This work concerns adversarial training against the small-norm adversarial examples that arise from the inherent input instability of a trained deep neural network. Examples in this class are small as measured in the relative ℓ2-norm, and therefore lie in the neighborhood of the input on which the model acts approximately linearly, the regime in which the perturbation remains imperceptible. We first show that such examples can be computed directly from the trained network parameters, without input gradient iterations, by means of a linearization called the low-rank Householder expansion (LRHE). The expansion describes the composed affine map rather than any individual layer, and the directions it identifies are read from the activation pattern already available in the forward pass. We then propose a simple adversarial training scheme built on this construction. No differentiation with respect to the input is performed at any point: training requires only additional forward evaluations, with weight parameters updated by the standard backward pass, and the inner maximization of the usual min-max formulation is eliminated entirely. That such a regularizer exists is our main finding: the methods that dispense with the inner search all obtain their local geometry by differentiating with respect to the input, and we show this is not necessary. The regularizer costs the equivalent of 2.8 PGD steps per epoch, an 8.7× reduction relative to 40-step adversarial training on MNIST and below the cost of 3-step training. The resulting models match three-step PGD adversarial training for relative ℓ2 budgets ε≤0.02 and 40-step training for ε≤0.012, falling away beyond, consistent with the locality of the expansion.
Figures & tables
Figure 1. Diagram of a forward pass that computes the output basis (ϕℓ)ℓ ( 3.5 ). The computation of the output basis involves additional partial forward passes that omit the nonlinearities. The output basis is then used in the regularization term R ( 3.12 ) to penalize large changes in the output logits in the direction of the output basis.
Figure 2. An illustration relating LRHE input basis to adversarial examples. The surface denotes the model logit output for the incorrect class, which increases quickly in one of the input-basis directions. In the linear regime, when the input is perturbed in the direction of ψ1 the logit changes in the direction of ϕ1 resulting in a misclassification.
Figure 3. A diagram of the CNN architecture used for the MNIST experiments (left). The feedforward form of the same architecture, where the max-pooling layers are converted into a ReLU network, is shown alongside (right). Four new ReLUs are added to the feedforward form, which implies additional output basis vectors ϕℓ will be computed.
Figure 4. Adversarial examples found for the standard CNN model using PGD with relative ℓ2 norm ε=0.1 .
α
Adv. acc.
0.5
99.04 (0.44)
1.0
98.84 (0.64)
1.5
98.70 (0.78)
2.0
98.16 (1.32)
2.5
97.90 (1.58)
3.0
96.45 (3.03)
Table 1. Adversarial accuracy of the clean model after LRHE basis attack for each step-size α ( 5.1 ). Difference from clean accuracy of 99.48% is in the parentheses.
Figure 5. LRHE basis attack results. Six adversarial examples found for varying step-size α . The original image and correctly predicted label is shown, alongside the perturbed input and the perturbation. The corresponding logit scores and the changes are also shown below the examples.
Figure 6. Orthogonal complement projection of adversarial examples leads to corrections. Original test image, the adversarial example, and the projected example are shown, along with the differences. Output logit scores and corresponding changes are also shown.
Figure 7. LRHE input and output bases for original and adversarially trained models. Top two examples are from the LRHE of the original model, and bottom two examples from the adversarially trained model.
Original
LRHE-AT
PGD-40-AT
PGD-3-AT
Test
99.48
99.53
99.46
99.43
ℓ2 -rel. adv.
ε=0.002
99.45 ( 0 0.03)
99.48 ( 0 0.05)
99.40 ( 0 0.06)
99.34 ( 0 0.09)
ε=0.004
99.42 ( 0 0.06)
99.40 ( 0 0.13)
99.36 ( 0 0.10)
99.31 ( 0 0.12)
ε=0.006
99.34 ( 0 0.14)
99.38 ( 0 0.15)
99.28 ( 0 0.18)
99.26 ( 0 0.17)
ε=0.008
99.25 ( 0 0.23)
99.31 ( 0 0.22)
99.25 ( 0 0.21)
99.25 ( 0 0.18)
ε=0.010
99.17 ( 0 0.31)
99.27 ( 0 0.26)
99.20 ( 0 0.26)
99.19 ( 0 0.24)
Table 2. Adversarial accuracy (percentage) under relative ℓ2 perturbations ( ∥δx∥2≤ε∥x∥2 ; with ∥x∥2≈9.2 on MNIST, ε=0.150 corresponds to an absolute radius ∥δx∥2 of ≈1.4 ) and under ℓ∞ perturbations. All defended models were trained at ε=0.075 in the relative ℓ2 norm; the ℓ∞ block therefore measures cross-norm transfer. Parenthesized values give accuracy lost relative to each model’s own clean accuracy.
LRHE-AT
Test accuracy
99.53
White-box adv. acc.
94.94 (4.59)
Transfer from second LRHE-AT model
97.28 (2.72)
Transfer from original model
98.47 (1.53)
Table 3. Black-box attack for the adversarially trained model. Adversarial accuracy (percentage) computed for ℓ2 -relative ε=0.075 .
PGD steps
1
2
5
10
20
40
Wall time (s)
7.8
10.6
18.8
32.3
58.0
110.5
Table 4. Wall time per epoch during PGD adversarial training. Batch size is 30. The wall time was measured using standard PyTorch implementation on NVIDIA GeForce RTX 3090 with 24GB of memory.