Adversarial Detection methods

文章目录

Kernel Density (KD)
Local Intrinsic Dimensionality (LID)
Gaussian Discriminant Analysis (GDA)
Gaussian Mixture Model (GMM)
SelectiveNet
Combined Abstention Robustness Learning (CARL)
- Adversarial Training with a Rejection Option
Energy-based Out-of-distribution Detection
Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks (CCAT)

Kernel Density (KD)

Feinman R., Curtin R. R., Shintre S. and Gardner A. B. Detecting Adversarial Samples from Artifacts. arXiv preprint arXiv:1703.00410, 2017.

原文代码

作者认为普通样本的特征和对抗样本的特征位于不同的流形中, 故可以通过密度估计的方法, 估计出普通样本的密度函数, 然后求得样本各自的置信度, 选择合适的阈值(通过ROC-AUC之类的), 便有了区分普通样本和对抗样本的方法.

假设
z = h ( x ) ∈ R d . z = h(x) \in \mathbb{R}^d. z=h(x)∈Rd.
为将样本 x x x提取为特征 z z z

选取合适的样本数目 x 1 , ⋯ , x N x_1, \cdots, x_N x1,⋯,xN;
提取特征 z 1 , ⋯ , z N z_1, \cdots, z_N z1,⋯,zN;
构建核密度估计函数:
f ^ ( x ) = 1 N ∑ i = 1 N k σ ( z i , h ( x ) ) , k σ ( z , z ′ ) = 1 ( 2 π ) d 2 σ d exp ⁡ ( − ∥ z ′ − z ∥ 2 2 σ 2 ) . \hat{f}(x) = \frac{1}{N} \sum_{i=1}^N k_{\sigma}(z_i, h(x)), \\ k_{\sigma}(z, z') = \frac{1}{(2\pi)^{\frac{d}{2}}\sigma^d}\exp (-\frac{\|z' - z\|^2}{2\sigma^2}). f^(x)=N1i=1∑Nkσ(zi,h(x)),kσ(z,z′)=(2π)2dσd1exp(−2σ2∥z′−z∥2).

选择合适的阈值 t t t, 对于样本 x x x, 判定其为对抗样本, 若 f ^ ( x ) < t \hat{f}(x) < t f^(x)<t.

有些时候, 可以对每一类构建一个 f ^ ( x ) \hat{f}(x) f^(x), 但这个情况也就只能用在ROC-AUC了.

Local Intrinsic Dimensionality (LID)

LID

Gaussian Discriminant Analysis (GDA)

Lee K., Lee K., Lee H. and Shin J. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Advances in Neural Information Processing Systems (NIPS), 2018.

原文代码

作者假设特征 z = h ( x ) z=h(x) z=h(x)(所属类别为 c c c)满足后验分布:
z ∣ y = c ∼ N ( μ c , Σ ) , z|y=c \sim \mathcal{N}(\mu_c, \Sigma), z∣y=c∼N(μc,Σ),
即
p ( h ( x ) ∣ y = c ) = N ( h ( x ) ∣ μ c , Σ ) , p(h(x)|y=c) = \mathcal{N}(h(x)|\mu_c, \Sigma), p(h(x)∣y=c)=N(h(x)∣μc,Σ),
注意到对于不同的 c c c, 协方差矩阵 Σ \Sigma Σ是一致的(这个假设是为了便于直接用于分类, 但是与detection无关, 便不多赘述).

均值和协方差矩阵通过如下方式估计:
μ ^ c = 1 N c ∑ i : y i = c h ( x i ) , Σ ^ = 1 N ∑ c ∑ i : y i = c ( h ( x i ) − μ ^ c ) ( h ( x i ) − μ ^ c ) T . \hat{\mu}_c = \frac{1}{N_c} \sum_{i:y_i=c}h(x_i), \: \widehat{\Sigma} = \frac{1}{N}\sum_c \sum_{i:y_i=c}(h(x_i) - \hat{\mu}_c) (h(x_i) - \hat{\mu}_c)^T. μ^c=Nc1i:yi=c∑h(xi),Σ =N1c∑i:yi=c∑(h(xi)−μ^c)(h(xi)−μ^c)T.

故可以用
f ^ ( x ) : = max ⁡ c N ( h ( x ) ∣ μ ^ c , Σ ^ ) , \hat{f}(x) := \max_c \mathcal{N}(h(x)| \hat{\mu}_c, \widehat{\Sigma}), f^(x):=cmaxN(h(x)∣μ^c,Σ ),
来区分 x x x是否为abnormal的样本(对抗的或者偏离训练分布的样本).

在文中用的是log化(且去掉比例系数)的指标:
M ( x ) = max ⁡ c − ( h ( x ) − μ ^ c ) T Σ ^ ( h ( x ) − μ ^ c ) . M(x) = \max_c -(h(x) - \hat{\mu}_c)^T \widehat{\Sigma}(h(x) - \hat{\mu}_c). M(x)=cmax−(h(x)−μ^c)TΣ (h(x)−μ^c).

改方法可以进一步拓展(实际上光用这个指标看实验结果似乎并不理想):

Input pre-processing:

对于输入的样本进行如下变换:
x ^ = x + ϵ s i g n ( ∇ x M ( x ) ) . \hat{x} = x + \epsilon \mathrm{sign}(\nabla_x M(x)). x^=x+ϵsign(∇xM(x)).
有点像fgsm生成对抗样本, 但感觉这么做的原因是让 f ^ ( x ) \hat{f}(x) f^(x)之间的区别大一点.

Feature ensemble:

即对不同层的特征 h l ( x ) h_l(x) hl(x)都进行如上的操作, 然后得到 f ^ 1 , ⋯ , f ^ L \hat{f}_1, \cdots, \hat{f}_L f^1,⋯,f^L, 并通过SVM来训练得到权重 α l \alpha_l αl, 最后的score为
∑ l α f ^ l ( x ) . \sum_l \alpha \hat{f}_l(x). l∑αf^l(x).

注: 文中实际为 M l ( x ) M_l(x) Ml(x).

Gaussian Mixture Model (GMM)

Zheng Z. and Hong P. Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks. In Advances in Neural Information Processing Systems (NIPS), 2018.

类似的, 对于特征 z = h ( x ) z=h(x) z=h(x), 假设其服从GMM:
p ( h ( x ) ∣ y = c ; θ ) = ∑ k = 1 K w i N ( h ( x ) ∣ μ c k , Σ c k ) , p(h(x)|y=c;\theta) = \sum_{k=1}^K w_i \mathcal{N}(h(x)|\mu_{ck}, \Sigma_{ck}), p(h(x)∣y=c;θ)=k=1∑KwiN(h(x)∣μck,Σck),
并用EM算法来估计.

注: 对每一个类别都需要估计一个GMM模型.

于是
f ^ c ( x ) = p ( h ( x ) ∣ y = c ; θ ) , \hat{f}_c(x) = p(h(x)|y=c;\theta), f^c(x)=p(h(x)∣y=c;θ),
当其小于给定的threshold的时候, 便认为其不属于类别 c c c.

问: 所以当所有的 c c c都被拒绝的时候, 就可以认为是对抗样本了?

SelectiveNet

Geilman Y., El-Yaniv R. SelectiveNet: A deep neural network with an integrated reject option. In International Conference on Machine Learning (ICML), 2019.

原文代码

本文的模型解释起来有点复杂, 在一个普通的判别网络 f f f的基础上:
( f , g ) ( x ) : = { f ( x ) if g ( x ) = 1 , don’t know if g ( x ) = 0. (f, g)(x) := \left \{ \begin{array}{ll} f(x) & \text{if } g(x) = 1, \\ \text{don't know} & \text{if } g(x) = 0. \end{array} \right . (f,g)(x):={f(x)don’t knowif g(x)=1,if g(x)=0.
其中 g g g是一个用来选择是否判断的模块.
作者给出了两个指标:

Coverage:
ϕ ( g ) : = E P [ g ( x ) ] , \phi(g) := E_P [g(x)], ϕ(g):=EP[g(x)],
以及
Selective Risk:
R ( f , g ) : = E P [ ℓ ( f ( x ) , y ) g ( x ) ] ϕ ( g ) . R(f, g) := \frac{E_P[\ell(f(x), y) g(x)]}{\phi(g)}. R(f,g):=ϕ(g)EP[ℓ(f(x),y)g(x)].
Coverage不能太低, 因为如果全部拒绝判断模型就没有意义了, 然后 R ( f , g ) R(f, g) R(f,g)自然是越低越好, 但是注意到, 虽然一味拒绝回答能够使得分子接近0, 但是分母也会接近0, 所以需要一个平衡.
二者的经验估计如下:
r ^ ( f , g ∣ S N ) : = 1 N ∑ i = 1 N ℓ ( f ( x i ) , y i ) g ( x i ) ϕ ( g ∣ S N ) , ϕ ( g ∣ S N ) : = 1 N ∑ i = 1 N g ( x i ) . \hat{r}(f,g|S_N) := \frac{\frac{1}{N}\sum_{i=1}^N \ell(f(x_i), y_i)g(x_i)}{\phi(g|S_N)}, \\ \phi(g|S_N):= \frac{1}{N}\sum_{i=1}^N g(x_i). r^(f,g∣SN):=ϕ(g∣SN)N1∑i=1Nℓ(f(xi),yi)g(xi),ϕ(g∣SN):=N1i=1∑Ng(xi).

注: 在实际使用中, g g g的取值往往在 [ 0 , 1 ] [0, 1] [0,1]间, 此时可以选取threshold t来选择是否判断.

作者设计了一个结构如下:

其中:
Prediction: f f f;
Selection: g g g;
Auxiliary: h h h, 作者说此为别的任务来帮助训练的.

最后的损失:
L = α L ( f , g ) + ( 1 − α ) L h L ( f , g ) = r ^ ℓ ( f , g ∣ S N ) + λ Ψ ( c − ϕ ^ ( g ∣ S N ) ) Ψ ( a ) = max ⁡ ( 0 , a ) 2 L h = r ^ ( h ∣ S N ) = 1 N ∑ i = 1 N ℓ ( h ( x i ) , y i ) . \mathcal{L} = \alpha \mathcal{L}_{(f, g)} + (1 - \alpha) \mathcal{L}_h \\ \mathcal{L}_{(f, g)} = \hat{r}_{\ell} (f, g|S_N) + \lambda \Psi(c - \hat{\phi}(g | S_N)) \\ \Psi(a) = \max(0, a)^2 \\ \mathcal{L}_h = \hat{r}(h|S_N) = \frac{1}{N}\sum_{i=1}^N \ell (h(x_i), y_i). L=αL(f,g)+(1−α)LhL(f,g)=r^ℓ(f,g∣SN)+λΨ(c−ϕ^(g∣SN))Ψ(a)=max(0,a)2Lh=r^(h∣SN)=N1i=1∑Nℓ(h(xi),yi).

Combined Abstention Robustness Learning (CARL)

Laidlaw C., Feizi S. Playing it safe: adversarial robustness with an abstain option. arXiv preprint arXiv:1911.11253, 2019.

原文代码

假设 f f f将样本 x x x映射为 Y ⋃ { a } \mathcal{Y} \bigcup \{a\} Y⋃{a}, 其中 a a a表示弃权(don’t know).

则我们可以定义:
R n a t ( f ) : = E ( x , y ) ∼ D 1 { f ( x ) ≠ y } R a d v ( f ) : = E ( x , y ) ∼ D max ⁡ x ~ ∈ B ϵ ( x ) 1 { f ( x ~ ≠ y and f ( x ~ ) ≠ a } . \mathcal{R}_{nat} (f) := \mathbb{E}_{(x, y) \sim \mathcal{D}} \mathbf{1}\{f(x) \not = y\} \\ \mathcal{R}_{adv}(f) := \mathbb{E}_{(x, y) \sim \mathcal{D}} \max_{\tilde{x} \in \mathcal{B}_{\epsilon}(x)} \mathbf{1}\{f(\tilde{x} \not = y \text{ and } f(\tilde{x}) \not = a\}. Rnat(f):=E(x,y)∼D1{f(x)=y}Radv(f):=E(x,y)∼Dx~∈Bϵ(x)max1{f(x~=y and f(x~)=a}.

很自然的, 我们可以通过优化下列损失
R ( f ) = R n a t ( f ) + c R a d v ( f ) , \mathcal{R}(f) = \mathcal{R}_{nat}(f) + c \mathcal{R}_{adv}(f), R(f)=Rnat(f)+cRadv(f),
来获得一个带有弃权功能的判别器. 并且通过权重 c c c我们可以选择更好的natural精度或者更保守但更加安全的策略.

直接优化上面的损失是困难的, 故选择损失来替换. 作者采用普通的交叉熵损失来代替nat:
L n a t ( f ) = E ( x , y ) ∼ D − log ⁡ p y ( x ) , \mathcal{L}_{nat}(f) = \mathbb{E}_{(x, y) \sim \mathcal{D}} -\log p_y(x), Lnat(f)=E(x,y)∼D−logpy(x),
用下列之一替代adv:
L a d v ( f ) E ( x , y ) ∼ D max ⁡ x ~ ∈ B ϵ ( x ) ℓ ( f , x ~ , y ) , ℓ = { ℓ ( 1 ) , ℓ ( 2 ) } ℓ ( 1 ) = − log ⁡ ( p y ( x ~ ) + p a ( x ~ ) ) ℓ ( 2 ) = ( − log ⁡ ( p y ( x ~ ) ) ⋅ ( − log ⁡ p a ( x ~ ) ) \mathcal{L}_{adv}(f) \mathbb{E}_{(x, y) \sim \mathcal{D}} \max_{\tilde{x} \in \mathcal{B}_{\epsilon}(x)} \ell(f, \tilde{x}, y), \\ \ell = \{\ell^{(1)}, \ell^{(2)}\} \\ \ell^{(1)} = -\log (p_y (\tilde{x}) + p_a (\tilde{x})) \\ \ell^{(2)} = (-\log (p_y (\tilde{x})) \cdot (-\log p_a (\tilde{x})) \\ Ladv(f)E(x,y)∼Dx~∈Bϵ(x)maxℓ(f,x~,y),ℓ={ℓ(1),ℓ(2)}ℓ(1)=−log(py(x~)+pa(x~))ℓ(2)=(−log(py(x~))⋅(−logpa(x~))

Adversarial Training with a Rejection Option

Kato M., Cui Z., Fukuhara Y. ATRO: Adversarial training with a rejection option. arXiv preprint arXiv:2010.12905, 2020.

凸relax.

Energy-based Out-of-distribution Detection

Liu W., Wang X., Owens J. D., Li Y. Energy-based out-of-distribution detection. In Advances in Neural Information Processing Systems (NIPS), 2020.

普通的softmax分类网络可以从energy-based model的角度考虑:
p ( y ∣ x ) = e − E ( x , y ) / T ∫ y ′ e − E ( x , y ′ ) / T , E ( x , y ) = − f y ( x ) , p(y|x) = \frac{e^{-E(x, y) / T}}{\int_{y'}e^{-E(x, y') / T}},\\ E(x, y) = -f_y(x), \\ p(y∣x)=∫y′e−E(x,y′)/Te−E(x,y)/T,E(x,y)=−fy(x),
Helmholtz free energy:
E ( x ; f ) : = − T ⋅ log ⁡ ∫ y ′ e − E ( x , y ′ ) / T = − T ⋅ log ⁡ ∑ i K e f i ( x ) / T . E(x;f):=-T \cdot \log \int_{y'}e^{-E(x, y') / T} = -T \cdot \log \sum_{i}^K e^{f_i(x)}/T. E(x;f):=−T⋅log∫y′e−E(x,y′)/T=−T⋅logi∑Kefi(x)/T.

实际上, 通过 E ( x ; f ) E(x;f) E(x;f)我们可以构建 x x x的能量模型:
p ( x ) = e − E ( x ; f ) / T ∫ x e − E ( x ; f ) / T , p(x) = \frac{e^{-E(x;f)/T}}{\int_x e^{-E(x;f)/T}}, p(x)=∫xe−E(x;f)/Te−E(x;f)/T,
故我们可以通过 p ( x ) p(x) p(x)来判断一个样本是不是OOD的.

特别的, 由于对于所有的 x x x
Z = ∫ x e − E ( x ; f ) / T Z = \int_x e^{-E(x;f)/T} Z=∫xe−E(x;f)/T
都是一致的, 所以我们只需要比较
e − E ( x ; f ) / T e^{-E(x;f)/T} e−E(x;f)/T
的大小就可以了.

特别的, 作者指出为什么用 p ( y ∣ x ) p(y|x) p(y∣x)来作为判断是否OOD的依据不合适:
log ⁡ max ⁡ y p ( y ∣ x ) = log ⁡ max ⁡ y e f y ( x ) ∑ i e f i ( x ) = log ⁡ e f max ⁡ ( x ) ∑ i e f i ( x ) = E ( x ; f ( x ) − f max ⁡ ( x ) ) = E ( x ; f ) + f m a x ( x ) = − log ⁡ p ( x ) + f m a x ( x ) − log ⁡ Z ∝̸ − log ⁡ p ( x ) . \begin{array}{ll} \log \max_y p(y|x) &= \log \max_y \frac{e^{f_y(x)}}{\sum_i e^{f_i(x)}} \\ &= \log \frac{e^{f_{\max}(x)}}{\sum_i e^{f_i(x)}} \\ &= E(x;f(x) - f^{\max}(x)) \\ &= E(x;f) + f^{max}(x) \\ &= -\log p(x) + f^{max}(x) - \log Z \\ &\not\propto -\log p(x). \end{array} logmaxyp(y∣x)=logmaxy∑iefi(x)efy(x)=log∑iefi(x)efmax(x)=E(x;f(x)−fmax(x))=E(x;f)+fmax(x)=−logp(x)+fmax(x)−logZ∝−logp(x).

WOW!

Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks (CCAT)

Stutz D., Hein M. and Schiele B. Confidence-calibrated adversarial training: generalizing to unseen attacks. In International Conference on Machine Learning (ICML), 2020.

原文代码

假设 f ( x ) f(x) f(x)为预测的概率向量, CCAT通过如下算法优化:

输入: ( x 1 , y 1 ) , ⋯ , ( x B , y B ) (x_1, y_1), \cdots, (x_B, y_B) (x1,y1),⋯,(xB,yB);
将其中一半用于对抗训练, 一半用于普通训练:
min ⁡ ∑ b = 1 B / 2 L ( f ( x ~ b , y ~ b ) ) + ∑ b = B / 2 + 1 B L ( f ( x b ) , y b ) . \min \quad \sum_{b=1}^{B/2} \mathcal{L}(f(\tilde{x}_b, \tilde{y}_b)) + \sum_{b=B/2+1}^B \mathcal{L}(f(x_b), y_b). minb=1∑B/2L(f(x~b,y~b))+b=B/2+1∑BL(f(xb),yb).
其中
x ~ b = x b + δ b , y ~ b = λ ( δ b ) one_hot ( y b ) + ( 1 − λ ( δ b ) ) 1 K , δ b = arg ⁡ max ⁡ δ ∞ ≤ ϵ max ⁡ k ≠ y b f k ( x b + δ ) , λ ( δ b ) : = ( 1 − min ⁡ ( 1 , ∥ δ b ∥ ∞ ϵ ) ) ρ . \tilde{x}_b = x_b + \delta_b, \\ \tilde{y}_b = \lambda(\delta_b) \text{ one\_hot}(y_b) + (1 - \lambda(\delta_b)) \frac{1}{K}, \\ \delta_b = \mathop{\arg \max} \limits_{\delta_{\infty} \le \epsilon} \max_{k \not= y_b} f_k(x_b + \delta), \\ \lambda (\delta_b) := (1 - \min(1, \frac{\|\delta_b\|_{\infty}}{\epsilon}))^{\rho}. \\ x~b=xb+δb,y~b=λ(δb) one_hot(yb)+(1−λ(δb))K1,δb=δ∞≤ϵargmaxk=ybmaxfk(xb+δ),λ(δb):=(1−min(1,ϵ∥δb∥∞))ρ.

y ~ \tilde{y} y~是真实标签和均匀分布的一个凸组合, 这个还是挺有道理的.

最后, 倘若如果
max ⁡ k f k ( x ) , \max_k f_k(x), kmaxfk(x),
即置信度比较小的话, 拒绝判断(这个可靠的原因是目标函数让对抗样本趋于均匀分布).