Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness

Pu Zhao; Pin-Yu Chen; Payel Das; Karthikeyan Natesan Ramamurthy; Xue Lin

Source-linked AI summary

Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness

Pu Zhao, Pin-Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy, Xue Lin

arXiv:2005.00060v2Apr 30, 2020cs.LGcs.CVstat.ML

TL;DR

The paper addresses limited understanding of adversarial robustness through mode connectivity. It learns clean-data paths to repair tampered models and analyzes robustness loss, finding effective repair, a barrier between regular and robust models, and Hessian-eigenvalue correlation.

Problem
The paper studies how mode connectivity can analyze adversarial robustness and address DNNs tampered during training or inference.
Method
The method trains paths between model optima using limited bonafide data for tampered models and standard loss for robustness-landscape analysis.
Results
Backdoor attack success rates decrease from close to 100% at tampered endpoints to nearly 0% at selected path models, while error-injected paths reach nearly 100% fault tolerance.
Takeaways & Limitations
Mode connectivity provides a practical means to repair backdoored or error-injected models and evaluate adversarial robustness through loss-landscape geometry.
Takeaways & Limitations
The theoretical correlation result assumes that the local input landscape is captured by second-order Taylor curvature, and the adaptive-attack setting protects the bonafide data.

Abstract

from arXiv · show

Mode connectivity provides novel geometric insights on analyzing loss landscapes and enables building high-accuracy pathways between well-trained neural networks. In this work, we propose to employ mode connectivity in loss landscapes to study the adversarial robustness of deep neural networks, and provide novel methods for improving this robustness. Our experiments cover various types of adversarial attacks applied to different network architectures and datasets. When network models are tampered with backdoor or error-injection attacks, our results demonstrate that the path connection learned using limited amount of bonafide data can effectively mitigate adversarial effects while maintaining the original accuracy on clean data. Therefore, mode connectivity provides users with the power to repair backdoored or error-injected models. We also use mode connectivity to investigate the loss landscapes of regular and robust models against evasion attacks. Experiments show that there exists a barrier in adversarial robustness loss on the path connecting regular and adversarially-trained models. A high correlation is observed between the adversarial robustness loss and the largest eigenvalue of the input Hessian matrix, for which theoretical justifications are provided. Our results suggest that mode connectivity offers a holistic tool and practical means for evaluating and improving adversarial robustness.

1 INTRODUCTION

The paper applies mode connectivity to adversarial robustness, using connected models and loss-landscape geometry to repair tampered networks and expose robustness barriers.

Motivation and approach: Mode connectivity links independently trained models with the same architecture and loss through high-accuracy, low-loss paths.These paths provide access to many similarly performing models between two endpoints.
Motivation and approach: Adversaries can tamper with DNNs during training through backdoors or during inference through prediction-evasive attacks.The paper targets both training-phase and inference-phase threats.
Motivation and approach: Users need repair tools because publicly released models may be tampered with, while backdoors can remain difficult to detect without their triggers.Fine-tuning or transfer learning often uses only a small amount of private bonafide data.
Contributions: For backdoor and error-injection attacks, paths trained with limited bonafide data can repair attacked models and produce high-accuracy, low-risk models.The approach is reported to outperform fine-tuning, training from scratch, pruning, and random weight perturbations.
Contributions: For evasion attacks, standard-loss paths between regular and adversarially trained models show no standard-loss barrier but do reveal a robustness-loss barrier.The paper also relates robustness loss to the largest eigenvalue of the input Hessian.

2 BACKGROUND AND RELATED WORK

This section introduces mode-connectivity path parameterizations and the adversarial threats considered: backdoor, evasion, and error-injection attacks.

Mode connectivity in loss landscapes: Mode connectivity studies continuous curves between independently trained endpoint weights w1 and w2 while seeking high accuracy along the path.The curve φθ(t) has endpoints φθ(0) = w1 and φθ(1) = w2.
Mode connectivity in loss landscapes: Path parameters θ are optimized through an expected loss over models sampled along the curve, with a tractable uniform-distribution formulation.qθ(t) samples path models indexed by t, while U(0, 1) samples t uniformly.
Mode connectivity in loss landscapes: Polygonal chains parameterize bends between endpoint networks, whereas Bezier curves provide a convenient smooth path parameterization.The cited one-bend polygonal chain and quadratic Bezier curve are alternative curve constructions.
Related work: Mode connectivity has mainly supported generalization analysis and model ensembling, while its adversarial-robustness implications remain largely unexplored.The paper distinguishes its scope from prior work focused on interpreting input-space decision surfaces and evasion attacks.
Adversarial attacks: A backdoor attack poisons training data with a trigger-target association, causing triggered inputs to receive the target label while clean behavior remains normal.The paper focuses on repairing backdoored models with mode connectivity and limited bonafide data.
Adversarial attacks: Evasion attacks modify benign inputs slightly to manipulate predictions, while error-injection attacks alter model weights during inference to cause targeted misclassification.The latter can plausibly be implemented through hardware mechanisms such as laser beams or row hammer attacks.

3 MAIN RESULTS

Mode connectivity connects models through high-accuracy paths and can both repair models compromised by training- or inference-phase attacks and reveal barriers in adversarial robustness. Across backdoor, error-injection, and evasion settings, limited-data paths preserve clean performance while improving resilience, whereas regular paths between regular and adversarially trained models retain a robustness-loss barrier.

Experimental scope: Experiments span backdoor, error-injection, and evasion attacks across VGG and ResNet architectures on CIFAR-10 and SVHN.Connections use cross-entropy loss and quadratic Bezier curves.
Untampered-model connections: 1000/2500 CIFAR-10 samples reduce VGG16 test accuracy by at most 10%/5% on separate 5000-sample test data.The worst path model is usually near t = 0.5, geometrically farthest from both endpoints.
Backdoor attacks: At t = 0.1 or t = 0.9, paths between backdoored models retain similar clean performance while reducing backdoor attack success from close to 100% to nearly 0%.Most models for t ∈[0.1, 0.9] are resilient, while fewer bonafide samples mainly worsen clean-data performance.
Backdoor attacks: Path connection outperforms fine-tuning, training from scratch, pruning, and random weight perturbations for mitigating backdoor attacks.Fine-tuning can have 58.7% higher backdoor accuracy at the same clean accuracy; pruning has little effect on backdoor accuracy.
Error-injection attacks: Paths between error-injected models remove injected errors almost completely, with most path models attaining nearly 100% fault tolerance while retaining comparable clean performance near endpoints.Across architectures and datasets, path training consistently sanitizes injected errors, with training-data size mainly affecting standard test error.
Error-injection attacks: Only path connection and training-from-scratch achieve 0% attack accuracy against error injection, while path connection provides substantially better clean accuracy than the effective baselines.The method also remains resilient to an adaptive path-aware error-injection attack.
Evasion attacks: Regular loss has no barrier along the examined paths, but robustness loss has a barrier between regular and adversarially trained models.The barrier is more apparent for regular-to-adversarial and adversarial-to-adversarial pairs; path models can be less robust than adversarially trained endpoints despite similar standard losses.
Evasion attacks: Adversarial-training-based robust connections can link adversarially trained or regularly trained model pairs, although ensembling with either connection provides little gain against evasion attacks.This extension contrasts with the robustness barrier observed for paths trained with standard loss.

4 CONCLUSION

The paper uses mode connectivity to study and improve adversarial robustness, repairing tampered models and revealing robustness barriers between regular and robust models.

Path connections trained with limited clean data can repair backdoored or error-injected models while preserving clean-data accuracy.The method significantly outperforms several baseline repair approaches.
Connecting regular and adversarially-trained models reveals a barrier in robustness loss along the path.
The paper theoretically justifies the observed high correlation between robustness loss and the largest input-Hessian eigenvalue.
Experiments across network architectures and datasets validate the proposed robustness analyses and repair approach.

A NETWORK ARCHITECTURE AND TRAINING

Experiments use VGG and ResNet models on CIFAR-10 and SVHN, with clean accuracy reported for untampered models and path behavior illustrated for ResNet on SVHN.

The experiments mainly use VGG and 26-layer Preactivation-ResNet architectures.VGG contains 13 convolutional and 3 fully connected layers.
Test accuracy of untampered models is reported across CIFAR-10 and SVHN for different architectures.
Figure A1 presents loss and error rate along paths connecting two untampered ResNet models trained on SVHN.Inference evaluation uses 5000 separate test samples.

C ILLUSTRATION AND IMPLEMENTATION DETAILS OF BACKDOOR AND ERROR-INJECTION ATTACKS

The appendix describes how backdoor and error-injection attacks are constructed, including trigger poisoning and targeted parameter perturbations, with resulting clean-image accuracy degradation.

Backdoor models are trained on data where 10% of images receive a trigger and target labels.The trigger is a white block in the image’s right-bottom area.
Error injection targets 4 of 1000 test images with randomly selected incorrect labels while preserving the remaining classifications.
100% target-label accuracy is achieved for the 4 injected errors, while accuracy on other clean images falls to 78% and 75%, respectively.

D PREDICTION ERROR ON THE TRIGGERED DATA

Triggered-data prediction error is high at the tampered path endpoints and follows standard test-error trends away from those endpoints.

Triggered-data error rate is high at path ends t = 0 and t = 1 because both endpoint models are tampered.
For models not too close to the path ends, triggered-data error shows a trend similar to standard test error.The path can therefore identify models with good clean and backdoor performance away from the endpoints.
Figure A3 reports prediction error against backdoor attacks along the connection path.

E MORE RESULTS ON PATH CONNECTION AGAINST BACKDOOR ATTACKS

Additional experiments show that mode-connectivity paths can mitigate backdoor attacks while preserving clean performance across datasets and architectures. Comparisons with baseline repairs further support path connection’s effectiveness.

Training from scratch with only 50 images usually yields the lowest clean test accuracy.The low-data limitation is especially pronounced for the training-from-scratch baseline.
Random Gaussian perturbations do not reliably change model robustness status, unlike the structured evolution along a path connection.The path follows a targeted trajectory for backdoor robustness rather than random exploration.
Path connection preserves clean performance while reducing backdoor vulnerability on CIFAR-10 and SVHN.Figures A4 and A5 report clean and backdoor error rates along the connection paths.
Path connection outperforms fine-tuning, training from scratch, pruning, and random weight perturbations against single-target backdoor attacks.The comparison covers CIFAR-10 with ResNet and SVHN with VGG.

F MORE RESULTS ON PATH CONNECTION AGAINST ERROR-INJECTION ATTACKS

Further experiments indicate that path connection mitigates error-injection attacks across settings, including differently tampered models and limited-data repair. It also compares favorably with baseline methods.

Path connection outperforms baseline methods against error-injection attacks across network-architecture and dataset combinations.The comparison includes the settings summarized in Tables 3 and A3.
Path connection attains the highest clean accuracy and 0% attack accuracy against error-injection attacks.This result is reported in the performance evaluation against error injection.
With 250 images, triggered-sample error reaches 100% at t = 0.25 in one backdoor repair example.At that point, clean accuracy is lower than for the fine-tuned endpoint.
Path connection can quickly eliminate injected errors while maintaining high clean accuracy in the one-tampered-model setting.The procedure first fine-tunes the model with bonafide data, then connects the original and fine-tuned models.
Path connection remains effective when the two models are tampered differently.The experiments vary poisoned datasets for backdoors and injection settings for error attacks.
Noise-based model exploration produces low clean accuracy and high attack success rates, making chance-based repair unlikely.The experiment evaluates 1000 noisy models generated from a backdoored model.

I DATA SIMILARITY OF INPUT GRADIENTS

Input-gradient similarity provides a mechanism for understanding how path models retain clean behavior while reducing adversarial effects. The analysis compares path models with both endpoint models on clean and tampered data.

The analysis uses average cosine similarity distance between path-model input gradients and endpoint input gradients.Figure A11 reports similarity distances for models along the CIFAR-10 VGG path.
Under a flat loss along the path, similar input gradients imply similar behavior for the same sample.The first-order Taylor approximation supplies the stated explanation.
The explanation targets backdoor and error-injection mitigation through weight-space exploration and input-gradient similarity.The broader method is presented as a technical account of path connection’s effectiveness.
Path models resemble endpoint models on clean inputs but are dissimilar to them on tampered inputs.This combination supports clean-data accuracy alongside mitigation of adversarial effects.

K IMPLEMENTATION DETAILS FOR EVASION ATTACK AND ADVERSARIAL TRAINING

The evasion-attack analysis evaluates standard and robustness losses along paths and develops robust connections using adversarial training. A robustness barrier persists between non-robust and robust models, while Hessian curvature tracks robustness loss.

The evasion evaluation uses PGD adversarial examples with ϵ = 8/255 and 10 attack iterations.These examples are generated over the test set after path training.
Large input-Hessian spectra correspond to sharper minima and greater vulnerability to small input distortions.Flat minima with smaller spectra require more effort to leave under perturbation.
The largest input-Hessian eigenvalue evolves similarly to adversarial-example loss along the path.The paper computes the eigenvalue with power iteration and compares it with loss and error curves.
The Hessian-to-robustness relationship relies on assumptions about high-accuracy paths, second-order input-landscape approximation, and PGD approximation quality.If the higher-order O(ϵ3) term is non-negligible, the analysis gains an O(ϵ) offset.
Robust connection samples a path model, maximizes loss over feasible perturbations, then minimizes the expected maximum loss with respect to path parameters.Projected gradient descent is used for the inner maximization.
A robustness loss barrier remains between non-robust and robust models, even with robust path training.Robust model pairs and non-robust model pairs show no such barrier, with small loss variance and flat attack success rates.
Model ensembling averages outputs from randomly selected path models while testing attacks generated from an endpoint model.The attacker is assumed not to know the connection path or its models.

N EXPERIMENTAL RESULTS ON CIFAR-100

On CIFAR-100, mode connectivity repairs models under backdoor and error-injection attacks, while paths between regular and adversarially trained models reveal a robustness-loss barrier and Hessian correlation.

Backdoor and error-injection attacks: The path connection removes backdoor and error-injection effects on CIFAR-100 while repairing the attacked model.The experiment connects two tampered models using varying amounts of bona fide data.
Evasion attack: Evasion experiments connect two regular models and regular with adversarially trained models, without investigating two adversarially trained models.The authors note that adversarial training is less significant on CIFAR-100 than on CIFAR-10.
Fine-tuning comparison: Fine-tuning with larger learning rates lowers attack accuracy faster but can degrade clean accuracy, whereas smaller rates preserve clean accuracy but reduce attack accuracy slowly.The trade-off becomes more pronounced when bona fide data decreases from 2500 to 1000 images.
Evasion attack: A robustness-loss barrier appears on paths connecting regular and adversarially trained models, despite no standard-loss barrier.The figure also reports a high correlation between robustness loss and the largest eigenvalue of the input Hessian.

P STABILITY ANALYSIS

The stability analysis finds relatively small performance variance across path-connections trained with different initializations and learning rates, while selection thresholds depend on available clean-data access.

Stability analysis: Gaussian-noise experiments report only average accuracy across multiple runs, without variance, because the average indicates that noise is ineffective for removing adversarial effects.This reporting choice is described in Appendix E.
Path stability: The stability study mainly uses one representative setup with multiple runs because evaluating every attack, dataset, and architecture combination would require considerable time and resources.Results are summarized with means and standard deviations.
Path stability: Across 10 connections, path performance remains close with relatively small variance despite different initializations and learning rates.The connections use learning rates randomly set to 0.005, 0.01, or 0.02.
Choosing t: For full clean-test accuracy, selecting a path model within Δa = 6% of the endpoint accuracy is suggested to remove attack effects without substantially sacrificing clean accuracy.The threshold is based on the performance evaluations in the cited figures.
Choosing t: Without full clean-test accuracy, k-fold cross-validation estimates path-model test accuracy, but reduced validation size makes the test error rate less stable.The suggested threshold in this setting is Δa = 10%, and larger bona fide datasets are preferred because 50 images show large deviation.