Transferring Adversarial Robustness
Through Robust Representation Matching

Despite state-of-the-art performance in numerous domains, deep neural networks (DNNs) remain vulnerable to adversarial examples, inputs that are imperceptibly modified such that they are misclassified by DNNs [23]. In response to the discovery of adversarial examples, several techniques have been proposed to improve the robustness of DNNs against such inputs [15, 19, 27]. Adversarial training is one such technique that augments the training data with adversarial examples. During training, adversarial examples are generated on the fly and used to tune the network weights. Although adversarial training is simple to implement and secure against a wide array of attacks [1, 15], it slows down the training process significantly and scales poorly with respect to model complexity and input dimension. In our experiments, for example, adversarial training is on average $\sim 7\times$ slower than natural training. The expensive computational cost of adversarial training is only exacerbated by improvements to model architecture or new data. When new state-of-the-art model architectures are developed, adversarial training must be re-done in order to obtain adversarially robust models. These events make adversarial training impractical to use in real world settings, where models are frequently tweaked to improve performance. Therefore, it is desirable to be able to transfer adversarial robustness between models of different architectures to reduce the cost associated with adversarial training.

Ilyas et al. [14] demonstrated that adversarial examples are the result of a model’s reliance on non-robust features, i.e., highly predictive features that are incomprehensible to humans, whose correlation with the predicted label can be easily flipped with a small amount of noise. They argue that adversarial training works by forcing the model to assign higher priority to the robust features for classification. Thus, if the non-robust information can be removed from the dataset, adversarially robust models should be obtainable through standard training. To this end, they design a robust dataset generation process, which first adversarially trains a model and then uses the learned features in the model to transform the original dataset. Their results demonstrated that new models naturally trained on the robust dataset were more adversarially robust than the models naturally trained on the original dataset.

While the work by Ilyas et al. [14] is a step towards transferable adversarial robustness, it suffers from two significant limitations. First, compared to an adversarially trained model, the adversarial robustness of a model trained on the robust dataset is poor. When evaluated against $\ell_{2}$-bounded adversary with $\epsilon=0.5$, the adversarial constraint, a ResNet50 model trained on the robust dataset achieves $21.8\%$ adversarial accuracy. This is a significant improvement over the same model trained on original dataset, which exhibits $0\%$ adversarial accuracy. However, the performance falls significantly when evaluated against $\epsilon=1.0$, the value used for adversarial training. In this case, the ResNet50 model trained on robust data achieves only $2.3\%$ adversarial accuracy. Second, generating a robust dataset from an existing adversarially trained model is slow. In our experiments, it took approximately $6$ hours with a Titan V GPU to generate a robust CIFAR-10 dataset using an adversarially trained ResNet18 model and the default hyperparameters provided by Ilyas et al. [14].

In this paper, we propose Robust Representation Matching (RRM), a novel, low-cost method to transfer adversarial robustness using a student-teacher framework. Similar to prior works, RRM first adversarially trains a model. Then, using the adversarially trained model as a teacher, RRM trains a new student model by modifying the training loss to include a novel robust representation loss term. This new term encourages the student model to learn the teacher’s robust features. In essence, RRM transfers the teacher’s robust features directly to the student as part of standard training rather than expecting the student to learn robust features from the data. RRM can transfer robustness even between models of different architectures. Our proposed method outperforms other adversarial robustness transfer methods including the method demonstrated by Goldblum et al. [10], which employs a more traditional distillation approach [12] to transfer adversarial robustness from an adversarially trained teacher to a student using standard training.

Using RRM’s student-teacher paradigm significantly speeds up the process of training adversarially robust models. To demonstrate this, we compare it against other approaches that speed up adversarial training [22, 28] using CIFAR-10. Given a pre-trained teacher, RRM is able to achieve performance comparable to adversarial training [15] in the least amount of training time. Additionally, we demonstrate that RRM can benefit from techniques that speed up adversarial training such as Fast Adversarial Training [28]. When combined with Fast Adversarial training, we show RRM achieves higher performance ($\sim\mathbf{2.5\%}$ higher standard accuracy and $\sim\mathbf{3.5\%}$ higher adversarial accuracy) while requiring significantly lower total training time (converges $\sim\mathbf{1.8\times}$ faster) compared to Free Adversarial Training [22]. Furthermore, we show that RRM is able to scale to higher dimensional datasets using the Restricted-ImageNet dataset. In the presence of an adversarially trained AlexNet model, we are able to train a ResNet50 model $\sim 18\times$ faster than adversarial training while achieving competitive performance on both natural and adversarial images.

In this section, we formally define the problem of adversarial robustness and briefly discuss the concepts foundational to our solution’s design.

The rise of deep learning has been accompanied by its widespread adoption in commercial systems. Autonomous driving systems, news aggregators, virtual assistants, voice recognition, and fraud detection systems are just some of the systems we rely on every day that use deep learning models to accomplish their tasks. Even in their current imperfect state [16], deep learning models are experiencing rapid improvements, and much of their potential is believed to be unrealized [24]. Like other innovations in computer systems, the increased adoption of deep learning puts a spotlight on their reliability and robustness against adversaries whose goal is to cause the system to misbehave. Early examples of these concerns have manifested as physically realizable adversarial attacks on deep learning models [9]. For safety-critical commercial systems using deep learning models (e.g., self-driving cars), robustness against such attacks is highly desirable. We argue that to be usable in real world systems, the process of robustification of deep learning models should have the following characteristics:

• •

  Low standard accuracy reduction. Tsipras et al. [26] established that there is a trade-off between a model’s performance on adversarial and non-adversarial (i.e., natural) inputs. In real world scenarios, adversarial attacks are expected to be rare anomalous occurrences, much like the instances of fraud in credit card transactions. Therefore, commercial systems with strict requirements for standard accuracy (i.e., accuracy on natural inputs) will be hesitant to adopt solutions that significantly impact their functionality in the absence of an adversary. Taking this into consideration, a robustification process should minimally reduce standard accuracy while conferring non-trivial adversarial accuracy.

• •

  Low amortized training cost. In production, the life-cycle of a deep learning model involves regular re-training and fine-tuning because of the availability of new data and improvements in the models. For example, Figure 1 presents the rate at which the state-of-the-art accuracy on ImageNet dataset has improved in the last decade. The $~{}40\%$ gain in the accuracy during this period results from hundreds, if not thousands, of iterative improvements and modifications and our increased capacity to train deeper models. Adoption to a rapidly evolving environment mandates any robustification technique to impose minimal average overhead in terms of training cost and scale well with the complexity of the newer generation of models.

As one of the most recognized defense approaches, adversarial training, in its current formulation, is poorly suited for real world use. While the models trained using adversarial training show significant adversarial robustness ¹¹1The robustness of adversarial training is empirically validated against first-order adversaries., the training overhead remains an issue. Due to the need to generate adversarial examples on the fly during training, multiple forward and backward passes are made, making adversarial training computationally expensive. Furthermore, the training overhead only gets worse as the model and data increase in complexity and dimensionality. In our experiments, adversarially training a classifier (using $7$-step PGD attack) was on average $7\times$ slower than standard training. Any modifications in the model requires a complete repeat of this expensive process as reuse of the existing adversarially trained model is not possible.

RRM seeks to improve the usability of adversarial training by allowing adversarial robustness to transfer across models, thereby eliminating the cost of repeated adversarial training. Through enabling transferable adversarial robustness, our proposed method allows for the reuse of older adversarially trained models to train new adversarially trained models using a modified ERM objective. Furthermore, we can exploit our approach to speed up standard adversarial training at the cost of a small amount of adversarial accuracy by first adversarially training a smaller, faster model and then transferring the robustness to a larger, slower model.

Our objective is to make the process of training adversarially robust models computationally efficient. To this end, we propose Robust Representation Matching (RRM), a student-teacher framework to transfer adversarial robustness between models. RRM allows us to train adversarially robust models at a computational cost comparable to standard training. Empirically, we show that our method helps models attain high standard and adversarial accuracy in the smallest training time as compared to prior works [22, 10].

Our design begins with the same assumption as Ilyas et al. [14], i.e., advesarially trained models learn robust features. Thus, given an adversarially trained teacher model $T_{\phi}$, we train a student model $S_{\theta}$ to match the teacher’s penultimate layer representations on natural (i.e., non-adversarial) images. This is done using the following training objective:

The functions $g_{S}(\cdot)$ and $g_{T}(\cdot)$ return the penultimate layer representations of classifiers $S_{\theta}$ and $T_{\phi}$ respectively. Our loss function includes two terms: (1) the cross-entropy loss $\mathcal{L}_{CE}$; and (2) the robust representation loss $\mathcal{L}_{R}$, which computes the distance between the penultimate layer representations of $S_{\theta}$ and $T_{\phi}$. Updating $\theta$ to minimize $\mathcal{L}_{R}$, while keeping $\phi$ frozen, forces $S_{\theta}$ to learn penultimate layer representations that resemble those of adversarially robust $T_{\phi}$. Matching the penultimate layer representations in this way allows us to transfer adversarial robustness from $T_{\phi}$ to $S_{\theta}$. Algorithm 1 provides the pseudo-code of the RRM training method.

The coefficient $\lambda$ is used to appropriately weigh the contribution of $\mathcal{L}_{CE}$ towards the total loss. The higher the value of $\lambda$, the more $S_{\theta}$ biases towards maximizing standard accuracy with a smaller focus on the teacher’s robust representations, which in turn lowers the student’s adversarial robustness. This observation is consistent with the findings of prior works [14, 26]. Thus, if we select a small value for $\lambda$, we can instead bias $S_{\theta}$ to focus more on robust representations and improve its adversarial robustness through the supervision provided by $\mathcal{L}_{R}$. The value of $\lambda$ can be tuned based on the user’s requirement²²2Note that it is mandatory to set $\lambda$ to a non-zero value. Otherwise, no loss gradient will be present to train the final layer of $S_{\theta}$ as $\mathcal{L}_{R}$ does not depend on the final layer..

As we are training $S_{\theta}$ with natural images only, the computational cost of our approach is comparable to that of standard training and much lower than adversarial training [15]. In addition to the backpropagation step present in standard training, RRM requires an additional forward pass through classifier $T_{\phi}$ to compute $\mathcal{L}_{R}$, which we later show is only a small amount of additional overhead. Although adversarially training $T_{\phi}$ is necessary, its cost is amortized as we can robustly train future student models, as might be required in large-scale commercial systems.

In this section, we provide specifications of the threat model under which we perform our evaluations. Our threat model is similar to the one used by Madry et al. [15]. Additionally, we claim similar adversarial robustness guarantees as them.

We conduct experiments to demonstrate the superiority of RRM along two dimensions: (1) training time (Section 6.2), and (2) effectiveness of transfer (Section 6.3). We perform both set of experiments using the CIFAR-10 dataset and compare against most relevant recent prior works. We also demonstrate that RRM scales to high dimensional datasets using the Restricted-ImageNet dataset [26] (Section 6.4). Through our evaluation, we verify that the results presented are statistically significant. For adversarial accuracy computation, we follow the standard practice in adversarial machine learning literature and use multiple random restarts to ensure that the attack doesn’t get stuck in bad local maxima. For epoch timings, we compute the $95\%$ confidence interval to study statistical significance of our speedup results.

In this section we discuss some noteworthy points regarding RRM. First, we discuss how changing the value of $\lambda$ affects the performance of the student model, which can inform users of RRM how to tune $\lambda$ based on their use case. Second, we explore the decreasing effectiveness of RRM when the teacher is more complex than the student. In our presented results, the teacher’s architecture was always less complex (i.e., faster to train) than the student. Using a ResNet50 teacher, we train multiple student models of decreasing complexity and observe lowering rates of robustness transfer.

First, RRM uses a cosine similarity loss focused on the models’ penultimate layer (i.e., pre-logit layer) whereas Goldblum et al. use a knowledge distillation loss focused on the models’ temperature scaled softmax outputs. Our approach encourages the student to utilize the robust representations learned by the teacher. When they have differently shaped representation layers, we add an additional layer of the correct shape after the current penultimate layer to one of the models. In contrast, KD expects the student to learn its own representations to match the teacher’s softmax output and requires an additional hyperparameter, the temperature t, as compared to RRM. Depending on its magnitude, $t$ can affect the success rate of gradient based adversarial attacks due to an artificial scaling of the logits [2]. Note that the hyperparameter $\lambda$ in Equation 5 and $\alpha$ in Equation 6 serve identical purpose of controlling the trade-off between natural and adversarial accuracy.

The second difference is in intent. KD is traditionally used to transfer the performance of a larger more complex model to a smaller less complex model in an effort to “compress” the larger model into the smaller one. Goldblum et al. use this to improve the adversarial robustness of smaller models by leveraging robust larger models and their experiments reflect this. Their approach augments adversarial training with KD to achieve high performance. As we showed in Section 6.3, distillation alone is insufficient to transfer the robustness of the teacher and, likely, only helps to fine-tune adversarial performance. In contrast, RRM seeks to reduce the adversarial training overhead by leveraging smaller models to quickly train robust larger models. We necessarily do not adversarially train the student.

Adversarial machine learning looms as an ever-present threat to the security and reliability of machine learning systems as research has proven attackers with a certain level of access can reliably cause them to misbehave. As such, it is desirable to train machine learning models that are robust to adversarial attacks in advance rather than wait for a breach to occur. Unfortunately, adversarial training, one of the most well-known and reliable defenses, is impractical to deploy in real world systems. Like software, machine learning models need to be constantly updated to maintain state-of-the-art performance due to the availability of new training data or the development of new model architectures. The high training overhead and poor scalability of adversarial training discourage users from adopting it as part of their training process.

In this paper, we proposed a method to transfer adversarial robustness between models despite differences in their architectures. RRM enables low-cost, efficient transfer of robust representations learned by an adversarially trained teacher model to a new student model. By adding a new loss term to the standard training objective, an adversarially robust model can be trained on natural images only using RRM. On CIFAR-10, we demonstrated that RRM outperforms state-of-the-art adversarial training speedup techniques. On Restricted-ImageNet, a higher dimensional dataset, we demonstrated that RRM remains effective both in terms of model performance and training speedup.

We thank Veena Krish, Farhan Ahmed, the anonymous reviewers, and our shepherd, David Freeman, for their valuable feedback. This work was supported by the Office of Naval Research under grants N00014-20-1-2858 and N00014-22-1-2001, and Air Force Research Lab under grant FA9550-22-1-0029. Any opinions, findings, or conclusions expressed in this material are those of the authors and do not necessarily reflect the views of the sponsors.