PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Robustness Against the Union of Multiple Perturbation Models

Pratyush Maini, Eric Wong, J. Zico Kolter

arXiv:1909.04068v2cs.LGcs.AIstat.ML

TL;DR

Multi-perturbation defenses can be difficult to tune and may leave the worst-case loss over the union poorly optimized. The paper introduces Multi Steepest Descent, which combines perturbation models within one adversary, and reports improved robustness on MNIST and CIFAR10, including 47.0% CIFAR10 robust accuracy versus 40.6% for previous approaches.

  • Problem

    Existing multi-perturbation defenses can be difficult to tune and converge to imbalanced, suboptimal worst-case trade-offs across perturbation models.

  • Method

    Multi Steepest Descent incorporates different perturbation models into each projected steepest-descent step by maximizing worst-case loss over them.

  • Results

    47.0% robust accuracy on CIFAR10 improved upon the best-performing simpler method, AVG, by 6.4%.

  • Takeaways & Limitations

    MSD consistently outperformed past approaches across MNIST and CIFAR10 while using standard architectures and directly targeting the robust optimization objective.

  • Takeaways & Limitations

    On MNIST, MAX and AVG required altered perturbation settings or additional attack restarts to train reasonably well, and such methods could remain vulnerable to gradient-free attacks.

Abstract

from arXiv · show

Owing to the susceptibility of deep learning systems to adversarial attacks, there has been a great deal of work in developing (both empirically and certifiably) robust classifiers. While most work has defended against a single type of attack, recent work has looked at defending against multiple perturbation models using simple aggregations of multiple attacks. However, these methods can be difficult to tune, and can easily result in imbalanced degrees of robustness to individual perturbation models, resulting in a sub-optimal worst-case loss over the union. In this work, we develop a natural generalization of the standard PGD-based procedure to incorporate multiple perturbation models into a single attack, by taking the worst-case over all steepest descent directions. This approach has the advantage of directly converging upon a trade-off between different perturbation models which minimizes the worst-case performance over the union. With this approach, we are able to train standard architectures which are simultaneously robust against $\ell_\infty$, $\ell_2$, and $\ell_1$ attacks, outperforming past approaches on the MNIST and CIFAR10 datasets and achieving adversarial accuracy of 47.0% against the union of ($\ell_\infty$, $\ell_2$, $\ell_1$) perturbations with radius = (0.03, 0.5, 12) on the latter, improving upon previous approaches which achieve 40.6% accuracy.

1. Introduction

Adversarial training has mainly targeted single perturbation models, while multi-model defenses can produce imbalanced and unpredictable worst-case robustness. The paper proposes a unified PGD-based adversary to improve trade-offs across perturbation models.

  • Motivation: Adversarial examples are imperceptible perturbations that can cause classifiers to misclassify inputs.Attacks commonly use gradient information and projected gradient descent to maximize loss within a perturbation region.
  • Prior approaches: Existing multi-model defenses include variational-autoencoder architectures and aggregations of different adversaries.These approaches target simultaneous robustness to multiple perturbation models.
  • Problem: Previous methods often converge to suboptimal trade-offs, becoming robust to some perturbation models while failing against others.Their worst-case robust performance can vary substantially across datasets.
  • Contribution: Multi Steepest Descent integrates multiple gradient-based perturbation models into one adversary that directly targets worst-case loss over their union.The method is presented as a modified PGD-based algorithm for adversarial training.
  • Contribution: The authors report improved worst-case robust performance over prior approaches on MNIST and CIFAR10.The cited contribution passage states that MSD finds better trade-offs across the perturbation models.

2. Related work

Prior work developed stronger attacks, adversarial training, verification methods, and defenses against multiple attack types. Most verification and defense methods nevertheless focused on one perturbation model at a time, while multi-attack architectures showed uneven robustness.

  • Attacks: FGSM introduced a one-step gradient-sign attack, while PGD became a more successful and widely used iterative attack.Momentum and other adaptations further improved attack success and transferability.
  • Defenses: Adversarial training with a PGD adversary has remained empirically robust, alongside verification methods based on SMT, SDP, and mixed-integer programming.Some verification approaches have also been incorporated into training.
  • Scope: Most prior verification work focused on defending against or certifying robustness to a single adversarial perturbation type.The passage notes that multi-perturbation extensions were possible but not the primary focus.
  • Multiple attacks: Analysis by synthesis used multiple variational autoencoders for MNIST but produced variants that were robust to some norms and not others.One variation was robust to ℓ0 and ℓ2 but not ℓ∞, while another was robust to ℓ∞ and ℓ0 but not ℓ2.
  • Geometric view: Figure 1 compares ℓ∞, ℓ2, and ℓ1 steepest-descent directions from the same gradient using blue, red, and green vectors.The black arrow denotes the gradient, and the colored directions correspond to α-radius step sizes.

3. Overview of adversarial training

The paper frames adversarial training as an outer minimization over model parameters and an inner maximization over perturbations. Projected steepest descent increases loss using norm-specific directions while keeping perturbations inside the allowed ball.

  • Optimization setup: The perturbation set Δp,ε is the ℓp ball of radius ε centered at the origin.The loss notation is abbreviated as ℓ(x + δ; θ).
  • Inner optimization: The inner attack maximizes loss over allowed perturbations, seeking an adversarial example x + δ⋆.Projected gradient methods iteratively increase loss and project each iterate back onto the feasible ℓp ball.
  • Steepest descent: Steepest descent chooses a norm-dependent direction and repeatedly applies steps intended to increase the loss.Projected steepest descent is used because gradients at the unperturbed example can be too small for efficient progress.
  • Norms and projections: The steepest-descent direction can differ from the gradient depending on the norm, with the ℓ∞ case reducing to the gradient-sign method.Projection keeps iterates within the specified perturbation region; ℓ∞ projection corresponds to clipping coordinates to [−ε, ε].
  • Outer optimization: Adversarial training minimizes model loss using adversarial examples obtained by approximately solving the inner maximization with PGD.Danskin’s theorem motivates backpropagating through the loss evaluated at the maximizing perturbation, although the inner problem is not solved exactly.

4. Adversarial training for multiple perturbation models

The paper generalizes adversarial training to unions of perturbation models, comparing simple aggregation strategies with a single multi-steepest-descent adversary. MSD incorporates all perturbation models at each projected descent step to target worst-case loss over their union.

  • Problem formulation: The union of perturbation models is defined as the combined region of ℓp balls for p ∈ S, with potentially different radii for each model.The notation uses a common ϵ symbol for simplicity even when the radii differ.
  • Limitations of simple combinations: Both simple approaches can converge to unexpected, dataset-dependent trade-offs that fail to minimize worst-case performance across perturbation models.Their inner maximization treats attacks separately, limiting use of information from the full union.
  • Simple combinations: MAX independently runs an ℓp PGD attack for each model and trains on the perturbation producing the largest loss.With exact subproblem solutions, MAX recovers the optimal union perturbation; with one model, it reduces to standard adversarial training.
  • Simple combinations: AVG trains on all adversarial perturbations generated independently by the individual ℓp PGD attacks.AVG also reduces to standard adversarial training when |S| = 1.
  • Multi Steepest Descent: MSD creates one adversarial perturbation by choosing, at every projected steepest-descent step, the direction maximizing loss over all attack models.It is designed as a drop-in replacement for standard PGD adversaries and avoids the myopic, one-model-at-a-time updates of simpler methods.

5. Results

Across MNIST and CIFAR10, MSD more reliably minimizes worst-case loss over the union of ℓ∞, ℓ2, and ℓ1 perturbations than MAX and AVG, using standard architectures and broad attack evaluation.

  • Experimental setup: MSD, MAX, and AVG were evaluated on MNIST and CIFAR10 with gradient-based and gradient-free attacks, aggregating results by each example’s worst-case error.The evaluation included individual attacks and perturbation models, while focusing on the robust optimization objective over their union.
  • MNIST: On MNIST, MSD achieved 58.4% robust accuracy against the union of ℓ∞, ℓ2, and ℓ1 perturbations, over 15% above MAX.The evaluated radii were ϵ = (0.3, 2.0, 10).
  • MNIST: Most previous MNIST approaches defended against only two of three perturbation models, while B-ABS, ABS, and AVG remained weak against ℓ2, ℓ∞, and strong ℓ1 decision-based attacks, respectively.These weaknesses produced suboptimal worst-case trade-offs over the combined perturbation model.
  • MNIST: MAX exceeded 40% robust accuracy in only 10% of MNIST hyperparameter configurations, while training frequently produced masked gradients and failed to balance multiple attacks.The worst-case accuracy combined three gradient-based attacks with a gradient-free pointwise attack.
  • MNIST: MSD was easier to tune than MAX and AVG, exceeded 50% accuracy in around 40% of MNIST runs, and allowed relative step-size adjustments to counter bias toward one perturbation type.Equivalent adjustments did not help MAX and AVG.
  • CIFAR10: On CIFAR10, MSD achieved 47.0% robust accuracy against ℓ∞, ℓ2, and ℓ1 perturbations with radii (0.03, 0.5, 12), improving 6.4% over AVG.The individual accuracies were 48.0%, 64.3%, and 53.0%, respectively.

6. Conclusion

Previous multi-perturbation defenses can be variable and difficult to tune, whereas MSD incorporates perturbation models directly into steepest descent and consistently outperforms past approaches on MNIST and CIFAR10.

  • Previous approaches were highly variable across parameters and datasets, difficult to tune, and converged to suboptimal trade-offs against the union of perturbation models.
  • MSD incorporates different perturbation models directly into the steepest-descent direction to better optimize worst-case performance.
  • MSD consistently outperformed past approaches across MNIST and CIFAR10 while retaining the scalability and generality of adversarial training.
  • The authors recommend MSD for directly minimizing worst-case performance among multiple perturbation models.

Adversarial Robustness Against the Union of Multiple Perturbation Models (Supplementary Material)

The supplementary material defines steepest-descent and projection procedures for ℓ∞, ℓ2, and ℓ1 adversaries, then describes practical adjustments for efficient multi-norm attacks and reports attack-level breakdowns.

  • The paper specifies standard steepest-descent and projection steps for ℓ∞, ℓ2, and ℓ1 adversaries, choosing ℓ1 instead of the ℓ0 model used by Schott et al.
  • For ℓ2 attacks, the descent direction normalizes the loss gradient by its ℓ2 norm.
  • Projection onto the ℓ1 ball is solved with a sorting-based algorithm that operates on element-wise absolute perturbation values.
  • Because the ℓ1 steepest-descent step updates one coordinate, the method randomly samples a number of coordinates and updates them to improve efficiency and attack success.
  • The implementation restricts ℓ0 and ℓ1 coordinate choices near pixel-space boundaries to prevent PGD from repeatedly selecting directions that leave the valid range.
  • The experiments report adversarial error rates for individual attacks on both MNIST and CIFAR10.

B.1. MNIST results

The MNIST supplementary results document attack settings and comparison tables, while noting that some prior results use different threat models and provide only approximate or upper-bound comparisons.

  • Table 3 summarizes adversarial accuracy results for MNIST across the evaluated models and attacks.
  • MNIST attacks generally use the first 1000 test examples with 10 random restarts, except Boundary Attack and DDN attack.
  • Prior B-ABS and ABS results use different radii and an ℓ0 threat model, making their reported ℓ1 adversarial accuracy a near estimate and their robustness an upper bound.
  • The MNIST ℓ∞ adversary uses step size α = 0.01, radius ϵ = 0.3, and 50 iterations.
  • The MNIST ℓ2 adversary uses step size α = 0.1, radius ϵ = 2.0, and 100 iterations.
  • The MNIST ℓ1 adversary uses step size α = 0.8, radius ϵ = 10, 50 iterations, and two restarts by default.

C.2. Training hyperparameters

The training setup uses dataset-specific optimizers and schedules, extensive MNIST hyperparameter search, and distinct MAX, AVG, and MSD attack configurations, with some heuristic balancing and early stopping.

  • MNIST: MNIST training uses Adam without weight decay and a learning rate that rises to 10^-3 before decaying to zero over 15 epochs.
  • MNIST: MNIST MAX, AVG, and MSD models receive a broad search over combinations of ℓ1, ℓ2, and ℓ∞ step sizes.
  • MNIST: For MNIST, MSD uses radii ϵ = (0.3, 2.0, 10) for (ℓ∞, ℓ2, ℓ1), while MAX and AVG use their listed model-specific configurations.
  • MNIST: The MNIST MAX model required early stopping after the fourth epoch because further training biased it toward ℓ∞ robustness.
  • The training objective targets trade-offs between different perturbation models while retaining standard P1, P2, and P∞ models for comparison.
  • CIFAR10: CIFAR10 training uses SGD with momentum 0.9, weight decay 5 · 10^-4, and a 50-epoch piecewise-linear learning-rate schedule.
  • CIFAR10: For CIFAR10, MSD uses radii ϵ = (0.03, 0.5, 12) for (ℓ∞, ℓ2, ℓ1), whereas MAX and AVG reduce the ℓ2 radius to 0.3.

D. Comparison with Tram`er & Boneh (2019)

The comparison finds that MSD retains an advantage over simpler multi-adversary training methods, but evaluation strength and attack coverage materially affect reported robust accuracy.

  • MSD outperforms the simpler AVG- and MAX-like approaches in the reported comparisons.The comparison uses AdvAVG and AdvMAX results from Tram`er & Boneh (2019) as counterparts to AVG and MAX.
  • The CIFAR10 comparison uses a WideRes-Net with 5 residual blocks and widening factor 10, which has four times more parameters than the main-paper comparison model.The reported CIFAR10 models were trained and tested only against ℓ∞ and ℓ1 perturbations.
  • The comparison considers smaller CIFAR10 perturbation regions than those used in the main paper.The comparison radii are approximately (0.0157, 7.84), while the main-paper regions are strictly larger.
  • 65.2% accuracy against the attacks considered by Tram`er & Boneh contrasts with 58.4% under the paper’s stronger overall evaluation.The same MSD model was used without retraining for the MNIST comparison.
  • Random restarts and a broader attack suite can reduce measured accuracy and expose stronger adversaries absent from the comparison baseline.Up to 10 restarts reduced accuracy by 5–10% in the authors’ experiments, while attacks such as DDN were not considered by Tram`er & Boneh.
  • The authors therefore emphasize multiple restarts and broad attack coverage when assessing robust performance.

E. Analyzing learned Filters for MNIST

The MNIST filter analysis links sparse first-layer filters and decision-based attack behavior descriptively, while showing that MSD responds to relative attack step sizes more than MAX or AVG.

  • ℓ∞-robust MNIST models contain many nearly one-element filters, a pattern absent from the ℓ2- and ℓ1-robust models.The filters are interpreted as thresholding filters because an activation layer follows them.
  • Changing the relative ℓ∞ step size can reduce thresholding filters in MSD and improve accuracy against decision-based attacks.The compared settings use α∞ = 0.01 and α∞ = 0.03; MAX and AVG are nearly invariant to these individual attack step sizes.
  • MAX requires more ℓ1-training restarts and early stopping because continued training biases it toward ℓ∞ robustness and decision-based vulnerability.
  • The analysis does not establish a consistent relationship between the number of sparse filters and final performance or gradient masking.The authors describe the analysis as empirical and preliminary, without formal statements.

F. Attacks outside the perturbation model

Experiments beyond the defended perturbation model are exploratory: common-corruption robustness generally improves, and omitting ℓ2 training reduces but does not eliminate ℓ2 robustness.

  • The authors present these outside-model evaluations only as exploratory because no principled generalization beyond the defended perturbation model is assumed.
  • Common corruptions: Common-corruption performance improves over the standard CIFAR10 model for every evaluated model except P1.The CIFAR-10-C benchmark applies corruptions such as noise, blur, and compression.
  • Defending against ℓ1 and ℓ∞ and evaluating on ℓ2: Removing ℓ2 training reduces ℓ1 and ℓ∞ PGD robustness by 1% and ℓ2 PGD robustness by 2%.The experiment trains MSD on MNIST using only ℓ1 and ℓ∞ perturbation models.
  • Defending against ℓ1 and ℓ∞ and evaluating on ℓ2: Including ℓ2 training empirically improves overall robustness across all three perturbation models, although ℓ2 performance falls when ℓ2 is omitted.The model retains some ℓ2 robustness despite not being trained against that perturbation model.
  • Learned filters: MSD filters become less sparse when relative attack step sizes are adjusted, whereas MAX and AVG filters remain nearly unchanged.The filter comparisons are shown for MNIST models trained with different ℓ∞ step sizes.
Loading 1909.04068v2…