[Paper Review] Adversarially robust transfer learning

Ali Shafahi, Parsa Saadatpanah+5 more|arXiv (Cornell University)|May 20, 2019

Adversarial Robustness in Machine Learning26 references14 citations

TL;DR

This paper proposes adversarially robust transfer learning by leveraging robust feature extractors from pre-trained adversarially trained models, enabling high accuracy and robustness on new tasks without adversarial training. By using lifelong learning techniques like Learning without Forgetting (LwF), the method preserves robustness during fine-tuning, improving generalization by ~2% on CIFAR-100 while maintaining robustness.

ABSTRACT

Transfer learning, in which a network is trained on one task and re-purposed on another, is often used to produce neural network classifiers when data is scarce or full-scale training is too costly. When the goal is to produce a model that is not only accurate but also adversarially robust, data scarcity and computational limitations become even more cumbersome. We consider robust transfer learning, in which we transfer not only performance but also robustness from a source model to a target domain. We start by observing that robust networks contain robust feature extractors. By training classifiers on top of these feature extractors, we produce new models that inherit the robustness of their parent networks. We then consider the case of fine tuning a network by re-training end-to-end in the target domain. When using lifelong learning strategies, this process preserves the robustness of the source network while achieving high accuracy. By using such strategies, it is possible to produce accurate and robust models with little data, and without the cost of adversarial training. Additionally, we can improve the generalization of adversarially trained models, while maintaining their robustness.

Motivation & Objective

• To address the challenge of achieving adversarial robustness in low-data regimes where adversarial training is costly and data-scarce.
• To investigate whether robustness can be transferred from a source model to a target domain without retraining with adversarial examples.
• To develop a method that preserves robustness during fine-tuning, avoiding catastrophic forgetting of robust features.
• To improve generalization of adversarially trained models by transferring robust features using lifelong learning.

Proposed method

• Transfer robustness by freezing the feature extractor of a pre-trained, adversarially trained model (e.g., Wide-ResNet on ImageNet) and retraining only the final classifier head on the target dataset.
• Use Learning without Forgetting (LwF) to fine-tune the entire network while preserving robustness, with a distillation loss that encourages similarity between feature representations of the source and target models.
• Apply ℓ2-norm distillation on the penultimate layer activations to enforce feature representation consistency between the source and fine-tuned models.
• Store source model features offline to speed up training and avoid online forward passes during LwF training.
• Use a warm-start strategy: initially train only the classifier head, then gradually fine-tune both the feature extractor and classifier with reduced learning rate.
• Control the trade-off between robustness and generalization via the hyperparameter λd in the LwF loss.

Experimental results

Research questions

• RQ1 Can robustness be effectively transferred from a source model to a new target domain without adversarial training?
• RQ2 Does end-to-end fine-tuning of a robust model degrade its adversarial robustness?
• RQ3 Can lifelong learning methods like LwF prevent forgetting of robust features during fine-tuning?
• RQ4 Can robust feature transfer improve generalization of adversarially trained models?
• RQ5 What is the impact of the LwF regularization strength (λd) on robustness and clean accuracy?

Key findings

• Transferring a robust ImageNet model to CIFAR-10 via feature extraction achieved 87.25% natural accuracy and 45.84% robust accuracy on PGD-20, without any adversarial training.
• Using LwF during fine-tuning preserved the robustness of the source model while improving clean validation accuracy, achieving 89.07% on CIFAR-10 with λd = 1e-7.
• On the CIFAR-100+ dataset, LwF improved generalization of a robust model by approximately 2% compared to standard fine-tuning, while maintaining robustness.
• The LwF method reduced the generalization gap in adversarially trained models, increasing PGD-20 accuracy from 22.76% to 24.31% on CIFAR-100 with λd = 0.001.
• The choice of λd significantly affects the trade-off between robustness and generalization, with some values (e.g., 0.1) improving both robustness and clean accuracy.
• Empirical results show that robustness originates in the feature extractors, and preserving their representations is key to maintaining robustness during transfer.