Source-linked AI summary
DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles
Huanrui Yang, Jingyang Zhang, Hongliang Dong, Nathan Inkawhich, Andrew Gardner, Andrew Touchet, Wesley Wilkes, Heath Berry, Hai Li
TL;DR
CNNs trained on the same dataset can share adversarial vulnerabilities, and existing ensemble diversity methods have not reliably prevented transfer attacks. DVERGE distills and diversifies sub-model vulnerabilities; it improves transfer robustness with little clean-accuracy impact, while white-box protection requires adversarial training.
Problem
Method
DVERGE distills non-robust features corresponding to each sub-model’s vulnerability and uses their overlap in a round-robin procedure to diversify the ensemble.
Source: §1 · p. 2, §3.1 · p. 4Results
DVERGE improves ensemble robustness against black-box transfer attacks without significantly affecting clean accuracy; only 3-6% of attacks that break one sub-model misclassify other sub-models.
Source: §1 · p. 3, §4.2 · p. 7Takeaways & Limitations
DVERGE’s induced diversity consistently improves robustness as the ensemble gains sub-models.
Source: §1 · p. 3DVERGE relies on adversarial training for white-box defense and traditional computer security to maintain system integrity.
Source: Broader Impact · p. 9
Abstract
from arXiv · showhide
Recent research finds CNN models for image classification demonstrate overlapped adversarial vulnerabilities: adversarial attacks can mislead CNN models with small perturbations, which can effectively transfer between different models trained on the same dataset. Adversarial training, as a general robustness improvement technique, eliminates the vulnerability in a single model by forcing it to learn robust features. The process is hard, often requires models with large capacity, and suffers from significant loss on clean data accuracy. Alternatively, ensemble methods are proposed to induce sub-models with diverse outputs against a transfer adversarial example, making the ensemble robust against transfer attacks even if each sub-model is individually non-robust. Only small clean accuracy drop is observed in the process. However, previous ensemble training methods are not efficacious in inducing such diversity and thus ineffective on reaching robust ensemble. We propose DVERGE, which isolates the adversarial vulnerability in each sub-model by distilling non-robust features, and diversifies the adversarial vulnerability to induce diverse outputs against a transfer attack. The novel diversity metric and training procedure enables DVERGE to achieve higher robustness against transfer attacks comparing to previous ensemble methods, and enables the improved robustness when more sub-models are added to the ensemble. The code of this work is available at https://github.com/zjysteven/DVERGE
1 Introduction
Models trained on the same dataset share non-robust features and adversarial vulnerabilities, while existing ensemble diversity objectives have not reliably blocked transfer attacks. DVERGE distills and diversifies those vulnerabilities to improve ensemble robustness while retaining clean accuracy.
1 Introduction
- Models trained independently on the same dataset tend to capture similar non-robust features, creating overlapping vulnerabilities that make adversarial attacks transferable.The introduction illustrates this shared vulnerability with clean-trained ensemble sub-models vulnerable along the same transfer-attack axis.Source: §1 · pp. 1–2
- Adversarial training reduces a single model’s vulnerability by encouraging robust features, but learning them is difficult and often increases clean-data generalization error.The paper contrasts this clean-accuracy cost with ensemble training that retains non-robust features.Source: §1 · p. 2
- Prior ensemble methods diversify output-logit distributions or input-gradient directions, but empirical results find these metrics ineffective at inducing the output diversity needed for robustness.The proposed ensemble approach seeks to maintain high clean accuracy without excluding non-robust features.Source: §1 · p. 2
- DVERGE distills and diversifies features corresponding to each sub-model’s adversarial vulnerability, using their overlap to measure diversity and a round-robin procedure to train the ensemble.The proposed approach is intended to impede transferability between sub-models and produce diverse outputs against transferred attacks.Source: §1 · p. 2
- DVERGE can isolate and diversify vulnerabilities within sub-models so that within-ensemble attack transferability is nearly eliminated.The resulting diverse vulnerabilities can persist in individual sub-models while the ensemble remains robust to transfer attacks.Source: §1 · pp. 2–3
- DVERGE improves ensemble robustness against black-box transfer attacks without significantly affecting clean accuracy, and robustness consistently improves as more sub-models are added.The method aims to isolate and diversify each sub-model’s vulnerability while allowing those vulnerabilities to persist for high clean accuracy.Source: §1 · p. 3
2 Related work
Prior work studies adversarial training and ensembles for accuracy, uncertainty, and robustness, but existing ensemble diversity metrics have not reliably reduced transferability. The section positions DVERGE against these approaches and their limitations.
2 Related work
- Adversarial training minimizes loss on generated adversarial examples, but it is difficult and costly, harms clean-data accuracy, and may require larger model architectures.PGD is often used for the inner maximization in its min-max objective.Source: §2 · p. 3
- Traditional ensembles such as bagging and boosting use diverse predictions to improve accuracy, while neural-network ensembles can support uncertainty estimation.Prior work finds that stronger links between diversity and ensemble accuracy require specially designed diversity metrics and training algorithms.Source: §2 · p. 3
- Prior robustness ensembles promote diversity in non-maximal predictions or adversarial subspaces, including ADP [12] and gradient-cosine methods [13], but these metrics do not reliably block transfer.The cited methods seek to limit adversarial transferability through output or input-gradient diversity.Source: §2 · p. 4
- Existing ensemble diversity metrics do not align well with reducing shared adversarial vulnerabilities, and ensembles trained with them remain highly non-robust to transfer attacks.The section identifies an effective metric for low attack transferability and high overall robustness as still lacking.Source: §2 · p. 4
3 Method
DVERGE measures how much two models share adversarial vulnerability by comparing their losses on distilled non-robust features. It uses that metric to train an ensemble with diverse vulnerabilities through round-robin updates on other sub-models’ distilled images.
3.1 Vulnerability diversity metric
- DVERGE’s vulnerability-diversity metric uses cross-entropy on distilled features to measure how much two models’ adversarial vulnerabilities overlap.The feature for an input is distilled using a randomly chosen source image and hidden layer; the formulation can be evaluated across architectures trained on the same dataset.Source: §3.1 · p. 4
3.2 Vulnerability diversification objective
- The diversification objective combines classification with increased vulnerability diversity; its revised form encourages diversity while keeping the distilled image correctly classified as its source label.DVERGE differs from adversarial training: it trains each sub-model on other models’ distilled images and optimizes the ensemble members in round-robin fashion, allowing non-robust features.Source: §3.2 · p. 5
3.3 DVERGE training routine
- DVERGE pretrains sub-models on clean data, distills non-robust features with PGD, then updates each model in round-robin using other models’ distilled images and source labels.The distillation layer is randomly chosen each epoch; the routine is repeated over training batches and epochs.Source: §3.3 · pp. 5–6
4 Experimental results
On CIFAR-10 with ResNet-20 sub-models, experiments assess DVERGE’s within-ensemble diversity and transferability, robustness, and combination with adversarial training. DVERGE achieves stronger robustness than other ensemble methods, with further gains from adding sub-models.
4.1 Setup
- The evaluation uses CIFAR-10 and ResNet-20 sub-models, with ensembles of 3, 5, or 8 models and empirically selected distillation ε values.The selected ε values are 0.07, 0.05, and 0.05 for ensembles of 3, 5, and 8 sub-models, respectively.Source: §4.1 · p. 6
4.2 Diversity and transferability within the ensemble
- As DVERGE training proceeds, ensemble diversity increases while transferability decreases, using ε=0.07 for diversity and ε=0.03 for transferability.The trend is reported for an ensemble of three sub-models.Source: §4.2 · p. 6, Figure 2 · p. 7
- DVERGE reduces pair-wise transfer success to 3–6%, versus 60–70% for ADP and over 80% between two GAL sub-models.Figure 3 reports transfer success from the i-th source sub-model to the j-th tested sub-model; diagonal entries are white-box attack success rates.Source: §4.2 · p. 7, Figure 3 · p. 7
4.3 Robustness of the ensemble
- DVERGE outperforms other ensemble methods in black-box and white-box robustness, maintains comparable clean accuracy, and gains robustness as sub-models are added.The evaluation averages results across three runs on 1,000 randomly selected test samples.Source: Figure 4 · p. 7, §4.3 · p. 8
4.4 DVERGE with adversarial training
- DVERGE+AdvT improves clean accuracy and transfer robustness over AdvT, but sacrifices clean accuracy versus DVERGE alone and has weaker robustness to large-perturbation white-box attacks than AdvT.The authors attribute these trade-offs to fixed ensemble capacity shared between robust and diverse non-robust features.Source: Figure 5 · p. 8, §4.4 · p. 9
5 Conclusions
DVERGE trains CNN ensembles to isolate and diversify sub-model vulnerabilities using distilled non-robust features. The paper reports reduced transferability and improved robustness, including with additional sub-models and when combined with adversarial training.
5 Conclusions
- DVERGE reduces transfer attack success between sub-models from over 60% for previous ensemble methods to under 6%, improving robustness while maintaining desirable clean accuracy.The conclusion also reports further robustness gains from adding sub-models and higher clean accuracy and transfer robustness for DVERGE combined with adversarial training versus adversarial training alone.Source: §5 · p. 9
Broader Impact
DVERGE may increase training computation and carbon production, while the impact of improved reliability and security depends on the application. It addresses black-box robustness but leaves other attack types and system integrity to other defenses.
Broader Impact
- DVERGE increases training computation, and the possibility of reducing its training burden through hyperparameter selection has not been examined for this method.Modified training may also use more computation per parameter update yet require fewer steps or epochs; whether that applies to DVERGE remains open.Source: Broader Impact · p. 9
- DVERGE improves black-box robustness orthogonally, leaving systems vulnerable to other attack types and reliant on adversarial training and traditional computer security.The paper notes that white-box knowledge can still be leaked in black-box scenarios.Source: Broader Impact · p. 9
- The reliability and security impact of DVERGE is not clear-cut and depends heavily on the application space.The paper also notes that robustness techniques cannot be applied only to uses judged positive-impact.Source: Broader Impact · p. 10
A Training and implementation details
The experiments compare DVERGE and other ensemble methods under specified training and attack setups. DVERGE training was marginally faster than adversarial training, with additional computational costs relative to some alternatives.
A Training and implementation details
- Baseline ensembles train for 200 epochs with SGD; DVERGE starts from those trained ensembles and follows their learning-rate schedule.The baseline uses momentum 0.9, weight decay 0.0001, initial learning rate 0.1, and 10× decays at epochs 100 and 150; the authors note a tuned DVERGE schedule may improve performance.Source: A Training and implementation details · p. 12
- Ensemble adversarial training uses 10-step PGD with ϵ = 8/255 and α = 2/255, generating examples from the whole ensemble; combined DVERGE uses examples from each sub-model.The authors report these choices help each case achieve its best robustness.Source: A Training and implementation details · p. 12
- M-DI2-FGSM uses input transformation probability 0.5, while SGM uses γ = 0.2.These settings follow the respective attack papers’ recommendations.Source: A Training and implementation details · p. 12
- DVERGE training was marginally faster than adversarial training, while ADP used the least time but did not improve robustness much.The comparison covers ResNet-20 ensembles with three sub-models trained for 200 epochs on one TITAN XP GPU; the authors consider DVERGE’s extra cost over GAL worthwhile given its robustness gains.Source: A Training and implementation details · p. 12, Table 1 · p. 12
B Analysis on the training ϵ of DVERGE
The analysis varies DVERGE’s feature-distillation ϵ and examines transferability and robustness. Larger training ϵ can reduce transferability, but the effect depends on ensemble size and trades off with clean accuracy.
B Analysis on the training ϵ of DVERGE
- Larger training ϵ improves feature-distillation accuracy and increases diversity loss, which the authors connect to lower transferability.The feature-distillation and diversity-loss analysis uses two standard ResNet-20 models trained on CIFAR-10.Source: Table 2 · p. 12, B Analysis on the training ϵ of DVERGE · p. 13
- 8%–10% to 3%–6% transferability as training ϵ rises from 0.03 to 0.07 in three-sub-model ensembles, but some pairs in larger ensembles remain highly vulnerable.For a five-sub-model ensemble trained with ϵ = 0.07, 79% of examples from the second sub-model fooled the fourth, and 48% transferred in reverse.Source: B Analysis on the training ϵ of DVERGE · p. 13, Figure 6 · p. 13
- Larger training ϵ leads to higher black-box transfer robustness but lower clean accuracy; white-box robustness varies non-monotonically.The authors leave the relationship between sub-model transferability and whole-ensemble white-box robustness for future study.Source: B Analysis on the training ϵ of DVERGE · p. 14, Table 3 · p. 14
C.2 Transferability within the ensemble under different testing ϵ
- Across different testing ϵ settings, DVERGE has the lowest within-ensemble transferability among the evaluated ensemble methods.Figure 8 reports the transferability results under different testing ϵ.Source: §C.2 · p. 14
C.1 Decision region visualization
- Additional decision-region plots compare baseline and DVERGE ensembles for testing images, with each row pair corresponding to one image.The plots use three-sub-model ResNet-20 ensembles trained on CIFAR-10.Source: §C.1 · p. 14, Figure 7 · p. 15
C.3 Numerical results for robustness
DVERGE retains the strongest robustness among ensemble methods against black-box transfer attacks from surrogates that replicate the defense. Across the reported attack spectrum, it shows noticeable improvements, alongside some result variation.
C.3 Numerical results for robustness
- 4.9% > 0.4% white-box versus black-box transfer accuracy for ADP/8 at ϵ = 0.02, which the authors say may indicate obfuscated gradients.Tables 4 and 5 provide numerical results corresponding to the black-box transfer and white-box evaluations.Source: §C.3 · pp. 15–16
- DVERGE yields noticeable robustness improvements over other methods across the attack spectrum, despite somewhat higher variation across three runs.The authors suspect variation comes from the randomly selected distillation layer in the last training epoch; Figure 9 reports standard deviations.Source: §C.3 · pp. 16–17, Figure 9 · p. 17
- DVERGE shows the strongest robustness among ensemble methods against black-box transfer attacks from surrogate models replicating the defense.The evaluation uses surrogates with 3, 5, and 8 sub-models and the same attack group as the earlier evaluation.Source: §C.3 · p. 17
C.4 Discussion on DVERGE with adversarial training
DVERGE can be combined with adversarial training, with the loss balance and ensemble size shaping the trade-off between clean accuracy and robustness.
C.4 Discussion on DVERGE with adversarial training
- The combined training objective includes DVERGE and adversarial-training losses; λ balances the terms, and λ = 1.0 was used for Figure 5, while Figure 10 shows results for other ensemble sizes.Source: §C.4 · p. 17
- With λ = 0.5 rather than λ = 1.0 for an eight-sub-model ensemble, clean accuracy decreases while black-box and white-box robustness increase when ϵ is large.The lower DVERGE-loss weight favors adversarial training and robust features over diverse non-robust features.Source: §C.4 · p. 18
- Larger ensembles yield better clean performance but worse black-box and white-box robustness under a large ϵ, as their DVERGE loss weighs more heavily against the AdvT loss.The reported comparison uses λ = 1.0.Source: §C.4 · pp. 17–18
C.5 Ablation study on layer selection for distillation
Random layer selection balances layer-specific effects and provides the strongest reported black-box robustness among the tested layer choices; training from scratch also improves robustness over other methods.
C.5 Ablation study on layer selection for distillation
- The layer ablation compares random selection with fixed distillation from ResBlock 1, ResBlock 2, ResBlock 3, or the whole network.Randomly sampling among 20 candidate ResNet-20 layers is intended to avoid overfitting to any one layer's feature sets.Source: §C.5 · p. 18
- Random layer selection provides superior black-box robustness to other layer choices, while its white-box robustness is slightly below ResBlock 1.Table 7 reports black-box robustness at ϵ=0.03 and white-box robustness at ϵ=0.01.Source: Table 7 · p. 18, §C.5 · pp. 18–19
- Deep-layer distillation lowers transferability between sub-models, whereas shallow-layer choices improve individual white-box robustness; random selection balances both effects.The pair-wise transferability comparison uses ϵ=0.01; the authors say both factors contribute to ensemble black-box robustness.Source: §C.5 · p. 18, Figure 11 · p. 19
C.6 Ablation study on pre-training
- Training DVERGE from scratch still improves robustness over other methods, although results are slightly worse than with pre-trained models.Figure 12 evaluates methods with three sub-models and reports three repeated runs.Source: §C.6 · p. 19, Figure 12 · p. 20
D Convergence check
The convergence check finds only small accuracy changes with additional attack iterations and concludes that the evaluated attacks had sufficient steps.
D Convergence check
- The authors conclude that sufficient attack steps were applied and that all attacks converged during evaluation.Source: D Convergence check · p. 20
- Accuracy decreases by no more than 0.6% for black-box attacks and 1.2% for white-box attacks as attack steps increase.The white-box evaluation uses one random start for efficiency.Source: Table 8 · p. 20, D Convergence check · p. 20
- Table 8 reports accuracy against attacks with varying numbers of iterations.Source: Table 8 · p. 20