Less is More: Data Pruning for Faster Adversarial Training

Abstract

Deep neural networks (DNNs) are sensitive to adversarial examples, resulting in fragile and unreliable performance in the real world. Although adversarial training (AT) is currently one of the most efective methodologies to robustify DNNs, it is computationally very expensive (e.g., 5 ∼ 10× costlier than standard training). To address this challenge, existing approaches focus on single-step AT, referred to as Fast AT, reducing the overhead of adversarial example generation. Unfortunately, these approaches are known to fail against stronger adversaries. To make AT computationally eficient without compromising robustness, this paper takes a diferent view of the eficient AT problem. Specifically, we propose to minimize redundancies at the data level by leveraging data pruning. Extensive experiments demonstrate that the data pruning based AT can achieve similar or superior robust (and clean) accuracy as its unpruned counterparts while being significantly faster. For instance, proposed strategies accelerate CIFAR-10 training up to 3.44× and CIFAR-100 training to 2.02× . Additionally, the data pruning methods can readily be reconciled with existing adversarial acceleration tricks to obtain the striking speed-ups of 5.66× and 5.12× on CIFAR-10, 3.67× and 3.07× on CIFAR-100 with TRADES and MART, respectively.

Keywords

• eol>Adversarial Robustness
• Adversarial Data Pruning
• Eficient Adversarial Training

1. Introduction

The AAAI-23 Workshop on Artificial Intelligence Safety (SafeAI 2023), Feb 13-14, 2023, Washington, D.C., US † Corresponding author. $ [e-mail] (Y. Li); [e-mail] (P. Zhao); [e-mail] (X. Lin); [e-mail] (B. Kailkhura); [e-mail] (R. Goldhahn)

© 2023 Copyright for this paper by its authors. Use permitted under Creative Commons License pruning with Bullet-Train [22], which allocates dynamic CPWrEooUrckReshdoinpgs IhStpN:/c1e6u1r3-w-0s.o7r3g ACttEribUutRion W4.0oInrtekrnsahtioonpal (PCCroBYce4.0e).dings (CEUR-WS.org) computing cost to categorized training data, further improves the speed-ups by 5.66× and 3.67× on CIFAR-10 and CIFAR-100, respectively. Our main contributions are summarized below.

• We explore eficient AT from the lens of data pruning, where the acceleration is achieved by only focusing on the representative subset of the data. • We propose two data pruning algorithms, Adv

GRAD-MATCH and Adv-GLISTER, and perform a comprehensive experimental study. We demonstrate that our data pruning methods yield consistent efectiveness across diverse robustness evaluations, e.g., PGD [13] and AutoAttack [23]. • Furthermore, combining our eficient AT framework with the existing Bullet-Train approach [22] achieves state-of-the-art performance in training cost.

2. Related Work

tacks [13, 24, 25, 26, 27] refer to detrimental techniques that inject imperceptible perturbations into the inputs and mislead decision making process of networks. In this paper, we mainly investigate ℓ attacks, where ∈ {0, 1, 2, ∞}. Fast Gradient Sign Method (FGSM) [24] is the cheapest one-shot adversarial attack. Basic Iterative Method (BIM) [28], Projected Gradient Descent (PGD) [13] and CW [25] are stronger attacks that are iterative in nature. Adversarial examples are used for the assessment of model robustness. AutoAttack [23] ensembles multiple attack strategies to perform a fair and reliable evaluation of adversarial robustness.

Various defense methods [29, 30, 31, 32] have been proposed to tackle the vulnerability of DNNs against adversarial examples, while most of the approaches are built over AT, where perturbed inputs are fed to DNNs to learn from adversarial examples. Projected Gradient Descent (PGD) based AT is one of the most popular defense strategies [13], which uses a multi-step adversary. Training only with adversarial samples can lead to a drop in clean accuracy [33]. To improve the trade-of between accuracy and robustness, TRADES [20] and MART [21] compose the training loss with both the natural error term and the robustness regularization term. Curriculum Adversarial Training (CAT) [34] robustifies DNNs by adjusting PGD steps arranging from weak attack strength to strong attack strength, while Friendly Adversarial Training (FAT) [35] performs early-stopped PGD for adversarial examples. computation consumption depending on the number of steps used in generating adversarial examples. The major work to achieve training eficiency focuses on how to reduce the number of attack steps and maintain the stability of one-step FGSM-based AT. Free AT [ 36 ] performs FGSM perturbations and updates model weights on the simultaneous mini-batch. FAST AT [14] generates FGSM attacks with random initialization but still sufers from ‘catastrophic overfitting’. Therefore, Gradient alignment regularization [17], suitable inner interval (step size) for the adversarial direction [16], and Fast Bi-level AT (FASTBAT) [ 37 ] are proposed to prevent such failure.

Data pruning.

Eficient learning through data subset selection economizes on training resources. Proxy functions [ 38, 39 ] take advantage of the feature representation from the tiny proxy model to select the most informative subset for training the larger one. Coreset-based algorithms [ 40 ] mine for a small representative subset that approximates the entire dataset following established criapproximates the full gradient and GRAD-MATCH [ 42 ] minimizes the gradient matching error. GLISTER [ 43 ] prunes the training data by maximizing log-likelihood for the validation set. 3. Data Pruning Based Adversarial

Training

3.1. Preliminaries

AT [13] aims to solve the min-max optimization problem as follows: min 1 ∑︁

︂[ || (,)∈ ∈△ sample and label from the training dataset , denotes imperceptible adversarial perturbations injected into under the norm constraint by the constant strength , i.e., △ := {‖ ‖∞ ≤ }, and ℒ is the training loss. During the adversarial procedure, the optimization first maximizes the inner approximation for adversarial attacks and then minimizes the outer training error over the model parameter . A typical adversarial example generation procedure involves multiple steps for the stronger adversary, e.g., +1 = Proj△ (︀ + sign (︀ ∇ ℒ (︀ ; , ︀) , (2)

Adversarial attacks and defenses.

Adversarial at- teria. CRAIG [ 41 ] selects the training data subset which ial examples, the learning overhead is usually dramatically larger than the standard training, e.g., 5 ∼ training showing empirical robustness against adversar- size , using the sign of gradients. where the projection follows -ball at the step with step Outlier Boundary Robust F 30 20 10 90 80 70 60 Outlier Boundary Robust

Epoch (a) TRADES. F 30 20 10 90 80 70 60 3.2. General Formulation for Adversarial

Data Pruning

tions towards eficiently achieving high clean accuracy.

We extend these approaches in the context of adversarial robustness. Motivated by GLISTER [ 43 ], we first consider Our adversarial data pruning consists of two steps: ad- training a subset that obtains the optimal adversarial versarial subset selection and AT with the subset of data. log-likelihood on the validation set in Eq. (5), defined as In the specified epoch, adversarial subset selection first ifnds a representative subset of data from the entire training dataset. Next, AT is performed with the selected subset. Though the size of the subset keeps the same in diferent iterations, the data in the subset is updated in each iteration based on the diferent status of the model weights. We formulate the AT with the data subset in Eq. (3) and adversarial subset selection in Eq. (4).

min 1

∑︁ (,)∈ ︂[ ∈△ where represents the complete training set and represents the perturbation under ∞ norm constraint △

. The selected subset with the size is obtained by optimizing the function , which aims to narrow the diference between and under specific criteria with model parameters . Note that the data selection step is performed * are adversarial examples obtained by maximizing periodically to achieve computational savings.

Recent data subset selection schemes, GRAD-MATCH ( ; + , ) and ( ; + , ), respectively. During the data selection, the adversarial gra[ 42 ] and GLISTER [ 43 ], have made significant contribudient diference between the weighted subset loss and where is the negative log-likelihood on validation set; * is the adversarial perturbation obtained by maximizing ( ; + , ).

Another adversarial data pruning approach is inspired by GRAD-MATCH [ 42 ], which aims to find the data sub(3) set whose gradients closely match those of the full train

ing data. Adv-GRAD-MATCH is formulated as Eq. (6): (4) () = ‖

∇ ℒ ( ; + * , ) ∑︁ ( , )∈ −∇

ℒ (,)∈ ( ; + *, )‖

(6) where is the weight vector associated with each instance in the subset ; ℒ and ℒ denote the training loss over the subset and entire dataset; * and

4. Experiments

4.1. Experiment Setup

To evaluate the eficiency and generality of the proposed method, we apply adversarial training loss functions from TRADES [20] or MART [21] on the standard datasets, CIFAR-10, CIFAR-100 [ 44 ] trained on ResNet-18 [ 45 ]. Our adversarial data pruning methods include Adv-GRADMATCH and Adv-GLISTER with diferent data portions (subset size) [30%, 50%] with 100 and 200 epochs where the selection interval is 20 (i.e., perform adversarial subset selection every 20 epochs of AT). The original training dataset is divided into the train (90%) and the validation set (10%) in Adv-GLISTER. The optimizer is SGD with momentum 0.9 and weight decay 2e-4 for TRADES and 3.5e-3 for MART. For Adv-GRAD-MATCH and AdvGLISTER, the initial learning rate is 0.01 and 0.02 on CIFAR-10 and 0.08 and 0.05 on CIFAR-100 respectively. Besides the original TRADES [20] and MART [21] methods, we also compare our approach with Bullet-Train [22]. PGD attack [13] (PGD-50-10) is adopted for evaluating the robust accuracy, ranging from low magnitude ( = 4/255) to high magnitude ( = 16/255) with 50 iterations as well as 10 restarts at the step-size = 2/255 under ∞-norm. Moreover, AutoAttack [23] is leveraged for the reliable robustness evaluation. Additionally, our methods can also be combined with Bullet-Train [22] and we term them as Adv-GRAD-MATCH&Bullet and Adv-GLISTER&Bullet.

4.2. Main Results

Table 1 shows the results of our Adv-GLISTER and AdvGRAD-MATCH for TRADES compared with the original TRADES and Bullet-Train methods. The comparison is in terms of clean and robust accuracy (under samples gradually increases and eventually dominates, two attack methods, PGD Attack [13] and AutoAttack while the number of outliers and boundary data points [23]) along with the training speed-up. We observe that decreases over epochs, revealing similar achievements compared to the baselines, the training eficiency of our in TRADES-based AT and data pruning-based methods. method is improved significantly on CIFAR-10, while In addition, the ultimate portions of three sets explain the decrease happens on the clean accuracy and robust- the clean accuracy and robustness degrading of our apness under AutoAttack and PGD attacks for diferent proaches. In detail, two baselines obtain more robust values of . Especially, for = 16/255, the robust accu- samples and fewer boundary and outlier examples. racy can be improved from 16.05% (Bullet-Train [22]) We further evaluate the performances of adversarial to 16.52% and 17.49% with our Adv-GRAD-MATCH data pruning based on the loss of MART in Table 2. Reand Adv-GLISTER, indicating our defensive capability sults are consistent with our findings on TRADES in on powerful attacks. As displayed in Table 1, our Adv- Table 1.

GRAD-MATCH and Adv-GLISTER reduce the training overheads (seconds per epoch) enormously and achieve 4.3. Ablation Studies 3.44× and 3.09× training speed-ups. After combining our approaches with Bullet-Train [22], an even faster Epoch. We first consider the training epoch. Table 3 acceleration of 5.12× can be reached. shows that longer training improves both clean and ro

On CIFAR-100, the validity of our schemes is consistent bust accuracy. Due to the shrinking data size, more as well. The reason why both clean and robust accuracy epochs are required to enhance data-eficient adversarial drop might be that our data pruning schemes struggle learning, in alignment with standard data pruning trainwith the dimensionality and complexity of the dataset. ing. However, 100-epoch training appears to be suficient Regardless, our schemes still result in conspicuous com- for the small dataset. putation savings compared with other baselines. Subset Size. We experiment with diferent subset sizes.

To understand the robustness improvements of our Moving from the extremely small subset (10% of the full schemes, we track the dynamics of the outlier, robust, training set) to a larger subset (70%) in Fig. 2, the obserand boundary sets (similar to [22]) using PGD-5-1 attack. vation is that robust accuracy gradually increases to that Without any attack, the outlier examples have already of the full dataset. This highlights the benefit of pruning been mistaken by the model, but boundary and robust with optimal subset size. We can see that 30% is an approexamples are correctly identified. After adversarial at- priate choice for the CIFAR-10 subset size, after taking tacks, boundary examples are incorrectly classified while the global eficiency into account. robust examples are still correctly classified. Fig. 1 dis- Number of selection rounds. In Sec. 4.2, our experiplays the dynamics of the outlier, boundary, and robust ments perform adversarial data pruning every 20 epochs examples on CIFAR-10 for various schemes. During the (with 9 selections). Here we present the results of data model training and data selection, the number of robust pruning every 40 epochs (with 4 selections). As shown in Adv-GLISTER Efficiency Adv-GRAD-MATCH Efficiency

Adv-GLISTER Efficiency

Adv-GRAD-MATCH Efficiency 11 TARdAv-DGELSISTER 10 Adv-GRAD-MATCH 9 TRADES 8 7 6 5 4 3 2 1 0 100% p u d e e p S 100% p u d e e p S 5. Conclusion and Future Work In this paper, we investigated eficient adversarial training from a data-pruning perspective. With comprehensive experiments, we demonstrated that proposed adversarial data pruning approaches outperform the existing baselines by mitigating substantial computational overhead. These positive results pave a path for future research on accelerating AT by minimizing redundancy at the data level. Our future work will focus on designing more accurate pruning schemes for large-scale datasets.

Acknowledgment

This work was performed under the auspices of the U.S.

Department of Energy by Lawrence Livermore National Laboratory under Contract DE-AC52-07NA27344 and was supported by LLNL-LDRD Program under Project No. 20-SI-005 (LLNL-CONF-842760). in: Advances in Neural Information Processing Sys- 2021.

tems (NeurIPS), 2020. [23] F. Croce, M. Hein, Reliable evaluation of adversarial [10] A. Athalye, N. Carlini, D. Wagner, Obfuscated gra- robustness with an ensemble of diverse parameterdients give a false sense of security: Circumventing free attacks, in: International Conference on Madefenses to adversarial examples, in: Proceedings chine Learning (ICML), 2020. of the 35th International Conference on Machine [24] I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining Learning (ICML), 2018. and harnessing adversarial examples, in: arXiv, [11] E. Wong, Z. Kolter, Provable defenses against ad- 2015.

versarial examples via the convex outer adversarial [25] N. Carlini, D. Wagner, Towards evaluating the ropolytope, in: Proceedings of the 35th International bustness of neural networks, in: IEEE Symposium Conference on Machine Learning (ICML), 2018. on Security and Privacy (S&P), IEEE, 2017. [12] H. Salman, J. Li, I. Razenshteyn, P. Zhang, H. Zhang, [26] F. Croce, M. Hein, Sparse and imperceivable adverS. Bubeck, G. Yang, Provably robust deep learning sarial attacks, in: Proceedings of the IEEE/CVF Invia adversarially trained smoothed classifiers, in: ternational Conference on Computer Vision (ICCV), Advances in Neural Information Processing Sys- 2019.

tems (NeurIPS), 2019. [27] Q. Zhang, X. Li, Y. Chen, J. Song, L. Gao, Y. He, [13] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, H. Xue, Beyond imagenet attack: Towards crafting A. Vladu, Towards deep learning models resistant adversarial examples for black-box domains, in: to adversarial attacks, in: International Conference International Conference on Learning Representaon Learning Representations (ICLR), 2018. tions (ICLR), 2022. [14] E. Wong, L. Rice, J. Z. Kolter, Fast is better than free: [28] A. Kurakin, I. Goodfellow, S. Bengio, Adversarial Revisiting adversarial training, in: International examples in the physical world, 2016. URL: https: Conference on Learning Representations (ICLR), //arxiv.org/abs/1607.02533. doi:10.48550/ARXIV. 2020. 1607.02533. [15] B. S. Vivek, R. Venkatesh Babu, Single-step adver- [29] D. Meng, H. Chen, Magnet: A two-pronged defense sarial training with dropout scheduling, in: 2020 against adversarial examples, in: Proceedings of IEEE/CVF Conference on Computer Vision and Pat- the 2017 ACM SIGSAC Conference on Computer tern Recognition (CVPR), 2020. and Communications Security, 2017. [16] H. Kim, W. Lee, J. Lee, Understanding catastrophic [30] F. Liao, M. Liang, Y. Dong, T. Pang, X. Hu, J. Zhu, overfitting in single-step adversarial training, in: Defense against adversarial attacks using high-level Proceedings of the AAAI Conference on Artificial representation guided denoiser, in: Proceedings Intelligence (AAAI), volume 35, 2021, pp. 8119– of the IEEE Conference on Computer Vision and 8127. Pattern Recognition (CVPR), 2018. [17] M. Andriushchenko, N. Flammarion, Understand- [31] A. Mustafa, S. Khan, M. Hayat, R. Goecke, J. Shen, ing and improving fast adversarial training, in: Ad- L. Shao, Adversarial defense by restricting the hidvances in Neural Information Processing Systems den space of deep neural networks, in: Proceedings (NeurIPS), 2020. of the IEEE/CVF International Conference on Com[18] B. R. Bartoldson, B. Kailkhura, D. Blalock, Compute- puter Vision (ICCV), 2019.

eficient deep learning: Algorithmic trends and op- [32] Y. Gong, Y. Yao, Y. Li, Y. Zhang, X. Liu, X. Lin, S. Liu, portunities, arXiv preprint arXiv:2210.06640 (2022). Reverse engineering of imperceptible adversarial [19] M. Kaufmann, Y. Zhao, I. Shumailov, R. Mullins, image perturbations, in: International Conference N. Papernot, Eficient adversarial training with on Learning Representations (ICLR), 2022. data pruning, in: arXiv, 2022. [33] D. Su, H. Zhang, H. Chen, J. Yi, P.-Y. Chen, Y. Gao, Is [20] H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. E. Ghaoui, robustness the cost of accuracy? – a comprehensive M. I. Jordan, Theoretically principled trade-of be- study on the robustness of 18 deep image classifitween robustness and accuracy, in: International cation models, in: Proceedings of the European Conference on Machine Learning (ICML), 2019. Conference on Computer Vision (ECCV), 2018. [21] Y. Wang, D. Zou, J. Yi, J. Bailey, X. Ma, Q. Gu, Im- [34] Q.-Z. Cai, C. Liu, D. Song, Curriculum adversarial proving adversarial robustness requires revisiting training, in: Proceedings of the Twenty-Seventh misclassified examples, in: International Confer- International Joint Conference on Artificial Intellience on Learning Representations (ICLR), 2020. gence, IJCAI-18, International Joint Conferences on [22] W. Hua, Y. Zhang, C. Guo, Z. Zhang, G. E. Suh, Bul- Artificial Intelligence Organization, 2018, pp. 3740– lettrain: Accelerating robust neural network train- 3747. URL: https://doi.org/10.24963/ijcai.2018/520. ing via boundary example mining, in: Advances in doi:10.24963/ijcai.2018/520. Neural Information Processing Systems (NeurIPS), [35] J. Zhang, X. Xu, B. Han, G. Niu, L. Cui, M. Sugiyama,

References

[1] Q. Xie , M.- T. Luong , E. Hovy , Q. V. Le , Self-training with noisy student improves imagenet classification , in: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2020 .

[2] P. Foret , A. Kleiner , H. Mobahi , B. Neyshabur , Sharpness-aware minimization for eficiently improving generalization , in: International Conference on Learning Representations (ICLR) , 2021 .

[3] Z.-Q. Zhao , P. Zheng , S.-T. Xu, X. Wu , Object detection with deep learning: A review , IEEE Transactions on Neural Networks and Learning Systems 30 ( 2019 ) 3212 - 3232 . doi: 10 .1109/TNNLS. 2018 . 2876865 .

[4] S. S. A. Zaidi , M. S. Ansari , A. Aslam , N. Kanwal , M. Asghar , B. Lee , A survey of modern deep learning based object detection models , Digital Signal Processing 126 ( 2022 ) 103514 .

[5] A. Vaswani , N. Shazeer , N. Parmar , J. Uszkoreit , L. Jones , A. N. Gomez , L. u. Kaiser, I. Polosukhin , Attention is all you need , in: Advances in Neural Information Processing Systems (NeurIPS) , 2017 .

[6] S. Borgeaud , A. Mensch , J. Hofmann , T. Cai , E. Rutherford , K. Millican , G. B. Van Den Driessche , J. -B. Lespiau , B. Damoc , A. Clark , D. De Las Casas , A. Guy , J. Menick , R. Ring , T. Hennigan , S. Huang , L. Maggiore , C. Jones , A. Cassirer , A. Brock , M. Paganini , G. Irving , O. Vinyals , S. Osindero , K. Simonyan , J. Rae , E. Elsen , L. Sifre , Improving language models by retrieving from trillions of tokens , in: Proceedings of the 39th International Conference on Machine Learning (ICML) , 2022 .

[7] P.-Y. Chen , H. Zhang , Y. Sharma , J. Yi , C.-J. Hsieh , Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models , in: Proceedings of the ACM Workshop on Artificial Intelligence and Security , ACM, 2017 .

[8] C. Xiao , B. Li , J. yan Zhu, W. He, M. Liu , D. Song , Generating adversarial examples with adversarial networks , in: Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence(IJCAI) , 2018 .

[9] F. Tramer , N. Carlini , W. Brendel , A. Madry , On adaptive attacks to adversarial example defenses, M. Kankanhalli, Attacks which do not kill training make adversarial learning stronger , in: Proceedings of the 37th International Conference on Machine Learning (ICML) , 2020 .

[36] A. Shafahi , M. Najibi , M. A. Ghiasi , Z. Xu , J. Dickerson , C. Studer , L. S. Davis , G. Taylor, T. Goldstein, Adversarial training for free! , in: Advances in Neural Information Processing Systems (NeurIPS) , 2019 .

[37] Y. Zhang , G. Zhang, P. Khanduri, M. Hong , S. Chang , S. Liu, Revisiting and advancing fast adversarial training through the lens of bi-level optimization , in: International Conference on Machine Learning (ICML) , 2022 .

[38] C. Coleman , C. Yeh , S. Mussmann , B. Mirzasoleiman , P. Bailis , P. Liang , J. Leskovec , M. Zaharia , Selection via proxy: Eficient data selection for deep learning , in: International Conference on Learning Representations (ICLR) , 2020 . URL: https://openreview.net/forum?id= HJg2b0VYDr .

[39] V. Kaushal , R. Iyer , S. Kothawade , R. Mahadev , K. Doctor , G. Ramakrishnan, Learning from less data: A unified data subset selection and active learning framework for computer vision , in : Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV) , 2019 .

[40] D. Feldman , Core-Sets: Updated Survey, Springer International Publishing, Cham, 2020 , pp. 23 - 44 . URL: https://doi.org/10.1007/978-3- 030 -29349- 9 _2. doi: 10 .1007/978-3- 030 -29349- 9 _ 2 .

[41] B. Mirzasoleiman , J. Bilmes , J. Leskovec , Coresets for data-eficient training of machine learning models , in: Proceedings of the 37th International Conference on Machine Learning (ICML) , 2020 .

[42] K. Killamsetty , D. S, G. Ramakrishnan, A. De, R. Iyer, Grad-match: Gradient matching based data subset selection for eficient deep model training , in: Proceedings of the 38th International Conference on Machine Learning (ICML) , 2021 .

[43] K. Killamsetty , D. Sivasubramanian , G. Ramakrishnan, R. Iyer , Glister: Generalization based data subset selection for eficient and robust learning , in: Proceedings of the AAAI Conference on Artificial Intelligence (AAAI) , volume 35 , 2021 , pp. 8110 - 8118 .

[44] A. Krizhevsky , G. Hinton , Learning multiple layers of features from tiny images , Master's thesis , Department of Computer Science, University of Toronto ( 2009 ).

[45] K. He , X. Zhang , S. Ren, J. Sun , Identity mappings in deep residual networks , in: European conference on computer vision (ECCV) , Springer, 2016 , pp. 630 - 645 .