PaperlayerView exact revision on arXiv

Source-linked AI summary

Are Labels Required for Improving Adversarial Robustness?

Jonathan Uesato, Jean-Baptiste Alayrac, Po-Sen Huang, Robert Stanforth, Alhussein Fawzi, Pushmeet Kohli

arXiv:1905.13725v4cs.LGcs.CVstat.ML

TL;DR

Adversarially robust training needs substantially more data than standard classification, and labeled data can be expensive. The paper develops UAT to use unlabeled data, showing matching theoretical sample complexity up to constants and strong empirical robustness, including with uncurated data.

  • Problem

    Adversarial robustness requires substantially larger datasets than standard classification, making robust-model development difficult when labeled data is expensive.

  • Method

    The paper develops Unsupervised Adversarial Training, using labeled examples to obtain targets and unlabeled examples to train a smoothed robust classifier.

  • Results

    UAT matches fully supervised sample complexity up to constant factors theoretically and captures over 95% of the improvement from equally sized labeled data empirically.

  • Takeaways & Limitations

    Unlabeled data can be competitive with labeled data for adversarial training, including when the additional data is noisy and uncurated.

  • Takeaways & Limitations

    The theoretical analysis assumes labeled and unlabeled samples come from the same joint distribution and marginal distribution, respectively.

Abstract

from arXiv · show

Recent work has uncovered the interesting (and somewhat surprising) finding that training models to be invariant to adversarial perturbations requires substantially larger datasets than those required for standard classification. This result is a key hurdle in the deployment of robust machine learning models in many real world applications where labeled data is expensive. Our main insight is that unlabeled data can be a competitive alternative to labeled data for training adversarially robust models. Theoretically, we show that in a simple statistical setting, the sample complexity for learning an adversarially robust model from unlabeled data matches the fully supervised case up to constant factors. On standard datasets like CIFAR-10, a simple Unsupervised Adversarial Training (UAT) approach using unlabeled data improves robust accuracy by 21.7% over using 4K supervised examples alone, and captures over 95% of the improvement from the same number of labeled examples. Finally, we report an improvement of 4% over the previous state-of-the-art on CIFAR-10 against the strongest known attack by using additional unlabeled data from the uncurated 80 Million Tiny Images dataset. This demonstrates that our finding extends as well to the more realistic case where unlabeled data is also uncurated, therefore opening a new avenue for improving adversarial training.

1 Introduction

Adversarial robustness remains difficult because it requires more data than standard classification, while labeled data is expensive. The paper proposes using unlabeled data through UAT and reports theoretical and empirical evidence that it can substantially improve robustness.

  • Adversarially robust training requires substantially larger datasets than standard classification, creating a hurdle where labeled data is expensive.
  • UAT uses unlabeled examples for adversarial training, motivated by estimating classifier smoothness from unlabeled data and propagating labels from supervised examples.
  • In a simple theoretical setting, UAT matches the fully supervised sample complexity up to constant factors after one labeled example.
  • 54.1% and 84.4% robust accuracy on CIFAR-10 and SVHN respectively nearly match 55.5% and 86.2% with full supervision, capturing over 95% of that improvement.
  • UAT improves CIFAR-10 performance from 52.58% to 56.30% against the strongest known attack using additional noisy, uncurated data.

2 Related Work

Related work established adversarial vulnerability, developed adversarial and semi-supervised defenses, and highlighted the distinct challenge of adversarial generalization. UAT extends smoothness and pseudo-labeling ideas from semi-supervised learning to adversarial robustness.

  • Adversarial examples can fool highly accurate neural networks, and many proposed defenses have not remained robust against stronger attacks.
  • Adversarial training is among the most successful approaches for obtaining adversarially robust classifiers.
  • Adversarial generalization can require more data than natural generalization, as illustrated by a 46% adversarial accuracy despite near 100% adversarial accuracy on the training set.
  • Semi-supervised methods use smoothness regularization, confident predictions, or adversarial perturbations to exploit unlabeled data, but prior work focused on standard generalization.
  • UAT belongs to concurrent work optimizing adversarial robustness without labels and is nearly equivalent to a particular Robust Self-Training instantiation.

3 Unsupervised Adversarial Training (UAT)

Unsupervised Adversarial Training (UAT) uses unlabeled data to improve adversarial generalization, motivated by the greater data demands of robust training. The paper develops two UAT strategies and shows theoretical and empirical competitiveness with labeled-data approaches.

  • Motivation: UAT addresses the question of whether unlabeled data can replace some labeled data for adversarial training when labeled examples are expensive.The approach targets settings where unlabeled examples are much cheaper to acquire than labeled examples.
  • UAT-OT: Adversarial risk can be decomposed into natural classification loss and a smoothness loss measuring prediction changes within perturbation neighborhoods.The smoothness term can dominate adversarial-training performance on the test set.
  • UAT-OT: UAT-OT minimizes a differentiable surrogate of the label-independent smoothness loss using unlabeled data and an iterative PGD adversary.The overall objective combines supervised and unsupervised losses as L(θ) = Lsup(θ) + λLunsup(θ).
  • UAT-FT: UAT-FT first trains a standard classifier, then uses its predictions as fixed pseudo-labels for supervised adversarial training on unlabeled examples.With enough unlabeled data, it recovers a smoothed classifier that preserves clean-data predictions while stabilizing predictions locally.
  • Theoretical model: A single labeled example plus O(d) unlabeled examples suffices for fixed arbitrary accuracy in the Gaussian model, matching the supervised sample complexity up to constants.The purely supervised setting requires O(d / log d) examples, whereas the semi-supervised setting uses one labeled example and O(d) unlabeled examples.

4 Experiments

Experiments on CIFAR-10 and SVHN evaluate unlabeled-data adversarial training across data regimes, UAT variants, noisy pseudo-labels, and attack settings. UAT++ approaches supervised-oracle robustness with in-distribution unlabeled data and improves robustness even with off-distribution data.

  • Experimental setup: Experiments use CIFAR-10 and SVHN with standard L∞ perturbation constraints, 20-step iterative FGSM evaluation, and MultiTargeted attacks in later experiments.The constraints are ε = 8/255 for CIFAR-10 and ε = 0.01 for SVHN.
  • Experimental setup: The study varies unlabeled-sample counts by splitting training data into supervised and unsupervised sets, comparing regimes where m ≈ n and m ≫ n.A separate 10,000-example validation split is used for both datasets.
  • Comparison to baselines: 12.9% / 16.9% improvement over baselines is achieved by UAT-OT with maximum unlabeled data on CIFAR-10 / SVHN, while gains over VAT are 6.4% / 1.6%.These results are reported for 32k / 60k unlabeled images on CIFAR-10 / SVHN.
  • Comparison to the oracle: 54.1% on CIFAR-10 and 84.4% on SVHN are achieved by UAT++ with large unlabeled datasets, only 1.4% and 1.8% below their supervised oracles.The corresponding unlabeled-data amounts are 32K for CIFAR-10 and 60K for SVHN.
  • Comparison to the oracle: 97.6% / 97.9% of the supervised improvement is captured without labels on CIFAR-10 / SVHN, according to the experiments’ conclusion.The comparison uses 32K / 60K additional examples for CIFAR-10 / SVHN, respectively.
  • Robustness to label noise: 8.0% improvement over the strongest baseline persists with nearly 50% base-classifier error, consistent with UAT relying primarily on smoothness loss rather than classification loss.UAT-FT remains relatively flat across substantial random and correlated label noise, while corrupted labels have limited classification utility.
  • Off-distribution unlabeled data: UAT++ outperforms TRADES with off-distribution 80 Million Tiny Images data, improving by 5.07% under FGSM20 and 0.77% under MultiTargeted attack at 80m@200K.Performance improves from 80m@100K to 80m@200K but degrades at 80m@500K; WRN-106 reaches +6.54% under FGSM20 and +3.72% under MultiTargeted attack.
  • Attack validation: Additional checks find no evidence that attacks outperform MultiTargeted, including gradient-free SPSA comparisons, loss-landscape visualizations, and attack-convergence analyses.These checks are described in Appendix E.

5 Conclusion

The paper argues that adversarially robust classifiers can be trained with far fewer labels by leveraging unlabeled and uncurated data. Its experiments support near-state-of-the-art robustness with limited annotations and report a 4% improvement on CIFAR-10 against the strongest known attack.

  • UAT reaches near-state-of-the-art adversarial robustness with 4K CIFAR-10 labels and 1K SVHN labels.These correspond to 10 times and 100 times fewer labels than the original datasets, respectively.
  • UAT applied to uncurated web-query data improves CIFAR-10 state-of-the-art performance by 4% against the strongest known attack.
  • The findings open an avenue for improving adversarial robustness using unlabeled data, potentially relevant where collecting labels is particularly costly.

Overview

The appendix describes UAT implementations, adversarial-loss estimation, optimization settings, data handling, and architecture choices. It also records implementation differences for distribution shift and training details for reproducibility.

  • Architecture: WRN-28 variants are used for Section 4.1, while CIFAR-10 depth is increased to 34, 70, and 106 in Section 4.2.2.
  • Data preprocessing: Image preprocessing uses padding, random 32x32 crops, and dataset-specific augmentations for CIFAR-10 and SVHN.
  • Pseudocode: UAT-OT and UAT-FT updates combine labeled and unlabeled batches with adversarial and, for UAT-OT, smoothness losses.
  • Adversarial optimization: Adversarial maximization is approximated with 10-step PGD, while attacks use a margin-loss objective optimized with Adam.
  • Loss implementation: UAT-OT uses hard-label adversarial optimization for its smoothness loss, while UAT++ reuses the adversarial example computed for its adversarial loss.
  • Optimization: All experiments use λ = 5 for UAT-OT and UAT++, with SGD momentum and 5 × 10^-4 weight decay.
  • Distribution shift: Distribution-shift experiments separate labeled and unlabeled forward passes and downweight unlabeled loss to accommodate batch-normalization effects.

A.2 Negative results and observations

Additional observations identify training choices that affect robustness and failure modes in UAT variants. These checks are explicitly presented as less carefully examined and potentially setup-specific.

  • The appendix cautions that these observations are less carefully examined and may be specific to the particular training setup.
  • Merging labeled and unlabeled batches improves robust accuracy, particularly in the small-data regime, possibly through more reliable batch-normalization statistics.
  • A shorter learning-rate schedule improves robust accuracy by approximately 3% relative to the authors’ adversarial-training reimplementation.
  • The smoothness loss strongly regularizes UAT-OT and UAT++, keeping train robust accuracy below 80% under the reported schedule.
  • Without fixed parameters or fixed unlabeled targets, smoothness training can produce uniform predictions and near-random test accuracy on unperturbed images.
  • Combining UAT with UDA yields no significant adversarial-accuracy improvement, while InstanceNorm and GroupNorm perform slightly worse.

B Implementation note on VAT baseline implementation

The VAT baseline is adapted to the L∞ ball, while UAT-OT uses a stronger PGD-based perturbation estimate and outperforms VAT on adversarial generalization.

  • The VAT loss uses Kullback-Leibler divergence with a fixed parameter copy to stop gradient propagation.
  • The original VAT procedure approximates the optimal perturbation using a Taylor expansion, finite differences, and power iteration.
  • For fair comparison, the baseline is adapted to the L∞ ball by replacing that procedure with one FGSM step at learning rate ϵ.
  • UAT-OT instead uses 10 PGD steps to estimate the perturbation and clearly outperforms VAT.

C Dataset Details

The experiments construct filtered, web-derived unlabeled datasets from 80 Million Tiny Images and evaluate models with increasingly strong adversarial attacks.

  • Roughly one million near-duplicate images are removed using nearest-neighbor GIST distances to CIFAR-10 test images.
  • A CIFAR-10-trained WRN-28-10 model filters images using WordNet hyponyms, leaving roughly 2 million images with highly non-uniform class frequencies.
  • The strongest evaluation uses the MultiTargeted attack, which runs a targeted attack against each possible class and returns the image minimizing untargeted loss.
  • The MultiTargeted and untargeted PGD settings use 200 steps with 20 random restarts for each class or attack configuration.
  • For the strongest model, adversarial accuracy is 63.65% under FGSM20 and 61.10% under untargeted PGD.

E.2 SPSA evaluation

Multiple checks indicate that the strongest model’s performance is not primarily caused by gradient masking, although some images show optimization irregularities under PGD restarts.

  • 64.9% SPSA adversarial accuracy is similar to 61.1% under untargeted PGD, while SPSA rarely outperforms PGD.
  • In Figure 4, each point compares final margin losses for one image under PGD and SPSA, with proximity to y = x indicating similar outcomes.
  • The loss landscape is rather smooth, providing weak additional evidence against gradient masking.
  • PGD usually converges quickly with tightly clustered restart losses, but some images show varying final losses across restarts when MultiTargeted succeeds and PGD does not.

F Additional Experimental Results

Additional experiments show that UAT transfers to L2 robustness and remains effective with fewer labels, while the appendix also supplies concentration tools for the theoretical analysis.

  • L2 robustness: At L2 radius ϵ = 0.87, UAT reaches 55.2% robust accuracy versus 32.7% for purely supervised training and 53.9% for the supervised oracle.
  • L2 robustness: At L2 radius ϵ = 0.87, unlabeled data provides a 21% absolute gain and captures over 90% of the oracle improvement.
  • Number of necessary labels: With 4K labels and 32K unlabeled examples, UAT achieves 54.1% robust accuracy versus 55.5% for a supervised oracle using 36K labels.
  • Number of necessary labels: Using 2K and 1K labels yields robust accuracies of 51.9% and 47.7%, respectively, increasing the gap from the supervised oracle.
  • The theoretical appendix introduces concentration inequalities and a χ-squared concentration lemma for bounding the main quantities of interest.

G.2 Main Proof

The proof bounds adversarial robustness by controlling both classifier smoothness and data-fitting terms, under Gaussian-model and classifier-accuracy assumptions. It then combines these bounds to obtain robust-error guarantees for the constructed classifier.

  • Proof strategy: The proof controls robustness through the sample-mean vector z, whose norm governs classifier smoothness and whose inner product with θ⋆ governs data fitting.These quantities are handled through separate lemmas before being combined.
  • Technical difficulty: The key technical difficulty is that the predicted-label-weighted sample mean is not Gaussian because the predicted labels depend on the inputs.This prevents directly applying the Gaussian-distribution argument used for the corresponding true-label quantity.
  • Probability control: The proof combines concentration bounds and a union bound to establish the desired probability of the robustness guarantee.The intermediate bounds include a Chernoff-bound step and conditioning on multiple events.
  • Assumptions and estimator: The analysis assumes i.i.d. Gaussian data, a base classifier with accuracy p > 3/4, and a unit estimator aligned with z.The estimator is defined as ˆw = z/∥z∥2.
  • Guarantee: Under additional restrictions such as σ ≤ 1/(32d^1/4) and p > 0.99, the constructed linear classifier has ℓ_p-robust classification error at most 0.01 over a specified ε range.The stated range includes 1/(4d^−1/4) ≤ ε ≤ 1/4, with the bound expressed in terms of 256ε^2√d.
Loading 1905.13725v4…