# New measurement of the diffusion of carbon dioxide on non-porous amorphous
solid water

Jiao Hea, Paula Caroline Pérez Rickerta,b, Tushar Suhasariaa, Orianne
Sohiera,c, Tia Bäckera,d, Dimitra Demertzia,e, Gianfranco Vidalif and Thomas
K. Henninga Corresponding author Jiao He, Email<EMAIL_ADDRESS>aMax Planck
Institute for Astronomy, Königstuhl 17, D-69117 Heidelberg, Germany;
bDepartment for Physics and Astronomy, Heidelberg University, 69120
Heidelberg, Germany; cDépartement de chimie, École normale supérieure, PSL
University, 75005 Paris, France; dPhysics Department, University of Helsinki,
Helsinki, 00560, Finland; eInstitute for Molecules and Materials, Radboud
University, Nijmegen 6525 AJ, Netherlands; fPhysics Department, Syracuse
University, Syracuse, NY 13244, USA;

###### Abstract

The diffusion of molecules on interstellar grain surfaces is one of the most
important driving forces for the molecular complexity in the interstellar
medium. Due to the lack of laboratory measurements, astrochemical modeling of
grain surface processes usually assumes a constant ratio between the diffusion
energy barrier and the desorption energy. This over-simplification inevitably
causes large uncertainty in model predictions. We present a new measurement of
the diffusion of CO2 molecules on the surface of non-porous amorphous solid
water (np-ASW), an analog of the ice mantle that covers cosmic dust grains. A
small coverage of CO2 was deposited onto an np-ASW surface at 40 K, the
subsequent warming of the ice activated the diffusion of CO2 molecules, and a
transition from isolated CO2 to CO2 clusters was seen in the infrared spectra.
To obtain the diffusion energy barrier and pre-exponential factor
simultaneously, a set of isothermal experiments were carried out. The values
for the diffusion energy barrier and pre-exponential factor were found to be
$1300\pm 110$ K and $10^{7.6\pm 0.8}$ s-1. A comparison with prior laboratory
measurements on diffusion is discussed.

###### keywords:

ISM; diffusion; molecules; astrochemistry; solid state; carbon dioxide

##  1 Introduction

Dust grains in molecular clouds are covered by an ice mantle consisting of
H2O, CO2, CO, NH3, CH4, and CH3OH[1]. Other molecules, particularly complex
organic molecules, which are defined in the astronomy context as carbon-
containing molecules with at least six atoms, should also be present in the
ice[2]. Various laboratory experiments and astrochemical modeling suggest that
most of these molecules are formed by chemical reactions in the solid state
rather than formed in the gas phase and then condensed on the grain
surface[2]. After their formation, they may desorb, either thermally or non-
thermally, and return to the gas phase and be identified by radio telescopes.

One of the most important mechanisms for chemical reactions on grain surfaces
is diffusion. Reactants on the surface need to diffuse in order to encounter
the reaction counterparts. There are two types of diffusion, quantum
diffusion, which is only important for very light species such as hydrogen,
and thermal diffusion, which is relevant for almost all reactants. In most
gas-grain astrochemical models, thermal diffusion is the dominant pathway to
chemical reactions on grains[3, 4], although in recent years the role of
thermal diffusion has been challenged and non-diffusive mechanisms have been
proposed as well to account for the formation of complex organic molecules in
interstellar ices[5, 6, 7, 8, 9].

Thermal diffusion is normally described by an Arrhenius equation with two
parameters, the pre-exponential factor $\nu_{\rm dif}$, and the diffusion
energy barrier $E_{\rm dif}$. The goal of laboratory experiments on diffusion
is to quantify $E_{\rm dif}$ and $\nu_{\rm dif}$ for various atoms, radicals,
and molecules on representative dust grain surfaces, such as water ice,
silicate, or carbonaceous surfaces. Diffusion of reactants on silicate and
carbonaceous surfaces is only important before the dust grains are covered by
an ice layer. Once water starts to form on the bare grain surface, subsequent
condensation of particles happens on top of the ice surface dominated by H2O.
Most of the existing laboratory experiments on diffusion focused on amorphous
water ice, i.e., the so-called amorphous solid water (ASW), which is the
dominant form of water ice on the grain surface. This current study also
focuses on the diffusion on ASW surface.

Several laboratory experimental studies focused on the diffusion of molecules
on the surface of ASW, either on the outer surface of non-porous ASW (np-ASW)
or through the inner pores of porous ASW (p-ASW). Zubkov et al. [10] deposited
N2 on ASW of different thicknesses and performed temperature-programmed
desorption (TPD) experiments, from which they obtained $E_{\rm dif}=890$ K and
$\nu_{\rm dif}=9\times 10^{7}$–$4\times 10^{8}$ s-1, respectively. Mispelaer
et al. [11] presented one of the first systematic experimental studies on the
diffusion of astro-relevant molecules in p-ASW. They covered the target
molecule with ASW layers, and then warmed up the ice to a temperature at which
the target molecules start to penetrate through the p-ASW and desorb from the
ice. By monitoring the remaining amount of target molecules in the ice, they
were able to quantify the diffusion rate through the pores. Though it is an
important step ahead, it still has some limitations: (1) The diffusion might
have already started even during the growth of the ASW layers, and it is not
accurate to treat the beginning of the isotherm as the beginning of the
diffusion process; (2) The structure of the ASW might be changing during the
diffusion/desorption, since no annealing was done to stabilize the structure;
(3) The effect of diffusion and desorption are mixed and very difficult to
separate, therefore introducing large uncertainty; (4) Based on the design of
the experiment, only a narrow temperature range can be explored, and the
accuracy in diffusion energy barrier determination is limited. More recently,
Maté et al. [12] used a similar approach to measure the diffusion rate of CH4
in ASW, and therefore inherited the same advantages and drawbacks.

Lauck et al. [13] measured the diffusion of CO in p-ASW. In their experiments,
CO and water were deposited at 12 K. Then the ice was flash heated to a
temperature between 15 and 23 K for isothermal experiments. They used the fact
that pure CO and CO mixed with water ice has different infrared absorption
peak shapes to trace the diffusion of CO in porous water ice. Pure CO ice has
a sharp peak centered at about 2139 cm-1, while the mixture of CO and ASW has
two peaks at 2139 and 2152 cm-1, respectively. As diffusion goes on, there is
a gradual transition from pure CO to a mixture of CO and water. Therefore, the
diffusion rate can be calculated from the time evolution of this transition.
Compared to Mispelaer et al., Lauck et al. solved the problem of a limited
temperature span, and the problem with desorption. However, the method by
Lauck et al. suffers from an unstable ice structure during the diffusion
process, and this method only works for CO diffusion on ASW.

He et al. (2017) [14] (referred to as He17 later) measured the diffusion of
CO2 on np-ASW. Discrete CO2 molecules and CO2 clusters have different infrared
absorption peaks. With less than a monolayer of CO2 present on the surface,
when the surface temperature increases, CO2 diffuses and forms clusters.
Therefore, there is a transition from discrete CO2 to CO2 clusters which is
observable in infrared measurement. By using a rate equation model to simulate
the diffusion process and to fit the experimental data, the diffusion energy
barrier was calculated to be 2100 K. It has to be noted that in this study,
the prefactor was assumed to be $10^{12}$ s-1, as is customarily done in these
studies. If a different prefactor is assumed, the diffusion energy value would
be different. It is important to determine both the prefactor and the
diffusion energy value simultaneously. An energy value without the correct
prefactor could be in error.

Kouchi et al. (2020) [15] used a transmission electron microscope (TEM) to
measure the diffusion energy barrier of CO and CO2 on p-ASW. This is the first
attempt to use the TEM technique to measure the diffusion of astro-relevant
molecules. In their experiment, they first deposited 10 nm of water ice at 10
K and then deposited, for example CO, while taking TEM scans during
deposition. When the ice is covered by the required amount of CO, and if the
temperature is high enough for the crystallization to proceed[8], crystals of
CO are formed in the ice. They interpreted the forming of crystals as a result
of the diffusion of CO and used the distance between crystals to represent the
average diffusion distance of CO molecules. By analyzing the diffusion
distance at different temperatures, they calculated the diffusion energy
barrier. The study by Kouchi et al. suffers from a few drawbacks: (1) The
interpretation of the experimental result is not intuitive, and alternative
interpretations exist. The observed temperature dependence of crystal distance
may be a result of the temperature dependence of the phase transition of CO
ice. Such alternative interpretations have to be checked before extending this
method to a wider range of systems; (2) The water ice was unstable during the
diffusion and could have affected the experimental results; (3) They could not
determine the prefactor from the experiments; as mentioned above, it is
important to determine both values simultaneously. A similar approach has
recently been applied to a wider range of molecules[16].

He et al. (2018)[17] (referred to as He18 later) designed an experiment to
measure diffusion based on the fact that when a molecule is binding to the
dangling OH (dOH) site of p-ASW, the weak dOH absorption band in the infrared
is red-shifted. In the experiment, porous water ice was grown at 10 K,
stabilized by annealing to 70 K, and then cooled down to 10 K to deposit the
target molecule. Then the ice was warmed to a specific temperature, for
example, 20 K, and infrared spectra were measured continuously to monitor the
shifting of dOH bands. When diffusion happens, a gradient in concentration of
the target molecule is expected in the ice. After a long time, the whole pore
surface is evenly covered by the target molecule, and almost all the dOH is at
the shifted position. This method was applied to molecules including N2, O2,
CO, CH4, and Ar, all of which wet the ASW surface. From the experiments, both
the prefactor and energy barrier for diffusion were obtained. The prefactor
was found to be mostly in the $10^{7}$–$10^{9}$ s-1 range, and the diffusion
energy barrier was roughly 0.3 times the upper bound of the desorption energy
distribution on ASW. Table 1 shows a summary of the above-mentioned
experimental studies and some key aspects of the experiments. The same method
cannot be applied directly to non-wetting molecules such as CO2 [18]. In fact,
we attempted to measure the diffusion of CO2 through p-ASW using the same
method, but found no clear evidence of CO2 penetration into the p-ASW to form
monomers. This is somehow in agreement with prior experimental studies on the
segregation of CO2 from CO2:H2O ice mixtures. Several groups found that by
warming up the mixture of CO2:H2O ice, CO2 tends to segregate and form
clusters or islands, rather than mixing. This indicates that the interaction
force between CO2 molecules is stronger than the interaction force between CO2
and ASW[19, 20, 21]. A TPD study of CO2 on ASW also supports this
argument[14].

Table 1: Summary of a few previous laboratory studies on diffusion. Mi13, La15, He17, He18, Ko20, Ma20 and Fu22 stand for Mispelaer et al. (2013)[11], Lauck et al. (2015)[13], He et al. (2017)[14], He et al. (2018)[17], Kouchi et al. (2020)[15], Mate et al. (2020)[12], and Furuya et al. (2022) [16], respectively. The following aspects are considered: (1) whether desorption interferes with diffusion; (2) whether the water ice is stable during the whole diffusion process; (3) whether it is applicable to IR-inactive molecules; (4) whether both $E_{\rm dif}$ and $\nu_{\rm dif}$ are obtained simultaneously.  | Mi13 | La15 | He17 | He18 | Ko20/Fu22 | Ma20
---|---|---|---|---|---|---
Des. not interfere with dif. | $\times$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$
H2O ice stable during dif. | $\times$ | $\times$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$
Applicable to IR-inactive mol. | $\times$ | $\times$ | $\times$ | $\checkmark$ | $\checkmark$ | $\times$
Both $E_{\rm dif}$ and $\nu_{\rm dif}$ obtained | $\checkmark$ | $\checkmark$ | $\times$ | $\checkmark$ | $\times$ | $\checkmark$

The mixed ice of CO2:H2O had been the focus of a number of experimental
studies because of the presence of such mixture in interstellar ices[22, 23,
24, 19, 20, 25]. However, diffusion of CO2 on ASW surface was not addressed in
those studies. Combining the strengths of both He17 and He18, we perform a new
set of experiments to measure the diffusion rate of CO2 on np-ASW. Isothermal
experiments are carried out at different temperatures and CO2 are allowed to
diffuse and form clusters. We obtain the diffusion energy barrier $E_{\rm
dif}$ and prefactor $\nu_{\rm dif}$ values simultaneously from the
experiments.

##  2 Experimental

###  2.1 Experimental setup

Experiments were performed using an ultra-high vacuum (UHV) setup, which has
been described previously [14, 17, 21]. The setup consists of a main UHV
chamber and two molecular beamlines. In the present study, only the main UHV
chamber was used. The chamber is pumped by a combination of scroll pumps,
turbomolecular pumps, and a cryopump, and a base pressure of $2\times
10^{-10}$ mbar is achieved after bake-out. Located at the center of the
chamber is a gold-plated copper disk, which is used as the substrate onto
which ice samples are grown. The substrate can be cooled down to 6 K using a
closed-cycle helium cryostat, and heated up using a resistive heater. The
temperature was measured using a silicon diode temperature sensor. A Lakeshore
336 temperature controller recorded and controlled the temperature to an
accuracy of 0.05 K. Ice was grown on the substrate by gas/vapor deposition
from the chamber background, following a procedure described in detail in He
et al. (2018) [21]. Two separate computer-controlled leak valves (VAT variable
leak valve 590) were used to deposit H2O and CO2, respectively. The thickness
of the ice in monolayer (ML, defined as 1015 molecules per cm2) was calculated
by integrating the chamber pressure during deposition, assuming the sticking
as unity [26]. The ionization pressure gauge calibration factors for H2O and
CO2 were taken into account in the calculation. Throughout the experiments, a
Thermo Fisher Nicolet 6700 Fourier Transform Infrared Spectrometer (FTIR) in
the Reflection Absorption Infrared Spectroscopy (RAIRS) configuration was used
to monitor the ice composition over time. A spectrum was created by taking an
average of nine scans every 12 seconds.

###  2.2 Experimental procedure

The gold surface was first covered with 30 ML of non-porous amorphous solid
water (np-ASW) by vapor deposition at a rate of 6 ML/minute over 5 minutes
while the substrate was at 130 K. It remained at 130 K for 20 minutes to
stabilize the ice and pump out the residual gas. Subsequently, the substrate
was cooled down to 40 K for CO2 deposition. 0.075 ML of CO2 was deposited on
top of the np-ASW at a deposition rate of 0.1 ML/minute. At 40 K, CO2 does not
diffuse[14], and the coverage is low enough so that almost all the CO2
molecules are monomers. After CO2 deposition, flash heating was applied to
heat the substrate to the desired target temperature ($T_{\rm iso}$) at a ramp
rate of 30 K/minute for the isothermal experiment. During the isothermal
evolution, CO2 molecules diffuse and form clusters. For $T_{\rm iso}>62$ K,
the temperature was held for 30 minutes to allow CO2 to diffuse and form
clusters. For $T_{\rm iso}\leq 62$ K, at which the diffusion is slower, 60
minutes were selected to provide sufficient time for diffusion. After the
isothermal measurement, the sample was heated to 110 K to remove the CO2 ice
and leave the np-ASW intact. By 110 K, there is no CO2 left on the surface, as
evidenced by no signature of CO2 in the RAIRS spectra. The substrate was then
cooled down to 40 K again for the next CO2 deposition. Figure 1 shows the
temperature during one segment of the experiment. Different stages of the
experiment are marked. To minimize human error, we used a LabVIEW program to
regulate the temperature and gas deposition throughout the entire experiment.
We explored the $T_{\rm iso}$ range between 56 and 68 K in 1 K steps.

Figure 1: Temperature of the substrate during one segment of the experiment
(isothermal experiment at 67 K). Different stages of the experiment are
marked.

##  3 Results and analysis

During the isothermal evolution at each temperature, RAIRS spectra are
collected every 12 seconds, and a selection of them is displayed in Figure 2.
At the very beginning of the isothermal evolution, the CO2 absorption profile
shows a single peak at 2330 cm-1, which indicates isolated CO2 molecules,
i.e., monomers, on the surface. This is to be expected given that the coverage
is only 0.075 ML and the likelihood of cluster formation is very low before
the diffusion process kicks in. After a certain period of time, the 2330 cm-1
peak drops and a new peak at $\sim$2355 cm-1, indicative of CO2 clusters [14],
grows over time. This suggests that CO2 is diffusing to form clusters.
Considering the very low coverage of CO2, we assume that the shifting of the
adsorption peak position and the formation of clusters are only governed by
the diffusion of CO2 molecules. The rate of diffusion should be temperature-
dependent. Indeed, the shifting from 2330 to 2355 cm-1 peak is faster at 68 K
than at 58 K. To quantify the rate of diffusion, we use two Gaussian functions
to fit the two peaks and analyze the time and temperature dependence of them.
Figure 2 shows the fitting of selected spectra using the sum of two Gaussian
functions. This fitting is only an approximation, particularly, since the
profile of the 2355 cm-1 peak is not exactly a Gaussian line shape [21].
Furthermore, even if all the CO2 are in the form of clusters or in the form of
bulk CO2, the 2330 cm-1 component is not absent. This is seen in a prior paper
[14], which shows that even if CO2 is allowed to have sufficient diffusion,
both peaks are still present. Nonetheless, the shifting from one peak to the
other still allows us to derive information about the kinetics. Figure 3 shows
the resulting area of the two peaks during the isothermal evolution at each
$T_{\rm iso}$. When the 2330 cm-1 peak area decreases, the 2355 cm-1 peak area
increases, except when the temperature is higher than 67 K, at which the 2355
cm-1 peak also drops. This is because the desorption of CO2 starts when the
temperature is close to $\sim$67 K [14], and the total area of the two peaks
decreases over time. In the other extreme, when the temperature is at 56 K and
the diffusion is too slow, the area of the 2355 cm-1 peak is much noisier than
the rest and is considered less reliable. As a result, for the diffusion
analysis, we only consider the temperature range of 57 to 65 K.

Figure 2: Selected RAIRS spectra in the range of the CO2 $\nu_{3}$ mode during
the isothermal experiment at different temperatures. Each panel depicts the
CO2 absorption peak at various times since the start of an isothermal
experiment. The time and temperature of the isotherm are indicated in the
figure. The black curves represent the experimental data, while the orange
curves represent the fittings made with a sum of two Gaussian functions.
Figure 3: The band areas of the 2330 and 2355 cm-1 components of the CO2
absorption peak during the isothermal evolution at different temperatures.

Next, we use a model to describe the diffusion. Surface diffusion has been
reviewed in previous publications [27, 28]. We refer intereted readers to
those publications. When the concentration of molecules on the substrate
surface is low enough so that the interaction force between them is
negligible, the diffusion of molecules can be analyzed by assuming that they
follow random walk. This type of diffusion is called tracer diffusion or
intrinsic diffusion. On a 2D surface such as the np-ASW in the present study,
CO2 molecules jumps from one adsorption site to the nearest neighbour.
Although the np-ASW surface is by no means a regular periodic surface, for the
sake of simplicity, we still use a 2D lattice to represent it. We have assumed
that 1 ML of CO2 is equivalent to $10^{15}$ molecules per cm2;
correspondingly, the lattice size is $l=3.2$ Å. In the random walk analysis,
diffusion rate $k_{D}(T)$ can be described by an Arrhenius equation:

$k_{D}(T)=\nu_{\rm dif}\exp(\frac{-E_{\rm dif}}{k_{\rm B}T})$ (1)

$E_{\rm dif}$ is the diffusion energy barrier, and $\nu_{\rm dif}$ is the
prefactor for diffusion. In the literature, the prefactor is sometimes
referred to as the attempt frequency. In astronomy, it is a convention to omit
the Boltzmann constant $k_{\rm B}$, and then the diffusion energy barrier has
the unit Kelvin. We denote the time-dependent coverage of CO2 monomers and
dimers as $C_{1}(t)$ and $C_{2}(t)$, respectively. They are unitless variables
defined to be the fraction of absorption sites holding monomers and dimers. In
theory, larger clusters such as trimers should also be considered. However,
due to the low coverage of CO2, the coverage of trimers should be much smaller
than dimers and can be ignored. Once dimers are formed, we assume that they do
not break apart before desorption. This is reasonable assumption, since the
binding force between CO2 molecules is stronger than the binding force between
CO2 and water [14], and CO2 molecules are prone to form clusters on ASW.
Following He et al. (2017)[14], we describe the coverage of monomers and
dimers using the following rate equations:

$\displaystyle\frac{dC_{1}(t)}{dt}$ $\displaystyle=-2C_{1}(t)^{2}k_{D}(T)$ (2)
$\displaystyle\frac{dC_{2}(t)}{dt}$ $\displaystyle=C_{1}(t)^{2}k_{D}(T)$ (3)

Note that both the left and the right sides of the equations have the unit of
s-1, since $C_{1}$ and $C_{2}$ are unitless. The initial condition of the rate
equation is $C_{1}(0)=0.075$ and $C_{2}(0)=0$. Solving the rate equation
analytically, we have:

$C_{1}(t)=\frac{1}{2k_{D}(T)t+\frac{1}{C_{1}(0)}}=\frac{1}{2k_{D}(T)t+13.33}$
(4)

$C_{2}(t)$ can be expressed as $0.5\times(C_{1}(0)-C_{1}(t))$. The next step
is to relate $C_{1}(t)$ and $C_{2}(t)$ to the area of the 2330 and 2355 cm-1
peaks. As discussed above, the 2330 cm-1 peak area is not exactly proportional
to $C_{1}(t)$ because $C_{2}(t)$ also contributes to it. However, it is
reasonable to assume they have a linear relation, that is:

$C_{1}(t)=\frac{a}{2k_{D}(T)t+13.33}+b$ (5)

where $a$ and $b$ are two free parameters. This is then used to fit the curves
in the top panel of Figure 3, and the fitting as well as the corresponding
$k_{D}(T)$ value are shown in Figure 4.

Figure 4: The band area of the 2330 cm-1 component during isothermal
experiment at different temperatures and the fitting using Equation 5. The
best fit $k_{D}$ values are shown in the figure.

The diffusion rate expression in Equation 1 can be rewritten as:

$\log(k_{D}(T))=\log(\nu_{\rm dif})-\frac{E_{\rm dif}}{T}$ (6)

This shows that $\log(k_{D}(T))$ is a linear function of $1/T$ with a slope of
$-E_{\rm dif}$. In Figure 5 we make an Arrhenius-type plot. A linear fitting
of it yields the slope and intercept, from which we obtain the diffusion
energy barrier $E_{\rm dif}=1300\pm 110$ K, and prefactor $\nu_{\rm
dif}=10^{7.6\pm 0.8}$ s-1. In many other studies on diffusion, it is custom to
report the Arrhenius expression of the diffusion constant (units of cm2 s-1)
[27]:

$D=D_{0}\exp(\frac{-E_{\rm dif}}{k_{\rm B}T})$ (7)

$D_{0}$ is often called the diffusivity:

$D_{0}=\exp(\frac{\Delta S_{\rm dif}}{k_{\rm
B}T})\frac{\nu_{0}l^{2}}{4}=\frac{\nu_{\rm dif}l^{2}}{4};$ (8)

where $\Delta S_{dif}$ is the change in entropy between the saddle point and
the adsorption site, and $\nu_{0}$ is the small-amplitude frequency ($\approx
10^{13}$ sec-1) of oscillation of the particle in the adsorption well. In this
case, D0=$10^{-8.0\pm 0.8}$ cm2 s-1.

Figure 5: Arrhenius plot $log(k_{D})$ over $1/T$, where $k_{D}$ is the
diffusion rate, and $T$ is the isotherm temperature. The linear fitting is
shown in orange.

##  4 Discussions

Molecule diffusion is crucial for the chemistry on/in interstellar ice.
However, laboratory measurements of diffusion are lacking, limiting the
accuracy of astrochemical modeling of grain surface processes. The current
study builds on prior studies [14, 17] to measure the diffusion energy barrier
and prefactor for CO2 on np-ASW surface simultaneously. A whole set of
isothermal experiments were carried out to quantify the diffusion rate at
different temperatures, from which the energy barrier and the prefactor for
diffusion were then obtained.

It is worthwhile to compare this study to prior experimental studies. He17
deposited a small coverage of CO2 on np-ASW and warmed up the ice slowly to
monitor the shifting of infrared absorption peaks with increasing temperature.
Because it was only a single measurement, it was not possible to derive the
diffusion energy barrier and the prefactor simultaneously. It was assumed that
the diffusion and desorption prefactor were the same, $\nu_{\rm dif}=\nu_{\rm
des}=10^{12}$ s-1, and based on a rate equation model, the $E_{\rm dif}$ value
was calculated to be $2150\pm 50$ K, which is about 0.96 times the desorption
energy of CO2 from np-ASW surface. The main drawback of He17 is the assumption
that the diffusion and desorption prefactors are equivalent, which is
typically not the case, as demonstrated by He18. Here we recalculate the
$E_{\rm dif}$ value for the experiment that is shown in Fig. 10 of He17, but
replacing the $\nu_{\rm dif}$ value $10^{12}$ s-1 by $10^{7.6}$ s-1 obtained
from the present study. Figure 6 shows the equivalent of Fig. 10 in He17. By
lowering the diffusion prefactor, the diffusion energy barrier is reduced to
$1400\pm 100$ K, which is in agreement with the value obtained by the present
study $1300\pm 110$ K within error allowance.

Figure 6: Recalculation of the diffusion energy barrier for the experiment in
Fig. 10 of He17. The prefactor value $10^{12}$ s-1 is replaced by $10^{7.6}$
s-1. See He17 for more details.

In the present study, we carried out isothermal experiments, similar to what
He18 did, and indeed obtained a diffusion prefactor much lower than
desorption, in agreement with He18. Based on prior studies on diffusion (see a
review in [29]), it is not uncommon to see different diffusion prefactors,
either higher or lower than the one for desorption. This present study, along
with He18, makes a strong case that in astrochemical modeling one should make
a distinction between diffusion prefactor $\nu_{\rm dif}$ and desorption
prefactor $\nu_{\rm des}$. Based on these two studies, we suggest using a
$\nu_{\rm dif}$ value about 3–5 orders of magnitude lower than $\nu_{\rm des}$
in modeling. However, we acknowledge that this is only based on the
measurement of a few volatile molecules on the ASW surface and that exceptions
may be possible for other molecules. More diffusion measurements are required
to confirm it.

Compared to He18, the Arrhenius fitting in Figure 5 has a much larger error,
and correspondingly, the uncertainty of diffusion energy barrier and prefactor
values are larger. At least the following factors contribute to the larger
uncertainty:

  1. 1.

The peak profile of CO2 is more complicated than the dOH profile, as in He18.
One cannot simply attribute the 2330 cm-1 peak exclusively to CO2 monomers. In
our model, we had to simplify the problem by assuming a linear dependence
between the coverage of monomers and the 2330 cm-1 peak area. This could be
one important source of uncertainty.

  2. 2.

We assumed that there is only a single diffusion energy barrier that governs
the formation of clusters. In practice, we cannot exclude the possibility that
more than one activation energy is contributing.

  3. 3.

A Gaussian function does not describe the 2355 cm-1 component exactly. It is
clear in Figure 2 that the fitting of the 2355 cm-1 peak is not ideal.

  4. 4.

Ignoring clusters larger than dimers may also induce some uncertainty.

A prior experimental determination of CO2 on ASW surface was also done by
Kouchi et al. (2020)[15], who reported an energy value of 1500 K, which is
slightly higher than what we found in the present study. This difference could
be due to the uncertainty in the prefactor that is assumed in Kouchi et al.
They were unable to determine the prefactor value simultaneously with the
energy value. It would be interesting to repeat the experiments in Kouchi et
al. at different temperatures and derive the values of both the prefactor and
the energy simultaneously. Karssemeijer & Cuppen (2014)[30] did molecular
dynamics modeling calculation of CO2 diffusion on water ice, and found the
diffusion energy value to be $\sim 1470$ K on a disordered water surface,
which is close to our measured value.

In the present study, we only presented the experiments on np-ASW. Although
the porosity of the ice mantle on interstellar grains is still under debate,
it is probably the case that it is neither highly porous nor completely
compact. It is still relevant to consider the diffusion on the surface of both
p-ASW and np-ASW. We attempted to run experiments similar to He18, i.e.,
tracing the diffusion of CO2 into p-ASW by monitoring the infrared spectra.
Unfortunately, the diffusion of CO2 on p-ASW surface is not efficient enough
to allow entry into the pores. CO2 primarily remains in the top layers as
“pure” CO2. The results are not shown here. Nonetheless, the results on np-ASW
may apply to p-ASW as well. Previous experimental studies [31, 10] have
suggested a similarity between the surface of a np-ASW and the pore surface of
a p-ASW that is annealed to 60 K or above in terms of binding energy
distribution and the fraction of dangling OH groups. The diffusion energy
barrier and prefactor measured from np-ASW are likely to apply to the pore
surface of p-ASW. We suggest that, in general, more experimental work is
needed to measure diffusion on interstellar dust grain analogs.

## Acknowledgement

We dedicate this paper to the memory of Dieter Gerlich, who was a good friend
and colleague of some of us. We acknowledge the support from the European
Research Council under the Horizon 2020 Framework Program via the ERC Advanced
Grant Origins 83 24 28, and from NSF Astronomy & Astrophysics Research Grant
#1615897.

## References

  * [1] A.C.A. Boogert, P.A. Gerakines and D.C.B. Whittet, Annu. Rev. Astron. Astrophys. 53, 541–581 (2015).
  * [2] E. Herbst and E.F. van Dishoeck, Annu. Rev. Astron. Astrophys. 47 (1), 427–480 (2009).
  * [3] R.T. Garrod and E. Herbst, Astron. Astrophys. 457 (3), 927–936 (2006).
  * [4] K. Acharyya, Publ. Astron. Soc. Aust 39, e009 (2022).
  * [5] M. Jin and R.T. Garrod, Astrophys. J., Suppl. Ser. 249 (2), 26 (2020).
  * [6] R.T. Garrod, M. Jin, K.A. Matis, D. Jones, E.R. Willis and E. Herbst, Astrophys. J., Suppl. Ser. 259 (1), 1 (2022).
  * [7] E. Herbst and R.T. Garrod, Frontiers in Astronomy and Space Sciences 8, 209 (2022).
  * [8] J. He, F.E. Toriello, S.M. Emtiaz, T. Henning and G. Vidali, Astrophys. J. Lett. 915 (1), L23 (2021).
  * [9] J. He, S. Góbi, G. Ragupathy, G. Tarczay and T. Henning, Astrophys. J. Lett. 931 (1), L1 (2022).
  * [10] T. Zubkov, R.S. Smith, T.R. Engstrom and B.D. Kay, J. Chem. Phys. 127 (18), 184708 (2007).
  * [11] F. Mispelaer, P. Theulé, H. Aouididi, J. Noble, F. Duvernay, G. Danger, P. Roubin, O. Morata, T. Hasegawa and T. Chiavassa, Astron. Astrophys. 555, A13 (2013).
  * [12] B. Maté, S. Cazaux, M.Á. Satorre, G. Molpeceres, J. Ortigoso, C. Millán and C. Santonja, Astron. Astrophys. 643, A163 (2020).
  * [13] T. Lauck, L. Karssemeijer, K. Shulenberger, M. Rajappan, K.I. Öberg and H.M. Cuppen, Astrophys. J. 801, 118 (2015).
  * [14] J. He, S.M. Emtiaz and G. Vidali, Astrophys. J. 837 (1), 65 (2017).
  * [15] A. Kouchi, K. Furuya, T. Hama, T. Chigai, T. Kozasa and N. Watanabe, Astrophys. J. Lett. 891 (1), L22 (2020).
  * [16] K. Furuya, T. Hama, Y. Oba, A. Kouchi, N. Watanabe and Y. Aikawa, Astrophys. J. Lett. 933 (1), L16 (2022).
  * [17] J. He, S. Emtiaz and G. Vidali, Astrophys. J. 863 (2), 156 (2018).
  * [18] J.A. Noble, E. Congiu, F. Dulieu and H.J. Fraser, Mon. Not. R. Astron. Soc. 421 (1), 768–779 (2012).
  * [19] R. Hodyss, P.V. Johnson, G.E. Orzechowska, J.D. Goguen and I. Kanik, Icarus 194, 836–842 (2008).
  * [20] K.I. Öberg, E.C. Fayolle, H.M. Cuppen, E.F. van Dishoeck and H. Linnartz, Astron. Astrophys. 505, 183–194 (2009).
  * [21] J. He, S. Emtiaz, A. Boogert and G. Vidali, Astrophys. J. 869 (1), 41 (2018).
  * [22] P.A. Gerakines, W.A. Schutte, J.M. Greenberg and E.F. van Dishoeck, Astron. Astrophys. 296, 810 (1995).
  * [23] O. Gálvez, I.K. Ortega, B. Maté, M.A. Moreno, B. Martín-Llorente, V.J. Herrero, R. Escribano and P.J. Gutiérrez, Astron. Astrophys. 472 (2), 691–698 (2007).
  * [24] Ó. Gálvez, B. Maté, V.J. Herrero and R. Escribano, Icarus 197 (2), 599–605 (2008).
  * [25] E.C. Fayolle, K.I. Öberg, H.M. Cuppen, R. Visser and H. Linnartz, Astron. Astrophys. 529, A74 (2011).
  * [26] J. He, K. Acharyya and G. Vidali, Astrophys. J. 823, 56 (2016).
  * [27] T.T. Tsong, Physica A Statistical Mechanics and its Applications 357, 250–281 (2005).
  * [28] G. Antczak and G. Ehrlich, _Surface Diffusion: Metals, Metal Atoms, and Clusters_ (, , 2010).
  * [29] X. Wang, X. Xiao and Z. Zhang, Surf. Sci. 512 (1), L361–L366 (2002).
  * [30] L.J. Karssemeijer and H.M. Cuppen, Astron. Astrophys. 569, A107 (2014).
  * [31] J. He, A.R. Clements, S. Emtiaz, F. Toriello, R.T. Garrod and G. Vidali, Astrophys. J. 878 (2), 94 (2019).


# Robust Deep Learning Models against
Semantic-Preserving Adversarial Attack

1st Dashan Gao*$\dagger$ *These authors contributed equally to this
work.$\dagger$Corresponding author.This paper is accepted by the 2023
International Joint Conference on Neural Networks (IJCNN 2023). Dept. of CSE
HKUST & SUSTech
Hong Kong, China
<EMAIL_ADDRESS>2nd Yunce Zhao* Dept. of CSE
University of Technology, Sydney & SUSTech
Shenzhen, China
<EMAIL_ADDRESS>3rd Yinghua Yao  Dept. of CSE
University of Technology, Sydney & SUSTech
Shenzhen, China
<EMAIL_ADDRESS>4th Zeqi Zhang  Huawei Technologies Co., Ltd.
Shenzhen, China
<EMAIL_ADDRESS>5th Bifei Mao  Huawei Technologies Co., Ltd.
Shenzhen, China
<EMAIL_ADDRESS>6th Xin Yao  Dept. of CSE
SUSTech
Shenzhen, China
<EMAIL_ADDRESS>
###### Abstract

Deep learning models can be fooled by small $l_{p}$-norm adversarial
perturbations and natural perturbations in terms of attributes. Although the
robustness against each perturbation has been explored, it remains a challenge
to address the robustness against joint perturbations effectively. In this
paper, we study the robustness of deep learning models against joint
perturbations by proposing a novel attack mechanism named Semantic-Preserving
Adversarial (SPA) attack, which can then be used to enhance adversarial
training. Specifically, we introduce an attribute manipulator to generate
natural and human-comprehensible perturbations and a noise generator to
generate diverse adversarial noises. Based on such combined noises, we
optimize both the attribute value and the diversity variable to generate
jointly-perturbed samples. For robust training, we adversarially train the
deep learning model against the generated joint perturbations. Empirical
results on four benchmarks show that the SPA attack causes a larger
performance decline with small $l_{\infty}$ norm-ball constraints compared to
existing approaches. Furthermore, our SPA-enhanced training outperforms
existing defense methods against such joint perturbations.

###### Index Terms:

Adversarial Examples, Natural Perturbation, Adversarial Perturbation,
Robustness

##  I Introduction

Figure 1: An illustration of SPA attack. The attribute value $\alpha$ (e.g.,
the extent of smiling) and adversarial diversity variable $\bm{z}$ are jointly
optimized in attribute space and adversarial space to find a valid jointly-
perturbed sample with smaller $l_{p}$-norm adversarial noises $\bm{\delta}$.

Deep neural networks (DNNs) have achieved significant breakthroughs in a
variety of domains and tasks, such as computer vision [1, 2], and natural
language processing [3]. However, DNNs are found to be susceptible to
adversarial samples, which are crafted by adding small adversarial
perturbations to natural samples [4]. Later studies suggested that such
vulnerability of DNNs exists over a wide range of security-sensitive
applications [5], which highlights the significance of building robust deep
learning models.

Robust deep learning aims to make accurate predictions on unseen samples with
perturbations. Adversarial training [6, 4] proves to be a most effective
strategy against adversarial samples [7, 8, 9] and is widely adopted for
building robust deep learning models [10, 11, 12]. The idea of adversarial
training is to train the target model by incorporating adversarial samples.
The adversarial training process mimics adversaries to constantly attack the
target model. And the target model gradually learns to be robust against all
attacks (i.e., adversarial samples) from the adversary. Therefore, it is
essential to find threatening adversarial samples with subtle adversarial
noise, which could effectively cause mis-predictions. This work enhances the
robustness of deep learning models against different perturbations by
proposing a novel and strong attack mechanism for adversarial training.

Although most existing works on adversarial attacks aim to find imperceptible
$l_{p}$-norm adversarial noises, adversarial noises added to data are large to
perceptible in many cases (e.g., $\epsilon=0.3$ for MNIST [13] dataset).
Otherwise, the adversarial attack may fail. Therefore, existing works usually
consider a relatively large size of $l_{p}$ ball to achieve successful
adversarial attacks. This work designs an attack mechanism to find smaller yet
viable adversarial perturbations.

Besides malicious adversarial perturbations, DNNs might also encounter natural
perturbations measured by attributes in the real world. For example, object-
level transforms, such as the degree to which a person smiles, or geometric
transforms, such as the rotation of images, that commonly appear in the real
world are not accounted for by adversarial perturbations. Natural
perturbations along these attributes preserve the semantic classification
information and are thus semantic-preserving. For instance, changing the
extent of smiling of a person in a gender classification task, or changing the
rotation angle of a digit in a digit classification task, generates a natural-
looking image and will not lead to a change of the true class label. Yet,
authors in [14, 15] find that intentional perturbations along these attributes
are also likely to cause model performance to decline. Although such
performance decline is much smaller compared to that of adversarial
perturbations, natural perturbations can be used for attacks. Moreover, it is
shown that the robustness against natural perturbations is independent of
adversarial robustness [16]. That is, classifiers trained with only
adversarial samples are not robust against natural perturbations, and vice
versa. Therefore, we aim to train a target model that is robust against both
types of perturbations.

In this work, we address the robustness against both perturbations by
proposing a novel generator-based adversary named Semantic-Preserving
Adversarial (SPA) attack that generates jointly-perturbed samples. Figure 1
illustrates the idea of the proposed attack. SPA attack maximizes the exposure
of the target model to variations in both attribute space and adversarial
space. The attack framework consists of an attribute manipulator for natural
perturbations and an adversarial noise generator for diverse adversarial
perturbations. By modifying the class-irrelevant attributes of the images, SPA
attack searches semantic-preserving samples that are more vulnerable to
adversarial attacks. Then, SPA attack finds valid adversarial noises under
stringent $l_{p}$ norm-ball constraints by exploring the adversarial diversity
variable. Based on the proposed attack mechanism, we further design a robust
training approach, which addresses a min-max optimization and adversarially
trains the target model against joint perturbations. Empirical studies in
Section V verify the effectiveness of our SPA attack, and demonstrate that our
SPA training can provide superior protection against joint attacks compared to
previous methods.

The major contributions are summarized as follows:

  * •

We present a novel attack mechanism named Semantic-Preserving Adversarial
(SPA) attack that considers the problem of robustness against joint
perturbations in the pixel space as well as a set of specified attributes in
the attribute space.

  * •

We propose SPA training as robust training by solving a min-max optimization
problem and jointly exploring the pixel space and the attribute space in novel
ways without access to the test domain.

  * •

We introduce two surrogate functions for attribute manipulation on two
classical semantic-preserving natural perturbations: geometric transformations
and objective-level transformations.

  * •

We empirically demonstrate the effectiveness of our proposed approach on four
public datasets.

The rest of this paper is organized as follows. We briefly review the related
work in Section II and provide the definition of this problem in Section III.
Then, we introduce our approach for attack and defense in Section IV. Finally,
we discuss the experiment results on MNIST, FashionMNIST, CelebA, and SICAPv2
datasets in Section V.

##  II Related Work

In this section, we investigate the related work on adversarial attacks and
training, attribute robust training, and attribute manipulation.

###  II-A Adversarial Attacks and Training

As a pioneering work, Szegedy et al. [17] initially observed that deep
learning models are vulnerable against imperceptible adversarial
perturbations. While adversarial training could be formulated as a min-max
optimization mathematically, it is a huge challenge to solve the inner
maximization (e.g., the generation of adversarial examples). Goodfellow et al.
[4] proposed Fast Gradient Sign Method (FGSM) to generate adversarial examples
with the sign of gradient in a one-step manner. However, the model trained
with FGSM-generated adversarial examples suffers from catastrophic overfitting
[18, 19]. For further enhancing the strength of attacks, an iterative FGSM
variant Basic Iterative Method (BIM), was proposed in [5]. And CW attack [20]
then took a direct optimization approach to find adversarial samples, which
broke the distillation knowledge defense for the first time. Later, Madry et
al. [6] proposed PGD attack, which is considered to be one of the most
powerful first-order attacks for approximating the optimal value of the inner
maximization problem.

More recently, approaches based on learning-to-learn (L2L) [21, 22, 23] are
proposed to improve adversarial training. L2LDA [24] further introduced a
diversity variable to generate diverse adversarial noises and update the
adversarial noise recursively. Their adversarially trained ResNet was shown to
outperform the ResNets trained by CW, L2L and PGD on CIFAR-10. Such
adversarial attacks perturb the pixel space under $l_{p}$ norm-ball
constraints, yet may fail when the constraints get much more stringent. On the
contrary, we approach the problem of generating jointly-perturbed samples with
smaller adversarial perturbations. Following the literature, we use several
state-of-the-art attacks from CW [20] and L2LDA [24] as our benchmarks.

###  II-B Attribute Robust Training

Recently, there has been an increasing interest in the robustness against
natural perturbations in terms of attributes, which are perceptible shifts in
the data but still are natural-looking, and enough to fool a classifier [25].
Liu et al. [26] proposed to perturb physical parameters that underlay image
formation to produce natural perturbations sensitive to physical concepts like
lighting and geometry. [14] proposed to generate natural perturbations by
modifying multiple specified attributes with a conditional generative model.
[15] proposed to perturb the attribute space to synthesize new images and
maximize the exposure of the classifier to the attributes space. However, such
attacks only cause limited performance decline and do not result in severe
model failure as pixel-level adversarial attacks do [15], especially when few
attributes are valid. Contrary to these approaches, we address the robustness
against both perturbations by considering a novel and powerful attack that
jointly leverages attribute perturbations and adversarial perturbations.

Figure 2: An illustration of the Semantic-Preserving Adversarial (SPA) attack.
The attribute manipulator $h_{\psi}$ and the noise generator $g_{\phi}$
sequentially conduct natural perturbations and adversarial perturbations. The
attribute value $\bm{\alpha}$ (e.g., the extent of smiling) and adversarial
diversity variable $\bm{z}$ are jointly and iteratively optimized to generate
jointly-perturbed samples.

###  II-C Attribute Manipulation

There are various approaches for manipulating attributes in images.
Conditional Generative Adversarial Networks [27] use an encoder-decoder
architecture to learn attribute invariant latent representation and
disentangle attributes for attribute editing. Matrix Subspace Projection (MSP)
[28] is proposed to factorize the latent space for attribute manipulation
effectively. Spatial Transformer Networks (STN) [29] uses a localization net
to conduct precise spatial transformation.

##  III Problem Formulation

We begin by defining a classifier parameterized by $\theta$ as
$f_{\theta}:\mathcal{X}\rightarrow\mathcal{Y}$, where $\mathcal{X}$ denotes
the space of the image data and $\mathcal{Y}$ denotes the label space. Labeled
data $(\bm{x},\bm{\alpha},\bm{y})$, where $\bm{x}$ denotes the input image,
$\bm{\alpha}$ denotes the annotated attribute value, $\bm{y}$ denotes the
class label. Table I summarizes the notions used in this paper.

The objective of this paper is to build a classifier $f_{\theta}$ that is
robust to both 1) adversarial perturbations, which are $l_{\infty}$-bounded in
the pixel space, and 2) natural perturbations along specific attributes
$\bm{\alpha}$ that is specified a priori.

We categorize semantic-preserving natural perturbations into two major types -
(a) Geometric transformations, where images are manipulated by affine
transformations such as rotation, scaling, and shifting. (b) Object-level
transformations, where general attributes of the objects in images are
manipulated without changing the semantic information of the class labels,
such as changing the extent of smiling or hair color of a person in a gender
classification task. Geometric transformations have explicit generative
mechanisms, allowing us to conduct accurate natural perturbations. However, we
do not have access to the true generative mechanisms for objective-level
transformations. Therefore, we need to approximate the objective-level
transformations by training a conditional generative model.

The classification loss of the target classifier $f_{\theta}$ can be defined
as a cross-entropy loss:

$\mathcal{L}(\bm{x},\bm{y};\theta)=\bm{y}^{T}\log f(\bm{x};\theta),$ (1)

where $f(\bm{x};\theta)$ outputs the predicted probabilities for $\bm{x}$. We
simplify the loss as $\mathcal{L}(\bm{x})$ without causing confusion.

This task can be formulated as a min-max optimization of a saddle point
problem:

$\min_{\theta\in\Theta}\mathbb{E}_{(\bm{x},\bm{y})\sim\mathcal{D}}\left[\max_{\tilde{\bm{x}}\in\mathcal{X}_{spa}(\bm{x})}\mathcal{L}(\tilde{\bm{x}},\bm{y};\theta)\right],$
(2)

where $\mathcal{X}_{spa}(\bm{x})$ is a set of admissible attacks of $\bm{x}$
with natural perturbations in the attribute space along the specified
attributes $\bm{\alpha}$ as well as $l_{p}$-bounded adversarial perturbations
in the pixel space.

TABLE I: Notations Notations | Descriptions
---|---
$\bm{x}$ | The input features
$\bm{y}$ | The labels
$\bm{\alpha}$ | The attribute values
$\bm{z}$ | The diversity variable of adversarial noises
$f_{\theta}$ | The classifier parameterized by $\theta$
$g_{\phi}$ | The adversarial noise generator parameterized by $\phi$
$h_{\psi}$ | The attribute manipulator parameterized by $\psi$
$\mathcal{L}$ | The loss function
$\epsilon$ | The $l_{\infty}$ norm of adversarial noise

Eq. 2 solves a min-max optimization problem. The inner maximization aims to
generate jointly-perturbed samples with both perturbations that maximize the
classification loss, and the outer minimization corresponds to finding model
parameters that minimize the loss on jointly-perturbed samples found by the
inner maximization. The success of finding the optimal $\theta^{*}$ that
minimizes Eq. 2 crucially relies on solving the (non-concave) inner
optimization problem. In this work, we focus on the inner maximization problem
of Eq. 2 to achieve robustness against both perturbations. To conduct attacks,
we propose an architecture that generates and effectively optimizes diverse
natural and adversarial perturbations.

##  IV Proposed Approach

Conceptually, generating jointly-perturbed samples with both natural and
adversarial perturbations of an image can be broken into two sub-problems: (a)
effective navigation on the attribute space and the $l_{p}$-bounded pixel
space, and (b) joint optimization of attribute values and adversarial noises
over both attribute and pixel spaces. We address each problem in detail below.

###  IV-A Joint Perturbation Models

First, let us consider the problem of generating jointly-perturbed samples
with both natural and adversarial perturbations, via navigating on the
attribute space and the $l_{p}$-bounded pixel space. We design a sequential
architecture to perform joint perturbation, as shown in Figure 2.

Attribute Manipulation. We adopt a differentiable attribute manipulator
$h_{\psi}:\mathcal{X}\times\mathcal{A}\rightarrow\mathcal{X}$, conditioned on
a semantic attribute space $\mathcal{A}$, to conduct attribute manipulation.
$h_{\psi}$ takes an image $\bm{x}$ and an attribute vector $\bm{\alpha}$ as
input, and generates perturbed image $\bm{x_{attr}}$ with the specified
attribute. $h_{\psi}$ is trained with the annotated training data
$(\bm{x},\bm{\alpha})$.

For objective-level transformations, we leverage MSP [28] to build $h_{\psi}$.
An encoder network encodes the input image into attribute-invariant features
and attribute-related features. Matrix subspace projection modifies the
attributes of interest to specified values $\bm{\alpha}$. Then, a decoder
network decodes the modified features into the desired image with specified
attributes. For geometric transformations, the attribute manipulator is built
with STN [29]. The input images are first normalized by STN with attributes
predicted by an attribute predictor, which is pre-trained with the annotated
attributes in training data. Then an STN is used to conduct affine
transformation on the normalized images to specified attributes.

Adversarial Noise Generation. To explore novel and hard adversarial samples,
we explicitly train an adversarial noise generator
$g_{\phi}:{X}\times\mathcal{Z}\rightarrow\mathcal{S}$ to generate diverse
adversarial noises $\delta\in\mathcal{S}$, conditioned on a diversity variable
$\bm{z}\in\mathcal{Z}$, where $\mathcal{S}$ the $l_{p}$-ball with $\epsilon$
size and $\mathcal{Z}$ the diversity variable space. For a stronger attack,
the adversarial noise generator $g_{\phi}$ can be further enhanced by adding
$\nabla_{\bm{x}}\mathcal{L}(\bm{x})$ the gradient of the image, $\bm{y}$ the
class label, and $\delta$ the noise of the image as input. Therefore, the
adversarial noise can be recursively generated by:

$\tilde{\bm{x}}^{(t+1)}\leftarrow\text{Proj}_{\mathcal{S}\cup\mathcal{X}}(\bm{x}^{(t)}+\epsilon_{\text{step}}g_{\phi}(\bm{x},\bm{z};\bm{y},\delta^{(t)},\nabla_{\bm{x}}\mathcal{L}(\tilde{\bm{x}}^{(t)}))),$
(3)

where $\text{Proj}_{\mathcal{S}\cup\mathcal{X}}(\cdot)$ denotes the projection
of its element to $l_{p}$-ball $\mathcal{S}$ and a valid pixel value range,
$\delta^{(t)}$ is the noise accumulated up to $t$-th step, and
$\epsilon_{step}$ denotes the step size smaller than $\epsilon$. We adopt a
diversity loss to encourage generating diverse adversarial noises [30, 24]:

$\mathcal{L}_{div}=\frac{\frac{1}{T}\sum^{T}_{1}||\tilde{\bm{x}}^{(t)}(\bm{z}_{1})-\tilde{\bm{x}}^{(t)}(\bm{z}_{2})||_{1}}{||\bm{z}_{1}-\bm{z}_{2}||_{1}},$
(4)

where $\tilde{\bm{x}}^{(t)}(\bm{z})$ denotes the adversarial samples generated
by Eq. 3 with $\bm{z}$, and $\bm{z}_{1},\bm{z}_{2}$ are two i.i.d. samples of
$\bm{z}$.

Given the above models, we define a semantic-preserving adversarial attack as
the process of transforming an input image $x$ via attribute perturbation
$\bm{x}_{\bm{\alpha}}=h_{\psi}(\bm{x},\bm{\alpha})$ and adversarial
perturbation $\delta=g_{\phi}(\bm{x}_{\bm{\alpha}},\bm{z})$ to produce a new
sample $\widetilde{\bm{x}_{\bm{\alpha}}}=\bm{x}_{\bm{\alpha}}+\delta$, such
that $f(\widetilde{\bm{x}_{\bm{\alpha}}})\neq y$. Therefore, we reformulate
Eq. 2 as an optimization of the following problem:

$\displaystyle\min_{\theta\in\Theta}\mathbb{E}_{(\bm{x},y)\sim\mathcal{D}}\left[\max_{\bm{\alpha}\in\mathcal{A},z\in\mathcal{Z}}\mathcal{L}(\bm{x}_{spa},y;\theta)\right]$
(5) $\displaystyle
s.t.\;\;\bm{x}_{spa}=\text{Proj}_{\mathcal{S}\cup\mathcal{X}}(h_{\psi}(\bm{x},\bm{\alpha})+\epsilon
g_{\phi}(h_{\psi}(\bm{x},\bm{\alpha}),\bm{z})),$

Algorithm 1 Semantic-Preserving Adversarial (SPA) Attack

0: Image $\bm{x}$, ground-truth label $\bm{y}$, pretrained attribute
manipulator and noise generator $h_{\psi},g_{\phi}$.

0: SPA sample $\bm{x}_{spa}$.

1: Initialize $\bm{\alpha}^{(0)}$, $\bm{z}^{(0)}$

2: for i in range [0, I) do

3: $\bm{x}_{attr}^{(i)}\leftarrow h_{\psi}(\bm{x},\bm{\alpha}^{(i)})$.

4: for t in range [0, T] do

5:
$\tilde{\bm{x}}_{attr}^{(i,t+1)}\leftarrow\text{Proj}_{\mathcal{S}\cup\mathcal{X}}(\bm{x}_{attr}^{(i)}+$
$\;\;\;\;\;\;\;\;\;\epsilon_{\text{step}}g_{\phi}(\bm{x}_{attr}^{(i)},\bm{z}^{(i)};\bm{y},\delta^{(t)},\nabla_{\bm{x}}\mathcal{L}(\tilde{\bm{x}}_{attr}^{(i,t)})))$

6: end for

7: $\tilde{\bm{x}}_{attr}^{(i+1)}\leftarrow\tilde{\bm{x}}^{(i,T)}$

8:
$\bm{\alpha}^{(i+1)}\leftarrow\bm{\alpha}^{(i)}+\nabla_{\bm{\alpha}}\mathcal{L}(\tilde{\bm{x}}_{attr}^{(i+1)})$

9:
$\bm{z}^{(i+1)}\leftarrow\bm{z}^{(i)}+\nabla_{\bm{z}}\mathcal{L}(\tilde{\bm{x}}_{attr}^{(i+1)})$

10: end for

11: $\bm{x}_{spa}\leftarrow$ Repeat Step 3-6 with
$\bm{\alpha}=\bm{\alpha}^{(I)},\bm{z}=\bm{z}^{(I)}$.

###  IV-B Iterative Parameter Optimization

Having access to the attribute manipulator and the noise generator, we focus
on solving the inner optimization in Eq. 5. Note that the success of robust
training relies on generating strong perturbations in terms of attributes and
adversarial noises. Algorithm 1 demonstrates the optimization of the attribute
value and diversity variable for finding SPA samples $\bm{x}_{spa}$. Step 3-6
conducts attribute manipulation and adversarial noise generation sequentially.
Then, we project the adversarial loss onto the attribute space and the
diversity variable space, by cascading the output of the attribute
manipulator, noise generator, and target classifier. The optimization is
conducted by back-propagation over the classifier $f_{\theta}$ and
perturbation models $h_{\psi},g_{\phi}$.

Algorithm 1 efficiently explores a larger parameter space and generates
stronger jointly-perturbed samples, compared to previous methods [24, 15],
especially under stringent constraints with small $l_{p}$-ball and few valid
semantic-preserving attributes.

###  IV-C Semantic-Preserving Adversarial Training

With our proposed SPA attack, we solve the outer optimization problem in
Equation 5 by proposing a unified training framework for the robustness
against natural and adversarial perturbations, by jointly optimizing the noise
generator $g_{\phi}$ and the target classifier $f_{\theta}$. Before SPA
training, The attribute manipulator $h_{\psi}$ is pretrained with the
annotated training data $(\bm{x},\bm{\alpha}_{gt})$, where $\bm{\alpha}_{gt}$
the ground-truth attributes.

Algorithm 2 Semantic-Preserving Adversarial Training

0: Image $\bm{x}$, and label $\bm{y}$, pretrained attribute manipulator
$h_{\psi}$.

1:
$\bm{x}_{spa}\leftarrow\text{SPA\\_Attack}(\bm{x},\bm{y},h_{\psi},g_{\phi})$

2: Randomly initialize $\bm{\alpha},\bm{z}_{1},\bm{z}_{2}$

3:
$\bm{x}\leftarrow[\bm{x};\bm{x}],\bm{\alpha}\leftarrow[\bm{\alpha};\bm{\alpha}],\bm{y}\leftarrow[\bm{y};\bm{y}],\bm{z}\leftarrow[\bm{z}_{1};\bm{z}_{2}]$
($[\cdot;\cdot]:$ concatenation)

4: $\bm{x}_{attr}\leftarrow h_{\psi}(\bm{x},\bm{\alpha})$

5: for t in range [0, T) do

6:
$\tilde{\bm{x}}_{attr}^{(t+1)}\leftarrow\text{Proj}_{\mathcal{S}\cup\mathcal{X}}(\bm{x}_{attr}+$
$\;\;\;\;\;\;\;\;\;\epsilon_{\text{step}}g_{\phi}(\bm{x}_{attr},\bm{z};\bm{y},\delta^{(t)},\nabla_{\bm{x}}\mathcal{L}(\tilde{\bm{x}}_{attr}^{(t)})))$

7: end for

8: Compute $\mathcal{L}_{div}$ with $\tilde{\bm{x}}_{attr}^{(t)},\bm{z}$
following Eq. 4

9:
$\mathcal{L}_{cls}\leftarrow\frac{1}{T}\sum^{T}_{1}\mathcal{L}(\tilde{\bm{x}}_{attr}^{(t)})+\mathcal{L}(\bm{x}_{spa})$

10:
$\phi\leftarrow\phi+\nabla_{\phi}(\mathcal{L}_{cls}+\lambda\mathcal{L}_{div})$

11:
$\theta\leftarrow\theta-\nabla_{\theta}(\mathcal{L}(\bm{x})+\mathcal{L}(\tilde{\bm{x}}_{attr}^{(T)})+\mathcal{L}(\bm{x}_{spa}))$

The overall procedure is summarized in Algorithm 2. For each batch, we first
randomly sample attribute values for attribute manipulation and two batches of
diversity variables for diverse adversarial noises. Then, we duplicate the
batch with different diversity variables. Then, we conduct attribute
manipulation on the training data and generate diverse adversarial noise with
different diversity variables. Then, we generate SPA samples of training data
following Algorithm 1. We update the noise generator $g_{\phi}$ with the
classification loss $\mathcal{L}_{cls}$ and the diversity loss
$\mathcal{L}_{div}$. Finally, we update the target classifier $f_{\theta}$
with the classification loss of real images, attribute perturbed images, and
SPA images.

##  V Experiments

In this section, we report the experimental results of our proposed SPA attack
and training on four public datasets.

###  V-A Experimental Setups

Datasets. We evaluate our approach on MNIST [13], FashionMNIST [31],
CelebFaces Attributes (CelebA) [32] and SICAPv2 [33] datasets. 1) MNIST
dataset consists of $70,000$ $28\times 28$ images with digits from zero to
nine. 2) Fashion-MNIST dataset consists of $70,000$ $28\times 28$ images with
10 classes of clothes. For both datasets, we consider rotation in $[-45,45]$
degrees and scaling in $[0.7,1.3]$ times as natural perturbations, separately.

We also conduct experiments on two real-world datasets. 3) CelebA dataset has
more than 200K $64\times 64$ celebrity images, each with 40 attribute
annotations. We consider the ”smiling” attribute as the target attribute for
natural perturbation and train a classifier to predict ”gender”. All training
data are resized to $32\times 32$. 4) SICAPv2 is a medical dataset collected
for prostate cancer diagnosis. There are 3773 non-cancerous patches and 3641
cancerous patches with Gleason grading equal 4. We resize the images to
$64\times 64$ and consider the rotation in $[-45,45]$ degrees as natural
perturbations. We set the size of $l_{\infty}$ ball as $\epsilon=0.1$ for
MNIST and FashionMNIST, and $\epsilon=0.01$ for CelebA and SICAPv2 datasets,
which is $\mathbf{3\times}$ smaller than that of previous works.

Model Parameters. We employ ResNet-20 as the target classifier. We randomly
initialize the classifier and the generator and jointly train both of them by
Adam with a learning rate of 0.01 beta of $[0.9,0.99]$ and weight decay of
0.0001 for 20K iterations, with a batch size of 100. For SPA attack, after the
classifier is pre-trained, the generator is updated for 100K iterations, with
a batch size of 100. We set $\epsilon_{step}=1/4\epsilon$. We update the
attribute and adversarial noise to generate SPA samples for ten steps. Both
attribute value and diversity variable are optimized by Adam over the cross-
entropy loss.

Baselines. To measure the robustness of the SPA-trained classifier, we compare
our approach against the classifiers that are trained upon state-of-the-art
adversarial training methods. We employ two gradient-based methods CW [20] and
PGD [6], and a generator-based method L2LDA[24] for adversarial training. We
also compare our approach against an attribute robust training method AGAT
[15].

To evaluate the effectiveness of the SPA attack, we compare our SPA attack
with a natural perturbation method SAA [14], and three adversarial
perturbation approaches CW, PGD, and L2LDA.

Furthermore, to demonstrate the effectiveness of the proposed joint
optimization of attribute values and diversity variables, we also compare with
hybrid approaches which combine existing adversarial attack approaches,
including CW, PGD and L2LDA with random attribute perturbation, denoted as CW-
Attr, PGD-Attr and L2LDA-Attr, correspondingly.

TABLE II: Impact of the perturbation models on SPA attack on FashionMNIST dataset with ”rotation” attribute, in terms of accuracy. $\times$ denotes removing the model $h_{\psi}$ or $g_{\phi}$. Attack Defense | Naive | AGAT | CW | SPA
---|---|---|---|---
SPA ($h_{\psi}\times\;g_{\phi}\times$) | 0.9337 | 0.9153 | 0.9241 | 0.9251
SPA ($h_{\psi}\;\checkmark\;g_{\phi}\times$) | 0.7451 | 0.8541 | 0.7544 | 0.8849
SPA ($h_{\psi}\times\;g_{\phi}\checkmark$) | 0.0737 | 0.1298 | 0.5190 | 0.8428
SPA ($h_{\psi}\;\checkmark\;g_{\phi}\;\checkmark$) | 0.0093 | 0.0189 | 0.5092 | 0.7996
TABLE III: Impact of the parameter optimization on SPA attack on FashionMNIST dataset with ”rotation” attribute, in terms of accuracy. $\bm{\alpha}$ and $\bm{z}$ refer to the attribute value and the diversity variable in Algorithm 1. $\times$ denotes using fixed random $\bm{\alpha}$ or $\bm{z}$. Attack Defense | Naive | AGAT | CW | SPA
---|---|---|---|---
SPA ($\bm{\alpha}\times\;\bm{z}\;\times$) | 0.0541 | 0.0863 | 0.5144 | 0.8327
SPA ($\bm{\alpha}\;\checkmark\;\bm{z}\;\times$) | 0.0144 | 0.0311 | 0.5102 | 0.8209
SPA ($\bm{\alpha}\times\;\bm{z}\;\checkmark$) | 0.0284 | 0.1045 | 0.5084 | 0.8255
SPA ($\bm{\alpha}\;\checkmark\;\bm{z}\;\checkmark$) | 0.0093 | 0.0189 | 0.5092 | 0.7996
Figure 3: Impact of attack iterations on classification accuracy on CelebA
dataset with ”Smiling” attribute. We perform SPA attack method on naive, AGAT
[15], and SPA-trained classifiers.

###  V-B Ablation Study

To understand (a) how the perturbation models impact the performance of SPA
attack, and (b) how the optimization of the attribute value $\bm{\alpha}$ and
the diversity variable $\bm{z}$ improves the quality of SPA samples, we
conduct ablation studies on the FashionMNIST dataset, using STN-based
attribute manipulator. Note that STN conducts precise natural perturbation
along with attributes and thus will not unintentionally introduce an
adversarial noise. Therefore, the noise $\bm{\delta}$ generated by the noise
generator is the overall adversarial noise added to the data. This allows us
to isolate the influence of each perturbation in SPA attacks.

Perturbation Model. Table II demonstrates the impact of each perturbation
model on SPA attack. We compare the second row and the third row with the
first row, respectively. We observe that the adversarial noise generator
$g_{\phi}$ causes severe model failure (85% accuracy decline against naive
classifier on FashionMNIST), while the attribute manipulator $h_{\psi}$ only
results in 18.86% accuracy decline. Therefore, the adversarial noise generator
contributes more accuracy decline than the attribute manipulator against the
four defense methods.

TABLE IV: Impact of the noise size $\epsilon$ on CelebA dataset with ”smiling” attribute, in terms of accuracy. We conduct PGD, L2LDA, and SPA attacks on a naive classifier and a SPA-trained classifier. Defense | Attack | Noise size $\epsilon$
---|---|---
|  | 0.00 | 0.01 | 0.02 | 0.03
Naive | PGD | 0.9565 | 0.0935 | 0.0225 | 0.0027
L2LDA | 0.9565 | 0.1055 | 0.0372 | 0.0108
SPA | 0.9565 | 0.0755 | 0.0214 | 0.0051
SPA | PGD | 0.9430 | 0.9130 | 0.7315 | 0.5792
L2LDA | 0.9430 | 0.9185 | 0.5721 | 0.4744
SPA | 0.9430 | 0.8910 | 0.6122 | 0.4530
TABLE V: Impact of the attribute number on SICAPv2 dataset, in terms of accuracy. Legend of attributes: Re: reshape, Sc: scaling, Ro: rotation. We conduct the attack on a PGD-trained classifier. Rand-Attr is an adversarial attack with randomly generated attributes. As the number of attributes increases, SPA attacks are more effective. Our SPA attack performs better than Rand-Attr, where the attribute values are randomly selected, showing the efficacy of joint optimization in finding strong adversarial samples. Attack Type | Attributes | SPA | Rand-Attr
---|---|---|---
Single Attribute | Re | 0.3030 | 0.4136
Sc | 0.5741 | 0.6277
Ro | 0.3732 | 0.3830
Double Attributes | Re, Sc | 0.2944 | 0.3541
Re, Ro | 0.2629 | 0.3842
Sc, Ro | 0.3580 | 0.3732
Multi Attributes | Re, Sc, Ro | 0.2207 | 0.3317
TABLE VI: The result of White-box attacks on MNIST, FashionMNIST, CelebA, and SICAPv2 datasets. For adversarial noise, we set $\epsilon=0.1$ for MNIST and FashionMNIST datasets and $\epsilon=0.01$ for CelebA and SICAPv2 datasets. We measure the classification accuracy of the adversarially trained classifiers (rows) against various attack methods (columns). Defense Attack | Naive | SAA | CW | PGD | L2LDA | CW-Attr | L2LDA-Attr | SPA | Min
---|---|---|---|---|---|---|---|---|---
MNSIT [13] Attribute $\leftarrow$ Scaling
Plain | 0.9684 | 0.8236 | 0.1226 | 0.0983 | 0.1159 | 0.0351 | 0.0308 | 0.0118 | 0.0118
AGAT | 0.9672 | 0.9584 | 0.1328 | 0.1240 | 0.1401 | 0.0741 | 0.1143 | 0.0219 | 0.0219
CW | 0.9629 | 0.8307 | 0.8172 | 0.4131 | 0.7931 | 0.7497 | 0.6278 | 0.6415 | 0.6278
PGD | 0.9891 | 0.8406 | 0.7521 | 0.7842 | 0.8028 | 0.7412 | 0.7749 | 0.6744 | 0.6744
L2LDA | 0.9677 | 0.8472 | 0.8641 | 0.8140 | 0.9148 | 0.8073 | 0.7946 | 0.7441 | 0.7441
PGD-Attr | 0.9860 | 0.9431 | 0.7581 | 0.7872 | 0.7992 | 0.7528 | 0.7617 | 0.7844 | 0.7581
SPA | 0.9661 | 0.9575 | 0.9194 | 0.8789 | 0.9071 | 0.8951 | 0.8784 | 0.8572 | 0.8572
FashionMNSIT [31] Attribute $\leftarrow$ Rotation
Plain | 0.9337 | 0.7496 | 0.0648 | 0.0617 | 0.0737 | 0.0165 | 0.0284 | 0.0093 | 0.0093
AGAT | 0.9153 | 0.8659 | 0.0869 | 0.0794 | 0.1298 | 0.0831 | 0.1045 | 0.0189 | 0.0189
CW | 0.9241 | 0.7597 | 0.6539 | 0.3642 | 0.5190 | 0.6831 | 0.5084 | 0.5092 | 0.5084
PGD | 0.9257 | 0.7642 | 0.7365 | 0.7044 | 0.6531 | 0.6611 | 0.6417 | 0.5371 | 0.5371
L2LDA | 0.9224 | 0.7827 | 0.8593 | 0.7281 | 0.7417 | 0.8144 | 0.7929 | 0.7731 | 0.7417
PGD-Attr | 0.9217 | 0.8582 | 0.7912 | 0.7380 | 0.7278 | 0.7128 | 0.7417 | 0.6982 | 0.6982
SPA | 0.9251 | 0.8845 | 0.8313 | 0.8047 | 0.8428 | 0.8127 | 0.8255 | 0.7996 | 0.7996
CelebA [32] Attribute $\leftarrow$ Smiling
Plain | 0.9565 | 0.8830 | 0.1375 | 0.1035 | 0.1055 | 0.1035 | 0.0950 | 0.0775 | 0.0775
AGAT | 0.9400 | 0.9420 | 0.3740 | 0.3577 | 0.4180 | 0.3725 | 0.3580 | 0.3415 | 0.3415
CW | 0.9518 | 0.9151 | 0.5798 | 0.4966 | 0.5419 | 0.5541 | 0.5221 | 0.5077 | 0.5077
PGD | 0.9479 | 0.9068 | 0.6431 | 0.9047 | 0.5541 | 0.5681 | 0.5328 | 0.5041 | 0.5041
L2LDA | 0.9523 | 0.9094 | 0.6740 | 0.6937 | 0.7240 | 0.6192 | 0.6891 | 0.6390 | 0.6192
PGD-Attr | 0.9401 | 0.9268 | 0.6458 | 0.8806 | 0.5618 | 0.5828 | 0.5527 | 0.5541 | 0.5527
SPA | 0.9430 | 0.9405 | 0.9125 | 0.8973 | 0.9185 | 0.9035 | 0.8975 | 0.8910 | 0.8910
SICAPv2 [33] Attribute $\leftarrow$ Rotation
Plain | 0.8971 | 0.8070 | 0.0014 | 0.0142 | 0.0217 | 0.0028 | 0.0121 | 0.0217 | 0.0014
AGAT | 0.7624 | 0.8791 | 0.0430 | 0.0841 | 0.0402 | 0.0830 | 0.0402 | 0.0531 | 0.0402
CW | 0.8732 | 0.7832 | 0.3044 | 0.2831 | 0.2629 | 0.3188 | 0.2370 | 0.2207 | 0.2207
PGD | 0.8890 | 0.7890 | 0.6731 | 0.3347 | 0.4141 | 0.6542 | 0.3030 | 0.3732 | 0.3030
L2LDA | 0.8877 | 0.8021 | 0.5844 | 0.5821 | 0.5741 | 0.5830 | 0.5703 | 0.4785 | 0.4785
PGD-Attr | 0.8941 | 0.8741 | 0.6525 | 0.5506 | 0.4633 | 0.6277 | 0.4527 | 0.4071 | 0.4071
SPA | 0.8920 | 0.8837 | 0.6207 | 0.8533 | 0.7685 | 0.6183 | 0.7051 | 0.6295 | 0.6183

We further observe Table III to study the impact of parameter optimization by
comparing random initialization with parameter optimization methods. By
comparing the second and first row, we note that the optimization of
attributes $\bm{\alpha}$ leads to a 1.18% accuracy decline against the SPA
defense on FashionMNIST. Similarly, we observe the performance drops 0.72% by
optimizing the diversity variable $\bm{z}$. Therefore, optimizing attributes
$\bm{\alpha}$ contributes more than optimizing the diversity variable
$\bm{z}$.

The above ablation studies show that our method’s perturbation models and
parameter optimizations benefit the generation of powerful attacks in a
complementary way.

###  V-C Impact of Parameters

Noise Size. As demonstrated in Table IV, we explore the noise size $\epsilon$
on the CelebA dataset with the ”smiling” attribute. We conduct PGD, L2LDA, and
SPA attacks on a naive classifier and a classifier adversarially trained via
SPA. The size of adversarial noise varies from 0.0 to 0.03. It can be observed
that when the size of noise is small (e.g., $\epsilon=0.01$), our proposed SPA
attack outperforms PGD and L2LDA by around 2%. As the noise size increases,
the SPA attack can achieve a strong attack but could be outperformed by other
approaches (e.g., PGD on a naive classifier).

Attack Iteration. To study the impact of the attack iteration $I$ in Algorithm
1, we observe the change of prediction accuracy in Figure 3. The attack is
conducted upon classifiers trained by naive, attribute robust, and SPA
training. We observed that parameter optimization could effectively enhance
the SPA samples. The accuracy becomes stable after 30 steps. We also notice
that the SPA-trained classifier has the smallest relative accuracy decline
(7.2%=$\frac{93.75\%-86.97\%}{93.75\%}$ for 50 steps) than the other baselines
(26.1% for attribute robust training and 56.6% for naive training). For
efficiency, we only update 10 steps in SPA training.

Figure 4: Semantic-preserving adversarial (SPA) examples generated with
multiple attributes on the SICAPv2 dataset. Column (a) shows original images.
Column (b) shows images with optimized attributes. Column (c) shows SPA images
with joint perturbations. Column (d) shows the gradient of images in column
(c). Column (e) and column (f) show the adversarial noises generated with
different diversity variables. Column (g) shows the difference between the two
noises in columns (e) and (f). Images in columns (e), (f), (g) are amplified
30 times.

Attribute Number. We quantitatively explore the effect of introducing a
different number of attributes for the SPA attack. We conduct experiments on
the SICAPv2 dataset by attacking a classifier adversarially trained against
PGD attack. Table V demonstrates that as the number of attributes increases,
the SPA attack can efficiently search stronger natural perturbations by
optimizing in larger attribute space. Compared to randomly sampling attributes
as in Rand-SPA, our optimization-based SPA attack fears better and can find
stronger adversarial samples.

###  V-D Comparisons

In this section, we compare our approach to existing works in defense and
attack. We use four popular defense methods in the literature, AGAT [15], CW
[20], PGD [6] and L2LDA [24], as the baselines for adversarial training. The
results on MNIST, FashionMNIST, CelebA, and SICAPv2 datasets are presented in
Table VI.

First, we observe that the SPA-trained target classifier outperforms the
others by a significant margin in all four datasets against jointly-perturbed
samples. Compared to AGAT and SPA training, the two classifiers trained by CW
and L2LDA cannot defend natural perturbations from SAA in most cases. SPA
training achieves comparable performance to AGAT against natural
perturbations. However, the SPA-trained classifier is robust against
adversarial perturbations, while the AGAT-trained classifier is not. According
to the fifth to the seventh columns in Table VI, our proposed SPA training is
robust against both perturbations.

To well evaluate the performance of our proposed SPA attack, we use three
existing attack methods (SAA [14], CW, and L2LDA) and two hybrid attack
methods (CW-Attr and L2LDA-Attr) as baselines. We observe that the SPA attack
outperforms other natural-perturbation-based attacks, gradient-based
adversarial attacks, generator-based adversarial attacks, and hybrid attacks
in most cases. Although random attribute perturbation can help enhance
adversarial samples, the SPA attack generates stronger samples thanks to
parameter optimization. Therefore, the SPA attack is able to generate powerful
jointly-perturbed samples for improving the robustness against joint
perturbations.

##  VI Conclusion and Future Work

This paper proposes a new adversarial training strategy named Semantic-
Preserving Adversarial (SPA) training for enhancing robustness against joint
perturbations in the attribute and pixel spaces by designing a novel attack
mechanism. To make the classifier more robust against joint adversarial and
natural perturbations, we leverage an attribute manipulator for natural
perturbation and a noise generator to generate diverse adversarial noises,
then optimize both attribute values and adversarial diversity variables. The
SPA attack causes a larger performance decline under small $l_{\infty}$ norm-
ball constraints compared to existing approaches. We extensively evaluate SPA
attacks and training on four benchmarks and achieve state-of-the-art
performance. Besides, we empirically demonstrate that SPA training applies to
multiple types of natural perturbations and can be used with different
surrogate functions for attribute manipulation. In the future, we are going to
explore joint-perturbation space with a unified generator more effectively and
adapt our SPA training to other robustness problems, not limited to
classification.

## References

  * [1] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , 2016, pp. 770–778.
  * [2] A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” _Advances in Neural Information Processing Systems_ , vol. 25, pp. 1097–1105, 2012.
  * [3] I. Sutskever, O. Vinyals, and Q. V. Le, “Sequence to sequence learning with neural networks,” in _Advances in Neural Information Processing Systems_ , 2014, pp. 3104–3112.
  * [4] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” _arXiv preprint arXiv:1412.6572_ , 2014.
  * [5] A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” _arXiv e-prints_ , p. arXiv:1607.02533, Jul. 2016.
  * [6] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in _International Conference on Learning Representations_ , 2018.
  * [7] A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in _International Conference on Machine Learning_. PMLR, 2018, pp. 274–283.
  * [8] T. Pang, X. Yang, Y. Dong, H. Su, and J. Zhu, “Bag of tricks for adversarial training,” in _International Conference on Learning Representations_ , 2021\. [Online]. Available: https://openreview.net/forum?id=Xb8xvrtB8Ce
  * [9] F. Tramer, N. Carlini, W. Brendel, and A. Madry, “On adaptive attacks to adversarial example defenses,” in _Advances in Neural Information Processing Systems_ , H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, Eds., vol. 33. Curran Associates, Inc., 2020, pp. 1633–1645. [Online]. Available: https://proceedings.neurips.cc/paper/2020/file/11f38f8ecd71867b42433548d1078e38-Paper.pdf
  * [10] A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” in _International Conference on Learning Representations_ , 2017\.
  * [11] H. Zhang, Y. Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in _International Conference on Machine Learning_. PMLR, 2019, pp. 7472–7482.
  * [12] Y. Wang, D. Zou, J. Yi, J. Bailey, X. Ma, and Q. Gu, “Improving adversarial robustness requires revisiting misclassified examples,” in _International Conference on Learning Representations_ , 2020. [Online]. Available: https://openreview.net/forum?id=rklOg6EFwS
  * [13] Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” _Proceedings of the IEEE_ , vol. 86, no. 11, pp. 2278–2324, Nov 1998.
  * [14] A. Joshi, A. Mukherjee, S. Sarkar, and C. Hegde, “Semantic adversarial attacks: Parametric transformations that fool deep classifiers,” in _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , 2019, pp. 4773–4783.
  * [15] T. Gokhale, R. Anirudh, B. Kailkhura, J. J. Thiagarajan, C. Baral, and Y. Yang, “Attribute-guided adversarial training for robustness to natural perturbations,” in _Proceedings of the AAAI Conference on Artificial Intelligence_ , 2021, pp. 7574–7582.
  * [16] A. Laugros, A. Caplier, and M. Ospici, “Are adversarial robustness and common perturbation robustness independant attributes ?” in _Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) Workshops_ , Oct 2019.
  * [17] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” _arXiv preprint arXiv:1312.6199_ , 2013.
  * [18] E. Wong, L. Rice, and J. Z. Kolter, “Fast is better than free: Revisiting adversarial training,” in _International Conference on Learning Representations_ , 2020. [Online]. Available: https://openreview.net/forum?id=BJx040EFvH
  * [19] H. Kim, W. Lee, and J. Lee, “Understanding catastrophic overfitting in single-step adversarial training,” in _Proceedings of the AAAI Conference on Artificial Intelligence_ , vol. 35, no. 9, 2021, pp. 8119–8127.
  * [20] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in _2017 IEEE Symposium on Security and Privacy_. IEEE, 2017, pp. 39–57.
  * [21] H. Jiang, Z. Chen, Y. Shi, B. Dai, and T. Zhao, “Learning to defense by learning to attack,” _AISTATS_ , vol. 130, 2021.
  * [22] H. Wang and C.-N. Yu, “A direct approach to robust deep learning using adversarial networks,” in _International Conference on Learning Representations_ , 2019.
  * [23] K. R. Mopuri, U. Ojha, U. Garg, and R. V. Babu, “Nag: Network for adversary generation,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , 2018, pp. 742–751.
  * [24] Y. Jang, T. Zhao, S. Hong, and H. Lee, “Adversarial defense via learning to generate diverse attacks,” in _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , 2019, pp. 2740–2749.
  * [25] D. Hendrycks and T. Dietterich, “Benchmarking neural network robustness to common corruptions and perturbations,” in _International Conference on Learning Representations_ , 2018.
  * [26] H.-T. D. Liu, M. Tao, C.-L. Li, D. Nowrouzezahrai, and A. Jacobson, “Beyond pixel norm-balls: Parametric adversaries using an analytically differentiable renderer,” in _International Conference on Learning Representations_ , 2018\.
  * [27] M. Mirza and S. Osindero, “Conditional generative adversarial nets,” _arXiv preprint arXiv:1411.1784_ , 2014.
  * [28] X. Li, C. Lin, R. Li, C. Wang, and F. Guerin, “Latent space factorisation and manipulation via matrix subspace projection,” in _International Conference on Machine Learning_. PMLR, 2020, pp. 5916–5926.
  * [29] M. Jaderberg, K. Simonyan, A. Zisserman _et al._ , “Spatial transformer networks,” _Advances in Neural Information Processing Systems_ , vol. 28, pp. 2017–2025, 2015.
  * [30] D. Yang, S. Hong, Y. Jang, T. Zhao, and H. Lee, “Diversity-sensitive conditional generative adversarial networks,” _International Conference on Learning Representations_ , 2019.
  * [31] H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” _arXiv preprint arXiv:1708.07747_ , 2017.
  * [32] Z. Liu, P. Luo, X. Wang, and X. Tang, “Deep learning face attributes in the wild,” in _Proceedings of the IEEE International Conference on Computer Vision_ , 2015, pp. 3730–3738.
  * [33] J. Silva-Rodríguez, A. Colomer, M. A. Sales, R. Molina, and V. Naranjo, “Going deeper through the gleason scoring scale: An automatic end-to-end system for histology prostate grading and cribriform pattern detection,” _Computer Methods and Programs in Biomedicine_ , vol. 195, p. 105637, oct 2020\. [Online]. Available: https://doi.org/10.1016%2Fj.cmpb.2020.105637