Skip to content
Original

A theoretically grounded trade-off between robustness and accuracy

Theoretically Principled Trade-off between Robustness and Accuracy

arXiv· arXiv:1901.08573· Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, Michael I. JordanCMU; TTIC; University of Virginia; UC Berkeley; Petuum Inc.Indexed by this site · 14 days ago· Originally publishedSelected DefensesSelectedAttention38

Translation in progress — untranslated text is omitted.

Quick read

Defenses

Based on the paper PDF (AI-generated); refer to the original

AI summaryThe paper decomposes the robust error on adversarial examples into natural classification error and boundary error, gives a differentiable upper bound, and based on this proposes the adversarial training method TRADES. The authors prove that this upper bound is uniformly tightest over all probability distributions and measurable predictors, and give a matching lower bound; the TRADES loss consists of a natural error term and a regularization term that pushes the decision boundary away, with the regularization weight λ controlling the trade-off between accuracy and robustness. On CIFAR10, under the white-box FGSM k attack, this method achieves a robust accuracy of up to 56.61%, whereas prior defenses under this setting are about 47%; on MNIST, under the C&W white-box attack, the robust accuracy is 99.46%. The method's competition entry ranked first among about 2000 submissions in the NeurIPS 2018 Adversarial Vision Challenge, with an average ℓ2 perturbation distance 11.41% higher than the second place. The authors released the code and trained models.

Questions
Adversarial defense requires a tradeoff between robustness and natural accuracy; the authors state that this tradeoff has previously been studied mostly empirically, lacking theoretical characterization; directly optimizing the robust 0-1 loss is computationally infeasible, and the approximation tightness of commonly used surrogate losses has no theoretical guarantee.
Methods
The authors decompose robust error into natural error and boundary error, use classification-calibrated loss theory to give a differentiable upper bound and prove that it is consistently tightest; on this basis they propose TRADES: in addition to the natural loss, a regularization term measuring the difference between predictions on natural samples and adversarial samples is added, and adversarial training is done with inner maximization by projected gradient.
Experiments and results
The tightness of the upper bound was verified on MNIST binary classification (Table 3); under CIFAR10 white-box FGSM^20(PGD), TRADES(1/λ=6) has robust accuracy 56.61%, higher than 47.04% for [MMS+18]; it also outperforms the Madry model under black-box transfer attacks; a submission based on this method won first place in the NeurIPS 2018 Adversarial Vision Challenge.
Limitations and future work
The authors state that generalization analysis under finite samples is left for future work (Section 3 footnote); the experiments cover only four image datasets, MNIST, CIFAR10, Tiny ImageNet and bird-or-bicycle, and the architectures tested are CNN, ResNet-18, WRN-34-10, ResNet-50; the paper does not report query budgets beyond the number of attack iterations, nor the number of repeats (Table 4 gives standard deviations, the other tables do not).
Why it was selectedThe paper decomposes robust error into natural error and boundary error, and on this basis derives a trainable TRADES objective, with comparative data under white-box and black-box attacks.

The paper decomposes robust error into natural error and boundary error, and on this basis derives a trainable TRADES objective, with comparative data under white-box and black-box attacks.

Related papers

Both use: Tiny ImageNet
Show 3 more papers
Both use: Tiny ImageNet
Both use: MNIST
Read originalarxiv.org