[论文解读] Improving the Generalization of Adversarial Training with Domain Adaptation

Chuanbiao Song, Kun He+2 more|arXiv (Cornell University)|Oct 1, 2018

Adversarial Robustness in Machine Learning参考文献 27被引用 47

一句话总结

ATDA 将基于 FGSM 的对抗训练重新表述为一个领域适应问题，以对齐干净与对抗表示，从而在对多种攻击的泛化能力方面得到提升，同时保持对干净数据的合理准确率。

ABSTRACT

By injecting adversarial examples into training data, adversarial training is promising for improving the robustness of deep learning models. However, most existing adversarial training approaches are based on a specific type of adversarial attack. It may not provide sufficiently representative samples from the adversarial domain, leading to a weak generalization ability on adversarial examples from other attacks. Moreover, during the adversarial training, adversarial perturbations on inputs are usually crafted by fast single-step adversaries so as to scale to large datasets. This work is mainly focused on the adversarial training yet efficient FGSM adversary. In this scenario, it is difficult to train a model with great generalization due to the lack of representative adversarial samples, aka the samples are unable to accurately reflect the adversarial domain. To alleviate this problem, we propose a novel Adversarial Training with Domain Adaptation (ATDA) method. Our intuition is to regard the adversarial training on FGSM adversary as a domain adaption task with limited number of target domain samples. The main idea is to learn a representation that is semantically meaningful and domain invariant on the clean domain as well as the adversarial domain. Empirical evaluations on Fashion-MNIST, SVHN, CIFAR-10 and CIFAR-100 demonstrate that ATDA can greatly improve the generalization of adversarial training and the smoothness of the learned models, and outperforms state-of-the-art methods on standard benchmark datasets. To show the transfer ability of our method, we also extend ATDA to the adversarial training on iterative attacks such as PGD-Adversial Training (PAT) and the defense performance is improved considerably.

研究动机与目标

• 激发神经网络对对抗样本的鲁棒性，并解决对未见攻击的泛化能力不足的问题。
• 提出一种领域适应框架，在对数空间中弥合干净数据与对抗数据之间的差距。
• 将无监督和有监督的领域适应与标准对抗训练相结合以提升泛化能力。
• 在常用数据集上证明有效性，并扩展到像 PGD 这样的迭代攻击。

提出的方法

• 将对抗训练建模为在对数空间中干净域与对抗域之间的领域适应。
• 使用无监督领域适应损失：CORAL 用于对齐协方差，MMD 用于对齐干净与对抗表示之间的均值。
• 引入基于边际的有监督领域适应损失，以降低类内变化并增加类间分离，中心更新方式类似于 center loss。
• 使用 FGSM 变体生成对抗样本以避免标签泄漏，并将它们与一个综合损失一起加入训练：对干净数据和对抗数据进行分类，以及域适应项。
• 定义一个综合目标，其中包含干净和对抗数据的标准分类损失，以及一个用于域对齐（UDA + SDA）的正则化项，平衡参数为 lambda。
• 概述一个迭代算法：逐步采样小批量、创建对抗样本、更新类别中心，并优化网络与中心。

实验结果

研究问题

• RQ1 领域适应技术是否能够在对数空间中减少干净数据与对抗数据之间的分布差距？
• RQ2 对矩和协方差的对齐（UDA）加上基于类别的对齐（SDA）是否提高对FGSM之外的未见攻击者的泛化能力？
• RQ3 ATDA 是否与标准对抗训练兼容并且能够扩展到像 PGD 这样的迭代攻击？
• RQ4 与传统对抗训练相比，ATDA 对干净准确率和模型平滑性有何影响？

主要发现

• 与标准对抗训练及一些最先进基线相比，ATDA 在对多种受限对手的泛化能力上有所提升。
• UDA 和 SDA 组件有助于实现领域不变性和鲁棒性，消融实验显示域对齐带来显著收益。
• 相对于基线，ATDA 产生的模型更加平滑，局部损失敏感性降低。
• 学习到的对数表示在干净域与对抗域之间的分布对齐程度高于其他方法（MMD 距离更低）。
• ATDA 可以扩展为 PATDA 用于基于 PGD 的对抗训练，在若干数据集上相较 PAT 获得更强的鲁棒性，尽管结果因数据集而异。