Source-linked AI summary
Metric Learning for Adversarial Robustness
Chengzhi Mao, Ziyuan Zhong, Junfeng Yang, Carl Vondrick, Baishakhi Ray
TL;DR
Deep networks remain vulnerable because adversarial attacks shift internal representations toward false classes, undermining reliable classification. The paper uses metric-learning regularization with carefully sampled triplets to reshape these representations. Experiments report up to 4% higher adversarial accuracy and up to 6% higher detection efficiency by AUC over prior work.
Problem
Adversarial attacks degrade deep-network performance, motivating more reliable robustness for safety- and reliability-critical applications.
Method
Triplet Loss Adversarial training adds metric-learning regularization on adversarial latent representations, using carefully selected triplet examples.
Results
Up to 4% higher adversarial classification accuracy and up to 6% higher detection efficiency by AUC are reported over prior robust training methods.
Takeaways & Limitations
TLA reshapes representations to bring same-class natural and adversarial examples together while enlarging margins between different classes, improving robustness and detection.
Takeaways & Limitations
The study focuses on untargeted attacks bounded by an Lp norm.
Abstract
from arXiv · showhide
Deep networks are well-known to be fragile to adversarial attacks. We conduct an empirical analysis of deep representations under the state-of-the-art attack method called PGD, and find that the attack causes the internal representation to shift closer to the "false" class. Motivated by this observation, we propose to regularize the representation space under attack with metric learning to produce more robust classifiers. By carefully sampling examples for metric learning, our learned representation not only increases robustness, but also detects previously unseen adversarial samples. Quantitative experiments show improvement of robustness accuracy by up to 4% and detection efficiency by up to 6% according to Area Under Curve score over prior work. The code of our work is available at https://github.com/columbia/Metric_Learning_Adversarial_Robustness.
1 Introduction
Adversarial attacks degrade deep-network performance by shifting latent representations toward false classes. The paper responds with Triplet Loss Adversarial training, using metric learning and targeted sampling to improve robustness and detection.
- Adversarial attacks use human-imperceptible, carefully crafted perturbations that degrade deep-network performance, raising concerns for safety- and reliability-critical applications.
- The attack shifts adversarial latent representations away from their true class and closer to the false class, often making them indistinguishable from natural false-class images.
- Triplet Loss Adversarial training adds a triplet-loss constraint on adversarial latent representations to produce more robust classifiers.
- Random false-class negatives can be too easy because of class variance, so the method selects the closest mini-batch example as the negative and another correct-class sample as the positive.
- Up to 4% higher adversarial classification accuracy and up to 6% higher detection efficiency by AUC are reported over prior robust training methods.
2 Related Work
Prior work developed increasingly effective adversarial attacks and defenses, with adversarial training established as a state-of-the-art foundation. Related methods also improve robustness through logit pairing, feature denoising, divergence losses, unlabeled data, or ensembles.
- Research progressed from FGSM to stronger attacks including C&W, PGD, BIM, MIM, DeepFool, and JSMA, motivating continued defense research.
- Adversarial training dynamically trains models on generated PGD attacks and became a foundation for state-of-the-art robust training.
- Adversarial Logit Pairing adds a loss term matching logits from clean images and corresponding adversarial images.
- Feature denoising, TRADES, unlabeled data, and model ensembles represent other approaches for improving adversarial robustness.
- Unlike feature denoising, which adds a denoising block, the proposed method requires no change to the model architecture.
3 Qualitative Analysis of Latent Representations under Adversarial Attack
The qualitative analysis shows adversarial examples shifting from their true-class representations toward false-class regions. TLA instead clusters same-class adversarial examples and separates mispredicted examples toward the false-class boundary.
- Figure 1: In the undefended model, adversarial examples from one true class separate into different false classes, while TLA clusters them together.
- Figure 1: Adversarial training and adversarial logit pairing reduce this separation but still leave same-class adversarial representations discriminable.
- Figure 2: For truck images mispredicted as birds, the undefended model moves adversarial representations into the center of the false class.
- Figure 2: Adversarial training and adversarial logit pairing separate some adversarial images from natural false-class images, but most remain inside the false class.
- Figure 2: TLA promotes mispredicted adversarial representations toward the false-class edge, where they remain separable and can be rejected as attacks.
- Design principle: The approach brings adversarial representations closer to natural true-class representations and farther from natural representations of the corresponding false class.
4 Approach
The approach regularizes adversarial representations with triplet metric learning, pulling same-class natural and adversarial examples together while separating different classes. It uses adversarial anchors, angular distance, and semi-hard negative sampling within mini-batches.
- Metric-learning objective: Triplet loss pulls natural and adversarial examples from one class together while pushing false-class examples apart by a margin.The proposed constraint is applied to latent representations so an image and its adversarial counterpart occupy the same manifold.
- Distance function: The embedding distance is defined as angular distance, with α controlling the margin between examples in representation space.The network maps inputs through h(x) to the embedded layer, where distances are evaluated.
- Training objective: TLA applies triplet loss to the penultimate-layer embedding while jointly optimizing it with cross-entropy loss.This combines a stable metric-space representation with semantic information from classification loss.
- Triplet construction: Each triplet uses an adversarial anchor, a clean same-class positive, and a clean different-class negative.The adversarial anchor is chosen because it tends to lie closer to the true-versus-false-class decision boundary.
- Negative sampling: Negative examples are selected as the closest false-class samples in a mini-batch, providing semi-hard negatives instead of searching the full training set.This avoids the computational cost of full-dataset search and the convergence slowdown associated with very hard negatives.
5 Experiments
Experiments evaluate TLA across datasets, attack types, and architectures, showing improved adversarial accuracy, separation of adversarial representations from false classes, and adversarial-example detection.
- Robust accuracy: TLA improves adversarial accuracy by up to 1.86%, 4.12%, and 0.84% on MNIST, CIFAR-10, and Tiny-ImageNet, respectively.Table 1 evaluates eight L∞-bounded untargeted attacks.
- Negative sampling: Training time grows linearly with negative-sample mini-batch size, while adversarial robustness peaks at sizes 500 to 1000.These results support using semi-hard negative examples in TLA.
- Unseen attacks: 13.1% is the largest reported adversarial-accuracy improvement on unseen L0- and L2-bounded attacks for CIFAR-10.Models were trained only on L∞-bounded attacks.
- Model architectures: 4.27% and 0.55% are the maximum adversarial-accuracy improvements reported for TLA on MNIST and CIFAR-10 across additional architectures.The architecture experiments use MLP and ConvNet models.
- Representation separation: Stronger PGD perturbations shift representations further toward false classes, while TLA generally produces higher separation ratios than baseline methods.On Tiny-ImageNet, adversarial examples can be closer to the false-class manifold than natural images are to one another.
- Adversarial detection: TLA improves detection AUC by up to 3.69%, 6.45%, and 1.37% on MNIST, CIFAR-10, and Tiny ImageNet, respectively.Detection uses 10k clean and 10k adversarial images.
6 Conclusion
The conclusion presents TLA regularization as a metric-learning approach for adversarial robustness that improves both model robustness and adversarial-sample detection efficiency.
- TLA regularization leverages metric learning to improve robustness and detection efficiency in deep networks.
Supplementary material for “Metric Learning for Adversarial Robustness”
The supplementary material extends the paper’s t-SNE visualizations across CIFAR-10 classes and models, examining adversarial representations and their separation from false-class natural images.
- Supplementary Figures 6–8 visualize clean and adversarial representations for additional CIFAR-10 classes using t-SNE.The visualizations cover adversarial images from the same true class that are mistakenly assigned to false classes.
- Figures 9–11 compare representations of two classes and adversarial images from one class misclassified as the other.The figures show representations across UM, AT, ALP, and TLA models, including frog–horse and horse–airplane comparisons.
C.1 Implementation Details
The supplementary implementation details describe dataset-specific architectures, optimization settings, and additional CIFAR-10, MNIST, and Tiny-ImageNet visualizations.
- MNIST: MNIST experiments use a modified LeNet with batch normalization, 3 × 3 convolutions, Adam, batch size 50, and label smoothing of 0.1.The learning rate is 0.0001, and ALP uses λ = 0.5.
- CIFAR-10: CIFAR-10 experiments use the WRN architecture and SGD with learning-rate decay from 0.1 to 0.01 at 50k iterations.Training runs for 55k iterations with batch size 50.
- Supplementary visualizations: Additional visualizations cover CIFAR-10 class pairs including horse and airplane.Figures 9–11 provide t-SNE visualizations of class representations and adversarial separation margins.
- Tiny-ImageNet: Tiny-ImageNet experiments use ResNet-50 with a stride-2 first convolution and dataset-specific Adam training schedules.TLA fine-tuning uses batch size 20 because of the GPU memory budget.
C.2 Effect of TLA on Bring Adversarial vs. Natural Image of the Same Class Together
This section evaluates whether TLA brings adversarial representations closer to natural representations from the same class, using a complementary distance ratio and supporting architectural descriptions.
- The complementary ratio r′ measures how adversarial representations are pulled toward their true class across models and datasets.Lower r′ is desirable because it indicates that examples from the same class are pulled together.
- TLA brings adversarial examples closer to clean examples of their true class on CIFAR-10 and Tiny-ImageNet, with comparable performance on MNIST.The result supports placing adversarial and clean images from the same class on the same manifold.
- Table 9 reports the average ratio of adversarial-to-natural same-class distance relative to mean inner-class distance.The table highlights TLA’s reduction in the relative distance of adversarial images to natural images from their true classes.
D TLA Algorithm
TLA is presented as a one-loop training procedure that combines adversarial-example generation, strategically sampled triplets, and joint loss optimization.
- D TLA Algorithm: TLA is introduced as a simple metric-learning method implemented within one training loop.The algorithm is named Metric Learning for Adversarial Robustness, or Triplet Loss Adversarial training.
- D TLA Algorithm: Each iteration samples a minibatch of data and same-class positive examples from the training set.The minibatch contains paired data selections for constructing triplet-learning inputs.
- D TLA Algorithm: The procedure generates adversarial images from the sampled data before constructing the metric-learning batches.Adversarial examples are generated from X, and an additional subset is used to calculate the negative minibatch.
- D TLA Algorithm: The final step calculates the total loss on the sampled batches.The algorithm uses Lall as defined in the paper’s loss formulation.
E The effect of the hyper-parameter
The experiments examine TLA’s sensitivity to hyper-parameters, representation-layer choice, nearest-neighbor retrieval, and loss landscapes. They report broad hyper-parameter tolerance, best performance for the second-to-last layer, correct adversarial retrieval, and a slightly smoother loss landscape than baselines.
- Hyper-parameter sensitivity: TLA is generally insensitive to specific hyper-parameter settings and improves over baseline models across a wide range.On MNIST, higher accuracy is usually achieved with margin 0.01 to 0.1 and λ between 0.5 and 2.
- Hyper-parameter sensitivity: λ1 values from 0.5 to 2 are reported as reasonable for adversarial accuracy under 100-step PGD on MNIST.The result is summarized in Table 10.
- Hyper-parameter sensitivity: The best MNIST adversarial accuracy under 100-step PGD is achieved with margin 0.05 in the reported α experiment.This result is summarized in Table 11 with λ1 = 2.
- Representation and robustness: Using the second-to-last representation layer achieves the best reported adversarial robustness accuracy on MNIST.Table 12 compares models trained with ATL on different representation layers, all using λ1 = 2.
- Nearest-neighbor retrieval: Under adversarial querying about a deer, TLA retrieves the correct nearest-neighbor images while AT and ALP do not.Figure 12 contrasts clean-image queries with adversarially perturbed queries.
- Loss landscape: TLA has a slightly smoother Tiny ImageNet loss landscape than the AT and ALP baselines.The visualization uses heatmaps from three randomly sampled examples and two shared random directions per column.