The robustness of Deep neural networks (DNNs) has been recently challenged by adversarial attacks State-of-the-art defending algorithms improve DNNs' robustness by paying high computational costs. Moreover, these approaches are usually designed against one or a few known attacking techniques only. The effectiveness to defend other types of attacking methods cannot be guaranteed. In this work, we propose Bamboo - the first data augmentation method designed for improving the general robustness of DNN without any hypothesis on the attacking algorithms. Our experiments show that Bamboo substantially improve the general robustness against arbitrary types of attacks and noises, achieving better results comparing to previous adversarial training methods, robust optimization methods and other data augmentation methods with the same amount of data points.
In recent years, deep neural network (DNN) models (e.g.,
CNNs) have been widely used in many real-world
applications
Many approaches have also been proposed to defend
against adversarial attacks. However, adversarial training
methods
Generally speaking, defending against adversarial
attacks can be considered as a special case of increasing the
generalizability of DNN to unseen data points. Therefore
data augmentation method may also be effective.
Previous studies show that training with additional data sampled
from a Gaussian distribution centered at the original
training data can enhance the model robustness against natural
noise
In this work, we propose Bamboo—a ball shape data augmentation technique aiming for improving the general robustness of DNN against adversarial attacks from all directions. Without requiring any prior knowledge of the attacking algorithm, Bamboo can effectively enhance the general robustness of the DNN models against the adversarial noise. Bamboo can offer a significantly enhanced model robustness comparing to previous robust optimization methods, without suffering from the high computational complexity. Comparing to other data augmentation method, Bamboo can also achieve further improvement of the model robustness using the same amount of augmented data. Most importantly, as our method makes no assumption on the distribution of adversarial examples, it can work against all kinds of noise.
A metric for measuring the robustness of the DNN is
necessary.
As FGSM attack leverages only the local gradient for
perturbing the input, if is found that even a DNN model
achieves high accuracy under FGSM attack, it may still
be vulnerable to other attacking methods
Besides these gradient based methods, the generation of
adversarial examples can also be viewed as an optimization
process.
There are previous attempts to derive a bound of the DNN
robustness theoretically
Most of the supervised machine learning algorithms follow
the principle of empirical risk minimization (ERM), which
is based on the hypothesis that the testing data has a similar
distribution as the training data, so minimizing the loss on
the training data would naturally lead to the minimum
testing loss. However, the distribution of adversarial examples
generated by attacking algorithms may be different from the
original training data. Thus the DNN models trained with
ERM would have unsatisfactory performance on adversarial
examples
Instead of ERM, the vicinity risk minimization (VRM)
principle targets to minimize the vicinity risk R^ on the
virtual data pair (x^; y^) sampled from a vicinity distribution
P^(x^; y^jx; y) generated from the original training set
distribution P (x; y)
For most of the attacking algorithms, there is a
constraint on the strength of the perturbation, so the
adversarial example x^ can be considered as within a r-radius ball
around the original data x. Without any prior knowledge
of the attacking algorithm, we can consider the adversarial
examples as uniformly distributed within the r-radius ball:
x^ U nif orm(jjx^ xjj2 r). However, directly sampling
the virtual data point x^ within the ball may be data
inefficient. Here we propose to further improve the data
efficiency by utilizing the geometry analysis of DNN model.
Previous research shows that the curvature of DNN’s
decision boundary near a training data point would most likely
be very small
P^(x^; y^jx; y) = U nif orm(jjx^ xjj2= r) (y^; y): (1) By optimizing the VRM objective with this vicinity distribution, we can improve the robustness of DNN against adversarial attacks with higher data efficiency in sampling the virtual data points for augmentation.
We propose Bamboo, a ball-shape data augmentation scheme that augments the training set with N virtual data points uniformly sampled from a r-radius ball centered at each original training data point. Algorithm 1 provides a formal description of the proposed method.
Since the decision boundary of the DNN model tends
to have small curvature around training data points
Output: Augmented training set (X^ ; Y^ ) 1 n := length(X);
. Initialization with training set data 2 X^ := X, Y^ := Y ; 3 count := n; 4 for i = 1 : n do 5 x := X[i], y := Y [i]; 6 for j = 1 : N do 7 count := count + 1; 8 Sample
X^ [count] := x + r;
Y^ [count] := y; 9 points, implying a more robust model with the training set augmented with our proposed Bamboo method.
For evaluating the effect of parameter r and N on the
performance of our model, we use the average strength of
successful CW attack
To visualize the effect on decision boundary, we follow
the setting used in
(b) CW robustness Bamboo augmentation has two hyper-parameters: the ball radius r and the ratio of the augmented data N . In figure 2a, when we fix the radius r, the testing accuracy increases as the number of augmented points grows up. Adjusting the radius has little impact on the testing accuracy. Figure 2b presents that when r is fixed, the robustness improves as N increases. The effectiveness of further increasing N becomes less as N gets larger. Under the same data amount, increasing the radius r can also enhance the robustness, while the effectiveness of increasing r saturates as r gets larger.
Figure 3 shows the top 20 smallest decision boundary on random orthogonal directions average across MNIST and CIFAR-10 testing points respectively. Comparing to previous methods, our Bamboo data augmentation can provide largest gain on robustness for the most vulnerable directions.
Table 1 summarizes the performance of the DNN model trained with Bamboo comparing to other methods. Bamboo achieves the highest robustness under CW attack on both MNIST and CIFAR-10 experiments, and the lowest accuracy drop when facing Gaussian noise. Bamboo demonstrates a higher robustness against a wide range of attacking methods and the performance of our method is less sensitive to the change of the attacking strength. Also, the overall performance of Bamboo is better than Mixup with the same amount of data augmented. All these observations lead to the conclusion that our proposed Bamboo method can effectively improve the overall robustness of DNN models, no matter which kind of attack is applied or which direction of noise is added. The ImageNet experiment results showed in Table 2 show the same trend as well. = 0:5
In this work we propose Bamboo, the first data augmentation method that is specially designed for improving the overall robustness of DNNs. Without making any assumption on the distribution of adversarial examples, Bamboo is able to effectively improve the robustness of DNN models against different kinds of attacks, and can achieve stable performance on large DNN models or facing strong adversarial attacks.
In future work we will discuss the theoretical relationship between the resulted DNN robustness and the parameters in our method, and how will the change in the scale of the classification problem affect such relationship. We will also propose new training tricks better suited for training with augmented dataset.