On the Convergence and Robustness of Adversarial Training

Yisen Wang; Xingjun Ma; James Bailey; Jinfeng Yi; Bowen Zhou; Quanquan Gu

Source-linked AI summary

On the Convergence and Robustness of Adversarial Training

Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, Quanquan Gu

arXiv:2112.08304v2Dec 15, 2021cs.LG

TL;DR

Adversarial training needs a criterion for evaluating how well its inner maximization generates adversarial examples, because this affects robust-classifier training. The paper introduces FOSC to measure convergence quality, uses it to motivate dynamic training, and reports improved robustness, with conclusions bounded by stated assumptions and an unresolved account of stage interactions.

Problem
The inner maximization in adversarial training lacks an effective quantitative criterion for measuring convergence quality, limiting monitoring and analysis of the min-max procedure.
Method
The paper proposes FOSC to measure adversarial-example convergence quality and a dynamic strategy that gradually increases this quality during training.
Results
FOSC is well correlated with adversarial strength and training robustness, while dynamic training significantly improves adversarial-training robustness.
Takeaways & Limitations
Better robustness is associated with using higher-convergence-quality adversarial examples later rather than earlier in training, motivating staged control of inner maximization quality.
Takeaways & Limitations
The overall min-max convergence proof holds under certain assumptions, and the precise interaction between early and later training stages remains an open problem.

Abstract

from arXiv · show

Improving the robustness of deep neural networks (DNNs) to adversarial examples is an important yet challenging problem for secure deep learning. Across existing defense techniques, adversarial training with Projected Gradient Decent (PGD) is amongst the most effective. Adversarial training solves a min-max optimization problem, with the \textit{inner maximization} generating adversarial examples by maximizing the classification loss, and the \textit{outer minimization} finding model parameters by minimizing the loss on adversarial examples generated from the inner maximization. A criterion that measures how well the inner maximization is solved is therefore crucial for adversarial training. In this paper, we propose such a criterion, namely First-Order Stationary Condition for constrained optimization (FOSC), to quantitatively evaluate the convergence quality of adversarial examples found in the inner maximization. With FOSC, we find that to ensure better robustness, it is essential to use adversarial examples with better convergence quality at the \textit{later stages} of training. Yet at the early stages, high convergence quality adversarial examples are not necessary and may even lead to poor robustness. Based on these observations, we propose a \textit{dynamic} training strategy to gradually increase the convergence quality of the generated adversarial examples, which significantly improves the robustness of adversarial training. Our theoretical and empirical results show the effectiveness of the proposed method.

1. Introduction

DNNs are vulnerable to imperceptible adversarial perturbations, motivating defenses such as adversarial training. This paper focuses on measuring and improving the convergence quality of adversarial examples in the inner maximization.

DNN vulnerability to imperceptible adversarial perturbations raises security concerns in applications such as face recognition and autonomous driving.
Adversarial training solves a min-max problem whose inner maximization generates loss-maximizing examples and whose outer minimization trains model parameters on them.
The inner maximization is typically nonconcave, and its solution quality directly affects the robustness achieved by the outer minimization.
FOSC is proposed as a principled criterion for measuring adversarial-example convergence quality, with correlations to adversarial strength and training robustness.
Better robustness is associated with higher convergence quality in later training stages, whereas high-quality examples early can be unnecessary or harmful.
A dynamic strategy gradually increases adversarial-example convergence quality and significantly improves adversarial-training robustness while providing an overall min-max convergence guarantee.

2. Related Work

Prior work includes diverse attack and defense methods, with PGD regarded as a strong first-order attack and adversarial training among the most effective defenses. The paper identifies a missing convergence criterion for inner maximization and proposes dynamic PGD training to improve robustness.

Attacking methods seek constrained perturbations that remain within an ϵ-ball while causing incorrect DNN predictions.
FGSM uses one perturbation step, whereas PGD uses multiple smaller steps and projects each iterate back onto the ϵ-ball when necessary.
PGD is regarded as the strongest first-order attack, while C&W is among the strongest attacks to date.
Defense research spans distillation, feature analysis, denoising, gradient regularization, compression, and adversarial training, among which adversarial training is described as most effective.
The inner maximization lacks an effective quantitative criterion for comparing convergence quality across attack methods and analyzing the min-max problem.
The paper proposes FOSC and a dynamic training strategy intended to significantly improve the robustness of standard PGD adversarial training.

3. Evaluation of the Inner Maximization

FOSC provides a constrained-optimization criterion for evaluating adversarial-example convergence and is closely related to adversarial strength and training robustness. Experiments show that FOSC is more informative than loss for comparing attack settings and that weaker attacks early in training can improve later convergence and robustness.

3.1. Quantitative Criterion: FOSC: FOSC measures convergence quality for the nonconcave, constrained inner maximization, with smaller values indicating better adversarial-example solutions.It is affine invariant and does not depend on a specific norm.
3.1. Quantitative Criterion: FOSC: FOSC reaches zero at an interior stationary point or at a boundary local maximum satisfying the perturbation constraint.Thus, the criterion accounts for both the loss gradient and the allowed perturbation region.
3.2. FOSC View of Adversarial Training: Lower FOSC correlates with lower adversarial-example accuracy and higher loss, while progressively stronger PGD perturbations drive FOSC toward zero.Across 20 randomly selected examples, loss increases and then stabilizes over a wider range than FOSC.
3.2. FOSC View of Adversarial Training: PGD-ϵ/2 and PGD-ϵ/4 achieve the best robustness among tested step sizes, with FOSC distributions concentrated near zero despite nearly identical loss distributions.When varying step number, robustness and FOSC remain similar, while additional steps beyond those needed to reach the ϵ-ball surface provide marginal or no gain.
3.2. FOSC View of Adversarial Training: FOSC is initially low but becomes higher later in training, and replacing early PGD-ϵ/4 with weaker FGSM improves both final robustness and later PGD convergence.The FOSC density in [0, 0.1] rises above 35% from below 30% after this replacement.

4. Dynamic Adversarial Training

The dynamic adversarial training strategy controls adversarial-example convergence quality during training, using progressively stronger examples and providing an overall min-max convergence guarantee.

The Proposed Dynamic Training Strategy: FOSC controls the convergence quality of adversarial examples used in dynamic adversarial training.The strategy uses FOSC to monitor and regulate the inner maximization while training the outer model.
The Proposed Dynamic Training Strategy: Training uses weak adversarial examples early and strong adversarial examples later by gradually decreasing the target FOSC value.The control criterion decreases linearly from cmax toward zero and remains zero after the control epoch T′.
The Proposed Dynamic Training Strategy: Algorithm 1 applies PGD-based inner updates, filters examples using the FOSC threshold, and updates model parameters with stochastic gradients.The algorithm iterates over training epochs and PGD steps, disabling examples once their FOSC falls below the epoch-specific threshold.
Convergence Analysis: The convergence analysis addresses the complete min-max optimization problem rather than only the inner maximization.The analysis accounts for approximate inner maximizers despite nonlinearities such as ReLU and max-pooling.
Convergence Analysis: Under Assumptions 1–3, the method converges to an approximate first-order stationary point when the inner FOSC is controlled below δ.The resulting precision includes a term proportional to 2L2Lθxδ/µ, and the convergence rate is sublinear under the theorem’s step-size and iteration conditions.
Relation to Curriculum Learning: The dynamic strategy can be viewed as curriculum learning because it orders adversarial examples from weaker to stronger during training.Unlike using PGD step count as difficulty, FOSC directly measures convergence quality, while more steps can overshoot and produce suboptimal examples.

5. Experiments

Experiments compare Dynamic adversarial training with standard and curriculum baselines across white-box, black-box, perturbation, and training-dynamics settings. Dynamic generally provides the strongest robustness, particularly on CIFAR-10 and WideResNet, while later training uses higher-quality adversarial examples.

White-box Robustness: Dynamic achieves nearly the best white-box robustness among evaluated defense models, with larger gains over Standard on CIFAR-10 than MNIST.The authors attribute the limited CIFAR-10 gain in the small model partly to its capacity and evaluate WideResNet separately.
WideResNet Benchmark: Dynamic significantly boosts WideResNet robustness over Madry’s adversarial training on FGSM and PGD-20, while achieving the highest robustness against C&W∞.Curriculum gains only slightly on the first attacks and loses 4% relative to Madry’s model on C&W∞.
Black-box Robustness: Dynamic achieves higher black-box robustness than the other defense models, while Curriculum also improves over Standard adversarial training.The authors connect these gains with using weak adversarial examples during early training.
Perturbation Constraints: Curriculum and Dynamic substantially improve Standard’s robustness across tested PGD-10 perturbation constraints, with Dynamic performing better again.Figure 4 evaluates testing and training ϵ values from 2/255 to 8/255 on CIFAR-10.
Adversarial Training Process: Dynamic and Curriculum generate adversarial examples with increasing convergence quality, and at later epochs their FOSC distributions align with their final robustness rankings.At the later stages, FOSC density exceeds 40% for Dynamic, 30% for Curriculum, and remains below 30% for Standard.

6. Discussion and Conclusion

The paper introduces FOSC to measure adversarial-example convergence quality and uses it to motivate Dynamic training. Results support improving convergence quality later rather than earlier, although the interaction between training stages remains unresolved.

Discussion and Conclusion: FOSC measures the convergence quality of adversarial examples in the inner maximization and correlates with adversarial strength more consistently than loss.The paper also reports theoretical convergence for the overall min-max optimization under certain assumptions.
Discussion and Conclusion: Higher robustness is achieved by using better-convergence adversarial examples at later training stages rather than at early stages.The Dynamic strategy gradually increases adversarial-example convergence quality according to this finding.
Discussion and Conclusion: Dynamic training achieves a significant robustness gain over Madry’s baselines, especially on CIFAR-10 with WideResNet and ϵ = 8/255.The conclusion identifies this setting as a particularly strong benchmark for the proposed strategy.
Discussion and Conclusion: The precise interaction between early and later training stages remains an open problem.The authors suggest increasing weak-example diversity early or adversarial-example strength later as directions for further study.

A. Proof of Theorem 1

The proof establishes regularity properties for the outer objective and bounds involving approximate stochastic gradients. These lemmas support the convergence proof for the proposed min-max training approach under stated assumptions.

Lemma 1: Under Assumptions 1 and 2, the outer objective LS(θ) is L-smooth with L = LθxLxθ/µ + Lθθ.This is stated as Lemma 1 and provides the smoothness property used in the theorem proof.
Lemma 2: Lemma 2 bounds the approximate stochastic gradient ˆg(θ) under Assumptions 1 and 2.The proof invokes triangle inequality and Assumption 1 to derive the bound.