[Paper Review] You Only Propagate Once: Painless Adversarial Training Using Maximal Principle

Dinghuai Zhang, Tianyuan Zhang+3 more|arXiv (Cornell University)|May 2, 2019

Adversarial Robustness in Machine LearningComputer Science22 references45 citations

TL;DR

YOPO (You Only Propagate Once) is a novel adversarial training method that leverages the Pontryagin's Maximal Principle to reduce computational cost by limiting full forward and backward passes to only one per adversarial update. By exploiting the fact that adversary updates depend only on the first-layer parameters, YOPO achieves comparable robust accuracy to PGD with 1/5 to 1/4 of the GPU time.

ABSTRACT

Deep learning achieves state-of-the-art results in many tasks in computer vision and natural language processing. However, recent works have shown that deep networks can be vulnerable to adversarial perturbations, which raised a serious robustness issue of deep networks. Adversarial training, typically formulated as a robust optimization problem, is an effective way of improving the robustness of deep networks. A major drawback of existing adversarial training algorithms is the computational overhead of the generation of adversarial examples, typically far greater than that of the network training. This leads to the unbearable overall computational cost of adversarial training. In this paper, we show that adversarial training can be cast as a discrete time differential game. Through analyzing the Pontryagin's Maximal Principle (PMP) of the problem, we observe that the adversary update is only coupled with the parameters of the first layer of the network. This inspires us to restrict most of the forward and back propagation within the first layer of the network during adversary updates. This effectively reduces the total number of full forward and backward propagation to only one for each group of adversary updates. Therefore, we refer to this algorithm YOPO (You Only Propagate Once). Numerical experiments demonstrate that YOPO can achieve comparable defense accuracy with approximately 1/5 ~ 1/4 GPU time of the projected gradient descent (PGD) algorithm. Our codes are available at https://https://github.com/a1600012888/YOPO-You-Only-Propagate-Once.

Motivation & Objective

• To address the high computational cost of adversarial training, which stems from repeated generation of adversarial examples.
• To reduce the number of full forward and backward passes during adversarial training without sacrificing robustness.
• To exploit structural properties of the adversarial optimization problem to enable efficient parameter updates.
• To develop a method that maintains high defense accuracy while significantly lowering training time.

Proposed method

• YOPO formulates adversarial training as a discrete-time differential game and applies Pontryagin's Maximal Principle (PMP) to analyze the optimality conditions.
• The analysis reveals that adversary updates depend only on the parameters of the first layer of the network.
• This insight allows YOPO to restrict most forward and backward propagation to the first layer during adversary updates.
• Full network backpropagation is performed only once per group of adversarial updates, drastically reducing computational overhead.
• The method maintains standard network training dynamics while minimizing redundant computation in deeper layers.
• YOPO uses a modified training loop that reuses the first-layer activations and gradients across multiple adversary steps.

Experimental results

Research questions

• RQ1 Can the computational cost of adversarial training be significantly reduced by exploiting the structure of the optimization problem?
• RQ2 Is it possible to limit full backpropagation to a single pass per adversarial update without degrading robustness?
• RQ3 Does the dependency of adversary updates on only the first-layer parameters enable efficient training?
• RQ4 Can a method based on PMP achieve robustness comparable to PGD with substantially reduced training time?

Key findings

• YOPO achieves defense accuracy comparable to PGD on standard benchmarks such as CIFAR-10 and SVHN.
• YOPO reduces GPU training time to approximately 1/5 to 1/4 of that required by PGD.
• The method maintains robustness even when using a single full backpropagation per adversarial update group.
• The computational efficiency gain is achieved without modifying the network architecture or loss function.
• Empirical results confirm that the theoretical insight from PMP holds in practice, enabling effective and efficient training.