Argthtjtr

I am implementing adversarial training with the FGSM method from Explaining and Harnessing Adversarial Examples using the custom loss function:

Implemented in tf.keras using a custom loss function, it conceptually looks like this:

model = Sequential([

    ...

])



def loss(labels, logits):

    # Compute the cross-entropy on the legitimate examples

    cross_ent = tf.losses.softmax_cross_entropy(labels, logits)



    # Compute the adversarial examples

    gradients, = tf.gradients(cross_ent, model.input)

    inputs_adv = tf.stop_gradient(model.input + 0.3 * tf.sign(gradients))



    # Compute the cross-entropy on the adversarial examples

    logits_adv = model(inputs_adv)

    cross_ent_adv = tf.losses.softmax_cross_entropy(labels, logits_adv)



    return 0.5 * cross_ent + 0.5 * cross_ent_adv



model.compile(optimizer='adam', loss=loss)

model.fit(x_train, y_train, ...)

This works well for a simple convolutional neural network.

During the logits_adv = model(inputs_adv) call, the model is called for the second time. This means, that it will use different dropout masks than in the original feed-forward pass with model.inputs. The inputs_adv, however, were created with tf.gradients(cross_ent, model.input), i.e. with the dropout masks from the original feed-forward pass. This could be problematic, as allowing the model to use new dropout masks will likely dampen the effect of the adversarial batch.

Since implementing the reusing of dropout masks in Keras would be cumbersome, I am interested in the actual effect of reusing the masks. Does it make a difference w.r.t. the test accuracy on both legitimate and adversarial examples?

I tried out reusing the dropout masks during the adversarial training step's feed-forward pass with a simple CNN on MNIST. I chose the same network architecture as the one used in this cleverhans tutorial with an additional dropout layer before the softmax layer.

This is the result (red = reuse dropout masks, blue = naive implementation):

The solid lines represent the accuracy on legitimate test examples. The dotted lines represent the accuracy on adversarial examples generated on the test set.

In conclusion, if you only use adversarial training as a regularizer in order to improve the test accuracy itself, reusing dropout masks might not be worth the effort. For the robustness against adversarial attacks, however, it seems to make a difference.

To keep the figure above readable, I omitted the accuracy on adversarial test examples for the model trained without adversarial training. The values lay around 10%.

You can find the code for this experiment in this gist. With TensorFlow's eager mode, it was rather straightforward to implement storing and reusing the dropout masks.