[论文解读] Intriguing properties of adversarial training at scale

Cihang Xie, Alan Yuille|arXiv (Cornell University)|Jun 10, 2019

Adversarial Robustness in Machine Learning参考文献 41被引用 17

一句话总结

本论文揭示了在 ImageNet 上大规模对抗训练的两个关键特性：(1) 当在混合的干净样本与对抗样本上进行训练时，批量归一化（BN）会因域偏移而损害模型的鲁棒性，而将干净样本与对抗样本的归一化统计量分离可显著提升鲁棒性；(2) 当前的‘深度’网络（如 ResNet-152）对于对抗学习而言仍显不足，更深的架构（如 ResNet-638）能带来显著且一致的鲁棒性提升。

ABSTRACT

Adversarial training is one of the main defenses against adversarial attacks. In this paper, we provide the first rigorous study on diagnosing elements of adversarial training, which reveals two intriguing properties. First, we study the role of normalization. Batch normalization (BN) is a crucial element for achieving state-of-the-art performance on many vision tasks, but we show it may prevent networks from obtaining strong robustness in adversarial training. One unexpected observation is that, for models trained with BN, simply removing clean images from training data largely boosts adversarial robustness, i.e., 18.3%. We relate this phenomenon to the hypothesis that clean images and adversarial images are drawn from two different domains. This two-domain hypothesis may explain the issue of BN when training with a mixture of clean and adversarial images, as estimating normalization statistics of this mixture distribution is challenging. Guided by this two-domain hypothesis, we show disentangling the mixture distribution for normalization, i.e., applying separate BNs to clean and adversarial images for statistics estimation, achieves much stronger robustness. Additionally, we find that enforcing BNs to behave consistently at training and testing can further enhance robustness. Second, we study the role of network capacity. We find our so-called "deep" networks are still shallow for the task of adversarial learning. Unlike traditional classification tasks where accuracy is only marginally improved by adding more layers to "deep" networks (e.g., ResNet-152), adversarial training exhibits a much stronger demand on deeper networks to achieve higher adversarial robustness. This robustness improvement can be observed substantially and consistently even by pushing the network capacity to an unprecedented scale, i.e., ResNet-638.

研究动机与目标

• 诊断 ImageNet 上大规模对抗训练的关键组件，重点关注归一化与网络容量。
• 探究为何批量归一化（BN）在标准训练中表现优异，却在对抗训练中损害鲁棒性。
• 探索相较于标准深度网络，更深的网络是否能克服对抗鲁棒性的局限。
• 评估对抗训练模型中干净准确率与鲁棒性之间的权衡。
• 验证假设：干净样本与对抗样本来自不同的数据域，从而影响归一化效果。

提出的方法

• 在 ImageNet 上使用统一框架进行对抗训练，对比包含与不包含批量归一化（BN）的模型。
• 提出一种双域归一化策略：为干净样本与对抗样本分别使用独立的 BN，以分离其统计量。
• 用组归一化（GN）替代 BN，GN 对每张图像独立估计归一化参数，避免批量统计量混合。
• 在训练与推理阶段强制保持 BN 行为一致，以提升鲁棒性。
• 系统性地将网络深度从 ResNet-152 增加至 ResNet-638，以评估其对对抗鲁棒性的影响。
• 使用基于 PGD 的攻击和标准评估协议来测量鲁棒性与干净准确率。

实验结果

研究问题

• RQ1 为何在混合干净样本与对抗样本的数据上训练时，批量归一化会降低对抗鲁棒性？
• RQ2 能否通过为干净样本与对抗样本分离归一化统计量来提升模型鲁棒性？
• RQ3 在训练与推理阶段强制保持 BN 行为一致，是否能进一步增强鲁棒性？
• RQ4 当前的‘深度’网络（如 ResNet-152）是否足够深以应对对抗学习，还是需要更深的网络容量？
• RQ5 在大规模设置下，增加网络深度如何影响对抗鲁棒性与干净准确率？

主要发现

• 在对抗训练期间从训练数据中移除干净样本，可使基于 BN 的模型鲁棒性提升 18.3%，表明干净样本与对抗样本之间存在域偏移。
• 通过为干净样本与对抗样本分别应用 BN 来分离归一化统计量，可显著提升鲁棒性，优于在混合数据上使用标准 BN 的表现。
• 用组归一化（GN）替代 BN 可实现 67.5% 的干净准确率与强鲁棒性，表明批量统计量混合会损害性能。
• 在训练与推理阶段强制保持 BN 行为一致，可进一步增强鲁棒性，尤其在结合分离归一化策略时效果更显著。
• 将网络深度从 ResNet-152 增加到 ResNet-638，在对抗攻击下鲁棒性提升 2.4%，远超干净训练中 0.5% 的提升，表明更深的网络对对抗学习至关重要。
• 最深的模型 ResNet-638 达到了 68.7% 的干净准确率，比 ResNet-152 提高 6.1%，表明更深的网络也能提升标准准确率。