PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Distributional Training for Robust Deep Learning

Yinpeng Dong, Zhijie Deng, Tianyu Pang, Hang Su, Jun Zhu

arXiv:2002.05999v2cs.LGcs.CRstat.ML

TL;DR

Existing adversarial training often relies on one attack and may fail against unseen attacks or miss diverse perturbations. The paper introduces ADT, which learns entropically regularized worst-case adversarial distributions and trains models against their expected loss. Experiments across CIFAR-10, CIFAR-100, and SVHN validate ADT against state-of-the-art adversarial training methods, while the framework is analyzed under an ℓ∞ threat model.

  • Problem

    Specific attacks can overfit attack patterns and fail against unseen attacks, while single algorithms may not explore the perturbation space sufficiently.

  • Method

    ADT formulates robust training as minimax optimization over entropically regularized adversarial distributions around each natural input, with three parameterizations from Gaussian to implicit models.

  • Results

    ADT demonstrates effectiveness against state-of-the-art adversarial training methods on CIFAR-10, CIFAR-100, and SVHN, with learned samples showing average ℓ2 distance 1.95 versus 1.56 for PGD.

  • Takeaways & Limitations

    Learning diverse adversarial distributions can produce smoother, more flattened loss surfaces and improve overall robustness compared with attack-specific training.

  • Takeaways & Limitations

    The presented formulation considers the ℓ∞ threat model; extension to other threat models such as ℓ2 is left for future work.

Abstract

from arXiv · show

Adversarial training (AT) is among the most effective techniques to improve model robustness by augmenting training data with adversarial examples. However, most existing AT methods adopt a specific attack to craft adversarial examples, leading to the unreliable robustness against other unseen attacks. Besides, a single attack algorithm could be insufficient to explore the space of perturbations. In this paper, we introduce adversarial distributional training (ADT), a novel framework for learning robust models. ADT is formulated as a minimax optimization problem, where the inner maximization aims to learn an adversarial distribution to characterize the potential adversarial examples around a natural one under an entropic regularizer, and the outer minimization aims to train robust models by minimizing the expected loss over the worst-case adversarial distributions. Through a theoretical analysis, we develop a general algorithm for solving ADT, and present three approaches for parameterizing the adversarial distributions, ranging from the typical Gaussian distributions to the flexible implicit ones. Empirical results on several benchmarks validate the effectiveness of ADT compared with the state-of-the-art AT methods.

1 Introduction

Existing adversarial training can overfit specific attack patterns and fail against unseen attacks, while single attacks may not explore diverse perturbations. ADT addresses these issues by learning entropically regularized adversarial distributions and reports effectiveness across standard image benchmarks.

  • Motivation: Specific-attack adversarial training can generalize poorly to unseen attacks, including stronger or adaptive attacks that expose possible gradient masking.The paper distinguishes generalization across attacks under the same threat model from generalization across different threat models.
  • Motivation: Single attack algorithms may insufficiently explore high-dimensional perturbations, and existing multiple-adversary methods lack a formal characterization of diversity.PGD random restarts can still produce concentrated adversarial examples.
  • Approach: ADT models adversarial examples around each natural input with a distribution, using an entropic regularizer to retain heterogeneous adversarial examples.Its minimax objective learns worst-case distributions in the inner problem and trains the classifier against their expected loss in the outer problem.
  • Contributions: Theoretical analysis yields a sequential solution procedure, while three parameterizations range from Gaussian distributions to flexible implicit density models.The proposed framework is evaluated against state-of-the-art adversarial training methods on CIFAR-10, CIFAR-100, and SVHN.

2 Proposed method

ADT replaces a single worst-case perturbation with a worst-case adversarial distribution over perturbations within the threat set. Its entropic objective, sequential optimization, and parameterized distributions support diverse examples that improve loss-surface smoothness and robustness.

  • Adversarial distributional training: ADT targets broader attack coverage by learning distributions rather than locally most-adversarial points, with entropy encouraging exploration of possible perturbations.The paper connects this distributional coverage to expected-loss minimization and improved cross-attack generalization under the same threat model.
  • Adversarial distributional training: ADT models perturbations within S as distributions, with the inner problem maximizing expected loss and the outer problem minimizing expected loss over worst-case distributions.AT is recovered as the special case where the distribution family contains only Delta distributions.
  • Regularizing adversarial distributions: Without entropy regularization, the optimal adversarial distribution degenerates to a Dirac distribution, preventing diverse coverage and reducing ADT to AT.The objective therefore adds entropy with a balancing hyperparameter λ; entropy increases distribution support.
  • A general algorithm for ADT: The general ADT algorithm alternates between solving each minibatch’s inner distribution problem and updating model parameters with stochastic gradient descent.The paper provides this sequential procedure as an analogue of adversarial training.
  • Discussion on the superiority of ADT: Adversarial distributions sampled by ADT have average ℓ2 distance 1.95 versus 1.56 for PGD, while retaining similar attack power.Visualizations show ADT samples scattered across the projected perturbation space, whereas PGD samples concentrate together.
  • A general algorithm for ADT: Theoretical analysis establishes directional differentiability of the maximized objective under differentiability and bounded-equicontinuous-density assumptions.The result supports updating model parameters using gradients at global inner maximizers, analogous to AT.

3 Parameterizing adversarial distributions

ADT parameterizes input-dependent adversarial distributions, using explicit Gaussian models or amortized and implicit generators to approximate diverse perturbations. These formulations optimize expected loss with entropy-related terms while addressing the computational cost of per-example distribution learning.

  • ADT parameterizes adversarial distributions with trainable parameters and solves the inner problem by maximizing expected loss over those distributions.
  • ADTEXP: ADTEXP transforms diagonal Gaussian samples through tanh and scales them by ϵ, producing perturbations within the allowed set.The learned parameters are the Gaussian mean and standard deviation.
  • ADTEXP: The explicit method uses reparameterization for differentiable gradient estimation, while entropy contributes through a negative log-density term.
  • ADTEXP-AM: Per-example explicit distribution learning is computationally expensive, motivating ADTEXP-AM, which predicts distribution parameters through a conditional generator network.ADTEXP is approximately k times slower than PGD-based AT when k Monte Carlo samples estimate each gradient.
  • ADTIMP-AM: Implicit distributions avoid requiring a tractable density and are implemented with a generator mapping noise and natural inputs to perturbations, using a variational entropy lower bound.ADTIMP-AM samples noise from U(−1, 1).

4 Related work

Prior work studies adversarial robustness through attack-specific training, generator-based attacks, smoothing, and distributionally robust optimization. ADT differs by learning input-dependent adversarial distributions rather than modeling shifts in the overall data-generating distribution.

  • Existing adversarial-training improvements modify losses or architectures, accelerate training, or exploit additional data beyond PGD-based training.
  • Distribution-learning methods for black-box attacks search over adversarial distributions but use higher-variance natural-evolution-strategy gradient estimators than ADT's white-box approach.
  • Generator-based prior methods still target the standard AT minimax formulation, whereas ADT introduces distributional adversaries.
  • ADT is an empirical defense using input-dependent adversarial distributions, unlike randomized-smoothing approaches that target certified robustness.
  • Table 1 compares proposed methods and baselines on CIFAR-10 across white-box attacks and reports overall robustness in its final column.
  • Unlike DRO, which addresses changes in data-generating distributions, ADT finds an adversarial distribution separately for each input.

5 Experiments

Across CIFAR-10, CIFAR-100, and SVHN evaluations, ADT methods show robust performance across diverse attacks and generally outperform established adversarial-training baselines. Ablations indicate that distribution parameterization and entropy regularization affect robustness, while ADT also produces smoother loss landscapes and remains effective with TRADES-style objectives.

  • 5.3 Additional results and ablation studies: ADTEXP is better than ADTEXP-AM and ADTIMP-AM in most cases, while amortized variants can accelerate training.The paper attributes the gap to the generator’s limited capacity to learn appropriate adversarial regions for every input.
  • 5.3 Additional results and ablation studies: EXP is slightly stronger than PGD-20, while EXP-AM and IMP-AM have comparable attack power.The comparison evaluates the learned adversarial-distribution attacks on five models under the same perturbation budget.
  • 5.3 Additional results and ablation studies: A larger λ generally increases adversarial-distribution entropy and robustness, but excessive λ reduces robustness.The study varies λ across 0.0, 0.001, 0.01, 0.1, and 1.0 using ADTEXP-AM on CIFAR-10.
  • 5.3 Additional results and ablation studies: ADT models exhibit smoother, more flattened loss surfaces than Standard and ATPGD models, consistent with improved robustness.The study uses loss projections and the dominant Hessian eigenvalue as a quantitative smoothness proxy.
  • 5.4 Compare with the state-of-the-art: ADT methods also outperform TRADES and improve over a state-of-the-art ATPGD model under matched training settings.The TRADES comparison uses a WRN-34-10 model, while the matched ATPGD comparison reproduces the settings and hyperparameters from the reference method.

6 Conclusion

The paper concludes that ADT trains robust DNNs by modeling heterogeneous adversarial examples around each natural input as distributions. Its three parameterization approaches and experiments across three datasets support ADT’s effectiveness against state-of-the-art adversarial-training methods.

  • 6 Conclusion: ADT models heterogeneous adversarial examples around each natural input with an entropically regularized adversarial distribution.The framework is formulated as a distribution-based minimax problem for robust DNN training.
  • 6 Conclusion: ADT provides three adversarial-distribution parameterizations ranging from Gaussian distributions to flexible implicit distributions.The paper develops a general algorithm for solving the resulting minimax problem.
  • 6 Conclusion: Experiments on CIFAR-10, CIFAR-100, and SVHN demonstrate ADT’s effectiveness compared with state-of-the-art adversarial-training methods.

Broader Impact

The work targets security threats from adversarial examples while acknowledging a robustness–natural-accuracy trade-off. It presents ADT training procedures based on optimizing adversarial distributions and classifier parameters.

  • Broader Impact: Adversarial examples create security threats in deployed machine-learning systems, especially in autonomous driving, healthcare, and finance.The paper also notes that degraded clean-data accuracy is a negative consequence of adversarially robust training.
  • Broader Impact: The paper identifies lower natural accuracy than standard training as a negative consequence, despite improving natural accuracy over previous adversarial-training methods.This reflects the stated trade-off between adversarial robustness and clean-data accuracy.
  • Broader Impact: ADTEXP alternates inner gradient ascent on distribution parameters with outer stochastic gradient descent on classifier parameters.The procedure uses Monte Carlo gradient estimation during the inner updates.
  • Broader Impact: Amortized ADT variants jointly update classifier and generator parameters through stochastic gradient descent and ascent.ADTEXP-AM samples perturbations from generator-produced distributions, while ADTIMP-AM also updates variational-distribution parameters.
  • Broader Impact: ADT uses variational entropy maximization for implicit adversarial distributions when their densities cannot be accessed exactly.The variational distribution q is implemented as a diagonal Gaussian parameterized by a neural network.

B.1 Proof of Theorem 1

The proof establishes conditions under which the adversarial-distribution search space is compact and the loss is continuous, enabling Danskin’s theorem for ADT. It also identifies a theoretical boundary for implicit distributions.

  • B.1 Proof of Theorem 1: Under Assumption 2, the adversarial-distribution space is compact because its densities are closed, bounded, and equicontinuous.The proof invokes the Arzelà–Ascoli theorem on the compact perturbation set S.
  • B.1 Proof of Theorem 1: The loss function J is shown to be jointly continuous on the product of the distribution space and classifier-parameter space.The proof constructs a metric combining distribution distance with Euclidean parameter distance.
  • B.1 Proof of Theorem 1: Danskin’s theorem then yields directional differentiability of the maximized objective and its gradient at a unique maximizer.Applying the theorem with Q equal to the adversarial-distribution space proves the stated ADT optimization result.
  • B.1 Proof of Theorem 1: For explicit distributions, bounded and equicontinuous densities satisfy Assumption 2 after controlling their means and standard deviations.The proof derives boundedness and Lipschitz continuity from the diagonal covariance and the parameter constraints.
  • B.1 Proof of Theorem 1: For implicit adversarial distributions, the authors cannot prove Assumption 2, although experiments still support using the theorem and general training algorithm.The entropy lower bound is optimized through Monte Carlo integration and back-propagation.
  • B.1 Proof of Theorem 1: Assumption 2 is sufficient but not necessary for compactness, since delta distributions reduce ADT to AT over the compact perturbation set.This observation separates the proof condition from the broader compactness requirement.

C.1 Datasets

Experiments use CIFAR-10, CIFAR-100, and SVHN with specified preprocessing and perturbation budgets. Generator inputs incorporate images and classifier-loss gradients, with explicit and implicit parameterizations differing in their outputs and noise inputs.

  • C.1 Datasets: Experiments use CIFAR-10, CIFAR-100, and SVHN, with standard augmentation on CIFAR and no augmentation on SVHN.Testing uses no data augmentation, and the datasets contain 32×32 color images for CIFAR and house-number images for SVHN.
  • C.1 Datasets: The generator architecture contains three residual blocks plus initial and final convolutions, with stride-1 convolutions followed by normalization and ReLU.The architecture is shared across the generator implementations described here.
  • C.1 Datasets: Generator inputs include the natural image and classifier-loss gradients evaluated at natural and FGSM-adversarial examples.This design follows the paper’s stated motivation that natural images alone can produce poor results.
  • C.1 Datasets: ADTEXP-AM outputs six channels representing explicit distribution parameters, whereas ADTIMP-AM uses a 64-dimensional uniform noise vector processed by fully connected layers.The implicit variant feeds the encoded noise to the generator along with the image and gradients.
  • C.1 Datasets: The generator and variational-network architectures are documented in Tables 7 and 8, including residual-block and convolution notation.Table 7 covers the generators, while Table 8 covers the variational distribution q in ADTIMP-AM.

C.3 Training details

Training compares standard and adversarial-training baselines while evaluating robustness with feature attacks and convergence experiments. The reported setup specifies optimization schedules, attack parameters, and architecture tables for reproducibility.

  • C.3 Training details: The classifier uses SGD with momentum 0.9, weight decay 2 × 10−4, batch size 64, and a learning rate reduced after epoch 75.Training stops after 76 epochs.
  • C.3 Training details: ADTEXP optimizes per-example distribution parameters with Adam for T = 7 steps and k = 5 Monte Carlo samples per inner-gradient estimate.The distribution-parameter learning rate is 0.3.
  • C.3 Training details: The generator architectures used in the experiments are specified in Table 7, and the variational-distribution architecture for ADTIMP-AM is specified in Table 8.The tables define convolutional-layer notation and the residual-block design.
  • C.3 Training details: Primary baselines include clean standard training and PGD adversarial training, with additional CIFAR-10 baselines including a released pretrained ATPGD model.The PGD baseline uses seven steps and step size α = ϵ/4.
  • C.3 Training details: Feature-attack evaluation targets feature representations of randomly selected images from different classes and reports success when any of 200 attacks misclassifies an input.The attack uses α = ϵ/8 and 50 optimization steps.

D Supplementary experimental results

Supplementary experiments report ADT performance under white-box attacks, TRADES integration, and convergence of explicit adversarial distributions. The distributions converge within a few attack iterations.

  • Supplementary experimental results: ADT variants are evaluated against baselines on CIFAR-100 and SVHN under all adopted white-box attacks.Table 9 marks per-attack best results and overall results outperforming baselines.
  • TRADES integration: The TRADES-integrated ADT variants are compared with TRADES on CIFAR-10 under white-box attacks using worst-case robustness.Table 10 reports classification accuracy for each attack and marks overall improvements over baselines.
  • Convergence study: Explicit adversarial distributions converge within a few attack iterations when attacking ATPGD and ADTEXP.The study varies attack iterations from 0 to 100 and tracks classification loss and accuracy in Fig. 6.

D.4 Training time

The training-time comparison shows that explicit distribution optimization is costly, while amortizing adversarial distributions substantially reduces runtime. ADTEXP-AM and ADTIMP-AM are reported as faster than ATPGD.

  • D.4 Training time: ADTEXP is nearly 5× slower than ATPGD because it uses five Monte Carlo samples per gradient estimate.The reported comparison measures one-epoch training time on CIFAR-10.
  • D.4 Training time: ADTEXP-AM and ADTIMP-AM are nearly 2× faster than ATPGD through amortization of the adversarial distributions.The comparison concerns one-epoch training time on CIFAR-10 in Fig. 7.
  • Comparison with Chen et al. [9]: ADT models distributions of adversarial perturbations, whereas L2L uses a generator to produce adversarial examples for training.The paper describes L2L as a variant of vanilla adversarial training based on single adversarial examples.
  • Comparison with Chen et al. [9]: ADTEXP-AM and ADTIMP-AM outperform L2L in most cases under the same classifier and generator configuration.The comparison uses CIFAR-10 white-box attacks with epsilon = 8/255, as summarized in Table 11.
Loading 2002.05999v2…