Robust Regularization with Adversarial Labelling of Perturbed Samples

1 Introduction

Despite the stunning power of deep learning, regularization remains as an important technique in deep neural networks. In general, regularization may broadly refer to any technique that prevents a model from overfitting to the training data but generalizing poorly on the unseen data. Traditional regularization techniques are "data-independent", in the sense that they do not explicitly exploit the training data. These schemes, including, for example, weight decay [Krogh and Hertz, 1992] and Dropout [Srivastava et al., 2014], impose additional constraints on the model so as to restrict its capacity. Label smoothing [Szegedy et al., 2016] may also be regarded as a data-independent regularization scheme, where the training labels are "softened", leading to smoother classification boundaries. Effective as they are, the ignorance of the data structure with these data-independent approaches is arguably a major limitation.

∗Corresponding author:zhangrc@act.buaa.edu.cn

Indeed there exists another class of regularization schemes, which are "data-dependent". The most well-known example in this class is perhaps data augmentation, where additional examples are constructed from the training set based on certain prior knowledge. Each of the new examples then provides an additional constraint, thereby regularizing the model. To date, properly designed data augmentation schemes remain as the most powerful regularization techniques [Cubuk et al., 2019].

Amore recent data-dependent regularization technique is known as MixUp [Zhang et al., 2018]. It creates synthetic examples by interpolating the training examples and assigns a soft-label heuristically to each synthetic example by a similar interpolation of the labels. This approach is shown to be very effective in [Zhang et al., 2018], where the authors attribute this effectiveness to the Vicinal Risk Minimization (VRM) principle [Chapelle et al., 2001], dated back 20 years ago. Briefly VRM insists training a model not using the training set per se, but using samples drawn from a distribution, called a "vicinal distribution", that "smears" the training data to their vicinity. Indeed, using a particular choice of such distribution, the original VRM approach results in several effective regularization schemes [Chapelle et al. ].

Recently adversarial training techniques [Goodfellow et al., 2015] are proposed to improve the robustness of a model against the adversarial attacks. In these schemes, a synthetic example is produced by slightly perturbing a training example in a peculiar direction and the label of the original training example is assigned to the synthetic example. Such synthetic data are then used to train the model. Although these techniques are originally proposed to improve the adversarial robustness of a model, they also can be used as regularization techniques (see, e.g., [Miyato et al., 2018]. This is sensible since adversarial vulnerability and over-fitting share some similarities: both are caused by the close proximity of training examples to the classification boundaries. However recent research has revealed that the objective adversarial training and that of regularization, although correlated, are not completely aligned [Madry et al., 2018; Tsipras et al., 2018; Zhang et al., 2019]: excessively optimizing the model towards adversarial robustness may in fact hurt its prediction accuracy. On the other hand, as observed in [Verma et al., 2019], effectively regularized models, such as those by MixUp, are not sufficiently robust against adversarial attacks.

At present, it remains unclear howmuch adversarial robustness a model has to trade in so as to generalize well. Nonetheless, the interest of this work is to develop a regularization scheme that not only allows the model to generalize well but also make it as robust as possible. We call such an objective "robust regularization".

This work starts with a revisit of the VRM framework, since moving a data point to its vicinity appears to be an essential ingredient both for regularization and for adversarial training. In this revisit, we discover that label smoothing may also be unified under the VRM framework. More interestingly, view as a VRM technique, MixUp appears to have combined the advantages of both label smoothing and the original VRM in the following sense: the vicinal distribution used in MixUp is over the joint space of both inputs and labels whereas the vicinal distributions used in label smoothing and the original VRM are only over one of the two spaces. This inspires us to set up a vicinal distribution in a way similar to MixUp, where vicinity is defined in the joint input-label space. We then arrive at a new VRM loss function. We derive a regularization scheme based on minimizing an upper bound of this loss. This formulation, also adopting a min-max optimization as in adversarial training, has an elegant property, namely, that the inner maximization can be solved in a closed form. This allows us to arrive at a very simple training algorithm, which we designate "adversarial labelling of perturbed samples", or ALPS. Briefly, ALPS moves a training example x in the direction towards another example x′ and assigns an "adversarial label" to the moved example; here the adversarial label is the soft-label obtained by perturbing the label of x to the least likely label predicted by the model. The combination of sample interpolation and adversarial labelling in ALPS then allow the scheme to be effective both as a regularization scheme and as an adversarial training scheme.

Experiments on the SVHN, CIFAR-10, CIFAR-100 and Tiny-ImageNet datasets confirm that ALPS is among the best regularization schemes. At the same time, it also offers great adversarial robustness to the trained model, much more than existing regularization schemes.

2 RelatedWork

Data augmentation [Shorten and Khoshgoftaar, 2019] includes a family of regularization strategy, from geometrical transformations, perturbing samples with (adversarial) noise, to more advanced schemes such as AutoAugment [Cubuk et al., 2019] automatically searching for augmentation policies from data.

MixUp [Zhang et al., 2018] linearly interpolates data examples to augment training data, and encourages linear behaviour in the learned model. Manifold MixUp [Verma et al., 2019] extends this approach to the hidden layers in the neural network. CutMix [Yun et al., 2019] cuts and pastes image patches to construct new images, and mix the labels in proportion to the patch sizes. To prevent an underfitting phenomenon "manifold intrusion" in Mixup, both AdaMixup [Guo et al., 2019] and AugMix [Hendrycks et al., 2020] introduce elaborately devised penalty loss functions to learn better mixing policies.

Adversarial training [Goodfellow et al., 2015] starts from improving the model's robustness against adversarial attacks by perturbing training samples within a bounded-norm ball, where regularization arise as a knock-on effect. Layer-wise adversarial training [Sankaranarayanan et al., 2018] perturbs the activation of intermediate layers. Adversarial labelling [Kurakin et al., 2017] uses the least-likely label as a strong adversary. To tackle the over-confidence of predictions, the label smoothing regularization scheme spreads the probability of the ground-truth label slightly to other labels. This approach appears to also provide some adversarial robustness in the trained model [Shafahi et al., 2019].

Data-independent regularization methods fall in the earlier paradigm, which include, for example, early stopping, weight decay, Dropout [Srivastava et al., 2014]. Similar to Dropout, DropBlock [Ghiasi et al., 2018] generalizes input Cutout [Yun et al., 2019] by applying Cutout at every feature map in convolutions networks.

3 Vicinal RiskMinimization as a General Principle for Regularization

Consider training a neural network classifier f : X → Y for a K-class classification problem, where X is the input space and Y is the label space. Note that here we take Y as space of all distributions over the set of all class labels {1, 2, . . . ,K}, namely, each element y ∈ Y is a K-dimensional vector representing a label distribution. Let D := {(xi, yi)}ni=1 denote the training set, where each xi ∈ X is a training example, and each yi ∈ Y is the label of xi represented as a one-hot vector. Let ℓ : Y ×Y denote the usual cross-entropy loss. Under the Empirical Risk Minimization (ERM) formulation [Vapnik, 1998], the training loss is defined as the empirical risk

One can view the above empirical risk as the expectation of the cross-entropy loss over the empirical distribution given by D. More precisely, let the empirical distribution ˜ p on X × Y be defined as

where δxi (·) and δyi (·) are the Dirac measures that put probability 1 to xi and to yi. It then follows

It is known that ERM may suffer from overfitting, particularly when the sample size is small or when the model capacity is large. When this occurs, although the loss value ℓ(f(x), y) is low on each training point (x, y) ∈ D, the loss value ℓ(f(x), y) may still be high on the unseen data point (x, y).

In [Chapelle et al., 2001], a Vicinal Risk Minimization (VRM) framework is proposed, where the empirical distribution ˜ p in (3) is replaced with a "vicinal distribution" ̂ p, giving rise to the training objective

Specifically, the authors of [Chapelle et al., 2001] advocate a particular form of the vicinal distribution, ̂ pCWBV ("CWBV" are initials of the authors of [Chapelle et al., 2001]), using a spherical Gaussian kernel function N(x - xi, σ2 I) in place of each Dirac measure δxi :

This approach corresponds to adding a spherical Gaussian noise to the training example xi and, as shown in [Chapelle et al., 2001] that it gives rise to various regularization schemes, such as Ridge Regression, Constrained logistic classifier and Tangent-Prop.

In this paper, we argue that the effectiveness of VRM can be explained by the fact that the vicinal distribution ̂ p covers regions of X ×Y beyond the support of the empirical distribution ˜ p (i.e., the training points). This presents opportunities for the learned model to generalize better on unseen data. Indeed, beyond the original proposal of [Chapelle et al., 2001], more recent regularization schemes may also be viewed as VRM with a special choice of vicinal distribution.

3.1 Label Smoothing as VRM

We will use ⃗1,⃗2, . . . , ⃗K to denote respectively the one-hot vector representations of labels 1, 2, . . . ,K. For any label k ∈ {1, 2, . . . ,K}, we define the smoothed soft-label distribution πk on Y as

Now define the vicinal distribution ̂ pLS on X × Y by

Under this vicinal distribution, the minimization objective in VRM for label smoothing becomes

where ̂ yi is the K-dimensional probability vector that puts probability 1 - ϵ to the label represented by yi and puts probability ϵ K-1 to each of the remaining labels. We note that the final equality above follows from the fact that the crossentropy loss ℓ is linear in its second argument. It can be verified that the expression in (8) is precisely the loss function minimized in label smoothing [Szegedy et al., 2016]. Thus we have proved the following lemma.

Lemma 1. Label smoothing is a special case of VRM, the minimization objective of which is specified in the form of (8).

To the best of our knowledge, this connection between label smoothing and VRM as suggested in the lemma is reported for the first time.

3.2 MixUp as VRM

MixUp may also be viewed as VRM with a particular choice of vicinal distribution. This has been shown in [Zhang et al., 2018], which we now recapitulate.

For the convenience of notation, for any two vectors s and s′ having the same length and any scalar λ ∈ [0, 1], we denote

For any given pair (x, y) ∈ X × Y, if we draw a random variable pair (X′ , Y ′ ) from ˜ p and draw a random variable Λ from a beta distribution Beta(α, α) for some prescribed α, then M(x,X′ ;Λ) and M(y, Y ′ ;Λ) are a pair of random variables, and we will use q(·|x, y) to denote their joint distribution. Note that for any given (x, y) ∈ X ×Y, q(·|x, y) is a distribution over X × Y. Now we define a vicinal distribution ̂ pMixUp as follows: for any (x, y) ∈ X ×Y

Then under VRM, the minimization objective is ̂ LMixUp

Now it is easy to see that MixUp essentially takes a stochastic approximation of loss ̂ LMixUp by sampling a finite number of λ values and uses a mini-batch SGD to minimize such an approximated loss.

At this end, we have shown that the formulation of VRM unifies various effective regularization schemes. The following observations are particularly remarkable. In the original VRM schemes where the vicinal distribution is chosen as ̂ pCWBV, the extension of the training points D is only on the X dimension; namely, each training example xi is perturbed while preserving its label. In label smoothing, the vicinal distribution ̂ pLS extends D only along the Y dimension, namely, the location of each xi is kept but its training label yi is "smeared". In MixUp, the extension of the training points D by the vicinal distribution ̂ pMixUp is on both the X dimension and the Y dimension. This unique feature of MixUp, which exploits the freedom in the joint space X × Y for moving a training point, is arguably critically attributed to its superior performance relative to other regularization schemes.

We now develop a new regularization scheme that is principled by VRM and exploits the joint space X × Y like MixUp. But unlike MixUp, this scheme is not only designed for regularization but also serve an adversarial training purpose for the "robust regularization" objective.

4 Adversarial Labelling of Perturbed Samples

Let ˜ pX be the marginal of the empirical distribution ˜ p on X . For any y ∈ Y and small scalar ϵ > 0, we use B(y; ϵ) to denote the L1-ball in Y having radius ϵ and centred at y. We will use Vol (B(y; ϵ)) to denote the volume of B(y; ϵ).

For any given (x, y) ∈ X × Y, consider the following process of constructing a distribution γ(·|x, y) on X ×Y. First draw random variable X′ from the marginal distribution ˜ pX , and draw random variable Λ from Beta distribution Beta(α, β). Then create a pair (̂ X, ̂ Y ) of random variables as follows.

where ∆ is uniformly distributed in ball B(0; ϵ). In our implementation, we set the mode of Beta distribution α-1 α+β-2 to a value close to 1. Denote the joint distribution of (̂ X, ̂ Y ) by γ(·|x, y), and define ALPS vicinal distribution ̂ pALPS as follows: for each (x, y) ∈ X × Y,

Under this vicinal distribution, the minimization objective of VRM is

Note that in (14), we turn to an upper bound JALPS of the desired minimization objective ̂ LALPS. This is because it is in general intractable to compute the integral of the loss over the ball B(yi; ϵ). But turning the VRM formulation to minimizing the upper bound JALPS may be well justified as follows.

First, when the radius ϵ is small, the upper bound is expected to be quite tight. Second, even when the bound is not sufficiently tight, minimizing JALPS to a sufficiently small value, say η, necessarily drives the true objective ̂ LALPS to a value no larger than η. Finally, using the upper bound as the minimization objective renders the training process an "adversarial" flavour, and one expects some level of adversarial robustness may be obtained from such minimization.

To minimize JALPS, one can approximate the expectation over λ by its stochastic approximation, and minimizing the double sum can be carried out efficiently using a mini-batch SGD (just as that in MixUp). Concerning the inner maximization, there is an elegant property as shown below.

Theorem 1. For an arbitrary training example (x, y) ∈ D. Let ˜x be a perturbed version of x, and k∗ be the least likely label assignment according to the predictive distribution f(˜x).

Proof. Obviously, for ∀˜ y ∈ B(y; ϵ), there always ∃ϵ′ satisfy ϵ′ ≤ ϵ and ‖˜ y - y‖1 = ϵ′ . Without loss of the generality, assuming that y = ⃗k, it can then be verified that ˜ y[k] = 1- ϵ′ 2 . Then it is possible to show:

If we continue to slacken the L1-ball radius ϵ′ until ϵ, ℓ(f (˜x), ˜ y) will reach its supremum.

this suggests that ˜ y = ρ(˜x, y) is the maximizer of ℓ(f(˜x), ˜ y) given the perturbed example ˜x.

The theorem suggests that the inner maximization in (14) has the "adversarial label" ρ(˜x, y) as its closed-form solution. Note that ρ(˜x, y) is merely the label distribution obtained by shifting probability ϵ/2 from the ground-truth label to the least likely label. The minimizing JALPS reduces to

where the above stochastic approximation uses one batch S of training example pairs, and for example pair (xi, xj), we have used ˜xij to denote the mix M(xi, xj; λij) with λij drawn from Beta(α, β). The gradient signal of this approximation can then be used to update the model parameters as usual.

Algorithm 1 ALPS Regularized Training

Require: The training set D = {(xi, yi)}ni=1 , the neural network f(·), the number of epochs E, the hyper-parameters of beta distribution α, β, and the radius ϵ of permitted perturbation over label space Y

• 1: for e = 1 to E do
• 2: for i = 1 to n do
• 3: Sample x′ ∼ D uniformly, sample λ ∼ Beta(α, β);
• 4: Let ˜x = M(xi, x′ ; λ);
• 5: Get the least likely label k∗ predicted fromf(˜x), and assign ρ = (1 - ϵ2 )yi + ϵ2 ⃗ k∗ ;
• 6: Use the vicinal sample (˜x, ρ) to compute the loss gradient and update the parameters;
• 7: end for
• 8: end for

Remarks on ALPS's robust regularization effects. Note that an overfitted model tends to carve its class boundaries too close to the training examples, and its corresponding loss landscape tends to change sharply near the training points. This is mitigated in ALPS by training the model with synthetic data points that have moved away from the data manifold in the joint input-label space. This aspect is similar to MixUp. On the other hand, the movement in the label space is designed in an adversarial manner, namely, towards the direction of increasing the loss. This aspect is similar to adversarial training. Thus ALPS is expected to work both as a data-dependent regularization scheme and as an adversarial training scheme.

5 Experiments

Here we experimentally compare the regularization performance of ALPS with other popular regularization schemes. Adversarial robustness of the trained models is also evaluated and compared. We select several popular regularization schemes, including Dropout, Label smoothing, MixUp, and vanilla ERM as baselines to compare with ALPS. Weight decay is applied to all schemes.

5.1 Experimental Setup

Four publicly available benchmark datasets are used. The SVHN dataset has 10 classes for the digit numbers, and 73257 training digits, 26032 test digits. The CIFAR-10 and CIFAR100 dataset have the same image set but different label strategy. CIFAR-10 has 10 classes containing 6000 images each, and CIFAR-100 has 100 classes containing 600 images each. The two datasets are split with 5:1 for training and testing per class. The Tiny-ImageNet dataset has 200 classes. Each class has 500 training images, 50 validation images, and 50 test images. Since the test set does not provide true labels, we take the validation set for testing.

Besides the vanilla empirical risk minimization (ERM), we select three regularization methods to compare with ALPS, i.e., Dropout, label smoothing, and MixUp. PreActResNet18 [He et al., 2016] and VGG16 [Simonyan and Zisserman, 2015] are employed as classification model architecture. In training processes, we adopt the geometrical transformation augmentation methods, random crops and horizontal flips. Normalization is performed on both training and test set with the mean and standard derivation computed on training set.

We follow the training procedure of [Zhang et al., 2018], where SGD with momentum optimizer is used with a stepwise learning rate decay. Weight decay factor is set to 10-4 . For Dropout, we randomly deactivate 50% of the neurons in the penultimate layer at each iteration. The label smoothing ratio is set to 0.1. The Beta hyper-parameter of MixUp α is set to 1. For ALPS, the mode of asymmetric Beta distribution is chosen in the range (0.75, 1), and the L1 ball constraint ϵ in adversarial labelling is restricted to (0, 0.5) empirically.

5.2 Regularization Performance

On SVHN, CIFAR-10 and CIFAR-100 datasets, top-1 test error is used to measure the generalization ability of PreActResNet18 and VGG16 networks trained with the compared regularization schemes. The corresponding results are reported in Table 1, Table 2, and Table 3 respectively. ALPS outperforms other baselines generally. On average, ALPS trained the two models' top-1 error are improved by about 1% on SVHN, 2% on CIFAR-10, and 3.5% on CIFAR-100 respectively, in contrast to ERM baseline. The performance of MixUp is close with and slightly worse than that of ALPS. On the Tiny-ImageNet, top-1 and top-5 errors are used to measure regularization performance. The results are summarized in Table 4. We also find that ALPS achieves the best performance compared with all other baseline methods. Especially for PreActResNet18 model, the performance of ALPS is higher than the competitive MixUp method, and gains an increase of 0.8% in both top-1 and top-5 error compared with it. These results confirm that ALPS is a state-of-art regularization scheme.

5.3 Robustness to Adversarial Attacks

Training a model with out-of-manifold samples as well as label adversaries, ALPS is expected to substantially improved the adversarial robustness of the trained model. To validate this, we consider the off-the-shelf Fast Gradient Sign Method (FGSM) [Goodfellow et al., 2015] and Projected Gradient Decent method (PGD) [Madry et al., 2018], to construct adversarial examples. Then, we train the PreActResNet18 model with ALPS and all the baseline methods, and evaluate the robustness against the two kinds of attacks in both white-box and black-box settings.

For the setting of white-box adversarial attacks, we use the trained models themselves to generate attack samples. The top-1 test error is also adopted as the evaluation metric. The observed best and second-best performances are marked with bold font and underline respectively. Table 5 (left) lists the FGSM attack experiment results with perturbation radius ϵ = 4 for each pixel. It can be observed that ALPS generally outperforms other regularization baselines, with the gaps of 3.43% on the SVHN dataset, 3.38% on the CIFAR-10 dataset, 6.33% on the CIFAR-100 dataset, and 2.50% on the TinyImageNet dataset compared with the correspondingly secondbest schemes. In Table 6 (left), ALPS also manifests superior performance in defending against the 10-step PGD white-box attacks with the steps size set to 1 and perturbation radius ϵ = 4. ALPS is seen to dominate in all other experiment settings except in CIFAR-10 where ALPS appears weaker than Label Smoothing baseline with a gap 1.77%. It is interesting to note that Dropout and label smoothing appear to perform well with respect to defending both FGSM and PGD whitebox adversarial attacks. On the other hand, MixUp appears quite weak against PGD attacks, and this weakness is seen nicely cured in ALPS, arguably attributed to the adversarial labelling in ALPS.

For the black-box adversarial attack setting, we firstly train a model with ERM to generate a set of adversarial examples. Then we measure the adversarial robustness of the other methods on the set of adversarial examples. Table 5 (right) and Table 6 (right) summaries the evaluation results for FGSM and PGD respectively. Similarly to white-box attacks, ALPS outperforms all other baselines. It is worth mentioning that the models trained with MixUp also achieves significant improvement on all three datasets. In addition, the Dropout and label smoothing methods are relatively not much effective to black-box attacks in contrast to the competitive performances in the white-box attack experiments.

Sanity Check for Adversarial Attacks. The issue known as "gradient masking" [Athalye et al., 2018] may lead to false sense of adversarial robustness owing to the inferior quality of the gradients, e.g., shattered gradients, vanishing gradients. To validate this, we further conduct unbounded PGD sanity check as [Verma et al., 2019]. We take our trained models with MixUp and ALPS on the four datasets, and run PGD for 200 iterations with a step size 0.01. The unbounded PGD attack reduced the ALPS's accuracy to 0.22% on SVHN dataset and reduce the accuracy of other seven cases to 0%. This suggests that there are no obvious obfuscated gradients in our robustness measurement.

6 Conclusion

In this paper, we suggest VRM as a general principle for regularization. Under this perspective, MixUp appears to have a combined advantage of label smoothing and the traditional VRM schemes. Using an approach similar to MixUp, we construct another vicinal joint distribution of synthetic samples and their adversarial labels. Through minimizing the upper bound of the VRM loss, this formulation gives rise to a novel regularization scheme, ALPS. We show that ALPS not only demonstrates a state-of-the-art regularization performance, it also provides the trained model with strong adversarial robustness. This paper appears to be the first work that develops a strong regularization scheme while also explicitly aiming at adversarial robustness. We hope that further research will be inspired towards this "robust regularization" objective.

Acknowledgements

This work is supported partly by the National Natural Science Foundation of China (No. 61772059), by the Fundamental Research Funds for the Central Universities, by the Beijing S&T Committee (No. Z191100008619007), by National Key Research and Development Program (2018YFB1306000), by the Beijing Advanced Innovation Center for Big Data and Brain Computing and by State Key Laboratory of Software Development Environment (No. SKLSDE-2020ZX-14).