[Paper Review] Unifying Adversarial Training Algorithms with Flexible Deep Data Gradient Regularization

Alexander G. Ororbia, C. Lee Giles+1 more|arXiv (Cornell University)|Jan 26, 2016

Adversarial Robustness in Machine Learning11 references17 citations

TL;DR

This paper introduces DataGrad, a unified framework for adversarial training that regularizes deep neural network gradients using flexible L1/L2 penalties. By optimizing a general regularized objective, DataGrad subsumes prior adversarial training methods and achieves state-of-the-art robustness, outperforming classical L1/L2 and multi-task regularization on both clean and adversarial data, especially when combined with multi-task learning.

ABSTRACT

Many previous proposals for adversarial training of deep neural nets have included di- rectly modifying the gradient, training on a mix of original and adversarial examples, using contractive penalties, and approximately optimizing constrained adversarial ob- jective functions. In this paper, we show these proposals are actually all instances of optimizing a general, regularized objective we call DataGrad. Our proposed DataGrad framework, which can be viewed as a deep extension of the layerwise contractive au- toencoder penalty, cleanly simplifies prior work and easily allows extensions such as adversarial training with multi-task cues. In our experiments, we find that the deep gra- dient regularization of DataGrad (which also has L1 and L2 flavors of regularization) outperforms alternative forms of regularization, including classical L1, L2, and multi- task, both on the original dataset as well as on adversarial sets. Furthermore, we find that combining multi-task optimization with DataGrad adversarial training results in the most robust performance.

Motivation & Objective

• To unify diverse adversarial training algorithms under a single, principled framework.
• To address the challenge of training robust deep neural networks against adversarial perturbations.
• To provide an efficient, back-propagation-compatible method for optimizing deep gradient regularizations.
• To demonstrate that deep gradient regularization improves generalization and robustness beyond standard L1/L2 and multi-task approaches.

Proposed method

• Proposes a general regularized objective function, DataGrad, defined as a weighted sum of the main loss and regularizers applied to deep gradients.
• Uses back-propagation to compute gradients of the regularized objective with respect to network weights, enabling end-to-end training.
• Employs L1 and L2 norms as regularizers on the deep gradient of the loss with respect to input data, enabling flexible and robust optimization.
• Extends the framework to multi-task learning by applying regularizers to both main and auxiliary task gradients.
• Derives a deterministic, differentiable algorithm for training with deep gradient penalties, avoiding approximations used in prior work.
• Applies the framework to generate adversarial examples via gradient-based perturbations and trains models to be robust under such perturbations.

Experimental results

Research questions

• RQ1 Can a unified framework be developed to encompass diverse adversarial training approaches based on gradient regularization?
• RQ2 How does deep gradient regularization compare to classical L1/L2 and multi-task regularization in terms of robustness on clean and adversarial data?
• RQ3 What is the impact of combining multi-task learning with deep gradient regularization in adversarial training?
• RQ4 Can the proposed DataGrad framework be efficiently optimized using standard back-propagation without approximations?
• RQ5 Does the use of flexible gradient regularization improve generalization and robustness in deep neural networks?

Key findings

• DataGrad with L2 regularization (DGL2) outperforms classical L2 and L1 regularization, achieving 98.83% test accuracy on clean MNIST data under strong adversarial noise.
• The multi-task DataGrad-L1 variant (MT-DGL1) with λ=0.1 and φ=0.1 achieves 99.03% accuracy on clean data and 98.12% on adversarial data, significantly outperforming standard multi-task learning.
• Combining multi-task learning with DataGrad regularization yields the most robust performance, with MT-DGL1 achieving 98.90% accuracy on adversarial examples under φ=0.1 noise.
• DataGrad-L2 with λ=0.01 and φ=0.1 achieves 97.66% accuracy on adversarial data under φ=0.05 noise, surpassing all other methods in robustness.
• The proposed framework generalizes prior approaches, such as those by Miyato et al. and Huang et al., by showing they are special cases of the unified DataGrad objective.
• The ablation study confirms that deep gradient regularization is more effective than standard L1/L2 and multi-task regularization, especially under high-strength adversarial attacks.