A Minimax Optimization Framework for Robust Deep Learning under Adversarial Perturbations

Abstract

Adversarial training defends deep networks by solving a minimax problem. The learner minimizes the worst loss that an adversary can reach near each input. The worst-case loss has kinks in the network weights. We regularize the adversary with relative entropy and a temperature. The regularized inner problem then has a closed-form Gibbs solution over a set of candidate perturbations. Its value lies between the mean and the maximum of the candidate losses. Its distance below the best candidate is at most the temperature times the logarithm of the number of candidates. We prove that its gradient is Lipschitz with a constant that grows inversely with the temperature, and that this constant is attained. We prove that near-stationary points of the smoothed loss are near-stationary for the original min-max loss. In the zero-temperature limit they are Clarke stationary, and the temperature enters the iteration complexity through a logarithmic factor. We compare it with three defenses on MNIST and Fashion MNIST at a matched budget of eight ascent steps. The method did not improve on projected gradient adversarial training. Worst-case accuracy was 58.5% for both on Fashion-MNIST, and 32.3% against 34.4% on MNIST, within the test-sampling error. The theory explains why the temperature had little effect: two restarts ended on average only 0.047 nats apart on MNIST. On trained networks, the measured curvature added by the adversary was three to four orders of magnitude below the bound. Splitting the budget into four two-step chains reduced MNIST worst-case accuracy to 5.6%.