[Paper Review] A Closer Look at Accuracy vs. Robustness

Yao-Yuan Yang, Cyrus Rashtchian+3 more|arXiv (Cornell University)|Mar 5, 2020

Adversarial Robustness in Machine Learning73 references83 citations

TL;DR

The paper argues that robustness and accuracy are not inherently at odds and are achievable on real image data if one uses locally Lipschitz functions; it analyzes why current methods underperform and shows dropout can improve generalization when combined with robust training.

ABSTRACT

Current methods for training robust networks lead to a drop in test accuracy, which has led prior works to posit that a robustness-accuracy tradeoff may be inevitable in deep learning. We take a closer look at this phenomenon and first show that real image datasets are actually separated. With this property in mind, we then prove that robustness and accuracy should both be achievable for benchmark datasets through locally Lipschitz functions, and hence, there should be no inherent tradeoff between robustness and accuracy. Through extensive experiments with robustness methods, we argue that the gap between theory and practice arises from two limitations of current methods: either they fail to impose local Lipschitzness or they are insufficiently generalized. We explore combining dropout with robust training methods and obtain better generalization. We conclude that achieving robustness and accuracy in practice may require using methods that impose local Lipschitzness and augmenting them with deep learning generalization techniques. Code available at https://github.com/yangarbiter/robust-local-lipschitz

Motivation & Objective

• Empirically assess whether real image datasets exhibit class separation (r-separation).
• Theoretically connect r-separation and local Lipschitzness to the existence of robust and accurate classifiers.
• Evaluate how current robustness methods (AT, TRADES, RST) perform in terms of local Lipschitzness and generalization gaps.
• Investigate whether standard generalization techniques (e.g., dropout) can reduce the generalization gap and improve robustness.
• Offer guidance on designing training processes that jointly promote robustness and accuracy.

Proposed method

• Define and analyze r-separation in real datasets using distance metrics on images.
• Prove that r-separation implies existence of a robust and accurate classifier obtained by rounding a locally Lipschitz function.
• Empirically evaluate robustness methods (AT, RST, TRADES) on MNIST, SVHN, CIFAR-10, and Restricted ImageNet, focusing on local Lipschitzness and generalization gaps.
• Measure empirical local Lipschitz constants by a PGD-like procedure to assess classifier smoothness.
• Experiment with dropout as a generalization technique to see its effect on robustness, accuracy, and Lipschitzness.

Experimental results

Research questions

• RQ1 Do real image datasets exhibit r-separation between classes?
• RQ2 Can an r-separated distribution yield a robust and accurate classifier via a locally Lipschitz rounding function?
• RQ3 Why do practical robustness methods underperform relative to theory—is it due to limited local Lipschitzness or poor generalization?
• RQ4 Does adding dropout to robust training reduce generalization gaps and improve robustness and accuracy?
• RQ5 How do current robustness methods balance local smoothness, robustness, and generalization across standard benchmarks?

Key findings

• Real image datasets (MNIST, CIFAR-10, SVHN, Restricted ImageNet) are r-separated for perturbation radii typical in robustness experiments.
• There exists a locally Lipschitz function whose rounding yields a classifier with astuteness 1 at radius r on r-separated data, implying robustness and accuracy can coexist in principle.
• Adversarial Training (AT), Robust Self-Training (RST), and TRADES impose strong local Lipschitzness and robustness but exhibit large generalization gaps.
• Dropout reduces the generalization gap and can improve both clean and adversarial test accuracy when combined with robust methods.
• Although AT/RST/TRADES achieve smoother classifiers, they often generalize poorly; dropout helps ameliorate this and can further smoothness.