We study adversarial robustness of neural networks from a margin maximization perspective, where margins are defined as the distances from inputs to a classifier's decision boundary.
 Our study shows that maximizing margins can be achieved by minimizing the adversarial loss on the decision boundary at the "shortest successful perturbation", demonstrating a close connection between adversarial losses and the margins. We propose Max-Margin Adversarial (MMA) training to directly maximize the margins to achieve adversarial robustness. 
 Instead of adversarial training with a fixed $\epsilon$, MMA offers an improvement by enabling adaptive selection of the "correct" $\epsilon$ as the margin individually for each datapoint. In addition, we rigorously analyze adversarial training with the perspective of margin maximization, and provide an alternative interpretation for adversarial training, maximizing either a lower or an upper bound of the margins. Our experiments empirically confirm our theory and demonstrate MMA training's efficacy on the MNIST and CIFAR10 datasets w.r.t. $\ell_\infty$ and $\ell_2$ robustness. Figure 1: Illustration of decision boundary, margin, and shortest successful perturbation on application of an adversarial perturbation. Despite their impressive performance on various learning tasks, neural networks have been shown to be vulnerable to adversarial perturbations (Szegedy et al., 2013; Biggio et al., 2013 ). An artificially constructed imperceptible perturbation can cause a significant drop in the prediction accuracy of an otherwise accurate network. The level of distortion is measured by the magnitude of the perturbations (e.g. in ∞ or 2 norms), i.e. the distance from the original input to the perturbed input. Figure 1 shows an example, where the classifier changes its prediction from panda to bucket when the input is perturbed from the blue sample point to the red one. Figure 1 also shows the natural connection between adversarial robustness and the margins of the data points, where the margin is defined as the distance from a data point to the classifier's decision boundary. Intuitively, the margin of a data point is the minimum distance that x has to be perturbed to change the classifier's prediction. Thus, the larger the margin is, the farther the distance from the input to the decision boundary of the classifier is, the more robust the classifier is w.r.t. this input. Although naturally connected to adversarial robustness, "directly" maximizing margins has not yet been thoroughly studied in the adversarial robustness literature. Instead, the method of minimax adversarial training (Madry et al., 2017; Huang et al., 2015) is arguably the most common defense to adversarial perturbations due to its effectiveness and simplicity. Adversarial training attempts to minimize the maximum loss within a fixed sized neighborhood about the training data using projected gradient descent (PGD). Despite advancements made in recent years (Hendrycks et al., 2019; Zhang et al., 2019a; Shafahi et al., 2019; Zhang et al., 2019b; Stanforth et al., 2019; Carmon et al., 2019) , adversarial training still suffers from a fundamental problem, the perturbation length has to be set and is fixed throughout the training process. In general, the setting of is arbitrary, based on assumptions on whether perturbations within the defined ball are "imperceptible" or not. Recent work (Guo et al., 2018; Sharma et al., 2019) has demonstrated that these assumptions do not consistently hold true, commonly used settings assumed to only allow imperceptible perturbations in fact do not. If is set too small, the resulting models lack robustness, if too large, the resulting models lack in accuracy. Moreover, individual data points may have different intrinsic robustness, the variation in ambiguity in collected data is highly diverse, and fixing one for all data points across the whole training procedure is likely suboptimal. Instead of further improving adversarial training with a fixed perturbation magnitude, we revisit adversarial robustness from the margin perspective, and propose Max-Margin Adversarial (MMA) training, a practical algorithm for direct input margin maximization. By directly maximizing margins calculated for each data point, MMA training allows for optimizing the "current robustness" of the data, the "correct" at this point in training for each sample individually, instead of robustness w.r.t. a predefined magnitude. While it is intuitive that one can achieve the greatest possible robustness by maximizing the margin of a classifier, this maximization has technical difficulties. In Section 2, we overcome these difficulties and show that margin maximization can be achieved by minimizing a classification loss w.r.t. model parameters, at the "shortest successful perturbation". This makes gradient descent viable for margin maximization, despite the fact that model parameters are entangled in the constraints. We further analyze adversarial training (Madry et al., 2017; Huang et al., 2015) from the perspective of margin maximization in Section 3. We show that, for each training example, adversarial training with fixed perturbation length is maximizing a lower (or upper) bound of the margin, if is smaller (or larger) than the margin of that training point. As such, MMA training improves adversarial training, in the sense that it selects the "correct" , the margin value for each example. Finally in Section 4, we test and compare MMA training with adversarial training on MNIST and CIFAR10 w.r.t. ∞ and 2 robustness. Our method achieves higher robustness accuracies on average under a variety of perturbation magnitudes, which echoes its goal of maximizing the average margin. Moreover, MMA training automatically balances accuracy vs robustness while being insensitive to its hyperparameter setting, which contrasts sharply with the sensitivity of standard adversarial training to its fixed perturbation magnitude. MMA trained models not only match the performance of the best adversarially trained models with carefully chosen training under different scenarios, it also matches the performance of ensembles of adversarially trained models. In this paper, we focus our theoretical efforts on the formulation for directly maximizing the input space margin, and understanding the standard adversarial training method from a margin maximization perspective. We focus our empirical efforts on thoroughly examining our MMA training algorithm, comparing with adversarial training with a fixed perturbation magnitude. In this paper, we proposed to directly maximize the margins to improve adversarial robustness. We developed the MMA training algorithm that optimizes the margins via adversarial training with perturbation magnitude adapted both throughout training and individually for the distinct datapoints in the training dataset. Furthermore, we rigorously analyzed the relation between adversarial training and margin maximization. Our experiments on CIFAR10 and MNIST empirically confirmed our theory and demonstrate that MMA training outperforms adversarial training in terms of sensitivity to hyperparameter setting and robustness to variable attack lengths, suggesting MMA is a better choice for defense when the adversary is unknown, which is often the case in practice. Proof. Recall (δ) = δ . Here we compute the gradient for d θ (x, y) in its general form. Consider the following optimization problem: where ∆(θ) = {δ : L θ (x+δ, y) = 0}, and L(δ, θ) are both C 2 functions 6 . Denotes its Lagrangian by L(δ, λ), where L(δ, λ) = (δ) + λL θ (x + δ, y) For a fixed θ, the optimizer δ * and λ * must satisfy the first-order conditions (FOC) Put the FOC equations in vector form, Note that G is C 1 continuously differentiable since and L(δ, θ) are C 2 functions. Furthermore, the Jacobian matrix of G w.r.t (δ, λ) is which by assumption is full rank. Therefore, by the implicit function theorem, δ * and λ * can be expressed as a function of θ, denoted by δ * (θ) and λ * (θ). where the second equality is by Eq. (10). The implicit function theorem also provides a way of computing which is complicated involving taking inverse of the matrix Here we present a relatively simple way to compute this gradient. Note that by the definition of and δ * (θ) is a differentiable implicit function of θ restricted to this level set. Differentiate with w.r.t. θ on both sides: Combining Eq. (11) and Eq. (12), Lastly, note that 6 Note that a simple application of Danskin's theorem would not be valid as the constraint set ∆(θ) depends on the parameter θ. Therefore, one way to calculate λ * (θ) is by We provide more detailed and formal statements of Proposition 2.2. For brevity, consider a K-layers fully-connected ReLU network, f (θ; x) = f θ (x) as a function of θ. where the D k are diagonal matrices dependent on ReLU's activation pattern over the layers, and W k 's and V are the weights (i.e. θ). Note that f (θ; x) is a piecewise polynomial functions of θ with finitely many pieces. We further define the directional derivative of a function g, along the direction of v, to be: t . Note that for every direction v, there exists α > 0 such that f (θ; x) is a polynomial restricted to a line segment [θ, θ + α v]. Thus the above limit exists and the directional derivative is well defined. We first show the existence of v and t for l( Proposition A.1. For > 0, t ∈ [0, 1], and θ 0 ∈ Θ, there exists a direction v ∈ Θ, such that the derivative of l θ0, v, (t) exists and is negative. Moreover, it is given by is negative. The Danskin theorem provides a way to compute the directional gradient along this direction v. We basically apply a version of Danskin theorem for directional absolutely continuous maps and semicontinuous maps (Yu, 2012). 1. the constraint set {δ : δ ≤ } is compact; 2. L(θ 0 + t v; x + δ, y) is piecewise Lipschitz and hence absolutely continuous (an induction argument on the integral representation over the finite pieces). 3. L(θ 0 + t v; x + δ, y) is continuous on both δ and along the direction v and hence upper semi continuous. Hence we can apply Theorem 1 in Yu (2012). Therefore, for any > 0, if θ 0 is not a local minimum, then there exits a direction d, such that for Our next proposition provides an alternative way to increase the margin of f θ . Proposition A.2. Assume f θ0 has a margin 0 , and θ 1 such that l θ0, v, 0 (t) ≤ l θ1, v, 0 (0) , then f θ1 has a larger margin than 0 . Proof. Since f θ0 has a margin 0 , thus max To see the equality (constraint not binding), we use the following argument. The envolope function's continuity is passed from the continuity of L(θ 0 ; x + δ, y). The inverse image of a closed set under continuous function is closed. If δ * lies in the interior of max δ ≤ 0 L v, (θ 0 ; x + δ, y) ≥ 0, we would have a contradiction. Therefore the constraint is not binding, due to the continuity of the envolope function. By Eq. (15), max δ ≤ 0 L(θ 1 ; x + δ, y) < 0. So for the parameter θ 1 , f θ1 has a margin 1 > 0 . Therefore, the update θ 0 → θ 1 = θ 0 + t v increases the margin of f θ . ≤ log(exp(
We propose MMA training to directly maximize input space margin in order to improve adversarial robustness primarily by removing the requirement of specifying a fixed distortion bound. An adaptive margin-based adversarial training approach to train robust DNNs, by maximizing the shortest margin of inputs to the decision boundary, that makes adversarial training with large perturbation possible. A method for robust learning against adversarial attacks where the input space margin is directly maximized and a softmax variant of the max-margin is introduced.