[论文解读] Cross-Entropy Loss and Low-Rank Features Have Responsibility for Adversarial Examples

Kamil Nar, Orhan Öçal+2 more|arXiv (Cornell University)|Jan 24, 2019

Adversarial Robustness in Machine Learning被引用 30

一句话总结

本文 identifies cross-entropy loss and low-rank features in neural network activations as key causes of adversarial examples. It proposes differential training—a novel loss function based on inter-class feature differences—that enforces a large margin between classes, significantly reducing adversarial success rates on CIFAR-10, even generalizing well to test data.

ABSTRACT

State-of-the-art neural networks are vulnerable to adversarial examples; they can easily misclassify inputs that are imperceptibly different than their training and test data. In this work, we establish that the use of cross-entropy loss function and the low-rank features of the training data have responsibility for the existence of these inputs. Based on this observation, we suggest that addressing adversarial examples requires rethinking the use of cross-entropy loss function and looking for an alternative that is more suited for minimization with low-rank features. In this direction, we present a training scheme called differential training, which uses a loss function defined on the differences between the features of points from opposite classes. We show that differential training can ensure a large margin between the decision boundary of the neural network and the points in the training dataset. This larger margin increases the amount of perturbation needed to flip the prediction of the classifier and makes it harder to find an adversarial example with small perturbations. We test differential training on a binary classification task with CIFAR-10 dataset and demonstrate that it radically reduces the ratio of images for which an adversarial example could be found -- not only in the training dataset, but in the test dataset as well.

研究动机与目标

• To identify the root causes of adversarial examples in deep neural networks.
• To analyze how cross-entropy loss and low-rank feature structures contribute to poor decision boundary margins.
• To propose a training scheme that improves generalization and robustness against adversarial perturbations.
• To demonstrate that differential training leads to better robustness on both training and test data.

提出的方法

• Propose a new loss function based on the differences between features of points from opposite classes.
• Use gradient descent to minimize this loss, which encourages large geometric margins between classes in the penultimate layer.
• Theoretically prove that minimizing this loss leads to the optimal hard margin solution for linear classifiers.
• Apply the method to nonlinear networks via a modified loss function and test it on CIFAR-10.
• Use projected gradient descent attacks to evaluate robustness on both training and test sets.
• Demonstrate that the resulting model maintains high accuracy on adversarial examples from both training and test distributions.

实验结果

研究问题

• RQ1 Why do state-of-the-art neural networks exhibit high vulnerability to small adversarial perturbations despite high accuracy on clean data?
• RQ2 How does the use of cross-entropy loss contribute to the formation of decision boundaries close to training data points?
• RQ3 To what extent do low-rank features in the penultimate layer of deep networks enable small perturbations to misclassify inputs?
• RQ4 Can a training objective based on inter-class feature differences produce larger margins and improved robustness?
• RQ5 Does the proposed method generalize robustness to adversarial examples beyond the training distribution?

主要发现

• Differential training reduces the ratio of adversarial examples found in both training and test sets on CIFAR-10 to near zero under PGD attack.
• The network trained with differential training generalizes robustness to adversarial examples, maintaining high accuracy on both training- and test-generated perturbations.
• Empirical results confirm that features in the penultimate layer of trained networks are low-rank, supporting the theoretical analysis.
• Theoretical analysis shows that minimizing the differential loss via gradient descent converges to the optimal hard margin solution for linear classifiers.
• The method improves robustness without sacrificing clean accuracy, and the robustness generalizes across data distributions.
• The study establishes a causal link between cross-entropy loss and adversarial vulnerability via low-rank feature structures.