PaperlayerView exact revision on arXiv

Source-linked AI summary

Boosting Adversarial Training with Hypersphere Embedding

Tianyu Pang, Xiao Yang, Yinpeng Dong, Kun Xu, Jun Zhu, Hang Su

arXiv:2002.08619v3cs.LGcs.CRcs.CVstat.ML

TL;DR

Adversarial training is robust but existing representation-regularization approaches can be computationally costly or introduce class biases. This paper integrates hypersphere embedding into adversarial training, finding generally improved robust learning across frameworks with little extra computation and simple implementation.

  • Problem

    Adversarial training remains effective, but representation-regularization approaches can incur high computational costs and sampling-based metric learning can introduce class biases on unbalanced data.

  • Method

    The paper integrates hypersphere embedding into adversarial training by normalizing penultimate-layer features and softmax weights with additive angular margins.

  • Results

    Across tested adversarial-training frameworks and attack settings, integrating hypersphere embedding generally improves robust learning with little extra computation and simple code implementation.

  • Takeaways & Limitations

    Hypersphere embedding is broadly compatible with adversarial-training strategies, although its adaptability varies with the specific training principles.

  • Takeaways & Limitations

    The analysis relies on an assumption that class-relevant logits dominate competing logits for clean and adversarial examples.

Abstract

from arXiv · show

Adversarial training (AT) is one of the most effective defenses against adversarial attacks for deep learning models. In this work, we advocate incorporating the hypersphere embedding (HE) mechanism into the AT procedure by regularizing the features onto compact manifolds, which constitutes a lightweight yet effective module to blend in the strength of representation learning. Our extensive analyses reveal that AT and HE are well coupled to benefit the robustness of the adversarially trained models from several aspects. We validate the effectiveness and adaptability of HE by embedding it into the popular AT frameworks including PGD-AT, ALP, and TRADES, as well as the FreeAT and FastAT strategies. In the experiments, we evaluate our methods under a wide range of adversarial attacks on the CIFAR-10 and ImageNet datasets, which verifies that integrating HE can consistently enhance the model robustness for each AT framework with little extra computation.

1 Introduction

Adversarial training is a strong general defense, but existing representation-supervision approaches can be computationally costly or introduce class bias. The paper integrates hypersphere embedding into adversarial training and evaluates this lightweight combination across multiple frameworks, attacks, and datasets.

  • Adversarial training achieves state-of-the-art robustness across different settings, motivating continued efforts to improve its efficiency and data use.Prior work accelerates training and exploits extra labeled or unlabeled data, especially when computation or data access is limited.
  • Metric-learning and optimal-transport enhancements exploit inter-sample interactions but can incur high computational cost or class bias on unbalanced data.
  • Hypersphere embedding normalizes penultimate-layer features and softmax weights while adding an angular margin.The mechanism is incorporated as a lightweight module within adversarial-training frameworks.
  • Feature and weight normalization direct adversarial attacks toward changing the angular component cos(θ) in the classification objective.For the binary example, the norm factors remain positive and cannot change the sign of the objective.
  • HE is combined with PGD-AT, ALP, TRADES, FreeAT, and FastAT and evaluated on CIFAR-10 and ImageNet under diverse attacks.The experiments also inspect robustness to corrupted images on CIFAR-10-C and ImageNet-C.

2 Methodology

The paper formulates adversarial training as coupled inner maximization and outer minimization problems, then augments these frameworks with hypersphere embedding. HE uses feature normalization, weight normalization, and training-time angular margins.

  • AT frameworks: Adversarial training alternates inner adversarial-objective maximization with outer training-objective minimization until the model parameters converge.The inner maximization searches allowed points around each input, while the outer minimization updates the model.
  • AT frameworks: Existing metric-learning integrations can improve robust representations but may add computational overhead, introduce class biases, or remain vulnerable to strong attacks.
  • AT frameworks with HE: HE integrates with AT as a lightweight module designed to adapt to AT learning dynamics and address these deficiencies.
  • Hypersphere embedding: Weight normalization replaces each classifier weight W_l with W_l divided by its norm, while feature normalization replaces z with z divided by its norm.
  • Hypersphere embedding: With HE, predictions use normalized feature–weight angles without a bias vector, and angular margins modify the training cross-entropy loss.The angular-margin operation is applied only during training, with scale s used for numerical stability.

3 Analysis of the benefits

The analysis explains how hypersphere embedding improves adversarial training by shaping attack directions, training dynamics, and classifier-weight updates under ℓp-bounded threats.

  • 3.1 Formalized first-order adversary: First-order adversaries maximize the loss by moving in the gradient direction under an ℓp constraint.The one-step solution is x* = x + ϵU_p(∇_x L_A(x)), with loss increase ϵ||∇_x L_A(x)||_q.
  • 3.3 Benefits from feature normalization: Feature normalization removes ineffective feature-norm changes from adversarial updates, aligning perturbations with the decision-relevant angular direction.This can reduce the iterations needed to craft adversarial examples, especially under constraints such as ℓ∞.
  • 3.3 Benefits from feature normalization: Feature normalization makes easy examples contribute less after being well learned, allowing hard examples to later dominate training in a curriculum-like process.Without normalization, updates can spend ineffective effort increasing feature norms and overlook hard examples.
  • 3.4 Benefits from weight normalization: The analysis evaluates HE-related mechanisms across CIFAR-10 and ImageNet settings, including PGD-AT, FastAT, and FreeAT evaluations summarized in the supplied tables.The cited table captions identify classification accuracy and, for FastAT and FreeAT, training time as reported measures.
  • 3.4 Benefits from weight normalization: Weight updates can become biased by class frequency, example difficulty, and adversarial predictions, causing classifier weights to oscillate in norm and direction.Untargeted adversaries tend to exploit semantically similar classes, influencing updates to the corresponding softmax weights.

4 Experiments

Experiments evaluate HE-enhanced adversarial training across datasets, attacks, training frameworks, and robustness settings. The reported results show stronger robustness, more efficient attack generation during training, and increased attention to adversarial examples.

  • Experimental setup: HE-enhanced models are evaluated on CIFAR-10 and ImageNet using multiple adversarial attacks and training configurations.The experiments include PGD-AT, ALP, TRADES, FreeAT, and FastAT settings, with attacks including PGD and stronger alternatives.
  • White-box attacks: 55.25% / 52.54% accuracy is reported for PGD-AT+HE under adaptive PGD-20 / PGD-500 attacks, versus 53.97% / 51.63% for PGD-AT.The adaptive attack uses the training loss, including the HE scale and margin, as its adversarial objective.
  • Benchmark attacks: PGD-AT+HE with WRN-34-20 achieves state-of-the-art performance on CIFAR-10 under RayS and AutoAttack according to the reported benchmarks.RayS evaluation uses 1,000 test samples because of its high computational cost, and no additional data is used.
  • Black-box attacks: HE generally improves robustness under transfer-based and query-based black-box attacks.The paper reports detailed transfer-based experiments in Appendix C.4 and evaluates query-based attacks including ZOO, SPSA, and NES.
  • Distributional shifts: HE-enhanced models achieve better robustness across unseen CIFAR-10-C and ImageNet-C corruptions averaged over five severity levels.The evaluated architectures are WRN-34-10 on CIFAR-10 and ResNet-50 on ImageNet.
  • More empirical analyses: 3-step PGD training with PGD-AT+HE is more robust under PGD-20 than 7-step PGD training with PGD-AT.This reduces the iterations needed during training; the analyses also report sharper, more detailed perturbation profiles and larger adversarial-example gradients.

5 Conclusion

The paper concludes that integrating hypersphere embedding into adversarial training generally supports robust learning across frameworks and threat models. HE is presented as lightweight, computationally inexpensive, and simple to implement, though its adaptability varies by training principle.

  • Conclusion: HE is generally conducive to robust learning and compatible with previous adversarial-training strategies with little extra computation and simple code implementation.The paper notes that adaptability varies across different adversarial-training frameworks according to their specific training principles.

Broader Impact

The paper frames adversarial vulnerability as a security and public-confidence risk in deployed machine-learning systems. It motivates reliable, general, and lightweight robustness strategies and presents HE-enhanced adversarial training as a simple, efficient approach.

  • Broader impact: Adversarial vulnerability in practical systems can create security risks and negatively affect public confidence.These concerns motivate reliable, general, and lightweight strategies for improving robustness against malicious attacks.

A.1 Proof of Lemma 1

This material presents first-order adversarial perturbation results, attack-method definitions, and threat-model terminology used in the paper. It also describes several white-box and black-box attack constructions and their experimental settings.

  • Proof of Lemma 1: Under first-order Taylor expansion, the maximizing perturbation is x∗= x + ϵUp(∇L(x)), and the loss becomes L(x∗) = L(x) + ϵ∥∇L(x)∥q.Here ∥·∥q is the dual norm associated with ∥·∥p.
  • Threat models: Threat models specify assumptions about the adversary’s goals, capabilities, and knowledge.The paper distinguishes untargeted and targeted goals, ℓp-bounded perturbations, and oblivious, white-box, black-box, and general-purpose adversaries.
  • Gradient-based attacks: BIM iteratively applies small gradient updates, while PGD additionally uniformly samples its initial point within the neighborhood of the clean input.The sampling is described as covering greater diversity in the adversarial space.
  • Iterative attacks: MIM adds a momentum term to BIM, and DeepFool iteratively seeks a decision-boundary example with minimum perturbation.The reported MIM decay factor is µ = 1.0, while DeepFool uses a maximum of 100 iterations with early stopping when an intermediate result is adversarial.
  • Optimization and query-based attacks: C&W constructs adversarial examples through optimization, whereas ZOO estimates coordinate gradients with finite differences and query access.The experiments use Adam with binary search for C&W, σ = 10−4 and 20,000 maximum queries for ZOO, and one randomly sampled coordinate update.
  • Gradient estimation: NES and SPSA estimate full gradients from random samples, using Gaussian and Rademacher perturbation distributions respectively.The experiments use the logit-margin objective J(x, y), σ = 0.001, and q = 128.

B.3 Adversarial training

Adversarial training improves robustness but faces computational costs and representation-learning challenges. Existing approaches address these challenges through robust-feature supervision, metric learning, and computationally efficient training frameworks.

  • B.3 Adversarial training: Adversarial training is a leading defense strategy, but multi-step methods impose substantial computational costs.Training a robust ImageNet model can require tens of GPU workers, motivating more efficient strategies such as FreeAT.
  • B.3 Adversarial training: The section situates PGD-AT and TRADES among established frameworks and notes FreeAT as a computationally efficient alternative for ImageNet-scale training.PGD-AT formulates adversarial training as a min-max problem, while TRADES adds a prediction-consistency regularizer.
  • B.3 Adversarial training: Metric-learning approaches add triplet objectives to stabilize representations by contrasting adversarial, same-class, and different-class examples.The triplet formulation uses an adversarial anchor, a clean positive example, and a clean negative example with a margin-based distance objective.
  • B.3 Adversarial training: Feature-scatter methods instead generate adversarial examples jointly and maximize optimal-transport distance between clean and adversarial distributions.This approach uses inter-sample interactions during the inner maximization rather than crafting each adversarial example only from its clean counterpart.
  • B.3 Adversarial training: The experiments largely reuse public implementations with minimal modifications to support fair comparisons across frameworks.The implementations use public code for TRADES, FreeAT, and FastAT, primarily based on PyTorch.

C.2 Datasets

The study evaluates on CIFAR-10 and ImageNet, using standard image augmentations tailored to each dataset. CIFAR-10 contains 60,000 images across 10 classes, while ImageNet contains 1.28 million training images across 1,000 classes.

  • C.2 Datasets: CIFAR-10 contains 60,000 32×32 color images across 10 classes, divided into 50,000 training and 10,000 test images.Training uses RandomCrop with four-pixel padding and RandomHorizontalFlip.
  • C.2 Datasets: ImageNet contains 1.28 million training images and 50,000 validation images across 1,000 classes.Training uses RandomResizedCrop and RandomHorizontalFlip, with resizing applied during evaluation.

C.3 Extensive ablation studies

Ablation studies examine HE hyperparameters and black-box transfer attacks across AT frameworks. HE scale and margin trade clean accuracy against adversarial robustness, while transfer evaluations use multiple substitute models and attacks.

  • C.3 Extensive ablation studies: Different HE scale s and margin m values produce trade-offs between clean accuracy and adversarial robustness in TRADES + HE.The comparison reports classification accuracy on clean inputs and under PGD-20 attack on CIFAR-10.
  • C.3 Extensive ablation studies: Black-box evaluations train PGD-AT, ALP, and TRADES as substitute models before transferring adversarial examples to the evaluated models.The experiments use untargeted PGD-20 and MIM-20 attacks to generate transfer perturbations.
  • C.3 Extensive ablation studies: Figure 4 reports CIFAR-10 classification accuracy under black-box transfer-based attacks, with separate substitute models for PGD-AT, ALP, and TRADES.Asterisks identify white-box cases in the figure.

C.5 Full results of m-HE on CIFAR-10

The CIFAR-10 white-box results compare modified HE with HE across PGD-AT, ALP, and TRADES. Their relative effectiveness depends on whether the framework trains exclusively on adversarial examples or mixes clean and adversarial examples.

  • C.5 Full results of m-HE on CIFAR-10: m-HE is more effective than HE with PGD-AT, FreeAT, and FastAT, which train exclusively on adversarial examples.The comparison uses s = 15 and m = 0.1 under the CIFAR-10 white-box threat model.
  • C.5 Full results of m-HE on CIFAR-10: HE performs better than m-HE with ALP and TRADES, which train on mixtures of clean and adversarial examples.The result is reported in the CIFAR-10 white-box evaluation.

C.6 Full results on CIFAR-10-C and ImageNet-C

Tables 11 and 12 report full classification accuracy results for different defenses on CIFAR-10-C and ImageNet-C across severity and corruption combinations.

  • Tables 11 and 12 cover 75 combinations of severity and corruption for the CIFAR-10-C and ImageNet-C evaluations.The results provide detailed classification accuracy for each combination.
  • Table 11 reports classification accuracy (%) on CIFAR-10-C, with severity denoted by S and defenses abbreviated as P, A, and T.P, A, and T refer to PGD-AT, ALP, and TRADES, respectively.
  • Table 12 reports classification accuracy (%) on ImageNet-C, with severity denoted by S and FreeAT abbreviated as F.
Loading 2002.08619v3…