TRADES (TRadeoff-inspired Adversarial DEfense via Surrogate-loss minimization)

This is the official code for the ICML'19 paper "Theoretically Principled Trade-off between Robustness and Accuracy" by Hongyang Zhang (CMU, TTIC), Yaodong Yu (University of Virginia), Jiantao Jiao (UC Berkeley), Eric P. Xing (CMU & Petuum Inc.), Laurent El Ghaoui (UC Berkeley), and Michael I. Jordan (UC Berkeley).

The methodology is the first-place winner of the NeurIPS 2018 Adversarial Vision Challenge (Robust Model Track).

The attack method transferred from TRADES robust model is the first-place winner of the NeurIPS 2018 Adversarial Vision Challenge (Targeted Attack Track).

Prerequisites

Python (3.6.4)
Pytorch (0.4.1)
CUDA
numpy

Install

We suggest to install the dependencies using Anaconda or Miniconda. Here is an exemplary command:

$ wget https://repo.anaconda.com/archive/Anaconda3-5.1.0-Linux-x86_64.sh
$ bash Anaconda3-5.1.0-Linux-x86_64.sh
$ source ~/.bashrc
$ conda install pytorch=0.4.1

TRADES: A New Loss Function for Adversarial Training

What is TRADES?

TRADES minimizes a regularized surrogate loss L(.,.) (e.g., the cross-entropy loss) for adversarial training: $\min_f\mathbb{E}\left\{\mathcal{L}(f(X),Y)+\beta\max_{X'\in\mathbb{B}(X,\epsilon)}\mathcal{L}(f(X),f(X'))\right\}.$

Important: the surrogate loss L(.,.) in the second term should be classification-calibrated according to our theory, in contrast to the L2 loss used in Adversarial Logit Pairing.

The first term encourages the natural error to be optimized by minimizing the "difference" between f(X) and Y , while the second regularization term encourages the output to be smooth, that is, it pushes the decision boundary of classifier away from the sample instances via minimizing the "difference" between the prediction of natural example f(X) and that of adversarial example f(X′). The tuning parameter β plays a critical role on balancing the importance of natural and robust errors.

<img src="images/grid.png" width="450"\> Left figure: decision boundary by natural training. Right figure: decision boundary by TRADES.

How to use TRADES to train robust models?

Natural training:

def train(args, model, device, train_loader, optimizer, epoch):
    model.train()
    for batch_idx, (data, target) in enumerate(train_loader):
        data, target = data.to(device), target.to(device)
        optimizer.zero_grad()
        loss = F.cross_entropy(model(data), target)
        loss.backward()
        optimizer.step()

Adversarial training by TRADES:

To apply TRADES, cd into the directory, put 'trades.py' to the directory. Replace F.cross_entropy() above with trades_loss():

from trades import trades_loss

def train(args, model, device, train_loader, optimizer, epoch):
    model.train()
    for batch_idx, (data, target) in enumerate(train_loader):
        data, target = data.to(device), target.to(device)
        optimizer.zero_grad()
        # calculate robust loss - TRADES loss
        loss = trades_loss(model=model,
                           x_natural=data,
                           y=target,
                           optimizer=optimizer,
                           step_size=args.step_size,
                           epsilon=args.epsilon,
                           perturb_steps=args.num_steps,
                           beta=args.beta,
			   distance='l_inf')
        loss.backward()
        optimizer.step()

Arguments:

step_size: step size for perturbation
epsilon: limit on the perturbation size
num_steps: number of perturbation iterations for projected gradient descent (PGD)
beta: trade-off regularization parameter
distance: type of perturbation distance, 'l_inf' or 'l_2'

The trade-off regularization parameter beta can be set in [1, 10]. Larger beta leads to more robust and less accurate models.

Basic MNIST example (adversarial training by TRADES):

python mnist_example_trades.py

We adapt main.py in [link] to our new loss trades_loss() during training.

Running demos

Adversarial training:

Train WideResNet-34-10 model on CIFAR10:

  $ python train_trades_cifar10.py

Train CNN model (four convolutional layers + three fully-connected layers) on MNIST:

  $ python train_trades_mnist.py

Train CNN model (two convolutional layers + two fully-connected layers) on MNIST (digits '1' and '3') for binary classification problem:

  $ python train_trades_mnist_binary.py

Robustness evaluation:

Evaluate robust WideResNet-34-10 model on CIFAR10 by FGSM-20 attack:

  $ python pgd_attack_cifar10.py

Evaluate robust CNN model on MNIST by FGSM-40 attack:

  $ python pgd_attack_mnist.py

Experimental results

Results in the NeurIPS 2018 Adversarial Vision Challenge [link]

TRADES won the 1st place out of 1,995 submissions in the NeurIPS 2018 Adversarial Vision Challenge (Robust Model Track) on the Tiny ImageNet dataset, surpassing the runner-up approach by 11.41% in terms of L2 perturbation distance.

<img src="images/NeurIPS.png" width="450"\> Top-6 results (out of 1,995 submissions) in the NeurIPS 2018 Adversarial Vision Challenge (Robust Model Track). The vertical axis represents the mean L2 perturbation distance that makes robust models fail to output correct labels.

Certified robustness [code]

TRADES + Random Smoothing achieves SOTA certified robustness in $\ell_\infty$ norm at radius 2/255.

Results on certified $\ell_\infty$ robustness at radius 2/255 on CIFAR-10:

| Method | Robust Accuracy | Natural Accuracy | |-----------------------|-----------------------|------------------| | TRADES + Random Smoothing | 62.6% | 78.7% | | Salman et al. (2019) | 60.8% | 82.1% | | Zhang et al. (2020) | 54.0% | 72.0% | | Wong et al. (2018) | 53.9% | 68.3% | | Mirman et al. (2018) | 52.2% | 62.0% | | Gowal et al. (2018) | 50.0% | 70.2% | | Xiao et al. (2019) | 45.9% | 61.1% |

Want to attack TRADES? No problem!

TRADES is a new baseline method for adversarial defenses. We welcome various attack methods to attack our defense models. We provide checkpoints of our robust models on MNIST dataset and CIFAR dataset. On both datasets, we normalize all the images to [0, 1].

How to download our CNN checkpoint for MNIST and WRN-34-10 checkpoint for CIFAR10?

cd TRADES
mkdir checkpoints
cd checkpoints

Then download our pre-trained model

[download link] (CIFAR10)

[download link] (MNIST)

and put them into the folder "checkpoints".

How to download MNIST dataset and CIFAR10 dataset?

cd TRADES
mkdir data_attack
cd data_attack

Then download the MNIST and CIFAR10 datasets

[download link] (CIFAR10_X)

[download link] (CIFAR10_Y)

[download link] (MNIST_X)

[download link] (MNIST_Y)

and put them into the folder "data_attack".

About the datasets

All the images in both datasets are normalized to [0, 1].

cifar10_X.npy -- a (10,000, 32, 32, 3) numpy array
cifar10_Y.npy -- a (10,000, ) numpy array
mnist_X.npy -- a (10,000, 28, 28) numpy array
mnist_Y.npy -- a (10,000, ) numpy array

Load our CNN model for MNIST

from models.small_cnn import SmallCNN

device = torch.device("cuda")
model = SmallCNN().to(device)
model.load_state_dict(torch.load('./checkpoints/model_mnist_smallcnn.pt'))

For our model model_mnist_smallcnn.pt, the limit on the perturbation size is epsilon=0.3 (L_infinity perturbation distance).

White-box leaderboard

|Rank | Attack | Submitted by | Natural Accuracy | Robust Accuracy | Time | |-----------------------|-----------------------|-----------------------|------------------|-----------------|-----------------| |1| ITA | Hong Lei | 99.48% | 92.46% | Aug 27, 2021 | |2| EWR-PGD | Ye Liu (second entry) | 99.48% | 92.47% | Dec 20, 2020 |3| EWR-PGD | Ye Liu | 99.48% | 92.52% | Sep 9, 2020 |4|Square Attack

TRADES

Install / Use

README