[Paper Review] On the Convergence and Robustness of Adversarial Training

Yisen Wang, Xingjun Ma+4 more|arXiv (Cornell University)|Dec 15, 2021

Adversarial Robustness in Machine LearningComputer Science31 references182 citations

TL;DR

Introduces FOSC as a convergence criterion for the inner maximization in adversarial training and proposes a dynamic training strategy that gradually increases adversarial strength to improve robustness, with theoretical convergence guarantees and extensive experiments.

ABSTRACT

Improving the robustness of deep neural networks (DNNs) to adversarial examples is an important yet challenging problem for secure deep learning. Across existing defense techniques, adversarial training with Projected Gradient Decent (PGD) is amongst the most effective. Adversarial training solves a min-max optimization problem, with the extit{inner maximization} generating adversarial examples by maximizing the classification loss, and the extit{outer minimization} finding model parameters by minimizing the loss on adversarial examples generated from the inner maximization. A criterion that measures how well the inner maximization is solved is therefore crucial for adversarial training. In this paper, we propose such a criterion, namely First-Order Stationary Condition for constrained optimization (FOSC), to quantitatively evaluate the convergence quality of adversarial examples found in the inner maximization. With FOSC, we find that to ensure better robustness, it is essential to use adversarial examples with better convergence quality at the extit{later stages} of training. Yet at the early stages, high convergence quality adversarial examples are not necessary and may even lead to poor robustness. Based on these observations, we propose a extit{dynamic} training strategy to gradually increase the convergence quality of the generated adversarial examples, which significantly improves the robustness of adversarial training. Our theoretical and empirical results show the effectiveness of the proposed method.

Motivation & Objective

• Motivate the need for a quantitative convergence criterion for the inner maximization in adversarial training.
• Introduce FOSC as an affine-invariant measure of convergence quality for adversarial examples within the epsilon-ball.
• Demonstrate that gradual increase of adversarial strength during training enhances robustness.
• Provide a theoretical convergence guarantee for the proposed dynamic training strategy.
• Empirically validate the proposed method against state-of-the-art defenses on MNIST and CIFAR-10.

Proposed method

• Define the adversarial training objective as a min-max problem with inner maximization over the epsilon-ball.
• Propose FOSC, a first-order stationary condition for constrained optimization, as a convergence criterion for the inner maximization.
• Show closed-form expression for FOSC and its relation to perturbation and gradient, linking smaller FOSC to stronger adversaries.
• Propose a dynamic adversarial training algorithm that progressively reduces the FOSC threshold over training epochs.
• Provide a convergence analysis showing sublinear convergence to a stationary point up to a delta-precision related to the inner maximization error.
• Experimentally compare Dynamic training to Standard and Curriculum adversarial training on MNIST and CIFAR-10, including WideResNet settings.

Experimental results

Research questions

• RQ1 How can we quantify the convergence quality of the inner maximization in adversarial training?
• RQ2 Is FOSC a reliable indicator of adversarial strength and downstream robustness?
• RQ3 Does a dynamic curriculum that increases adversarial strength over time improve robustness compared to fixed-strength PGD adversarial training?
• RQ4 What are the theoretical convergence guarantees for the proposed dynamic adversarial training approach?
• RQ5 How does dynamic adversarial training perform against white-box and black-box attacks on MNIST and CIFAR-10, including larger-capacity networks?

Key findings

• FOSC correlates linearly with adversarial strength (accuracy decreases and loss increases as FOSC decreases).
• Training with higher convergence quality adversarial examples later in training yields better robustness; early-stage high-convergence-adversary training can hurt robustness.
• Dynamic adversarial training, which gradually tightens FOSC thresholds, significantly improves robustness over standard PGD adversarial training, especially on CIFAR-10.
• Theoretical analysis shows convergence to a first-order stationary point at sublinear rate up to a delta-precision determined by inner maximization accuracy (delta).
• Empirical results show Dynamic training achieving strong white-box and black-box robustness on MNIST and CIFAR-10, with notable gains on CIFAR-10 and with WideResNet architectures.