Injecting adversarial examples during training, known as adversarial training, can improve robustness against one-step attacks, but not for unknown iterative attacks. To address this challenge, we first show iteratively generated adversarial images easily transfer between networks trained with the same strategy. Inspired by this observation, we propose cascade adversarial training, which transfers the knowledge of the end results of adversarial training. We train a network from scratch by injecting iteratively generated adversarial images crafted from already defended networks in addition to one-step adversarial images from the network being trained. We also propose to utilize embedding space for both classification and low-level (pixel-level) similarity learning to ignore unknown pixel level perturbation. During training, we inject adversarial images without replacing their corresponding clean images and penalize the distance between the two embeddings (clean and adversarial). Experimental results show that cascade adversarial training together with our proposed low-level similarity learning efficiently enhances the robustness against iterative attacks, but at the expense of decreased robustness against one-step attacks. We show that combining those two techniques can also improve robustness under the worst case black box attack scenario. Injecting adversarial examples during training (adversarial training), BID1 BID3 increases the robustness of a network against adversarial attacks. The networks trained with one-step methods have shown noticeable robustness against onestep attacks, but, limited robustness against iterative attacks at test time. To address this challenge, we have made the following contributions:Cascade adversarial training: We first show that iteratively generated adversarial images transfer well between networks when the source and the target networks are trained with the same training method. Inspired by this observation, we propose cascade adversarial training which transfers the knowledge of the end results of adversarial training. In particular, we train a network by injecting iter FGSM images (section 2.1) crafted from an already defended network (a network trained with adversarial training) in addition to the one-step adversarial images crafted from the network being trained. The concept of using already trained networks for adversarial training is also introduced in BID9 . In their work, purely trained networks are used as another source networks to generate one-step adversarial examples for training. On the contrary, our cascade adversarial training uses already defended network for iter FGSM images generation.Low level similarity learning: We advance the previous data augmentation approach by adding additional regularization in deep features to encourage a network to be insensitive to adversarial perturbation. In particular, we inject adversarial images in the mini batch without replacing their corresponding clean images and penalize distance between embeddings from the clean and the adversarial examples. There are past examples of using embedding space for learning similarity of high level features like face similarity between two different images BID8 BID7 Wen et al., 2016) . Instead, we use the embedding space for learning similarity of the pixel level differences between two similar images. The intuition of using this regularization is that small difference on input should not drastically change the high level feature representation. We performed through transfer analysis and showed iter FGSM images transfer easily between networks trained with the same strategy. We exploited this and proposed cascade adversarial training, a method to train a network with iter FGSM adversarial images crafted from already defended networks. We also proposed adversarial training regularized with a unified embedding for classification and low-level similarity learning by penalizing distance between the clean and their corresponding adversarial embeddings. Combining those two techniques (low level similarity learning + cascade adversarial training) with deeper networks further improved robustness against iterative attacks for both white-box and black-box attacks.However, there is still a gap between accuracy for the clean images and that for the adversarial images. Improving robustness against both one-step and iterative attacks still remains challenging since it is shown to be difficult to train networks robust for both one-step and iterative attacks simultaneously. Future research is necessary to further improve the robustness against iterative attack without sacrificing the accuracy for step attacks or clean images under both white-box attack and black-box attack scenarios. We perform 24x24 random crop and random flip on 32x32 original images. We generate adversarial images with "step ll" after these steps otherwise noted.We use stochastic gradient descent (SGD) optimizer with momentum of 0.9, weight decay of 0.0001 and mini batch size of 128. For adversarial training, we generate k = 64 adversarial examples among 128 images in one mini-batch. We start with a learning rate of 0.1, divide it by 10 at 4k and 6k iterations, and terminate training at 8k iterations for MNIST, and 48k and 72k iterations, and terminate training at 94k iterations for CIFAR10. Ensemble models Pre-trained models R20 E , R20 P,E , R110 E , R110 P,E R20 3 , R110 3 R110 E2 , R110 P,E2 R20 4 , R110 4 Cascade models Pre-trained model R20 K,C , R20 P,C R20 P R110 K,C , R110 P,C R110 P R110 K,C2 , R110 P,C2R110 P Figure 7: Argument to the softmax vs. in test time. "step ll", "step FGSM" and "random sign" methods were used to generate test-time adversarial images. Arguments to the softmax were measured by changing for each test method and averaged over randomly chosen 128 images from CIFAR10 test-set. Blue line represents true class and the red line represents mean of the false classes. Shaded region shows ± 1 standard deviation of each line.We draw average value of the argument to the softmax layer for the true class and the false classes to visualize how the adversarial training works as in figure 7 . Standard training, as expected, shows dramatic drop in the values for the true class as we increase in "step ll" or "step FGSM direction. With adversarial training, we observe that the value drop is limited at small and our method even increases the value in certain range upto =10. Note that adversarial training is not the same as the gradient masking.As illustrated in figure 7, it exposes gradient information, however, quickly distort gradients along the sign of the gradient ("step ll" or "step FGSM) direction. We also observe improved results (broader margins than baseline) for "random sign" added images even though we didn't inject random sign added images during training. Overall shape of the argument to the softmax layer in our case becomes smoother than Kurakin's method, suggesting our method is good for pixel level regularization. Even though actual value of the embeddings for the true class in our case is smaller than that in Kurakin's, the standard deviation of our case is less than Kurakin's, making better margin between the true class and false classes. We observe accuracies for the "step FGSM" adversarial images become higher than those for the clean images ("label leaking" phenomenon) by training with "step FGSM" examples as in . Interestingly, we also observe "label leaking" phenomenon even without providing true labels for adversarial images generation. We argue that "label leaking" is a natural result of the adversarial training.
Cascade adversarial training + low level similarity learning improve robustness against both white box and black box attacks.
{"src": "scitldr-AIC_train", "paper_id": "HyRVBzap-"}