA generally provides more stable and balanced robustness, while fixed-magnitude PGD can fail when its perturbation exceeds data-point margins.

  • Experimental setup: MMA training is evaluated against adversarial-training variants on MNIST and CIFAR10 under ℓ∞ and ℓ2 perturbations.Robustness is measured using combined whitebox and transfer PGD attacks, alongside clean, average, and average robust accuracy.
  • Overall comparison: MMA training is stable across hinge thresholds and balances accuracy across variable attack lengths better than fixed-magnitude adversarial training.The reported conclusion is that this makes MMA preferable when the perturbation length is unknown.
  • Margin distributions: 37.8% of PGD-2.5 training points have margins below 0.05 at the end of training, compared with 20.4% for MMA.Both methods increase average margins, but MMA continues improving points with small margins while PGD leaves some near zero.
  • Fixed-magnitude PGD: PGD-24 achieves about 10% accuracy across all tested CIFAR10-ℓ∞ attack magnitudes.This supports the analysis that fixed-magnitude training can fail when its perturbation exceeds the margin.
  • Hyperparameter sensitivity: MMA-32 reaches 84.36% clean accuracy and 47.18% robust accuracy at 8/255 despite a hinge threshold of 32/255.The model effectively ignores larger attack lengths deemed infeasible, whereas comparable PGD performance requires careful magnitude selection.
  • Comparisons: MMA achieves similar performance to ensembles of PGD-trained models, while PGD ensembles retain good clean accuracy but are marginally less robust than MMA-32 at various magnitudes.TRADES exceeds MMA below 12/255 but sacrifices robustness under larger attacks.

5 CONCLUSIONS

The paper proposes direct margin maximization through MMA training and analyzes adversarial training from the same perspective. Experiments on MNIST and CIFAR10 support MMA’s robustness and hyperparameter advantages when attack length is unknown.

  • MMA directly maximizes input margins by adapting perturbation magnitudes throughout training and across individual training datapoints.
  • The paper rigorously analyzes how fixed-magnitude adversarial training relates to margin maximization.Its experiments empirically confirm the proposed theory on MNIST and CIFAR10 under ℓ∞ and ℓ2 robustness.
  • MMA outperforms fixed-magnitude adversarial training in hyperparameter sensitivity and robustness across variable attack lengths.The conclusion suggests MMA is preferable when the adversary’s perturbation length is unknown.

A.1 PROOF OF PROPOSITION 2.1

The proof handles margin maximization when the shortest successful perturbation is defined by a parameter-dependent constraint. It uses first-order conditions and the implicit function theorem to differentiate the optimizer with respect to model parameters.

  • The shortest successful perturbation solves a constrained optimization problem whose constraint depends on model parameters.The loss and perturbation norm are assumed to be C2 functions.
  • First-order conditions characterize the perturbation and Lagrange multiplier at the constrained optimum.
  • The implicit function theorem expresses the optimal perturbation and multiplier as functions of the model parameters when the Jacobian is full rank.
  • Differentiating the optimal perturbation requires the inverse of a Jacobian involving the coupled perturbation and multiplier variables.
  • A direct application of Danskin’s theorem is invalid because the constraint set depends on the model parameters.

A.2 PROOF OF PROPOSITION 2.2

The proof shows that suitable parameter updates can reduce adversarial loss within a fixed perturbation radius and thereby increase the classifier’s margin. The argument uses directional derivatives and a proposition linking loss bounds to margin enlargement.

  • For any positive perturbation radius, a non-local-minimum parameter setting admits a direction with negative directional derivative of the worst-case loss.
  • Under the stated loss condition, moving along that direction produces parameters with a larger margin than the original radius.
  • The proof establishes that a parameter update can increase the margin when the constrained worst-case loss decreases appropriately.
  • Continuity and compactness arguments connect worst-case loss thresholds inside a perturbation ball to the location of the decision boundary.

A.5 PROOF OF THEOREM 3.1

The paper frames margin maximization through adversarial-loss behavior and contrasts MMA’s average-margin objective with related robustness approaches. It leaves maximization of the minimum margin for future work.

  • Related methods: MMA’s margin estimation is exact when the shortest successful perturbation can be solved, extending beyond linear models to some broader model classes.First-order methods accurately estimate margins for linear classification functions, whereas MMA uses the shortest successful perturbation directly.
  • Related methods: Lipschitz-based methods enlarge margins by constraining the global Lipschitz constant, while MMA estimates margins locally with adversarial attacks.The paper characterizes MMA’s local estimate as more precise near the data point and more flexible than strong global constraints.
  • Hard-margin SVM: Under separability and correct classification, the MMA formulation maximizes average margin rather than the minimum margin optimized by hard-margin SVM.The paper notes that the margin-gradient theorem also applies to differentiable SVM formulations solvable with SGD.
  • Scope: The paper explicitly postpones maximization of the minimum margin, focusing MMA on improving adversarial robustness through average-margin maximization.This is identified as future work rather than an objective addressed by the current formulation.
  • Related methods: Randomized smoothing certifies a lower bound on the input-space margin of a smoothed classifier, and prior work directly maximizes that certified radius.The paper presents this as a related approach to robust-radius maximization.

B.1 DETAILED COMPARISON WITH ADVERSARIAL TRAINING WITH DDN

The paper compares MMA with DDN-based adversarial training for ℓ2 robustness, emphasizing differences in failed-attack handling and reporting similar performance in experiments.

  • DDN comparison: DDN seeks successful perturbations with minimal ℓ2 norm and can replace AN-PGD as MMA’s margin-estimation attack.The comparison uses downloaded DDN-trained models on MNIST and CIFAR10.
  • Model comparison: The DDN MNIST and CIFAR10 models use larger architectures than the corresponding LeNet5 and WideResNet-28-4 models used in the paper.The cited models are a larger ConvNet and WideResNet-28-10, respectively.
  • Training differences: When DDN fails, DDN training uses the clean image, whereas MMA assigns a very large perturbation that the hinge loss ignores.The two methods therefore differ in how unsuccessful adversarial searches affect training.
  • Results: MMA achieves similar performance to DDN training for ℓ2 cases, while also improving over PGD training in the ℓ∞ case.The paper scopes the DDN comparison to ℓ2 because DDN training focuses on that norm.

C DETAILED SETTINGS FOR TRAINING

Training experiments vary datasets, norms, perturbation magnitudes, model architectures, and MMA settings while using fixed optimization and attack procedures within each dataset family.

  • Loss settings: The experiments fix the combined-loss weights at (1/3, 2/3) for LCE and LMMA after initial CIFAR10-ℓ∞ tests.The same weights are used for the remaining MNIST and ℓ2 experiments.
  • Architectures: MMA experiments use LeNet5 for MNIST and WideResNet-28-4 for CIFAR10, with CIFAR10 images standardized per image.MNIST images are not preprocessed; the CIFAR10 network has depth 28 and widen factor 4.
  • Checkpoint selection: Models are selected from checkpoints by the largest validation average margin estimated with AN-PGD, using the first 5000 training images only for monitoring.Two random seeds are trained for each dmax value to assess initialization effects and provide transfer attacks.
  • Optimization: MNIST training uses Adam for 100000 steps with batch size 50, while CIFAR10 training uses momentum SGD for 50000 steps with batch size 128.CIFAR10 additionally uses momentum 0.9 and weight decay 0.0002.
  • Attack settings: Training attacks use SLM-loss PGD, while AN-PGD adds a 10-step bisection search and sets ϵmax to 1.05dmax.MNIST uses 40 PGD steps and CIFAR10 uses 10; the training-time step size is scaled by perturbation magnitude.
  • Model configurations: Training compares PGD and PGDLS across multiple fixed ϵ values with MMA and OMMA across several dmax values, plus clean, ensemble, and published reference models.The total model counts are 18 for MNIST-ℓ∞, 24 for MNIST-ℓ2, 32 for CIFAR10-ℓ∞, and 26 for CIFAR10-ℓ2.

D DETAILED SETTINGS OF ATTACKS

The attack evaluation uses CE and CW PGD variants, specialized ensemble attacks, SPSA settings, and fixed iteration budgets to measure robustness across models.

  • Single-model attacks: Evaluation attacks use both CE-PGD and CW-PGD, with 100 iterations at test time and attack counts determined by dataset.Each model receives N attacks, split evenly between CE and CW; N is 50 for MNIST and 10 for CIFAR10.
  • Ensemble attacks: Ensemble attacks use either summed model losses or a customized loss that changes according to the fraction and labels of misclassified ensemble members.The customized strategy aggregates CW losses from correct classifiers when fewer than half are wrong and targets the most frequent wrong label otherwise.
  • Limitation: The paper states that more carefully designed attacks could work better on ensembles and leaves that development to future work.This caveat applies specifically to the ensemble attack evaluation.
  • SPSA attacks: SPSA attacks run for 100 iterations with perturbation size 0.01, Adam learning rate 0.01, stopping threshold -5.0, and 2048 gradient-estimation samples.The evaluated magnitudes are 8/255 for CIFAR10-ℓ∞ and 0.3 for MNIST-ℓ∞.

E EFFECTS OF ADDING CLEAN LOSS IN ADDITION TO THE MMA LOSS

Adding clean loss to MMA changes the loss landscape and can improve robustness, while its effects vary across datasets and attack settings. On CIFAR10, the added term reduces TransferGaps and slightly trades clean accuracy for robust accuracy.

  • TransferGaps: TransferGaps measure the robust-accuracy difference between combined whitebox-plus-transfer attacks and whitebox PGD attacks.They quantify the additional attack success rate introduced by transfer attacks.
  • TransferGaps: Adding clean loss reduces MMA-32’s TransferGap at ϵ = 8/255 from the observed gap to 3.02%.The passage attributes this to a more tilted loss landscape, allowing whitebox PGD attacks to succeed more easily.
  • Dataset differences: TransferGaps are almost zero for MMA models on MNIST under both ℓ∞ and ℓ2 attacks.The contrast with CIFAR10 indicates that dataset properties contribute to the observed TransferGaps.
  • Accuracy–robustness trade-off: On CIFAR10, adding clean loss lowers clean accuracy from 86.11% to 84.36% while increasing average robust accuracy from 28.36% to 29.39%.The comparison is between OMMA-32 and MMA-32.

F FULL RESULTS AND TABLES

The full results compare MMA with adversarial-training baselines across MNIST and CIFAR10, using whitebox, transfer, and combined attacks. MMA is generally stable and provides strong robustness–accuracy trade-offs, but dataset and attack magnitude affect the relative outcomes.

  • Evaluation setup: The evaluation reports combined whitebox-plus-transfer attacks as a proxy for true robustness, whitebox PGD attacks, and TransferGaps.Results are organized across Tables 4 to 15.
  • Baseline checks: The external PGD-Madry model checks produce 89.79% robust accuracy on MNIST at ϵ = 0.3 and 44.70% on CIFAR10 at ϵ = 8/255 under whitebox attacks.The CIFAR10 attack used 100-step PGD and was stronger than the reported website result.
  • TRADES comparison: TRADES outperforms MMA at smaller ℓ∞ perturbations but sacrifices robustness at larger perturbations on both MNIST and CIFAR10.On MNIST, TRADES fails completely at ϵ = 0.4; on CIFAR10, it outperforms MMA below ϵ = 12/255.
  • CIFAR10 results: MMA training is fairly stable to dmax and achieves good robustness–accuracy trade-offs, whereas PGD methods require larger clean-accuracy sacrifices for good average robust accuracy.Similar patterns are reported for CIFAR10-ℓ2.
  • MNIST-ℓ∞ results: On MNIST-ℓ∞, PGD-0.4 reduces clean accuracy to 96.64% and PGD-0.45 fails to train, while PGDLS handles large ϵ values and MMA adds no extra benefit.The passage attributes this to the relative easiness of the MNIST task and the sufficiency of global ϵ scheduling.
  • MNIST-ℓ2 results: On MNIST-ℓ2, MMA reaches about 40% robust accuracy at ϵ = 3.0 without much clean-accuracy sacrifice, while PGD/PGDLS reaches 44.5% with some sacrifice.The passage describes 40% as the apparent robustness limit of MMA models in this setting.
  • MNIST results: PGD(LS)-ens performs poorly in robustness on both MNIST-ℓ∞ and MNIST-ℓ2, likely because PGD-trained models sharply drop when attack ϵ exceeds training ϵ.The stated explanation is specific to the observed MNIST behavior.
  • Dataset differences: TransferGaps are very small for MMA models on MNIST, indicating that dataset properties affect TransferGaps in addition to the MMA algorithm.The paper defers a thorough explanation of the MNIST–CIFAR10 difference to future work.

F.1 ADDITIONAL EVALUATION WITH THE CW-ℓ2 ATTACK

CW-ℓ2 evaluation measures the minimum perturbation distances needed to change predictions and shows observations consistent with PGD-based robust-accuracy evaluations. On MNIST, MMA improves robustness while retaining higher clean accuracy than larger-ε PGD/PGDLS training; CIFAR10 results show stable robustness–accuracy trade-offs.

  • Evaluation protocol: CW-ℓ2 attack results report clean accuracy and minimum perturbation distances, including mean, median, and percentile statistics.The attack is run on the first 1000 test examples for models trained with ℓ2 attacks.
  • Consistency with PGD evaluation: The CW-ℓ2 results show observations very similar to robust accuracies measured under PGD attacks at different ε values and their averages.
  • MNIST-ℓ2 results: 2.15 to 2.76: MMA’s MNIST mean minimum distance increases as dmax rises from 2.0 to 6.0, while clean accuracy declines only from 99.3% to 97.7%.
  • MNIST-ℓ2 results: At ε = 4.0, PGD/PGDLS reaches a 2.53 mean minimum distance but drops clean accuracy to 91.8%, whereas MMA retains better combined performance.
  • CIFAR10-ℓ2 results: On CIFAR10, MMA remains fairly stable to dmax and achieves good robustness–accuracy trade-offs, while carefully chosen ε can produce similar trade-offs for PGD-based training.
Loading 1812.02637v4…