Adversarial Defence

How can we train our models so that they are harder to break with adversarial attacks?

Adversarial Training

A basic idea is to adversarial samples to our training set and re-train. That helps somewhat, especially for samples that we added.

What if we built this process into our training? We can incorporate a mini adversarial attack into every gradient step while trainig.

TRADES

‘TRadeoff-inspired Adversarial DEfense via Surrogate loss minimization” uses an idea like this.

Consider:

• Model $f:x\to \mathbb{R}$
• Dataset $(X,T)$ with inputs $X\subset \mathbb{X}$ and targets $T\in \{-1,1\}$.

Then, $\text{sign}(f(x))$ is the predicted class of $x$. The classification is correct if $f(X)T>0$.

The classification loss can be written as:

$$\underset{\text{"Natural loss"}}{\underbrace{{\mathcal{R}}_{\text{nat}}(f)}}={\mathbb{E}}_{(X,T)}1\{f(X)T\le 0\}$$

where we are using the indicator function $1$ to count how many times we get a wrong class.

If we want to consider how our model will perform under adversarial attack, we consider the robust loss

$$\underset{\text{"Robust loss"}}{\underbrace{{\mathcal{R}}_{\text{rob}}(f)}}={\mathbb{E}}_{(X,T)}1\{\exists x^{\prime }\in \mathbb{B}(x,ϵ)|f(x^{\prime })T\le 0\}$$

This has some built-in pessimism, that looks for the worst-case in the neighborhood of $X$.

Instead of counting misclassified points directly, to make it differentiable we approximate it use a surrogate loss function, $g$:

Then, the natural loss becomes:

$$\underset{f}{\min }{\mathbb{E}}_{(X,T)}[g(f(x)T)]$$

We can train a robust model with the combined loss

$$\underset{f}{\min }{\mathbb{E}}_{(X,T)}\left[g(f(x)T)+\underset{X^{\prime }\in \mathbb{B}(x,ϵ)}{\max }g(f(x)f(x^{\prime }))\right]$$

• The first term ensures that each $x$ is correctly classified
• Adds a penalty for models $f$ that put $x$ within $ϵ$ of the decision boundary

Implementation:

• For each gradient descent step
  • Run several steps of gradient ascent to find $x^{\prime }$
  • Evaluate the joint loss $g(f(x)T)+\beta g(f(x)f(x^{\prime }))$, where $\beta$ is a regularization parameter
  • Use the gradient of the joint loss for each gradient step