[Paper Review] Robust Local Features for Improving the Generalization of Adversarial Training

Chuanbiao Song, Kun He+3 more|arXiv (Cornell University)|Sep 23, 2019

Adversarial Robustness in Machine LearningComputer Science31 references34 citations

TL;DR

The paper introduces RLFAT, which learns robust local features via Random Block Shuffle during adversarial training and transfers this knowledge to normal adversarial training, improving both adversarial robustness and standard generalization across datasets.

ABSTRACT

Adversarial training has been demonstrated as one of the most effective methods for training robust models to defend against adversarial examples. However, adversarially trained models often lack adversarially robust generalization on unseen testing data. Recent works show that adversarially trained models are more biased towards global structure features. Instead, in this work, we would like to investigate the relationship between the generalization of adversarial training and the robust local features, as the robust local features generalize well for unseen shape variation. To learn the robust local features, we develop a Random Block Shuffle (RBS) transformation to break up the global structure features on normal adversarial examples. We continue to propose a new approach called Robust Local Features for Adversarial Training (RLFAT), which first learns the robust local features by adversarial training on the RBS-transformed adversarial examples, and then transfers the robust local features into the training of normal adversarial examples. To demonstrate the generality of our argument, we implement RLFAT in currently state-of-the-art adversarial training frameworks. Extensive experiments on STL-10, CIFAR-10 and CIFAR-100 show that RLFAT significantly improves both the adversarially robust generalization and the standard generalization of adversarial training. Additionally, we demonstrate that our models capture more local features of the object on the images, aligning better with human perception.

Motivation & Objective

• Motivate the investigation of how robust local features influence the generalization gap in adversarial training.
• Propose a method to learn robust local features and transfer them to standard adversarial training.
• Demonstrate the method's compatibility with state-of-the-art adversarial frameworks (PGDAT and TRADES).
• Show empirical improvements in both adversarial robustness and standard accuracy across multiple datasets.

Proposed method

• Introduce Random Block Shuffle (RBS) to disrupt global structure and retain local features during adversarial training.
• Define Robust Local Features for Adversarial Training (RLFAT) by training on RBS-transformed adversarial examples.
• Propose Robust Local Feature Transfer (RLFT) to align high-level features between RBS-transformed and original adversarial inputs.
• Integrate RLFL and RLFT into end-to-end RLFAT loss functions for PGDAT and TRADES variants.
• Provide end-to-end training algorithm that combines RBSAT and RLFT (Algorithm 1).
• Evaluate on STL-10, CIFAR-10, CIFAR-100 against white-box (PGD, CW) and black-box (NAttack) attacks.

Experimental results

Research questions

• RQ1 Can robust local features learned during adversarial training generalize better to unseen data than global-structure biased features?
• RQ2 Does learning robust local features via RBS and transferring them to normal adversarial training improve both robustness and standard accuracy?
• RQ3 Is RLFAT compatible with existing adversarial training frameworks (PGDAT and TRADES) and dataset scales?
• RQ4 Do models trained with RLFAT show salience maps aligned more with human perception?
• RQ5 What is the impact of robust local feature transfer on performance under distribution shifts (brightness and gamma)?

Key findings

• RLFAT consistently improves adversarial robustness and standard accuracy over PGDAT and TRADES across STL-10, CIFAR-10, and CIFAR-100.
• RLFAT_T achieves higher adversarial robust generalization and standard generalization than TRADES on the tested datasets.
• RLFAT_P also outperforms PGDAT in robustness and maintains superior standard accuracy.
• Salience maps for RLFAT models indicate increased emphasis on local features, aligning more with human perception.
• Loss-sensitivity analyses show RLFAT yields smoother loss under brightness and gamma distribution shifts.