# Theoretical overview of $b\to s$ hadronic decays

University of Sussex, Department of Physics and Astronomy, Falmer, Brighton
BN1 9QH, UK
E-mail

###### Abstract:

A wealth of data on hadronic $b\to s$ transitions is available from the
$B$-factories and will be improved at the LHCb experiment and possible future
super-$B$-factories. I review the theory of these decays as it pertains to the
search for physics beyond the Standard Model and various puzzles in the
present data.

##  1 Introduction

Charmless hadronic $b\to s$ transitions are a rich source of information about
the physics of the weak and/or TeV scales. Their sensitivity to short-distance
physics derives from the CKM hierarchy and a GIM cancellation which combine to
suppress contributions at tree-level in the weak interaction or through light-
quark loops. As a consequence, the Standard-Model (SM) amplitudes are governed
by the combination

$V_{ts}^{*}V_{tb}\times\frac{1}{16\pi^{2}}\times\frac{m_{B}^{2}}{M_{W}^{2}}\sim
10^{-6}.$ (1)

The resulting rareness of these modes makes them sensitive to contributions of
new particles with TeV-scale masses, so we should expect deviations from the
Standard Model. The task is to disentangle SM and new-physics (NP)
contributions in a given mode, such that a possible NP signal can be
recognized, and to identify those observables, or combinations of them, where
this is best possible. More ambitiously, one may want to quantify a signal in
terms of NP-model parameters.

It is worth contrasting the $b\to s$ transitions with the $b\to d$ ones. Here,
the CKM hierarchy is different, such that tree-level contributions involving
$V_{ub}\propto(\bar{\rho}-i\bar{\eta})$ can compete with or dominate over loop
contributions involving $V_{td}\propto(1-\bar{\rho}-i\bar{\eta})$. Indeed,
$b\to d$ hadronic decays, together with $b\to u$ semileptonic and, by now,
purely leptonic $B^{+}\to\tau\nu_{\tau}$ decays, provide the main input to the
global CKM fit (Figure 1).

Figure 1: Global CKM fit as shown at this conference [1]

The two dominant inputs are the ratio of $B_{d}$ and $B_{s}$ mass differences
(orange ring) and the mixing-induced CP violation in $B_{d}\to J/\psi K_{S}$
(blue wedge) derive from the $B-\bar{B}$ mixing amlitudes, which are again
loop processes. Two constraints in a plane will generically intersect in a
discrete set of points, and the most significant consistency check is through
the “$\alpha$” measurements in $B_{d}\to{\pi\pi,\pi\rho,\rho\rho}$ transitions
(shown as light blue “half moon” in the Figure). Hence the consistency of the
CKM fit at present allows ${\cal O}(10\%)$ NP effects. Beyond this level, NP
contributions to different observables would have to conspire to maintain the
observed level of agreement.111 The picture may change as progress in lattice
QCD makes more precise predictions for $B$ meson mixing, $B\to\tau\nu$, and
$\epsilon_{K}$ possible. Interestingly, a significantly improved calculation
of $B_{K}$ [2] indicates a tension with the aforementioned CKM determinations
at about the $2\sigma$ level [3]. On the other hand, the combination
$V_{ts}^{*}V_{tb}$ relevant to $b\to s$ transitions is very weakly dependent
on $\bar{\rho}$ and $\bar{\eta}$. Hence these processes are determined, in
principle, with a small parametric uncertainty in the SM. Moreover, the
consistency of the CKM fit has little to say about new physics in $b\to s$
transitions. Indeed, several puzzles have shown up in recent years in the
data, notably

  1. 1.

time-dependent CP violation in $b\to s$ decays of $B^{0}_{d}$ mesons to a CP
eigenstate. In the SM, one expects to measure $-\eta_{CP}S\approx\sin 2\beta$,
but some modes show a deviation (Figure 2). None of these is very significant
at the moment, but this might change with more precise data becoming available
from LHCb and, eventually, a super-$B$ factory.

  2. 2.

The time-dependent CP violation in $B_{s}\to J/\psi\phi$, in combination with
lifetime difference and semileptonic asymmetry, determines the phase of the
mixing amplitude to be [4]

$\phi_{B_{s}}\in(-168,-102)^{\circ}\cup(-78,-11)^{\circ},$ (2)

about $2.2\sigma$ from the SM, with much better statistics ahead at Tevatron
and LHCb. The theory is reviewed in a separate talk at this conference [5].

  3. 3.

Direct CP asymmetries in $B\to\pi K$ decays. These modes have received
attention for several years. It has been stressed that $A_{\rm
CP}(B^{+}\to\pi^{0}K^{+})\not=A_{\rm CP}(B^{0}\to\pi^{-}K^{+})$ at $5\sigma$
significance [6]. The verdict is less clear, since the SM does not predict
identical asymmetries.

##  2 Hadronic decay amplitudes

Interpreting items 1 and 3 requires knowledge about hadronic decay amplitudes,
which always involve nonperturbative QCD. As the latter is generally under
limited control, approximations are necessary, either neglecting some small
parameter or expanding in it.

For any $b\to s$ transition to a final state $f$, we can write

$\displaystyle{\cal A}_{f}$ $\displaystyle\equiv$ $\displaystyle{\cal A}(B\to
f)=V_{us}V_{ub}^{*}T_{f}+V_{cs}V_{cb}^{*}P_{f}+P_{f}^{\rm NP},$ (3)
$\displaystyle\bar{\cal A}_{\bar{f}}$ $\displaystyle\equiv$
$\displaystyle{\cal
A}(\bar{B}\to\bar{f})=V_{us}^{*}V_{ub}T_{f}+V_{cs}^{*}V_{cb}P_{f}+P_{\bar{f}}^{\rm
NP},$ (4)

where $T_{f}$ and $C_{f}$ are CP-even “strong” amplitudes and $P_{f}^{\rm
NP}$, $P_{\bar{f}}^{\rm NP}$ are new-physics contributions. CKM unitarity has
been used to eliminate the combination $V_{ts}V_{tb}^{*}$
($V_{ts}^{*}V_{tb}$). Branching fractions and CP asymmetries are functions of
the magnitudes and relative phases of the strong amplitudes, as well as
magnitudes and phases of the CKM elements. For instance, if $f$ is a CP
eigenstate, $|\bar{f}\rangle=\eta_{\rm CP}(f)|f\rangle$, then the time-
dependent CP asymmetry is given as

$A_{\rm CP}(f;t)\equiv\frac{\Gamma(\bar{B}(t)\to f)-\Gamma(B(t)\to
f)}{\Gamma(\bar{B}(t)\to f)+\Gamma(B(t)\to f)}\equiv-C_{f}\cos\Delta
m_{d}\,t+S_{f}\sin\Delta m_{d}\,t,$ (5)
$C_{f}=\frac{1-|\xi|^{2}}{1+|\xi|^{2}},\qquad S_{f}=\frac{2{\rm
Im}\xi}{1+|\xi|^{2}},\qquad\xi=e^{-i2\beta}\frac{{\cal A}(\bar{B}\to f)}{{\cal
A}(B\to f)}=-\eta_{\rm
CP}(f)e^{-i2\beta}\frac{V_{cs}^{*}V_{cb}+\dots}{V_{cs}V_{cb}^{*}+\dots}.$ (6)

Here the dots are proportional to the ratio $T_{f}/P_{f}$, multiplied by CKM
factors of ${\cal O}(\lambda^{2})$. If the tree amplitudes are neglected, then
$-\eta_{\rm CP}(f)S_{f}=\sin(2\beta)$ results to very good approximation.
While experimentally (Figure 2) the various modes are in reasonable agreement
with each other and the determination of $\sin 2\beta$ from $b\to c\bar{c}s$
transitions, the suggestive pattern of the central values begs the question
whether it could be caused by the neglected SM tree amplitudes, or one has to
invoke NP terms $P_{f}^{\rm NP}$. Quantitative information on the amplitudes
derives from (i) flavour-$SU(3)$ (and isospin) relations [8] together with
measurements of $b\to d$ transitions and (ii) the heavy-quark expansion in
$\Lambda_{\rm QCD}/m_{b}$ (QCDF [9] and its effective-field-theory formulation
in SCET [10, 11, 12], and the somewhat different “pQCD” approach [13]).
Guidance on the relative importance of amplitudes follows from (iii) Cabibbo
counting and (iv) the large-$N$ expansion [14]. (i), (ii), and (iv) involve
the subdivision of the “physical” tree and penguin amplitudes into several
“topological” amplitudes,

$\displaystyle T_{M_{1}M_{2}}$ $\displaystyle=$
$\displaystyle\Big{[}A_{M_{1}M_{2}}(\alpha_{1}(M_{1}M_{2})+\alpha_{2}(M_{1}M_{2})+\alpha_{4}^{u}(M_{1}M_{2}))$
$\displaystyle+B_{M_{1}M_{2}}(b_{1}(M_{1}M_{2})+b_{2}(M_{1}M_{2})+b_{3}^{u}(M_{1}M_{2})+b_{4}^{u}(M_{1}M_{2}))+{\cal
O}(\alpha)\Big{]}\;+(M_{1}\leftrightarrow M_{2})\;,$ $\displaystyle
P_{M_{1}M_{1}}$ $\displaystyle=$
$\displaystyle\Big{[}A_{M_{1}M_{2}}\alpha_{4}^{c}(M_{1}M_{2})+B_{M_{1}M_{2}}(b_{3}^{c}(M_{1}M_{2})+b_{4}^{c}(M_{1}M_{2}))+{\cal
O}(\alpha)\Big{]}+(M_{1}\leftrightarrow M_{2})\;,$ (8)

where we employ the notation of [15, 9], which is general but is particularly
suited for the heavy-quark expansion. $A_{M_{1}M_{2}}$ and $B_{M_{1}M_{2}}$
are normalization factors which by convention contain certain form factors and
decay constants. The $\alpha_{i}$ and $b_{i}$ denote the different topological
amplitudes. Often, $A\alpha_{1}$ and $A\alpha_{2}$ are written as $T$ and $C$,
$A\alpha_{4}^{c}$ as $P_{ct}$, etc., or variations thereof. Table 1 summarizes
the counting in the various small parameters.

Figure 2: Left: Measurements of mixing-induced CP asymmetries in $b\to s$ penguin transitions as compiled by the HFAG [7]. Right: Constraints from decay rate data in the $(A,S)$ plane for $B\to\pi^{0}K_{S}$ ($A=-C$) [23] Table 1: Hierarchies among topological amplitudes from expansions in the Cabibbo angle $\lambda$, in $1/N_{c}$, and in $\Lambda_{\rm QCD}/m_{b}$. (Some amplitudes, such as electroweak penguins, are omitted from the list.)  | $\alpha_{1}$ | $\alpha_{2}$ | $\alpha_{4}^{u}$ | $\alpha_{4}^{c}$ | $\alpha_{3EW}$ | $\alpha_{4EW}$ | $b_{3}^{c}$ | $b_{4}^{c}$ | $b_{1}$ | $b_{2}$
---|---|---|---|---|---|---|---|---|---|---
| $(T)$ | $(C)$ | $(P_{ut})$ | $(P_{ct})$ | $(P_{\rm EW})$ | $(P_{\rm EW}^{\rm C})$ |  |  | $(E)$ | $(A)$
Cabibbo $(b\to d)$ | all amplitudes are ${\cal O}(\lambda^{3})$
Cabibbo $(b\to s)$ | $\lambda^{4}$ | $\lambda^{4}$ | $\lambda^{4}$ | $\lambda^{2}$ | $\lambda^{2}$ | $\lambda^{2}$ | $\lambda^{2}$ | $\lambda^{2}$ | $\lambda^{4}$ | $\lambda^{4}$
$1/N$ | $1$ | $\frac{1}{N}$ | $\frac{1}{N}$ | $\frac{1}{N}$ | $1$ | $\frac{1}{N}$ | $\frac{1}{N}$ | $\frac{1}{N}$ | $\frac{1}{N}$ | $1$
$\Lambda/m_{b}$ | $1$ | $1$ | $1$ | $1$ | $1$ | $1$ | $\Lambda/m_{b}$ | $\Lambda/m_{b}$ | $\Lambda/m_{b}$ | $\Lambda/m_{b}$

At the quantitative level, the leading-power amplitudes $\alpha_{1}$,
$\alpha_{2}$, …can be factorized [9] into products of “hard kernels” that can
be computed order by order in perturbation theory and include all strong
(rescattering) phase information, and nonperturbative normalization factors
such as $f_{+}^{B\pi}(0)f_{K}$ or $f_{B}f_{K}f_{\pi}$ (usually factored out
into $A_{M_{1}M_{2}}$ and $B_{M_{1}M_{2}}$). This statement holds up to
generally incalculable $\Lambda/m_{b}$ corrections. Certain amplitudes
(annihilation amplitudes $b_{i}$) are altogether power-suppressed and not
calculable. See [16] for more details. Over the last years, a number of
higher-order (NNLO) calculations of the kernels have been performed [17]. The
main phenomenological findings can be summarized as follows.

  * •

The colour-allowed trees $\alpha_{1}$ are well behaved in perturbation theory,
with overall uncertainties at the few-percent level (not counting the
nonperturbative normalization).

  * •

The colour-suppressed trees $\alpha_{2}$ show cancellations within the (well-
behaved) perturbative part, and suffer from a large uncertainty in the
normalization and sensitivity to power corrections. Attaching an ${\cal O}(1)$
uncertainty to the (small) theoretical prediction using the power-correction
model of [9] would still imply $|\alpha_{2}/\alpha_{1}|<{\cal O}(1/2)$.

  * •

The topological (QCD) penguin amplitudes are also under good control (but only
a subset of NNLO corrections is known), but are phenomenologically
indistinguishable from the incalculable (formally power-suppressed) penguin
annihilation amplitudes.

  * •

The colour-allowed and colour-suppressed electroweak penguins amplitudes
behave qualitatively like the colour-allowed and colour-suppressed trees,
respectively.

Further recent work focussing on phenomenological issues can be found in [18],
and a new take on long-distance charm penguins in [19].

##  3 Phenomenological applications

Table 2: Predictions for $\Delta S$ defined in the text for several penguin-dominated modes. From [16]; see therein for details, in particular the meaning and comparison of errors. mode | QCDF/BBNS [20] | SCET/BPRS [11, 21] | pQCD [22] | experiment [7]
---|---|---|---|---
$\phi K_{S}$ |  $0.01$ …$0.05$ |  $0$ / $0$ |  $0.01$ …$0.03$ | $-0.23\pm 0.18$
$\omega K_{S}$ |  $0.01$ …$0.21$ |  $-0.25$ …$-0.14$ / $0.09$ …$0.13$ |  $0.08$ …$0.18$ | $-0.22\pm 0.24$
$\rho^{0}K_{S}$ |  $-0.29$ …$0.02$ |  $0.11$ …$0.20$ / $-0.16$ …$-0.11$ |  $-0.25$ …$-0.09$ | $-0.13\pm 0.20$
$\eta K_{S}$ |  $-1.67$ …$0.27$ |  $-0.20$ …$0.13$ / $-0.07$ …$0.21$ |  |
$\eta^{\prime}K_{S}$ |  $0.00$ …$0.03$ |  $-0.06$ …$0.10$ / $-0.09$ …$0.11$ |  | $-0.08\pm 0.07$
$\pi^{0}K_{S}$ |  $0.02$ …$0.15$ |  $0.04$ …$0.10$ |  | $-0.10\pm 0.17$

Several authors have estimated the tree “pollution” in the hadronic $b\to s$
penguins combining experimental data and heavy-quark-expansion calculations in
different ways. Their results, compared in Table 2, are in general agreement
with each other (as they should) and can be compared to Figure 2. Clearly, the
SM does not produce the pattern of experimental (central) values. While the
significance of the measured $\Delta S$ values is low for all modes, in the
case of $\pi^{0}K_{S}$ one can perform a combined analysis of all $B\to\pi K$
decay data to get a somewhat stronger “signal”. The method discussed here [23]
(see also [24]) invokes the well-known isospin symmetry relation

$\sqrt{2}{\cal A}(B^{0}\to\pi^{0}K^{0})+{\cal
A}(B^{0}\to\pi^{-}K^{+})=-\Big{[}(\hat{T}+\hat{C})e^{i\gamma}+\hat{P}_{\rm
ew}\Big{]}\equiv 3A_{3/2}.$ (9)

This relation, and a similar one for the CP conjugates, allows to fix all four
complex decay amplitudes from the four decay rates if the isospin-$3/2$
amplitudes are known, up to a four-fold ambiguity. The latter can indeed be
obtained as

$3A_{3/2}=-R_{T+C}|V_{us}/V_{ud}|\sqrt{2}|A(B^{+}\to\pi^{+}\pi^{0})|\Big{(}e^{i\gamma}-0.66\frac{0.41}{R_{b}}R_{q}\Big{)},$
(10)

where $R_{b}$ is a side of the unitarity triangle and
$R_{T+C}=1.23^{+0.02}_{-0.03}$ and
$R_{q}=(1.02^{+0.27}_{-0.22})e^{i(0^{+1}_{-1})^{\circ}}$ quantify $SU(3)$
breaking, with uncertainties obtained in a QCDF calculation. Fixing the
ambiguity by a (minimal) usage of either QCDF or $SU(3)$, one obtains a
prediction of $S_{\pi^{0}K_{S}}$ (Figure 2) from the remaining data. This is
one of many ways of visualizing the tension in the $\pi K$ system,
distinguished perhaps by a particularly limited use of uncertain theoretical
predictions or assumptions. A future perspective on the uncertainty is also
indicated (thin band). For more on NP in $B\to\pi K$, see [25].

One can also attempt to compute directly the difference in direct CP
asymmetries. Unfortunately, this involves the uncertain colour-suppressed tree
amplitude, and the significance of this discrepancy is currently difficult to
quantify. Making no assumptions about $C$, one still has the relation [26]
$A_{\rm CP}(K^{+}\pi^{-})+A_{\rm CP}(K^{0}\pi^{+})\approx A_{\rm
CP}(K^{+}\pi^{0})+A_{\rm CP}(K^{0}\pi^{0})$, which is satisfied by the current
experimental data [24], and expected to hold (in general) to few-percent
level.

## Acknowledgment

I thank the organizers for a superb conference experience within and outside
the lecture theatre.

## References

  * [1] CKMfitter Group (J. Charles et al.), Eur. Phys. J. C 41 (2005) 1 [arXiv:hep-ph/0406184], updated results and plots available at http://ckmfitter.in2p3.fr; K. Trabelsi, talk at this conference.
  * [2] D. J. Antonio et al. [RBC and UKQCD Collaborations], Phys. Rev. Lett. 100 (2008) 032001 [arXiv:hep-ph/0702042].
  * [3] E. Lunghi and A. Soni, Phys. Lett. B 666 (2008) 162 [arXiv:0803.4340 [hep-ph]]; A. J. Buras and D. Guadagnoli, Phys. Rev. D 78 (2008) 033005 [arXiv:0805.3887 [hep-ph]].
  * [4] C. Amsler et al. [Particle Data Group], Phys. Lett. B 667 (2008) 1. The average is from the 2009 update and has been performed by the Heavy Flavour Averaging Group, see [7] and http://www.slac.stanford.edu/xorg/hfag/osc/PDG_2009/.
See also the talks by K. Gibson and I. Bertram at this conference.

  * [5] P. Ball, talk at this conference.
  * [6] The Belle Collaboration, Nature 452 (2008) 332.
  * [7] E. Barberio et al. [HFAG], arXiv:0808.1297 [hep-ex], http://www.slac.stanford.edu/xorg/hfag/index.html.
  * [8] D. Zeppenfeld, Z. Phys. C 8 (1981) 77; M. Gronau, O. F. Hernandez, D. London and J. L. Rosner, Phys. Rev. D 50 (1994) 4529 [arXiv:hep-ph/9404283].
  * [9] M. Beneke, G. Buchalla, M. Neubert and C. T. Sachrajda, Phys. Rev. Lett. 83 (1999) 1914 [arXiv:hep-ph/9905312]; Nucl. Phys. B 591 (2000) 313 [arXiv:hep-ph/0006124]; Nucl. Phys. B 606 (2001) 245 [arXiv:hep-ph/0104110].
  * [10] C. W. Bauer, S. Fleming, D. Pirjol and I. W. Stewart, Phys. Rev. D 63 (2001) 114020 [arXiv:hep-ph/0011336]; J. g. Chay and C. Kim, Phys. Rev. D 68 (2003) 071502 [arXiv:hep-ph/0301055]; C. W. Bauer, D. Pirjol, I. Z. Rothstein and I. W. Stewart, Phys. Rev. D 70 (2004) 054015 [arXiv:hep-ph/0401188].
  * [11] A. R. Williamson and J. Zupan, Phys. Rev. D 74, 014003 (2006) [Erratum-ibid. D 74, 03901 (2006)] [arXiv:hep-ph/0601214].
  * [12] M. Beneke and S. Jäger, Nucl. Phys. B 768, 51 (2007) [arXiv:hep-ph/0610322].
  * [13] Y. Y. Keum, H. n. Li and A. I. Sanda, Phys. Lett. B 504, 6 (2001) [arXiv:hep-ph/0004004].
  * [14] A. J. Buras, J. M. Gerard and R. Rückl, Nucl. Phys. B 268, 16 (1986); M. Bauer, B. Stech and M. Wirbel, Z. Phys. C 34 (1987) 103.
  * [15] M. Beneke and M. Neubert, Nucl. Phys. B 675 (2003) 333 [arXiv:hep-ph/0308039].
  * [16] M. Antonelli et al., arXiv:0907.5386 [hep-ph], and references therein.
  * [17] T. Becher and R. J. Hill, JHEP 0410, 055 (2004) [arXiv:hep-ph/0408344]; M. Beneke and D. Yang, Nucl. Phys. B 736, 34 (2006) [arXiv:hep-ph/0508250]; G. G. Kirilin, arXiv:hep-ph/0508235; N. Kivel, JHEP 0705, 019 (2007) [arXiv:hep-ph/0608291]; M. Beneke and S. Jäger, Nucl. Phys. B 768, 51 (2007) [arXiv:hep-ph/0610322]; A. Jain, I. Z. Rothstein and I. W. Stewart, arXiv:0706.3399 [hep-ph]; V. Pilipp, Nucl. Phys. B 794, 154 (2008) [arXiv:0709.3214 [hep-ph]]; G. Bell, Nucl. Phys. B 795, 1 (2008) [arXiv:0705.3127 [hep-ph]]; Nucl. Phys. B 822, 172 (2009) [arXiv:0902.1915 [hep-ph]]; M. Beneke, T. Huber and X. Q. Li, arXiv:0911.3655 [hep-ph].
  * [18] M. Duraisamy and A. L. Kagan, arXiv:0812.3162 [hep-ph]; H. n. Li and S. Mishima, arXiv:0901.1272 [hep-ph]; G. Bell and V. Pilipp, Phys. Rev. D 80 (2009) 054024 [arXiv:0907.1016 [hep-ph]]. H. Y. Cheng and C. K. Chua, Phys. Rev. D 80 (2009) 074031 [arXiv:0908.3506 [hep-ph]].
  * [19] M. Beneke, G. Buchalla, M. Neubert and C. T. Sachrajda, Eur. Phys. J. C 61 (2009) 439 [arXiv:0902.4446 [hep-ph]].
  * [20] M. Beneke, Phys. Lett. B 620, 143 (2005) [arXiv:hep-ph/0505075].
  * [21] W. Wang, Y. M. Wang, D. S. Yang and C. D. Lu, Phys. Rev. D 78, 034011 (2008).
  * [22] H. n. Li and S. Mishima, Phys. Rev. D 74, 094020 (2006) [arXiv:hep-ph/0608277].
  * [23] R. Fleischer, S. Jäger, D. Pirjol and J. Zupan, Phys. Rev. D 78 (2008) 111501 [arXiv:0806.2900 [hep-ph]].
  * [24] M. Gronau and J. L. Rosner, Phys. Lett. B 666 (2008) 467 [arXiv:0807.3080 [hep-ph]].
  * [25] It is difficult to do justice to the enormous literature on NP in $B\to\pi K$ in a conference proceedings. Some classic works are: T. Yoshikawa, Phys. Rev. D 68 (2003) 054023 [arXiv:hep-ph/0306147]; M. Gronau and J. L. Rosner, Phys. Lett. B 572 (2003) 43 [arXiv:hep-ph/0307095]; A. J. Buras, R. Fleischer, S. Recksiegel and F. Schwab, Phys. Rev. Lett. 92 (2004) 101804 [arXiv:hep-ph/0312259]; Nucl. Phys. B 697 (2004) 133 [arXiv:hep-ph/0402112]; S. Baek, P. Hamel, D. London, A. Datta and D. A. Suprun, Phys. Rev. D 71 (2005) 057502 [arXiv:hep-ph/0412086]; Y. L. Wu and Y. F. Zhou, Phys. Rev. D 72 (2005) 034037 [arXiv:hep-ph/0503077]; see also [15]. Recent work includes: T. Feldmann, M. Jung and T. Mannel, JHEP 0808 (2008) 066 [arXiv:0803.3729 [hep-ph]]; A. Soni, A. K. Alok, A. Giri, R. Mohanta and S. Nandi, Phys. Lett. B 683 (2010) 302 [arXiv:0807.1971 [hep-ph]]; M. Ciuchini, E. Franco, G. Martinelli, M. Pierini and L. Silvestrini, Phys. Lett. B 674 (2009) 197 [arXiv:0811.0341 [hep-ph]]; N. Mahajan, arXiv:0812.0230 [hep-ph]; R. Mohanta and A. K. Giri, Phys. Rev. D 79 (2009) 057902 [arXiv:0812.1842 [hep-ph]]; V. Barger, L. Everett, J. Jiang, P. Langacker, T. Liu and C. Wagner, Phys. Rev. D 80 (2009) 055008 [arXiv:0902.4507 [hep-ph]]; Q. Chang, X. Q. Li and Y. D. Yang, JHEP 0905 (2009) 056 [arXiv:0903.0275 [hep-ph]]; S. Baek, C. W. Chiang, M. Gronau, D. London and J. L. Rosner, Phys. Lett. B 678 (2009) 97 [arXiv:0905.1495 [hep-ph]]; V. Barger, L. L. Everett, J. Jiang, P. Langacker, T. Liu and C. E. M. Wagner, JHEP 0912 (2009) 048 [arXiv:0906.3745 [hep-ph]]; S. Khalil, A. Masiero and H. Murayama, Phys. Lett. B 682 (2009) 74 [arXiv:0908.3216 [hep-ph]]; M. Bauer, S. Casagrande, U. Haisch and M. Neubert, arXiv:0912.1625 [hep-ph]; A. Soni, A. K. Alok, A. Giri, R. Mohanta and S. Nandi, arXiv:1002.0595 [hep-ph].
  * [26] M. Gronau, Phys. Lett. B 627 (2005) 82 [arXiv:hep-ph/0508047].


# Robustness and Generalization via Generative Adversarial Training

Omid Poursaeed1,2 Tianxing Jiang1 Harry Yang3

Serge Belongie1,2 Ser-Nam Lim3

1Cornell University 2Cornell Tech 3Facebook AI

###### Abstract

While deep neural networks have achieved remarkable success in various
computer vision tasks, they often fail to generalize to new domains and subtle
variations of input images. Several defenses have been proposed to improve the
robustness against these variations. However, current defenses can only
withstand the specific attack used in training, and the models often remain
vulnerable to other input variations. Moreover, these methods often degrade
performance of the model on clean images and do not generalize to out-of-
domain samples. In this paper we present Generative Adversarial Training, an
approach to simultaneously improve the model’s generalization to the test set
and out-of-domain samples as well as its robustness to unseen adversarial
attacks. Instead of altering a low-level pre-defined aspect of images, we
generate a spectrum of low-level, mid-level and high-level changes using
generative models with a disentangled latent space. Adversarial training with
these examples enable the model to withstand a wide range of attacks by
observing a variety of input alterations during training. We show that our
approach not only improves performance of the model on clean images and out-
of-domain samples but also makes it robust against unforeseen attacks and
outperforms prior work. We validate effectiveness of our method by
demonstrating results on various tasks such as classification, segmentation
and object detection.

##  1 Introduction

Deep neural networks have shown promising generalization to in-domain samples.
However, they are vulnerable to slight alterations of input images and have
limited generalization to new domains. Several defenses have been proposed for
improving the models’ robustness against input variations. However, these
models only provide robustness against a narrow range of threat models used in
training, and they have poor generalization to unseen attacks. We hypothesize
that this is due to the fact that they only consider a small subset of
realistic examples on or near the manifold of natural images. For instance,
additive perturbations leave high-level semantic aspects of images intact.
Therefore, models trained against these examples do not provide robustness to
high-level input variations. In order for a model to become robust to all
realistic variations of inputs, it needs to see a diverse set of samples
during training. However, most of the existing works only alter a low-level
aspect of images such as color [19, 25, 4], spatial [14, 37, 1], pose [2, 43],
and others. Even if we consider the union of several types of attacks, the
model can still be vulnerable to other input variations that are not contained
in any of the constituent threat models. To provide robustness against
unforeseen attacks, we propose adversarial training against a range of low-
level to high-level variations of inputs. We leverage generative models with
disentangled latent representations to systematically build diverse and
realistic examples without leaving the manifold of natural images. We show
that our approach improves generalization and robustness of the model to
unseen variations of input images without training against any of them.

We build upon state-of-the-art generative models which disentangle factors of
variation in images. We create fine and coarse-grained adversarial changes by
manipulating various latent variables at different resolutions. Loss of the
target network is used to guide the generation process. The pre-trained
generative model constrains the search space for our adversarial examples to
realistic images, thereby revealing the target model’s vulnerability in the
natural image space. We verify that we do not deviate from the space of
realistic images with a user study as well as a t-SNE plot comparing
distributions of real and adversarial images. As a result, we observe that
including these examples in training the model enhances its accuracy on clean
images as well as out-of-domain samples. Moreover, since the model has seen a
variety of low-level and high-level alterations of images, it becomes robust
to a wide range of adversarial examples including recoloring, spatial
transformations, perceptual and additive perturbations.

Our contributions can be summarized as follows:

  * •

We present Generative Adversarial Training (GAT) to simultaneously improve the
model’s generalization to clean and out-of-domain samples and its robustness
to unforeseen attacks. Our approach is based on adversarial training with
fine-grained unrestricted adversarial examples in which the attacker controls
which aspects of the image to manipulate, resulting in a diverse set of
realistic, on-the-manifold examples.

  * •

We evaluate GAT against a diverse set of adversarial attacks: recoloring,
spatial transformations, perceptual and additive perturbations, and
demonstrate that it achieves state-of-the-art robustness against these attacks
without training against any of them.

  * •

We extend our approach to semantic segmentation and object detection tasks,
and propose the first method for generating unrestricted adversarial examples
for segmentation and detection. Training with our examples improves both
robustness and generalization of the model.

##  2 Related Work

###  2.1 Adversarial Examples

Most of the existing works on adversarial attacks focus on norm-constrained
adversarial examples: for a given classifier
$F:\mathbb{R}^{n}\rightarrow\\{1,\ldots,K\\}$ and an image
$x\in\mathbb{R}^{n}$, the adversarial image $x^{\prime}\in\mathbb{R}^{n}$ is
created such that $\left\lVert x-x^{\prime}\right\rVert_{p}<\epsilon$ and
$F(x)\neq F(x^{\prime})$. Common values for $p$ are $0,2,\infty$, and
$\epsilon$ is chosen small enough so that the perturbation is imperceptible.
Various algorithms have been proposed for creating $x^{\prime}$ from $x$.
Optimization-based methods solve a surrogate optimization problem based on the
classifier’s loss and the perturbation norm [35, 15, 8]. Gradient-based
methods use gradient of the classifier’s loss with respect to the input image
[16, 28, 12, 24].

Another line of work creates unrestricted adversarial examples that are not
bounded by a norm threshold. One way to achieve this is by applying subtle
geometric transformations such as spatial transformations [37, 1],
translations and rotations [14] or pose changes [2] to the inputs. Other works
consider recoloring [19, 25, 4], intermediate features [13, 26, 41] and
inserting new objects or patches in the image [6]. A challenge for creating
unrestricted adversarial examples and defending against them is introduced in
[5] using the simple task of classifying between birds and bicycles. Recent
works consider using generative models to create adversarial examples. Song et
al. [32] search in the latent ($z$) space of AC-GAN [29] to find generated
images that can fool a target classifier but yield correct predictions on AC-
GAN’s auxiliary classifier. They constrain the search region of $z$ so that it
is close to a randomly sampled noise vector, and show results on MNIST, SVHN
and CelebA datasets. This approach does not alter any aspects of images and
merely generates a set of generated images misclassified by the model. As we
show in the supplementary material, training with these adversarial examples
hurts the classifier’s performance on clean images. One reason for this
accuracy drop is that requiring two classifiers to have inconsistent
predictions degrades sample quality of the model. To further illustrate
difference of our approach with [32], we plot t-SNE embeddings of real CelebA-
HQ images and adversarial examples from our method and [32] in the
supplementary material, and show that our adversarial images stay closer to
the manifold of real images. The recent work by [17] shows that adversarial
training with examples generated by StyleGAN can improve performance of the
model on clean images. Their approach requires precomputing a mapping from the
image space to the latent space for the whole dataset, which is
computationally prohibitive for large datasets. It is also constrained to fine
changes using only a subset of the latent variables. They argue that coarse
changes might be label-dependent. This statement is not true since coarse
stylistic changes do not alter the label (e.g. gender) and merely modify high-
level aspects of images. Moreover, [17] only considers the classification task
on low-resolution datasets such as ColorMNIST (28x28) and CelebA (64x64).
While their approach uses the StyleGAN model, they do not show any results on
high-resolution datasets that StyleGAN is originally trained on (e.g. LSUN and
CelebA-HQ (1024x1024)), which makes it hard to ascertain that their
adversarial training will be effective on high-resolution datasets. Even on
low-resolution datasets such as Color-MNIST, their adversarial training can
perform worse than random sampling on unbiased datasets as shown in Table 2 of
[17]. On the other hand, our approach directly samples and manipulates latent
variables without requiring the mapping step. We demonstrate that by limiting
the number of iterations we can use both coarse and fine changes and both
contribute to improvements in performance. While [17] only enhances the
accuracy on clean images, our approach also improves generalization to out-of-
domains samples and unseen adversarial examples. In addition, we propose the
first method for unrestricted adversarial attacks on semantic segmentation and
object detection, and demonstrate that adversarial training improves
segmentation and detection results on clean images.

###  2.2 Adversarial Robustness

Several methods have been proposed for defending against adversarial attacks.
Many defenses attempt to combat adversaries using a form of input pre-
processing or by manipulating intermediate features or gradients [18, 39, 31].
Few approaches have been able to scale up to high-resolution datasets such as
ImageNet [27, 40, 21]. Most of the proposed heuristic defenses were later
broken by stronger adversaries [8, 36, 3]. One of the most successful defenses
is adversarial training [16, 24, 28, 38, 33, 17] which augments training data
with adversarial examples generated as the training progresses. This approach
is able to withstand strong attacks. Adversarial training with perturbation-
based examples degrades performance of the model on clean images. [38]
proposes to use separate batch norm layers for clean and adversarial images to
avoid the accuracy drop. Our approach improves the model’s accuracy on clean
images without modifying the architecture. Moreover, unlike prior work which
make the classifier robust only against the specific attack used in training,
our method provides generalizable robustness across a range of attacks.

##  3 Approach

We present Generative Adversarial Training, a method for improving
generalization and robustness of models to unseen attacks. Most of the
existing works on adversarial attacks modify a low-level aspect of images,
thereby a model adversarially trained with these samples remains susceptible
to various other input alterations. We demonstrate that by encouraging
diversity and realism in the generated adversarial examples, we can improve
both performance of the model on clean and out-of-domain images and its
robustness to a wide range of adversarial attacks. Our approach creates a
spectrum of low-level, mid-level and high-level changes for which the target
network fails to generalize. The adversarially trained model observes a
variety of examples on or near the manifold of natural images. This allows the
model to generalize better to test samples and various alterations of images.
We leverage disentangled latent representations for generating the adversarial
examples. We build upon state-of-the-art generative models and use StyleGAN
[23] for the classification task and SPADE [30] for semantic segmentation and
object detection.

Figure 1: Classification architecture. Style $({\bf{y}})$ and noise
$(\boldsymbol{\eta})$ variables are used to generate images $g({\bf
y},\boldsymbol{\eta})$ which are fed to the classifier $F$. Adversarial style
and noise tensors are initialized with ${\bf y}$ and $\boldsymbol{\eta}$ and
iteratively updated using gradients of the loss function $J$. The classifier
$F$ is adversarially trained with clean and adversarial samples.

###  3.1 Classification

Style-GAN [23] is a state-of-the-art generative model which disentangles high-
level attributes and stochastic variations in an unsupervised manner.
Stylistic variations are represented by style variables and stochastic details
are captured by noise variables. Changing the noise only affects low-level
details, leaving the overall composition and high-level aspects intact. This
allows us to manipulate the noise variables such that variations are barely
noticeable by the human eye. The style variables affect higher level aspects
of image generation. For instance, when the model is trained on bedrooms,
style variables from the top layers control viewpoint of the camera, middle
layers select the particular furniture, and bottom layers deal with colors and
details of materials [23]. This allows us to manipulate images in a controlled
manner, providing an avenue for fine-grained unrestricted attacks.

Formally, we can represent Style-GAN with a mapping function $f$ and a
synthesis network $g$. As illustrated in Figure 1, the mapping function is an
8-layer MLP which takes a latent code ${\bf z}$, and produces an intermediate
latent vector ${\bf w}=f({\bf z})$. This vector is then specialized by learned
affine transformations $A$ to style variables ${\bf y}$, which control
adaptive instance normalization operations after each convolutional layer of
the synthesis network $g$. Noise inputs are single-channel images consisting
of un-correlated Gaussian noise that are fed to each layer of the synthesis
network. Learned per-feature scaling factors $B$ are used to generate noise
variables $\boldsymbol{\eta}$ which are added to the output of convolutional
layers. The synthesis network takes style ${\bf y}$ and noise
$\boldsymbol{\eta}$ as input, and generates an image ${\bf x}=g({\bf
y},\boldsymbol{\eta})$. We pass the generated image to a pre-trained
classifier $F$. We seek to slightly modify ${\bf x}$ so that $F$ can no longer
classify it correctly. We achieve this through perturbing the style and noise
tensors. We initialize adversarial style and noise variables as ${\bf
y_{adv}^{(0)}=y}$ and $\boldsymbol{\eta}_{\bf
adv}^{\bf(0)}=\boldsymbol{\eta}$, and iteratively update them in order to fool
the classifier. Loss of the classifier determines the update rule, which in
turn depends on the type of attack. As common in the literature, we consider
two types of attacks: non-targeted and targeted.

In order to generate non-targeted adversarial examples, we need to change the
model’s original prediction. Starting from initial values ${\bf
y_{adv}^{(0)}=y}$ and $\boldsymbol{\eta}_{\bf
adv}^{\bf(0)}=\boldsymbol{\eta}$, we can iteratively perform gradient ascent
in the style and noise spaces of the generator to find values that maximize
the classifier’s loss. Alternatively, as proposed by [24], we can use the
least-likely predicted class $ll_{\bf{x}}=\arg\min(F({\bf x}))$ as our target.
We found this approach more effective in practice. At time step $t$, the
update rule for style and noise variables is:

${\bf{y_{adv}^{(t+1)}}}={\bf
y_{adv}^{(t)}}-\epsilon\cdot\operatorname{sign}(\nabla_{\bf
y_{adv}^{(t)}}J(F(g({\bf y_{adv}^{(t)}},\boldsymbol{\eta}_{\bf
adv}^{\bf(t)})),ll_{\bf x}))$ (1) ${\boldsymbol{\eta}_{\bf
adv}^{\bf(t+1)}}=\boldsymbol{\eta}_{\bf
adv}^{\bf(t)}-\delta\cdot\operatorname{sign}(\nabla_{\boldsymbol{\eta}_{\bf
adv}^{\bf(t)}}J(F(g({\bf y_{adv}^{(t)}},\boldsymbol{\eta}_{\bf
adv}^{\bf(t)})),ll_{\bf x}))$ (2)

in which $J(\cdot,\cdot)$ is the classifier’s loss function, $F(\cdot)$ gives
the probability distribution over classes, ${\bf x}=g({\bf
y},\boldsymbol{\eta})$, and $\epsilon,\delta\in\mathbb{R}$ are step sizes. We
use $(\epsilon,\delta)=(0.004,0.2)$ and $(0.004,0.1)$ for LSUN and CelebA-HQ
respectively. We perform multiple steps of gradient descent (usually 2 to 10)
until the classifier is fooled. We report the average number of iterations
required to fool the classifier in the supplementary material.

Generating targeted adversarial examples is more challenging as we need to
change the prediction to a specific class $T$. In this case, we perform
gradient descent to minimize the classifier’s loss with respect to the target
$T$:

${\bf y_{adv}^{(t+1)}}={\bf
y_{adv}^{(t)}}-\epsilon\cdot\operatorname{sign}(\nabla_{\bf
y_{adv}^{(t)}}J(F(g({\bf y_{adv}^{(t)}},\boldsymbol{\eta}_{\bf
adv}^{\bf(t)})),T))$ (3) ${\boldsymbol{\eta}_{\bf
adv}^{\bf(t+1)}}=\boldsymbol{\eta}_{\bf
adv}^{\bf(t)}-\delta\cdot\operatorname{sign}(\nabla_{\boldsymbol{\eta}_{\bf
adv}^{\bf(t)}}J(F(g({\bf y_{adv}^{(t)}},\boldsymbol{\eta}_{\bf
adv}^{\bf(t)})),T))$ (4)

We use $(\epsilon,\delta)=(0.005,0.2)$ and $(0.004,0.1)$ in the experiments on
LSUN and CelebA-HQ respectively. Note that we only control deviation from the
initial latent variables, and do not impose any norm constraint on generated
images.

The classifier $F$ is adversarially trained with equal number of clean and
adversarial images. To maximize diversity of generated samples, we manipulate
groups of consecutive style and noise layers separately (e.g. layers 1-2, 3-4,
etc.) for experiments on adversarial training. As the training progresses, the
classifier observes a variety of examples and becomes more robust to input
variations. Hence, the generator needs to explore new areas of the natural
image manifold that correspond to generalization errors of the classifier.
Since our model allows both coarse and fine changes, it results in superior
generalization performance compared to existing works on adversarial training
that only manipulate a low-level aspect of images.

Figure 2: Semantic segmentation and object detection architecture. Adversarial
parameters $\gamma_{adv}$ and $\beta_{adv}$ are initialized with $\gamma$ and
$\beta$, and iteratively updated to fool the segmentation or detection model
$G$. The model $G$ is adversarially trained with clean and adversarial
examples.

####  3.1.1 Input-conditioned Generation

Generation can also be conditioned on real input images by embedding them into
the latent space of Style-GAN. We first synthesize images similar to the given
input image $I$ by optimizing values of ${\bf y}$ and $\boldsymbol{\eta}$ such
that $g({\bf y},{\boldsymbol{\eta}})$ is close to $I$. More specifically, we
minimize the perceptual distance [20] between $g({\bf y},{\boldsymbol{\eta}})$
and $I$. We can then proceed similar to equations 1–4 to perturb these tensors
and generate the adversarial image. Realism of synthesized images depends on
inference properties of the generative model. In practice, generated images
resemble input images with high fidelity especially for CelebA-HQ images.

###  3.2 Semantic Segmentation and Object Detection

We also consider the task of semantic segmentation and leverage the generative
model proposed by [30]. The model is conditioned on input semantic layouts and
uses SPatially-Adaptive (DE)normalization (SPADE) modules to better preserve
semantic information against common normalization layers. The layout is first
projected onto an embedding space and then convolved to produce the modulation
parameters $\gamma$ and $\beta$. We adversarially modify these parameters with
the goal of fooling a segmentation model. We consider non-targeted attacks
using per-pixel predictions and compute gradient of the loss function with
respect to the modulation parameters with an update rule similar to equations
1 and 2. Figure 2 illustrates the architecture. We consider a similar
architecture for the object detection task except that we pass the generated
image to the detection model and try to increase its loss. Results for this
task are shown in the supplementary material.

##  4 Results and Discussion

We provide qualitative and quantitative results using experiments on LSUN [42]
and CelebA-HQ [22]. LSUN contains 10 scene categories and 20 object
categories. We use all the scene classes as well as two object classes: cars
and cats. We consider this dataset since it is used in Style-GAN, and is well
suited for a classification task. For the scene categories, a 10-way
classifier is trained based on Inception-v3 [34] which achieves an accuracy of
${88.9\%}$ on LSUN’s test set. The two object classes also appear in ImageNet
[11], a richer dataset containing $1000$ categories. Therefore, for
experiments on cars and cats we use an Inception-v3 model trained on ImageNet.
This allows us to explore a broader set of categories in our attacks, and is
particularly helpful for targeted adversarial examples. CelebA-HQ consists of
30,000 face images at $1024\times 1024$ resolution. We consider the gender
classification task, and use the classifier provided by [23]. This is a binary
task for which targeted and non-targeted attacks are similar.

(a) Non-targeted

(b) Targeted

Figure 3: Unrestricted adversarial examples on LSUN for a) non-targeted and b)
targeted attacks. Predicted classes are shown under each image.

In order to synthesize a variety of adversarial examples, we use different
random seeds in Style-GAN to obtain various values for ${\bf z},{\bf w},{\bf
y}$ and $\boldsymbol{\eta}$. Style-based adversarial examples are generated by
initializing ${\bf y_{adv}}$ with the value of ${\bf y}$, and iteratively
updating it as in equation 1 (or 3) until the resulting image $g({\bf y}_{\bf
adv},\boldsymbol{\eta})$ fools the classifier $F$. Noise-based adversarial
examples are created similarly using $\boldsymbol{\eta}_{\bf adv}$ and the
update rule in equation 2 (or 4). While using different step sizes makes a
fair comparison difficult, we generally found it easier to fool the model by
manipulating the noise variables. We can also combine the effect of style and
noise by simultaneously updating ${\bf y}_{\bf adv}$ and
$\boldsymbol{\eta}_{\bf adv}$ in each iteration, and feeding $g({\bf y}_{\bf
adv},\boldsymbol{\eta}_{\bf adv})$ to the classifier. In this case, the effect
of style usually dominates since it creates coarser changes.

Figure 4: Input-conditioned adversarial examples on CelebA-HQ gender
classification. From top to bottom: input, generated and style-based images.
Males are classified as females and vice versa.  Figure 5: Unrestricted
adversarial examples for semantic segmentation. Generated images,
corresponding predictions and their accuracy (ratio of correctly predicted
pixels) are shown for different number of iterations.

Figure 3 illustrates generated adversarial examples on LSUN. Original images
$g({\bf y},\boldsymbol{\eta})$, noise-based images $g({\bf
y},\boldsymbol{\eta}_{\bf adv})$ and style-based images $g({\bf y}_{\bf
adv},\boldsymbol{\eta})$ are shown. Adversarial images look almost
indistinguishable from natural images. Manipulating the noise variable results
in subtle, imperceptible changes. Varying the style leads to coarser changes
such as different colorization, pose changes, and even removing or inserting
objects in the scene. We can also control granularity of changes by selecting
specific layers of the model. Manipulating top layers, corresponding to coarse
spatial resolutions, results in high-level changes. Lower layers, on the other
hand, modify finer details. In the first two columns of Figure 3, we only
modify top 6 layers (out of 18) to generate adversarial images. The middle two
columns change layers 7 to 12, and the last column uses the bottom 6 layers.
We also show results on CelebA-HQ gender classification in the supplementary
material. Figure 4 illustrates adversarial examples conditioned on real input
images using the procedure described in Section 3.1.1. Synthesized images
resemble inputs with high fidelity, and set the initial values in our
optimization process.

We also show results on semantic segmentation in Figure 5 in which we consider
non-targeted attacks on DeepLab-v2 [9] with a generator trained on the COCO-
stuff dataset [7]. We iteratively modify modulation parameters at all layers,
using a step size of $0.001$, to maximize the segmentation loss with respect
to the given label map. As we observe, subtle modifications to images lead to
large drops in accuracy.  Object detection results and additional examples are
provided in the supplementary material.

| Classification (LSUN) | Classification (CelebA-HQ) | Segmentation | Detection
---|---|---|---|---
| Clean |  Adversarial | Clean | Adversarial |  Clean | Adversarial | Clean |  Adversarial
Adv. Trained | 89.5% |  78.4% | 96.2% | 83.6% |  69.1% | 60.2% | 40.2% |  33.7%
Original | 88.9% |  0.0% | 95.7% | 0.0% |  67.9% | 2.7% | 39.0% |  2.0%
Table 1: Performance of adversarially trained and original models on clean and adversarial test images. Accuracy is shown for classification and segmentation, and Average Precision is shown for object detection.  Model | Attack | Mean
---|---|---
| Clean |  GAT | PGD | Spatial | Recolor | Perceptual |
GAT (Ours) | 89.5% |  78.4% | 39.4% | 47.8% | 52.3% | 28.9% | 42.1%
AT PGD [28] | 81.2% |  6.3% | 56.7% | 5.1% | 37.9% | 2.8% | 13.0%
AT AdvProp [38] | 89.4% |  7.8% | 57.6% | 6.0% | 38.5% | 3.5% | 22.7%
AT Spatial [37] | 76.3% |  5.4% | 3.1% | 66.0% | 4.1% | 2.2% | 3.7%
AT Recolor [25] | 88.6% |  4.7% | 7.3% | 0.4% | 60.7% | 1.7% | 3.5%
PAT [26] | 72.4% |  18.3% | 40.1% | 46.3% | 42.5% | 30.1% | 36.5%
Table 2: Accuracy of adversarially trained models against various attacks on
the LSUN dataset. The mean accuracy of models on unseen attacks is shown in
the last column.

###  4.1 Adversarial Training

Adversarial training increases robustness of models by injecting adversarial
examples into training data. Adversarial training with norm-bounded examples
degrades performance of the classifier on clean images as they have different
underlying distributions. We show that adversarial training with our
unrestricted examples improves the model’s accuracy on clean test images as
well as out-of-domain samples. To ensure that the model maximally benefits
from these additional samples, we need to avoid unrealistic examples which do
not resemble natural images. Therefore, we only include samples that can fool
the model in less than a specific number of iterations. We use a threshold of
$10$ as the maximum number of iterations, and demonstrate results on
classification, semantic segmentation and object detection111In the
supplementary material we show that limiting the number of iterations for
norm-bounded perturbations is not effective for avoiding the accuracy drop on
clean images.. We use the first $10$ generated examples for each starting
image in the segmentation and detection tasks. Table 1 shows accuracy of the
strengthened and original classifiers on clean and adversarial test images.
For the segmentation and detection tasks we report the mean accuracy and
average precision of adversarial images at iteration $10$. Similar to norm-
constrained perturbations, adversarial training is an effective defense
against our unrestricted attacks. Note that accuracy of the model on clean
test images is improved after adversarial training. This is in contrast to
training with norm-bounded adversarial inputs which hurts the classifier’s
performance on clean images, and it is due to the fact that unlike
perturbation-based inputs, our generated images live on the manifold of
realistic images as constrained by the generative model.

We also evaluate the adversarially trained model against various unforeseen
attacks to demonstrate generalizable robustness of the model. We consider
several attacks including recoloring [19, 25], spatial transformations [37],
perceptual [26] and additive perturbations [28]. Results are shown in Table 2,
and are compared against other defense methods such as Adversarial Training
with PGD (AT PGD) [28], AT Spatial [37], AT Recolor [25], PAT [26] and AT
AdvProp [38]. We observe that our adversarially trained model achieves
superior robustness to these attacks. Unlike other methods which create a low-
level change for each image, our approach generates a spectrum of low-level,
mid-level and high-level changes around each sample, resulting in superior
generalization to a variety of attacks without being trained against them. We
also evaluate our attack against a certified defense in the supplementary
material.

Finally, we examine performance of the model on out-of-domain samples. We
train a binary classifier on the two object classes of LSUN, i.e. cars and
cats. We then evaluate the model on test samples from LSUN and ImageNet. Since
several ImageNet classes represent cars and cats, we group all the relevant
categories. Table 3 demonstrates the results for regular and adversarially
trained models. We observe that adversarial training with our examples
improves generalization power of the model to LSUN test images as well as
ImageNet out-of-domain samples.

| LSUN |  ImageNet
---|---|---
Adv. Trained | 94.7% |  92.0%
Original | 94.2% |  91.4%
Table 3: Generalization of the models to in-domain (LSUN) and out-of-domain
(ImageNet) samples.

###  4.2 User Study

Norm-constrained attacks provide visual realism by $L_{p}$ proximity to a real
input. To verify that our unrestricted adversarial examples are realistic and
correctly classified by an oracle, we perform human evaluation using Amazon
Mechanical Turk. In the first experiment, each adversarial image is assigned
to three workers, and their majority vote is considered as the label. The user
interface for each worker contains nine images, and shows possible labels to
choose from. We use $2400$ noise-based and $2400$ style-based adversarial
images from the LSUN dataset, containing $200$ samples from each class ($10$
scene classes and $2$ object classes). The results indicate that $99.2\%$ of
workers’ majority votes match the ground-truth labels. This number is
${98.7\%}$ for style-based adversarial examples and ${99.7\%}$ for noise-based
ones. As we observe in Figure 3, noise-based examples do not deviate much from
the original image, resulting in easier prediction by a human observer. On the
other hand, style-based images show coarser changes, which in a few cases
result in unrecognizable images or false predictions by the workers.

We use a similar setup in the second experiment but for classifying real
versus fake (generated). We also include $2400$ real images as well as $2400$
unperturbed images generated by Style-GAN. ${74.7}\%$ of unperturbed images
are labeled by workers as real. This number is ${74.3}\%$ for noise-based
adversarial examples and ${70.8\%}$ for style-based ones, indicating less than
${4\%}$ drop compared with unperturbed images generated by Style-GAN.

##  5 Conclusion and Future Work

Existing works on adversarial defense assume a known threat model in advance.
Therefore, adversaries can easily circumvent these defenses by using different
types of attacks. This raises the need for defenses that are robust against
unforeseen threat models. To this end, we incorporate diversity and realism in
the examples used in adversarial training to bridge the distribution gap
between real and adversarial examples. We leverage state-of-the-art generative
models with disentangled representations which enable a range of low-level to
high-level adversarial changes without leaving the manifold of natural images.
We demonstrate results on classification, segmentation and object detection
tasks. We consider extending the model to other tasks and evaluating it
against new threat models in the future.

## References

  * [1] Rima Alaifari, Giovanni S Alberti, and Tandri Gauksson.  Adef: An iterative algorithm to construct adversarial deformations.  arXiv preprint arXiv:1804.07729, 2018.
  * [2] Michael A Alcorn, Qi Li, Zhitao Gong, Chengfei Wang, Long Mai, Wei-Shinn Ku, and Anh Nguyen.  Strike (with) a pose: Neural networks are easily fooled by strange poses of familiar objects.  arXiv preprint arXiv:1811.11553, 2018.
  * [3] Anish Athalye, Nicholas Carlini, and David Wagner.  Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples.  arXiv preprint arXiv:1802.00420, 2018.
  * [4] Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and David A Forsyth.  Unrestricted adversarial examples via semantic manipulation.  arXiv preprint arXiv:1904.06347, 2019.
  * [5] Tom B Brown, Nicholas Carlini, Chiyuan Zhang, Catherine Olsson, Paul Christiano, and Ian Goodfellow.  Unrestricted adversarial examples.  arXiv preprint arXiv:1809.08352, 2018.
  * [6] Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer.  Adversarial patch.  arXiv preprint arXiv:1712.09665, 2017.
  * [7] Holger Caesar, Jasper Uijlings, and Vittorio Ferrari.  Coco-stuff: Thing and stuff classes in context.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 1209–1218, 2018.
  * [8] Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks.  In 2017 IEEE Symposium on Security and Privacy (SP), pages 39–57. IEEE, 2017.
  * [9] Liang-Chieh Chen, George Papandreou, Iasonas Kokkinos, Kevin Murphy, and Alan L Yuille.  Deeplab: Semantic image segmentation with deep convolutional nets, atrous convolution, and fully connected crfs.  IEEE transactions on pattern analysis and machine intelligence, 40(4):834–848, 2017.
  * [10] Jeremy M Cohen, Elan Rosenfeld, and J Zico Kolter.  Certified adversarial robustness via randomized smoothing.  arXiv preprint arXiv:1902.02918, 2019.
  * [11] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.  Imagenet: A large-scale hierarchical image database.  In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009.
  * [12] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li.  Boosting adversarial attacks with momentum.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 9185–9193, 2018.
  * [13] Isaac Dunn, Laura Hanu, Hadrien Pouget, Daniel Kroening, and Tom Melham.  Evaluating robustness to context-sensitive feature perturbations of different granularities.  arXiv preprint arXiv:2001.11055, 2020.
  * [14] Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry.  A rotation and a translation suffice: Fooling cnns with simple transformations.  arXiv preprint arXiv:1712.02779, 2017.
  * [15] Roger Fletcher.  Practical methods of optimization.  John Wiley & Sons, 2013.
  * [16] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572, 2014.
  * [17] Sven Gowal, Chongli Qin, Po-Sen Huang, Taylan Cemgil, Krishnamurthy Dvijotham, Timothy Mann, and Pushmeet Kohli.  Achieving robustness in the wild via adversarial mixing with disentangled representations.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1211–1220, 2020.
  * [18] Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten.  Countering adversarial images using input transformations.  arXiv preprint arXiv:1711.00117, 2017.
  * [19] Hossein Hosseini and Radha Poovendran.  Semantic adversarial examples.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pages 1614–1619, 2018.
  * [20] Justin Johnson, Alexandre Alahi, and Li Fei-Fei.  Perceptual losses for real-time style transfer and super-resolution.  In European conference on computer vision, pages 694–711. Springer, 2016.
  * [21] Harini Kannan, Alexey Kurakin, and Ian Goodfellow.  Adversarial logit pairing.  arXiv preprint arXiv:1803.06373, 2018.
  * [22] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen.  Progressive growing of gans for improved quality, stability, and variation.  arXiv preprint arXiv:1710.10196, 2017.
  * [23] Tero Karras, Samuli Laine, and Timo Aila.  A style-based generator architecture for generative adversarial networks.  arXiv preprint arXiv:1812.04948, 2018.
  * [24] Alexey Kurakin, Ian Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  arXiv preprint arXiv:1607.02533, 2016.
  * [25] Cassidy Laidlaw and Soheil Feizi.  Functional adversarial attacks.  arXiv preprint arXiv:1906.00001, 2019.
  * [26] Cassidy Laidlaw, Sahil Singla, and Soheil Feizi.  Perceptual adversarial robustness: Defense against unseen threat models.  arXiv preprint arXiv:2006.12655, 2020.
  * [27] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu.  Defense against adversarial attacks using high-level representation guided denoiser.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 1778–1787, 2018.
  * [28] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  arXiv preprint arXiv:1706.06083, 2017.
  * [29] Augustus Odena, Christopher Olah, and Jonathon Shlens.  Conditional image synthesis with auxiliary classifier gans.  In Proceedings of the 34th International Conference on Machine Learning-Volume 70, pages 2642–2651. JMLR. org, 2017.
  * [30] Taesung Park, Ming-Yu Liu, Ting-Chun Wang, and Jun-Yan Zhu.  Semantic image synthesis with spatially-adaptive normalization.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 2337–2346, 2019.
  * [31] Pouya Samangouei, Maya Kabkab, and Rama Chellappa.  Defense-gan: Protecting classifiers against adversarial attacks using generative models.  arXiv preprint arXiv:1805.06605, 2018.
  * [32] Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon.  Constructing unrestricted adversarial examples with generative models.  In Advances in Neural Information Processing Systems, pages 8312–8323, 2018.
  * [33] David Stutz, Matthias Hein, and Bernt Schiele.  Disentangling adversarial robustness and generalization.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 6976–6987, 2019.
  * [34] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna.  Rethinking the inception architecture for computer vision.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2818–2826, 2016.
  * [35] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  arXiv preprint arXiv:1312.6199, 2013.
  * [36] Jonathan Uesato, Brendan O’Donoghue, Aaron van den Oord, and Pushmeet Kohli.  Adversarial risk and the dangers of evaluating against weak attacks.  arXiv preprint arXiv:1802.05666, 2018.
  * [37] Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song.  Spatially transformed adversarial examples.  In International Conference on Learning Representations, 2018.
  * [38] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le.  Adversarial examples improve image recognition.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 819–828, 2020.
  * [39] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille.  Mitigating adversarial effects through randomization.  arXiv preprint arXiv:1711.01991, 2017.
  * [40] Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan Yuille, and Kaiming He.  Feature denoising for improving adversarial robustness.  arXiv preprint arXiv:1812.03411, 2018.
  * [41] Qiuling Xu, Guanhong Tao, Siyuan Cheng, Lin Tan, and Xiangyu Zhang.  Towards feature space adversarial attack.  arXiv preprint arXiv:2004.12385, 2020.
  * [42] Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao.  Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop.  arXiv preprint arXiv:1506.03365, 2015.
  * [43] Xiaohui Zeng, Chenxi Liu, Yu-Siang Wang, Weichao Qiu, Lingxi Xie, Yu-Wing Tai, Chi-Keung Tang, and Alan L Yuille.  Adversarial attacks beyond the image space.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4302–4311, 2019.

Supplementary Material: Robustness and Generalization via Generative
Adversarial Training

##  6 Comparison with Song et al. [32]

We show that adversarial training with examples generated by [33] hurts the
classifier’s performance on clean images. Table 4 demonstrates the results. We
use the same classifier architectures as [32] and consider their basic attack.
We observe that the test accuracy on clean images drops by $1.3\%$, $1.4\%$
and $1.1\%$ on MNIST, SVHN and CelebA respectively. As we show in Table 1 of
the main paper training with our examples improves the accuracy, demonstrating
difference of our approach with that of [32].

| MNIST | SVHN | CelebA
---|---|---|---
| Clean |  Adversarial | Clean | Adversarial |  Clean | Adversarial
Adv. Trained | 98.2% |  84.5% | 96.4% | 86.4% |  96.9% | 85.9%
Original | 99.5% |  12.8% | 97.8% | 14.9% |  98.0% | 16.2%
Table 4: Accuracy of adversarially trained and original models on clean and
adversarial test images from [32].

To further illustrate and compare distributions of real and adversarial
images, we use a pre-trained VGG network to extract features of each image
from CelebA-HQ, our adversarial examples, and those of [32], and then plot
them with t-SNE embeddings as shown in Figure 6. We can see that the
embeddings of CelebA-HQ real and our adversarial images are blended while
those of CelebA-HQ and Song et al.’s adversarial examples are more segregated.
This again provides evidence that our adversarial images stay closer to the
original manifold and hence could be more useful as adversarial training data.

|
---|---
Figure 6: t-SNE plot comparing distributions of real images with adversarial
examples from our approach and Song et al.

##  7 Number of Iterations

To make sure the iterative process always converges in a reasonable number of
steps, we measure the number of updates required to fool the classifier on
$1000$ randomly-selected images. Results are shown in Table 5. Note that for
targeted attacks we first randomly sample a target class different from the
ground-truth label for each image.

| LSUN | CelebA-HQ
---|---|---
| Targeted |  Non-targeted |
Style-based | ${9.1\pm 4.2}$ |  ${6.8\pm 3.6}$ | $7.3\pm 3.0$
Noise-based | $4.5\pm 1.7$ |  ${3.7\pm 1.8}$ | $6.2\pm 4.1$
Table 5: Average number of iterations (mean $\pm$ std) required to fool the
classifier.

##  8 Evaluation on Certified Defenses

Adversaries can circumvent defenses tailored for a specific type of attack by
using new threat models. To demonstrate this, we evaluate our attack on a
certified defense against norm-bounded perturbations. Cohen et al. [10]
propose a certified defense using randomized smoothing with Gaussian noise,
which guarantees a certain top-1 accuracy for perturbations with $L_{2}$ norm
less than a specific threshold. We use ${400}$ noise-based and ${400}$ style-
based adversarial images from the object categories of LSUN. Our adversarial
examples are evaluated against a randomized smoothing classifier based on
ResNet-50 using Gaussian noise with standard deviation of $0.5$. Table 6 shows
accuracy of the model on clean and adversarial images. As we observe, the
accuracy drops on adversarial inputs, and the certified defense is not
effective against our attack. Note that we stop updating adversarial images as
soon as the model is fooled. If we keep updating for more iterations
afterwards, we can achieve even stronger attacks.

| Accuracy
---|---
Clean | 63.1%
Adversarial (style) | 21.7%
Adversarial (noise) | 37.8%
Table 6: Accuracy of a certified classifier equipped with randomized smoothing
on our adversarial images.

##  9 Object Detection Results

Figure 7 illustrates results on the object detection task using the RetinaNet
target model [28]. We observe that small changes in the images lead to
incorrect bounding boxes and predictions by the model.

Figure 7: Unrestricted adversarial examples for object detection. Generated
images and their corresponding predictions are shown for different number of
iterations.

##  10 Impact of $\gamma$ and $\beta$ on Semantic Segmentation

In segmentation results shown in Figure 10 we simultaneously modify both
$\gamma$ and $\beta$ parameters of the SPADE module. We can also consider the
impact of modifying each parameter separately. Figure 8 illustrates the
results. As we observe, changing $\gamma$ and $\beta$ modifies fine details of
the images which are barely perceptible yet they lead to large changes in
predictions of the segmentation model.

##  11 Experiments on other datasets

While we show results on the categories that StyleGAN is originally trained
on, our approach and StyleGAN can also be trained on other datasets such as
CIFAR and ImageNet222Implementations of StyleGAN2 and StyleGAN2-ADA on CIFAR
and ImageNet are provided in https://github.com/justinpinkney/awesome-
pretrained-stylegan2 and https://github.com/NVlabs/stylegan2-ada. We provide
results on the CIFAR-10 dataset in the following using the Wide ResNet
classifier:

| Clean | Adversarial
---|---|---
Adv. Trained | 96.5% | 76.4%
Original | 96.1% | 0.0%

##  12 Adversarial Changes to Single Images

Figure 9 illustrates how images vary as we manipulate specific layers of the
network. We observe that each set of layers creates different adversarial
changes. For instance, layers 12 to 18 mainly change low-level color details.

Figure 8: Impact of separately modifying $\gamma$ and $\beta$ parameters on
segmentation results. Modified images at different iterations and
corresponding predictions are shown. In the first two rows only the $\gamma$
values are changed and in the last two rows only the $\beta$ values are
modified.  Figure 9: Impact of manipulating different layers of the network on
generated adversarial images.

##  13 Adversarial Training with Norm-bounded Perturbations

We consider adversarial training with norm-bounded perturbations and limit the
number of iterations to make the setup comparable with our unrestricted
adversarial training. Specifically, we use Iterative-FGSM with $\epsilon=4$
and a bounded number of steps. Results are shown in Table 7. Note that
accuracy of the models drop on clean images although we use a weak attack.
This is in contrast to training with our unrestricted adversarial examples
that improves the accuracy.

|  | IFGSM-2 | IFGSM-5
---|---|---|---
| Original |  Adv. Trained | Adv. Trained
LSUN | 88.9% |  88.4% | 87.8%
CelebA-HQ | 95.7% |  95.1% | 94.6%
Table 7: Adversarial Training with norm-bounded perturbations. Iterative-FGSM
($\epsilon=4$) with a maximum of 2 and 5 iterations is considered, and
accuracy of the adversarially trained and original models on clean test images
are shown.

##  14 Additional Examples

We also provide additional examples and higher-resolution images in the
following. Figure 10 depicts additional examples on the segmentation task.
Figure 11 illustrates adversarial examples on CelebA-HQ gender classification,
and Figure 12 shows additional examples on the LSUN dataset. Higher-resolution
versions for some of the adversarial images are shown in Figure 14, which
particularly helps to distinguish subtle differences between original and
noise-based images.

Figure 10: Unrestricted adversarial examples for semantic segmentation.
Generated images, corresponding predictions and their accuracy (ratio of
correctly predicted pixels) are shown for different number of iterations.
Figure 11: Unrestricted adversarial examples on CelebA-HQ gender
classification. From top to bottom: Original, noise-based and style-based
adversarial images. Males are classified as females and vice versa.

(a) Non-targeted

(b) Targeted

Figure 12: Unrestricted adversarial examples on LSUN for a) non-targeted and
b) targeted attacks. From top to bottom: original, noise-based and style-based
images.

Figure 13: High resolution versions of adversarial images. From left to right:
original, noise-based and style-based images.

Figure 14: (cont.) High resolution versions of adversarial examples. From left
to right: original, noise-based and style-based images.