[Paper Review] Towards Understanding the Dynamics of the First-Order Adversaries

Zhun Deng, Hangfeng He+2 more|arXiv (Cornell University)|Oct 20, 2020

Advanced Malware Detection Techniques4 citations

TL;DR

This paper provides the first convergence analysis of projected gradient ascent (PGA) for first-order adversarial attacks in two-layer ReLU networks with quadratic loss. It proves PGA converges to a local maximum in polynomial time with high probability, and shows that smaller input scales lead to faster convergence and more regular loss landscapes, validated by experiments on simulated and real-world data.

ABSTRACT

An acknowledged weakness of neural networks is their vulnerability to adversarial perturbations to the inputs. To improve the robustness of these models, one of the most popular defense mechanisms is to alternatively maximize the loss over the constrained perturbations (or called adversaries) on the inputs using projected gradient ascent and minimize over weights. In this paper, we analyze the dynamics of the maximization step towards understanding the experimentally observed effectiveness of this defense mechanism. Specifically, we investigate the non-concave landscape of the adversaries for a two-layer neural network with a quadratic loss. Our main result proves that projected gradient ascent finds a local maximum of this non-concave problem in a polynomial number of iterations with high probability. To our knowledge, this is the first work that provides a convergence analysis of the first-order adversaries. Moreover, our analysis demonstrates that, in the initial phase of adversarial training, the scale of the inputs matters in the sense that a smaller input scale leads to faster convergence of adversarial training and a "more regular" landscape. Finally, we show that these theoretical findings are in excellent agreement with a series of experiments.

Motivation & Objective

• To understand the dynamics of projected gradient ascent (PGA) in the inner maximization step of adversarial training.
• To investigate whether input scale influences the convergence speed and landscape regularity of adversarial training.
• To provide a theoretical foundation for the empirical effectiveness of first-order adversarial training.
• To analyze the non-concave landscape of adversarial perturbations in a two-layer ReLU network with quadratic loss.
• To establish a rigorous convergence guarantee for PGA in the context of adversarial robustness training.

Proposed method

• Analyzes the non-concave landscape of adversarial perturbations in a two-layer ReLU neural network with quadratic loss.
• Uses projected gradient ascent (PGA) as the solver for the inner maximization problem in adversarial training.
• Employs a convergence theorem to prove PGA finds an approximate local maximum in polynomial time with high probability.
• Introduces a geometric argument based on angle between gradients and Hessian approximation to analyze local minima and maxima on the perturbation sphere.
• Conducts experiments on simulated data with varying input scales and hidden widths to validate theoretical findings.
• Performs trajectory tracking on MNIST using PGD to visualize convergence from random perturbations to local maxima.

Experimental results

Research questions

• RQ1 Does projected gradient ascent (PGA) converge rapidly to a local maximum in the adversarial optimization problem?
• RQ2 How does the input scale affect the convergence speed and landscape regularity of adversarial training?
• RQ3 Is there a theoretical guarantee that PGA finds a local maximum rather than getting stuck at a saddle point?
• RQ4 How does the width of the hidden layer influence the adversarial loss landscape?
• RQ5 Are the theoretical insights about input scale and landscape regularity consistent with empirical observations?

Key findings

• Projected gradient ascent converges to a local maximum in polynomial time with high probability, providing the first convergence guarantee for first-order adversarial attacks.
• Smaller input scales lead to faster convergence of adversarial training and result in a more regular loss landscape.
• The adversarial loss landscape becomes more regular as the network width increases, especially when the input scale is small.
• Theoretical analysis shows that for small perturbation radii, the gradient directions are well-separated, enabling efficient convergence.
• Empirical results on MNIST and simulated data confirm that smaller input scales yield faster convergence and smoother trajectories toward local maxima.
• Theoretical and experimental findings are in strong agreement, validating the role of input scale in shaping optimization dynamics.