PaperlayerView exact revision on arXiv

Source-linked AI summary

Robustness and Accuracy Could Be Reconcilable by (Proper) Definition

Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, Shuicheng Yan

arXiv:2202.10103v2cs.LGcs.CRstat.ML

TL;DR

The paper addresses whether the robustness–accuracy trade-off is intrinsic by arguing that it can arise from an improperly defined robust error that imposes local invariance. It proposes locally equivariant SCORE, derives distance-based ways to optimize it, and reports improved adversarial-training performance, while noting practical optimization and explanatory limitations.

  • Problem

    Madry’s robust error imposes local invariance and can over-smooth models, potentially misaligning robust optimization with accurate conditional predictions.

  • Method

    SCORE replaces local invariance with local equivariance and is optimized efficiently by substituting KL divergence with distance metrics or their variants.

  • Results

    Substituting KL divergence with squared error improves adversarial-training performance, with top-rank CIFAR-10 and CIFAR-100 results on RobustBench under AutoAttack.

  • Takeaways & Limitations

    SCORE reconciles robustness and accuracy in expectation while retaining worst-case robust optimization and offering insights into overfitting and semantic gradients.

  • Takeaways & Limitations

    Direct SCORE optimization is intractable because it requires data-score gradients, and the paper’s explanations of overfitting and semantic gradients are not conclusive.

Abstract

from arXiv · show

The trade-off between robustness and accuracy has been widely studied in the adversarial literature. Although still controversial, the prevailing view is that this trade-off is inherent, either empirically or theoretically. Thus, we dig for the origin of this trade-off in adversarial training and find that it may stem from the improperly defined robust error, which imposes an inductive bias of local invariance -- an overcorrection towards smoothness. Given this, we advocate employing local equivariance to describe the ideal behavior of a robust model, leading to a self-consistent robust error named SCORE. By definition, SCORE facilitates the reconciliation between robustness and accuracy, while still handling the worst-case uncertainty via robust optimization. By simply substituting KL divergence with variants of distance metrics, SCORE can be efficiently minimized. Empirically, our models achieve top-rank performance on RobustBench under AutoAttack. Besides, SCORE provides instructive insights for explaining the overfitting phenomenon and semantic input gradients observed on robust models. Code is available at https://github.com/P2333/SCORE.

1. Introduction

The paper argues that the robustness–accuracy trade-off may originate in Madry’s robust error, whose local-invariance bias over-smooths models. It proposes SCORE, which replaces local invariance with local equivariance while retaining robust optimization, and reports top-rank RobustBench performance under AutoAttack.

  • Motivation: Madry’s robust error encourages local invariance, making predictions near x match p_d(y|x) rather than the conditional distribution at each perturbed input.The authors associate this bias with over-smoothed learned models and misalignment between the model and p_d(y|x).
  • Motivation: This misalignment can prevent the standard robust objective from reconciling robustness with accuracy, even making p_d(y|x) non-optimal under that objective.
  • Approach: SCORE replaces local invariance with local equivariance, encouraging p_θ(y|x′) to match p_d(y|x′) pointwise within the perturbation set.Its inner maximization compares the model and data conditionals at the same perturbed input.
  • Approach: SCORE preserves worst-case robust optimization in finite-sample settings while aligning its optimum with p_d(y|x).The paper illustrates self-consistency in a toy setting and robust optimization with limited samples.
  • Results: The paper reports improved state-of-the-art adversarial-training performance and top-rank CIFAR-10 and CIFAR-100 results on RobustBench under AutoAttack.The reported models use 1M DDPM-generated examples.

2. Self-Consistent Robust Error

The paper reframes robust error by contrasting Madry’s locally invariant objective with SCORE’s locally equivariant objective. SCORE preserves robust optimization while making the data conditional distribution a self-consistent optimum.

  • Standard and prior robustness definitions: Standard supervised learning minimizes expected KL divergence between p_d(y|x) and p_θ(y|x), whose optimum satisfies p_θ*(y|x) = p_d(y|x).
  • Standard and prior robustness definitions: Madry’s robust error uses an inner maximization over x′ ∈ B(x), encouraging p_θ(y|x′) to remain equal to p_d(y|x).This induces local invariance and can produce over-smoothed decision landscapes.
  • Problem: Under Madry’s objective, p_d(y|x) may fail to be optimally robust with respect to itself, creating a contradiction with supervised-learning consistency.
  • SCORE: SCORE uses local equivariance by comparing p_θ(y|x′) with p_d(y|x′) for each x′ ∈ B(x), making p_θ*(y|x) = p_d(y|x) the optimum.
  • SCORE: With finite samples, SCORE retains worst-case robust optimization and extracts more information from the available samples, supporting sample-efficient learning.The paper’s toy comparison uses six training pairs and 500 training steps.

3. How to Practically Optimize SCORE?

Direct SCORE optimization requires unavailable or high-variance data-score estimates, so the paper derives bounds using distance metrics and convex variants. These bounds motivate efficient objectives and connect excessive robust-error minimization to overfitting.

  • Practical optimization: Directly optimizing SCORE requires access to ∇_x log p_d(y|x), which is unavailable from ordinary training samples and makes the objective intractable in practice.
  • Practical optimization: Estimated data scores have high variance, motivating a reformulation that avoids directly differentiating through the data distribution.
  • Distance-based bounds: Replacing KL divergence with a distance metric yields upper and lower bounds that enable SCORE optimization without estimating data scores.The bounds apply to any distance metric satisfying the relevant axioms.
  • Distance-based bounds: The constant C_D represents the intrinsic smoothness of p_d(y|x) within B(x), with more complex datasets expected to have larger values.
  • Overfitting: In the toy analysis, overfitting begins when the robust distance objective falls below its threshold: SCORE starts increasing while the corresponding Madry objective continues decreasing.The example marks the transition at approximately 0.12 for the ℓ2 distance.
  • Convex variants: Convex variants such as squared error work better empirically than the underlying sublinear distance metrics, and substituting squared error for KL improves adversarial-training performance.

4. New Insights Brought by SCORE

SCORE connects robust-model phenomena to bounds and gradient structure, while randomized smoothing yields a related gradient-alignment interpretation. These analyses offer insights into overfitting and semantic gradients, but the explanations are not presented as conclusive.

  • Objective connections: Pinsker’s inequality connects KL-based robust error with distance-metric SCORE objectives.This connection supports bounds relating the objectives and motivates alternative explanations of robust-model behavior.
  • Overfitting and early stopping: RMadry(θ) can upper-bound the square-root robust error, helping explain why overfitting emerges during adversarial training.The paper relates this bound to the observation that accuracy and robustness can both increase before overfitting, with overfitting appearing earlier at RMadry(θ) ≈ CKL.
  • Adversarial-training gradients: Adversarially trained models emphasize shape-based features, which are described as more generative than texture-based features.The visualization highlights the top 10% of pixel positions with the largest summed RGB derivatives; the model is a FreeAT-trained ResNet-50 on ImageNet.
  • Adversarial-training gradients: Under first-order expansion, SCORE encourages alignment between data and model gradients for the target label.The result is analogous to score matching, although conditional probabilities are not normalized with respect to the input.
  • Randomized smoothing: Randomized smoothing exhibits a similar gradient-alignment objective, consistent with reports of semantic gradients.For small Gaussian noise, Gaussian-augmented learning decomposes into standard learning plus an alignment term involving the conditional log-gradient and data density.
  • Randomized smoothing: Gaussian-augmented learning combines standard learning with gradient alignment, adding evidence that robust learning has generative properties.The alignment term encourages ∇x log pθ(y|x) to match the direction of −∇x log pd(x|y).

5. Experiments

The experiments evaluate SCORE-related objectives and show that replacing KL divergence with squared error can improve the robustness–accuracy trade-off under AutoAttack. Additional generated-data experiments achieve strong RobustBench performance, while smaller TRADES β values can raise clean accuracy without materially changing robust accuracy.

  • 5.1. The 0-1 Version of SCORE for Evaluation: The 0-1 SCORE criterion is equivalent to the commonly used robust evaluation criterion when hard labels remain invariant within B(x).This follows from assuming Yd(x′) = Yd(x) for all x′ ∈B(x), so no evaluation modification is needed.
  • 5.2. Basic Setting without Extra or Generated Data: Distance metrics initially perform poorly in the PGD-AT ablation because of their sublinear property, motivating squared error as the selected instantiation.The ablation compares ℓ1, ℓ2, ℓ∞, JS, squared variants, and KL divergence across learning rates.
  • 5.2. Basic Setting without Extra or Generated Data: Squared error can improve clean accuracy and/or robustness over KL divergence without extra computation under AutoAttack.The comparison substitutes squared error for KL divergence in PGD-AT and TRADES.
  • 5.3. Advanced Setting with DDPM Generated Data: With large models and 1M DDPM-generated data, smaller TRADES β values such as 3 or 4 increase clean accuracy while keeping AutoAttack robust accuracy almost unchanged.The paper states that this differs from earlier observations and theoretically aligns TRADES more closely with PGD-AT.
  • 5.3. Advanced Setting with DDPM Generated Data: The advanced experiments use WRN-28-10 and WRN-70-16 without CutMix, while larger batches and longer training are expected to improve performance further.The reported setup uses batch size 512 and 400 epochs because of limited resources.
  • 5.3. Advanced Setting with DDPM Generated Data: On CIFAR-10 and CIFAR-100 RobustBench settings, substituting KL divergence with squared error and using a relatively small β yields higher clean accuracy with comparable or better robustness.The comparison covers ℓ∞ and ℓ2 threat models on CIFAR-10 and ℓ∞ on CIFAR-100.

6. Conclusion and Discussion

The paper attributes the robustness–accuracy trade-off to an improper robust-error definition and proposes SCORE to replace distributional invariance with local equivariance. It reports improved empirical trade-offs, while noting finite data can still produce an empirical trade-off.

  • Conclusion and Discussion: The conventional robust error converts reasonable hard-label invariance into distributional invariance, overcorrecting toward smoothness.This is identified as the source of the robustness–accuracy trade-off.
  • Conclusion and Discussion: SCORE uses local equivariance, provides an efficient optimization route, and offers explanations for overfitting and semantic gradients in robust models.The paper connects SCORE to substituting KL divergence with squared error in practice.
  • Conclusion and Discussion: SCORE reconciles robustness and accuracy in expectation, but insufficient finite training data can still cause an empirical trade-off.The paper states that convergence to a self-consistent solution is expected as more data are collected.
  • Conclusion and Discussion: SCORE permits arbitrary B(x), including sets of semantically similar points, while retaining stated self-consistency and robust-optimization sample-efficiency guarantees.This broadens the allowed perturbation set beyond local ℓp-balls.

A. Proofs

The appendix establishes the paper’s theoretical claims through distance-metric properties, convexity arguments, first-order expansions, and distributional assumptions. The listed proof steps connect these tools to SCORE, TRADES, threat models, and augmentation analyses.

  • Proofs: Several proofs invoke symmetry and the triangle inequality of a distance metric D(·||·).These properties are used as algebraic foundations for the stated bounds.
  • Proofs: The derivations repeatedly substitute intermediate results into earlier equations to establish the claimed theorems.The proof text explicitly references Theorem 1 and equations (17) and (23).
  • Proofs: Convexity of the square function supports a Jensen’s inequality step in the appendix derivations.The proof defines φ(·) = (·)^2 and uses its monotonicity and convexity.
  • Proofs: The appendix separately derives consequences for the TRADES objective and for ℓp-norm threat models using first-order expansion.The threat model is written as B(x) = {x′ ∥x′ −x∥p ≤ϵ}.
  • Proofs: Additional derivations analyze Gaussian augmentation and relate KL divergence to the objectives through Pinsker’s inequality.The Gaussian-augmentation section derives derivatives with respect to σ.

B. Detailed Derivations

This section details the robust-error formulation and the practical difficulty of directly optimizing SCORE. Score matching can estimate the required data gradients, but the resulting estimates are high variance in discriminative learning.

  • Madry’s robust error places maximization over perturbed inputs around the loss formulation, with equivalent first-order optimization directions under the expected KL formulation.The appendix distinguishes maximization before versus after label summation and treats the resulting objectives as equivalent for SGD or Adam updates.
  • Direct first-order optimization of SCORE requires explicitly computing the input gradient of the KL divergence.
  • The required data gradient can be decomposed into conditional and unconditional data scores, enabling score-matching estimators.
  • Initial experiments found the estimated data scores highly variable, making their use in discriminative learning non-trivial.

C. Detailed Discussion on the Effects of Randomized Smoothing

The section analyzes randomized smoothing through gradient-alignment terms and their relation to Gaussian augmentation. It also identifies limits on perfect alignment and illustrates semantic-gradient behavior using robust-model visualizations.

  • Gradient alignment: Gaussian-augmented learning decomposes into standard learning plus a gradient-alignment term, whose strength can be adjusted with γ and σ.Increasing γ toward one magnifies the alignment coefficient without increasing σ, which could degrade clean performance.
  • Gradient alignment: The gradient-alignment direction can be controlled because the alignment terms in the compared objectives have reversed signs.
  • Visualization: The figure caption describes additional semantic-gradient examples for a FreeAT-trained ResNet-50 on ImageNet using the Fig. 4 visualization pipeline.
  • Limits: Gradient alignment cannot be perfect because the class-weighted conditional gradients sum to the marginal data gradient, especially constraining alignment under uniform class probabilities.
  • Randomized smoothing: Randomized smoothing applies an ensemble of Gaussian-perturbed predictions at inference, but semantic gradients remain perceptually aligned with one sample, supporting training as the stronger explanation.

D. Additional Experiments

This section introduces additional technical details and empirical results without specifying a particular experiment in the supplied passage.

  • The section provides more technical details and empirical results.

D.1. Visualization of (KL-based) Overfitting

The section connects KL-based robust-error minimization with overfitting and semantic-gradient analyses, then describes how robust-model input gradients are visualized and sanity-checked.

  • Visualization of KL-based overfitting: When SCORE(θ)=0, the model matches the data conditional distribution, and the Madry robust error equals C_KL.
  • Visualization of KL-based overfitting: SCORE begins to overfit when Madry’s robust error is minimized to approximately C_KL, while Pinsker’s inequality implies an earlier C_KL-based stopping point.
  • Semantic-gradient visualization: The semantic-gradient visualization ranks pixels by summed RGB-channel derivatives and plots the top 10% positions to highlight shape-based characteristics.
  • Semantic-gradient visualization: For softmax classifiers, discriminative gradients are related to joint and marginal energy-based gradients through log pθ(y|x)=log pθ(x,y)−log pθ(x).
  • Sanity checks: Under PGD-40 attacks with varying perturbation sizes, accuracy converges to zero on CIFAR-10 and CIFAR-100, indicating that the SE function does not cause gradient obfuscation.
  • Terminology: The paper distinguishes multi-step adversarial-training overfitting from catastrophic overfitting in one-step training and separately frames robustness-accuracy trade-offs from other robustness trade-offs.

E.3. AutoAttack for Evaluation

The paper mainly evaluates robustness using AutoAttack, while acknowledging other attacks and concerns about detectability. It treats top-rank RobustBench performance as compelling evidence for the proposed method's effectiveness.

  • AutoAttack is the main benchmark used to evaluate the robustness of baselines and proposed methods.
  • RobustBench is recognized as a challenging, frequently updated benchmark based on AutoAttack.
  • Top-rank RobustBench performance provides compelling evidence for the proposed method's effectiveness.
Loading 2202.10103v2…