[Paper Review] Learning with a Strong Adversary

Ruitong Huang, Bing Xu+2 more|arXiv (Cornell University)|Nov 10, 2015

Adversarial Robustness in Machine Learning14 references263 citations

TL;DR

This paper proposes a novel training method called 'Learning with a Strong Adversary' (LWA) that enhances deep neural network robustness by formulating adversarial training as a min-max optimization problem. By generating stronger adversarial examples through a more effective search method, LWA significantly improves robustness on MNIST and CIFAR-10 while maintaining high standard accuracy, outperforming prior heuristic approaches like Goodfellow's method and LWA_Rep.

ABSTRACT

The robustness of neural networks to intended perturbations has recently attracted significant attention. In this paper, we propose a new method, \emph{learning with a strong adversary}, that learns robust classifiers from supervised data. The proposed method takes finding adversarial examples as an intermediate step. A new and simple way of finding adversarial examples is presented and experimentally shown to be efficient. Experimental results demonstrate that resulting learning method greatly improves the robustness of the classification models produced.

Motivation & Objective

• To address the lack of formal justification for adversarial training methods that are currently used heuristically in deep learning.
• To develop a more effective method for generating adversarial examples that lead to stronger robustness in classifiers.
• To propose a min-max formulation of adversarial training that inherently produces robust models, rather than relying on heuristic regularization.
• To evaluate the robustness and accuracy trade-off in deep networks under stronger perturbations, particularly on standard benchmarks like MNIST and CIFAR-10.

Proposed method

• The method formulates adversarial training as a min-max optimization problem: the model minimizes classification error while an adversary maximizes it by perturbing inputs within a bounded norm.
• A new, efficient algorithm is proposed to find stronger adversarial examples by solving a dual norm-based optimization problem, improving over the linear approximation used in Goodfellow et al. (2014).
• The approach is general and applicable to various loss functions and perturbation types, not limited to specific architectures or norms.
• The method is implemented by training the network to be robust against adversarial examples generated via this stronger search procedure, using both raw data and representation layer perturbations.
• The framework is evaluated on LeNet and a VGG-style network, with ablation studies on the impact of Dropout and Batch Normalization.
• The training procedure is compared against baseline methods including normal training, Dropout, Goodfellow’s method, and LWA_Rep, with robustness measured under increasing ℓ₂ norm perturbations.

Experimental results

Research questions

• RQ1 Can a formal min-max formulation of adversarial training lead to more robust deep neural networks than heuristic approaches?
• RQ2 How does the proposed method for generating adversarial examples compare in strength to existing methods like Goodfellow’s linear approximation?
• RQ3 Does training with stronger adversarial examples lead to better robustness without sacrificing standard accuracy?
• RQ4 Is the robustness improvement consistent across different network architectures, including deeper models with convolutional layers?
• RQ5 What is the impact of perturbing the representation layer versus the raw input layer in adversarial training?

Key findings

• On MNIST, LWA achieved 96.32% accuracy on adversarial examples with ℓ₂ norm 1.5, significantly outperforming Goodfellow’s method (90.35%) and LWA_Rep (50.14%).
• On the more complex LeNet architecture, LWA maintained high standard accuracy (99.34%) while achieving 96.27% robust accuracy under ℓ₂ perturbations of 1.5.
• On CIFAR-10, LWA with Batch Normalization achieved 78.5% robust accuracy under ℓ₂ perturbations of 0.5, outperforming Goodfellow’s method (75.4%) and LWA_Rep (57.4%).
• The method demonstrated consistent robustness gains across both MNIST and CIFAR-10, with no observed accuracy-robustness trade-off in the tested settings.
• Perturbing the representation layer (LWA_Rep) led to poor performance due to perturbation amplification in deeper layers, suggesting limitations in this approach.
• The proposed method for finding adversarial examples was empirically stronger than existing approaches, enabling the training of classifiers robust to more severe perturbations.