PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarially Robust Generalization Just Requires More Unlabeled Data

Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John Hopcroft, Liwei Wang

arXiv:1906.00555v2cs.LGstat.ML

TL;DR

Adversarial examples make robust generalization difficult because models can perform well on perturbed training data yet fail on unseen test attacks. The paper decomposes robust risk to use unlabeled data for stability, proves favorable Gaussian-mixture sample complexity, and validates an unlabeled-data training algorithm on MNIST and Cifar-10.

  • Problem

    Adversarially trained networks can fit perturbed training data but generalize poorly to perturbed test data, creating a need for more labeled data for robust generalization.

  • Method

    The paper decomposes expected robust risk into a label-free stability term and an accuracy term, then uses unlabeled data for stability and labeled data for accuracy.

  • Results

    The paper shows that sufficient unlabeled data can make robust generalization almost as easy as standard generalization in a Gaussian mixture problem and improves baseline performance on MNIST and Cifar-10.

  • Takeaways & Limitations

    Unlabeled data can improve adversarially robust generalization by supporting stability optimization without requiring additional labels.

Abstract

from arXiv · show

Neural network robustness has recently been highlighted by the existence of adversarial examples. Many previous works show that the learned networks do not perform well on perturbed test data, and significantly more labeled data is required to achieve adversarially robust generalization. In this paper, we theoretically and empirically show that with just more unlabeled data, we can learn a model with better adversarially robust generalization. The key insight of our results is based on a risk decomposition theorem, in which the expected robust risk is separated into two parts: the stability part which measures the prediction stability in the presence of perturbations, and the accuracy part which evaluates the standard classification accuracy. As the stability part does not depend on any label information, we can optimize this part using unlabeled data. We further prove that for a specific Gaussian mixture problem, adversarially robust generalization can be almost as easy as the standard generalization in supervised learning if a sufficiently large amount of unlabeled data is provided. Inspired by the theoretical findings, we further show that a practical adversarial training algorithm that leverages unlabeled data can improve adversarial robust generalization on MNIST and Cifar-10.

1 INTRODUCTION

Adversarial examples expose a gap between standard accuracy and robust generalization: models can fit perturbed training data yet fail on unseen attacks. The paper argues that additional unlabeled data can reduce this gap through risk decomposition, theory, and experiments.

  • Motivation: Adversarial examples can be nearly imperceptible while causing well-performing CNNs to misclassify inputs, including in transferable black-box attacks.The attacks can transfer across CNN architectures, so attackers need not know the target model's parameters or architecture.
  • Motivation: Adversarial training may achieve almost 100% training defense success yet below 60% on testing data, indicating poor robust generalization.The cited example uses Madry et al.'s state-of-the-art adversarial robust training method.
  • Core idea: The paper decomposes expected robust risk into a stability term and an accuracy term, enabling unlabeled data to optimize prediction consistency under perturbations.The stability term does not require ground-truth labels, while the accuracy term concerns correct predictions on natural samples.
  • Theory: With enough unlabeled data, robust generalization in the studied Gaussian mixture problem can require the same labeled sample complexity as standard generalization.This result extends prior work showing that robust generalization otherwise needs significantly more labeled data in that setting.
  • Experiments: An adversarial robust training algorithm using labeled and unlabeled data outperforms baseline algorithms on MNIST and Cifar-10.The experiments are presented as empirical evidence that unlabeled data can improve adversarially robust generalization.

2 RELATED WORKS

Related work spans attack methods, adversarial defenses, semi-supervised learning, and concurrent approaches that use unlabeled data for robust generalization. The paper positions its method among these defenses and comparisons.

  • Adversarial attacks and defense: Adversarial attack methods construct perturbations under l∞ or l2 constraints, while this work focuses on defending against white-box attacks.The attacker is assumed to know the model parameters and can apply methods such as FGSM, PGD, DeepFool, or C&W.
  • Adversarial attacks and defense: Adversarial training is described as the most successful white-box defense, modeling learning as a mini-max game between attacker and defender.Prior defenses can exploit gradient masking, motivating attacks such as BPDA that correct the gradients.
  • Semi-supervised learning: Semi-supervised learning commonly uses unlabeled examples through soft constraints that encourage desirable model behavior or similar outputs.Examples include transductive SVM confidence constraints and graph-based methods requiring similar outputs.
  • Semi-supervised learning for adversarially robust generalization: Concurrent robust semi-supervised methods assign soft labels, use self-training, or study robust self-training with unlabeled data across theoretical and image-dataset settings.Reported evaluations include CIFAR-10, SVHN, and Tiny Image data, with analyses of low-label regimes, certified robustness, and training components.

3 MAIN RESULTS

The paper decomposes robust risk into a stability component optimizable with unlabeled data and a standard accuracy component requiring labeled data. It shows theoretically that unlabeled data can reduce robust-generalization sample complexity, including to one labeled point in a Gaussian mixture setting.

  • General results: Unlabeled data can improve adversarially robust generalization in the general setting.The paper's first theoretical result establishes this directly through the robust-risk decomposition.
  • General results: The expected robust risk is bounded by a stability term based on PX and a standard PAC generalization term.The stability term can be optimized with unlabeled data, while the PAC term uses labeled data.
  • Gaussian mixture model: In the Gaussian mixture problem, robust generalization can be almost as easy as standard generalization when enough unlabeled data is available.This contrasts with prior results requiring substantially more labeled data for robust generalization.
  • Gaussian mixture model: 1%: the expected ℓ∞-robust classification risk is at most 1% with n = Ω(d) unlabeled points and ǫ ≤ 1.The guarantee applies to the learned classifier in the specified Gaussian mixture setting.
  • Gaussian mixture model: One labeled point suffices to learn a highly accurate and robust model when the unlabeled sample is sufficiently large.The result is stated for the Gaussian mixture model and follows the paper's unlabeled-direction estimation strategy.
  • Empirical implication: The paper presents a practical algorithm using labeled and unlabeled data, with better performance than baseline algorithms on MNIST and Cifar-10.This empirical result is intended to verify that unlabeled data can improve adversarially robust generalization.

4 ALGORITHM AND EXPERIMENTS

The algorithm trains classifiers to be accurate on labeled data and robust on both labeled and unlabeled data, combining supervised and label-free robustness losses. Experiments on MNIST and Cifar-10 show improved robust test accuracy, while stronger perturbation attacks improve robustness but excessive loss weighting harms convergence.

  • 4.1 PRACTICAL ALGORITHM: The method optimizes accuracy on labeled data and robustness on the union of labeled and unlabeled data.It uses separate loss terms for labeled and unlabeled samples, combined with coefficient λ.
  • 4.1 PRACTICAL ALGORITHM: The training objective combines supervised cross-entropy with a label-free objective measuring robustness on unlabeled data.The two losses are traded off by λ, with PGD used for inner-loop attacks and stochastic gradient descent for model optimization.
  • 4.1 PRACTICAL ALGORITHM: The algorithm generalizes VAT by applying adversarial training to labeled and unlabeled data, with k = 1 nearly recovering the original VAT algorithm.The paper reports that larger k is needed to improve adversarial robust generalization.
  • 4.3 EXPERIMENTAL RESULTS: Robust test accuracy improves with unlabeled data in both experiments; on Cifar-10, λ = 0.3 increases it by 3.0/5.0 percentage points in the 5k/10k settings versus PGD-adv baselines.The experiments use 5k or 10k labeled samples and the remaining training images as unlabeled data.
  • 4.3 EXPERIMENTAL RESULTS: In the 10k experiment, λ = 0.3 gives more than 3% higher robust test accuracy than λ = 0.1, but training becomes hard to converge when λ > 0.5.This identifies a trade-off between emphasizing unlabeled-data robustness and optimization stability.
  • 4.3 EXPERIMENTAL RESULTS: Using larger k produces more robust models, whereas k = 1 can retain higher natural accuracy but yields robust accuracy near zero.The result supports using stronger attacks on both labeled and unlabeled data for adversarially robust generalization.

5 CONCLUSION

The paper concludes that additional unlabeled data can improve adversarially robust generalization. It supports this conclusion with a risk decomposition theorem, a Gaussian-mixture result, and an unlabeled-data training algorithm evaluated empirically.

  • 5 CONCLUSION: More unlabeled data can produce models with better adversarially robust generalization.The conclusion combines theoretical and empirical evidence for this claim.
  • 5 CONCLUSION: For a Gaussian mixture model, adversarially robust generalization can be almost as easy as standard generalization.The conclusion states this holds for the specific learning problem studied.
  • 5 CONCLUSION: The proposed algorithm leverages unlabeled data during training and shows an empirical advantage.The paper evaluates the method on MNIST and Cifar-10.

A BACKGROUND ON GENERALIZATION AND RADEMACHER COMPLEXITY

This background introduces empirical Rademacher complexity as a capacity measure for a hypothesis space and states that it can bound generalization error.

  • A BACKGROUND ON GENERALIZATION AND RADEMACHER COMPLEXITY: Empirical Rademacher complexity is presented as a capacity measure for a hypothesis space.It is defined for a function class mapping from R^d to R over a finite sample set.
  • A BACKGROUND ON GENERALIZATION AND RADEMACHER COMPLEXITY: The empirical complexity uses independent random signs drawn from the Rademacher distribution unif({1, -1}).The signs are collected in the random vector ϵ.
  • A BACKGROUND ON GENERALIZATION AND RADEMACHER COMPLEXITY: A stated theorem uses Rademacher complexity to provide an upper bound on generalization error for 0-1 loss.The bound applies with probability at least 1 − δ over i.i.d. samples and uniformly over the hypothesis space.

B PROOF OF THEOREM 1

The proof bounds robust error by combining ordinary classification error with prediction instability under perturbations, then applies a generalization bound to the resulting terms.

  • B PROOF OF THEOREM 1: The proof begins with an indicator inequality that upper-bounds perturbed-sample error by clean-sample error plus prediction disagreement.This separates classification error from instability between x and x′.
  • B PROOF OF THEOREM 1: The resulting bound is derived from the indicator inequality and Definition 2.The proof then invokes Theorem 5 to control the relevant generalization term.
  • B PROOF OF THEOREM 1: The proof concludes after establishing the bound with probability at least 1 − δ for every function in the hypothesis space.The final step is stated after applying the Rademacher-based theorem.

C PROOF OF THEOREM 4

The proof reduces the Gaussian-mixture analysis to spiked covariance estimation: unlabeled samples recover θ∗ up to sign, while labeled data determine the sign and enable a robust-risk bound.

  • Gaussian-mixture reduction: The Gaussian mixture model is treated as a special case of the spiked covariance ensemble.The construction uses ξ_i uniformly distributed on {±1}, w_i Gaussian, and θ_0 = θ∗.
  • Unlabeled estimation: The top eigenvector of the unlabeled sample covariance approximately recovers θ∗ up to a sign difference.This follows from the covariance concentration result for the spiked covariance ensemble.
  • Sign recovery: Labeled data determine the remaining sign by choosing sign(yL · v⊤xL)v.The proof explicitly separates covariance-based direction recovery from label-based sign determination.
  • Robust-risk bound: A precise estimate of θ∗ is converted into a small robust classification risk for the resulting linear classifier.The robust-risk lemma bounds risk using the classifier’s inner product with θ∗, and Theorem 7 supplies the corresponding estimator.
  • Theorem 4: The proof of Theorem 4 applies the general bound under the stated high-dimensional condition on σ and sufficiently large d.The argument identifies the classifier in Theorem 7 with the one used in Theorem 4 and completes the bound through constant choices.
Loading 1906.00555v2…