System and method for max-margin adversarial training

Abstract

A system for generating an adversarial example in respect of a neural network, the adversarial example generated to improve a margin defined as a distance from a data example to a neural network decision boundary. The system includes a data receiver configured to receive one or more data sets including at least one data set representing a benign training example (x); an adversarial generator engine configured to: generate, using the neural network, a first adversarial example (Adv1) having a perturbation length epsilon1 against x; conduct a search in a direction (Adv1-x) using the neural network; and to generate, using the neural network, a second adversarial example (Adv2) having a perturbation length epsilon2 based at least on an output of a search in the direction (Adv1-x).

Description

FIELD

Embodiments of the present disclosure generally relate to the field of machine learning, and more specifically, embodiments relate to devices, systems and methods for training neural networks against adversarial attacks.

INTRODUCTION

Trained neural networks are useful in a wide variety of technical applications. Neural networks are often trained against benign inputs (e.g., inputs that are not specifically selected to cause classification problems). However, trained neural networks are vulnerable to adversarial attacks where an artificially constructed imperceptible perturbation is applied to an input, causing a significant drop in the prediction accuracy of an otherwise accurate network.

The level of distortion is measured by the magnitude of the perturbations (e.g. in l_∞ and l₂ norms), i.e. the distance from the original input to the perturbed input. For example, in image recognition, a small perturbation that injects differences otherwise unrecognizable to the human eye into an input signal may be able to shift a neural network's output from a correct classification to an incorrect classification.

Taking a benign example into consideration, a neural network may be trained to correctly classify an input image as that of a panda bear. However, adding small changes to this benign example by applying a perturbative noise to the input may cause a shift of classification such that the same image of a panda bear is incorrectly classified by the system as a bucket. The use of such perturbative noises provides a tool with a high probability of success in fooling the neural network as part of an adversarial attack.

In particular, adversarial attacks are example inputs that can be intentionally designed to cause a neural network to make a mistake. Adversarial attacks are especially difficult to defend against because it is difficult to predict what aspects will be used in generating future adversarial examples at the initial training or designing stage of a neural network.

Adversarial attacks are particularly worrisome in implementations where incorrect classifications could lead to significantly adverse outcomes. For example, for image recognition in relation to automated vehicles, an adversarial attack can be used to fool the neural network such that a traffic sign, or a road obstacle is incorrectly interpreted, leading to a crash.

SUMMARY

It is desirable to have a neural network that has a high level of robustness (e.g., improved resistance) against adversarial attacks. Adversarial attacks can, for example, apply artificially constructed perturbations (otherwise imperceptible to humans) to an input, causing a significant drop in the prediction accuracy of an otherwise accurate neural network and the misclassification of said input. Adversarial attacks pose a specific technical problem to be addressed. A technical solution is described herein that is used to generate improved adversarial examples for training a neural network such that the neural network may be able to generate correct outputs despite some level of adversarial attack being present in the test set/production data set. Accordingly, the robustness of the neural network is improved. The embodiments described herein are useful in practical implementations, for example, in relation to verification of various banking or financial institution features such as mortgage provisioning, improved virus/malware detection, and/or machine vision/facial recognition applications.

The disclosure provides a specific improvement over other approaches to adversarial training. In particular, the disclosure improves the adversarial robustness of a neural network from a margin perspective, and proposes Max-Margin Adversarial (MMA) training, a practical approach for direct input margin maximization. Because of its “direct” margin maximization nature, MMA training is an improvement over alternate approaches of adversarial training which have the inherent problem that a perturbation length ∈ has to be set and fixed throughout the training process, where ∈ is often set arbitrarily. Moreover, different data points may have different intrinsic robustness, thus fixing one E value for all data points across the training procedure is suboptimal.

As noted herein, fixing the value of the perturbation length can cause undesirable technical outcomes where adversarial examples that are generated for training are not particularly useful for the actual training to improve robustness, because they are either (1) too close to the original such that the machine learning classifier cannot readily distinguish them (i.e., too hard), or (2) too far from the original such that the classifier would have little to gain from distinguishing them (i.e., too easy).

MMA training resolves problems associated with said fixed perturbation magnitude ∈ in the sense that: 1) the approach dynamically determines (e.g., maximizes) the margin, the “current robustness” of the data, instead of robustness with regards to a predefined magnitude; 2) the margin is determined for each data point, therefore each sample's robustness could be maximized individually; and 3) during training, MMA selects the “correct” ∈ for adversarial training, which could improve efficiency of learning.

Actively determining the perturbation length instead of using a fixed perturbation length is important as it helps produce adversarial examples that are more useful for training.

Described further are validation results showing the technical improvement of some embodiments relative to comparison approaches. While there may be some computational costs incurred (additional training epochs, reduction of “clean accuracy” against a non-perturbed input), benefits are shown in respect of improved “robust accuracy”. Accordingly, an overall average accuracy (averaging clean and robust accuracy) is exhibited in some embodiments.

Adversarial attacks are especially difficult to defend against as it is difficult to know when training or designing a neural network what aspects are used in generating the future adversarial examples. Generating improved adversarial examples is important and the approaches described herein in some embodiments provide for an improved margin and more useful adversarial examples relative to nave approaches. Furthermore, embodiments described herein provide a technical solution, in the form of an improvement to a technological process, that can be incorporated as a practical application in financial systems (e.g., credit provisioning systems), identity verification systems, image recognition systems, malware detection, among others.

As an example, MMA training may be used to improve prediction accuracy in the context of credit card application approvals. A neural network classifier may be used to assess whether an individual's application, whose income is situated on the cut-off point for said credit card application, should be approved. Typically, the classifier is trained to reject applicants whose income is at or below the cut-off. However, suppose that the same individual later modifies his/her income by a negligible amount, such as $1, and re-applies for the same credit card. In that case, the classifier would approve the application despite there being virtually no difference in the applicant's profile, simply because the individual's income is no longer at or below the cut-off point. MMA training could be used to identify such perturbations that are close enough to the decision boundary that a neural network without MMA training would not otherwise identify as problematic.

In a first aspect, a method is provided for generating a data set representing an adversarial example in respect of a neural network, the method comprising: receiving one or more data sets including at least one data set representing a benign training example (x); generating a first adversarial example (Adv₁) having a perturbation length epsilon₁ against x; conducting a search (e.g., a binary search) in a direction (Adv₁-x); generating a second adversarial example (Adv₂) having a perturbation length epsilon₂ based at least on an output of the search in the direction (Adv₁-x).

In another aspect, the method includes training the neural network against adversarial examples using Adv₂.

In another aspect, the method includes conducting a binary search in a direction (Adv₂-x); and generating a third adversarial example (Adv₃) having a perturbation length epsilon₃ based at least on an output of the binary search in the direction (Adv₂-x).

In another aspect, the method includes training the neural network against adversarial examples using Adv₃.

In another aspect, the binary search includes at least determining a point near the benign training example and along a search direction such that a logit loss is approximately zero at the point.

In another aspect, the perturbation lengths are stored in a dictionary data structure.

In another aspect, when the neural network encounters a new training example, a stored perturbation length is used to initialize a hyperparameter representing a minimum perturbation length.

In another aspect, the training includes labelling the adversarial examples as negative training examples.

In another aspect, the method includes determining a level of available computational resources, and upon determining that the level of available computational resources is below a pre-defined threshold, training the neural network against adversarial examples using Adv₂.

In another aspect, the method includes a prediction based at least upon a logit loss of a perturbation, and wherein the prediction indicates that the logic loss >0, training the neural network against adversarial examples using Adv₂.

Corresponding systems, computer readable media, apparatuses, devices, and special purpose machines are contemplated. In some embodiments, the neural network is configured for interoperation with upstream data sources and downstream computing systems, for example, generating classification output data sets which may be used for controlling one or more automated or semi-automated functions.

The method can be performed on a specialized computer server having software stored thereon in non-transitory computer readable media. When the software, such as machine-interpretable instructions provided in the form of object code, is executed by a processor, the processor performs steps of the method. The computer server can be a server that operates in a data center of a financial institution, for example, coupled to a message bus where data sets can be received and/or output. The computer server can be activated to generate data sets representative of adversarial data sets for training a neural network.

The adversarial data sets can then be used in downstream training iterations to improve the robustness of the neural network. For example, the adversarial data sets can be used for supervised training whereby the training data are marked as adversarial or not, and then a reward function can be applied to the neural network to tune the neural network based on whether it is able to successfully classify the adversarial data sets as adversarial (and conversely, safe data sets as safe). An example practical implementation can include a neural network for image processing for automated driving, which, for example, classifies objects visible to the vehicle's sensors. The computer server can be utilized to generate adversarial examples which are specially adapted by the server applying a dynamically determined perturbation length. These adversarial examples, for example, could be traffic signs misclassified as garbage cans.

As the adversarial examples are generated at a “just right” range of difference from the original images, the adversarial examples result in a better trained outcome whereby the neural network because more robust against adversarial examples. While other approaches can also generate adversarial examples using a fixed perturbation length, these examples are often not useful and can result either in useless rounds of training as a result of examples that are “too easy” or “too hard”.

When a malicious user attempts to fool the neural network with an adversarial example to have it mistakenly misclassify a traffic sign as a garbage can, in some cases, the trained neural network may have a higher probability of making a correct classification due to an increase in robustness against adversarial examples, and accordingly, an accident may potentially be avoided. However, it is important that while the approach may improve robustness, it cannot guarantee success against all adversarial examples.

DESCRIPTION OF THE FIGURES

In the figures, embodiments are illustrated by way of example. It is to be expressly understood that the description and figures are only for the purpose of illustration and as an aid to understanding.

Embodiments will now be described, by way of example only, with reference to the attached figures, wherein in the figures:

FIG. 1 is a block schematic of an example system for generating adversarial examples having an improved margin, according to some embodiments.

FIG. 2 is an example method for generating adversarial examples having an improved margin, according to some embodiments.

FIG. 3 is an illustration of a model ƒ and a data pair (x, y) that is correctly classified by ƒ, according to some embodiments.

FIG. 4 is an example pseudocode provided in accordance with an embodiment and is provided as an illustrative, non-limiting example.

FIG. 5 is an example illustration of an adversarial example generated using a nave approach where a fixed perturbation length is used, according to some embodiments.

FIG. 6 is an example illustration of an adversarial example generated in accordance with some embodiments, where adv₂ is generated based on a binary search of adv₁.

FIG. 7A and FIG. 7B are illustrations of a margin pre-training with an improved adversarial example and post-training with an improved adversarial example, according to some embodiments.

FIG. 8 is an illustration of decision boundary, margin, and shortest successful perturbation on application of an adversarial perturbation, according to some embodiments.

FIG. 9 is a 1-D example of how margin is affected by decreasing the loss at different locations, according to some embodiments.

FIG. 10 is a visualization of a loss landscape in the input space for MMA and PGD trained models, according to some embodiments.

FIG. 11 is an example diagram of margin distributions during training, according to some embodiments.

FIG. 12 is an example diagram of an example computing system, according to some embodiments.

DETAILED DESCRIPTION

Approaches and mechanisms are described that are directed to improving a level of robustness (e.g., improved resistance) against adversarial examples of a neural network.

Improved adversarial examples are generated for training a neural network such that the neural network may be able to generate correct outputs despite some level of adversarial attack being present in the test set/production data set. Adversarial examples are generated whose margin (the distance from the data point to a decision boundary) is improved (in some embodiments, maximized).

This is an improvement over other approaches where, for example, the distance when used for generating adversarial examples is an arbitrarily selected distance. Adversarial attacks are especially difficult to defend against as it is difficult to know when training or designing a neural network what aspects are used in generating the future adversarial examples.

Applicants have studied adversarial robustness of neural networks from a margin maximization perspective, where margins are defined as the distances from inputs to a classifier's decision boundary. The study shows that maximizing margins can be achieved by minimizing the adversarial loss on the decision boundary at the “shortest successful perturbation”, which suggests a close connection between adversarial losses and the margins. As provided herein, validation results were generated to test various example embodiments, and improved technical outcomes are found in certain situations.

Improved approaches related to Max-Margin Adversarial (MMA) training to directly maximize the margins to achieve adversarial robustness. Instead of adversarial training with a fixed, MMA offers an improvement by selecting the margin as the “correct” individually for each point. The description further rigorously analyzes adversarial training in the perspective of margin maximization, and provide an alternative interpretation for adversarial training: adversarial training is maximizing either a lower bound or an upper bound of the margins. The experiments confirm the theory and demonstrate MMA training's efficacy on the MNIST and CIFAR10 datasets w.r.t. robustness.

To aid in understanding, the following definitions are provided:

Logit loss: for a data example the logit loss=(largest logit except true label)−(logit of the true label).

A prediction, described in various embodiments, is based on the following: when logit loss >0, prediction is wrong, when logit loss <0, prediction is correct.

Binary search: inputs of binary search are 1) a data example; 2) a neural network; 3) a search direction; 4) minimum and maximum search length; and 5) number of search steps. The purpose of binary search is to find the point, near the data example, and along the search direction, such that the logit loss is approximately 0 on this point.

It is very similar to classical binary search, where if, at a point, the logit loss is larger than zero, then the search range becomes from the minimum length to the length of this point, and vice versa.

Epsilon dictionary (epsdct): epsdct saves the suitable perturbation length of a given training example that was used to perturb it the last time when it is encountered. When an example is met for the first time, this value is initialized as mineps (a hyperparameter that is minimum perturbation length).

Suitable perturbation length: here it means that after a norm constrained attack with perturbation length, the closer it is to logit loss, the more suitable is the adversarial perturbation, because it is closer to the decision boundary. The approach shows that if an optimal perturbation within a norm constraint is close to the decision boundary, then optimizing the neural network on it will maximize the margin.

Adversarial example is an example with an adversarial perturbation.

As described in embodiments below, the mechanism is described in relation to K-class classification problems.

Denote S={x_i, y_i} as the training set of input-label data pairs sampled from data distribution D.

For this description, the classifier is considered as a score function ƒ_θ(x)=(ƒ_θ¹(x), . . . , ƒ_θ^K(x)), parameterized by θ, which assigns score ƒ_θ¹(x) to the i-th class. The predicted label of x is then decided by ŷ=arg max_i ƒ_θⁱ(x).

Let L_θ⁰¹(x, y)=Π(ŷ≠y) be the 0-1 loss indicating classification error, where Π(•) is the indicator function. For an input (x, y), Applicants define its margin w.r.t. the classifier ƒ_θ(•) as:d_θ(x,y)=∥δ*∥=min∥δ∥ s.t. δ:L_θ⁰¹(x+δ,y)=1  (1)

Where δ*=arg min_{Lθ01(x+δ,y)=1} ∥δ∥ is the “shortest successful perturbation”. Applicants give an equivalent definition of margin with the “logit margin loss” L_θ^LM(x, y)=max_j≠y ƒ_θⁱ(x)−ƒ_θ^y(x).

The level set {x:L_θ^LM(x, y)=0} corresponds to the decision boundary of class y. Also, when L_θ^LM(x, y)<0, the classification is correct, and when L_θ^LM(x, y)≥0 the classification is wrong.

Therefore, the approach can define the margin in Eq. (1) in an equivalent way by L_θ^LM(•) as:d_θ(x,y)=∥δ*∥=min∥δ∥ s.t. δ:L_θ^LM(x+δ,y)≥0,  (2)

where δ*=arg min_{LθLM(x+δ,y)≥0} ∥δ∥ is again the “shortest successful perturbation”.

As described herein, the term “margin” is used to denote d_θ(x, y) in Eq. (2). For other notions of margin, the description will use specific phrases, e.g. “SLM-margin” or “logit margin.”

FIG. 1 is a block schematic of an example system for generating adversarial examples having an improved margin, according to some embodiments.

The example system 100 is implemented on one or more processors operating in conjunction with computer memory, and in some embodiments, is a computing device or a distributed set of computing devices, such as one or more computer servers. Each component described herein is provided as an illustrative non-limiting example and may be provided through the one or more processors operating with the computer memory. The computer processors include electronic circuitry. The system 100 may include one or more input and output interfaces, which may include application programming interfaces and/or hardware interface devices and displays.

A neural network 102 is maintained at data storage 104, which includes a plurality of input nodes that each map to an input feature being analyzed from a received input, and a plurality of hidden nodes used for representing various interconnections between the input nodes and one or more output nodes. The one or more output nodes can, for example, each represent a possible outcome or classification, etc.

The neural network 102 can be established to heuristically track relationships between the input nodes and the output nodes, such that weighted interconnections between the computing nodes are modified over time as more training examples are provided to the neural network 102 to tune the weights in accordance with the structure of the neural network 102. For example, in some examples, neural network 102 may be established such that the hidden layer includes feed forward, backwards propagation, multiple layers, etc., which are used to modify how the neural network 102 responds to received training sets of data.

Over time, the interconnections are tuned such that in response to new input data, the neural network 102 is able to generate one or more predictions, which can be represented in the form of a vector of raw predictions having “logit” values (non-normalized), which for example may be provided into a softmax function to generate a vector of normalized probabilities that are used to establish a prediction. The neural network 102, through tuning, establishes a decision boundary through the logits as between different classifications in response to various inputs.

Depending on its structure, neural network 102 can be susceptible to being fooled by new input data that is intentionally or unintentionally close to a decision boundary, and accordingly, neural network 102 may generate incorrect classifications. Neural networks are especially vulnerable where an attacker knows how the neural network is configured (e.g., how the hidden layers are configured), and/or the values of the weights of the interconnections as between interconnected nodes. An attacker may be able to approximate or learn the structure of the neural network through observing the classifications and errors thereof generated by the neural network.

Accordingly, as described in various embodiments below, an improved approach is described wherein the system 100 generates a data set representing an adversarial example in respect of a neural network, which is an improved adversarial example relative to other approaches as the margin (the distance from the data point to a decision boundary) is improved (in some embodiments, maximized) through first, generating an initial adversarial example, and generating one or more subsequent adversarial examples along the direction (e.g., using a binary search). These one or more subsequent adversarial examples are then used for re-training the neural network such that it becomes less vulnerable to attack using adversarial examples. Not all embodiments are limited to using binary searches and other approaches are possible.

A data receiver 112 is provided that receives one or more data sets including at least one data set representing a benign training example (x).

An adversarial generator engine 106 is provided that is configured to generate, using the neural network 102, a first adversarial example (Adv₁) having a perturbation length epsilon₁ against x; conduct a search (e.g., a binary search) in a direction (Adv₁-x) using the neural network; and to generate, using the neural network 102, a second adversarial example (Adv₂) having a perturbation length epsilon₂ based at least on an output of the search in the direction (Adv₁-x).

The perturbation lengths may be stored on a perturbation dictionary data storage 104 for later retrieval and usage (e.g., initialization of hyperparameters).

In some embodiments, a prediction engine 110 is utilized to assess whether to conduct this approach.

The prediction includes checking a logit loss where logit loss >0, prediction is wrong, when logit loss <0, prediction is correct. If the prediction is wrong, standard clean training may be conducted on the example, and if the prediction is correct, the prediction engine 110 may continue with the process of finding an improved suitable adversarial example and training the neural network 102 on the improved suitable adversarial example.

FIG. 2 is an example method for generating adversarial examples having an improved margin, according to some embodiments. The method 200 is shown as an example, and other steps are possible, and the steps may be conducted in various orders and permutations and combinations.

At 202, one or more data sets are received, including at least one data set representing a benign training example (x).

At 204, a first adversarial example (Adv₁) is generated having a perturbation length epsilon₁ against x. An optional prediction may be conducted as described above. To find the suitable adversarial example of x, the method includes performing a PGD attack (with perturbation length epsilon₁ as obtained from the data storage 104 against the training sample x.

At 206, a binary search is conducted in a direction (Adv₁-x). Not all embodiments are limited to binary searches.

At 208, a second adversarial example (Adv₂) is generated having a perturbation length epsilon₂ based at least on an output of the binary search in the direction (Adv₁-x). This value can be stored in data storage 104 for later usage. The steps 206 and 208 may be repeated, in accordance with some embodiments, to establish additional, closer adversarial examples (Adv_n).

At 210, a selected suitable adversarial example Adv_{2 . . . n} can be utilized for training the neural network 102. The more repetitions of 206 and 208 are conducted, performance can be improved at the cost of computational resources. In a specific embodiment, Adv₃ is utilized in training the neural network 102.

Applicant notes that the PGD attack described in various embodiments is norm constrained, and thus the attack applies to any l_p norm and l_∞, where p≥1.

FIG. 3 is an example illustration of an adversarial example generated using MMA training.

The disclosure herein improves adversarial robustness by maximizing the average margin of the data distribution D by optimizing the following objective:

$\underset{\theta }{\min }\left\{\sum _{i\in S_{\theta }^{+}}\max \left\{0,d_{\max }-d_{\theta }\left(x_i,y_i\right)\right\}+\beta \sum _{j\in S_{\theta }^{-}}{𝒥}_{\theta }\left(x_j,y_j\right)\right\},$

where _θ⁺={i:L_θ^LM(x_i, y_i)<0} is the set of correctly classified examples, _θ⁻={i:L_θ^LM(x_i, y_i)≥0} is the set of wrongly classified examples, (•) is a regular classification loss function, e.g. cross-entropy loss, d_θ(x_i, y_i) is the margin for correctly classified samples, and is β is the coefficient for balancing correct classification and margin maximization.

Note that the margin d_θ(x_i, y_i) is inside the hinge loss with threshold d_max (a hyperparameter), which forces the learning to focus on the margins that are smaller than d_max.

Intuitively, MMA training simultaneously minimizes classification loss on wrongly classified points in _θ⁻ and maximizes the margins of correctly classified points in d_θ(x_i, y_i) until it reaches d_max. Note that margins on wrongly classified examples are not maximized. Minimizing the objective turns out to be a technical challenge. While ∇_θ(x_i, y_i) can be easily computed by standard back-propagation, computing the gradient of d_θ(x_i, y_i) needs some technical developments.

As shown in some embodiments herein, maximization can still be achieved by minimizing a classification loss w.r.t. model parameters, at the “shortest successful perturbation”.

For smooth functions, a stronger result exists: the gradient of the margin w.r.t. model parameters can be analytically calculated, as a scaled gradient of the loss. Such results make gradient descent viable for margin maximization, despite the fact that model parameters are entangled in the constraints.

Given the samples {z₁, . . . , z_n} ∈=x×y)² where z_i=(x_i, y_i) is a pair of data and its label, in an embodiment, an assumption of the number of classes y=1, 2, . . . , K. A scoring function ƒ, where given input data, x, ƒ(x)=ƒ₁(x), . . . , θ_K(x)) gives scores of x being each class. The predicted label is then decided by arg max_iƒ_i(x).

For the purposes of some embodiments described herein, an assumption is made that ƒ is parameterized by θ. An assumption is made that ƒ(x;θ) is C² jointly in x and θ almost everywhere.

Given a model ƒ and a data pair (x, y) that is correctly classified by ƒ as shown in FIG. 3, one can compute the distance of (x, y) to its surrounding decision boundary by:

$\begin{array}{cc}\underset{\delta }{\min }\delta s.t.L\left(\delta ,\theta ;z\right)\ge 0,\mathrm{where}L\left(\delta ,\theta ;z\right)=\underset{j\ne y}{\max }{f}_j\left(x+\delta \right)-f_y\left(x+\delta \right).& \left(1\right)\end{array}$

In this specification, z may be omitted in the notation of L if it is clear in its context. One can verify that L(δ, θ) is a C² function jointly in δ and θ almost everywhere.

Equation 1 is in fact also compatible with a misclassified sample, as for (x, y) that is misclassified by ƒ, the optimal δ would be θ. Therefore, an approach would tend to learn a model ƒ that maximizes the following objective:

$\underset{\theta }{\max }F\left(\theta \right)=\underset{\theta }{\max }\sum _{i=1}^n\underset{{\delta }_i\in {\Delta }_i\left(\theta \right)}{\min }{\delta }_i,$ where Δ_i(θ)={δ_i:L(δ_i, θ; z_i)≥0} with θ as its argument emphasizing its dependence on θ.

To solve the optimization via SGD, the approach computes its gradient (subgradient) in θ, denoted in a LaGrangian form described by (δ, λ) where(δ,λ)=∥δ∥+λL(δ,θ).

For a fixed θ, the optimizers of δ and λ, are denoted by δ* and λ*.

The following relation provides an efficient way of determining the gradient of F(θ).

Theorem 1.1: Assume that ∈(δ)=∥δ∥ and L(δ, θ) are C2 functions almost everywhere. Also assume that the matrix is full rank almost anywhere, where:

$M=\left(\begin{array}{cc}\frac{{\partial }^2ϵ\left({\delta }^{*}\right)}{\partial {\delta }^2}+{\lambda }^{*}\frac{{\partial }^{2}L\left({\delta }^{*},\theta \right)}{{\hspace{0.17em}}_{\top }\partial {\delta }^2}& \frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \delta }\\ \frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \delta }& 0\end{array}\right)$ $\text{Then},{\nabla }_{\theta }F\left(\theta \right)\propto \frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \delta }.$

Remark 1.1. The condition on the matrix M is serving as a technical condition to guarantee that the implicit function theorem is applicable and thus the gradient can be computed. Similar conditions are implicitly assumed in other approaches for adversarial training as well.

Remark 1.2: Note that although the exact calculation of ∇_θF(θ) requires solving both λ* and δ*, Theorem 1.1 shows that to perform one step of gradient descent, knowing δ* is enough as one can tune its step size.

Proof. The gradient for F(θ) is developed in its general form. Consider the following optimization problem:

$F\left(\theta \right)=\underset{\delta \in \Delta \left(\theta \right)}{\min }ϵ\left(\delta \right),$

where Δ(θ)={δ:g(θ, δ)=0}, ∈ and g are both C² functions. Note that a simple application of Danskin's theorem would not be valid as the constraint set Δ(θ) depends on the parameter θ. The Lagrangian form is denoted by (δ, λ) where (δ, λ)=∈(δ)+λg(θ, δ). For a fixed θ, the optimizer δ* and λ* must satisfy the first order conditions (FOC):

$\begin{array}{cc}{{\frac{\partial ϵ\left(\delta \right)}{\partial \delta }+\lambda \frac{\partial g\left(\theta ,\delta \right)}{\partial \delta }}_{\delta ={\delta }^{*},\lambda ={\lambda }^{*}}=0,g\left(\theta ,\delta \right)}_{\delta -{\delta }^{*}}=0.& \left(3\right)\end{array}$

Place the FOC equations in a vector form:

${G\left(\left(\delta ,\lambda \right),\theta \right)=\left(\begin{array}{c}\frac{\partial ϵ\left(\delta \right)}{\partial \delta }+\lambda \frac{\partial g\left(\theta ,\delta \right)}{\partial \delta }\\ g\left(\theta ,\delta \right)\end{array}\right)}_{\delta ={\delta }^{*},\lambda ={\lambda }^{*}}=0.$

Note that G is C¹ continuously differentiable since ε and g are C² functions. Furthermore, the Jacobian matrix of G with respect to (δ, λ),

${\nabla }_{\left(\delta ,\lambda \right)}G\left(\left({\delta }^{*},{\lambda }^{*}\right),\theta \right)=\left(\begin{array}{cc}\frac{{\partial }^2ϵ\left({\delta }^{*}\right)}{\partial {\delta }^2}+{\lambda }^{*}\frac{{\partial }^{2}g\left(\theta ,{\delta }^{*}\right)}{\partial {\delta }^2}& \frac{\partial g\left(\theta ,{\delta }^{*}\right)}{\partial \delta }\\ \frac{\partial {g\left(\theta ,{\delta }^{*}\right)}^{\top }}{\partial \delta }& 0\end{array}\right)$

which by assumption is in full rank. Therefore, by the implicit function relation, δ* and λ* can be expressed as a function of θ, denoted by δ*(θ) and λ*(θ).

To further compute ∇_θF(θ), note that F(θ)=∈(δ*, θ)).

Thus,

$\begin{array}{cc}{\nabla }_{\theta }F\left(\theta \right)=\frac{\partial ϵ\left({\delta }^{*}\right)}{\partial \delta }\frac{\partial {\delta }^{*}\left(\theta \right)}{\partial \theta }=-\lambda *\frac{\partial g\left(\theta ,{\delta }^{*}\right)}{\partial \delta }\frac{\partial {\delta }^{*}\left(\theta \right)}{\partial \theta },& \left(4\right)\end{array}$

where the second equality is by Equation 3. The implicit function relation also provides a way in computing

$\frac{\partial {\delta }^{*}\left(\theta \right)}{\partial \theta }$ which is complicated involving taking inverse of the matrix ∇_{(δ, λ)}G((δ*, λ*), θ). Here, a relatively simple way to compute this gradient is presented. Note that:g(θ,δ*(θ))=0.

Taking gradient with both sides with respect to θ,

$\begin{array}{cc}\frac{\partial g\left(\theta ,{\delta }^{*}\right)}{\partial \theta }+\frac{\partial g\left(\theta ,{\delta }^{*}\right)}{\partial \delta }\frac{\partial {\delta }^{*}\left(\theta \right)}{\partial \theta }=0.& \left(5\right)\end{array}$

Combining Equation 4 and Equation 5,

$\begin{array}{cc}{\nabla }_{\theta }F\left(\theta \right)={\lambda }^{*}\left(\theta \right)\frac{\partial g\left(\theta ,{\delta }^{*}\right)}{\partial \theta }.& \left(6\right)\end{array}$

Margin Maximization:

Recall thatd_θ(x,y)=∥δ*∥=min∥δ∥ s.t. δ:L_θ^LM(x+δ,y)≥0.

Note that the constraint of the above optimization problem depends on model parameters, thus margin maximization is a max-min nested optimization problem with a parameter-dependent constraint in its inner minimization.

Computing such gradients for a linear model is easy due to the existence of its closed-form solution, e.g., SVM, but it is not so for functions such as neural networks.

The next theorem provides a viable way to increase d_θ(x, y).

Theorem 2.1. Gradient descent on L_θ^LM(X+δ*, y) w.r.t. θ with a proper step size increases d_θ(x, y) where δ*=arg min_{LθLM(x+δ,y)≥0} ∥δ∥ is the shortest successful perturbation given the current θ.

Theorem 2.1 summarizes the theoretical results, where Applicants show separately later

1) how to calculate the gradient of the margin under some smoothness assumptions;

2) without smoothness, margin maximization can still be achieved by minimizing the loss at the shortest successful perturbation.

Calculating gradients of margins for smooth loss and norm: Denote L_θ^LM(x+δ, y) by L(θ, δ) for brevity. It is easy to see that for a wrongly classified example (x, y), δ* is achieved at 0 and thus ∇_θd_θ(x, y)=0.

Therefore the approach focuses on correctly classified examples.

Denote the LaGrangian as _θ(δ, λ)=∥δ∥+λL(δ, θ.)

For a fixed θ denote the optimizers of _θ(δ, λ) by δ* and λ*.

The following theorem shows how to compute ∇_θd_θ(x, y).

$\mathrm{Proposition}2.1.\mathrm{Let}ϵ\left(\delta \right)=\delta .\mathrm{Given}a\mathrm{fixed}\theta ,\mathrm{assume}\mathrm{that}{\delta }^{*}\mathrm{is}\mathrm{unique},ϵ\left(\delta \right)\mathrm{and}L\left(\delta ,\theta \right)$ $\mathrm{are}{C}^2\mathrm{functions}\mathrm{in}a\mathrm{neighborhood}\mathrm{of}\left(\theta ,{\delta }^{*}\right),\mathrm{and}\mathrm{the}\mathrm{matrix}\left(\begin{array}{cc}\frac{{\partial }^2ϵ\left({\delta }^{*}\right)}{\partial {\delta }^2}+\lambda *\frac{{\partial }^{2}L\left({\delta }^{*},\theta \right)}{\partial {\delta }^2}& \frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \delta }\\ \frac{\partial {L\left({\delta }^{*},\theta \right)}^{\top }}{\partial \delta }& 0\end{array}\right)$ $\mathrm{is}\mathrm{full}\mathrm{rank},\mathrm{then}$ ${\nabla }_{\theta }{d}_{\theta }\left(x,y\right)=C\left(\theta ,x,y\right)\frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \theta },\mathrm{where}$ $C\left(\theta ,x,y\right)=\frac{\langle \frac{\partial ϵ\left({\delta }^{*}\right)}{\partial \delta },\frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \delta }\rangle }{{\frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \delta }}_2^2}\mathrm{is}a\mathrm{scalar}.$

Remark 2.1. By Proposition 2.1, the margin's gradient w.r.t. to the model parameter θ is proportional to the loss′ gradient w.r.t. θ at δ*, the shortest successful perturbation. Therefore to perform gradient ascent on margin, the approach just needs to find δ* and perform gradient descent on the loss.

Margin maximization for non-smooth loss and norm: Proposition 2.1 requires the loss function and the norm to be C² at δ*. This might not be the case for many functions used in practice, e.g. ReLU networks and the l_∞ norm. The next result shows that under a weaker condition of directional differentiability (instead of C²), learning θ to maximize the margin can still be done by decreasing L(θ, δ*) w.r.t. θ, at θ=θ₀. Due to space limitations, there is only presented an informal statement here. Rigorous statements can be found in the Appendix.

Proposition 2.2. Let δ* be unique and L(δ, θ) be the loss of a deep ReLU network. There exists some direction {right arrow over (v)} in the parameter space, such that the loss L(δ, θ)|_δ=δ* can be reduced in the direction of {right arrow over (v)}. Furthermore, by reducing L(δ, θ)|_δ=δ*, the margin is also guaranteed to be increased.

Stabilizing the Learning with Cross Entropy Surrogate Loss

In practice, it is found that gradients of the “logit margin loss” L_θ^LM are unstable. The piecewise nature of the LM loss can lead to discontinuity of its gradient, causing large fluctuations on the boundary between the pieces. It also does not fully utilize information provide by all the logits.

In the MMA algorithm, the approach instead uses the “soft logit margin loss” (SLM)

$L_{\theta }^{\mathrm{SLM}}\left(x,y\right)=\log \sum _{j\ne y}\exp \left(f_{\theta }^j\left(x\right)\right)-f_{\theta }^y\left(x\right),$

which serves as a surrogate loss to the “logit margin loss” L_θ^LM(x, y) by replacing the max function by the LogSumExp (sometimes also called softmax) function. One immediate property is that the SLM loss is smooth and convex (w.r.t. logits). The next proposition shows that SLM loss is a good approximation to the LM loss.

Proposition 2.3.L_θ^SLM(x,y)−log(K−1)≤L_θ^LM(x,y)≤L_θ^LM(x,y),  (4)

where K denote the number of classes.

Remark 2.2. By using the soft logit margin loss, MMA maximizes a lower bound of the margin, the SLM-margin, d_θ^SLM(x, y).d_θ^SLM(x,y)=∥δ*∥=min∥δ∥ s.t. δ:L_θ^LM(x+δ,y)≥0,

To see that, note by Proposition 2.3, L_θ^LM(x, y) upper bounds L_θ^LM(x, y). So one has {δ:L_θ^LM(x+δ, y)≤0}⊆{δ:L_θ^SLM(x+δ, y)≤0}. Therefore, d_θ^SLM(x, y)≤d_θ(x, y), i.e. the SLM-marin is a lower bound of the margin.

The next proposition shows that the gradient of the SLM loss is proportional to the gradient of the cross entropy loss, thus minimizing L_θ^CE(x+δ*, y) w.r.t. θ “is” minimizing L_θ^SLM(x+δ*, y).

$\begin{array}{cc}\mathrm{Proposition}2.4.\mathrm{For}a\mathrm{Fixed}\left(x,y\right)\mathrm{and}\theta ,& \\ {\nabla }_{\theta }{L}_{\theta }^{\mathrm{CE}}\left(x,y\right)=r\left(\theta ,x,y\right){\nabla }_{\theta }{L}_{\theta }^{\mathrm{SLM}}\left(x,y\right),\mathrm{and}{\nabla }_x{L}_{\theta }^{\mathrm{CE}}\left(x,y\right)=r\left(\theta ,x,y\right){\nabla }_x{L}_{\theta }^{\mathrm{SLM}}\left(x,y\right)& \left(5\right)\\ \mathrm{where}\mathrm{the}\mathrm{scalar}r\left(\theta ,x,y\right)=\frac{\sum _{i\ne y}\exp \left(f_{\theta }^i\left(x\right)\right)}{\sum _i\exp \left(f_{\theta }^i\left(x\right)\right)}.& \left(6\right)\end{array}$

Therefore, to simplify the learning algorithm, gradient descent is performed on model parameters using L_θ^CE(x+δ*, y). As such, the approach uses L_θ^CE on both clean and adversarial examples, which in practice stabilizes training:

$\begin{array}{cc}\underset{\theta }{\min }{L}_{\theta }^{\mathrm{MMA}}\left(𝒮\right),\mathrm{where}{L}_{\theta }^{\mathrm{MMA}}\left(𝒮\right)=\sum _{i\in {𝒮}_{\theta }^{+}\bigcap \mathscr{H}\theta }{L}_{\theta }^{\mathrm{CE}}\left(x_i+{\delta }^{*},y_i\right)+\sum _{j\in {𝒮}_{\theta }^{-}}{L}_{\theta }^{\mathrm{CE}}\left(x_j,y_j\right),& \left(7\right)\end{array}$

where

${\delta }^{*}=\arg {\min }_{L_{\theta }^{\mathrm{SLM}}\left(x+\delta ,y\right)\ge 0}\delta $ is found with the SLM loss, and _θ={i:d_θ(x_i, y_i)<d_max} is the set of examples that have margins smaller than the hinge threshold.Finding the Optimal Perturbation δ*

To implement MMA, one still needs to find the δ*, which is intractable in general settings. An adaptation of the projected gradient descent (PGD) (Madry et al., 2017) attack is proposed in this description to give an approximate solution of δ*, the Adaptive Norm Projective Gradient Descent Attack (AN-PGD).

In AN-PGD, Applicants apply PGD on a initial perturbation magnitude ∈_init to find a norm-constrained perturbation δ₁, then Applicants search along the direction of δ₁ to find a scaled perturbation that gives L=0, Applicants then use this scaled perturbation to approximate ∈*. Note that AN-PGD here only serves as an algorithm to give an approximate solution of δ*, and it can be decoupled from the remaining parts of MMA training. Other attacks that can serve a similar purpose can also fit into the MMA training framework, e.g. the Decoupled Direction and Norm (DDN) attack (Rony et al., 2018). Algorithm 1 describes the Adaptive Norm PGD Attack (AN-PGD) algorithm.

Algorithm 1 Adaptive Norm PGD Attack for approximately solving δ*.
Inputs: (x, y) is the data example. ϵinit is the initial norm constraint used in the first PGD attack.
Outputs: δ*, approximate shortest successful perturbation. Parameters: ϵmax is the maximum
perturbation length. PGD (x, y, ϵ) represents PGD perturbation δ with magnitude ϵ.
1: Adversarial example δ1 = PGD (x, y, ϵinit)
2: Unit                      ⁢                                                                                          ⁢                      perturbation                      ⁢                                                                                          ⁢                                              δ                        u                                                              =                                                                  δ                        1                                                                                                                      δ                          1                                                
3: if prediction on x + δ1 is correct then
4: Binary search to find ϵ′, the zero-crossing of L(x + ηδu, y) w.r.t. η, η ∈ [∥δ1∥, ϵmax]
5: else
6: Binary search to find ϵ′, the zero-crossing of L(x + ηδu, y) w.r.t. η, η ∈ [0, ∥δ1∥)
7: end if
8: δ* = ϵ′δu

Remark 2.3. Finding the δ* in Proposition 2.2 and Proposition 2.1 requires solving a non-convex optimization problem, where the optimality cannot be guaranteed in practice. Previous adversarial training methods, e.g. Madry et al. (2017), suffer the same problem. Nevertheless, as shown later in FIG. 10, the proposed MMA training algorithm does achieve the desired behavior of maximizing the margin of each individual example in practice.

Additional Clean Loss During Training

In practice, Applicants observe that when the model is only trained with the objective function in Eq. (7), the input space loss landscape is very flat, which makes PGD less efficient in finding δ* for training, as shown in FIG. 10. Here Applicants choose 50 examples from both training and test sets respectively, then perform PGD attack with ∈=8/255 and keep those failed perturbations. For each, Applicants linearly interpolate 9 more points between the original example and the perturbed, and plot their logit margin losses. In each sub-figure, the horizontal axis is the relative position of the interpolated example: e.g. 0.0 represents the original example, 1.0 represents the perturbed example with ∈=8/255, 0.5 represents the average of them. The vertical axis is the logit margin loss. Recall that when L_θ^LM(x+δ, y)<0, the perturbation δ fails.

OMMA-32 in FIG. 10(a) represents model trained with only L_θ^MMA in Eq. (7) with d_max=8. PGD-8 FIG. 10(b) represents model trained with PGD training (Madry et al., 2017) with ∈=8. As one can see, OMMA-32 has “flatter” loss curves compared to PGD-8. This could potentially weaken the adversary during training, which leads to poor approximation of δ* and hampers training.

To alleviate this issue, Applicants add an additional clean loss term to the MMA objective in Eq. (7) to lower the loss on clean examples, so that the input space loss landscape is steeper. Specifically, Applicants use this combined loss

$\begin{array}{cc}{L}_{\theta }^{\mathrm{CB}}\left(𝒮\right)=\frac{1}{3}\sum _{j\in 𝒮}{L}_{\theta }^{\mathrm{CE}}\left(x_j,y_j\right)+\frac{2}{3}{L}_{\theta }^{\mathrm{MMA}}\left(𝒮\right).& \left(8\right)\end{array}$

The model trained with this combined loss and d_max=32 is the MMA-32 shown in FIG. 10 (c). Adding the clean loss is indeed effective. Most of the loss curves are more tilted, and the losses of perturbed examples are lower. Applicants use L_θ^CB for MMA training in the rest of the paper due to its higher performance. A more detailed comparison between L_θ^CB and L_θ^MMA is described in the Appendix.

ALGORITHM 2
Max-Margin Adversarial Training.
Inputs: The training set {(xi, yi)}. Outputs: the trained model fθ(•) Parameters: ϵ contains
perturbation lengths of training data. ϵmin is the minimum perturbation length. ϵmax is the maxi-
mum perturbation length.    (x, y, ϵinit) represents the approximate shortest successful perturbation
returned by an algorithm      (e.g. AN-PGD) on the data example (x, y) and at the initial norm ϵinit.
1:  Randomly initialize the parameter θ of model f, and initialize every element of ϵ as ϵmin
2:  repeat
3:  Read minibatch B = {(x1, y1), . . . , (xm, ym)}
4:  Make predictions on B and into two: wrongly predicted B0 and correctly predicted B1
5:  Initialize an empty batch B1adv
6:  for (xi, yi) in B1 do
7:  Retrieve perturbation length ϵi from ϵ
8:  δi* =   (xi, yi, ϵi)
9:  Update the ϵi in ϵ as ||δi*||. If ||δi*|| < dmax then put (xi + δi*, yi) into B1adv
10: end for
11: Calculate⁢⁢gradients⁢⁢of⁢⁢∑j∈B0⁢⁢LθCE⁡(xj,yj)+13⁢∑j∈B1⁢LθCE⁡(xj,yj)+23⁢∑j∈B1adv⁢⁢LθCE⁡(xj,yj),
    the combined loss on B0, B1, and B1adv, w.r.t. θ, according to Eqs. (7) and (8)
12: Perform one step gradient step update on θ
13: until meet training stopping criterion

Example Proposed MMA Training Algorithm

Algorithm 2 summarizes the practical MMA training algorithm. During training for each minibatch, Applicants 1) separate it into 2 batches based on if the current prediction is correct; 2) find δ* for each example in the “correct batch”; 3) calculate of the gradient of 0 based on to Eqs. (7) and (8).

Understanding Adversarial Training Through Margin Maximization

Through the development of MMA training in the last section, Applicants have shown that margin maximization is closely related to adversarial training with the optimal perturbation length ∥δ*∥. In this section, Applicants further investigate the behavior of adversarial training in the perspective of margin maximization. Adversarial training (Huang et al., 2015; Madry et al., 2017) minimizes the “worst-case” loss under a fixed perturbation magnitude ∈, as follows.

$\begin{array}{cc}\underset{\theta }{\min }{𝔼}_{x,y}\text{∼}𝒟\underset{\delta \le ϵ}{\max }{L}_{\theta }\left(x+\delta ,y\right).& \left(9\right)\end{array}$

Looking again at FIG. 9, Applicants can see that an adversarial training update step does not necessarily increase the margin. In particular, as Applicants perform an update to reduce the value of loss at the fixed perturbation E, the parameter is updated from θ₀ to θ₁. After this update, Applicants imagine two different scenarios of the updated loss functions L_θ1(•) (the solid curve) in FIGS. 9 (c) and (d). In both (c) and (d), L_θ1(∈) is decreased by the same amount. However, the margin is increased in (c) with δ*₁>δ*₀ but decreased in (d) with δ*₁<δ*₀. s

Formalizing the intuitive analysis, Applicants have presented theorems connecting adversarial training and margin maximization. For brevity, fixing {(x, y)}, let L(θ, δ)=L_θ^LM(x+δ, y), d_θ=d_θ(x, y), and ∈*_θ(ρ)=min_{δ:L(δ, θ)≥ρ}∥δ∥.

Theorem 3.1. Assuming an update from adversarial training changes θ₀ to θ₁ such that p*=max_{∥δ∥≤∈} L(θ₀, δ)>max_{∥δ∥≤∈} L(θ₁, δ), then1) if ∈=d_θ0, then ρ*=0, ∈*_θ1(ρ*)=d_θ1≥d_θ0=∈*_θ0(ρ*);2) if ∈=d_θ0, then ρ*≤0, ∈*_θ0(ρ*)≤d_θ0, ∈*_θ1(ρ*)≤d_θ1, and ∈*_θ1(ρ*)≥∈*_θ0(ρ*);3) if ∈=d_θ0, then ρ*≥0, ∈*_θ0(ρ*)≥d_θ0, ∈*_θ1(ρ*)≥d_θ1, and ∈*_θ1(ρ*)≥∈*_θ0(ρ*);

Remark 3.1. In other words, adversarial training, with the logit margin loss and a fixed perturbation length ∈

1) exactly maximizes the margin, if ∈ is equal to the margin;

2) maximizes a lower bound of the Margin, if ∈ is smaller than the margin;

3) maximizes an upper bound of the margin, if ∈ is larger, than the margin.

Next Applicants look at adversarial training with the cross-entropy loss (Madry et al., 2017) through the connection between cross-entropy and the soft logit margin loss from Proposition 2.4. Applicants first look at adversarial training on the SLM loss. Fixing {(x, y)}, let

$d_{\theta }^{\mathrm{SLM}}=d_{\theta }^{\mathrm{SLM}}\left(x,y\right),\mathrm{and}{ϵ}_{\mathrm{SLM},\theta }^{*}\left(\rho \right)={\min }_{L_{\theta }^{\mathrm{SLM}}\left(x+\delta ,y\right)\ge \rho }\delta .$

Corollary 3.1. Assuming an update from adversarial training changes θ₀ to θ₁, such that max_{∥δ∥≤∈} L_θ0^SLM(x+δ, y)>max_{∥δ∥≤∈} L_θ1^SLM(x+δ, y), if ∈≤d_θ0^SLM, then ρ*=max_{∥δ∥≤∈} L_θ0^SLM(x+δ, y)≤0, ∈*_SLM,θ0 (ρ*)≤d_θ0, ∈*_SLM,θ1 (ρ*)≤d_θ1, and ∈*_SLM,θ1 (ρ*)≥∈*_SLM,θ0 (ρ*).

Remark 3.2. In other words, if ∈ is smaller than or equal to the SLM-margin, adversarial training, with the SLM loss and a fixed perturbation length ∈, maximizes a lower bound of the SLM-margin, thus a lower bound of the margin.

Recall Proposition 2.4 shows that L_θ^CE and L_θ^SLM have the same gradient direction w.r.t. both the model parameter and the input. In adversarial training (Madry et al., 2017), the PGD attack only uses the gradient direction w.r.t. the input, but not the gradient magnitude. Therefore, in the inner maximization loop, using the SLM and CE loss will result in the same approximate δ*. Furthermore, ∇_θL_θ^CE(x+δ*, y) and ∇_θL_θ^SLM(x+δ*, y) have the same direction. If the step size is chosen appropriately, then a gradient update that reduces L_θ^CE(x+δ*, y) will also reduce L_θ^SLM(x+δ*, y). Combined with Remark 3.2, these suggest:

Adversarial training with cross entropy loss (Madry et al., 2017) approximately maximizes a lower bound of the margin, if ∈ is smaller than or equal to the SLM-margin.

Remark 3.3. From the analysis above, Applicants recognize that when E equals to (or smaller than) the margin, adversarial training maximizes the margin (or the lower bound of it). On the other hand, when ∈ is larger then the margin, they do not have such relation. Applicants could anticipate that when ∈ is too large, adversarial training might not necessarily increase the margin. For adversarial training with a large ∈, starting with a smaller ∈ then gradually increasing it could help, since the lower bound of margin is maximized at the start of training. Results in the earlier Sections corroborate this theoretical prediction.

FIG. 4 is an example pseudocode provided in accordance with an embodiment and is provided as an illustrative, non-limiting example.

An example description of the implementation of the approach is provided as a non-limiting example below. A neural network is provided that models the scoring function where each logit (e.g., output of the network without softmax function) represents the score of each class.

From Theorem 1.1, it is known that performing regular gradient descent on x+δ*, namely the closest point to x on the decision boundary, then the approach is performing gradient descent on the margin.

Therefore, it is useful is to find δ* or a perturbation as close to possible to δ*.

If one knows the margin ε* of a data point x, PGD perturbed x with length ε* can be applied, PGD (x, ε*), as an approximation of x+δ*, assuming that PGD attack maximizes the loss reasonably well.

The margin ε* is estimated using PGD attack followed by a binary search for the zero-crossing of loss L. Specifically, the approach includes performing a PGD attack on x with a fixed perturbation length ε₀ to obtain x_adv, and then searching along the direction of xadv-x to find a scaled perturbation that gives L=0. The norm of this scaled on-decision boundary perturbation is used as the margin estimate.

In this section, an example embodiment is shown to be a stronger requirement than adversarial training.

Recall that in adversarial training, a model ƒ is learned by minimizing the adversarial loss,

$\underset{\theta }{\min }G\left(\theta \right)=\underset{\theta }{\min }\underset{\delta \le ϵ}{\max }L\left(\theta ,x+\delta ,y\right).$

Consideration should be made in relation to: ∈*=min_{L(θ,x+δ,y)≥l} ∥δ∥ and l*=max_{∥δ∥≤∈} L(θ, x+δ, y).

$\mathrm{Theorem}1.2.\mathrm{Let}L\left(\theta ,x,y\right)\mathrm{be}a{C}^1\mathrm{differentiable}\mathrm{function}\mathrm{with}$ $\mathrm{respect}\mathrm{to}\mathrm{the}\mathrm{input}x.\mathrm{Assume}{\ell }^{*}\mathrm{is}a\mathrm{regular}\mathrm{value}$ $\mathrm{for}L\left(\theta ,x,y\right).\mathrm{Then}\mathrm{for}\mathrm{any}{\ell }^{*}\in \mathrm{Range}\left(L\left(\theta ,x,y\right)\right)\text{:}$ ${ϵ}^{*}=\underset{L\left(\theta ,x+\delta ,y\right)\ge {\ell }^{*}}{\min }\delta ⟹\underset{\delta \le {ϵ}^{*}}{\max }L\left(\theta ,x+\delta ,y\right)={\ell }^{*}\left(7\right)$

The zero-crossing binary search is denoted as arg min_η |L(η)| for brevity.

For any δ*:

$\begin{array}{cc}\underset{\delta \le {ϵ}^{*}}{\max }L\left(\theta ,x+\delta ,y\right)={\ell }^{*}⟹\underset{L\left(\theta ,x+\delta ,y\right)\ge {\ell }^{*}}{\min }\delta \le {ϵ}^{*}& \left(8\right)\end{array}$

Proof left⇒right Let l* ∈ Range(L(θ, x, y)) be given, Since L(θ, x, y) is defined on a compact set [0, 1]^d and L(θ, x+δ, y)≥l* is a closed set, and ∥δ∥ is a continuous function, the minimum ∈*=∥δ*∥ is achieved by δ*. Note that

$\begin{array}{cc}\begin{array}{c}{ϵ}^{*}=\underset{L\left(\theta ,x+\delta ,y\right)\ge {\ell }^{*}}{\min }\delta \\ =\underset{x+\delta \in \left\{x+\delta :L\left(\theta ,x+\delta ,y\right)\ge {\ell }^{*}\right\}}{\inf }x+\delta -x\left(10\right)\\ =d\left(z,\left\{z\text{:}L\left(\theta ,z,y\right)\ge {\ell }^{*}\right\}\right)\left(11\right)\\ =d\left(z,\left\{z\text{:}L\left(\theta ,z,y\right)={\ell }^{*}\right\}\right)\left(12\right)\end{array}& \left(9\right)\end{array}$ The first three equalities are reformulations of the definitions. The last equality follows because l* is a regular value for L(θ, x, y) by Sard's theorem and implicit function theorem, {z:L(θ, z, y)=L*} is a C¹ manifold which is the boundary for {z:L(θ, z, y)≥l*}. Then the minimization is achieved on the boundary instead of the interior, by a perturbation argument leading to contradiction. Moreover, observe no δ such that ∥δ∥<∥δ*∥ can reach the minimum, due to the monotonicity of the norm function with respect to radius. Together, this means ∈*=∥δ*∥ is achieved at {z:L(θ, z, y)=L*}. Therefore,

$\underset{\delta \le {ϵ}^{*}}{\max }L\left(\theta ,x+\delta ,y\right)=\underset{\delta ={ϵ}^{*}}{\min }L\left(\theta ,x+\delta ,y\right)={\ell }^{*}$ right⇒left. The argument is almost identical to the above except that we longer have monotonicity of the lass L(θ, x+δ, y) with respect to any parameterization in the input δ, due to the lack of strict convexity of L. Therefore, there is a gap when going from the right to the left.

When we have δ^#=arg max_{∥δ∥≤∈#} L(θ, X+δ, y) and l^#=L(θ, xδ^#, y) and then perform gradient descent using ≡_θL(θ, x+δ^#, y), it is equivalent (up to a scaling factor) to perform gradient ascent on, ∈^#, where ∈^#=min_{L(θ,x+δ,y)≥l#}∥δ|

Additionally we leave the following corollary

Corollary 1.1. Given ★₀=min_{L(θ,x+δ,y)≥l0} ∥δ∥ and ∈₁=min_{L(θ,x+δ,y)≥l1} ∥δ∥, then l₁>l₀ ⇒∈₁≥∈₀.

Based on Proposition 1.1, we can see that if l^#>0, then ∈^# is a upper bound of the margin, if l^##<0, then ∈^# is a lower bound of the margin.

Therefore, minimizing “adversarial loss” with fixed norm ball is maximizing the lower bound of the margin on robust examples, and maximizing the upper bound of the margin on non-robust examples.

There will be no doubt that some δ will lead a change the label of x₀+δ such that the loss is positive, unless the network outputs the same label on the entire domain.

Therefore, there will always be a feasible region for δ.

Depends on the value of L_x0(θ, 0), there are 3 situations (for each case, Applicants analyze where the optimal is obtained, value of margin, gradient of margin):

1. When L_x0(θ, 0)<0, it means that x₀ is correctly classified. So the margin will be obtained on the boundary of the constraint, the equality constraint L_x0(θ, 0)=0. The margin will be positive, i.e. ε*>0. Infinitesimal changes of will change the level set L_x0=(θ, 0). So ε* has non-zero gradient with respect to θ.

2. When L_x0(θ, 0)>0, it means the example is already wrongly classified, and therefore the margin will be zero, ε*=0. Infinitesimal changes of θ will not lead to changes of the margin's value. So e has zero gradient with respect to a θ For this situation, the only hope is to minimize the loss to negative, in order to get a positive margin. This observation is related to “warm start” and how to automatically adjust regularization coefficients, say by introducing concepts like “FG(S)M-margin”.

3. For the measure zero case of L_x0(θ, 0)=0, ε* is obtained both on the original point and the constraint boundary. L_x0(θ, 0)=0. So ∈* has non-zero gradient with respect to θ.

FIG. 5 is an example illustration of an adversarial example generated using a nave approach where a fixed perturbation length is used.

As shown in this figure, traditional approaches to adversarial training suffer from inherent limitations in that a fixed perturbation length 500 is used through the training process. In general, the fixed perturbation length 500 seems to be set arbitrarily. Moreover, different data points may have different intrinsic robustness, and fixing one perturbation length for all the data points across the entire training procedure is suboptimal.

Adversarial training with fixed perturbation length ∈ 500 is inferior to MMA training because it maximizes a lower (or upper) bound of the margin if the fixed perturbation length ∈ 500 is smaller (or larger) than the margin of that training point. As such, MMA training improves adversarial training in the sense that it enables adaptive selection of the “correct” perturbation length ∈ as the margin individually for each data point.

FIG. 6 is an example illustration of an adversarial example generated in accordance with some embodiments where adv₂ is generated based on a binary search of adv₁.

FIG. 7A and FIG. 7B are illustrations of a margin pre-training with an improved adversarial example and post-training with an improved adversarial example. In FIG. 7B, a larger margin is provided in respect of a decision boundary.

FIG. 8 is an illustration of decision boundary 800, margin 802, and shortest successful perturbation 804 on application of an adversarial perturbation.

FIG. 8 is an example where the classifier changes its prediction from panda to bucket when the input is perturbed from sample point A 806 to sample point B 808. A neural network may be trained to correctly classify an input image as that of a panda bear. However, adding small changes to this benign example by applying a perturbative noise to the input may cause a shift of classification such that the same image of a panda bear is incorrectly classified by the system as a bucket. The use of such perturbative noises provides a tool with a high probability of success in fooling the neural network as part of an adversarial attack.

This example also shows the natural connection between adversarial robustness and the margins of the data points, where the margin 802 is defined as the distance from a data point to the classifier's decision boundary 800. Intuitively, the margin 802 of a data point is the minimum distance needed to perturb x and make the prediction go wrong. Thus, the larger the margin 802, the farther the distance from the input to the decision boundary 800 of a classifier, and the more robust the classifier is with respect to this input.

FIG. 9 is a 1-D example of how margin is affected by decreasing the loss at different locations, according to some embodiments. A 1-D example is shown to explain the principle and mechanism of operation, but in practical implementations, an N-dimensional approach is more likely, as N may be the number of potential variables or aspects being tracked in the machine learning data model (e.g., neural network).

For example, there may be a 2-D example, a 3-D example, a 4-D example, and so forth, and what is important to note is the perturbation distance.

The margin of a data point is the minimum distance that x has to be perturbed to change a classifier's prediction. Thus, the larger the margin, the farther the distance from the input to the decision boundary of the classifier, and the more robust the classifier is with respect to this input.

As explained below, the use of MMA training is shown to directly maximize margins calculated for each data point at 902. 902 illustrates the principle of some embodiments described herein.

The perturbation shown is improved relative to the nave approaches of 904 and 906, which show a fixed perturbation length approach.

In contrast, the use of a fixed arbitrary perturbation length may lead to either margin increases at 904, or margin decreases at 906, depending on whether the perturbation length is set too small, such that the resulting models lack robustness, or too large, such that the resulting models lack accuracy.

FIG. 9 should be contemplated in view of FIG. 11, which shows sample histograms whereby a comparison is drawn between the two approaches, which becomes more apparent as the number of epochs increase.

As shown in FIG. 11, the histogram generated in relation to the fixed approaches starts to have two peaks, one at the origin and one at a further distance. These two peaks are indicative of examples generated that are either “too hard” (too close to the origin), or “too easy” (too far from the origin).

On the other hand, the MMA approach of some embodiments yields improved outcomes that has a peak in the “Goldilocks” range whereby the examples are useful for training (being neither too hard nor too easy). This is evident in the histograms of FIG. 11.

In technical terms, FIG. 9 illustrates the relationship between the margin and the adversarial loss with an example.

Consider a 1-D example at 900, where the input example x is a scalar. Consider also perturbing x in the positive direction with perturbation δ, fixing (x, y), and overloading L(δ, θ)=L_θ^LM(x+δ, y), which is monotonically increasing on δ, namely larger perturbation results in higher loss. Let L(•, θ₀) (the dashed curve) denote the original function before an updated step, and δ*₀=arg min_{L(δ,θ0)≥0} ∥δ∥ denote the corresponding margin (same as shortest successful perturbation in 1D).

As shown at 902, as the parameter is updated to θ₁ such that L(δ*₀, θ₁) is reduced, the new margin δ*₁=arg min_{L(δ,θ1)≥0} ∥δ∥ is enlarged. Intuitively, a reduced value of the loss at the shortest successful perturbation leads to an increase in margin.

FIG. 9 further shows that an adversarial training update step does not necessarily increase the margin. In particular, as an update is performed to reduce the value of loss at the fixed perturbation ∈, the parameter is updated from θ₀ to θ₁.

This update gives rise to two different scenarios of the updated loss functions L_θ1(•) (the solid curve) at 904 and 906.

At both 904 and 906, L_θ1(∈) is decreased by the same amount. However, the margin is increased at 904 with δ*₁>δ*₀ but decreased at 906 with δ*₁<δ*₀.

Formalizing the intuitive analysis, two theorems are presented connecting adversarial training and margin maximization. For brevity, fixing {(x, y)}, let L(θ, δ)=L_θ^LM(x+δ, y), d_θ=d_θ(x, y), and ∈*_θ(ρ)=min_{δ:L(δ,θ)≥ρ}∥δ∥.

Applicants empirically examine several hypotheses and compare MMA training with different adversarial training algorithms on the MNIST and CIFAR10 datasets under l_∞/l₂₋ norm constrained perturbations. Due to space limitations, Applicants mainly present results on CIFAR10-l_∞ for representative models in Table 1. Full results are in Table 2 to 13 in the Appendix. Implementation details are also left to the Appendix, including neural network model, training and attacking hyperparameters.

The results confirm the theory and show that MMA training is stable to its hyperparameter d_max, and balances better among various attack lengths compared to adversarial training with fixed perturbation magnitude. This suggests that MMA training is a better choice for defense when the perturbation length is unknown, which is often the case in practice.

Measuring Adversarial Robustness: Applicants use the robust accuracy under multiple projected gradient descent (PGD) attacks (Madry et al., 2017) as the robust measure. Specifically, given an example, each model is attacked by both repeated randomly initialized whitebox PGD attacks and numerous transfer attacks, generated from whitebox PGD attacking other models. If any one of these attack succeeds, then the model is considered “not robust under attack” on this example. For each dataset-norm setting and for each example, under a particular magnitude ∈, Applicants first perform N randomly initialized whitebox PGD attacks on each individual model, then use N·(m−1) PGD attacks from all the other models to perform transfer attacks, where m is the total number of model considered under each setting. In the experiments, Applicants use N=10 for models trained on CIFAR10, thus the total number of the “combined” (whitebox and transfer) set of attacks is 320 for CIFAR10-l_∞ (m=32).³

Applicants use ClnAcc for clean accuracy, AvgAcc for the average over both clean accuracy and robust accuracies at different ∈'s, AvgRobAcc for the average over only robust accuracies under attack.

Effectiveness of Margin Maximization During Training

As discussed in an earlier section, MMA training enlarges margins of all training points, while PGD training, by minimizing the adversarial loss with a fixed ∈, might fail to enlarge margins for points with initial margins smaller than ∈.

TABLE 1
Accuracies of representative models trained on CIFAR10 with  ∞-norm constrained
attacks. These robust accuracies are calculated under combined (whitebox + transter) PGD attacks.
AvgAcc averages over clean and all robust accuracies; AvgRobAcc averages over all robust
accuracies.
CIFAR10				RobAcc under different ϵ, combined (whitebox + transfer) attacks
Model	Cln Acc	AvgAcc	AvgRobAcc	4	8	12	16	20	24	28	32
PGD-8	85.14	27.27	20.03	67.73	46.47	26.63	12.33	4.69	1.56	0.62	0.22
PGD-16	68.86	28.28	23.21	57.99	46.09	33.64	22.73	13.37	7.01	3.32	1.54
PGD-24	10.90	9.95	9.83	10.60	10.34	10.11	10.00	9.89	9.69	9.34	8.68
PGDLS-8	85.63	27.20	19.90	67.96	46.19	26.19	12.22	4.51	1.48	0.44	0.21
PGSLS-16	70.68	28.44	23.16	59.43	47.00	33.64	21.72	12.66	6.54	2.98	1.31
PGDLS-24	58.36	26.53	22.55	49.05	41.13	32.10	23.76	15.70	9.66	5.86	3.11
MMA-12	88.59	26.87	19.15	67.96	43.42	24.07	11.45	4.27	1.43	0.45	0.16
MMA-20	86.56	28.86	21.65	66.92	46.89	29.83	16.55	8.14	3.25	1.17	0.43
MMA-32	84.36	29.39	22.51	64.82	47.18	31.49	18.91	10.16	4.77	1.97	0.81
PGD-ens	87.38	28.10	20.69	64.59	46.95	28.88	15.10	6.35	2.35	0.91	0.39
PGDLS-ens	76.73	29.52	23.62	60.52	48.21	35.06	22.14	12.28	6.17	3.14	1.43

This is because when d_θ(x, y)<∈, PGD training is maximizing an upper bound of d_θ(x, y), which may not necessarily increase the margin. To verify this, Applicants track how the margin distribution changes during training processes in 2 models under the CIFAR10-l₂₄ case, MMA-3.0 vs PGD-2.5. Applicants use MMA-d_max to denote the MMA trained model with the combined loss in Eq. (8) and hinge threshold d_max, and PGD-∈ to represent the PGD trained (Madry et al., 2017) model with fixed perturbation magnitude ∈.

Specifically, Applicants randomly select 500 training points, and measure their margins at the checkpoint saved after each training epoch. Applicants use the norm of the perturbation, generated by the 1000-step DDN attack (Rony et al., 2018), to approximate the margin. The results are shown in FIG. 11, where each subplot is a histogram (rotated by 90°) of margin values. For the convenience of comparing across epochs, Applicants use the vertical axis to indicate margin value, and the horizontal axis for counts in the histogram. The number below each subplot is the corresponding training epoch. Margins mostly concentrate near 0 for both models at the beginning. As training progresses, both enlarge margins on average. However, in PGD training, a portion of margins stay close to 0 across the training process. At the same time, it also pushes some margins to be even higher than 2.5, probably because PGD training keeps maximizing lower bounds of these margins, as Applicants discussed earlier. the ∈ value that the PGD-2.5 model is trained for. MMA training, on the other hand, does not “give up” on those data points with small margins. At the end of training, 37.8% of the data points for PGD-2.5 have margins smaller than 0.05, while the same number for MMA-3.0 is 20.4%. As such, PGD training enlarges the margins of “easy data” which are already robust enough, but “gives up” on “hard data” with small margins. Instead, MMA training pushes the margin of every data point, by finding the proper ∈. In general, when the attack magnitude is unknown, MMA training would be able to achieve a better balance between small margins and large margins, and thus achieves a better balance among adversarial attacks with various ∈.

Gradually Increasing ∈ Helps PGD Training when ∈ is Large

The previous analysis in an earlier section suggests that when the fixed perturbation magnitude ∈ is small, PGD training increases the lower bound of the margin. On the other hand, when ∈ is larger than the margin, PGD training does not necessarily increase the margin. This is indeed confirmed by the experiments. PGD training fails at larger ∈, in particular ∈=24/255 for the CIFAR10-l_∞ as shown in Table 1. Applicants can see that PGD-24's accuracies at all test ∈'s are around 10%.

Aiming to improve PGD training, Applicants propose a variant of PGD training, named PGD with Linear Scaling (PGDLS). The difference is that Applicants grow the perturbation magnitude from 0 to the fixed magnitude linearly in 50 epochs. According to the theory, a gradually increasing perturbation magnitude could avoid picking a ∈ that is larger than the margin, thus manages to maximizing the lower bound of the margin rather than its upper bound, which is more sensible. It can also be seen as a “global magnitude scheduling” shared by all data points, which is to be contrasted to MMA training that gives magnitude scheduling for each individual example.

Applicants use PGDLS-∈ to represent these models and show their performances also in Table 1. Applicants can see that PGDLS-24 is trained successfully, whereas PGD-24 fails. At ∈=8 or 16, PGDLS also performs similar or better than PGD training, confirming the benefit of training with small perturbation at the beginning.

Comparing MMA Training with PGD Training

From the first 3 columns in Table 1, Applicants can see that MMA training is very stable to its hinge hyperparameter d_max. When d_max is set to smaller values such as 12 and 20, MMA models attain good robust accuracies across different attacking magnitudes, with the best clean accuracies in the table. When d_max is large, MMA training can still learn a reasonable model that is both accurate and robust. For MMA-32, although d_max is set to a “impossible-to-be-robust” level at 32/255, it still achieves 84.36% clean accuracy and 47.18% robust accuracy at 8/255, and automatically “ignores” the demand to be robust at larger ∈'s, including 20, 24, 28 and 32, as it might be infeasible due to the intrinsic difficulty of the problem. In contrast, PGD trained models are more sensitive to their fixed perturbation magnitude. In terms of the overall performance, Applicants notice that MMA training with a large d_max, e.g. 20 or 32, achieves high AvgAcc values, e.g. 28.86% or 29.39%. However, for PGD training to achieve a similar performance, ∈ needs to be carefully picked (PGD-16 and PGDLS-16) and their clean accuracies suffer a significant drop.

Applicants also compare MMA models with ensemble of PGD trained models. PGD-ens/PGDLS-ens represents the ensemble of PGD/PGDLS trained models with different ∈'s. The ensemble makes prediction by majority voting on label predictions, and uses softmax scores as the tie breaker.

MMA training achieves similar performance compared to the ensemble PGD models. PGD-ens maintains a good clean accuracy, but it is still marginally outperformed by MMA-32 w.r.t. robustness at varies ∈'s. Further note that 1) the ensemble models require significantly higher computation costs both at training and test times; 2) Attacking an ensemble model is still relatively unexplored in the literature, thus the whitebox PGD attacks on the ensembles may not be sufficiently effective; and 3) as shown in the Appendix, for MNIST-l_∞/l₂, MMA trained models significantly outperform the PGD ensemble models.

Testing on gradient free attacks: As a sanity check for gradient obfuscating (Athalye et al., 2018), Applicants also performed the SPSA attack (Uesato et al., 2018), to all the l_∞-MMA trained models on the first 100 test examples. Applicants find that, in all cases, SPSA attack does not find any new adversarial examples in addition to whitebox only PGD attacks.

In this description, Applicants proposed to directly maximizes the margins to achieve adversarial robustness. Applicants developed the MMA training algorithm that optimizes the margins via adversarial training with “optimal” perturbation magnitude. Applicants further rigorously analyzed the relation between adversarial training and margin maximization. The experiments on CIFAR10 and MNIST confirmed the theory and demonstrated that MMA training outperformed adversarial training in terms of both adversarial robustness and its “robustness in training” w.r.t to the maximum perturbation magnitude considered.

FIG. 10 is a visualization of a loss landscape in the input space for MMA and PGD trained models showing that when the model is only trained with an objective function such as

$\begin{array}{cc}\underset{\theta }{\min }{L}_{\theta }^{\mathrm{MMA}}\left(𝒮\right),\mathrm{where}{L}_{\theta }^{\mathrm{MMA}}\left(𝒮\right)=\sum _{i\in {𝒮}_{\theta }^{+}\bigcap \mathscr{H}\theta }{L}_{\theta }^{\mathrm{CE}}\left(x_i+{\delta }^{*},y_i\right)+\sum _{j\in {𝒮}_{\theta }^{-}}{L}_{\theta }^{\mathrm{CE}}\left(x_j,y_j\right),,& \end{array}$ where δ*=arg min_{LθSLM(x+δ,y)≤0} ∥δ∥ is found with the SLM loss, and _θ={i:d_θ(x_i, y_i)<d_max} is the set of examples that have margins smaller than the hinge threshold, the input space loss landscape is very flat, which makes PGD less efficient in finding δ* for training.

The example in FIG. 10 follows an experiment in which 50 examples from both training and test sets respectively were chosen and PGD attacks were performed with ∈=8/255 and keeping the failed perturbations.

For each, 9 more points were linearly interpolated between the original example and the perturbed, and the associated logit margin losses were plotted. In each sub-FIG. 1000, the horizontal axis is the relative position of the interpolated example: e.g. 0.0 represents the original example, 1.0 represents the perturbed example with ∈=8/255, 0.5 represents the average of them. The vertical axis is the logit margin loss. Recall that when L_θ^LM(x+δ, y)<0, the perturbation fails.

OMMA-32 at 1002 represents model trained with only L_θ^MMA in the objective function with dmax=8. PGD-8 at 1004 represents model trained with PGD training with ∈=8. The results show that OMMA-32 at 1002 has “flatter” loss curves compared to PGD-8 at 1004. This could potentially weaken the adversary during training, which leads to poor approximation of δ* and hampers training.

To alleviate this issue, an additional clean loss term was added to the MMA objective in the objective function to lower the loss on clean examples, so that the input space loss landscape is steeper. Specifically, the following combined loss is used:

$L_{\theta }^{\mathrm{CB}}\left(\right)=\frac{1}{3}\sum _{j\in 𝒮}{L}_{\theta }^{\mathrm{CE}}\left(x_j,y_j\right)+\frac{2}{3}{L}_{\theta }^{\mathrm{MMA}}\left(\right).$

The model trained with this combined loss and dmax=32 is the MMA-32 shown at 1006. Adding the clean loss is effective. Most of the loss curves are more tilted, and the losses of perturbed examples are lower.

FIG. 11 is an example diagram of margin distributions during training.

As shown at 1100, the MMA training algorithm disclosed herein achieves the desired behavior of maximizing the margin of each individual example.

Specifically, FIG. 11 shows eleven epochs of randomly selected 500 training points and measuring the margins of said points at the checkpoint saved after each training epoch. A norm of the perturbation, generated by the 1000-step DDN attack, was used to approximate the margin.

Each subplot 1104 is a histogram (rotated by 90°) of margin values. For the convenience of comparing across epochs, vertical axis were used to indicate margin value, and the horizontal axis for counts in the histogram. The number below each subplot 1104 is the corresponding training epoch.

At 1102, margins are shown to mostly concentrate near 0 for both models at the beginning. As training progresses between epoch 1 at 1102 and epoch 141 at 1100, both margins are observed to enlarge on average. As shown in FIG. 11, there are two histograms, 1106 and 1108 at different epochs. It is important to note that the distinctions between the peaks.

For 1106 (MMA training), the peak is at a range that is useful for training. Conversely, for 1108 (PGD training), the first peak is around a margin and there is also a second peak at around 2.9. In PGD training, several margins stay close to 0 across the training process and some margins are pushed to be even higher than 2.5, probably because PGD training keeps maximizing the lower bounds of these margins. MMA training shown at 1106, on the other hand, does not “give up” on those data points with small margins. At the end of training, 37.8% of the data points for PGD-2.5 have margins smaller than 0.05, while the same number for MMA-3.0 is 20.4%.

As such, PGD training 1108 enlarges the margins of “easy data” which are already robust enough, but “gives up” on “hard data” with small margins. Instead, MMA training 1106 pushes the margin of every data point, by finding the proper ∈. In general, when the attack magnitude is unknown, MMA training would be able to achieve a better balance between small margins and large margins, and thus achieves a better balance among adversarial attacks with various ∈.

Overall, as shown in Table 1 below, MMA training is stable to its hyperparameter d_max, and balances better among various attack lengths compared to adversarial training with fixed perturbation magnitude. This suggests that MMA training is a better choice for defense when the perturbation length is unknown, which is often the case in practice.

TABLE 1
Accuracies of representative models trained on CIFAR10 with  ∞-norm constrained
attacks. These robust accuracies are calculated under combined (whitebox + transter) PGD attacks.
AvgAcc averages over clean and all robust accuracies; AvgRobAcc averages over all robust
accuracies.
CIFAR10				RobAcc under different ϵ, combined (whitebox + transfer) attacks
Model	Cln Acc	AvgAcc	AvgRobAcc	4	8	12	16	20	24	28	32
PGD-8	85.14	27.27	20.03	67.73	46.47	26.63	12.33	4.69	1.56	0.62	0.22
PGD-16	68.86	28.28	23.21	57.99	46.09	33.64	22.73	13.37	7.01	3.32	1.54
PGD-24	10.90	9.95	9.83	10.60	10.34	10.11	10.00	9.89	9.69	9.34	8.68
PGDLS-8	85.63	27.20	19.90	67.96	46.19	26.19	12.22	4.51	1.48	0.44	0.21
PGSLS-16	70.68	28.44	23.16	59.43	47.00	33.64	21.72	12.66	6.54	2.98	1.31
PGDLS-24	58.36	26.53	22.55	49.05	41.13	32.10	23.76	15.70	9.66	5.86	3.11
MMA-12	88.59	26.87	19.15	67.96	43.42	24.07	11.45	4.27	1.43	0.45	0.16
MMA-20	86.56	28.86	21.65	66.92	46.89	29.83	16.55	8.14	3.25	1.17	0.43
MMA-32	84.36	29.39	22.51	64.82	47.18	31.49	18.91	10.16	4.77	1.97	0.81
PGD-ens	87.38	28.10	20.69	64.59	46.95	28.88	15.10	6.35	2.35	0.91	0.39
PGDLS-ens	76.73	29.52	23.62	60.52	48.21	35.06	22.14	12.28	6.17	3.14	1.43

As discussed previously, when the fixed perturbation magnitude ∈ is small, PGD training increases the lower bound of the margin. On the other hand, when ∈ is larger than the margin, PGD training does not necessarily increase the margin.

This is indeed confirmed by experimental data presented in Table 1. PGD training fails at larger ∈, in particular ∈=24/255 for the CIFAR10-l_∞ as shown in Table 1. PGD-24's accuracies at all test ∈'s are around 10%.

Aiming to improve PGD training, a variant of PGD training, namely PGD with Linear Scaling (PGDLS), is proposed. In PGDLS, the perturbation magnitude is increased from 0 to the fixed magnitude linearly in 50 epochs.

A gradually increasing perturbation magnitude could avoid picking a ∈ that is larger than the margin, thus maximizing the lower bound of the margin rather than its upper bound, which is more sensible. It can also be seen as a “global magnitude scheduling” shared by all data points, which is to be contrasted to MMA training that gives magnitude scheduling for each individual example.

PGDLS-E is used to represent these models and show their performances in Table 1. Table 1 shows that PGDLS-24 is trained successfully, whereas PGD-24 fails. At ∈=8 or 16, PGDLS also performs similar or better than PGD training, confirming the benefit of training with small perturbation at the beginning.

The first 3 columns in Table 1, further show that MMA training is very stable to its hinge hyperparameter d_max.

When d_max is set to smaller values such as 12 and 20, MMA models attain good robust accuracies across different attacking magnitudes, with the best clean accuracies in the table.

When d_max is large, MMA training can still learn a reasonable model that is both accurate and robust. For MMA-32, although d_max is set to a “impossible-to-be-robust” level at 32/255, it still achieves 84.36% clean accuracy and 47.18% robust accuracy at 8/255, and automatically “ignores” the demand to be robust at larger ∈'s, including 20, 24, 28 and 32, as it might be infeasible due to the intrinsic difficulty of the problem.

In contrast, PGD trained models are more sensitive to their fixed perturbation magnitude. In terms of the overall performance, MMA training with a large d_max, e.g. 20 or 32 achieves high AvgAcc values, e.g. 28.86% or 29.39%. However, for PGD training to achieve a similar performance, ∈ needs to be carefully picked (PGD-16 and PGDLS-16) and their clean accuracies suffer a significant drop.

MMA models were further compared with an ensemble of PGD trained models. PGD-ens/PGDLS-ens represents the ensemble of PGD/PGDLS trained models with different ∈'s. The ensemble makes prediction by majority voting on label predictions, and uses softmax scores as the tie breaker.

MMA training achieves similar performance compared to the ensemble PGD models. PGD-ens maintains a good clean accuracy, but it is still marginally outperformed by MMA-32 with respect to robustness at different ∈'s.

Further note that 1) the ensemble models require significantly higher computation costs both at training and test times; 2) Attacking an ensemble model is still relatively unexplored in the literature, thus whitebox PGD attacks on the ensembles may not be sufficiently effective; and 3) for MNIST-l_∞/l₂, MMA trained models significantly outperform the PGD ensemble models.

As a sanity check for gradient obfuscating, an SPSA attack was also performed on all l_∞-MMA trained models on the first 100 test examples.

In all cases, the SPSA attack does not find any new adversarial examples in addition to whitebox only PGD attacks.

FIG. 12 is an example diagram of an example computing system, according to some embodiments. FIG. 12 is a schematic diagram of a computing device 1200 such as a server. As depicted, the computing device includes at least one processor 1202, memory 1204, at least one I/O interface 1206, and at least one network interface 1208.

Processor 1202 may be an Intel or AMD x86 or x64, PowerPC, ARM processor, or the like. Memory 1204 may include a combination of computer memory that is located either internally or externally such as, for example, random-access memory (RAM), read-only memory (ROM), compact disc read-only memory (CDROM). Each I/O interface 1206 enables computing device 1200 to interconnect with one or more input devices, such as a keyboard, mouse, camera, touch screen and a microphone, or with one or more output devices such as a display screen and a speaker. I/O interfaces can include application programming interfaces.

Each network interface 1208 enables computing device 1200 to communicate with other components, to exchange data with other components, to access and connect to network resources, to serve applications, and perform other computing applications by connecting to a network (or multiple networks) capable of carrying data including the Internet, Ethernet, plain old telephone service (POTS) line, public switch telephone network (PSTN), integrated services digital network (ISDN), digital subscriber line (DSL), coaxial cable, fiber optics, satellite, mobile, wireless (e.g. Wi-Fi, WiMAX), SS7 signaling network, fixed line, local area network, wide area network, and others.

The term “connected” or “coupled to” may include both direct coupling (in which two elements that are coupled to each other contact each other) and indirect coupling (in which at least one additional element is located between the two elements).

Although the embodiments have been described in detail, it should be understood that various changes, substitutions and alterations can be made herein without departing from the scope. Moreover, the scope of the present application is not intended to be limited to the particular embodiments of the process, machine, manufacture, composition of matter, means, methods and steps described in the specification.

As one of ordinary skill in the art will readily appreciate from the disclosure, processes, machines, manufacture, compositions of matter, means, methods, or steps, presently existing or later to be developed, that perform substantially the same function or achieve substantially the same result as the corresponding embodiments described herein may be utilized. Accordingly, the appended claims are intended to include within their scope such processes, machines, manufacture, compositions of matter, means, methods, or steps.

As can be understood, the examples described above and illustrated are intended to be exemplary only.

APPENDIX

A. Proofs

A.1 Proof of Proposition 2.1

Proof. Recall ∈(δ)=∥δ∥. Here Applicants compute the gradient for d_θ(x, y) in its general form. Consider the following optimization problem:

$d_{\theta }\left(x,y\right)=\underset{\delta \in \Delta \left(\theta \right)}{\min }ϵ\left(\delta \right),$

where Δ(θ)={δ:L_θ(x+δ, y)=0}, ∈ and L(δ, θ) are both C² functions ⁶. Denotes its Lagraingian by (δ, λ), where ⁶Note that a simple application of Danskin's Theorem would not be valid as the constraint set Δ(θ) depends on the parameter θ.(δ,λ)=∈(δ)+λL_θ(x+δ,y)

For a fixed θ, the optimizer δ* and λ* must satisfy the first-order conditions (FOC)

$\begin{array}{cc}\frac{\partial ϵ\left(\delta \right)}{\partial \delta }+\lambda \frac{\partial L_{\theta }\left(x+\delta ,y\right)}{\partial \delta }{|}_{\delta ={\delta }^{*},\lambda ={\lambda }^{*}}=0,L_{\theta }\left(x+\delta ,y\right){|}_{\delta ={\delta }^{*}}=0.& \left(10\right)\end{array}$

Put the FOC equations in vector form,

$G\left(\left(\delta ,\lambda \right),\theta \right)=\left(\begin{array}{c}\frac{\partial ϵ\left(\delta \right)}{\partial \delta }+\lambda \frac{\partial L_{\theta }\left(x+\delta ,y\right)}{\partial \delta }\\ L_{\theta }\left(x+\delta ,y\right)\end{array}\right){|}_{\delta ={\delta }^{*},\lambda ={\lambda }^{*}}=0.$

Note that G is C¹ continuously differentiable since ∈ and L(δ, θ) are C² functions. Furthermore, the Jacobian matrix of G w.r.t (δ, λ) is

${\nabla }_{\left(\delta ,\lambda \right)}G\left(\left({\delta }^{*},{\lambda }^{*}\right),\theta \right)=\left(\begin{array}{cc}\frac{{\partial }^2ϵ\left({\delta }^{*}\right)}{\partial {\delta }^2}+{\lambda }^{*}\frac{{\partial }^{2}L\left({\delta }^{*},L\left(\delta ,\theta \right)\right)}{\partial {\delta }^2}& \frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \delta }\\ \frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \delta }\top & 0\end{array}\right)$

which by assumption is full rank. Therefore, by the implicit function theorem, δ* and λ* can be expressed as a function of θ, denoted by δ*(θ) and λ*(θ).

To further compute ∇_θd_θ(x, y), note that d_θ(x, y)=∈(δ*(θ)). Thus,

$\begin{array}{cc}{\nabla }_{\theta }{d}_{\theta }\left(x,y\right)=\frac{\partial ϵ\left({\delta }^{*}\right)}{\partial \delta }\frac{\partial {\delta }^{*}\left(\theta \right)}{\partial \theta }=-{\lambda }^{*}\frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \delta }\frac{\partial {\delta }^{*}\left(\theta \right)}{\partial \theta },& \left(11\right)\end{array}$

where the second equality is by Eq. (10). The implicit function theorem also provides a way of computing

$\frac{\partial {\delta }^{*}\left(\theta \right)}{\partial \theta }$ which is complicated involving taking inverse of the matrix ≡_{(δ, λ)}G((δ*, λ*), θ). Here Applicants present a relatively simple way to compute this gradient. Note that by the definition of δ*(θ).L(δ*(θ)θ)≡0.

And δ*(θ) is a differentiable implicit function of θ restricted to this level set. Differentiate with w.r.t. θ on both sides:

$\begin{array}{cc}\frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \theta }+\frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \delta }\frac{\partial {\delta }^{*}\left(\theta \right)}{\partial \theta }=0.& \left(12\right)\end{array}$

Combining Eq. (11) and Eq. (12),

$\begin{array}{cc}{\nabla }_{\theta }{d}_{\theta }\left(x,y\right)={\lambda }^{*}\left(\theta \right)\frac{\partial L\left({\delta }^{*},\theta \right)}{\partial \theta }.& \left(13\right)\end{array}$

Lastly, note that

${\frac{\partial ϵ\left(\delta \right)}{\partial \delta }+\lambda \frac{\partial L_{\theta }\left(x+\delta ,y\right)}{\partial \delta }{|}_{\delta ={\delta }^{*},\lambda ={\lambda }^{*}}}_2=0.$

Therefore, one way to calculate λ*(θ) is by

$\begin{array}{cc}\hspace{1em}{\lambda }^{*}\left(\theta \right)=\frac{\frac{\partial ϵ\left(\delta \right)}{\partial \delta }\top \frac{\partial L_{\theta }\left(x+\delta ,y\right)}{\partial \delta }}{\frac{\partial L_{\theta }\left(x+\delta ,y\right)}{\partial \delta }\top \frac{\partial L_{\theta }\left(x+\delta ,y\right)}{\partial \delta }}{|}_{\delta ={\delta }^{*}}& \square \end{array}$

A.2 Proof of Proposition 2.2

Applicants provide more detailed and formal statements of Proposition 2.2.

For brevity, consider a K-layers fully-connected ReLU network, ƒ(θ; x)=ƒ_θ(x) as a function of θ.ƒ(θ;x)=V^TD_KW_KD_K-1W_K-1. . . D₁W_K^Tx

where the D_k are diagonal matrices dependent on ReLU's activation pattern over the layers, and W_k's and V are the weights (i.e. θ). Note that ƒ(θ; x) is a piecewise polynomial functions of θ with finitely many pieces. Applicants further define the directional derivative of a function g, along the direction of {right arrow over (v)}, to be:

$g^{\prime }\left(\theta ;\overrightarrow{v}\right):=\underset{t\downarrow 0}{\lim }\frac{g\left(\theta +t\overrightarrow{v}\right)-g\left(\theta \right)}{t}.$

Note that for every direction {right arrow over (v)}, there exists α>0 such that ƒ(θ; x) is a polynomial restricted to a line segment [θ, θ+α{right arrow over (v)}]. Thus the above limit exists and the directional derivative is well defined. Applicants first show the existence of {right arrow over (v)} and t for (θ₀+t{right arrow over (v)}) given any ∈. Let _{θ0,{right arrow over (v)},∈}(t):=sup_{∥δ∥≤∈} L(δ, θ₀+t{right arrow over (v)}).

Proposition A.1. For ∈>0, t∈[0, 1], and θ₀∈Θ, there exists a direction {right arrow over (v)}∈Θ, such that the derivative of _{θ0,{right arrow over (v)},∈}(t) exists and is negative. Moreover, it is given by_{θ0,{right arrow over (v)},∈}(t)=L′(δ*,θ₀;{right arrow over (v)}).

Proof. [Proof sketch] Since θ₀ is not a local minimum, there exists a direction d, such that

$L^{\prime }\left({\delta }^{*},{\theta }_0;\overrightarrow{v}\right)=\frac{\partial L\left({\delta }^{*},{\theta }_0+t\overrightarrow{v}\right)}{\partial t}$ is negative.

The Danskin theorem provides a way to compute the directional gradient along this direction {right arrow over (v)}. Applicants basically apply a version of Danskin theorem for directional absolutely continuous maps and semi-continuous maps (Yu, 2012). 1. the constraint set {δ:∥δ∥≤∈} is compact; 2. L(θ₀+t{right arrow over (v)}; x+δ, y) is piecewise Lipschitz and hence absolutely continuous (an induction argument on the integral representation over the finite pieces). 3. L(θ₀+t{right arrow over (v)}; x+δ, y) is continuous on both δ and along the direction {right arrow over (v)} and hence upper semi continuous. Hence Applicants can apply Theorem 1 in Yu (2012).

Therefore, for any ∈>0, if θ₀ is not a local minimum, then there exits a direction d, such that for θ₁=θ₀+t{right arrow over (v)} for a proper t,

$\begin{array}{cc}\underset{\delta \le ϵ}{\sup }L\left(\delta ,{\theta }_0+t\overrightarrow{v}\right)<\underset{\delta \le ϵ}{\sup }L\left(\delta ,{\theta }_0\right).& \left(15\right)\end{array}$

The next proposition provides an alternative way to increase the margin of ƒ₀.

Proposition A.2. Assume ƒ_θ0 has a margin ∈₀, and θ₁ such that _{θ0,{right arrow over (v)},∈0} (t)≤_{θ1,{right arrow over (v)},∈0} (0), then ƒ_θ1 has a larger margin than ∈₀.

Proof. Since ƒ_θ1 has a margin ∈₀, thus

$\underset{\delta \le {ϵ}_0}{\max }L\left({\theta }_0;x+\delta ,y\right)=0$

Further by _{θ0,{right arrow over (v)},∈0} (t)≤_{θ1,{right arrow over (v)},∈0} (0)

$\underset{\delta \le ϵ}{\sup }L\left(\delta ,{\theta }_0+t\overrightarrow{v}\right)\le \underset{\delta \le ϵ}{\sup }L\left(\delta ,{\theta }_0\right).$

To see the equality (constraint not binding), Applicants use the following argument. The envelope function's continuity is passed from the continuity of L(θ₀; x+δ, y). The inverse image of a closed set under continuous function is closed. If δ* lies in the interior of max_{∥δ∥≤∈0} L_{{right arrow over (v)},∈}(θ₀; x+δ, y)≥0, Applicants would have a contradiction. Therefore the constraint is not binding, due to the continuity of the envelope function. By Eq. (15), max_{∥δ∥≤∈0} L(θ₁; x+δ, y)<0. So for the parameter θ₁, ƒ_θ1 has a margin ∈₁>∈₀.

Therefore, the update θ₁→θ₀=θ₀+t{right arrow over (v)} increases the margin of

A.3 Proof of Proposition 2.3

$\begin{array}{cc}\mathrm{Proof}.& \\ L_{\theta }^{\mathrm{LM}}\left(x,y\right)=\left(\underset{j\ne y}{\max }{f}_{\theta }^j\left(x\right)\right)-f_{\theta }^y\left(x\right)& \left(16\right)\\ =\log \left(\exp \left(\underset{j\ne y}{\max }{f}_{\theta }^j\left(x\right)\right)\right)-f_{\theta }^y\left(x\right)& \left(17\right)\\ \le \log \left(\exp \left(\sum _{j\ne y}{f}_{\theta }^j\left(x\right)\right)\right)-f_{\theta }^y\left(x\right)& \left(18\right)\\ =L_{\theta }^{\mathrm{SLM}}\left(x,y\right)& \left(19\right)\\ \le \log \left(\left(K-1\right)\exp \left(\underset{j\ne y}{\max }{f}_{\theta }^j\left(x\right)\right)\right)-f_{\theta }^y\left(x\right)& \left(20\right)\\ =\log \left(\left(K-1\right)+\left(\underset{j\ne y}{\max }{f}_{\theta }^j\left(x\right)\right)\right)-f_{\theta }^y\left(x\right)& \left(21\right)\\ =\log \left(K-1\right)+L_{\theta }^{\mathrm{LM}}\left(x,y\right)& \left(22\right)\\ \mathrm{Therefore},& \\ L_{\theta }^{\mathrm{SLM}}\left(x,y\right)-\log \left(K-1\right)\le L_{\theta }^{\mathrm{LM}}\left(x,y\right)\le L_{\theta }^{\mathrm{SLM}}\left(x,y\right).& \end{array}$

A.4 A Lemma for Later Proofs

The following lemma helps relate the objective of adversarial training with that of the MMA training. Here, Applicants denote L_θ(x+δ, y) as L(δ, θ) for brevity.

Lemma A.1. Given (x, y) and θ, assume that L(δ, θ) is continuous in δ, then for ∈≥0, and ρ≥L(0, θ) ∈ Range (L(δ, θ)), it holds that

$\begin{array}{cc}\underset{L\left(\delta ,\theta \right)\ge \rho }{\min }\delta =ϵ\Rightarrow \underset{\delta \le ϵ}{\max }L\left(\delta ,\theta \right)=\rho ;& \left(23\right)\\ \underset{\delta \le ϵ}{\max }L\left(\delta ,\theta \right)=\rho \Rightarrow \underset{L\left(\delta ,\theta \right)\ge \rho }{\min }\delta \le ϵ.& \left(24\right)\end{array}$

• • Proof Eq. (23). We prove this by contradiction. Suppose max_{∥δ∥≤∈} L(δ, θ)>ρ. When ∈=0, this violates our assumption ρ≥L(0, θ) in the theorem. So assume ∈>0. Since L(δ, θ) is a continuous function defined on a compact set, the maximum is attained by δ such that ∥δ∥≤∈ and L(δ, θ)>ρ. Note that L(δ, θ)) is continuous and ρ≥L(0, θ), then there exists δ∈ (0, δ) i.e. the line segment connecting 0 and δ, such that ∥{tilde over (δ)}∥≤∈ and L({tilde over (δ)}, θ)=ρ. This follows from the intermediate value theorem by restricting L(δ, θ) onto θ, δ. This contradicts min_{L(δ,θ)≥ρ} ∥δ∥=∈.
  • If max_{∥δ∥≤∈} L(δ, θ)<ρ, then {δ:∥δ∥≤∈}∈{δ:L(δ, θ)<ρ}. Every point p ∈ {δ:∥δ∥≤∈} is in the open set {δ:L(δ, θ)<ρ}, there exists an open ball with some radius r_p centered at p such that B_rp ⊂{δ:L(δ, θ)<ρ}. This forms an open cover for {δ:∥δ∥≤∈}. Since {δ:∥δ∥≤∈} is compact, there is an open finite subcover such that: {δ:∥δ∥≤∈}⊂⊂{δ:L(δ, θ)<ρ}. Since is finite, there exists h>0 such that {δ:∥δ∥≤∈+h}⊂{δ:L(δ, θ)<ρ}. Thus {δ:L(δ, θ)≥ρ}⊂{δ:∥δ∥>∈+h}, contradicting min_{L(δ,θ)≥ρ} ∥δ∥=ε again.
  • Eq. (24). Assume that min_{L(δ,θ)≥ρ} ∥δ∥>∈, then {δ:L(δ, θ)≥ρ}⊂{δ:∥δ∥≥∈}. Taking complementary set of both sides, {δ:∥δ∥≤∈}⊂{δ:L(δ, θ)<ρ}. Therefore, by the compactness of {δ:∥δ∥≤∈}, max_{∥δ∥≤∈} L(δ, θ)<ρ, contradiction. □

A.5 Proof of Theorem 3.1

• • Proof Recall that L(θ, δ)=L_θ^LM(x+δ, y), d_θ=(x, y), ∈*_θ(ρ)=min_{δ:L(δ,θ)≥ρ} ∥δ∥, and ρ*=max_{∥δ∥≤∈} L(θ₀, δ)>max_{∥δ∥≤∈} L(θ₁, δ).
  • We first prove that ∀∈, ∈*_θ1(ρ*)≥∈*_θ0(ρ*) by contradiction. We assume ∈*_θ1(ρ*)<∈*_θ0(ρ*). Let δ*_θ(ρ)=arg min_{δ:L(δ,θ)≤ρ} ∥δ∥, which is ∥δ*_θ1(ρ*)∥<∥δ*_θ0(ρ*)∥. By Eq. (24), we have ∥δ*θ₀(ρ*)∥≤∈. Therefore, ∥δ*_θ1(ρ*)∥<∈. Then there exist a δ^# ∈{δ:∥δ∥≤∈} such that L(θ₁, δ^#)≥ρ*. This contradicts max_{∥δ∥≤∈} L(θ₁, δ)<ρ*. Therefore ∈*_θ1(ρ*)≥∈*_θ0(ρ*).
  • For 1), ∈=d_θ0. By definition of margin in Eq. (1), we have ρ*=max_{∥δ∥≤dθ0} L(θ₀, δ)=0. Also by definition of ∈*_θ(ρ), ∈*_θ0(0)=d_θ0, and ∈*_θ1 (0)=d_θ1.
  • For 2), ∈<d_θ0. We have ρ*=max_{∥δ∥≤∈} L(θ₀, δ)≤max_{∥δ∥≤dθ0} L(θ₀, δ)=0. Therefore ∈*_θ0(ρ*)≤∈*_θ0(0)=d_θ0 and ∈*_θ1(ρ*)≤∈*_θ1(0)=d_θ1.
  • For 3), ∈>d_θ0. We have ρ*=max_{∥δ∥≤∈} L(θ₀, δ)≥max_{∥δ∥≤dθ0} L(θ₀, δ)=0. Therefore ∈*_θ0(ρ*)≥∈*_θ0(0)=d_θ0 and ∈*_θ1(ρ*)≥∈*_θ1(0)=d_θ1.

B More Related Works

Applicants next discuss a few related works in detail.

First-order Large Margin: Previous works (Elsayed et al., 2018; Sokolic et al., 2017; Matyasko & Chau, 2017) have attempted to use first-order approximation to estimate the input space margin. For first-order methods, the margin will be accurately estimated when the classification function is linear. MMA's margin estimation is exact when the shortest successful perturbation δ* can be solved, which is not only satisfied by linear models, but also by a broader range of models, e.g. models that are convex w.r.t. input x. This relaxed condition could potentially enable more accurate margin estimation which improves MMA training's performance.

(Cross-)Lipschitz Regularization: Tsuzuku et al. (2018) enlarges their margin by controlling the global Lipschitz constant, which in return places a strong constraint on the model and harms its learning capabilities. Instead, the proposed method, alike adversarial training, uses adversarial attacks to estimate the margin to the decision boundary. With a strong method, the estimate is much more precise in the neighborhood around the data point, while being much more flexible due to not relying on a global Lipschitz constraint.

Hard-Margin SVM (Vapnik, 2013) in the separable case: Assuming that all the training examples are correctly classified and using the notations on general classifiers, the hard-margin SVM objective can be written as:

$\begin{array}{cc}\underset{\theta }{\max }\left\{\underset{i}{\min }{d}_{\theta }\left(z_i\right)\right\}s.t.L_{\theta }\left(z_i\right)<0,\forall i.& \left(25\right)\end{array}$

On the other hand, under the same “separable and correct” assumptions, MMA formulation in Eq. (3) can be written as

$\begin{array}{cc}\underset{\theta }{\max }\left\{\sum _i{d}_{\theta }\left(z_i\right)\right\}s.t.L_{\theta }\left(z_i\right)<0,\forall i,& \left(26\right)\end{array}$

which is maximizing the average margin rather than the minimum margin in SVM. Note that the theorem on gradient calculation of the margin in an earlier section also applies to the SVM formulation of differentiable functions. Because of this, Applicants can also use SGD to solve the following “SVM-style” formulation:

$\begin{array}{cc}\underset{\theta }{\max }\left\{\underset{i\in S_{\theta }^{+}}{\max }{d}_{\theta }\left(z_i\right)-\sum _{j\in S_{\theta }^{-}}{J}_{\theta }\left(z_j\right)\right\}.& \left(27\right)\end{array}$

As the focus is using MMA to improve adversarial robustness which involves maximizing the average margin, Applicants delay the maximization of minimum margin to future work.

B.1 Detailed Comparison with Adversarial Training with DDN

For l₂ robustness, Applicants also compare to models adversarially trained on the “Decoupled Direction and Norm” (DDN) attack (Rony et al., 2018), which is concurrent to the work described in embodiments described herein. DDN attack aims to achieve successful perturbation with minimal l₂ norm, which makes DDN based adversarial training very similar to the MMA training. In fact, DDN attack could be a drop-in replacement for the AN-PGD attack for MMA training. Applicants performed evaluations on the downloaded⁷ DDN trained models.

The DDN MNIST model is a larger ConvNet with similar structure to Applicants' LeNet5, and the CIFAR10 model is wideresnet-28-10, which is similar but larger than the wideresnet-28-4 that Applicants use.

DDN training is very similar to MMA training with a few differences. DDN training is “training on adversarial examples generated by the DDN attack”. When DDN attack does not find a successful adversarial example, it returns the clean image, and the model will use it for training. In MMA, when a successful adversarial example cannot be found, it is treated as a perturbation with very large magnitude, Applicants will be ignored by the hinge loss when Applicants calculate gradient for this example. Also in DDN training, there exist a maximum norm of the perturbation. This maximum norm constraint does not exist for MMA training. When a perturbation is larger than the hinge threshold, it will be ignored by the hinge loss. There are also a few differences in training hyperparameters, which Applicants refer the reader to Rony et al. (2018) for details.

Despite these differences, in the experiments MMA training achieves similar performances under the l₂ cases. While DDN attack and training only focus on l₂ cases, Applicants also show that the MMA training framework provides significant improvements over PGD training in the l_∞ case.

C Detailed Settings for Training

Applicants train LeNet5 models for the MNIST experiments and use wide residual networks (Zagoruyko & Komodakis, 2016) with depth 28 and widen factor 4 for all the CIFAR10 experiments. For all the experiments, Applicants monitor the average margin from AN-PGD on the validation set and choose the model with largest average margin from the sequence of checkpoints during training. The validation set contains first 5000 images of training set. It is only used to monitor training progress and not used in training. Here all the models are trained and tested under the same type of norm constraints, namely if trained on, then tested on l_∞; if trained on l₂, then tested on l₂.

The LeNet5 is composed of 32-channel cony filter+ReLU+size 2 max pooling+64-channel cony filter+ReLU+size 2 max pooling+fc layer with 1024 units+ReLU+fc layer with 10 output classes. Applicants do not preprocess MNIST images before feeding into the model.

For training LeNet5 on all MNIST experiments, for both PGD and MMA training, Applicants use the Adam optimizer with an initial learning rate of 0.0001 and train for 100000 steps with batch size 50. In the initial experiments, Applicants tested different initial learning rate at 0.0001, 0.001, 0.01, and 0.1 and do not find noticeable differences.

Applicants use the WdeResNet-28-4 as described in Zagoruyko & Komodakis (2016) for the experiments, where 28 is the depth and 4 is the widen factor. Applicants use “per image standardization”⁸ to preprocess CIFAR10 images, following Madry et al. (2017).

For training WdeResNet on CIFAR10 variants, Applicants use stochastic gradient descent with momentum 0.9 and weight decay 0.0002. Applicants train 50000 steps in total with batch size 128. The learning rate is set to 0.3 at step 0, 0.09 at step 20000, 0.03 at step 30000, and 0.009 at step 40000. This setting is the same for PGD and MMA training. In the initial experiments, Applicants tested different learning rate at 0.03, 0.1, 0.3, and 0.6, and kept using 0.3 for all the later experiments. Applicants also tested a longer training schedule, following Madry et al. (2017), where Applicants train 80000 steps with different learning rate schedules. Applicants did not observe improvement with this longer training, therefore kept using the 50000 steps training.

For models trained on MNIST, Applicants use 40-step PGD attack with the soft logit margin (SLM) loss defined in an earlier section, for CIFAR10 Applicants use 10 step-PGD, also with the SLM loss. For both MNIST and CIFAR10, the step size of PGD attack at training time is

$\frac{2.5ϵ}{\text{number of steps}}.$ In AN-PGD, Applicants always perform 10 step binary search after PGD, with the SLM loss. For AN-PGD, the maximum perturbation length is always 1.05 times the hinge threshold: ∈_max=1.05d_max. The initial perturbation length at the first epoch, ∈_init, have different values under different settings. ∈_init=0.5 MNIST l₂, ∈_init=0.1 for MNIST l_∞, ∈_init=0.5 for CIFAR10 l₂, ε_init=0.05 for CIFAR10 l₂. In epochs after the first, ∈_init it will be set to the margin of the same example from last epoch.

Trained models: Various PGD/PGDLS models are trained with different perturbation magnitude ∈, denoted by PGD-∈ or PGDLS-∈. PGD-ens/PGDLS-ens represents the ensemble of PGD/PGDLS trained models with different ∈'s. The ensemble makes prediction by majority voting on label pre-dictions, and uses softmax scores as the tie breaker.

Applicants perform MMA training with different hinge thresholds d_max, also with/without the additional clean loss (see next section for details). Applicants use OMMA to MMA represent training with only L_θ^MMA in Eq. (7), and MMA to represent training with the combined loss in Eq. (8). When training for each d_max value, Applicants train two models with different random seeds, which serves two purposes: 1) confirming the performance of MMA trained models are not significantly affected by random initialization; 2) to provide transfer attacks from an “identical” model. As such, MMA trained models are named as OMMA/MMA-dmax-seed. Models shown in the main body correspond to those with seed “sd0”.

For MNIST-l_∞, Applicants train PGD/PGDLS models with ∈=0.1, 0.2, 0.3, 0.4, 0.45, OMMA/MMA models with d_max=0.45. For MNIST-l₂, Applicants train PGD/PGDLS models with ∈=1.0, 2.0, 3.0, 4.0, OMMA/MMA models with d_max=2.0, 4.0, 6.0. For CIFAR10-l_∞, Applicants train PGD/PGDLS models with ∈=4, 8, 12, 16, 20, 24, 28, 32, OMMA/MMA models with d_max=12, 20, 32. For CIFAR10-l₂, Applicants train PGD/PGDLS models with ∈=0.5, 1.0, 1.5, 2.0, 2.5, OMMA/MMA models with d_max=1.0, 2.0, 3.0.

With regard to ensemble models, for MNIST-l₂ PGD/PGDLS-ens, CIFAR10-l₂ PGD/PGDLS-ens, MNIST-l_∞ PGDLS-ens, and CIFAR10-l_∞ PGDLS-ens, they all use the PGD (or PGDLS) models trained at all testing (attacking) ∈'s. For CIFAR10-l_∞ PGD-ens, PGD-24,28,32 are excluded for the same reason.

Detailed Settings of Attacks

For both l_∞ and l₂ PGD attacks, Applicants use the implementation from the AdverTorch toolbox (Ding et al., 2019b). Regarding the loss function of PGD, Applicants use both the cross-entropy (CE) loss and the Carlini & Wagner (CW) loss.⁹

As previously stated, each model with have N whitebox PGD attacks on them, N/2 of them are CE-PGD attacks, and the other N/2 are CW-PGD attacks. Recall that N=50 for MNIST and N=10 for CIFAR10. At test time, all the PGD attack run 100 iterations. Applicants tune the step size parameter on a few MMA and PGD models and then fix them thereafter. The step size for MNIST-l_∞ when ∈=0.3 is 0.0075, the step size for CIFAR10-l_∞ when ∈=8/255 is 2/255, the step size for MNIST-l₂ when ∈=1.0 is 0.25, the step size for CIFAR10-l₂ when ∈=1.0 is 0.25. For other ∈ values, the step size are linearly scaled accordingly.

The ensemble model Applicants considered uses the majority vote for prediction, and uses softmax score as the tie breaker. So it is not obvious how to perform CW-PGD and CE-PGD directly on them. Here Applicants take 2 strategies. The first one is a naive strategy, where Applicants minimize the sum of losses of all the models used in the ensemble. Here, similar to attacking single models, Applicants CW and CE loss here and perform the same number attacks.

The second strategy is still a PGD attack with a customized loss towards attacking ensemble models. For the group of classifiers in the ensemble, at each PGD step, if less than half of the classifiers give wrong classification, when Applicants sum up the CW losses from correct classifiers as the loss for PGD attacking. If more than half of the classifier give wrong classification, then Applicants find the wrong prediction that appeared most frequently among classifiers, and denote it as label0, with its corresponding logit, logit0. For each classifier, Applicants then find the largest logit that is not logit0, denoted as logit1.

The loss Applicants maximize, in the PGD attack, is the sum of “logit1−logit0” from each classifier. Using this strategy, Applicants perform additional (compared to attacking single models) whitebox PGD attacks on ensemble models. For MNIST, Applicants perform 50 repeated attacks, for CIFAR10 Applicants perform 10. These are also 100-step PGD attacks.

For the SPSA attack (Uesato et al., 2018), Applicants run the attack for 100 iterations with perturbation size 0.01 (for gradient estimation), Adam learning rate 0.01, stopping threshold −5.0 and 2048 samples for each gradient estimate. For CIFAR10-l_∞, Applicants use ∈=8/255. For MNIST-l_∞, Applicants used ∈=0.3.

Effects of Adding Clean Loss in Addition to the MMA Loss

The approach further examines the effectiveness of adding a clean loss term to the MMA loss. Applicants represent MMA trained models with the MMA loss in Eq. (7) as MMA-d_max. Earlier in this description, MMAC-d_max models were introduced to resolve MMA-d_max model's problem of having flat input space loss land-scape and showed its effectiveness qualitatively. Here, it is demonstrated the quantitative benefit of adding the clean loss.

It is observed that models trained with the MMA loss in Eq. (7) have certain degrees of TransferGaps. The term TransferGaps represents the difference between robust accuracy under “combined (white-box+transfer) attacks” and under “only whitebox PGD attacks”. In other words, it is the additional attack success rate that transfer attacks bring. For example, OMMA-32 achieves 53.70% under whitebox PGD attacks, but achieves a lower robust accuracy at 46.31% under combined (white-box+transfer) attacks, therefore it has a TransferGap of 7.39% (See Appendix for full results). After adding the clean loss, MMA-32 reduces its TransferGap at ∈=8/255 to 3.02%. This corresponds to an observation earlier in this description that adding clean loss makes the loss landscape more tilted, such that whitebox PGD attacks can succeed more easily.

Recall that MMA trained models are robust to gradient free attacks, as described earlier. Therefore, robustness of MMA trained models and the TransferGaps are likely not due to gradient masking.

Applicants also note that TransferGaps for both MNIST-l_∞ and l₂ cases are almost zero for the MMA trained models, indicating that TransferGaps, observed on CIFAR10 cases, are not solely due to the MMA algorithm, data distributions (MNIST vs CIFAR10) also play an important role.

Another interesting observation is that, for MMA trained models trained on CIFAR10, adding additional clean loss results in a decrease in clean accuracy and an increase in the average robust accuracy, e.g., OMMA-32 has ClnAcc 86.11%, and AvgRobAcc 28.36%, whereas MMA-32 has ClnAcc 84.36%, and AvgRobAcc 29.39%.

The fact that “adding additional clean loss results in a model with lower accuracy and more robustness” seems counter-intuitive. However, it actually confirms the motivation of the approaches described herein and reasoning of the additional clean loss: it makes the input space loss landscape steeper, which leads to stronger adversaries at training time, which in turn poses more emphasis on “robustness training”, instead of clean accuracy training.

Full Results and Tables

Empirical results are presented in Table 2 to 13. Specifically, the results show model performances under combined (whitebox+transfer) attacks in Tables 2 to 5. This is a proxy for true robustness measure. As noted below, model performances are shown under only whitebox PGD attacks in Tables 6 to 9. As noted below, this description shows TransferGaps in Tables 10 to 13.

In these tables, PGD-Madry et al. models are the “secret” models downloaded from https://github.com/MadryLab/mnist_challenge and https://github.com/MadryLab/cifar10_challenge/. DDN-Rony et al. models are downloaded from https://github.com/jeromerony/fast_adversarial/.

For MNIST PGD-Madry et al. models, the whitebox attacks brings the robust accuracy at ∈=0.3 down to 89.79%, which is at the same level with the reported 89.62% on the website, also with 50 repeated random initialized PGD attacks. For CIFAR10 PGD-Madry et al. models, the whitebox attacks brings the robust accuracy at ∈=8/255 down to 44.70%, which is stronger than the reported 45.21% on the website, with 10 repeated random initialized 20-step PGD attacks. As the PGD attacks are 100-step, this is not surprising.

As mentioned previously, DDN training can be seen as a specific instantiation of the MMA training approach, and the DDN-Rony et al. models indeed performs very similar to MMA trained models when d_max is set relatively low. Therefore, Applicants do not discuss the performance of DDN-Rony et al. separately.

As described herein, different phenomena are noted under the case of CIFAR10-l_∞.

For CIFAR10-l₂, the approach shows very similar patterns in Tables 5, 9 and 13. These include:

• • MMA training is fairly stable to d_max, and achieves good robustness-accuracy trade-offs. On the other hand, to achieve good AvgRobAcc, PGD/PGDLS trained models need to have large sacrifices on clean accuracies.
  • Adding additional clean loss increases the robustness of the model, reduce TransferGap, at a cost of slightly reducing clean accuracy.

As a simpler datasets, different adversarial training algorithms, including MMA training, have very different behaviors on MNIST as compared to CIFAR10.

MNIST-l_∞ is first considered. Similar to CIFAR10 cases, PGD training is incompetent on large c's, e.g. PGD-0.4 has significant drop on clean accuracy (to 96.64%) and PGD-0.45 fails to train. PGDLS training, on the other hand, is able to handle large ∈'s training very well on MNIST-l_∞, and MMA training does not bring extra benefit on top of PGDLS.

It is suspected that this is due to the “easiness” of this specific task on MNIST, where finding proper ∈ for each individual example is not necessary, and a global scheduling of t is enough. Applicants note that this phenomenon confirms the understanding of adversarial training from the margin maximization perspective as described earlier.

Under the case of MNIST-l₂, it is noticed that MMA training almost does not need to sacrifice clean accuracy in order to get higher robustness. All the models with d_max≥4.0 behaves similarly w.r.t. both clean and robust accuracies. Achieving 40% robust accuracy at ∈=3.0 seems to be the robustness limit of MMA trained models. On the other hand, PGD/PGDLS models are able to get higher robustness at ∈=3.0 with robust accuracy of 44.5%, although with some sacrifices to clean accuracy. This is similar to what Applicants have observed in the case of CIFAR10.

It is noticed that on both MNIST-l_∞ and MNIST-l₂, unlike CIFAR10 cases, PGD(LS)-ens model performs poorly in terms of robustness. This is likely due to that PGD trained models on MNIST usually have a very sharp robustness drop when the ∈ used for attacking is larger than the ∈ used for training.

Another significant differences between MNIST cases and CIFAR10 cases is that TransferGaps are very small for OMMA/MMA trained models on MNIST cases. This again is likely due to that MNIST is an “easier” dataset. It also indicates that the TransferGap is not purely due to the MMA training algorithm, it is also largely affected by the property of datasets. Although previous literature (Ding et al., 2019a; Zhang et al., 2019c) also discusses related topics on the difference between MNIST and CIFAR10 w.r.t. adversarial robustness, they do not directly explain the observed phenomena here.

TABLE 2
Accuracies of models trained on MNIST with  ∞-norm constrained attacks.
These robust accuracies are calculated under both combined (whitebox + transfer) PGD
attacks. sd0 and sd1 indicate 2 different random seeds
MNIST				RobAcc under different ϵ, combined (whitebox + transfer) attacks
Model	Cln Acc	AvgAcc	AvgRobAcc	0.1	0.2	0.3	0.4
STD	99.21	35.02	18.97	73.58	2.31	0.00	0.00
PGD-0.1	99.40	48.85	36.22	96.35	48.51	0.01	0.00
PGD-0.2	99.22	57.92	47.60	97.44	92.12	0.84	0.00
PGD-0.3	98.96	76.97	71.47	97.90	96.00	91.76	0.22
PGD-0.4	96.64	89.37	87.55	94.69	91.57	86.49	77.47
PGD-0.45	11.35	11.35	11.35	11.35	11.35	11.35	11.35
PGDLS-0.1	99.43	46.85	33.71	95.41	39.42	0.00	0.00
PGDLS-0.2	99.38	58.36	48.10	97.38	89.49	5.53	0.00
PGDLS-0.3	99.10	76.56	70.93	97.97	95.66	90.09	0.00
PGDLS-0.4	98.98	93.07	91.59	98.12	96.29	93.01	78.96
PGDLS-0.45	98.89	94.74	93.70	97.91	96.34	93.29	87.28
MMA-0.45-sd0	98.95	94.13	92.93	97.87	96.01	92.59	85.24
MMA-0.45-sd1	98.90	94.04	92.82	97.82	96.00	92.63	84.83
OMMA-0.45-sd0	98.98	93.94	92.68	97.90	96.05	92.35	84.41
OMMA-0.45-sd1	99.02	94.03	92.78	97.93	96.02	92.44	84.73
PGD-ens	99.28	57.98	47.65	97.25	89.99	3.37	0.00
PGDLS-ens	99.34	59.04	48.96	97.48	90.40	7.96	0.00
PGD-Madry et al.	98.53	76.04	70.41	97.08	94.83	89.64	0.11

TABLE 3
Accuracies of models trained on CIFAR10 with  ∞-norm constrained attacks.
These robust accuracies are calculated under both combined (whitebox + transfer) PGD
attacks. sd0 and sd1 indicate 2 different random seeds
CIFAR10				RobAcc under different ϵ, combined (whitebox + transfer) attacks
Model	Cln Acc	AvgAcc	AvgRobAcc	4	8	12	16	20	24	28	32
STD	94.92	10.55	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00
PGD-4	90.44	22.95	14.51	66.31	33.49	12.22	3.01	0.75	0.24	0.06	0.01
PGD-8	85.14	27.27	20.03	67.73	46.47	26.63	12.33	4.69	1.56	0.62	0.22
PGD-12	77.86	28.51	22.34	63.88	48.72	32.13	18.67	9.48	4.05	1.56	0.70
PGD-16	68.86	28.28	23.21	57.99	46.09	33.64	22.73	13.37	7.01	3.32	1.54
PGD-20	61.06	27.34	23.12	51.72	43.13	33.73	24.55	15.66	9.05	4.74	2.42
PGD-24	10.90	9.95	9.83	10.60	10.34	10.11	10.00	9.89	9.69	9.34	8.68
PGD-28	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00
PGD-32	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00
PGDLS-4	89.87	22.39	13.96	63.98	31.92	11.47	3.32	0.68	0.16	0.08	0.05
PGDLS-8	85.63	27.20	19.90	67.96	46.19	26.19	12.22	4.51	1.48	0.44	0.21
PGDLS-12	79.39	28.45	22.08	64.62	48.08	31.34	17.86	8.69	3.95	1.48	0.65
PGDLS-16	70.68	28.44	23.16	59.43	47.00	33.64	21.72	12.66	6.54	2.98	1.31
PGDLS-20	65.81	27.60	22.83	54.96	44.39	33.13	22.53	13.80	7.79	4.08	1.95
PGDLS-24	58.36	26.53	22.55	49.05	41.13	32.10	23.76	15.70	9.66	5.86	3.11
PGDLS- 28	50.07	24.20	20.97	40.71	34.61	29.00	22.77	16.83	11.49	7.62	4.73
PGDLS-32	38.80	19.88	17.52	26.16	24.96	23.22	19.96	16.22	12.92	9.82	6.88
MMA-12-sd0	88.59	26.87	19.15	67.96	43.42	24.07	11.45	4.27	1.43	0.45	0.16
MMA-l2-sd1	88.91	26.23	18.39	67.08	42.97	22.57	9.76	3.37	0.92	0.35	0.12
MMA-20-sd0	86.56	28.86	21.65	66.92	46.89	29.83	16.55	8.14	3.25	1.17	0.43
MMA-20-sd1	85.87	28.72	21.57	65.44	46.11	29.96	17.30	8.27	3.60	1.33	0.56
MMA-32-sd0	84.36	29.39	22.51	64.82	47.18	31.49	18.91	10.16	4.77	1.97	0.81
MMA-32-sd1	84.76	29.08	22.11	64.41	45.95	30.36	18.24	9.85	4.99	2.20	0.92
OMMA-12-sd0	88.52	26.31	18.54	66.96	42.58	23.22	10.29	3.43	1.24	0.46	0.13
OMMA-12-sd1	87.82	26.24	18.54	66.23	43.10	23.57	10.32	3.56	1.04	0.38	0.14
OMMA-20-sd0	87.06	27.41	19.95	66.54	45.39	26.29	13.09	5.32	1.96	0.79	0.23
OMMA-20-sd1	87.44	27.77	20.31	66.28	45.60	27.33	14.00	6.04	2.23	0.74	0.25
OMMA-32-sd0	86.11	28.36	21.14	66.02	46.31	28.88	15.98	7.44	2.94	1.12	0.45
OMMA-32-sd2	86.36	28.75	21.55	66.86	47.12	29.63	16.09	7.56	3.38	1.31	0.47
PGD-ens	87.38	28.10	20.69	64.59	46.95	28.88	15.10	6.35	2.35	0.91	0.39
PGDLS-ens	76.73	29.52	23.62	60.52	48.21	35.06	22.14	12.28	6.17	3.14	1.43
PGD-Madry et al.	87.14	27.22	19.73	68.01	44.68	25.03	12.15	5.18	1.95	0.64	0.23

TABLE 4
Accuracies of models trained on MNIST with  2-norm constrained attacks.
These robust accuracies are calculated under both combined (whitebox + transfer) PGD
attacks. sd0 and sd1 indicate 2 different random seeds
MNIST				RobAcc under different ϵ, combined (whitebox + transfer) attacks
Model	Cln Acc	AvgAcc	AvgRobAcc	1.0	2.0	3.0	4.0
STD	99.21	41.84	27.49	86.61	22.78	0.59	0.00
PGD-1.0	99.30	48.78	36.15	95.06	46.84	2.71	0.00
PGD-2.0	98.76	56.14	45.48	94.82	72.70	14.20	0.21
PGD-3.0	97.14	60.36	51.17	90.01	71.03	38.93	4.71
PGD-4.0	93.41	59.52	51.05	82.34	66.25	43.44	12.18
PGDLS-1.0	99.39	47.61	34.66	94.33	42.44	1.89	0.00
PGDLS-2.0	99.09	54.73	43.64	95.22	69.33	10.01	0.01
PGDLS-3.0	97.52	60.13	50.78	90.86	71.91	36.80	3.56
PGDLS-4.0	93.68	59.49	50.95	82.67	67.21	43.68	10.23
MMA-2.0-sd0	99.27	53.85	42.50	95.59	68.37	6.03	0.01
MMA-2.0-sd1	99.28	54.34	43.10	95.78	68.18	8.45	0.00
MMA-4.0-sd0	98.71	62.25	53.13	93.93	74.01	39.34	5.24
MMA-4.0-sd1	98.81	61.88	52.64	93.98	73.70	37.78	5.11
MMA-6.0-sd0	98.32	62.32	53.31	93.16	72.63	38.78	8.69
MMA-6.0-sd1	98.50	62.49	53.48	93.48	73.50	38.63	8.32
OMMA-2.0-sd0	99.26	54.01	42.69	95.94	67.78	7.03	0.03
OMMA-2.0-sd1	99.21	54.04	42.74	95.72	68.83	6.42	0.00
OMMA-4.0-sd0	98.61	62.17	53.06	94.06	73.51	39.66	5.02
OMMA-4.0-sd1	98.61	62.01	52.86	93.72	73.18	38.98	5.58
OMMA-6.0-sd0	98.16	62.45	53.52	92.90	72.59	39.68	8.93
OMMA-6.0-sd1	98.45	62.24	53.19	93.37	72.93	37.63	8.83
PGD-ens	98.87	56.13	45.44	94.37	70.16	16.79	0.46
PGDLS-ens	99.14	54.71	43.60	94.52	67.45	12.33	0.11
DDN-Rony et al.	99.02	59.93	50.15	95.65	77.65	25.44	1.87

TABLE 5
Accuracies of models trained on CIFAR10 with  2-norm constrained attacks.
These robust accuracies are calculated under both combined (whitebox + transfer) PGD
attacks. sd0 and sd1 indicate 2 different random seeds
CIFAR10				RobAcc under different ϵ, combined (whitebox + transfer) attacks
Model	Cln Acc	AvgAcc	AvgRobAcc	0.5	1.0	1.5	2.0	2.5
STD	94.92	15.82	0.00	0.01	0.00	0.00	0.00	0.00
PGD-0.5	89.10	33.63	22.53	65.61	33.21	11.25	2.31	0.28
PGD-1.0	83.25	39.70	30.99	66.69	46.08	26.05	11.92	4.21
PGD-1.5	75.80	41.75	34.94	62.70	48.32	33.72	20.07	9.91
PGD-2.0	71.05	41.78	35.92	59.76	47.85	35.29	23.15	13.56
PGD-2.5	65.17	40.93	36.08	55.60	45.76	35.76	26.00	17.27
PGDLS-0.5	89.43	33.41	22.21	65.49	32.40	10.73	2.09	0.33
PGDLS-1.0	83.62	39.46	30.63	67.29	45.30	25.43	11.08	4.03
PGDLS-1.5	77.03	41.74	34.68	63.76	48.43	33.04	19.00	9.17
PGDLS-2.0	72.14	42.15	36.16	60.90	48.22	35.21	23.19	13.26
PGDLS-2.5	66.21	41.21	36.21	56.45	46.66	35.93	25.51	16.51
MMA-1.0-sd0	88.02	35.55	25.06	66.18	37.75	15.58	4.74	1.03
MMA-1.0-sd1	88.92	35.69	25.05	66.81	37.16	15.71	4.49	1.07
MMA-2.0-sd0	84.22	40.48	31.73	65.91	45.66	27.40	14.18	5.50
MMA-2.0-sd1	85.16	39.81	30.75	65.36	44.44	26.42	12.63	4.88
MMA-3.0-sd0	82.11	41.59	33.49	64.22	46.41	30.23	17.85	8.73
MMA-3.0-sd1	81.79	41.16	33.03	63.58	45.59	29.77	17.52	8.69
OMMA-1.0-sd0	89.02	35.18	24.41	65.43	36.89	14.77	4.18	0.79
OMMA-1.0-sd1	89.97	35.20	24.25	66.16	36.10	14.04	4.17	0.79
OMMA-2.0-sd0	86.06	39.32	29.97	65.28	43.82	24.85	11.53	4.36
OMMA-2.0-sd1	85.04	39.68	30.61	64.69	44.36	25.89	12.92	5.19
OMMA-3.0-sd0	83.86	40.62	31.97	64.14	45.61	28.12	15.00	6.97
OMMA-3.0-sd1	84.00	40.66	32.00	63.81	45.22	28.47	15.41	7.08
PGD-ens	85.63	40.39	31.34	62.98	45.87	27.91	14.23	5.72
PGDLS-ens	86.11	40.38	31.23	63.74	46.21	27.58	13.32	5.31
DDN-Rony et al.	89.05	36.23	25.67	66.51	39.02	16.60	5.02	1.20

TABLE 6
Accuracies of models trained on MNIST with  ∞-norm constrained attacks.
These robust accuracies are calculated under only whitebox PGD
attacks. sd0 and sd1 indicate 2 different random seeds
MNIST				RobAcc under different ϵ, whitebox only
Model	Cln Acc	AvgAcc	AvgRobAcc	1.0	2.0	3.0	4.0
STD	99.21	35.02	18.97	73.59	2.31	0.00	0.00
PGD-0.1	99.40	48.91	36.29	96.35	48.71	0.09	0.00
PGD-0.2	99.22	57.93	47.60	97.44	92.12	0.86	0.00
PGD-0.3	98.96	77.35	71.95	97.90	96.00	91.86	2.03
PCD-0.4	96.64	91.51	90.22	94.79	92.27	88.82	85.02
PGD-0.45	11.35	11.35	11.35	11.35	11.35	11.35	11.35
PGDLS-0.1	99.43	46.94	33.82	95.41	39.85	0.02	0.00
PGDLS-0.2	99.38	58.44	48.20	97.38	89.49	5.95	0.00
PGDLS-0.3	99.10	76.85	71.29	97.98	95.66	90.63	0.90
PGDLS-0.4	98.98	95.49	94.61	98.13	96.42	94.02	89.89
PGDLS-0.45	98.89	95.72	94.92	97.91	96.64	94.54	90.60
MMA-0.45-d0	98.95	94.97	93.97	97.89	96.26	93.57	88.16
MMA-0.45-sd1	98.90	94.83	93.81	97.83	96.18	93.34	87.91
OMMA-0.45-sd0	98.98	95.06	94.07	97.91	96.22	93.63	88.54
OMMA-0.45-sd1	99.02	95.45	94.55	97.96	96.30	94.16	89.80
PGD-ens	99.28	58.02	47.70	97.31	90.11	3.38	0.00
PGDLS-ens	99.34	59.09	49.02	97.50	90.56	8.03	0.00
PGD-Madry et al.	98.53	76.08	70.47	97.08	94.87	89.79	0.13

TABLE 7
Accuracies of models trained on CIFAR10 with  ∞-norm constrained attacks.
These robust accuracies are calculated under only whitebox PGD
attacks. sd0 and sd1 indicate 2 different random seeds
CIFAR10				RobAcc under different ϵ, whitebox only
Model	Cln Acc	AvgAcc	AvgRobAcc	4	8	12	16	20	24	28	32
STD	94.92	10.55	0.00	0.00	0.00	000	0.00	0.00	0.00	0.00	0.00
PGD-4	90.44	22.97	14.53	66.33	33.51	12.27	3.03	0.77	0.25	0.07	0.02
PGD-8	85.14	27.28	20.05	67.73	46.49	26.69	12.37	4.71	1.58	0.62	0.23
PGD-12	77.86	28.55	22.39	63.90	48.25	32.19	18.78	9.58	4.12	1.59	0.72
PGD-16	68.86	28.42	23.36	58.07	46.17	33.84	22.99	13.65	7.19	3.43	1.57
PGD-20	61.06	27.73	23.57	51.75	43.32	34.22	25.19	16.36	9.65	5.33	2.73
PGD-24	10.90	9.98	9.86	10.60	10.34	10.11	10.01	9.91	9.74	9.39	8.81
PGD-28	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00
PGD-32	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00	10.00
PGDLS-4	89.87	22.43	14.00	63.98	31.93	11.57	3.43	0.77	0.18	0.09	0.05
PGDLS-8	85.63	27.22	19.92	67.96	46.19	26.24	12.28	4.54	1.52	0.45	0.21
PGDLS-12	79.39	28.50	22.14	64.63	48.10	31.40	17.99	8.80	4.01	1.51	0.67
PGDLS-16	70.68	28.53	23.26	59.44	47.04	33.78	21.94	12.79	6.66	3.07	1.34
PGDLS-20	65.81	27.82	23.07	54.96	44.46	33.41	22.94	14.27	8.07	4.37	2.08
PGDLS-24	58.36	27.25	23.36	49.09	41.47	32.90	24.84	16.93	10.88	7.04	3.76
PGDLS-28	50.07	25.68	22.63	40.77	35.07	30.18	24.76	19.40	14.22	9.96	6.65
PGDLS-32	38.80	22.79	20.79	26.19	25.34	24.72	23.21	20.98	18.13	15.12	12.66
MMA-12-sd0	88.59	27.54	19.91	67.99	43.62	24.79	12.74	5.85	2.68	1.09	0.51
MMA-12-sd1	88.91	26.68	18.90	67.17	43.63	23.62	10.80	4.07	1.20	0.50	0.18
MMA-20-sd0	86.56	31.72	24.87	67.07	48.74	34.06	21.97	13.37	7.56	4.06	2.11
MMA-20-sd1	85.87	33.07	26.47	65.63	48.11	34.70	24.73	16.45	10.97	7.00	4.14
MMA-32-sd0	84.36	36.58	30.60	65.25	50.20	38.78	30.01	22.57	16.66	12.30	9.07
MMA-32-sd1	84.76	33.49	27.08	64.66	48.23	35.65	25.74	17.86	11.86	7.79	4.88
OMMA-12-sd0	88.52	29.34	21.94	67.49	46.11	29.22	16.65	8.62	4.36	2.05	1.03
OMMA-12-sd1	87.82	30.30	23.11	66.77	46.77	31.19	19.40	10.93	5.72	2.84	1.29
OMMA-20-sd0	87.06	36.00	29.61	68.00	52.98	40.13	28.92	19.78	13.04	8.47	5.60
OMMA-20-sd1	87.44	34.49	27.87	67.40	51.55	37.94	26.48	17.76	11.31	6.74	3.76
OMMA-32-sd0	86.11	38.87	32.97	67.57	53.70	42.56	32.88	24.91	18.57	13.79	9.76
OMMA-32-sd1	86.36	39.13	33.23	68.80	56.02	44.62	33.97	24.71	17.37	11.94	8.39
PGD-ens	87.38	28.83	21.51	64.85	47.67	30.37	16.63	7.79	3.01	1.25	0.52
PGDLS-ens	76.73	30.60	24.83	61.16	49.46	36.63	23.90	13.92	7.62	3.91	2.05
PGD-Madry et al.	87.14	27.36	19.89	68.01	44.70	25.15	12.52	5.50	2.25	0.73	0.27

TABLE 8
Accuracies of models trained on MNIST with  2-norm constrained attacks.
These robust accuracies are calculated under only whitebox PGD
attacks. sd0 and sd1 indicate 2 different random seeds
MNIST				RobAcc under different ϵ, whitebox only
Model	Cln Acc	AvgAcc	AvgRobAcc	1.0	2.0	3.0	4.0
STD	99.21	41.90	27.57	86.61	23.02	0.64	0.00
PGD-1.0	99.30	49.55	37.11	95.07	48.99	4.36	0.01
PGD-2.0	98.76	56.38	45.79	94.82	72.94	15.08	0.31
PGD-3.0	97.14	60.94	51.89	90.02	71.53	40.72	5.28
PGD-4.0	93.41	59.93	51.56	82.41	66.49	44.36	12.99
PGDLS-1.0	99.39	48.17	35.36	94.35	43.96	2.97	0.16
PGDLS-2.0	99.09	55.17	44.19	95.22	69.73	11.80	0.03
PGDLS-3.0	97.52	60.60	51.37	90.87	72.24	38.39	3.99
PGDLS-4.0	93.68	59.89	51.44	82.73	67.37	44.59	11.07
MMA-2.0-sd0	99.27	53.97	42.64	95.59	68.66	6.32	0.01
MMA-2.0-sd1	99.28	54.46	43.26	95.79	68.45	8.79	0.01
MMA-4.0-sd0	98.71	62.51	53.45	93.93	74.06	40.02	5.81
MMA-4.0-sd1	98.81	62.22	53.07	93.98	73.81	38.76	5.75
MMA-6.0-sd0	98.32	62.60	53.67	93.16	72.72	39.47	9.35
MMA-6.0-sd1	98.50	62.73	53.79	93.48	73.57	39.25	8.86
OMMA-2.0-sd0	99.26	54.12	42.83	95.94	68.08	7.27	0.03
OMMA-2.0-sd1	99.21	54.12	42.85	95.72	68.96	6.72	0.00
OMMA-4.0-sd0	98.61	62.44	53.40	94.06	73.60	40.29	5.66
OMMA-4.0-sd1	98.61	62.22	53.13	93.72	73.23	39.53	6.03
OMMA-6.0-sd0	98.16	62.67	53.79	92.90	72.71	40.28	9.29
OMMA-6.0-sd1	98.45	62.52	53.54	93.37	73.02	38.49	9.28
PGD-ens	98.87	56.57	45.99	94.73	70.98	17.76	0.51
PGDLS-ens	99.14	54.98	43.93	94.86	68.08	12.68	0.12
DDN-Rony et al.	99.02	60.34	50.67	95.65	77.79	26.59	2.64

TABLE 9
Accuracies of models trained on CIFAR10 with  2-norm constrained attacks.
These robust accuracies are calculated under only whitebox PGD
attacks. sd0 and sd1 indicate 2 different random seeds
CIFAR10				RobAcc under different ϵ, whitebox only
Model	Cln Acc	AvgAcc	AvgRobAcc	0.5	1.0	1.5	2.0	2.5
STD	94.92	15.82	0.00	0.01	0.00	0.00	0.00	0.00
PGD-0.5	89.10	33.64	22.55	65.61	33.23	11.29	2.34	0.29
PGD-1.0	83.25	39.74	31.04	66.69	46.11	26.16	12.00	4.26
PGD-1.5	75.80	41.81	35.02	62.74	48.35	33.80	20.17	10.03
PGD-2.0	71.05	41.88	36.05	59.80	47.92	35.39	23.34	13.81
PGD-2.5	65.17	41.03	36.20	55.66	45.82	35.90	26.14	17.49
PGDLS-0.5	89.43	33.44	22.25	65.50	32.42	10.78	2.17	0.36
PGDLS-1.0	83.62	39.50	30.68	67.30	45.35	25.49	11.19	4.08
PGDLS-1.5	77.03	41.80	34.75	63.76	48.46	33.11	19.12	9.32
PGDLS-2.0	72.14	42.24	36.27	60.96	48.28	35.32	23.38	13.39
PGDLS-2.5	66.21	41.34	36.36	56.49	46.72	36.13	25.73	16.75
MMA-1.0-sd0	88.02	35.58	25.09	66.19	37.80	15.61	4.79	1.06
MMA-1.0-sd1	88.92	35.74	25.10	66.81	37.22	15.78	4.57	1.14
MMA-2.0-sd0	84.22	41.22	32.62	65.98	46.11	28.56	15.60	6.86
MMA-2.0-sd1	85.16	40.60	31.69	65.45	45.27	28.07	13.99	5.67
MMA-3.0-sd0	82.11	43.67	35.98	64.25	47.61	33.48	22.07	12.50
MMA-3.0-sd1	81.79	43.75	36.14	63.82	47.33	33.79	22.36	13.40
OMMA-1.0-sd0	89.02	35.49	24.79	65.46	37.38	15.34	4.76	1.00
OMMA-1.0-sd1	89.97	35.41	24.49	66.24	36.47	14.44	4.43	0.89
OMMA-2.0-sd0	86.06	42.80	34.14	65.55	46.29	30.60	18.23	10.05
OMMA-2.0-sd1	85.04	42.96	34.55	65.23	46.32	31.07	19.36	10.75
OMMA-3.0-sd0	83.86	46.46	38.99	64.67	49.34	36.40	26.50	18.02
OMMA-3.0-sd1	84.00	45.59	37.91	64.31	48.50	35.92	24.81	16.03
PGD-ens	85.63	41.32	32.46	63.27	46.66	29.35	15.95	7.09
PGDLS-ens	86.11	41.39	32.45	64.04	46.99	29.11	15.51	6.59
DDN-Rony et al.	89.05	36.25	25.69	66.51	39.02	16.63	5.05	1.24

TABLE 10
The TransferGap of models trained on MNIST with  2-norm constrained attacks.
TransferGap indicates the gap between robust accuracy under only whitebox PGD
attacks and under combined (whitebox + transfer) PGD attacks. sd0 and sd1 indicate 2 different random seeds
MNIST				TransferGap: RobAcc drop after adding transfer attacks
Model	Cln Acc	AvgAcc	AvgRobAcc	0.1	0.2	0.3	0.4
STD	—	0.00	0.00	0.01	0.00	0.00	0.00
PGD-0.1	—	0.06	0.07	0.00	0.20	0.08	0.00
PGD-0.2	—	0.00	0.00	0.00	0.00	0.02	0.00
PGD-0.3	—	0.38	0.48	0.00	0.00	0.10	1.81
PGD-0.4	—	2.14	2.67	0.10	0.70	2.33	7.55
PGD-0.45	—	0.00	0.00	0.00	0.00	0.00	0.00
PGDLS-0.1	—	0.09	0.11	0.00	0.43	0.02	0.00
PGDLS-0.2	—	0.08	0.11	0.00	0.00	0.42	0.00
PGDLS-0.3	—	0.29	0.36	0.01	0.00	0.54	0.90
PGDLS-0.4	—	2.42	3.02	0.01	0.13	1.01	10.93
PGDLS-0.45	—	0.97	1.22	0.00	0.30	1.25	3.32
MMA-0.45-sd0	—	0.83	1.04	0.02	0.25	0.98	2.92
MMA-0.45-sd1	—	0.80	0.99	0.01	0.18	0.71	3.08
OMMA-0.45-sd0	—	1.12	1.40	0.01	0.17	1.28	4.13
OMMA-0.45-sd1	—	1.42	1.78	0.03	0.28	1.72	5.07
PGD-ens	—	0.04	0.05	0.06	0.12	0.01	0.00
PGDLS-ens	—	0.05	0.06	0.02	0.16	0.07	0.00
PGD-Madry et al.	—	0.04	0.05	0.00	0.04	0.15	0.02

TABLE 11
The TransferGap of models trained on CIFAR10 with  ∞-norm constrained attacks.
TransferGap indicates the gap between robust accuracy under only whitebox PGD
attacks and under combined (whitebox + transfer) PGD attacks. sd0 and sd1 indicate 2 different random seeds
CIFAR10				TransferGap: RobAcc drop after adding transfer attacks
Model	Cln Acc	AvgAcc	AvgRobAcc	4	8	12	16	20	24	28	32
STD	—	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00
PGD-4	—	0.02	0.02	0.02	0.02	0.05	0.02	0.02	0.01	0.01	0.01
PGD-8	—	0.02	0.02	0.00	0.02	0.06	0.04	0.02	0.02	0.00	0.01
PGD-12	—	0.05	0.05	0.02	0.03	0.06	0.11	0.10	0.07	0.03	0.02
PGD-16	—	0.14	0.15	0.08	0.08	0.20	0.26	0.28	0.18	0.11	0.03
PGD-20	—	0.39	0.44	0.03	0.19	0.49	0.64	0.70	0.60	0.59	0.31
PGD-24	—	0.03	0.03	0.00	0.00	0.00	0.01	0.02	0.05	0.05	0.13
PGD-28	—	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00
PGD-32	—	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00
PGDLS-4	—	0.04	0.04	0.00	0.01	0.10	0.11	0.09	0.02	0.01	0.00
PGDLS-8	—	0.02	0.02	0.00	0.00	0.05	0.06	0.03	0.04	0.01	0.00
PGDLS-12	—	0.05	0.05	0.01	0.02	0.06	0.13	0.11	0.06	0.03	0.02
PGDLS-16	—	0.09	0.10	0.01	0.04	0.14	0.22	0.13	0.12	0.09	0.03
PGDLS-20	—	0.21	0.24	0.00	0.07	0.28	0.41	0.47	0.28	0.29	0.13
PGDLS-24	—	0.73	0.82	0.04	0.34	0.80	1.08	1.23	1.22	1.18	0.65
PGDLS-28	—	1.47	1.66	0.06	0.46	1.18	1.99	2.57	2.73	2.34	1.92
PGDLS-32	—	2.91	3.28	0.03	0.38	1.50	3.25	4.76	5.21	5.30	5.78
MMA-12-sd0	—	0.67	0.76	0.03	0.20	0.72	1.29	1.58	1.25	0.64	0.35
MMA-12-sd1	—	0.45	0.50	0.09	0.66	1.05	1.04	0.70	0.28	0.15	0.06
MMA-20-sd0	—	2.86	3.22	0.15	1.85	4.23	5.42	5.23	4.31	2.89	1.68
MMA-20-sd1	—	4.35	4.90	0.19	2.00	4.74	7.43	8.18	7.37	5.67	3.58
MMA-32-sd0	—	7.19	8.09	o.43	3.02	7.29	11.10	12.41	11.89	10.33	8.26
MMA-32-sd1	—	4.42	4.97	0.25	2.28	5.29	7.50	8.01	6.87	5.59	3.96
OMMA-12-sd0	—	3.02	3.40	0.53	3.53	6.00	6.36	5.19	3.12	1.59	0.90
OMMA-12-sd1	—	4.06	4.57	0.54	3.67	7.62	9.08	7.37	4.68	2.46	1.15
OMMA-20-sd0	—	8.59	9.66	1.46	7.59	13.84	15.83	14.46	11.08	7.68	5.37
OMMA-20-sd1	—	6.72	7.56	1.12	5.95	10.61	12.48	11.72	9.08	6.00	3.51
OMMA-32-sd0	—	10.51	11.83	1.55	7.39	13.68	16.90	17.47	15.63	12.67	9.31
OMMA-32-sd1	—	10.38	11.67	1.94	8.90	14.99	17.88	17.15	13.99	10.63	7.92
PGD-ens	—	0.73	0.82	0.26	0.72	1.49	1.53	1.44	0.66	0.34	0.13
PGDLS-ens	—	1.08	1.21	0.64	1.25	1.57	1.76	1.64	1.45	0.77	0.62
PGD-Madry et al.	—	0.14	0.16	0.00	0.02	0.12	0.37	0.32	0.30	0.09	0.04

TABLE 12
The TransferGap of models trained on MNIST with  2-norm constrained attacks.
TransferGap indicates the gap between robust accuracy under only whitebox PGD
attacks and under combined (whitebox + transfer) PGD attacks. sd0 and sd1 indicate 2 different random seeds
MNIST				TransferGap: RobAcc drop after adding transfer attacks
Model	Cln Acc	AvgAcc	AvgRobAcc	1.0	2.0	3.0	4.0
STD	—	0.06	0.07	0.00	0.24	0.05	0.00
PGD-1.0	—	0.76	0.96	0.01	2.15	1.65	0.01
PGD-2.0	—	0.24	0.30	0.00	0.24	0.88	0.10
PGD-3.0	—	0.57	0.72	0.01	0.50	1.79	0.57
PGD-4.0	—	0.41	0.51	0.07	0.24	0.92	0.81
PGDLS-1.0	—	0.56	0.70	0.02	1.52	1.08	0.16
PGDLS-2.0	—	0.44	0.55	0.00	0.40	1.79	0.02
PGDLS-3.0	—	0.47	0.59	0.01	0.33	1.59	0.43
PGDLS-4.0	—	0.39	0.49	0.05	0.16	0.91	0.84
MMA-2.0-sd0	—	0.12	0.15	0.00	0.29	0.29	0.00
MMA-2.0-sd1	—	0.13	0.16	0.01	0.27	0.34	0.01
MMA-4.0-sd0	—	0.26	0.33	0.00	0.05	0.68	0.57
MMA-4.0-sd1	—	0.35	0.43	0.00	0.11	0.98	0.64
MMA-6.0-sd0	—	0.29	0.36	0.00	0.09	0.69	0.66
MMA-6.0-sd1	—	0.25	0.31	0.00	0.07	0.62	0.54
OMMA-2.0-sd0	—	0.11	0.13	0.00	0.30	0.24	0.00
OMMA-2.0-sd1	—	0.09	0.11	0.00	0.13	0.30	0.00
OMMA-4.0-sd0	—	0.27	0.34	0.00	0.09	0.63	0.64
OMMA-4.0-sd1	—	0.21	0.26	0.00	0.05	0.55	0.45
OMMA-6.0-sd0	—	0.22	0.27	0.00	0.12	0.60	0.36
OMMA-6.0-sd1	—	0.28	0.35	0.00	0.09	0.86	0.45
PGD-ens	—	0.44	0.55	0.36	0.82	0.97	0.05
PGDLS-ens	—	0.27	0.33	0.34	0.63	0.35	0.01
DDN-Rony et al.	—	0.41	0.51	0.00	0.14	1.15	0.77

TABLE 13
The TransferGap of models trained on CIFAR10 with  2-norm constrained attacks.
TransferGap indicates the gap between robust accuracy under only whitebox PGD
attacks and under combined (whitebox + transfer) PGD attacks. sd0 and sd1 indicate 2 different random seeds
CIFAR10				TransferGap: RobAcc drop after adding transfer attacks
Model	Cln Acc	AvgAcc	AvgRobAcc	0.5	1.0	1.5	2.0	2.5
STD	—	0.00	0.00	0.00	0.00	0.00	0.00	0.00
PGD-0.5	—	0.02	0.02	0.00	0.02	0.04	0.03	0.01
PGD-1.0	—	0.04	0.05	0.00	0.03	0.11	0.08	0.05
PGD-1.5	—	0.06	0.07	0.04	0.03	0.08	0.10	0.12
PGD-2.0	—	0.11	0.13	0.04	0.07	0.10	0.19	0.25
PGD-2.5	—	0.10	0.12	0.06	0.06	0.14	0.14	0.22
PGDLS-0.5	—	0.03	0.04	0.01	0.02	0.05	0.08	0.03
PGDLS-1.0	—	0.05	0.06	0.01	0.05	0.06	0.11	0.05
PGDLS-1.5	—	0.06	0.07	0.00	0.03	0.07	0.12	0.15
PGDLS-2.0	—	0.09	0.11	0.06	0.06	0.11	0.19	0.13
PGDLS-2.5	—	0.13	0.15	0.04	0.06	0.20	0.22	0.24
MMA-1.0-sd0	—	0.03	0.03	0.01	0.05	0.03	0.05	0.03
MMA-1.0-sd1	—	0.05	0.06	0.00	0.06	0.07	0.08	0.07
MMA-2.0-sd0	—	0.74	0.89	0.07	0.45	1.16	1.42	1.36
MMA-2.0-sd1	—	0.79	0.94	0.09	0.83	1.65	1.36	0.79
MMA-3.0-sd0	—	2.08	2.49	0.03	1.20	3.25	4.22	3.77
MMA-3.0-sd1	—	2.59	3.11	0.24	1.74	4.02	4.84	4.71
OMMA-1.0-sd0	—	0.31	0.38	0.03	0.49	0.57	0.58	0.21
OMMA-1.0-sd1	—	0.20	0.24	0.08	0.37	0.40	0.26	0.10
OMMA-2.0-sd0	—	3.48	4.18	0.27	2.47	5.75	6.70	5.69
OMMA-2.0-sd1	—	3.28	3.94	0.54	1.96	5.18	6.44	5.56
OMMA-3.0-sd0	—	5.85	7.02	0.53	3.73	8.28	11.50	11.05
OMMA-3.0-sd1	—	4.93	5.92	0.50	3.28	7.45	9.40	8.95
PGD-ens	—	0.94	1.12	0.29	0.79	1.44	1.72	1.37
PGDLS-ens	—	1.01	1.22	0.30	0.78	1.53	2.19	1.28
DDN-Rony et al.	—	0.02	0.02	0.00	0.00	0.03	0.03	0.04

Claims

1. A system for generating an output data set representing an adversarial example adapted for training a neural network, the system comprising: a data receiver configured to receive one or more data sets including at least one data set representing a benign training example (x);an adversarial generator engine configured to: dynamically generate, using the neural network, a first adversarial example (Adv1) having a perturbation length (epsilon1) against benign training example (x);conduct a search in a direction (Adv1-x) using the neural network;dynamically generate, using the neural network, a second adversarial example (Adv2) having a perturbation length (epsilon2) based at least on an output of the search in the direction (Adv1-x).

2. The system of claim 1, wherein a neural network training processor is configured to train the neural network against the adversarial example using Adv2, and wherein the dynamic generation of the second adversarial example includes maximizing an average margin of a data distribution (D) of the one or more data sets by optimizing an objective function

3. The system of claim 1, wherein the adversarial generator engine is configured to conduct a search in a direction (Adv2-x); and to generate a third adversarial example (Adv3) having a perturbation length (epsilon3) based at least on an output of the search in the direction (Adv2-x).

4. The system of claim 3, wherein a neural network training processor is configured to train the neural network against the adversarial example using Adv3.

5. The system of claim 1, wherein the search includes at least determining a point near the benign training example and along a search direction such that a logit loss is approximately zero at the point.

6. The system of claim 1, wherein the perturbation lengths are stored in a dictionary data structure of a data storage device.

7. The system of claim 6, wherein when the neural network encounters a new training example, a stored perturbation length is used by the neural network training processor to initialize a hyperparameter representing a minimum perturbation length.

8. The system of claim 2, wherein the training includes labelling the adversarial examples as negative training examples.

9. The system of claim 3, further comprising determining a level of available computational resources, and upon determining that the level of available computational resources is below a pre-defined threshold, training the neural network against adversarial examples using Adv2.

10. The system of claim 1, further comprising generating a prediction based at least upon a logit loss of a perturbation, and wherein the prediction indicates that the logit loss >0, training the neural network against adversarial examples using Adv2.

11. A method for generating a data set representing an adversarial example adapted for training a neural network, the method comprising: receiving one or more data sets including at least one data set representing a benign training example (x);dynamically generating a first adversarial example (Adv1) having a perturbation length (epsilon1) against benign training example (x);conducting a search in a direction (Adv1-x);dynamically generating a second adversarial example (Adv2) having a perturbation length (epsilon2) based at least on an output of the search in the direction (Adv1-x).

12. The method of claim 11, comprising training the neural network against adversarial examples using Adv2 and wherein the step of dynamically generating the second adversarial example includes maximizing an average margin of a data distribution (D) of the one or more data sets by optimizing an objective function

13. The method of claim 11, further comprising conducting a search in a direction (Adv2-x); and generating a third adversarial example (Adv3) having a perturbation length (epsilon3) based at least on an output of the search in the direction (Adv2-x).

14. The method of claim 13, further comprising training the neural network against adversarial examples using Adv3.

15. The method of claim 11, wherein the search includes at least determining a point near the benign training example and along a search direction such that a logit loss is approximately zero at the point.

16. The method of claim 11, wherein the perturbation lengths are stored in a dictionary data structure.

17. The method of claim 16, wherein when the neural network encounters a new training example, a stored perturbation length is used to initialize a hyperparameter representing a minimum perturbation length.

18. The method of claim 12, wherein the training includes labelling the adversarial examples as negative training examples.

19. The method of claim 13, further comprising determining a level of available computational resources, and upon determining that the level of available computational resources is below a pre-defined threshold, training the neural network against adversarial examples using Adv2.

20. A non-transitory computer readable medium storing machine interpretable instructions, which when executed by a processor, cause the processor to perform a method for generating a data set representing an adversarial example adapted for training a neural network, the method comprising: receiving one or more data sets including at least one data set representing a benign training example (x);dynamically generating a first adversarial example (Adv1) having a perturbation length (epsilon1) against benign training example (x);conducting a search in a direction (Adv1-x);dynamically generating a second adversarial example (Adv2) having a perturbation length (epsilon2) based at least on an output of the search in the direction (Adv1-x).

21. A computer server including a non-transitory computer readable medium storing data elements representing a neural network trained using an adversarial example generated by executing stored machine interpretable instructions causing the computer server to perform a method for generating a data set representing the adversarial example adapted for training a neural network, the method comprising: receiving one or more data sets including at least one data set representing a benign training example (x);dynamically generating a first adversarial example (Adv1) having a perturbation length (epsilon1) against benign training example (x);conducting a search in a direction (Adv1-x);dynamically generating a second adversarial example (Adv2) having a perturbation length (epsilon2) based at least on an output of the search in the direction (Adv1-x).