[Paper Review] Are Perceptually-Aligned Gradients a General Property of Robust Classifiers?

Simran Kaur, Jeremy M. Cohen+1 more|arXiv (Cornell University)|Oct 18, 2019

Adversarial Robustness in Machine Learning26 references38 citations

TL;DR

The paper shows that perceptually-aligned gradients occur not only in adversarially trained networks but also in randomized-smoothed (Gaussian) robust classifiers, suggesting this phenomenon may be a general property of robust models.

ABSTRACT

For a standard convolutional neural network, optimizing over the input pixels to maximize the score of some target class will generally produce a grainy-looking version of the original image. However, Santurkar et al. (2019) demonstrated that for adversarially-trained neural networks, this optimization produces images that uncannily resemble the target class. In this paper, we show that these "perceptually-aligned gradients" also occur under randomized smoothing, an alternative means of constructing adversarially-robust classifiers. Our finding supports the hypothesis that perceptually-aligned gradients may be a general property of robust classifiers. We hope that our results will inspire research aimed at explaining this link between perceptually-aligned gradients and adversarial robustness.

Motivation & Objective

• Motivate understanding of why perceptually-aligned gradients appear with robustness defenses.
• Investigate whether perceptual alignment extends beyond adversarial training to randomized smoothing.
• Demonstrate, via targeted adversarial synthesis, that smoothed classifiers exhibit perceptually coherent target-class features.

Proposed method

• Define and employ the Gaussian-smoothed classifier hat{f}_{} and its base network f.
• Formulate the targeted adversarial objective using the expected logits and optimize via Monte Carlo gradient estimates over Gaussian noise.
• Use Projected Gradient Descent (PGD) to craft large- adversarial examples for smoothed networks.
• Compare two loss objectives for gradient-based synthesis: cross-entropy (L_CE) and target class max (L_TCM), preferring L_TCM for perceptual quality.
• Synthesize class-conditioned images by gradient ascent on the target class score starting from seed images drawn from class-specific Gaussians.

Experimental results

Research questions

• RQ1 Do perceptually-aligned gradients appear for classifiers built via randomized smoothing, in addition to adversarially trained models?
• RQ2 Is the perceptual alignment of gradients a general property of robust classifiers or specific to particular defenses?
• RQ3 What influence do smoothing parameters (e.g., sigma) and gradient estimation choices have on the perceptual quality of synthesized images?
• RQ4 How do different training approaches for the base network (Gaussian augmentation vs. SmoothAdv) affect perceptual alignment in the smoothed classifier?

Key findings

• Perceptually-aligned gradients are observed in smoothed networks when crafting large- adversarial examples targeting specific classes.
• Images synthesized via the smoothed classifier tend to resemble the target class visually, though may lack global coherence.
• The L_TCM loss yields more perceptually coherent target-class images than the cross-entropy loss in this setting.
• Increasing the smoothing scale sigma tends to produce more coherent, single-instance representations of the target class, while smaller sigma yields scattered features.
• Using Monte Carlo sampling (N) for gradient estimation with N up to 20 provides sufficient quality for perceptual synthesis in their experiments.