[Paper Review] Improving the Generalization of Adversarial Training with Domain Adaptation

Chuanbiao Song, Kun He+2 more|arXiv (Cornell University)|Oct 1, 2018

Adversarial Robustness in Machine Learning27 references47 citations

TL;DR

ATDA reframes FGSM-based adversarial training as a domain adaptation problem to align clean and adversarial representations, improving generalization to various attacks while maintaining reasonable accuracy on clean data.

ABSTRACT

By injecting adversarial examples into training data, adversarial training is promising for improving the robustness of deep learning models. However, most existing adversarial training approaches are based on a specific type of adversarial attack. It may not provide sufficiently representative samples from the adversarial domain, leading to a weak generalization ability on adversarial examples from other attacks. Moreover, during the adversarial training, adversarial perturbations on inputs are usually crafted by fast single-step adversaries so as to scale to large datasets. This work is mainly focused on the adversarial training yet efficient FGSM adversary. In this scenario, it is difficult to train a model with great generalization due to the lack of representative adversarial samples, aka the samples are unable to accurately reflect the adversarial domain. To alleviate this problem, we propose a novel Adversarial Training with Domain Adaptation (ATDA) method. Our intuition is to regard the adversarial training on FGSM adversary as a domain adaption task with limited number of target domain samples. The main idea is to learn a representation that is semantically meaningful and domain invariant on the clean domain as well as the adversarial domain. Empirical evaluations on Fashion-MNIST, SVHN, CIFAR-10 and CIFAR-100 demonstrate that ATDA can greatly improve the generalization of adversarial training and the smoothness of the learned models, and outperforms state-of-the-art methods on standard benchmark datasets. To show the transfer ability of our method, we also extend ATDA to the adversarial training on iterative attacks such as PGD-Adversial Training (PAT) and the defense performance is improved considerably.

Motivation & Objective

• Motivate robustness of neural networks against adversarial examples and address weak generalization to unseen attacks.
• Propose a domain adaptation framework to bridge the gap between clean and adversarial data in the logit space.
• Combine unsupervised and supervised domain adaptation with standard adversarial training to improve generalization.
• Demonstrate effectiveness on common datasets and extend to iterative attacks like PGD.

Proposed method

• Model adversarial training as domain adaptation between clean and adversarial domains in logit space.
• Use unsupervised domain adaptation losses: CORAL to align covariances and MMD to align means between clean and adversarial representations.
• Introduce supervised domain adaptation via a margin-based loss to reduce intra-class variation and increase inter-class separation, with center updates similar to center loss.
• Generate adversarial examples using a FGSM variant to avoid label leaking and incorporate them into training with a combined loss: classification on both clean and adversarial data plus domain adaptation terms.
• Define a combined objective that includes the standard classification losses on clean and adversarial data and a regularization term for domain alignment (UDA + SDA) with a balancing parameter lambda.
• Outline an algorithm that iteratively samples mini-batches, creates adversarial examples, updates class centers, and optimizes the network and centers.

Experimental results

Research questions

• RQ1 Can domain adaptation techniques reduce the distribution gap between clean and adversarial data in the logit space?
• RQ2 Does aligning moments and covariances (UDA) plus class-aware alignment (SDA) improve generalization to unseen adversaries beyond FGSM?
• RQ3 Is ATDA compatible with standard adversarial training and scalable to iterative attacks like PGD?
• RQ4 What is the impact of ATDA on clean accuracy and model smoothness compared to traditional adversarial training?

Key findings

• ATDA improves generalization to multiple bounded adversaries compared to standard adversarial training and some state-of-the-art baselines.
• UDA and SDA components contribute to domain invariance and robustness, with ablations showing significant gains from domain alignment.
• ATDA yields smoother models with reduced local loss sensitivity relative to baselines.
• The learned logit representations exhibit closer distributional alignment across clean and adversarial domains than other methods (lower MMD distances).
• ATDA can be extended to PATDA for PGD-based adversarial training, achieving stronger robustness on several datasets compared to PAT, though results vary by dataset.