Pareto Adversarial Robustness: Balancing Spatial Robustness and Sensitivity-based Robustness

The most representative Flow-based Attack is the Spatial Transformed Attack [35], wherein a differentiable flow vector $w_{F}=(\Delta\mu,\Delta v)$ is introduced in the 2D coordinates $(\mu,v)$ to craft adversarial spatial transformation. The vanilla-targeted Flow-based attack [35] follows the optimization manner ($\kappa=0$):

where $f_{\theta}(x)=\left(f_{\theta}^{1}(x),\ldots,f_{\theta}^{K}(x)\right)$ is the classifier in the $K$-classification task. $x_{w_{F}}$ is a Flow-based adversarial example parameterized by the flow vector $w_{F}$. $\mathcal{L}_{flow}$, which measures the local smoothness of the spatial transformation balanced by $\tau$.

Interestingly, our empirical study shown in the left part of Figure 1 suggests that the Flow-based attack tends to yield local permutations among pixels in some specific regions, irrespective of the option of $\tau$, rather than a global spatial transformation based on their shapes. Our analysis indicates that this phenomenon is due to two factors: 1) Local permutations, especially in regions where colors of pixels change dramatically, are already sufficiently sensitive to manipulations, as demonstrated by our empirical results shown in Figure 1. 2) The manner of optimization does not incorporate any sort of shape transformation information, e.g., a parametric equation of rotation, as opposed to the vanilla Rotation-Translation attack, which we present in the following. Therefore, we conclude that Flow-based attacks tend to capture the local spatial vulnerability. Further, to design the integrated spatial attack, we transform Eq 1 into its untargeted version under cross-entropy loss with flow vector bounded by an $\epsilon_{F}$-ball:

where $\mathcal{L}_{\theta}^{\mathrm{CE}}(x,y)=\log\sum_{j}\exp\left(f_{\theta}^{j}(x)\right)-f_{\theta}^{y}(x)$. To maintain a uniform optimization form in our integrated spatial attack, we replace local smoothness term $\mathcal{L}_{flow}$ in Eq. 1 with our familiar $l_{p}$ constraint and leverage the cross-entropy loss instead of the $max$ operation as suggested in [2]. Proposition 1 reveals the correlation between the two losses, indicating that the smooth approximation version of $max$ operation in Eq. 1, denoted as $\mathcal{L}^{S}_{\theta}$, has a parallel updating direction with cross-entropy loss related to $w_{F}$. Proof can be found in B.

The original Rotation-Translation attack [6, 5] applies parametric equation constraints on 2D coordinates, thus capturing the global spatial information:

To design a generic spatial transformation matrix that can simultaneously consider rotation, translation, cropping, and scaling, we re-parameterize the transform matrix as a generic 6-dimensional affine transformation one, inspired by Spatial Transformer Networks [11]:

where we denote $A_{w_{RT}}$ as the generic 6-dimensional affine transformation matrix, in which each entry of $w_{RT}$ indicates the increment in different spatial aspects. For example, $(w_{RT}^{13},w_{RT}^{23})$ determines translation. Finally, the optimization form of the resulting generic and differentiable RT-based attack bounded by $\epsilon_{RT}$-ball is expressed as:

The key to achieving integrated spatial robustness is to design an integrated parameterized sampling grid $\mathcal{T}_{w_{RT},w_{F}}\left(G\right)$ that can wrap the regular grid with both flow and affine transformation, where $G$ is the generated grid. We show our integrated approach as shown below:

Then we sample new $x^{adv}$ by $\mathcal{T}_{w_{RT},w_{F}}\left(G\right)$ via the differentiable bilinear interpolation [11]. Note that $w_{F}$ has the same dimensions as the grid $G$, which are different from the impact of two-dimensional translation parameters in $w_{RT}$. Then the final loss function of the integrated spatial attack can be presented as:

where $\eta_{w}$ is the crafted integrated spatial perturbation parameterized by $w=[w_{F},w_{RT}]^{T}$, simultaneously considering both Flow-based and RT spatial sensitivity. Note that $\eta_{w}$ itself does not necessarily satisfy the $l_{p}$ constraint directly. For the implementation, we follow the PGD procedure [21], a common practice in sensitivity-based attacks. We consider the infinity norm of $w$ and different learning rates for the two types of spatial robustness. Therefore, the updating rule of $w$ in each iteration is:

where $w^{t+1}=[w^{t+1}_{F},w^{t+1}_{RT}]^{T}$ is element-wisely clipped from $\bar{w}^{t+1}$ by $\epsilon=[\bm{\epsilon}_{F},\bm{\epsilon}_{RT}]^{T}$. From Figure 1, we can observe that our Integrated Spatial Attack can construct both local and global spatial transformations on images. Thus, it can simultaneously yield local pixel-wise permutations and global shape transformations.

Then, we visualize the loss surface under this Integrated Spatial Attack leveraging “filter normalization” [18] as illustrated in Figure 2. We strictly follow the implementation from [18] to achieve the desired visualization of the loss landscape of our integrated adversarial attacks for all the differentiable parameters $w$. Specifically, we view $w_{F}$ and $w_{RT}$ as two parameterized filters, which is analogous to the “filter normalization?? technique proposed by [18]. In the left part of Figure 2, we adjust the initialization of the variance of $w$, which then can provide a distant view of loss landscape before the optimization in Eq. 8. It exhibits a highly regular loss landscape, and its non-concavity w.r.t. only rotation and translation  [5] has been tremendously improved. In the middle of Figure 2, we then provide a closer view of the loss landscape before the optimization. It shows a highly convex surface around the $w$ to be optimized, facilitating the following optimization. In the right part of Figure 2, we also present the loss landscape around the maxima $w^{*}$ after the optimization in Eq. 8 of our integrated spatial attack, exhibiting a highly concave surface as well. In summary, the highly non-concave loss landscape concerning only rotation and translation raised by [5] has been largely alleviated by considering both local and global spatial vulnerabilities. This integrated form smooths the optimization process, which guarantees the efficacy of our Integrated Spatial Attack.

As Eq. 9 incorporates local and global spatial robustness simultaneously, it is natural to leverage it to construct Spatial Adversarial Training, which we deploy in Experiment 4.4.

We conduct rigorous experiments on MNIST, CIFAR-$10$, and Caltech-$256$ datasets to empirically examine the behavior of local and global spatial robustness as the sensitivity-based robustness increases. Specifically, after adversarially training multiple PGD (sensitivity-based) robust models with different numbers of PGD iterations, we further compute their test accuracy under Flow-based and RT-based spatial attacks via methods proposed in Section 2. The accuracy is computed on correctly classified test data for the model under consideration to mitigate the impact of the slightly different generalizations of these PGD-trained models. We fix both $\epsilon_{F}$ and $\epsilon_{RT}$ as 0.3 on MNIST, and choose $\epsilon_{F}$ and $\epsilon_{RT}$ as 0.3 and 1.0, respectively, on CIFAR-$10$ and Caltech-$256$. Then, we can control their strength of perturbations by adjusting the number of iterations in Flow-based and RT-based spatial attacks.

In Figure 3, the X-axis shows adversarially PGD-trained models with different numbers of PGD iterations, which can measure the different strengths of a model’s PGD (sensitivity-based) robustness. The Y-axis represents the computed test accuracy of the corresponding PGD-trained models under different spatial attacks, and a high-level test accuracy reflects a model’s high spatial robustness. It turns out that Flow-based spatial robustness (red lines) presents a steady ascending tendency across three datasets as the PGD sensitivity-based robustness increases, while the trend of RT-based spatial robustness (blue lines) fluctuates conversely. This result reveals that the sensitivity-based and RT-based spatial robustness is a trade-off relationship, consistent with the previous conclusion [12, 31]. However, this trade-off does not  (even on the contrary) apply to the local spatial sensitivity, where sensitivity-based and Flow-based spatial robustness is positively correlated. We provide strong and intuitive evidence from the perspective of shape-biased representation below.

We show first with our brief conclusion: the sensitivity-based robustness corresponds to the sparse and shape-bias representation [26, 41], indicating that sensitivity-based robust models rely more on the global shape during prediction rather than the local texture. Nevertheless, the local and global spatial robustness are associated with different representation manners.

We visualize the saliency maps of naturally trained, PGD, Flow-based, and RT adversarially trained models on some randomly selected images on Caltech-$256$, which are exhibited in Figure 4 to examine the shape-biased representation. Specifically, visualizing the saliency maps aims at assigning a sensitivity value, sometimes also called “attribution”, to show the sensitivity of the output to each pixel of an input image. Following [26, 41], we leverage SmoothGrad [27] to calculate the saliency map $S(x)$ of an image $x$, which alleviates the noises in the gradient by averaging over the gradient of $n$ noisy copies of an input:

where $x_{i}=x+q_{i}$, and $q_{i}$ are noises drawn i.i.d from a Gaussian distribution $\mathcal{N}(0,\sigma^{2})$. In our experiment, we set $n=100$ and the noise level $\sigma/(x_{max}-x_{min})=0.1$.

Figure 4 shows that PGD-trained models tend to learn a sparse and shape-biased representation for all pixels of an image, while two types of spatially adversarially trained models suggest a converse representation. In particular, the representation from the Flow-based training model presents a noisy and shape-biased one as it places extreme values, although noisy, on pixels around the shape of objects, e.g., the edge between the horse and the background shown in Flow AT in Figure 4. On the contrary, RT-based models rely less on the shape of objects, and the saliency values tend to be dense, smoothly scattering around more pixels of an image.

We calculate the distance of saliency maps from different models across all test data on the Caltech-$256$ dataset and then compute their skewness in Figure 5. Specifically, we compute the pixel-wise distance between the saliency maps of the two models, and then we calculate the median of the skewness of the saliency map difference for all test data. Note that if two saliency maps have no statistical difference, then the difference in the values will follow a symmetric normal distribution with skewness 0. Negative skewness indicates that the original saliency map (representation) is sparse as compared to the model under consideration. We plot the tendency of skewness as the strength of some specific robustness increases in Figure 5. We summarize the observations into two conclusions:

1. 1.

   Based on the first and fourth sub-pictures, both PGD and Flow-based robust models tend to learn a sparse and shape-biased representation compared with the natural model. However, the Flow-based trained model is less sparse (we call it noisy shape-biased) in comparison with the PGD-trained one.

2. 2.

   In contrast, RT-based robust models tend to learn a dense representation. This is intuitive because the RT-trained model is expected to memorize broader pixel locations to cope with potential rotations and transformations in the test data.

Overall, the divergent representation (sparse vs. dense) between RT-based and sensitivity robustness verifies that the trade-off shown in Figure 3 is fundamental. More importantly, the positive correlation of sensitivity-based and local spatial robustness, shown in Figure 3, can also be explained by their similar shape-biased representation, although the latter tends to be noisy.

We denote $\mathcal{R}_{\text{adv}}(f;S_{i}):=\mathbb{E}_{(x,y)\sim\mathcal{D}}\left[\max_{\bm{r}\in S_{i}}\mathcal{L}(f(x+r),y)\right]$ as the adversarial risk under perturbation sets $S_{i},i=1,...,m.$ Our goal is to find $f_{\theta}$ that can achieve uniform risk minimization across all $S_{i}$ as well as the minimal risk in the natural data. There are two common strategies to handle this issue.

We apply linear scalarization to solve the multi-objective optimization, which is the most commonly used approach. We denote $\alpha=(\alpha_{0},\alpha_{1},\alpha_{2},\alpha_{3})$ as the combination coefficients for various losses. Thus, the objective function is $\min_{\theta}\sum_{i=0}^{3}\mathbb{E}_{x}\left[\alpha_{i}^{*}(\theta)\mathcal{L}_{i}^{\theta}\right]$. Further, within the context of Pareto optimality, our goal is to find optimal combinations $\alpha$ between natural accuracy, sensitivity-based, and spatial robustness to perfectly balance their mutual impacts during the whole training process. Furthermore, we train a model $f_{\theta}$ under the optimal combinations $\alpha^{*}$ of different losses, and the computation of $\alpha^{*}$ in training is also associated with different losses determined by model parameters $\theta$. This implies a bilevel optimization problem with $\theta$ as the upper-level variable and $\alpha$ as the lower-level variable. In the construction of low-level optimization regarding $\alpha$, we apply a two-moment objective function concerning all losses. We name this bi-level optimization as Pareto Adversarial Training, which is formulated as:

where $r$ indicates the expectation of one-moment over all robust losses, i.e., spatial and sensitivity-based losses, which reflects the strength of comprehensive robustness we require after solving this quadratic lower-level optimization regarding $\alpha$. In particular, given the model parameter $\theta$ in each training step, the larger $r$ we require will push the resulting $\alpha_{i},i=1,2,3$ larger, thus increasing the weight of the robust losses rather than the natural loss to pursue more robustness.

A detailed algorithm description is given in Algorithm 1. In the lower-level procedure of Pareto adversarial training, we solve the quadratic optimization regarding $\alpha$ given $\theta$ in each training step to obtain the optimal combinations among natural loss, sensitivity-based, and spatial adversarial loss. Then in the upper-level optimization, we leverage our familiar SGD method to update $\theta$ based on $\alpha^{*}$ calculated from the lower-level problem. Note that the computation complexity of our method is similar to Ave AT and Max AT, which are still competitive in computation.

By adjusting the upper bound of the expected adversarial robustness loss $r$, we can evenly generate Pareto optimal solutions where the obtained models will have different levels of robustness under optimal combinations. The set of all Pareto optimal solutions then forms the Pareto front. Rigorously, it is almost impossible to attain all Pareto optimal solutions for a general continuous multi-objective optimization problem unless a closed-form solution exists for each $r$. Alternatively, we leverage the limited solutions obtained by solving a series of multi-objective optimization problems for various $r$ to approximate the Pareto front.

Thus, we train deep neural networks under different adversarial training strategies, i.e., PGD Adversarial Training (PGD AT), Spatial Adversarial Training (Spatial AT) proposed in Section 2.4, Max AT, Ave AT, and Pareto Adversarial Training (Pareto AT) under different $r$, in which we apply a proper iteration. Then we evaluate their test accuracy under PGD, Flow-based, and RT attacks under different perturbation strengths. Next, we average the test accuracies for each type of attack, and the result is a quantitative measure of the specific robustness, called Robustness Score. To evaluate the universal robustness, we further compute the average of Robustness Scores for all kinds of robustness and use the increment over the naturally trained model as the metric called Universal Robustness Score. We report the Robustness Scores of all models on CIFAR-10 in Table 1, and the results on the other two datasets are similar. All implementation details are provided in E. It shows that Pareto AT ($r=4.0$) has the best universal robustness score among all the models considered, although the highest specific robustness normally exists in the adversarial training model that only focuses on it.

Finally, we plot the universal robustness scores and the sacrificed clean accuracy of all methods across three datasets in Figure 7, where multiple Pareto AT models (red points) are trained under different $r$. The Pareto criterion exhibited in Figure 7 provides an optimality principle, which enables Pareto Adversarial Training to achieve the best universal robustness among all the methods considered, given a certain tolerable level of sacrificed clean accuracy. By adjusting the expected universal robustness $r$ in Pareto Adversarial Training, we can develop the set of Pareto optimal solutions, i.e., the Pareto front. It shows that all other methods are above our Pareto front and are less effective than our proposal.

Overall, we conclude that Pareto adversarial training perfectly balances the mutual impacts of sensitivity-based robustness and spatial robustness under the Pareto criterion.