EOT attack can break through this method

[problem-marker]

I reproduced this code and it has a robust accuracy of 60% on PGD20 and only 42% on EOT-PGD20, which is much lower than baseline

[2480667859]

Hello, may I ask how you achieved a PGD-20 accuracy of 60% in the evaluation, while my PGD-20 accuracy was only 38%

[UniSerj]

Hi, please check the readme for the training and evaluation setting. The pretrained models are also available on the Google Drive provided in the readme. All the results can be reproduced via the provided evaluation code and pretrained models.

For the evaluation, we follow the protocol in Double-win Quant (ICML 2021). The contribution of RPF mainly lies in a better trade-off between clean and robust accuracy due to distance preservation. It is possible that this method performs worse under stronger EOT attacks because the adversarial training strategy used in this method is a black-box one, which reduces the adversarial transferability among different paths instead of improving the adversarial robustness directly. One potential solution is to enhance the adversarial training by involving EOT-PGD.

[2480667859]

I downloaded the pretrained models in Google Drive and used the evaluation code, but the obtained robust accuracy of pgd and fgsm is 40%, which is much lower than 69.48% and 66.49% in the paper.

[problem-marker]

I just followed the readme and run the code. The following code is the key to implementing RPF for evaluation
if args.rp:
# random select a path to attack
model.module.random_rp_matrix()

    X_adv = atk(X, y)  # advtorch

    if args.rp:
        # random select a path to infer
        model.module.random_rp_matrix() 

[problem-marker]

Thank you very much for your reply. I believe that trying to use EOT attacks for adversarial training in random methods is a good idea, but this still does not guarantee that the model's robustness has genuinely improved. Perhaps this is a common issue with experience-based robustness verification methods.

[2480667859]

I just followed the readme and run the code. The following code is the key to implementing RPF for evaluation if args.rp: # random select a path to attack model.module.random_rp_matrix()

    X_adv = atk(X, y)  # advtorch

    if args.rp:
        # random select a path to infer
        model.module.random_rp_matrix() 

I set args.rp to True when I ran the evaluation code, but I still got the wrong robust accuracy. What does the code look like when reading the pre-trained model? The source code looks like this:
pretrained_model = torch.load(args.pretrain)
model.load_state_dict(pretrained_model, strict=False)
model.eval()
I think there may be some problems with it, can you share what your code is written here

[UniSerj]

Hi, @2480667859. If you have not modified the source code and followed the evaluation code in the readme:

python evaluate.py --dataset cifar10 --network ResNet18 --rp --rp_out_channel 48 --rp_block -1 -1 --save_dir eval_r18_c10 --pretrain [path_to_model]

the results in the paper can be reproduced. Would you please share the evaluation log so that I can help?

For the source code you mentioned

pretrained_model = torch.load(args.pretrain)
model.load_state_dict(pretrained_model, strict=False)
model.eval()

It loads all the weights from the pretrained model. The reason why strict=False is that a dataset normalization layer is added during evaluation, which replaces the transforms.Normalize() for a convenient evaluation using Torchattack.

[2480667859]

Thank you for your help. According to the method you just mentioned, we experimented again with the pretrained model you provided, and obtained similar results to those in the paper.
In addition, I tried to test the AT method in the literature Overfitting in ad-versarially robust deep learning (the results in the first row of the table in the picture), but the results obtained were quite different from those in the paper. Is the parameter setting of this method the same as that provided by you in the training strategy in Section 4.1 Experiment setting? If not, could you please share your parameter setting? Thank you very much!

[UniSerj]

Yes, the training recipe follows the one in Overfitting in adversarially robust deep learning. The detailed setting is provided in Section 4.1. It uses PGD-10 for 200 epochs with a multistep lr schedule. To reproduce the result of this baseline, you can try applying the AT framework provided in train.py with vanilla resnet.py.

[2480667859]

I tried the above, using the evaluation code, and made the following modifications：
parser.add_argument('--rp', action='store_true', help='if random projection') parser.add_argument('--rp_block', default=None, type=int, nargs='*', help='block schedule of rp') parser.add_argument('--rp_out_channel', default=0, type=int, help='number of rp output channels')
But the output is not good

[UniSerj]

It seems like it did not load the pretrained weights correctly since the clean accuracy is around 10%. Please note that you need to retrain the vanilla resnet.py with the AT algorithm in Overfitting in adversarially robust deep learning. Then you can replace the model in the evaluate.py to perform the evaluation. One potential issue here is that Torchattack assumes that the input image is not normalized. Thus, we add a dataset normalization layer to the resnet. Please check here.

[2480667859]

Do you mean that you use dataset_normalization on your data sets as you evaluate them？I tried _, nature_acc = evaluate_standard_rp(dataset_normalization, model)，but it gave me an error
In addition, I tried to run train.py with --network ResNet18 --dataset cifar10 --attack_iters 10 --lr_schedule multistep --epochs 200 --adv_training --rp -- rp_block-1-1 --rp_out_channel 48 --rp_weight_decay 1e-2 --save_dir resnet18_c10_RPF ， at the same time, the following modifications are made to draw the robust loss diagram

        for i, (X, y) in enumerate(train_loader):
            _iters = epoch * len(train_loader) + i

            # random select a path to attack
            if args.rp:
                model.module.random_rp_matrix()

            X, y = X.to('cuda'), y.to('cuda')
            if args.adv_training:
                delta = attack_pgd(model, X, y, epsilon, alpha, args.attack_iters, args.restarts, args.dataset)
                # random select a path to infer
                if args.rp:
                    model.module.random_rp_matrix()
                output = model(X + delta[:X.size(0)])
            else:
                output = model(X)
            loss = criterion(output, y)

            opt.zero_grad()
            loss.backward()
            opt.step()
            output_clean = model(X)
            loss_clean = criterion(output_clean, y)

            train_loss += loss.item() * y.size(0)
            train_clean_loss += loss_clean.item() * y.size(0)
            train_acc += (output.max(1)[1] == y).sum().item()
            train_clean_acc += (output_clean.max(1)[1] == y).sum().item()
            train_n += y.size(0)
#The loss function of clean samples is added in the training process

  logger.info(
            'Epoch \t LR \t \t Train Clean Loss \t Train Clean Acc \t Train Adv Loss \t Train Adv Acc \t Test Clean Loss \t Test Clean Acc \t Test Adv Loss \t Test Adv Acc')
        logger.info(
            '%d \t %.4f \t  %.4f \t %.4f \t %.4f \t %.4f \t %.4f \t %.4f \t %.4f \t %.4f',
            epoch, lr, train_clean_loss / train_n, train_clean_acc / train_n, train_loss / train_n,
                       train_acc / train_n, test_loss, test_acc, pgd_loss, pgd_acc)

        train_clean_loss_record.append(train_clean_loss / train_n)
        train_clean_acc_record.append(train_clean_acc / train_n)
        train_adv_loss_record.append(train_loss / train_n)
        train_adv_acc_record.append(train_acc / train_n)

        test_clean_loss_record.append(test_loss)
        test_clean_acc_record.append(test_acc)
        test_adv_loss_record.append(pgd_loss)
        test_adv_acc_record.append(pgd_acc)
        #The way the loss versus accuracy was recorded was modified before saving the model

Unfortunately, the results were not good.

The resulting robust loss diagram is as follows

Now I can't find my mistake. Could you give me some suggestions based on your experience of doing experiments in the past? Thank you very much!

[UniSerj]

1. The dataset normalization is moved to the model during the evaluation. Please check here.
2. If you want to train RPF, the script python train.py --network ResNet18 --dataset cifar10 --attack_iters 10 --lr_schedule multistep --epochs 200 --adv_training --rp --rp_block -1 -1 --rp_out_channel 48 --rp_weight_decay 1e-2 --save_dir resnet18_c10_RPF should produce the similar results in the paper. My guess is that you have not turned on random projection. Please check if model.module.random_rp_matrix() works in your code.

[2480667859]

Thanks for your help.
1.What I understand about the use of "dataset normalization" is that norm is set to False when evaluating RPF, and norm is set to True when evaluating AT. This is because the random projection filter is used in the RPF method instead of the convolutional filter in vanilla resnet, but vanilla resnet is still used in the AT method.
2.I checked the code and found that “model.module.random_rp_matrix()” was commented out in evaluate_standard_rp. Later, I conducted the experiment again, and there were two problems as follows.
1）.The robust accuracy of pgd and fgsm is 36.94% and 50.74% respectively, and the accuracy of clean samples is 87.42%.Different from the results in the paper.
2）.In addition, the loss diagram is drawn as follows.From the picture, it can be seen that the loss curve of the adversarial example is overfitted in test.Did you encounter this phenomenon in your experiments.