PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Robustness through Local Linearization

Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, Pushmeet Kohli

arXiv:1907.02610v2stat.MLcs.LG

TL;DR

Adversarial training is effective but can become prohibitively expensive, and weaker training attacks may produce gradient-obfuscated models that fail under stronger attacks. The paper introduces a local linearity regularizer that encourages locally linear loss behavior. Across CIFAR-10 and ImageNet, the method avoids gradient obfuscation, trains faster, and achieves strong adversarial accuracy, including 47% on ImageNet at ϵ = 4/255.

  • Problem

    Adversarial training is costly for large models and high-dimensional inputs, while weaker adversaries can yield models that fail under strong attacks because of gradient obfuscation.

  • Method

    The local linearity regularizer penalizes deviations from linear loss behavior near training examples, together with a gradient-magnitude term.

  • Results

    LLR achieves state-of-the-art adversarial robustness on CIFAR-10 and ImageNet, including 47% adversarial accuracy on ImageNet at ϵ = 4/255 under an untargeted white-box attack.

  • Takeaways & Limitations

    LLR enables robust models to be trained 5× faster than regular adversarial training while reducing susceptibility to gradient obfuscation.

  • Takeaways & Limitations

    At ϵ = 16/255, LLR has a significant drop in nominal accuracy, and all methods obtain below 8% untargeted adversarial accuracy.

Abstract

from arXiv · show

Adversarial training is an effective methodology for training deep neural networks that are robust against adversarial, norm-bounded perturbations. However, the computational cost of adversarial training grows prohibitively as the size of the model and number of input dimensions increase. Further, training against less expensive and therefore weaker adversaries produces models that are robust against weak attacks but break down under attacks that are stronger. This is often attributed to the phenomenon of gradient obfuscation; such models have a highly non-linear loss surface in the vicinity of training examples, making it hard for gradient-based attacks to succeed even though adversarial examples still exist. In this work, we introduce a novel regularizer that encourages the loss to behave linearly in the vicinity of the training data, thereby penalizing gradient obfuscation while encouraging robustness. We show via extensive experiments on CIFAR-10 and ImageNet, that models trained with our regularizer avoid gradient obfuscation and can be trained significantly faster than adversarial training. Using this regularizer, we exceed current state of the art and achieve 47% adversarial accuracy for ImageNet with l-infinity adversarial perturbations of radius 4/255 under an untargeted, strong, white-box attack. Additionally, we match state of the art results for CIFAR-10 at 8/255.

1 Introduction

Adversarial training is effective but increasingly expensive, while weaker training attacks can yield gradient-obfuscated models that fail under stronger attacks. The paper introduces LLR to encourage locally linear loss behavior and reports faster training and strong robustness.

  • Motivation: Adversarial training performs well for robustness but becomes prohibitively costly as model complexity and input dimensionality grow.The cost comes from repeatedly computing input perturbations with multiple gradient-based optimization steps.
  • Motivation: Weaker training adversaries reduce computation but can produce models that withstand weak attacks and break down under strong attacks.The paper links this failure to gradient obfuscation caused by highly convoluted, non-linear local loss surfaces.
  • Contribution: LLR encourages the loss to behave linearly near training data, preventing gradient obfuscation by making local gradient information more predictive.The paper names this approach the local linearity regularizer.
  • Results: 5× speed up was achieved for training a robust ImageNet model on 128 TPUv3 cores compared with adversarial training.The contribution statement attributes the speedup to LLR-based training.
  • Results: 47% adversarial accuracy was achieved on ImageNet at ϵ = 4/255 under an untargeted white-box attack, while CIFAR-10 matched state-of-the-art results at ϵ = 8/255.The reported CIFAR-10 result is 52.81% adversarial accuracy.

2 Background and Related Work

The paper frames adversarial robustness as protection against norm-bounded input perturbations and reviews adversarial training, PGD-based optimization, and alternative regularization approaches. Its central background challenge is balancing attack strength, computational cost, and reliable evaluation.

  • Model and robustness: The classifier maps input features x to logits for classes in C, with class probabilities obtained by applying the exponential normalization to those logits.The classification function is denoted f(x; θ).
  • Model and robustness: Adversarial robustness requires correct classification for every perturbation δ within the norm-bounded set B_p(ϵ).The paper focuses on p = ∞ and abbreviates B_∞(ϵ) as B(ϵ).
  • Adversarial optimization: Globally optimal adversarial-example computation is NP-hard, although gradient descent with random restarts can produce sufficiently strong perturbations empirically.This motivates practical gradient-based attack procedures.
  • Training objectives: Standard ERM minimizes expected nominal loss, but test accuracy can go to zero under adversarial evaluation because attacks induce a distribution shift.Adversarial training addresses this by perturbing data during training.
  • Adversarial optimization: PGD updates input perturbations by a projected gradient step, and the inner maximization dominates adversarial-training cost.Reducing the number of steps lowers cost but generally weakens the attack.
  • Related work: TRADES regularizes a robustness–accuracy trade-off, while related work uses gradient information or adaptive perturbation radii to improve robustness.The paper positions LLR among these alternative robustness approaches.

3 Motivating the Local Linearity Regularizer

The paper motivates LLR by measuring how closely the local loss surface follows its first-order Taylor approximation. Empirically, stronger PGD training makes this local surface increasingly linear on CIFAR-10.

  • Local linearity measure: The local linearity measure quantifies the discrepancy between the actual perturbed loss and its first-order Taylor approximation around x.The approximation is ℓ(x) + δT ∇xℓ(x) within neighbourhood B(ϵ).
  • Local linearity measure: When the loss is smooth and approximately linear, ℓ(x + δ) is well approximated by ℓ(x) + δT ∇xℓ(x).The absolute difference between these quantities indicates local nonlinearity.
  • Empirical observation: For CIFAR-10 at ϵ = 8/255, γ(ϵ, x) is on the order of 10^1 with one or two PGD training steps and on the order of 10^-1 with four or more steps.Figure 2 plots γ against training iterations.
  • Empirical observation: CIFAR-10 models trained with one or two PGD steps exhibit extremely non-linear local loss surfaces, whereas four or more steps produce surfaces relatively well approximated by the linear expansion.The analysis uses a Wide-ResNet-28-10 and measures γ throughout training.

4 Local Linearity Regularizer (LLR)

LLR regularizes adversarial training by penalizing local violations of the loss’s linear approximation and the associated gradient term. The paper theoretically connects this measure to adversarial loss and uses it to reduce the inner-optimization burden.

  • Motivation and theory: The paper observes that γ(ϵ, x) decreases as the number of PGD steps used for inner maximization increases.This empirical relationship motivates deriving a regularizer from local linearity.
  • Motivation and theory: A proposition upper-bounds adversarial loss using the local linearity measure plus the gradient-predicted loss change |δT ∇xℓ(x)|.The bound applies to once-differentiable losses within B(ϵ).
  • Motivation and theory: As both the gradient-predicted change and γ(ϵ, x) approach zero, the adversarial loss approaches the nominal loss ℓ(x).The paper also states an upper bound under an additional loss condition.
  • LLR objective: LLR adds penalties for the local linearity violation and gradient magnitude, using δ_LLR selected by maximizing the discrepancy within B(ϵ).The coefficients λ and µ are hyper-parameters.
  • LLR objective: LLR still requires inner optimization, but the paper reports that far fewer optimization steps are needed for the overall training scheme to work effectively.The training procedure is described as analogous to adversarial training but cheaper in required steps.
  • Motivation and theory: Under stated approximations and standard losses, minimizing γ(ϵ, x) with nominal loss is sufficient to minimize adversarial loss, while including the gradient term works better empirically.This connects the theoretical bound to the proposed objective.

5 Experiments and Results

Experiments on CIFAR-10 and ImageNet evaluate LLR against adversarial training and other baselines under increasingly strong attacks. LLR achieves strong robustness, degrades more gracefully, resists gradient obfuscation, and trains faster than adversarial training.

  • LLR achieves state-of-the-art adversarial accuracy on CIFAR-10 at ϵ = 8/255 and ImageNet at ϵ = 4/255 under strong attacks.
  • 52.81% adversarial accuracy: LLR obtains the best reported CIFAR-10 result under the strongest Multi-Targeted attack.Multi-Targeted evaluation produces lower adversarial accuracy than Untargeted evaluation for adversarial training.
  • 47% adversarial accuracy: LLR exceeds adversarial training’s 39.70% on ImageNet at ϵ = 4/255 under an untargeted attack.LLR uses two PGD steps during training, compared with 30 for adversarial training.
  • 5× speed up: LLR training takes 7 hours versus 36 hours for adversarial training on 128 TPUv3 cores.Both ImageNet networks were trained for 110 epochs.
  • With one or two PGD training steps, adversarial training produces jagged loss surfaces and 0% accuracy under the strongest attack, whereas LLR-2 reaches 44.50%.LLR produces a smoother loss surface and local-linearity values comparable to adversarial training with 20 PGD steps.

6 Conclusions

Promoting local linearity makes deep classification networks less susceptible to gradient obfuscation, while enabling fewer inner optimization steps. LLR achieves state-of-the-art adversarial robustness on CIFAR-10 and ImageNet and trains five times faster than regular adversarial training.

  • LLR promotes local linearity, making deep classification networks less susceptible to gradient obfuscation.
  • LLR allows fewer gradient descent steps for the inner optimization.
  • LLR achieves state-of-the-art adversarial robustness on CIFAR-10 and ImageNet.
  • LLR can be trained 5× faster than regular adversarial training.

A Empirical Observations on Adversarial Training: Supplementary

Figure 5 compares two-dimensional loss-surface projections for CIFAR-10 image 126 after adversarial training with one versus eight PGD steps. The one-step surface is highly non-linear, whereas the eight-step surface is smoother.

  • Figure 5 plots ℓ(x) around CIFAR-10 test image 126 using a two-dimensional projection.The axes comprise one adversarial-perturbation direction and one random direction.
  • One-step PGD adversarial training produces a highly non-linear local loss surface.
  • Eight-step PGD adversarial training produces a smoother local loss surface.
  • Table 4 reports nominal and adversarial accuracy for networks trained as shown in Figure 2.The Multi-Targeted attack is described in Section 5.1.

B Local Linearity Upper Bounds Robustness: Proof of Proposition 4.1

The proof starts from a local quadratic approximation of the loss and bounds curvature using the local linearity measure γ(ϵ, x). For squared-error and softmax cross-entropy losses, this controls the input-gradient term under stated approximation conditions.

  • The proof begins with a local quadratic approximation of ℓ(x + δ), using the GGN matrix and an approximation error term.
  • The curvature term is bounded by the local linearity measure γ(ϵ, x) plus the approximation error.
  • For squared-error and softmax cross-entropy losses, the input-gradient magnitude can be bounded using this curvature relation.
  • The argument does not establish the same bound for general loss functions.
  • For softmax cross-entropy, the bound depends on the target-label probability and shrinks as γ(ϵ, x) decreases when the approximation error is negligible.

D Proofs

The proofs relate gradients and curvature to the Jacobian for squared error and to a factorized softmax Hessian for cross-entropy. Algorithm 1 then optimizes the local-linearity objective over mini-batch perturbations during training.

  • Proofs: For squared error, the input gradient is −J⊤r and the GGN matrix is J⊤J.
  • Proofs: The squared-error curvature term bounds ∥Jδ∥2 through γ(ϵ, x) and the local quadratic approximation error.
  • Proofs: For softmax cross-entropy, the Hessian is expressed as J⊤Hν(z)J, with Hν(z) = diag(p) − pp⊤.
  • Proofs: Factoring Hν as CC⊤ converts the curvature term into a squared norm involving the output change Δz = Jδ.
  • Local Linearization of Network: Algorithm 1 initializes perturbations, performs M projected inner updates on g, and adds the resulting regularization objective to the mini-batch loss.

F.1 Evaluation Setup

The evaluation uses Adam-based projected attacks and specified training schedules for CIFAR-10 and ImageNet, with LLR adding a local linearity loss around nominal inputs.

  • Attack optimization: Adam updates adversarial perturbations instead of using gradient signs, with 200 steps for multi-targeted attacks.Untargeted and random-targeted attacks use a step-size schedule.
  • Hyperparameter selection: The hyperparameters λ and µ are selected through a hyperparameter sweep.
  • CIFAR-10: CIFAR-10 experiments use Wide-ResNet architectures trained for 110 epochs with momentum 0.9 and LLR settings λ = 4 and µ = 3.The learning rate starts at 0.1 and decays after epochs 100 and 105.
  • ImageNet (4/255): ImageNet training at 4/255 uses 2-step PGD with Adam, batch size 512, and a perturbation-radius ramp from 0 to 4/255 over 20 epochs.The LLR settings are λ = 3 and µ = 6, with nominal-loss weight 3.
  • ImageNet (16/255): ImageNet training at 16/255 uses 10-step PGD with Adam, batch size 512, and a perturbation-radius ramp from 0 to 16/255 over 90 epochs.The LLR settings are λ = 3 and µ = 9, with nominal-loss weight 3.
  • Batch normalization and LLR: During training, batch normalization uses local batch statistics evaluated at the nominal input x.The loss is written as ℓ(x + δ; y, µ, σ) − ℓ(x; y, µ, σ) − δT∇xℓ(x; y, µ, σ).

F.3 Ablation Studies

The ablations show that LLR improves adversarial accuracy and aligns with stronger adversarial training, while also exposing limitations of large ImageNet perturbation radii.

  • Ablation results: 47.00% versus 41.30% adversarial accuracy is obtained for ImageNet when the additional term is included, while CIFAR-10 changes from 49.38% to 51.13%.
  • Ablation results: 44.50% adversarial accuracy is achieved by LLR-2 under the strongest evaluation, compared with 0% for adversarially trained ADV-1 and ADV-2.
  • Resistance to gradient obfuscation: The ADV-2 perturbation resembles random noise, which is identified as a common sign of gradient obfuscation, unlike the LLR-2 perturbation.
  • Resistance to gradient obfuscation: 44.50% adversarial accuracy is reported for LLR-2 versus 0% for ADV-2, and LLR-1 also retains non-zero adversarial accuracy.
  • Linearity diagnostic: LLR-2 produces γ(ϵ, x) values similar to 20-step adversarial training, whereas 2-step adversarial training produces much higher values.γ(ϵ, x) is estimated by maximizing g(δ, x) with 50 PGD steps.
  • Adversarially perturbed images: At radius 16/255, attacks can erase objects and add faint images to backgrounds, significantly affecting visual perception.The example uses an ImageNet validation image labeled bobsled; its adversarial prediction is washbasin.
Loading 1907.02610v2…