Improving Global Adversarial Robustness Generalization
With Adversarially Trained GAN

Since Szegedy et al. [14] first discovered the vulnerability of neural networks to the adversarial examples, researches have proposed various of adversarial attacks methods to generate adversarial examples for evaluating the worst-case robustness of the neural network models. These works generate small perturbations under $L_{p}$ norm constrains, such as $L_{0}$ norm, $L_{2}$ norm or $L_{\infty}$ norm. For the $L_{0}$ norm constrain, Papernot et al. [19] proposed JSMA method, Su et al. [20] proposed one pixel attack method. For the $L_{2}$ norm constrain, Carlini and Wagner [21] proposed C&W attack method, Moosavi-Dezfooli at al. [22] proposed DeepFool method. For the $L_{\infty}$ norm, Szegedy et al. [14] proposed L-BFGS method, Goodfellow at al. [15] proposed FGSM method, Madry et al. [24] proposed PGD method.

Many adversarial defense methods have been proposed to make the neural network models robust to the $L_{p}$ norm constrained adversarial examples. These works include modifying the input such as data compression [26] and feature squeezing [35], modifying the network such as stochastic activation pruning [47] and Deep Contractive Network [28], adding auxiliary network such as Defense-gan [37], Pixeldefend [36], and Magnet [38]. Nevertheless, these methods are demonstrated to fail to defend against the adversarial examples. AT [24] trains the neural network models on the adversarial examples in a min-max manner, which is by so far the only defense method that can improve the adversarial robustness of the neural networks.

Although AT can improve the adversarial robustness of CNNs, the CNNs trained by AT still suffer from the problem of poor adversarial robustness generalization performance. Schmidt et al. [42] point out that adversarial robustness generalization requires much more labeled data than standard generalization. Based on this theoretical work, a follow-up work done by Zhai et al. [48] demonstrates that the labeled sample complexity for adversarial robustness generalization can be largely reduced if unlabeled data is used, and an adversarially robust model which generalizes well can be learned if we have plenty of unlabeled data. Another independent work done by Uesato et al. [49] also shows that an Unsupervised Adversarial Training (UAT) algorithm which uses unlabeled data together with very limited labeled data can significantly improve the adversarial robustness generalization performance achieved by purely supervised approaches. Carmon et al. [50] show that unlabeled data can fill the sample complexity gap between adversarial robustness generalization and standard generalization through a self-training algorithm. Najafi et al. [51] extent the Distributionally Robust Learning (DRL) method to handle Semi-Supervised Learning (SSL). Their proposed method demonstrates a comparable performance to that of the state-of-the-art method. Besides, two interesting works [52, 53] show that self-supervised learning can improve the adversarial robustness of the CNNs.

Generative Adversarial Networks (GANs) are an approach to generative modeling using deep learning methods such as CNNs. The idea of GANs was first introduced by Goodfellow et al. [54] in 2014. The architecture of GANs consists of a generator that aims to generate photo-realistic images from randomly selected noise vectors, and a discriminator that aims to discriminate between real images and generated images. The generator and the discriminator are trained simultaneously in a zero-sum game. Although the impressive results achieved by GANs, the training process of GANs is unstable. In [55], the authors give an architecture guideline for designing both the generator and the discriminator, which is demonstrated can result in stable GANs models. Based on these works, plenty of methods that extend GANs on the architecture or the loss function are proposed and achieve state-of-the-art results on various applications. Among these methods, the most related ones to our work are conditional GANs (cGANs) for image-to-image translation [56] and Auxiliary Classifier GANs (AC-GANs) [57]. The cGANs learn to map from conditional information $c$ and random noise vector $z$ to commonly an image $y$, $G:\{c,z\}\rightarrow y$, which is different from the traditional GANs that learn a mapping from random noise vector $z$ to output image $y$, $G:z\rightarrow y$. In [56], the authors use images as the conditional information and leverage an image-to-image network to generate synthetic images from images of other domain. The AC-GANs modify the discriminator to contain an auxiliary classifier that outputs the class label for the training data. The experimental results show that the GANs tasked with classification objective result in higher quality samples.

The main idea of ATGAN is incorporating AT into the standard GANs training procedure in order to remove the obfuscated gradients in GANs. Formally, a standard classification task can be defined as finding the set of model parameters $\theta\in\mathbb{R}^{p}$ that minimize the empirical risk $\mathbb{E}_{(x,y)\sim D}[L(x,y,\theta)]$ where $x\in\mathbb{R}^{d}$ and $y\in[k]$ are pairs of examples and corresponding class labels sampled from the empirical data distribution $D$ and $L(x,y,\theta)$ is a loss function such as the cross-entropy loss for a neural network. Although yielding classifiers with high standard generalization accuracy, empirical risk minimization (ERM) doesn’t ensure the robustness to adversarial examples. AT extends ERM through robust optimization. In AT, a threat model is specified which defines the attacks the classifiers should be robust to. During training, instead of directly feeding into the loss $L$ the samples from the distribution $D$, AT allows the threat model to perturb the samples first. This can be formalized as the min-max optimization problem:

where $S\subseteq\mathbb{R}^{d}$ is the set of perturbations the threat model can find, such as the union of the $L_{\infty}$-balls around the clean examples $x$. In this min-max optimization, the inner maximization problem finds an adversarial example that maximizes the loss, which is solved by projected gradient descent (PGD) [24]:

The outer minimization problem finds model parameters so that the loss is minimized on the adversarial examples found by the inner maximization, which can be solved by back-propagation for neural networks. AT doesn’t rely on obfuscated gradients when defending against the adversarial examples. GANs are also adopted as adversarial defense method based on the idea of mapping the adversarial examples back onto the manifold of the clean examples. However, the GANs trained by the standard training procedure have obfuscated gradients that give a false sense on the adversarial robustness. In order to remove the obfuscated gradients in GANs, making GANs truly robust against adversarial examples, ATGAN incorporates AT into the standard GANs training procedure. For ATGAN, the inner maximization problem in the min-max optimization 1 is modified as:

where $G$ is the image-to-image network generator of ATGAN. Before fed into the classifier, the samples are first mapped by the generator. During the inner maximization, the generator combined with the classifier, or the discriminator here, is treated as a whole classifier which the threat model aims to generate the adversarial examples against. This operation not only guarantees that ATGAN can learn the mapping from the distribution of the adversarial examples to the manifold of the clean examples but also guarantees that the obfuscated gradients in the generator can be removed.

In order to improve the adversarial robustness generalization performance of the CNNs trained by AT, ATGAN uses data augmentation to increase the sample complexity of the adversarial examples. The sample complexity needed by adversarial robustness generalization is higher than that needed by standard generalization. Thus the training data used to train a model with high standard generalization accuracy often cannot yield a model of similar high adversarial robustness generalization accuracy. The image-to-image network generator of ATGAN first encodes the adversarial examples into the low-dimensionality latent space then decodes the latent vectors into the clean example manifold. This operation can reduce the magnitude of the perturbations in the adversarial examples thus can reduce the power of the adversarial examples. ATGAN also adopts the perceptual loss which uses a pre-trained CNN to extract the high-level feature representations, then calculates the difference of the output of the generator and the clean examples based on these high-level feature representations:

where $\phi_{j}$ denotes the activations of the feature map of shape $C_{j}\times H_{j}\times W_{j}$ which are extracted from the $j$th layer of the pre-trained CNN, $\|\cdot\|_{2}$ denotes the Euclidean distance between feature representations. The perceptual loss can drive the output of the generator to be perceptually similar to the clean examples but not match the output of the generator and the clean examples exactly. Therefore the generator plays s role of data augmentation that can increase the sample complexity of the adversarial examples. As a result, ATGAN improves the adversarial robustness generalization performance of the CNNs trained by AT.

The schematic of the architecture of ATGAN is exhibited in Fig. 1. ATGAN consists of an adversarial attacker denoted by A, a generator denoted by G, a discriminator denoted by D, and a loss network denoted by L. The adversarial attacker is the $L_{\infty}$ norm PGD described in section 3.1 which treats the whole network consisted of the generator and the discriminator as a classifier and attacks this classifier to generate adversarial examples in one training epoch according to formula 2, indicated by Fig. 1 (a). The generated adversarial examples and their clean examples counterparts are then used to train the generator and the discriminator during the same training epoch. The generator is a fully convolutional image-to-image network that maps the adversarial examples onto the clean examples manifold. The strided convolutions and deconvolutions are adopted to downsample and upsample the adversarial examples instead of pooling layers. Tanh nonlinearity is adopted for the output layer to bound the values of the pixels in the range $[0,1]$. The exact architectures and hyper-parameters of the generators are different for different datasets, which are shown in Table 1. ATGAN adopts an AC-GANs-like discriminator which has an auxiliary classifier tasked with reconstructing the class labels of the inputs. The discrimination output of the discriminator produces a scalar value between 0 and 1 that indicates how likely the input image is a clean image. The classification output of the discriminator produces a $k$-dimensional vector that indicates the discrete probability distribution of $k$ classes. The discriminator is used to discriminate the adversarial examples and the clean examples and predict their class labels simultaneously. The discrimination task can drive the generator to output images that are similar to the clean examples and the classification task can further improve the perceptual quality of the output images. The CNN used in [21], the DenseNet40 [59] and the ResNet18 [60] are adopted as discriminators respectively for MNIST SVHN and CIFAR-10 datasets. ATGAN adopts a pre-trained CNN as the loss network and the activations of the first convolutional layers of the loss network are used to calculate the perceptual loss for the feature representations extracted from early layers of the loss network tends to encourage the generator to produce images that are visually realistic. The architectures of the loss network are the same with the discriminators for MNIST SVHN and CIFAR-10 datasets, except that there is no discrimination output.

ATGAN incorporates AT into standard GANs training procedure to remove obfuscated gradients and improve the adversarial robustness generalization performance of the CNN classifiers trained by AT. Thus the loss functions for both AT and GANs are extended by ATGAN.

It is noted that there are several important differences between ATGAN and the previous similar works [46, 39]. The Rob-GAN [46] also incorporates AT into the standard GANs training procedure, but it just adversarially trains the discriminator, which is different from ATGAN where the AT is applied to the whole classifier consisted of the generator and the discriminator. The generator of the Rob-GAN takes a noise vector and a class label as input, but the inputs of the generator of ATGAN are adversarial examples. The APE-GAN [39] adversarially trains the GAN, but the procedure of generating the adversarial examples is not incorporated into the GANs training procedure. They generate the adversarial examples on the target classifier they aim to defend then use the generated adversarial examples to train the GAN. The discriminator of the APE-GAN doesn’t task with classification objective. And both Rob-GAN and APE-GAN don’t use the perceptual loss.

We evaluate ATGAN on three standard datasets: MNIST SVHN and CIFAR-10. MNIST is a dataset of handwritten digits containing 70000 $28\times 28$ gray images in 10 classes. The training set contains 60000 samples and the testing set contains 10000 samples. SVHN is a dataset containing 10 classes of street view house numbers RGB images of size $32\times 32$. The training set contains 73257 samples and the testing set contains 26032 samples. CIFAR-10 is a dataset containing 60000 $32\times 32$ RGB images in 10 classes. The training set contains 50000 samples and the testing set contains 10000 samples.

ATGANs and the baseline models are trained by AT to resist the $L_{\infty}$ norm bounded adversarial examples using PGD. The number of steps of PGD is set to be 40 for MNIST and 7 for SVHN and CIFAR-10. The step size of PGD $\alpha$ is set to be 1 for MNIST and 2/255 for SVHN and CIFAR-10. To compare the global adversarial robustness generalization performance of ATGANs and the baseline models, we set a range of magnitudes of the perturbations during training and testing which are denoted by $\epsilon_{t}$ and $\epsilon_{i}$. We choose $\epsilon_{t}$ from the range [0.1, 0.15, 0.2, 0.25, 0.3] and $\epsilon_{i}$ from the range [0.1, 0.15, 0.2, 0.25, 0.3, 0.35, 0.4, 0.45, 0.5] for MNIST. We choose $\epsilon_{t}$ from the range [2/255, 4/255, 6/255, 8/255, 10/255] and $\epsilon_{i}$ from the range [2/255, 4/255, 6/255, 8/255, 10/255, 12/255, 14/255, 16/255, 18/255, 20/255] for SVHN and CIFAR-10. In addition to the standard AT procedure, we adopt another AT procedure which is of more generality: only use a fraction of adversarial examples in each mini-batch, and the rest of each mini-batch is replaced with clean examples. We denote this method by FracAT.

Three baseline models–a plain CNN [21], DenseNet40 [59], and ResNet18 [60]–are trained on MNIST SVHN and CIFAR-10. For comparison, the architectures of the baseline models are set to be the same with the discriminators of ATGANs but discard the discrimination outputs.

On MNIST we use Adam optimizer, learning rate of 0.001, batch size of 128, and epochs of 50 for both the generator and the discriminator. The loss weights are set as $\alpha=1$, $\beta=1$, and $\gamma=10$. On SVHN we use batch size of 64 and epochs of 40 for both the generator and the discriminator. The Adam optimizer parameterized with learning rate of 0.0002, $\beta_{1}$ of 0.5, and $\beta_{2}$ of 0.999 is used for the generator, and the Momentum optimizer parameterized with initial learning rate of 0.1 and momentum of 0.9 is used for the discriminator, the learning rate of the discriminator decays by a factor of 10 at epoch 20 and 30. The loss weights are set as $\alpha=1$, $\beta=1$, and $\gamma=10$. On CIFAR-10 we use batch size of 128 and steps of 80000 for both the generator and the discriminator. The Adam optimizer parameterized with learning rate of 0.0002, $\beta_{1}$ of 0.5, and $\beta_{2}$ of 0.999 is used for the generator, and the Momentum optimizer parameterized with initial learning rate of 0.1 and momentum of 0.9 is used for the discriminator, the learning rate of the discriminator decays by a factor of 10 at epoch 100 and 150. The loss weights are set as $\alpha=5$, $\beta=4$, and $\gamma=10$.

The recently proposed robustness curves [61] is used to quantitatively evaluate the global robustness of different models. Accuracy is adopted instead of the error to plot the robustness curves in this paper. According to Risse et al. [62], the commonly adopted scaler perturbation threshold fails to capture important global robustness properties, thus is not sufficient to reliably and meaningfully compare the robustness of different models. The saliency maps [63] is used to qualitatively evaluate the robustness of the features learned by different models.