Improving the Robustness of Deep Neural Networks via Adversarial Training with Triplet Loss

1 Introduction

Deep neural networks (DNNs) have been widely used for security-critical tasks, including but not limited to autonomous driving [Evtimov et al., 2017], surveillance [Ouyang and Wang, 2013], biometric recognition [Xu et al., 2017], and malware detection [Yuan et al., 2014]. However, recent studies have shown that DNNs are vulnerable to adversarial examples [Goodfellow et al., 2014; Papernot et al., 2016; Chen et al., 2017; Li et al., 2018], which are carefully crafted instances that can mislead welltrained DNNs. This raises serious concerns about the security of machine learning models in many real-world applications.

Recently, many efforts have been made to improve the robustness of DNNs, such as (i) using the properties of obfuscated gradients [Athalye et al., 2018] to prevent the attackers from obtaining the true gradient of the model, e.g., mitigating through randomization [Xie et al., 2018], Thermometer encoding [Buckman et al., 2018], and Defense-GAN [Samangouei et al., 2018]; (ii) adding adversarial examples into the training set, e.g., Adversarial Training [Szegedy et al.,

2013; Goodfellow et al., 2014], scalable Adversarial Training [Kurakin et al., 2016b], and Ensemble Adversarial Training [Tram`er et al., 2018]. However, it was shown that the first type of defense methods had been broken through by various targeted countermeasures [Carlini and Wagner, 2017a; He et al., 2017; Athalye et al., 2018]. The second type of methods also suffers the distortion of the classification boundary for the reason that they only import adversarial examples against some specific types of attacks.

In this paper, we follow the framework of Adversarial Training and introduce Triplet Loss [Schroff et al., 2015], one of the most popular Distance Metric Learning methods, to improve the robustness by smoothing the classification boundary. Triplet loss is designed to optimize the embedding space such that data points with the same label are closer to each other than those with different labels. The primary challenge of triplet loss is how to select representative triplets, which are made up of three examples from two different classes and jointly constitute a positive pair and a negative pair. Since adversarial examples contain more information about the decision boundary than normal examples, we modify the anchor of triplet loss with adversarial examples to enlarge the distance between adversarial examples and examples with different labels in the embedding space. Then, we add this finegrained triplet loss to the original adversarial training process and name the new algorithm as Adversarial Training with Triplet Loss (AT2L). We also propose an ensemble algorithm which aggregates different types of attacks and model structures to improve the performance. Furthermore, the proposed triplet loss can be applied to other methods as a regularization term for better robustness.

We summarize our main contributions as follows:

• We introduce triplet loss into the adversarial training framework and modify the anchor of triplet loss with adversarial examples. We also design an ensemble version of our method.
• We propose to take our triplet loss as a regularization term and apply it to existing defense methods for further improvement of robustness.
• We conduct extensive experiments to evaluate our algorithms. The empirical results show that our proposed approach behaves more robust and preserves the accuracy of the model, and the triplet loss can also improve

the performance of other defense methods.

2 RelatedWork

In this section, we briefly review existing adversarial attack and defense methods.

2.1 AttackMethods

Attack methods can be divided into two main categories: gradient-based attack and optimization-based attack.

The gradient-based attack asks for the structure of the attacked model and requires that the attacked model should be differentiable. Then it generates adversarial examples by adding perturbation along the direction of the gradients. FGSM [Goodfellow et al., 2014], Single-Step Least-Likely (LL) [Kurakin et al., 2016a; Kurakin et al., 2016b] and their iterative versions, i.e., I-FGSM and I-LL, are popular methods in this type of attack.

The optimization-based attack formulates the task of attack as an optimization problem which aims to minimize the norm of perturbation and make the DNN model mis-classify adversarial examples. C&W attack [Carlini and Wagner, 2017b] is by far one of the strongest optimization-based attacks. It can reduce the classifiers' accuracy to almost 0 and has bypassed over 10 different methods designed for detecting adversarial examples [Carlini and Wagner, 2017a]. However, it is more time-consuming than gradient-based algorithms.

2.2 Defense Methods

Many recent defense approaches are based on a technique called obfuscated gradients [Athalye et al., 2018]. It is similar to gradient masking [Papernot et al., 2017] which is a failed defense method that tries to deny the attacker access to a useful gradient, and leads to a false sense of security in defenses against adversarial examples. Typical defense methods using obfuscated gradients are thermometer encoding [Buckman et al., 2018], Stochastic activation pruning [Dhillon et al., 2018], Mitigating through randomization [Xie et al., 2018] and Defense-GAN [Samangouei et al., 2018].

Another common method is adversarial training, which proposes to add adversarial examples to the training set and then retrain the model for better robustness. Szegedy et al. (2013) first propose this simple process in which the model is trained on adversarial examples until it learns to classify them correctly. However, this type of methods suffers the distortion of the classification boundary. So in this paper, we introduce Distance Metric Learning to alleviate this distortion.

3 Methodology

In this section, we first introduce the triplet loss. Then we present Adversarial Training with Triplet Loss (AT2L) and an ensemble version of AT2L. Finally, we propose to treat our special triplet loss as a regularization term and combine it with existing defense methods.

3.1 Triplet Loss

A triplet [Schroff et al., 2015] consists of three examples from two different classes, which jointly constitute a positive pair and a negative pair. We denote (xai , xpi , xni ) as a triplet, where (xai , xpi ) has the same label and (xai , xni ) has the different. The xai term is referred to as the anchor of a triplet. The distance between the positive pair is encouraged to be smaller than that of the negative pair, and a soft nearest neighbor classification margin is maximized by optimizing a hinge loss. Specifically, triplet loss forces the network to generate an embedding where the distance between xai and xni is larger than the distance between xai and xpi plus the margin parameter α.

Formally, we define the triplet loss function as follows:

where N is the cardinality of the set of triplets used in the training process, f(·) is the output of the last fully connected layer of our neural network, ‖xi - xj‖ represents a metric of distance between xi and xj . Here we use ℓ∞ norm in our experiments.

Generating all possible triplets would result in redundant triplets and lead to slow convergence. So in the next sections, we use sampling strategy to generate triplets in our algorithms.

3.2 Adversarial TrainingWith Triplet Loss (AT2L)

The original version of adversarial training is to craft adversarial examples for the entire training set and add them to the training process. Specifically, it generates Xadv which contains adversarial examples of instances in training set X. Then it concatenates Xadv and X as X′ and retrains the model with X′ . During each iteration of the original algorithm, it generates the adversarial examples against the current model. The loss function of the original adversarial training is formulated as:

where λ is the hyper-parameter, k is the size of the mini-batch sampled from X, y is the label of xi and xadv i is the adversarial example of xi.

To encourage a larger margin between the positive class and the negative class, we incorporate triplet loss into the loss function. Specifically, for example xi, we generate adversarial example xadv i and sampled an example xni from the minibatch which has a different label to construct a new triplet (xadv i , xi, xni ). The main difference between this triplet and the original triplet is that instead of taking the original example xi as the anchor, we choose the adversarial example xadv i , which contains more information about the decision boundary. Specifically, when dealing with a binary classification problem, we sample xni which has the opposite label to xi. For multi-class problems, we sample xni from the same class as the adversarial example xadv i , which is an incorrect class from the view of human beings. We apply this new triplet

Algorithm 1 Adversarial Training With Triplet Loss (AT2L)

• 1: Train f(·) with training data X;
• 2: repeat
• 3: Construct Xadv against f(·) for each instance in X;
• 4: X′ = [X,Xadv];
• 5: Retrain f(·) with X′ using Eq. (2);
• 6: until Training converged

to the triplet loss, and combine it with the loss of adversarial training, so the loss function of our algorithm is formulated as:

where k is the size of a mini-batch, and λ1, λ2 and α are the hyper-parameters. We utilize this new loss function to retrain the model and summarize the proposed algorithm in Algorithm 1.

3.3 Ensemble AT2L

We proceed to improve the robustness of the model against unknown type of attacks for the reason that the originally proposed algorithm can only defend against known type of attacks, where defenders have detailed information about the attacking methods and lack robustness against attacks transferred from unknown models. Our first attempt is to combine different attack methods together to increase the robustness. As shown in Algorithm 2 where A denotes an aggregation of attack methods, we conduct adversarial training on a collection of adversarial examples that are generated by all the attack methods. In this paper, we consider three types of attacks as follows:

• Gradient-based: A = {FGSM, LL, I-FGSM, I-LL}.
• Optimization-based: A = {C&W}.
• Mixed: A = {FGSM, LL, I-FGSM, I-LL, C&W}.

On the other hand, we adopt the idea of Ensemble Adversarial Training [Tram`er et al., 2018], which says that the augmentation of training data with perturbations transferred from other models can improve the robustness not only under a known type of attack, but also under an unknown type of attack. As shown in Algorithm 2, where M is a set of model structures, we extend our training set with adversarial examples against different models in M.

In general, the ensemble version of our algorithm not only considers various types of attacks, but also involves adversarial examples generated against different model structures. Therefore, our algorithm captures more information about the decision boundary, and with our designed triplet loss, it can smooth the classification boundary and learn a better embedding space to alleviate the distortion.

3.4 Triplet Regularization

Our triplet loss can also be regarded as a regularization term:

Thus, it can be incorporated into most of the existing defense methods for better robustness. The defense methods based on obfuscated gradients mostly mask the real gradient by adding non-differentiable preprocessing or random processes, and there is no restriction on the loss function used in the training process. Therefore, we can modify their loss function by adding our triplet regularization term to further increase the robustness.

For example, Buckman et al. (2018) propose to encode the input with Thermometer Encoding and retrain the model with the traditional adversarial training. Triplet regularization can be easily applied to this method by changing the loss function of the adversarial training process. Mitigating through randomization [Xie et al., 2018] and Defense-GAN [Samangouei et al., 2018] both perform transformations over original inputs without changing the loss. So we can directly incorporate our triplet regularization into their losses to improve the defense effect.

4 Experiments

In this section, we present experimental results.

4.1 Settings

We conduct experiments over three datasets, i.e., Cats vs. Dogs [Elson et al., 2007], MNIST [LeCun, 1998] and CIFAR10 [Krizhevsky and Hinton, 2009]. Cats vs. Dogs is a large scale image dataset used for binary classification problems. MNIST and CIFAR10 are commonly used datasets for multi-class classification problems.

The attack methods we used in our experiments include FGSM, I-FGSM, LL, I-LL, C&W, LS-PGA and Deepfool [Moosavi-Dezfooli et al., 2016] and the model structures used in the experiments are different for three datasets. The parameters of these methods, detailed model structures and full results of the experiments are described in the full version of our paper 1 .

4.2 Adversarial TrainingWith Triplet Loss (AT2L)

To illustrate the advantage of the proposed method, we compare it with adversarial training without triplet loss, whose loss function is Eq. (1). As for the hyper-parameters in Eq. (1) and Eq. (2), we traverse in the appropriate interval and find

1 https://arxiv.org/abs/1905.11713

Algorithm 2 Ensemble version of AT2L

• 1: Train f(·) with training data X; 2: repeat 3: for a in A do 4: for m in M do 5: Construct Xa,m, which is the set of adversarial examples of X against model m under the attack method a. 6: end for 7: end for 8: Xadv = {Xa,m}, a ∈ A, m ∈M; 9: repeat 10: Sample k clean examples B = {x1, ..., xk} from training set X; 11: Sample k adversarial examples {xadv 1 , ..., xadv k } fromXadv. Each xadv i is the adversarial example of xi; 12: Construct a new training batch B′ = {x1, ..., xk, xadv 1 , ..., xadv k }; 13: For each instance of {xadv 1 , ..., xadv k }, take xi as xpi in triplet loss and sample an example from B with a different label from xi as xni in triplet loss; 14: Perform one training step of network f(·) using the mini-batch B′ according to Eq. (2); 15: until Training converged 16: until Training converged

that they have a stable performance in a proper range of values. Each experiment is tested by two types of attack methods, i.e., FGSM and C&W. Due to the limitation of space, we only show results where attackers perform white-box attacks in Fig. 1 and partial results where defenders perform the attack to a network which is not included in the training set M of our algorithm in Fig. 2.

We have the following observations from the results in Fig. 1: (i) when attacked by gradient-based attacks or optimization-based attacks, AT2L trained with adversarial examples generated by corresponding attacks has the best robustness, e.g., when attacked by gradient-based attacks, the model trained with adversarial examples generated by gradient-based attacks exhibits the best robustness; (ii) when trained with gradient-based attacks, AT2L shows almost no robustness against optimization-based attacks, which is shown by the black curves in Fig. 1. However, the robustness of our algorithm trained with optimization-based attacks demonstrates a decent defense effect against gradient-based attacks. This briefly verifies that optimization-based attacks are stronger and contain more information about the decision boundary than gradient-based attacks; (iii) AT2L trained with our mixed version of algorithms shows comparable robustness to the model trained with corresponding attacks. Although the mixed version of AT2L does not perform the best, it provides more reliable robustness when attacked by an unknown type of attacks.

Compared with Fig. 1 (results under adversarial examples transferred from known models), Fig. 2 (results under adversarial examples transferred from unknown models) shows that the results under the attack transferred from unknown models are slightly worse than that under the known type of attacks for the reason that the defenders are lack of precise information of the attack, e.g., the type of the attack method and model structure used for attack. However, the model still shows decent robustness against unknown type of attacks, and this is an advantage of our ensemble AT2L, which aggregates multiple model structures.

We also find that compared with the model trained over clean data, all the models trained with our algorithm, i.e., AT2L, have no loss of accuracy, and more details can be found in the supplemental material.

4.3 Triplet Regularization

To reveal the effect of triplet regularization, we compare it with the original adversarial training. We use FGSM to generate adversarial examples for the training process and test the robustness by the attack of FGSM.

From Fig. 3, we can see that the error rate of the model trained with our triplet regularization (the red curve) keeps decreasing as the number of iterations increases. So the triplet loss itself can increase the robustness of the model, and its effect is no worse than the original adversarial training (the blue curve). This result verifies our hypothesis that enlarging the margin between the adversarial examples and the negative examples and decreasing the margin between examples with the same class can smooth the decision boundary. This also suggests that the designed triplet regularization can work well in most machine learning problems to increase robustness. We can also see form Fig. 3 that AT2L, which integrates both adversarial training and triplet regularization, shows the best performance.

4.4 Current Defense Methods With Triplet Regularization

We further explore the effect of the combination of triplet regularization with existing defense methods. We experiment over some representative defense methods and demonstrate that our triplet regularization can be applied to improve their robustness further. Due to the limitation of space, we show partial results in this part, and full results are listed in the supplemental material.

Thermometer Encoding

We follow the setting of the original paper [Buckman et al., 2018] and do experiments over both known and unknown type of attacks. Partial results are shown in Table 1 which indicate employing our triplet regularization indeed improves the robustness based on the effect of the original defense. For example, when attacked by FGSM, the error rate of the model trained using thermometer encoding after 7 iterations is 20.0%. However, combining with our triplet regularization, the model can achieve 15.1% error rate.

Mitigating Through Randomization

We also apply our triplet loss to the work of Xie et al. (2018) who proposed to randomly resize or pad the images to a designed size. This defense can be added in front of normal classification process with no additional training or finetuning, and can be combined with our triplet regularization directly. We experiment over two settings from the original paper (vanilla attack scenario and ensemble-pattern attack scenario), and examine the performance of our triplet regularization. The result of the vanilla attack scenario is shown in Table 2. For the model of Inception-ResNet-v2, the randomized procedure only achieves 19.0% error rate under FGSM, but with our triplet regularization, the error rate can drop to 9.3%. These results show that our triplet regularization can further improve the robustness of the model based on the original defense method.

Defense-GAN

Defense-GAN is designed to project samples onto the manifold of the generator before classifying them. Our triplet regularization can be easily applied after the projection of Defense-GAN by simply changing the loss function during the training process of the classifier. We follow the setting of models' structures and parameters in the paper of Samangouei et al. (2018). As shown in Table 3, when attacked by C&W, model B attains 8.4% error rate using Defense-GAN, while combining with triplet regularization, it achieves 4.7% error rate. Again, this result shows that equipping the original defense method with triplet regularization can make the trained model more robust.

5 Conclusion

In this paper, we propose Adversarial Training with Triplet Loss (AT2L), which incorporates a modified triplet loss in the adversarial training process to alleviate the distortion of the models' classification boundary. We further design an ensemble version of AT2L and propose to use the triple loss as a regularization term. The results of our experiments validate the effectiveness of our algorithms and demonstrate that our triplet regularization can be applied to existing defense methods for further improvement of robustness.

Acknowledgments

This work was partially supported by the National Key R&D Program of China (2018YFB1004300), NSFC-NRF Joint Research Project (61861146001), YESS (2017QNRC001), and the Collaborative Innovation Center of Novel Software Technology and Industrialization.