Source-linked AI summary
Improving Adversarial Robustness via Promoting Ensemble Diversity
Tianyu Pang, Kun Xu, Chao Du, Ning Chen, Jun Zhu
TL;DR
Existing ensemble defenses often improve individual networks without modeling their interactions, despite adversarial examples transferring among similar models. The paper defines ensemble diversity over non-maximal predictions and trains ensembles with an ADP regularizer combining diversity and entropy. Across MNIST, CIFAR-10, and CIFAR-100, the method improves adversarial robustness while maintaining state-of-the-art normal accuracy, with compatibility and computational scalability described as practical properties.
Problem
Existing defenses mainly enhance individual networks and may ignore ensemble interactions, allowing similar members to facilitate adversarial-example transfer.
Method
The method defines diversity over normalized non-maximal predictions and uses an ADP regularizer combining logarithmic ensemble diversity with ensemble entropy.
Results
The method improves adversarial robustness while maintaining state-of-the-art accuracy on normal examples across MNIST, CIFAR-10, and CIFAR-100.
Takeaways & Limitations
Ensemble diversity is presented as an important design consideration and as an approach orthogonal to defenses acting on individual networks.
Takeaways & Limitations
The analysis assumes unlimited representation capacity for each network and focuses on optimal output predictions rather than the specific input-to-output mapping.
Abstract
from arXiv · showhide
Though deep neural networks have achieved significant progress on various tasks, often enhanced by model ensemble, existing high-performance models can be vulnerable to adversarial attacks. Many efforts have been devoted to enhancing the robustness of individual networks and then constructing a straightforward ensemble, e.g., by directly averaging the outputs, which ignores the interaction among networks. This paper presents a new method that explores the interaction among individual networks to improve robustness for ensemble models. Technically, we define a new notion of ensemble diversity in the adversarial setting as the diversity among non-maximal predictions of individual members, and present an adaptive diversity promoting (ADP) regularizer to encourage the diversity, which leads to globally better robustness for the ensemble by making adversarial examples difficult to transfer among individual members. Our method is computationally efficient and compatible with the defense methods acting on individual networks. Empirical results on various datasets verify that our method can improve adversarial robustness while maintaining state-of-the-art accuracy on normal examples.
1. Introduction
The paper argues that robust ensembles should exploit interactions among members by diversifying their non-maximal predictions, using ADP to reduce adversarial-example transfer while preserving accuracy and compatibility with individual-network defenses.
- Motivation: High-performance classifiers remain vulnerable to imperceptible adversarial perturbations, motivating robustness defenses and ensemble methods.
- Motivation: Similar ensemble members can produce transferable adversarial examples that fool individual networks and potentially the whole ensemble.
- Approach: The paper defines ensemble diversity over members’ non-maximal predictions rather than prediction errors, avoiding accuracy loss associated with diversifying already-accurate DNN predictions.
- Approach: Geometrically, ensemble diversity is the squared volume spanned by normalized non-maximal predictions; maximal predictions can remain consistent with the true label.
- Approach: The ADP regularizer combines a logarithm of ensemble diversity with ensemble entropy to encourage mutually orthogonal non-maximal predictions.
- Evidence and scope: Experiments on MNIST, CIFAR-10, and CIFAR-100 report improved adversarial robustness while maintaining state-of-the-art accuracy on normal examples, with O(K^3) matrix operations during back-propagation.
2. Preliminary Knowledge
This section introduces DNN classification and entropy notation, then reviews adversarial examples and commonly used attacks including FGSM, BIM, PGD, MIM, JSMA, C&W, and EAD.
- Notation: A DNN classifier F(x, θ) maps an input to an L-dimensional probability distribution, with θ denoting trainable parameters.
- Notation: Cross-entropy is presented as a standard classifier objective, while Shannon entropy is defined for a probability vector F.
- Adversarial examples: Adversarial examples are generated inputs that can fool high-performance classifiers while remaining indistinguishable from normal inputs to human observers.
- Attacks: FGSM forms x∗ by adding ϵ times the sign of the input-gradient of the adversarial loss.
- Attacks: BIM iteratively generates adversarial examples with clipping, while PGD uses the same process but starts from a randomly perturbed neighborhood point.
- Attacks: MIM is a BIM variant that updates gradients with momentum, whereas JSMA perturbs one feature per iteration using a saliency map.
- Attacks: JSMA typically produces sparser adversarial noise by perturbing fewer pixels than other attacks.
- Attacks: C&W minimizes an L2 perturbation objective with a confidence-controlled classification term, and EAD adds an L1 penalty, reducing to C&W when β = 0.
3. Methodology
The method trains ensemble members together while explicitly promoting diversity among their non-maximal predictions through the ADP regularizer. Its formulation preserves consistency on the true label, supports orthogonal non-maximal predictions, and remains compatible with individual-network defenses.
- Training strategies: Independent training ignores interactions among ensemble members, which can produce similar predictions or shared representations and limit robustness gains.The proposed simultaneous-training setup instead combines the ensemble cross-entropy loss with a regularizer that makes members interact during training.
- Ensemble diversity: Ensemble diversity is defined over normalized non-maximal predictions rather than prediction errors, avoiding an accuracy trade-off associated with treating strong DNNs as weak classifiers.The maximal prediction can remain consistent with the true label while diversity is promoted among predictions for potentially wrong labels.
- ADP training: The ADP regularizer combines ensemble Shannon entropy with the logarithm of ensemble diversity to promote diversity among ensemble members.The method uses simultaneous training so members retain individual accuracy through the ensemble cross-entropy term while interacting through the regularizer.
- Empirical and computational properties: Experiments report improved adversarial robustness while maintaining state-of-the-art normal-example accuracy, with compatibility with defenses such as adversarial training.The method is described as scalable because K grows much more slowly than the problem scale, and its additional back-propagation operations have O(K^3) complexity.
- Theoretical analysis: The ensemble entropy term is necessary: with α = 0, the LED-only objective yields one-hot predictions for every member.With β = 0, the regularizer reduces to ensemble entropy and produces ensemble-prediction solutions analogous to label smoothing.
- Theoretical analysis: When K divides L − 1, the theoretical optimum makes each member’s non-maximal predictions mutually orthogonal while preserving the true-label prediction constraint.The partition of non-zero non-maximal labels is adaptive to each input, so inputs with the same label can induce different partitions.
4. Experiments
Experiments across MNIST, CIFAR-10, and CIFAR-100 evaluate ADP ensembles under normal, white-box, black-box, and detection settings. ADP improves ensemble robustness and normal-example performance, mitigates transferability, remains compatible with adversarial training, and adds about 10% training time at K = 20.
- Setup: Experiments use MNIST, CIFAR-10, and CIFAR-100, with three Resnet-20 networks as the standard ensemble.The datasets each contain 50,000 training and 10,000 test images; the standard ensemble uses K = 3.
- Normal examples: ADP training causes higher individual-network error rates but lower ensemble error rates on normal test examples.The baseline is ECE training, while ADP2,0 and ADP2,0.5 are evaluated as reference and full settings.
- Efficiency and detection: About 10% more training time is required than baseline when K = 20, while ensemble diversity also serves as a detection metric for large perturbations.Training takes 692s/epoch for baseline versus 744s/epoch for ADP at K = 20; larger perturbations can cause nearly 100% misclassification, motivating detection.
- White-box attacks: ADP significantly improves robustness against the evaluated white-box attacks while preserving state-of-the-art normal-example accuracy.The experiments separately evaluate baseline, ADP2,0, and ADP2,0.5 ensembles under the attack configurations reported in Tables 2 and 3.
- Compatibility with adversarial training: ADP is tested with adversarial training using FGSM and PGD, demonstrating compatibility with defenses applied to individual networks.The CIFAR-10 evaluation reports enhanced ensemble classification accuracy under AdvTFGSM and AdvTPGD settings.
- Transferability: ADP training mitigates adversarial-example transferability among ensemble members in black-box evaluations using PGD and MIM.For untargeted attacks, evaluation uses classification accuracy; for targeted attacks, it uses target-class success rate.
5. Conclusion
The paper proposes ADP training as an orthogonal ensemble defense that promotes ensemble diversity alongside methods enhancing individual networks. It concludes that ensemble diversity is an important consideration for robust ensemble-system design.
- Conclusion: ADP training provides an orthogonal approach for further improving practical ensemble defenses beyond methods focused on individual networks.The conclusion identifies ensemble diversity as an important design consideration for robust ensemble systems.
- Conclusion: Ensemble diversity could be an important consideration when designing robust ensemble systems.
A. Proof
The appendix provides proofs for the theorems proposed in the paper.
- A. Proof: The appendix contains proofs of the theorems proposed in the paper.
A.1. Proof of Theorem 1
The proof analyzes the constrained optimization form of the ADP objective and shows that its optimum tends toward uniform predictions on the true label across classifiers.
- A.1. Proof of Theorem 1: When α = 0 and β ≥ 0, the optimization problem is formalized with constraints involving classifier and label indices.
- A.1. Proof of Theorem 1: The objective separates because normalized non-maximal predictions are mutually independent, allowing its terms to reach their minima separately.
- A.1. Proof of Theorem 1: The optimal solution tends to satisfy F_k_y = 1 for every classifier k.
A.2. Proof of Theorem 2
The proof analyzes the constrained optimization underlying the ADP regularizer when α > 0 and β = 0, deriving conditions for an optimal solution across ensemble members and classes.
- The optimization problem is formalized with constraints for the case α > 0 and β = 0.
- KKT conditions are applied to characterize the optimal solution for every ensemble member and class.
- At optimal solutions in the interior feasible space, all β_k,j and γ_k,j equal zero.
- The resulting conditions imply equality between the corresponding prediction components for classes distinct from the true label.
A.3. Proof of Corollary 1
The corollary establishes that the negative LED term is minimized by mutually orthogonal non-maximal predictions and identifies when both ADP terms can be minimized simultaneously.
- The negative LED term −log(ED) is minimized exactly when individual networks’ non-maximal predictions are mutually orthogonal.
- When K divides L − 1, the optimal solution can simultaneously minimize the LED and ensemble-entropy terms.
- The section provides additional theoretical and practical analyses of the paper’s stated results.
B.1. JS-divergence as the Diversity
The paper considers JS-divergence as an alternative ensemble-diversity definition, but its optimization lacks a suitable solution and creates an accuracy–diversity balancing problem. Temperature scaling is then used during training to address a numerical obstacle in ADP.
- JS-divergence is defined over classifier output vectors F_k ∈ R^L as a candidate measure of ensemble diversity.
- Adding JS-divergence regularization yields an optimization problem with neither a closed-form nor an intuitively reasonable solution.
- The JS-divergence minimization problem has no solution in the interior feasible space (0, 1)^(L×K).
- Directly using JS-divergence makes λ selection and accuracy–diversity balancing difficult because its second term can override the ECE term.
- During training, temperature scaling uses a high T to increase non-maximal predictions, while testing uses T = 1 for final predictions.
- Increasing ensemble size K or using dropout in the entropy term are identified as alternative ways to address the numerical obstacle, left for future work.
B.3. Histogram of the Ensemble Diversity
The CIFAR-10 histogram examines logarithmic ensemble-diversity values across 10,000 test samples and compares median diversity across training methods. ADP2,0 exceeds the baseline even without the LED term, while LED further explicitly promotes diversity.
- ADP2,0 learns substantially greater ensemble diversity than the baseline despite having an inactive LED term.
- The histogram contains ensemble-diversity values for 10,000 CIFAR-10 test samples, with median values summarized in a table.
- The ensemble-entropy term leaves freedom in optimal individual predictions, making low ensemble diversity unlikely.
- Adding the LED term further explicitly encourages ensemble diversity, as illustrated in Figure 5.