It has been widely recognized that adversarial examples can be easily crafted to fool deep networks, which mainly root from the locally non-linear behavior nearby input examples. Applying mixup in training provides an effective mechanism to improve generalization performance and model robustness against adversarial perturbations, which introduces the globally linear behavior in-between training examples. However, in previous work, the mixup-trained models only passively defend adversarial attacks in inference by directly classifying the inputs, where the induced global linearity is not well exploited. Namely, since the locality of the adversarial perturbations, it would be more efficient to actively break the locality via the globality of the model predictions. Inspired by simple geometric intuition, we develop an inference principle, named mixup inference (MI), for mixup-trained models. MI mixups the input with other random clean samples, which can shrink and transfer the equivalent perturbation if the input is adversarial. Our experiments on CIFAR-10 and CIFAR-100 demonstrate that MI can further improve the adversarial robustness for the models trained by mixup and its variants. Deep neural networks (DNNs) have achieved state-of-the-art performance on various tasks (Goodfellow et al., 2016) . However, counter-intuitive adversarial examples generally exist in different domains, including computer vision (Szegedy et al., 2014) , natural language processing (Jin et al., 2019) , reinforcement learning (Huang et al., 2017) , speech and graph data (Dai et al., 2018) . As DNNs are being widely deployed, it is imperative to improve model robustness and defend adversarial attacks, especially in safety-critical cases. Previous work shows that adversarial examples mainly root from the locally unstable behavior of classifiers on the data manifolds (Goodfellow et al., 2015; Fawzi et al., 2016; 2018; Pang et al., 2018b) , where a small adversarial perturbation in the input space can lead to an unreasonable shift in the feature space. On the one hand, many previous methods try to solve this problem in the inference phase, by introducing transformations on the input images. These attempts include performing local linear transformation like adding Gaussian noise (Tabacof & Valle, 2016) , where the processed inputs are kept nearby the original ones, such that the classifiers can maintain high performance on the clean inputs. However, as shown in Fig. 1(a) , the equivalent perturbation, i.e., the crafted adversarial perturbation, is still δ and this strategy is easy to be adaptively evaded since the randomness of x 0 w.r.t x 0 is local (Athalye et al., 2018) . Another category of these attempts is to apply various non-linear transformations, e.g., different operations of image processing (Guo et al., 2018; Raff et al., 2019) . They are usually off-the-shelf for different classifiers, and generally aim to disturb the adversarial perturbations, as shown in Fig. 1(b ). Yet these methods are not quite reliable since there is no illustration or guarantee on to what extent they can work. On the other hand, many efforts have been devoted to improving adversarial robustness in the training phase. For examples, the adversarial training (AT) methods (Madry et al., 2018; Shafahi et al., 2019) induce locally stable behavior via data augmentation on adversarial examples. However, AT methods are usually computationally expensive, and will often degenerate model performance on the clean inputs or under general-purpose transformations like rotation (Engstrom et al., 2019) . In contrast, the mixup training method introduces globally linear behavior in-between the data manifolds, which can also improve adversarial robustness (Zhang Generality. According to Sec. 3, except for the mixup-trained models, the MI method is generally compatible with any trained model with induced global linearity. These models could be trained by other methods, e.g., manifold mixup (Verma et al., 2019a; Inoue, 2018; . Besides, to better defend white-box adaptive attacks, the mixup ratio λ in MI could also be sampled from certain distribution to put in additional randomness. Empirical gap. As demonstrated in Fig. 2 , there is a gap between the empirical results and the theoretical formulas in Table 1 . This is because that the mixup mechanism mainly acts as a regularization in training, which means the induced global linearity may not satisfy the expected behaviors. To improve the performance of MI, a stronger regularization can be imposed, e.g., training with mixup for more epochs, or applying matched λ both in training and inference.
We exploit the global linearity of the mixup-trained models in inference to break the locality of the adversarial perturbations.
{"src": "scitldr-AIC_train", "paper_id": "ByxtC2VtPB"}