# A comprehensive first-principle study of borophene-based nano gas sensor
with gold electrodes

Yueyue Tian  International Centre for Quantum and Molecular Structures and
Department of Physics, Shanghai University, Shanghai 200444, China  Houping
Yang  International Centre for Quantum and Molecular Structures and Department
of Physics, Shanghai University, Shanghai 200444, China  Junjun Li  Hongzhiwei
Technology (Shanghai) Co., Ltd., Shanghai 201206, China  Shunbo Hu
International Centre for Quantum and Molecular Structures and Department of
Physics, Shanghai University, Shanghai 200444, China  Materials Genome
Institute, Shanghai University, Shanghai 200444, China  Shixun Cao
International Centre for Quantum and Molecular Structures and Department of
Physics, Shanghai University, Shanghai 200444, China  Materials Genome
Institute, Shanghai University, Shanghai 200444, China  Wei Ren  International
Centre for Quantum and Molecular Structures and Department of Physics,
Shanghai University, Shanghai 200444, China  Materials Genome Institute,
Shanghai University, Shanghai 200444, China  Yin Wang<EMAIL_ADDRESS>International Centre for Quantum and Molecular Structures and Department of
Physics, Shanghai University, Shanghai 200444, China  Hongzhiwei Technology
(Shanghai) Co., Ltd., Shanghai 201206, China

###### Abstract

Using density functional theory combined with nonequilibrium Green’s function
method, the transport properties of borophene-based nano gas sensors with gold
electrodes are calculated, and comprehensive understandings regarding the
effects of gas molecules, MoS2 substrate and gold electrodes to the transport
properties of borophene are made. Results show that borophene-based sensors
can be used to detect and distinguish CO, NO, NO2 and NH3 gas molecules, MoS2
substrate leads to a non-linear behavior on the current-voltage
characteristic, and gold electrodes provide charges to borophene and form a
potential barrier, which reduced the current values compared to the current of
the systems without gold electrodes. Our studies not only provide useful
information on the computationally design of borophene-based gas sensors, but
also help understand the transport behaviors and underlying physics of 2D
metallic materials with metal electrodes.

Gas sensors have received considerable attentions because of their important
applications in detecting toxic and deleterious gases, supervising air
quality, and monitoring human health.LiuReview ; YunusaReview  Compared to
other gas detection techniques, electrochemical sensing has various
advantages, such as, low energy linear output with high resolution, good
selectivity and repeatability, high detection accuracy, and being more
inexpensive than other techniques.YunusaReview  As motivated by the driving
force of enhancing the performance of gas sensors, great efforts have been
exhausted on their design with tiny architectures or configurations.LiuReview
At present, numerous distinct gas sensors have been prepared, for instance,
Zhang _et. al._Zhang2014  have built a gas sensor based on anatase TiO2 that
is used to detect decomposed gases in SF6, Cui _et. al._Cui2015  have
constructed a field effect transistor sensor device which exhibits an
ultrahigh sensitivity to NO2 in dry air, Cho _et. al._Cho2015  have
demonstrated atomically thin heterostructured gas sensors which comprising a
combination of exfoliated MoS2 and CVD graphene, Zhao _et. al._Zhao2018  have
made a MoS2-based flexible and wearable gas sensor which was fabricated based
on the direct synthesis of MoS2 on a polyimide substrate.

A clear trend is, with the emergence of two-dimensional (2D) materials,MaoR ;
WangR ; HuangR  gas sensors based on 2D materials have drawn more and more
attentions because of their superior properties, including large surface to
volume ratio, associated charge transfer between gas and surface, and high
electron mobility.Shukla2017 ; 2017Sc2CO2 ; APLMoSe2 ; APLZnO  Recently,
graphene and other 2D materials-based gas sensors have been widely
investigated both experimentally and theoretically.APLGraphene ; lu2009gas ;
GGR ; MalikR  Among these 2D materials, borophene, which has various excellent
properties, such as anisotropic mechanical,wang2016strain ; peng2017stability
; zhang2017elasticity  opticalgao2017prediction ; peng2016electronic  and
electronic properties,feng2016experimental ; feng2016direct ; wu2012two  plays
a crucial role in promoting the development of 2D gas
sensors.kou2014phosphorene ; kootenaei2016b36 ; WangR  Shukla _et.
al._Shukla2017  reported the realization of 2D monolayer borophene-based gas
sensor using first principle density functional theory methods, and concluded
that 2D monolayer borophene can be a potentially important substrate for gas
sensing of CO, NO, NO2 and NH3 gas molecules. Furthermore, Shen _et.
al._Shen2020  studied the transport properties of gas adsorbed on 2D monolayer
borophene with a MoS2 substrate, i.e., on borophene-MoS2 heterostructure, and
results show that the heterostructure is also very sensitive to CO, NO, NO2
and NH3 gas molecules, especially to NO moleclue, and therefore can be used as
a 2D gas sensor. However, these studies ignored the effect of metal
electrodes, which is necessary for not only the collecting of electrical
signal during the operation of the sensor, but also adjusting the Fermi energy
and/or electrostatic potential of the 2D materials.Chen1 ; Chen2 ; Xie  In
addition, a comprehensive understanding on the effects of MoS2 substrate, gas
molecules, as well as metal electrodes, to the transport properties of 2D
monolayer borophene is still lack.

In this paper, we systematically investigated the transport properties of
borophene-based nano gas sensors with or without considering the influence of
gas molecules, MoS2 substrate and/or metal electrodes. Results show that the
borophene and borophene-MoS2 heterostructure with gold electrodes is sensitive
to various gas molecules, therefore, they can be used as a gas sensor, which
qualitatively agrees with previous studies.Shukla2017 ; Shen2020  The
calculated current-voltage (_I-V_) characteristic through pristine borophene
without considering the effect of MoS2 substrate and gold electrodes under 0.5
V has a linear behavior, however, with considering the MoS2 substrate and/or
the metal electrodes, the current is reduced and a non-linear _I-V_ behavior
can be observed. Further band structure, charge and potential analyses well
explained the obtained results. Our studies not only provided comprehensive
information regarding the underlying physics of borophene-based gas sensors,
but also can be used to understand more transport behaviors of 2D monolayer
materials and heterostructures with metal electrodes, which are usually not
included when theoretically studying the transport properties of 2D metallic
materials in the literature.

Figure 1: (a) Schematic plot of the borophene-MoS2 heterostructure gas sensor
with gold electrodes. Gray area shows MoS2 substrate, and gold areas are metal
electrodes that collect the electrical signal. (b) Side view and (c) top view
of the atomic model in our first-principle calculations.

We started by considering the fabrication and operation process of a real
borophene-based nano gas sensor with gold electrodes, as shown in Fig. 1(a).
Monolayer borophene is placed on MoS2 substrate, and gold electrodes are
deposited onto borophene. The distance between two gold electrodes is big
enough to contain a gas molecule, so that the molecule can be regarded as no
interaction with the electrodes. When a gas molecule is approaching and
adsorbing on the borophene, the current is collected through the electrodes.
Fig. 1(b, c) show the side view and top view of the optimized atomic structure
of the entire gas sensor. The distance between each two parts (borophene, MoS2
or two gold electrodes) of the structure is optimized by vasp software,vasp
the optimization details can be found in the supplementary material. To
calculate the transport properties without MoS2 substrate and/or gold
electrodes, we just need to simply remove the corresponding part from the
entire structure in Fig. 1. According to the previous studies,Shukla2017 ;
Shen2020 ; Aghaei2018  in this work we considered four gas molecules, namely,
CO, NO, NO2 and NH3, which are all sensitive to borophene-based gas sensors
due to chemisorption between the molecules and borophene. These molecule-
borophene structures are fully relaxed (see the supplementary material), while
pristine borophene is used for all the systems without molecules. After the
structure was determined, we carried the quantum transport calculations by
density functional theory combined with the nonequilibrium Green’s function
(NEGF-DFT) as implemented in nanodcal software package.NEGFDFT1 ; NEGFDFT2  In
our NEGF-DFT numerical calculations, double-zeta polarized atomic orbital
basis set was used to expand the physical quantities of B and molecule
elements, single-zeta polarized atomic orbital basis set was used for Mo, S
and Au.basis  The exchange and correlation were treated at the level of the
Perdew-Burke-Ernzerhof (PBE) level,PBE  and atomic cores are defined by the
standard norm conserving nonlocal pseudopotentials.PP  In the self-consistent
calculations, 3 k-points are used to sample the Brillouin zone in the periodic
direction, and a cutoff energy of 80 Hartree were used. To obtain the
transmission and _I-V_ curve, 50 k-points are used. Spin orbital coupling is
not considered in this work.

Figure 2: Current-voltage (_I-V_) characteristics of borophene-based nano gas
sensors under 0.5 V external bias on various systems with or without
considering the influence of gas molecules, MoS2 substrate and/or gold
electrodes.

Fig. 2 shows the _I-V_ curves of borophene-based nano gas sensors under 0.5 V
from our NEGF-DFT numerical calculations on eleven different systems with or
without considering the influence of gas molecules, MoS2 substrate and/or gold
electrodes, from which the following results can be clearly observed:

(i) The _I-V_ characteristics of pristine borophene (black curve) show a
nearly perfect linear behavior, which maintains after a molecule (CO) is
adsorbed (red curve), and the scattering of the CO molecule leads to the
decreasing of the current. Our calculated _I-V_ values quantitatively agree
with the previous reports.Shukla2017  We should note that for the pristine
borophene system (black) and borophene-MoS2 heterostructure system (orange)
that will be discussed in the following, the atomic structures are actually
perfect periodic along the transport direction. For a periodic system, it is
experimentally unfeasible to direct apply finite bias on a selected region,
but numerical calculations of these periodic systems are very useful for one
to better understand the physics of transport properties through the
structure.

(ii) After MoS2 is introduced, the current values of heterostructure systems
(orange and gray curves) decrease compared to the current values of the
corresponding borophene systems. More interestingly, under 0.15 V the _I-V_
characteristic show non-linear behavior, and then become nearly linear after
0.2 V, which is more obvious for the orange curve of borophene-MoS2 system in
Fig. 2. This non-linear behavior was not mentioned in previous studies, and
should be further understood. Quantitatively, our calculated current values
under the same voltage is smaller than that in the previous reports on
borophene-MoS2 heterostructure,Shen2020  which is because we applied different
strain on MoS2 or borophene layer and used different stacking way to make the
bilayer structure.

(iii) The rest seven _I-V_ curves are all for the systems with gold
electrodes. We can see from the supplementary material that all these curves
lose the perfect linear behavior, which must stem from the existence of metal
electrodes. In addition, after gold electrodes are included, the calculated
current values under the same voltage is much smaller than the current values
of the corresponding system without gold electrodes, although gold is a good
conductor from a macro point of view. Similar experimental observations are
reported by Ref. ChoR,  in the Al:Graphene system, where Al electrodes reduced
the current of pure graphene.

(iv) It is obvious that for all the sensors, the current values of systems
with molecules are smaller than that without molecules, which agrees with all
the previous reports.Shukla2017 ; Shen2020  Moreover, one can see that the
four purple curves quantitatively have nearly the same _I-V_ characteristic,
which qualitatively agrees with the previous results on monolayer borophene
gas sensor for CO, NO, NO2 and NH3 gas molecules.Shukla2017  Therefore, to
further judge if the borophene-based nano-gas sensors can well distinguish
these molecules, more studies on the sensitivities of the sensors to various
molecules are necessary.

From the _I-V_ curves in Fig. 2, we can preliminarily conclude that borophene-
based nano heterostructure gas sensor with gold electrodes are sensitive
enough to detect some small molecules. Till now, two behaviors observed in the
_I-V_ curves (Fig. 2) still need to be further understood. First, why MoS2
substrate lead to a non-linear _I-V_ characteristic under small bias? Second,
why gold electrode, which is a good conductor, lead to the decrease of current
values compared to that in the corresponding systems without gold electrodes?
In the following we will solve these two problems (See Fig. 5 and related
discussions).

Figure 3: Band structure and density of states (DOS) for (a) pristine
borophene of a 8-atom unit cell system, (b) MoS2 that matches the pristine
borophene lattice, and (c) borophene-MoS2 heterostructure. (d) The _I-V_
characteristic of borophene-MoS2 system.

Fig. 3(a) shows the band structure and density of states (DOS) of pristine
borophene calculated from 8-atom unit cell that matches MoS2 lattice (see
supplementary materials), one can observe that each energy band in the band
structure cross the entire energy range from -0.5 to 0.5 eV in a nearly linear
fashion, and the corresponding DOS nearly keep a constant value ($\sim$ 1.5).
This means, if an external bias under 0.5 V is applied onto the borophene,
each incoming electron state in the left electrode at a certain moment $k$ and
energy $E$ can find a way out through and outgoing electron state in the right
electrode at the same moment k with a different energy $E^{\prime}$. In this
way, the current will be proportional to the width of the bias widow, namely,
the applied external bias voltage, leading to a linear behavior on the _I-V_
characteristic. After MoS2, whose band structure and DOS is shown in Fig. 3
(b), and borophene forming a heterostructure, charge transfer will take place
between these two materials. Fig. 3(c) shows the band structure and DOS of
borophene-MoS2 heterostructure, and the contribution of each element is
decomposed in the band structure. Clearly, in G-X and G-Y region above the
Fermi energy, Mo element contributes to the energy band, due to the charge
transfer from Mo to B (See later for charge discussion). Moreover, this energy
band is in a non-linear fashion and ends at 0.143 eV, leading to an abrupt
increase of the DOS ($\sim$ 4) above the Fermi energy. In this way, this
energy band in both electrodes will contribute to the transport in a resonance
way when the external bias is below 0.143 V. After the applied bias is over
0.143 V, this energy band in two electrodes will lose resonance, namely, the
incoming electron state corresponding to the DOS peak in the left electrode
miss the outgoing electron state corresponding to the DOS peak in the right
electrode. We believe that the resonance of the DOS peak in both electrodes is
the main reason that the _I-V_ characteristic of borophene-MoS2 system has a
non-linear behavior under smaller external bias. Fig. 3(d) shows the _I-V_
curve of borophene-MoS2 system with a smaller bias interval of 0.02 V, and a
piecewise function is used to fit the curve as:
$I_{1}=-935.83~{}V^{2}+629.89~{}V$ ($V\leq 0.14$ V), and
$I_{2}=423.46~{}V+10.71$ ($V\geq 0.16$ V). The crossover point of these two
fitted curves is at V=0.139 V, which is close to 0.143 V.

Figure 4: (a) Electrostatic potential and (b) charge of borophene, borophene-
MoS2 with and without gold electrodes. (c) The charge of B atoms indicated by
red dashed circles are calculated.

We now turn to understand why currents of the systems with gold electrodes are
drastically reduced compared to the current values of the systems without gold
electrodes. Ref. Oliver,  studied the ballistic conduction across the
intermetallic interface between gold and tungsten, and concluded that the
conduction is reduced compared to the conduction of pure gold or tungsten
because of dissimilar electronic structure that gold has $s$ wave-like modes
but tungsten has $d$ wave-like modes. Ref. Wu  and Kang  also think that one
factor to influence the spin injection efficiency from magnetic metal to
graphene or transition-metal dichalcogenide semiconductors is orbital
overlaps. In our case, borophene is actually extended along the transport
direction and gold acts as top contactsKang , that is, the $p$ orbitals of
borophene can contribute to the electron transport through the entire system,
therefore, we still seek another understanding on the current reducing with
gold electrodes.

Fig. 4(a) shows the averaged electrostatic potential of four systems without
molecules over the transverse direction. Clearly, for the pristine borophene
and heterostructure systems, the potential is periodic along the transport
direction, which is determined by the periodicity of the 2D crystal. For the
systems with gold electrodes, a potential barrier is formed in the scattering
region due to charge transfer. In this way, the incoming electron should pass
through this potential barrier before it goes out through the right electrode.
We also made a charge analysis as shown in Fig. 4(b), in which the valence
charge values of several B atoms in a selected row as indicted in Fig. 4(c) is
plotted. For pristine borophene the charge is +3 on all the B atoms. After
MoS2 substrate is added, electron transfer takes place from Mo atoms to B
atoms, leading to slightly increase of the charge on B atoms, these charges
contribute to the energy bands of the heterostructure around the Fermi energy
as shown in Fig. 3(c). After gold electrodes are introduced, more electrons
transfer from the electrodes to B atoms, leading to potential barrier forming
in the scattering region. Although gold is a good conductor and borophene also
shows metallic state, this potential barrier hinders the electron transport
and results in the decreasing of the current values.

Figure 5: The sensitivities of various borophene-based nano gas sensor to
molecules.

We finally calculated the sensitivity $S$ of the borophene-based nano gas
sensor to various molecules (Fig. 5), which is defined as $S=|I_{0}-I|/I$,
where $I$ and $I_{0}$ are the currents with and without molecules,
respectively.sensi ; Shen2020  The sensitivity of the pristine borophene gas
sensor keeps a high and nearly constant value ( 0.22), the sensitivity of the
borophene-MoS2 heterostructure gas sensor quickly and smoothly reduced with
increasing of the bias voltage. After gold electrodes are added, the
sensitivities keep below 0.2. We should point that under 0.1 V bias voltage
the sensitivities of heterostructure gas sensor with gold electrodes (purple
curves) can be clearly distinguished, which means that the four molecules we
studied in this paper can be well detected and differed by the gas sensor.

In summary, we studied the quantum transport properties of borophene-based
nano gas sensors with or without considering the influence of gas molecules,
MoS2 substrate and/or metal electrodes using density functional theory
combined with nonequilibrium Green’s function method. Numerical results show
that the gas sensors with gold electrodes can well detected and distinguished
CO, NO, NO2 and NH3 gas molecules. The effects of MoS2 substrate and gold
electrodes to the transport properties of borophene are calculated and
analyzed by electronic structure, charge, and electrostatic potential. Our
studies provide useful information to understand the transport behaviors
between 2D metallic materials with metal electrodes, which is usually not
considered when theoretically investigating the transport properties of 2D
metallic materials from first-principle in the literature.

See the supplementary material for (1) the optimized atomic details of
borophene and MoS2 heterostructure; (2) Relaxed structures of borophene
monolayer after adsorption of four different gas molecules; (3) The _I-V_
curve of ten different systems; (4) transmission for eleven different systems
with or without considering the influence of gas molecules, MoS2 substrate or
gold electrodes at equilibrium state and 0.5 V bias voltage and the
transmission versus moment k at Fermi energy.

###### Acknowledgements.

Y.T. is grateful to Mr Guodong Zhao for useful discussions regarding the use
of nanodcal software package. This work was financially supported by the
National Key R$\&$D Program of China (Grant No. 2018YFB040760) and the
National Natural Science Foundation of China (Grant No. 11774217). Y.T. and
H.Y. were partially supported by the Postgraduate Research Opportunities
Program of Hongzhiwei technology (Shanghai) Co., Ltd. (hzwtech-PROP).

## References

  * (1) Hong Liu Sha Hu Daqiang Zhang Xiao Liu, Sitian Cheng and Huansheng Ning.  A survey on gas sensing technology.  Sensors, 12(7):9635–9665, 2012.
  * (2) Ahsanul Kaiser Zainab Yunusa, Mohd. Nizar Hamidon and Zaiki Awang.  Gas sensors: a review.  Sensors & Transducers, 168:61–75, 2014.
  * (3) Zhang Xiaoxing, Chen Qinchuan, Tang Ju, Hu Weihua, and Zhang Jinbin.  Adsorption of SF6 decomposed gas on anatase (101) and (001) surfaces with oxygen defect: A density functional theory study.  Scientific Reports, 4:4762, 2014.
  * (4) Shumao Cui, Haihui Pu, Spencer A. Wells, Zhenhai Wen, Shun Mao, Jingbo Chang, Mark C. Hersam, and Junhong Chen.  Ultrahigh sensitivity and layer-dependent sensing performance of phosphorene-based gas sensors.  Nature Communications, 6:8632, 2015.
  * (5) Byungjin Cho, Jongwon Yoon, Sung Kwan Lim, Ah Ra Kim, Dong-Ho Kim, Sung-Gyu Park, Jung-Dae Kwon, Young-Joo Lee, Kyu-Hwan Lee, Byoung Hun Heung Cho Ko Lee, and Myung Gwan Hahm.  Chemical sensing of 2D graphene/MoS2 heterostructure device.  ACS applied materials & interfaces, 7(30):16775–16780, 2015.
  * (6) Yuxi Zhao, Jeong-Gyu Song, Gyeong Hee Ryu, Kyung Yong Ko, Whang Je Woo, Youngjun Kim, Donghyun Kim, Jun Hyung Lim, Sunhee Lee, Zonghoon Lee, Jusang Park, and Hyungjun Kim.  Low-temperature synthesis of 2D MoS2 on a plastic substrate for a flexible gas sensor.  Nanoscale, 10(19):9338–9345, 2018.
  * (7) Jun Mao, Yong Wang, Zhilong Zheng, and Dehui Deng.  The rise of two-dimensional MoS2 for catalysis.  Frontiers of Physics, 13(4):138118, 2018.
  * (8) Zhi-Qiang Wang, Tie-Yu Lü, Hui-Qiong Wang, Yuan Ping Feng, and Jin-Cheng Zheng.  Review of borophene and its potential applications.  Frontiers of Physics, 14(3):33404, 2019.
  * (9) Xiao-Ming Huang, Li-Zhao Liu, Si Zhou, and Ji-Jun Zhao.  Physical properties and device applications of graphene oxide.  Frontiers of Physics, 15(3):33301, 2020.
  * (10) Vivekanand Shukla, John Warna, Naresh K Jena, Anton Grigoriev, and Rajeev Ahuja.  Toward the realization of 2D borophene based gas sensor.  The Journal of Physical Chemistry C, 121(48):26869–26876, 2017.
  * (11) Shuhong Ma, Dongyu Yuan, Zhaoyong Jiao, Tianxing Wang, and Xianqi Dai.  Monolayer Sc2CO2: a promising candidate as a So2 gas sensor or capturer.  The Journal of Physical Chemistry C, 121(43):24077–24084, 2017.
  * (12) Dattatray J Late, Thomas Doneux, and Moussa Bougouma.  Single-layer MoSe2 based NH2 gas sensor.  Applied physics letters, 105(23):233103, 2014.
  * (13) Haichuan Mu, Zhiqiang Zhang, Xiaojing Zhao, Feng Liu, Keke Wang, and Haifen Xie.  High sensitive formaldehyde graphene gas sensor modified by atomic layer deposition zinc oxide films.  Applied Physics Letters, 105(3):033107, 2014.
  * (14) CW Chen, SC Hung, MD Yang, CW Yeh, CH Wu, GC Chi, FPSJ Ren, and SJ Pearton.  Oxygen sensors made by monolayer graphene under room temperature.  Applied Physics Letters, 99(24):243502, 2011.
  * (15) Ganhua Lu, Leonidas E Ocola, and Junhong Chen.  Gas detection using low-temperature reduced graphene oxide sheets.  Applied Physics Letters, 94(8):083111, 2009.
  * (16) Marisol González-Garnica, Andrés Galdámez-Martínez, Francisco Malagón, CD Ramos, G Santana, Reza Abolhassani, Pritam Kumar Panda, Ajeet Kaushik, Yogendra Kumar Mishra, Tangirala VK Karthik, et al.  One dimensional Au-ZnO hybrid nanostructures based CO2 detection: Growth mechanism and role of the seed layer on sensing performance.  Sensors and Actuators B: Chemical, 337:129765, 2021.
  * (17) Ritu Malik, Vijay K Tomer, Yogendra Kumar Mishra, and Liwei Lin.  Functional gas sensing nanomaterials: A panoramic view.  Applied Physics Reviews, 7(2):021301, 2020.
  * (18) Haifeng Wang, Qingfang Li, Yan Gao, F. Miao, Xiang-Feng Zhou, and X. G. Wan.  Strain effects on borophene: ideal strength, negative Possion’s ratio and phonon instability.  New Journal of Physics, 18(7):073016, 2016.
  * (19) Bo Peng, Hao Zhang, Hezhu Shao, Zeyu Ning, Yuanfeng Xu, Gang Ni, Hongliang Lu, David Wei Zhang, and Heyuan Zhu.  Stability and strength of atomically thin borophene from first principles calculations.  Materials Research Letters, 5(6):399–407, 2017.
  * (20) Zhuhua Zhang, Yang Yang, Evgeni S. Penev, and Boris I. Yakobson.  Elasticity, flexibility, and ideal strength of borophenes.  Advanced Functional Materials, 27(9):1605059, 2017.
  * (21) Miao Gao, Qi-Zhi Li, Xun-Wang Yan, and Jun Wang.  Prediction of phonon-mediated superconductivity in borophene.  Physical Review B, 95(2):024505, 2017.
  * (22) Bo Peng, Hao Zhang, Hezhu Shao, Yuanfeng Xu, Rongjun Zhang, and Heyuan Zhu.  The electronic, optical, and thermodynamic properties of borophene from first-principles calculations.  Journal of Materials Chemistry C, 4(16):3592–3598, 2016.
  * (23) Baojie Feng, Jin Zhang, Qing Zhong, Wenbin Li, Shuai Li, Hui Li, Peng Cheng, Sheng Meng, Lan Chen, and Kehui Wu.  Experimental realization of two-dimensional boron sheets.  Nature Chemistry, 8(6):563, 2016.
  * (24) Qing Zhong Wenbin Li Shuai Li Hui Li Peng Cheng Sheng Meng Lan Chen Baojie Feng, Jin Zhang and Kehui Wu.  Direct evidence of metallic bands in a monolayer boron sheet.  Physical Review B, 94(4):041408, 2016.
  * (25) Xiaojun Wu, Jun Dai, Yu Zhao, Zhiwen Zhuo, Jinlong Yang, and Xiao Cheng Zeng.  Two-dimensional boron monolayer sheets.  ACS Nano, 6(8):7443–7453, 2012.
  * (26) Liangzhi Kou, Thomas Frauenheim, and Changfeng Chen.  Phosphorene as a superior gas sensor: selective adsorption and distinct $I-V$ response.  The Journal of Physical Chemistry Letters, 5(15):2675–2681, 2014.
  * (27) Amirhossein Shahbazi Kootenaei and Goodarz Ansari.  B36 borophene as an electronic sensor for formaldehyde: quantum chemical analysis.  Physics Letters A, 380(34):2664–2668, 2016.
  * (28) Jiale Shen, Zhi Yang, Yatong Wang, Li-Chun Xu, Ruiping Liu, and Xuguang Liu.  The gas sensing performance of borophene/MoS2 heterostructure.  Applied Surface Science, 504:144412, 2020.
  * (29) Mingyan Chen, Zhizhou Yu, Yin Wang, Yiqun Xie, Jian Wang, and Hong Guo.  Nonequilibrium spin injection in monolayer black phosphorus.  Physical Chemistry Chemical Physics, 18(3):1601–1606, 2016.
  * (30) Mingyan Chen, Zhizhou Yu, Yiqun Xie, and Yin Wang.  Spin-polarized quantum transport properties through flexible phosphorene.  Applied Physics Letters, 109(14):142409, 2016.
  * (31) Yiqun Xie, Mingyan Chen, Zewen Wu, Yibin Hu, Yin Wang, Jian Wang, and Hong Guo.  Two-dimensional photogalvanic spin-battery.  Physical Review Applied, 10(3):034005, 2018.
  * (32) G. Kresse and J. Hafner.  Ab initio molecular dynamics for liquid metals.  Physical Review B, 47:558–561, Jan 1993.
  * (33) Sadegh Mehdi Aghaei, MM Monshi, I Torres, SMJ Zeidi, and I Calizo.  Dft study of adsorption behavior of NO, CO, NO2, and NH3 molecules on graphene-like BC3: a search for highly sensitive molecular sensor.  Applied Surface Science, 427:326–333, 2018.
  * (34) Jeremy Taylor, Hong Guo, and Jian Wang.  Ab initio modeling of quantum transport properties of molecular electronic devices.  Physical Review B, 63(24):245407, 2001.
  * (35) Jeremy Taylor, Hong Guo, and Jian Wang.  Ab initio modeling of open systems: Charge transfer, electron conduction, and moleculear switching of a 60C device.  Physical Review B, 63(12):121104, 2001.
  * (36) José M Soler, Emilio Artacho, Julian D Gale, Alberto García, Javier Junquera, Pablo Ordejón, and Daniel Sánchez-Portal.  The siesta method for ab initio order-n materials simulation.  Journal of Physics: Condensed Matter, 14(11):2745, 2002.
  * (37) John P. Perdew, Kieron Burke, and Matthias Ernzerhof.  Generalized gradient approximation made simple.  Physical Review Letters, 77:3865–3868, Oct 1996.
  * (38) N. Troullier and José Luís Martins.  Efficient pseudopotentials for plane-wave calculations.  Physical Review B, 43:1993–2006, Jan 1991.
  * (39) Byungjin Cho, Jongwon Yoon, Myung Gwan Hahm, Dong-Ho Kim, Ah Ra Kim, Yung Ho Kahng, Sang-Won Park, Young-Joo Lee, Sung-Gyu Park, Jung-Dae Kwon, et al.  Graphene-based gas sensor: metal decoration effect and application to a flexible device.  Journal of Materials Chemistry C, 2(27):5280–5285, 2014.
  * (40) David J Oliver, Jesse Maassen, Mehdi El Ouali, William Paul, Till Hagedorn, Yoichi Miyahara, Yue Qi, Hong Guo, and Peter Grütter.  Conductivity of an atomically defined metallic interface.  Proceedings of the National Academy of Sciences, 109(47):19097–19102, 2012.
  * (41) Qingyun Wu, Lei Shen, Zhaoqiang Bai, Minggang Zeng, Ming Yang, Zhigao Huang, and Yuan Ping Feng.  Efficient spin injection into graphene through a tunnel barrier: Overcoming the spin-conductance mismatch.  Physical Review Applied, 2:044008, Oct 2014.
  * (42) Jiahao Kang, Wei Liu, Deblina Sarkar, Debdeep Jena, and Kaustav Banerjee.  Computational study of metal contacts to monolayer transition-metal dichalcogenide semiconductors.  Physical Review X, 4:031005, Jul 2014.
  * (43) Ahmad I. Ayesh, Ayah F.S. Abu-Hani, Saleh T. Mahmoud, and Yousef Haik.  Selective h2s sensor based on cuo nanoparticles embedded in organic membranes.  Sensors and Actuators B: Chemical, 231:593 – 600, 2016.


InverseFi | / | / | / | / | / | / | / | /
ElevenFi | 400 | 759 | 1000 | 1341 | 2000 | 2363 | 4000 | 4326
bEarnFi | 400 | 1762 | 1000 | 2848 | 2000 | 2696 | 4000 | 4652
ApeRocket | 600 | 1659 | 1500 | 2426 | 3000 | 3309 | 6000 | 6235
AutoShark | 478 | 478 | 1068 | 1500 | 1645 | 1645 | 2753 | 2753
Novo | 400 | 412 | 1000 | 1035 | 2000 | 2028 | 4000 | 4031
Wdoge | 200 | 431 | 500 | 654 | 1000 | 1137 | 2000 | 2080
OneRing | 400 | 656 | 1000 | 1284 | 2000 | 2218 | 4000 | 4218
Puppet | 600 | 1244 | 1500 | 2012 | 3000 | 3509 | 6000 | 6452
PuppetV2 | 600 | 1806 | 1396 | 2369 | 2534 | 3348 | 4491 | 5061
Avg. data points: | 584 | 1338 | 1432 | 2450 | 2795 | 3656 | 5445 | 6248


# Scale-Invariant Adversarial Attack for Evaluating and Enhancing Adversarial
Defenses

Mengting Xu, Tao Zhang, Zhongnian Li, and Daoqiang Zhang Mengting Xu, Tao
Zhang, Zhongnian Li, and Daoqiang Zhang are with the College of Computer
Science and Technology, Nanjing University of Aeronautics and Astronautics,
Nanjing 211106, China.
E-mail<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

Efficient and effective attacks are crucial for reliable evaluation of
defenses, and also for developing robust models. Projected Gradient Descent
(PGD) attack has been demonstrated to be one of the most successful
adversarial attacks. However, the effect of the standard PGD attack can be
easily weakened by rescaling the logits, while the original decision of every
input will not be changed. To mitigate this issue, in this paper, we propose
Scale-Invariant Adversarial Attack (SI-PGD), which utilizes the angle between
the features in the penultimate layer and the weights in the softmax layer to
guide the generation of adversaries. The cosine angle matrix is used to learn
angularly discriminative representation and will not be changed with the
rescaling of logits, thus making SI-PGD attack to be stable and effective. We
evaluate our attack against multiple defenses and show improved performance
when compared with existing attacks. Further, we propose Scale-Invariant (SI)
adversarial defense mechanism based on the cosine angle matrix, which can be
embedded into the popular adversarial defenses. The experimental results show
the defense method with our SI mechanism achieves state-of-the-art performance
among multi-step and single-step defenses.

###### Index Terms:

cosine angle matrix, scale-invariant, adversarial attack, adversarial defense.

##  1 Introduction

Despite the widespread success of neural networks, recent studies have
highlighted the lack of robustness in state-of-the-art neural network models,
e.g., a well-trained network can be easily misled by a visually imperceptible
adversarial image. The vulnerability to adversarial examples calls into
question the safety-critical applications and services deployed by neural
networks. This finding has also spurred immense interest towards defense
methods to improve the robustness of deep neural networks against adversarial
attacks. While initial attempts of improving robustness against adversarial
attacks used just single-step adversaries for training [1], they were later
shown to be ineffective against strong multi-step attacks [2]. Then the
defenses using randomised or non-differentiable components were proposed to
minimise the effectiveness of gradient-based adversarial attack. However, many
such defenses [3, 4, 5] were later broken by Athalye et al. [6]. This game of
constructing defense methods against existing attacks and constructing
stronger attacks against the proposed defenses is crucial to the progress of
this field. Therefore, it’s necessary to construct effective adversarial
attack for evaluating and enhancing adversarial defense.

Figure 1: The unstable performance of PGD attack. The base model is trained by
TRADES [7]. When the logits of the model rescaled by factor from $10^{-3}$ to
$10^{3}$, the model accuracy attacked by PGD (bule line) changes obviously,
while our Scale-Invariant adversarial attack (SI-PGD,yellow line) is stable
and effective.

One of the most effective adversarial attacks to date is Projected Gradient
Descent (PGD) attack [8], which uniformly samples the initial point from the
neighborhood around the clean input, and computes the gradient of the cross-
entropy (CE) loss function around the current output logits of the model to
update the perturbations. However, despite the high performance of the PGD
attack, it still has a fatal flaw. The effect of the PGD attack with CE loss
based on logits can be easily weakened by rescaling the logits while the
original decision of the each input will not be changed. As shown in Fig. 1,
when the rescaling factor mutiplied to logits changes from $10^{-3}$ to
$10^{3}$, the effect of PGD attack has also changed significantly. The
instability of PGD attack may make the robustness of model evaluated by PGD
attack become unconvincing [9, 10]. Even worse, the performance of those PGD-
based defense models may also be weakened.

To address this problem, in this paper, we propose the Scale-Invariant
adversarial attack (SI-PGD) by utilizing the angle between the features in the
penultimate layer and the weights in the softmax layer with CE loss to guide
the generation of adversarial examples. Specifically, the cosine angle matrix
is used to learn angularly discriminative representation and will not be
changed with the rescaling of logits, thereby making SI-PGD effective and
stable. We demonstrate the state-of-the-art attack efficacy on multiple
defenses and datasets of the proposed SI-PGD. We further propose the Scale-
Invariant (SI) adversarial defense mechanism based on the cosine angle matrix,
which is concise and adaptable to be embedded into the popular adversarial
defenses. With proposed SI mechanism, we observe significant improvements in
both multi-step and single-step adversarial defenses.

Our main contributions are:

  * •

We reveal the fact that the effect of PGD attack can be easily changed with
the rescaling of the logits in Fig. 1.

  * •

We propose Scale-Invariant adversarial attack (SI-PGD), which achieves the
state-of-the-art performance across multiple defenses for a single attack and
multiple random restarts.

  * •

We propose Scale-Invariant (SI) adversarial defense mechanism, which achieves
the state-of-the-art performance of the model robustness when embedded into
the existing multi-step and single-step adversarial defenses.

The remainder of the paper is organized as follows. In Section 2 we review
related recent literature. We describe the materials including the datasets
and the problem formulations in Section 3. In Section 4, we reveal the
shortcoming of PGD attack, and propose our Scale-Invariant adversarial attack
(SI-PGD) and Scale-Invariant (SI) adversarial defense mechanism. In Section 5,
we evaluate the effectiveness of SI-PGD attack and SI defense mechanism. We
conclude in Section 6.

##  2 Related Works

###  2.1 Adversarial attacks

A lot of adversarial attacks have been proposed in recent years. Fast Gradient
Sign Method (FGSM) [1] is one of the earliest attacks specific to $L_{\infty}$
constrained adversaries. It calculates the gradient of the loss function with
respect to the pixel, and modifies the pixel value of a fixed step along the
direction of the gradient. Kurakin et al. [2] introduced a significantly
stronger, multi-step variant of this attack called Iterative FGSM (I-FGSM).
Then Madry et al. [8] developed a variant of this attack, which involves the
addition of initial random noise to the clean image, and is commonly referred
as Projected Gradient Descent (PGD) attack. Carlini and Wagner [11] explored
the use of maximum margin loss and optimization methods to craft adversarial
examples with high fidelity and small distortion with respect to the original
image. More recently, Croce and Hein [10] proposed AutoPGD, which is an
automatised variant of the PGD attack, that uses a step-learning rate schedule
adaptively based on the past progression of the optimization. They further
introduced a new loss function, Difference of Logits Ratio (DLR), which is a
scale invariant version of the maximum margin loss on logits. Additionally,
they proposed AutoAttack (AA), an ensemble of AutoPGD with the CE loss and the
DLR loss, the FAB attack [12] and Square attack [13].

###  2.2 Defenses against adversarial attacks

One of the most successful empirical defenses to date is adversarial training
(AT). It was first proposed in [14, 1], where they showed that adding
adversarial examples to the training set can improve the model robustness
against attacks. More recently, Madry et al. [8] formulated adversarial
training as a min-max optimization problem and demonstrated that adversarial
training with PGD attack leads to empirical robust model. Following this,
Kannan et al. [15] proposed adversarial logits paring (ALP), which regularizes
the distance between the clean logits and the adversarial ones. Then Zhang et
al. [7] presented a tight upper bound on the gap between natural and robust
error, in order to quantify the trade-off between accuracy and robustness.
Using the theory of classification calibrated losses, they developed TRADES, a
multi-step gradient-based technique. Wang et al. [16] further proposed MART
which differentiates the misclassified examples and correctly classified
examples during adversarial training, and adopted a regularized adversarial
loss involving both adversarial and natural examples to improve the robustness
of models. However, methods such as AT, TRADES are computationally intensive,
as they inherently depend upon the generation of strong adversaries through
iterative attacks.

Consequently, efforts were made to develop techniques that accelerated
adversarial training. Shafahi et al. [17] proposed a variant of AT, known as
Adversarial Training for Free (FreeAT), where the gradients accumulated in
each step are used to simultaneously update the adversarial example as well as
the network parameters. Contrary to prior wisdom, Wong et al. [18] found the
surprising result that Randomised FGSM (R-FGSM) [19] training could indeed be
successfully utilized to produce robust models. It was shown that R-FGSM
adversarial training (RFGSM-AT) could be made effective with the use of small-
step sizes for generation of adversarial examples, in combination with other
techniques such as early-stopping and cyclic learning rates. Moreover,
Sriramanan et al. [20] utilized function mapping of the clean image to guide
the generation of adversaries for adversarial training (GAT), and
Andriushchenko et al. [21] proposed GradAlign, that prevents catastrophic
overfitting by explicitly maximizing the gradient alignment inside the
perturbation set.

##  3 Materials

###  3.1 Datasets

We use the CIFAR-10, CIFAR-100 [22], and SVHN [23] datasets in our study. The
CIFAR-10 dataset consists of 60,000 32x32 colour images in 10 classes, with
6,000 images per class. There are 50,000 training images and 10,000 test
images. The CIFAR-100 has 100 classes containing 600 images each. There are
500 training images and 100 testing images per class. The 100 classes in the
CIFAR-100 are grouped into 20 superclasses. The SVHN dataset contains colour
images of streetview house numbers for 10 different classes.

###  3.2 Problem formulations

Let $\mathcal{X}\in\mathbb{R}^{d}$ denote the input space and
$\mathcal{Y}=\\{1,\cdots,K\\}$ be a finite set consists of $K$ possible class
labels. $D=\\{(\bm{x}_{1},y_{1}),\cdots,(\bm{x}_{m},y_{m})\\}$ is a training
set with $m$ labeled examples, where $\bm{x}_{i}\in\mathcal{X}$ is the feature
vector and $y_{i}\in\mathcal{Y}$ is the label of the $i$-th example. For the
classification task with $K$ labels in $[K]:=\\{1,\cdots,K\\}$, a deep neural
network can be generally denoted as the mapping function $f({\bm{x}})$ for
input ${\bm{x}}$ as

$f({\bm{x}})=\mathbb{S}(\bm{W}^{\top}\bm{z}+b),$ (1)

where we denote $g({\bm{x}})=\bm{W}^{\top}\bm{z}+b$ as the output logits of
the model, $\bm{z}=\bm{z}({\bm{x}};\bm{w})$ is the extracted feature with
model parameters $\bm{w}$, the matrix $\bm{W}=(W_{1},\cdots,W_{K})$ and vector
$b$ are the weight and bias in the softmax layer, respectively, and
$\mathbb{S}(\cdot)$ is the softmax function.

Next, we introduce the detailed information of PGD (standard PGD attack with
cross-entropy loss based on the output logits of the model [8]), PGDCW (PGD
attack with maximum margin loss proposed in C&W [11]), and PGDLR (PGD attack
with difference of logits ratio loss (DLR) [10]) attacks we used to compare
with our proposed SI-PGD in our study.

####  3.2.1 PGD

The standard PGD attack with cross-entropy loss is based on the output logits
of the model [8]. The formulation of PGD can be described as:

$\displaystyle{\bm{x}}_{0}^{\prime}={\bm{x}}+\mathbb{U}(-\epsilon,+\epsilon),$
(2) $\displaystyle{\bm{x}}_{t+1}^{\prime}={\rm Clip}_{{\bm{x}},\epsilon}$
$\displaystyle({\bm{x}}_{t}^{\prime}+\eta\cdot{\rm
sign}(\nabla_{\bm{x}}\mathcal{L}(f({\bm{x}}_{t}^{\prime}),y))),$ (3)
$\displaystyle\mathcal{L}(f({\bm{x}}_{t}^{\prime}),y)$
$\displaystyle=\mathcal{L}_{\rm CE}(f({\bm{x}}_{t}^{\prime}),y)=-\log
f({\bm{x}}_{t}^{\prime})_{y},$ (4)

where $\mathbb{U}(\cdot)$ is the uniform function, ${\rm
Clip}_{{\bm{x}},\epsilon}(\cdot)$ projects the adversarial example to satisfy
the $\epsilon$ constrain, $t$ is the number of step and $\eta$ is the step
size. $\mathcal{L}_{\rm CE}(\cdot)$ is the cross-entropy loss function.

####  3.2.2 PGDCW

PGDCW is the PGD attack with maximum margin loss proposed in C&W [11] rather
than standard cross-entropy loss:

$\mathcal{L}(f({\bm{x}}_{t}^{\prime}),y)=\mathcal{L}_{\rm
CW}(f({\bm{x}}_{t}^{\prime}),y)=-f({\bm{x}}_{t}^{\prime})_{y}+\max_{i\neq
y}f({\bm{x}}_{t}^{\prime})_{i}.$ (5)

####  3.2.3 PGDLR

PGDLR is the PGD attack with difference of logits ratio loss (DLR) [10]:

$\begin{split}\mathcal{L}(f({\bm{x}}_{t}^{\prime}),y)&=\mathcal{L}_{\rm
DLR}(f({\bm{x}}_{t}^{\prime}),y)\\\
&=-\frac{f({\bm{x}}_{t}^{\prime})_{y}-\max_{i\neq
y}f({\bm{x}}_{t}^{\prime})_{i}}{f({\bm{x}}_{t}^{\prime})_{\pi_{1}}-f({\bm{x}}_{t}^{\prime})_{\pi_{3}}},\end{split}$
(6)

where $\pi$ is the ordering of the components of $f({\bm{x}}_{t}^{\prime})$ in
decreasing order.

((a)) Misclassified

((b)) Updating the norm of weight

((c)) Updating the direction of the weight

Figure 2: A geometrical interpretation of our proposed SI mechanism. Different
color areas represent distinct classes. (a) A adversarial example
$\hat{{\bm{x}}}$ with label $k_{1}$ is misclassified by the model. (b) The
model can correctly classified adversarial example by updating the norm of
weight. However, the endless increase in weight may lead the phenomenon of
gradient vanishing. (c) The model can correctly classified adversarial example
by updating the direction of weight. By adding the cosine angle regularization
which bounded in $[-1,1]$, the vanishing of the gradient caused by the
increase of weight can be alleviated.

##  4 Methods

In this section, we first analyze the shortcoming of standard PGD attack, and
then propose our Scale-Invariant adversarial attack (SI-PGD) and Scale-
Invariant (SI) adversarial defense mechanism.

###  4.1 Shortcoming of standard PGD attack

One of the most effective attacks known till date is the PGD attack, which
starts with a random initialization and moves along the gradient direction to
maximize cross-entropy (CE) loss based on the output logits of the model.

One common training objective for deep neural networks is the CE loss, which
is defined as

$\mathcal{L}_{\rm CE}(f({\bm{x}}),y)=-\log
f({\bm{x}})_{y}=-g({\bm{x}})_{y}+\log(\sum_{i=1}^{K}e^{g({\bm{x}})_{i}}),$ (7)

where $g({\bm{x}})_{y}$ is the logits output of the network with respect to
class $y$, and $f({\bm{x}})_{y}$ is the probability (softmax on logits) of
${\bm{x}}$ belonging to class $y$. Then the adversarial examples generated by
PGD attack with maximum $L_{\infty}$ norm perturbation $\epsilon$ can be
described as

$\displaystyle{\bm{x}}_{0}^{\prime}={\bm{x}}+\mathbb{U}(-\epsilon,+\epsilon),$
(8) $\displaystyle{\bm{x}}_{t+1}^{\prime}={\rm Clip}_{{\bm{x}},\epsilon}$
$\displaystyle({\bm{x}}_{t}^{\prime}+\eta\cdot{\rm
sign}(\nabla_{\bm{x}}\mathcal{L}_{\rm CE}(f({\bm{x}}_{t}^{\prime}),y))),$ (9)
$\displaystyle\hat{{\bm{x}}}^{\prime}=$
$\displaystyle\arg\max_{{\bm{x}}^{\prime}\in\mathcal{B}_{\epsilon}({\bm{x}})}\mathcal{L}_{\rm
CE}(f({\bm{x}}^{\prime}),y),$ (10)

where $\mathbb{U}(\cdot)$ is the uniform function, ${\rm
Clip}_{{\bm{x}},\epsilon}(\cdot)$ projects the adversarial example to satisfy
the $\epsilon$ constrain, $t$ is the number of step and $\eta$ is the step
size.
$\mathcal{B}_{\epsilon}(\bm{x})=\\{\bm{x}^{\prime}:||\bm{x}^{\prime}-\bm{x}||_{\infty}\leq\epsilon\\}$
denotes the $L_{\infty}$-norm ball centered at $\bm{x}$ with radius
$\epsilon$.

Analyzing the definition of PGD attack, we have

$\begin{split}\nabla_{\bm{x}}\mathcal{L}_{\rm
CE}(f({\bm{x}}_{t}^{\prime}),y)&=(-1+f({\bm{x}}_{t}^{\prime})_{y})\nabla_{\bm{x}}g({\bm{x}}_{t}^{\prime})_{y}\\\
&+\sum_{i\neq
y}f({\bm{x}}_{t}^{\prime})_{i}\nabla_{\bm{x}}g({\bm{x}}_{t}^{\prime})_{i}.\end{split}$
(11)

If $f({\bm{x}}_{t}^{\prime})_{y}\approx 1$ and consequently
$f({\bm{x}}_{t}^{\prime})_{i}\approx 0$ for $i\neq y$, then
$\nabla_{\bm{x}}\mathcal{L}_{\rm CE}(f({\bm{x}}_{t}^{\prime}),y)\approx 0$ and
finite arithmetic yields $\nabla_{\bm{x}}\mathcal{L}_{\rm
CE}(f({\bm{x}}_{t}^{\prime}),y)=0$. This phenomenon of gradient vanishing will
make PGD attack ineffective. Note that one can achieve
$f({\bm{x}}_{t}^{\prime})_{y}\approx 1$ with a scaled classifier
$h=f(\alpha\cdot g)$ equivalent to $f$ (i.e., they make the same decision for
every ${\bm{x}}$) but rescaled by a constant $\alpha\textgreater 0$. The
detailed proof is as follows:

Proof 1. We denote
$\hat{g}({\bm{x}})=\alpha\cdot(\bm{W}^{\top}\bm{z}+b)=\alpha\cdot g({\bm{x}})$
as the output logits of the classifier $h$, where $g({\bm{x}})$ is the logits
of classifer $f$. Then we have

$\hat{f}({\bm{x}})=\mathbb{S}(\hat{g}({\bm{x}})),$ (12)

where $\mathbb{S}(\cdot)$ is the softmax function. Considering the binary-
class case with classes $k_{1}$ and $k_{2}$ as a example, we denote $k_{1}$ as
the true label of input ${\bm{x}}$, i.e.,
$\hat{f}({\bm{x}})_{k_{1}}\textgreater\hat{f}({\bm{x}})_{k_{2}}$. If we want
$\hat{f}({\bm{x}})_{k_{1}}\approx 1$, i.e.,

$\begin{split}\hat{f}({\bm{x}})_{k_{1}}&=\frac{\exp(\alpha
g({\bm{x}})_{k1})}{\exp(\alpha g({\bm{x}})_{k_{1}})+\exp(\alpha
g({\bm{x}})_{k_{2}})}\\\
&=\frac{1}{1+\exp(\alpha(g({\bm{x}})_{k_{2}}-g({\bm{x}})_{k_{1}}))}\approx
1,\end{split}$ (13)

i.e.,

$\exp(\alpha(g({\bm{x}})_{k_{2}}-g({\bm{x}})_{k_{1}}))\approx 0.$ (14)

Denote

$\alpha(g({\bm{x}})_{k_{2}}-g({\bm{x}})_{k_{1}})=\beta,$ (15)

where $\beta$ is a threshold that satisfies Equation (14) (e.g.,
$\beta\in[-\infty,-10^{5}]$). Hereafter, we can get

$\alpha=\frac{\beta}{g({\bm{x}})_{k_{2}}-g({\bm{x}})_{k_{1}}}.$ (16)

Thus, we get a $\alpha$ proves that $f({\bm{x}})_{y}\approx 1$ can be achieved
by a classifier $h=f(\alpha\cdot g)$.

As we shown in Fig 1, when the logits rescaled by factor from $10^{-3}$ to
$10^{3}$, the model accuracy attacked by PGD (blue line) changes obviously.
This discovery exposes the instability of PGD based on the logits, which may
influence the reported robustness of model evaluated by PGD.

###  4.2 Scale-Invariant adversarial attack (SI-PGD)

To mitigate this potential threat, we propose the Scale-Invariant adversarial
attack (SI-PGD) based on the angle between the features in the penultimate
layer and the weights in the softmax layer to guide the generation of
adversaril examples. Specifically, note that in Equation (1) there is
$\bm{W}^{\top}\bm{z}=(W_{1}^{\top}\bm{z},\cdots,W_{K}^{\top}\bm{z)}$, and
$\forall k\in[K]$, the inner product $W_{k}^{\top}\bm{z}=\lVert
W_{k}\rVert\lVert\bm{z}\rVert\cos(\theta_{k})$, where we denote
$\theta_{k}=\angle(W_{k},\bm{z})$. Let
$\cos\bm{\theta}=(\cos(\theta_{1}),\cdots,\cos(\theta_{k}))$, then the output
prediction used in SI-PGD is described as

$\widetilde{f}({\bm{x}})=\mathbb{S}(\cos\bm{\theta}).$ (17)

The CE loss with $\widetilde{f}({\bm{x}})$ is formulated as

$\mathcal{L}_{\rm
CE}(\widetilde{f}({\bm{x}}),y)=-\log\mathbb{S}(\cos\theta_{y}),$ (18)

where, $\forall\cos(\theta_{y})\in[-1,1],\nabla_{\bm{x}}\mathcal{L}_{\rm
CE}(\widetilde{f}({\bm{x}}),y)\neq 0$. The proof is as follows:

Proof 2. If $\nabla_{\bm{x}}\mathcal{L}_{\rm
CE}(\widetilde{f}({\bm{x}}),y)=0$, i.e., $\widetilde{f}({\bm{x}})_{y}\approx
1$. Considering the binary-class case with classes $k_{1}$ and $k_{2}$ as a
example, we denote $k_{1}$ as the true label of input ${\bm{x}}$. i.e.,

$\begin{split}\widetilde{f}({\bm{x}})_{k_{1}}&=\frac{\exp(\cos\theta_{k_{1}})}{\exp(\cos(\theta_{k_{1}})+\cos(\theta_{k_{2}}))}\\\
&=\frac{1}{1+\exp(\cos(\theta_{k_{2}})-\cos(\theta_{k_{1}}))}\approx
1,\end{split}$ (19)

i.e.,

$\exp(\cos(\theta_{k_{2}})-\cos(\theta_{k_{1}}))\approx 0.$ (20)

Denote

$\cos(\theta_{k_{2}})-\cos(\theta_{k_{1}})=\beta,$ (21)

where $\beta$ is a threshold that satisfies Equation (20) (e.g.,
$\beta\in[-\infty,-10^{5}]$). Hereafter, we can get

$\cos\theta_{k_{1}}=\cos\theta_{k_{2}}-\beta.$ (22)

Since $\cos\theta_{k_{1}}\in[-1,1]$, and
$\cos\theta_{k_{2}}-\beta\in[-\infty,-10^{5}]$. Therefore, Equation (22) does
not hold. Thus, $\widetilde{f}({\bm{x}})_{y}\approx 1$ as well as
$\nabla_{\bm{x}}\mathcal{L}_{\rm CE}(\widetilde{f}({\bm{x}}),y)=0$ are
impossible. Therefore, $\forall\cos(\theta_{y})\in[-1,1],$ we can obtain that

$\nabla_{\bm{x}}\mathcal{L}_{\rm CE}(\widetilde{f}({\bm{x}}),y)\neq 0.$ (23)

Therefore, there is no phenomenon of gradient vanishing for proposed SI-PGD.
Then similar to Equations (8) and (10), we can obtain the proposed Scale-
Invariant adversarial attack (SI-PGD) as

$\displaystyle{\bm{x}}_{t+1}^{\prime}={\rm Clip}_{{\bm{x}},\epsilon}$
$\displaystyle({\bm{x}}_{t}^{\prime}+\eta\cdot{\rm
sign}(\nabla_{\bm{x}}\mathcal{L}_{\rm
CE}(\widetilde{f}({\bm{x}}_{t}^{\prime}),y)))$ $\displaystyle={\rm
Clip}_{{\bm{x}},\epsilon}({\bm{x}}_{t}^{\prime}$ $\displaystyle+\eta\cdot{\rm
sign}(\nabla_{\bm{x}}(-\log\mathbb{S}(s\cdot\cos\theta_{y}^{\prime})_{t})),$
(24)

here $s\textgreater 0$ is a hyperparameter to improve the numcrical stability
[24].

The superiority of our SI-PGD can be confirmed from two aspects. First, the
consine angle matrix is used to learn angularly discriminative representation
of each input, which will guide SI-PGD to generate adversarial examples more
effectively. Second, the angle of input will not change with the rescaling of
the logits (i.e., the effect of SI-PGD will not be influenced by classifier
such as $h=f(\alpha\cdot g)$, where $\alpha\textgreater 0$). The same
verifications can also be observed in Fig. 1 yellow line, where our SI-PGD is
more effective and stable than standard PGD attack.

TABLE I: Formulations of the adversarial training frameworks without (✗) or with (✓) SI. The differences between our enhanced versions (with SI) from the original versions (without SI) are colored red. The adversarial objective $\mathcal{L}_{A}$ constructs adversarial examples (the inner maximization problem), and the training objective $\mathcal{L}_{T}$ updates parameters (the outer minimization problem). ${\rm KL}(\cdot)$ is Kullback-Leibler (KL) divergence.  Methods | SI | Training objective | Adversarial objective
---|---|---|---
AT [8] | ✗ | $\mathcal{L}_{\rm CE}(f(\hat{{\bm{x}}}^{\prime}),y)$ | $\mathcal{L}_{\rm CE}(f({\bm{x}}^{\prime}),y)$
✓ | $\mathcal{L}_{\rm CE}(f(\hat{{\bm{x}}}^{\prime}),y)+{\color[rgb]{1,0,0}\beta\mathcal{L}_{\rm CE}^{m}(\widetilde{f}(\hat{{\bm{x}}}^{\prime}),y)}$ | $\mathcal{L}_{\rm CE}({\color[rgb]{1,0,0}\widetilde{f}}({\bm{x}}^{\prime}),y)$
TRADES [7] | ✗ | $\mathcal{L}_{\rm CE}(f({{\bm{x}}}),y)+\lambda\cdot{\rm KL}(f({{\bm{x}}}),f(\hat{{\bm{x}}}^{\prime}))$ | ${\rm KL}(f({{\bm{x}}}),f({\bm{x}}^{\prime}))$
✓ | $\mathcal{L}_{\rm CE}(f({{\bm{x}}}),y)+\lambda\cdot{\rm KL}(f({{\bm{x}}}),f(\hat{{\bm{x}}}^{\prime}))+{\color[rgb]{1,0,0}\beta\mathcal{L}_{\rm CE}^{m}(\widetilde{f}(\hat{{\bm{x}}}^{\prime}),y)}$ | ${\color[rgb]{1,0,0}\mathcal{L}_{\rm CE}(\widetilde{f}({\bm{x}}^{\prime}),y)}$
ALP [15] | ✗ | $\alpha\mathcal{L}_{\rm CE}(f({{\bm{x}}}),y)+(1-\alpha)\mathcal{L}_{\rm CE}(f(\hat{{\bm{x}}}^{\prime}),y)+\lambda\lVert\bm{W}^{\top}(\bm{z}-\hat{\bm{z}}^{\prime})\rVert_{2}$ | $\mathcal{L}_{\rm CE}(f({\bm{x}}^{\prime}),y)$
✓ | $\alpha\mathcal{L}_{\rm CE}(f({{\bm{x}}}),y)+(1-\alpha)\mathcal{L}_{\rm CE}(f(\hat{{\bm{x}}}^{\prime}),y)+\lambda\lVert\bm{W}^{\top}(\bm{z}-\hat{\bm{z}}^{\prime})\rVert_{2}+{\color[rgb]{1,0,0}\beta\mathcal{L}_{\rm CE}^{m}(\widetilde{f}(\hat{{\bm{x}}}^{\prime}),y)}$ | $\mathcal{L}_{\rm CE}({\color[rgb]{1,0,0}\widetilde{f}}({\bm{x}}^{\prime}),y)$
MART [16] | ✗ | $\mathcal{L}_{\rm BCE}(f(\hat{{\bm{x}}}^{\prime}),y)+\lambda\cdot{\rm KL}(f({{\bm{x}}}),f(\hat{{\bm{x}}}^{\prime}))\cdot(1-f({\bm{x}})_{y})$ | $\mathcal{L}_{\rm CE}(f({\bm{x}}^{\prime}),y)$
✓ | $\mathcal{L}_{\rm BCE}(f(\hat{{\bm{x}}}^{\prime}),y)+\lambda\cdot{\rm KL}(f({{\bm{x}}}),f(\hat{{\bm{x}}}^{\prime}))\cdot(1-f({\bm{x}})_{y})+{\color[rgb]{1,0,0}\beta\mathcal{L}_{\rm CE}^{m}(\widetilde{f}(\hat{{\bm{x}}}^{\prime}),y)}$ | $\mathcal{L}_{\rm CE}({\color[rgb]{1,0,0}\widetilde{f}}({\bm{x}}^{\prime}),y)$

###  4.3 Scale-Invariant adversarial defense mechanism

In this section, we discuss details on the proposed Scale-Invariant (SI)
adversarial defense mechanism. As discussed in Section 4.2, our proposed SI-
PGD can obtain more effective and stable attack efficacy, so we utilize the
adversarial examples generated by SI-PGD for adversarial training. Moreover,
to obtain more robust defense, SI mechanism also applys cosine angle matrix as
a regularization term in the outer minimization phase of the adversarial
training, where $\widetilde{f}({\bm{x}})$ is fed into the CE loss with a
margin $m$ formulated as

$\mathcal{L}_{\rm
CE}^{m}(\widetilde{f}({\bm{x}}),y)=-\log\mathbb{S}(s\cdot(\cos\theta_{y}-m)),$
(25)

where $m$ is used to learn angularly more discriminative features [25].

As shown in Fig. 2, we perform a toy example with a binary-class case to
analyze our proposed SI mechanism during model outer minimization phase. The
decision boundary in CE loss is $(W_{1}-W_{2}){\bm{z}}+b_{1}-b_{2}=0$, where
$W_{i}$ and $b_{i}$ are weights and bias in softmax layer, respectively.
Assume that we have an adversarial example $\hat{{\bm{x}}}$ with original
label $k_{1}$ and constrain $\lVert W_{1}\rVert=\lVert W_{2}\rVert$ and
$b_{1}=b_{2}=0$, then the decision boundary becomes
$\cos\theta_{1}=\cos\theta_{2}$, as shown in Fig. 2(a). Since the adversarial
example is misclassified, $W_{1}$ will be updated towards both in norm (as
shown in Fig. 2(b)) and feature direction (as shown in Fig. 2(c)), which may
cause repetitive oscillation during training when fitting majority of
adversarial examples. Moreover, the unconstrained nature of the weight may
cause the model to be more inclined to update the norm of the weight rather
than the direction, and the gradually increasing weight of the example will
cause the network to increase its output logits, which may occur the
phenomenon of gradient vanishing as analyzed in Section 4.1. Therefore, our
cosine angle regularization is dedicated to assisting the model to update the
weight in the direction of features, which alleviates the noneffective
oscillation on the weight norm and the phenomenon of gradient vanishing due to
the bounded value range $[-1,1]$.

To highlight our main contributions in terms of methodology, we summarize the
proposed formulas of defenses in TABLE I. We mainly consider four
representative adversarial training frameworks including AT (adversarial
training based on PGD) [8], TRADES [7], ALP [15], and MART [16]. The
differences between our enhanced versions (with SI) from the original versions
(without SI) are colorized. Note that we apply the SI both on the adversarial
objective for constructing adversarial examples (the inner maximization
phase), and the training objective for updating parameters (the outer
minimization phase).

TABLE II: The sensitivity of scale $s$. Accuracy (%) on CIFAR-10 with ResNet18. The training framework is TRADES-SI with different scale $s$ and margin $m=0.2$. The original accuracy of test images is shown in column “Natural”. Method | $m$ | $s$ | Natural | PGD | PGDCW | SI-PGD | AA
---|---|---|---|---|---|---|---
TRADES | 0 | 0 | 84.15 | 55.23 | 52.67 | 52.24 | 50.06
TRADES-SI | 0.2 | 10 | 83.75 | 58.03 | 53.21 | 53.34 | 50.05
0.2 | 15 | 84.05 | 58.73 | 53.56 | 54.77 | 50.60
0.2 | 20 | 84.15 | 58.73 | 53.49 | 55.46 | 50.11
0.2 | 30 | 83.71 | 58.26 | 52.94 | 56.33 | 50.12
0.2 | 40 | 83.16 | 57.90 | 52.77 | 57.37 | 49.54
0.2 | 50 | 83.10 | 57.27 | 52.22 | 57.92 | 49.04
0.2 | 60 | 82.12 | 57.38 | 52.20 | 58.47 | 49.06
TABLE III: The sensitivity of margin $m$. Accuracy (%) on CIFAR-10 with ResNet18. The training framework is TRADES-SI with different margin $m$ and scale $s=15$. The original accuracy of test images is shown in column “Natural”. Method | $s$ | $m$ | Natural | PGD | PGDCW | SI-PGD | AA
---|---|---|---|---|---|---|---
TRADES | 0 | 0 | 84.15 | 55.23 | 52.67 | 52.24 | 50.06
TRADES-SI | 15 | 0.0 | 82.95 | 58.01 | 52.86 | 54.73 | 50.11
15 | 0.1 | 83.10 | 58.46 | 52.98 | 54.28 | 50.17
15 | 0.2 | 84.05 | 58.73 | 53.56 | 54.77 | 50.60
15 | 0.3 | 83.62 | 57.82 | 53.20 | 53.89 | 50.00
15 | 0.4 | 83.49 | 57.78 | 53.16 | 54.12 | 50.17
15 | 0.5 | 82.72 | 57.58 | 53.19 | 54.15 | 50.13
15 | 0.6 | 83.37 | 57.35 | 52.71 | 53.53 | 49.36
TABLE IV: The sensitivity of margin $\beta$. Accuracy (%) on CIFAR-10 with ResNet18. The training framework is TRADES-SI with different $\beta$. The margin $m=0.2$ and scale $s=15$. The original accuracy of test images is shown in column “Natural”. Method | $\beta$ | Natural | PGD | PGDCW | SI-PGD | AA
---|---|---|---|---|---|---
TRADES | - | 84.15 | 55.23 | 52.67 | 52.24 | 50.06
TRADES-SI | 0 | 81.58 | 59.59 | 52.67 | 52.95 | 49.59
0.1 | 83.04 | 58.53 | 53.05 | 53.95 | 50.05
0.2 | 84.05 | 58.73 | 53.56 | 54.77 | 50.60
0.3 | 84.36 | 57.96 | 53.27 | 54.50 | 50.34
0.4 | 84.82 | 58.12 | 53.51 | 54.55 | 50.55
0.5 | 84.15 | 57.82 | 53.11 | 54.23 | 50.22
0.6 | 84.29 | 57.95 | 53.27 | 54.26 | 50.08
TABLE V: Attacks (CIFAR-10):Accuracy (%) of various defenses (rows) against adversaries generated using different 20-step attacks (columns) under the $\ell_{\infty}$ bound with $\epsilon=8/255$. Architecture of each defense is described in the column “Model”. WideResNet is denoted by W (W-28-10 represents WideResNet-28-10), ResNet18 is denoted by RN-18. The original accuracy of each defense is described in the column “Natural”. $\dagger$ Additional data used for training. | Model | Natural | Single run of the attack | 5 random restarts
---|---|---|---|---
| PGD | PGDCW | PGDLR | SI-PGD | PGD | PGDCW | PGDLR | SI-PGD
AT [8] | RN-50 | 85.46 | 56.64 | 54.95 | 57.47 | 54.65 | 56.10 | 54.47 | 56.95 | 54.41
TRADES [7] | W-34-10 | 84.92 | 57.16 | 55.45 | 57.15 | 55.27 | 56.84 | 55.20 | 56.79 | 55.02
Pre-training [26] $\dagger$ | W-28-10 | 87.11 | 59.60 | 58.27 | 60.39 | 57.09 | 59.19 | 57.83 | 59.95 | 56.95
RST [27] $\dagger$ | W-28-10 | 89.69 | 65.05 | 63.09 | 64.73 | 62.34 | 64.52 | 62.74 | 64.33 | 62.18
MART [16] | RN-18 | 83.07 | 55.41 | 51.50 | 53.42 | 51.32 | 55.06 | 51.08 | 52.79 | 50.95
MART [16] $\dagger$ | W-28-10 | 87.50 | 64.77 | 61.04 | 62.65 | 60.60 | 64.31 | 60.47 | 62.04 | 60.32
HYDRA [28] $\dagger$ | W-28-10 | 88.98 | 62.84 | 60.54 | 62.41 | 60.13 | 62.34 | 60.23 | 61.89 | 59.93
TABLE VI: Multi-step defenses under white-box attack: Accuracy (%) of different defense mothods (rows) against various $L_{\infty}$ norm bound ($\epsilon=8/255$) white-box attacks (columns) on CIFAR-10 and CIFAR-100 datasets with ResNet18 and WideResNet. The original accuracy of each defense is described in the column “Natural”. Network | Method | CIFAR-10 | CIFAR-100
---|---|---|---
Natural | PGD | PGDCW | SI-PGD | AA | Natural | PGD | PGDCW | SI-PGD | AA
ResNet18 | AT [8] | 85.57 | 54.12 | 53.15 | 52.47 | 48.49 | 60.48 | 31.11 | 29.44 | 29.37 | 25.57
AT-SI | 83.03 | 55.76 | 52.93 | 52.89 | 48.15 | 57.52 | 31.94 | 28.72 | 29.68 | 25.30
TRADES [7] | 84.15 | 55.23 | 52.67 | 52.24 | 50.06 | 62.05 | 31.39 | 27.10 | 26.68 | 25.04
TRADES-SI | 84.05 | 58.73 | 53.56 | 54.77 | 50.60 | 60.17 | 33.54 | 28.19 | 29.66 | 25.86
ALP [15] | 84.25 | 56.11 | 53.26 | 53.06 | 50.30 | 58.19 | 31.16 | 27.89 | 27.61 | 25.47
ALP-SI | 85.70 | 57.64 | 53.06 | 52.66 | 49.30 | 61.49 | 32.46 | 28.38 | 28.62 | 25.51
MART [16] | 80.99 | 57.11 | 52.38 | 52.27 | 48.71 | 54.58 | 33.37 | 28.68 | 28.54 | 26.10
MART-SI | 81.46 | 61.02 | 52.49 | 53.90 | 49.09 | 56.53 | 35.25 | 29.50 | 31.02 | 26.77
WideResNet-34-10 | AT [8] | 85.60 | 55.84 | 54.78 | 54.76 | 51.02 | 59.48 | 32.34 | 30.01 | 29.63 | 26.84
AT-SI | 85.69 | 57.01 | 55.37 | 55.58 | 51.48 | 60.25 | 32.65 | 30.44 | 31.51 | 27.26
TRADES [7] | 86.36 | 58.04 | 56.32 | 56.27 | 52.35 | 63.74 | 33.85 | 30.62 | 30.16 | 27.24
TRADES-SI | 86.53 | 60.14 | 56.40 | 57.51 | 53.22 | 62.39 | 35.07 | 30.89 | 31.90 | 28.54
ALP [15] | 87.31 | 57.54 | 55.73 | 55.42 | 52.49 | 63.18 | 32.13 | 29.54 | 29.18 | 27.02
ALP-SI | 86.04 | 59.65 | 55.74 | 55.57 | 52.73 | 64.14 | 32.89 | 30.00 | 30.11 | 26.83
MART [16] | 84.41 | 59.93 | 55.55 | 55.74 | 52.23 | 55.28 | 34.59 | 30.92 | 30.84 | 28.21
MART-SI | 85.30 | 62.31 | 56.17 | 57.07 | 52.01 | 58.90 | 36.47 | 30.98 | 32.92 | 28.36
TABLE VII: Multi-step defenses under white-box attack on SVHN: Accuracy (%) of different defense methods (rows) against various $L_{\infty}$ norm bound ($\epsilon=8/255$) white-box attacks (columns) on SVHN with ResNet18. The original accuracy of each defense is described in the column “Natural”. | Natural | PGD | PGDCW | SI-PGD | AA
---|---|---|---|---|---
AT [8] | 92.91 | 57.99 | 56.20 | 55.39 | 49.75
AT-SI | 92.34 | 60.05 | 57.08 | 57.11 | 51.19
TRADES [7] | 90.42 | 61.28 | 57.39 | 56.90 | 50.82
TRADES-SI | 89.66 | 62.68 | 57.93 | 58.87 | 52.13
ALP [15] | 91.79 | 61.42 | 57.38 | 56.88 | 51.68
ALP-SI | 90.02 | 61.43 | 57.49 | 58.49 | 52.56
MART [16] | 91.84 | 62.45 | 56.50 | 55.54 | 49.64
MART-SI | 90.09 | 64.32 | 58.01 | 58.57 | 51.96

##  5 Experiments

In this section, we first introduce the experimental settings including the
networks and adversarial attack settings we used in this study. Second, we
choose the parameters $s$, $m$, and $\beta$ for our further experiments by
ablation study. Then, we present the experimental results of the proposed SI-
PGD attack, followed by details on evaluation of the proposed defense
mechanism SI. Finally, we analyze the effectiveness of our method.

###  5.1 Experiment setting

####  5.1.1 Networks

ResNet18 and PreActResNet18 setup [29, 30]. For each defense method, we apply
the SGD with momentum 0.9, weight decay $5\times 10^{-4}$ and an initial
learning rate 0.01, which is divided by 10 at the 75-th, 90-th, and 100-th
epoch. The total epoch is 120.

WideResNet setup. For each defense method, we apply the SGD with momentum 0.9,
weight decay $7\times 10^{-4}$ and an initial learning rate 0.1, which is
divided by 10 at the 75-th. The total epoch is 90.

####  5.1.2 Attack setting

We compare proposed SI-PGD with three types of attack: PGD (standard PGD
attack with cross-entropy loss based on the output logits of the model [8]),
PGDCW (PGD attack with maximum margin loss proposed in C&W [11]), and PGDLR
(PGD attack with difference of logits ratio loss (DLR) [10]). The maximum
$L_{\infty}$ perturbation $\epsilon=8/255$ for all attacks with 20 steps. The
step size is $\epsilon/4$.

###  5.2 Ablation study

In this part, we explore the sensitivity of parameters $s$, $m$, and $\beta$.
Different choices of the scale $s$, the margin $m$, and the hyperparameter
$\beta$ in SI-PGD and SI defense mechanism lead to different trade-offs
between the clean accuracy and the adversarial robustness of the trained
models. TABLE II, TABLE III, and TABLE IV show the sensitivities of $s$, $m$,
and $\beta$, respectively. We choose $s=15$, $m=0.2$, and $\beta=0.2$ in our
experiments.

###  5.3 Evaluation of the proposed SI-PGD attack

The performance of various defenses against different attacks on CIFAR-10 is
shown in TABLE V. We present results for both a single run of the attack (with
a budget of 20 iterations), as well as the worst-case accuracy across 5 random
restarts (with an effective budget of $5\times 20$ iterations). Notably, SI-
PGD consistently outperforms all other attacks across all defenses.
Particularly under the most common comparison setting (single run of the PGD
attack on CIFAR-10), The attack success rate of SI-PGD improved $\sim 2\%$ on
AT [8], $\sim 3\%$ on RST [27] and even $\sim 4\%$ on MART [16]. A similar
trend of improvement can be also observed for the random restarts of the
attacks.

###  5.4 Evaluation of the proposed Scale-Invariant adversarial defense
mechanism

In this part, we embed our SI defense mechanism into both the popular multi-
step and single-step adversarial defenses against white-box and black-box
attacks to verify the superiority of our SI defense mechanism. As presented in
TABLE I, we set $\beta=0.2$ for all defense methods, and $\lambda=6,3,6$ for
TRADES, ALP, and MART, respectively. The attack used for training is ${\rm
PGD}$ with random start. The maximun perturbation $\epsilon=8/255$ and the
number of step is 10 with step size $\epsilon/4$. The mini-batch size is 128.

####  5.4.1 Performance under white-box attack

TABLE VIII: Single-step defenses under white-box attack: Accuracy (%) of different defense methods (rows) against various $L_{\infty}$ norm bound ($\epsilon=8/255$) white-box attacks (columns) on CIFAR-10 with different models RN-18 (ResNet18) and PARN-18 (PreActResNet18). Original accuracy of each defense is described in “Natural”. Model | Method | Natural | PGD | PGDCW | SI-PGD
---|---|---|---|---|---
RN-18 | FreeAT [17] | 84.45 | 47.69 | 47.14 | 47.31
FreeAT-SI | 84.22 | 48.37 | 46.97 | 46.56
GAT [20] | 80.49 | 54.47 | 50.47 | 51.89
GAT-SI | 83.42 | 56.01 | 51.83 | 52.13
PARN-18 | RFGSM-AT [18] | 83.80 | 49.41 | 48.92 | 48.85
RFGSM-AT-SI | 82.85 | 50.75 | 49.69 | 49.42
GradAlign [21] | 80.14 | 49.42 | 48.23 | 48.12
GradAlign-SI | 82.58 | 50.51 | 49.64 | 49.35
TABLE IX: Defenses under black-box attack: Accuracy (%) of various defense methods under SPSA attack with different batch sizes. Average decision boundary (ADBD) and robust accuracy (Rob.Acc) of defense methods against black-box hard-label RayS attack. The dataset is CIFAR-10 with ResNet18 under $L_{\infty}$ norm bound $\epsilon=8/255$.  | SPSA | RayS
---|---|---
| 128 | 256 | 512 | ADBD | Rob.Acc
AT [8] | 59.81 | 57.85 | 56.00 | 0.0370 | 53.91
AT-SI | 60.51 | 58.29 | 56.40 | 0.0373 | 54.43
TRADES [7] | 59.67 | 57.67 | 55.97 | 0.0393 | 54.95
TRADES-SI | 60.35 | 58.38 | 56.71 | 0.0394 | 54.25
ALP [15] | 60.48 | 58.27 | 56.55 | 0.0388 | 54.79
ALP-SI | 61.02 | 58.62 | 56.65 | 0.0386 | 55.39
MART [16] | 58.16 | 56.20 | 54.91 | 0.0376 | 53.42
MART-SI | 59.16 | 56.90 | 55.23 | 0.0380 | 53.88

Figure 3: Example loss surfaces: Plot of the loss surface of an AT-SI trained
model with ResNet18 on CIFAR-10 perturbed images
${\bm{x}}_{i}^{\prime},i\in\\{1,2,3,4,5,6,7,8,9,10\\}$. Figure 4: Weight loss
surfaces across different methods on CIFAR-10 with ResNet18.

The white-box accuracy of existing multi-step defenses (i.e., AT [8], TARDES
[7], ALP [15], and MART [16]) on CIFAR-10, CIFAR-100, and SVHN are presented
in TABLE VI and TABLE VII, respectively. The single-step defenses (i.e.,
FreeAT [17], GAT [20], RFGSM-AT [18], and GradAlign [21]) on CIFAR-10 are
presented in TABLE VIII.

From TABLE VI we can observe, for multi-step defenses combined with our SI
mechanism on CIFAR-10 with ResNet-18 and WideResNet against attacks, MART-SI
shows the state-of-the-art defense accuracy when attacked by PGD, while
TRADES-SI achieves the best defense accuracy attacked by PGDCW, AA and our
proposed SI-PGD. The same improvement of defenses combined with SI can also be
observed on CIFAR-100 dataset, where MART-SI achieves the best defense
accuracy across all attacks.

Moreover, from TABLE VII we can observe, for multi-step defenses combined with
our SI mechanism on SVHN dataset against attacks, with the proposed SI defense
mechanism, we obtain a 2.06% defense accuracy increase on AT, 1.40% increase
on TRADES, and a 1.87% incerease on MART against PGD attack.

We further analyze the impact of using the proposed SI defense mechanism in
single-step defenses on CIFAR-10 dataset in TABLE VIII. We observe significant
robustness improvement in GAT-SI against all attacks compared with original
GAT defense on ResNet18. Moreover, the proposed RFGSM-AT-SI outperforms the
current state-of-the-art single-step defense on PreActResNet18 model by a
significant margin. The all improvement in robustness significantly
demonstrates the effectiveness of our proposed SI defense mechanism.

####  5.4.2 Performance under black-box attack

We perform black-box query-based SPSA attack [31] and hard-label RayS attack
[32] to fairly evaluate the effectiveness of our proposed SI. The results are
reported in TABLE IX. For SPSA attack, to estimate the gradients, we set the
batch size as 128, 256, and 512, the perturbation size as 0.001, and the
learning rate as 0.01. We run SPSA attack for 100 iterations, and early-stop
when we cause misclassification. As reported in TABLE IX, the defenses with SI
obtain better robustness over original defenses in each setting.

Furthermore, we record the Average Decision Boundary Distance (ADBD) and
robust accuracy (Rob.Acc) against RayS in Table IX. On CIFAR-10 dataset,
TRADES-SI achieves maximum ADBD and ALP-SI achieves best robust accuracy with
ResNet18. As expected, these results show that embedding SI can generally
provide promotion under the black-box threat models, and verify that SI
defense mechanism reliably improves the robustness rather than causing
gradient masking.

####  5.4.3 The reliability of proposed scale-invariant (SI) adversarial
defense mechanism

Note that the robustness improvement of embedding SI is not caused by the so-
called “obfuscated gradients” [6]. This can be verified by four phenomenons:
(1) Strong test attacks (e.g., PGDCW) have higher success rates (lower
accuracies) than weak test attacks (e.g., PGD) as shown in TABLE V. (2) SI
defense mechanism can defense AA effectively (i.e., TRADES-SI achieves 50.60%
accuracy when attacked by AA). (3) Fig. 3 shows the loss surfaces of our
proposed AT-SI trained model on perturbed images of the form
${\bm{x}}_{i}^{\prime}={\bm{x}}_{i}+\delta_{1}v+\delta_{2}r$, obtained by
varying $\delta_{1}$ and $\delta_{2}$. We craft PGD attack with 10 steps
perturbation as the normal direction $v$, and $r$ be a random direction, under
the $L_{\infty}$ constraint of $\epsilon=8/255$. From Fig. 3 we can observe,
the loss surfaces of AT-SI trained model on perturbed images are smooth, which
reveals the fact that the robustness improvement of our proposed SI is not
caused by gradient obfuscation. (4) Following [33], we visualize the weight
loss surface on TRADES-SI by plotting the adversarial loss change when moving
the weight $\bm{W}$ along a random direction $d$ with magnitude $\delta$. As
presented in Fig. 4, the weight loss surface of TRADES-SI is flatter (yellow
line) than original TRADES (blue line), which indicates the effectiveness and
stablity of our proposed SI defense mechanism.

The analysis above verify that our proposed SI mechanism improves adversarial
robustness effectively and reliably rather than gradient obfuscation or
masking.

###  5.5 Effectiveness analysis

TABLE X: Comparision SI with HE: Accuracy (%) of different defense mechanism SI and HE (rows) against various $L_{\infty}$ norm bound ($\epsilon=8/255$) attacks (columns) on CIFAR-10, CIFAR-100, and SVHN, based on TRADES with ResNet18.  Dataset | Method | PGD | PGDCW | SI-PGD | AA
---|---|---|---|---|---
CIFAR-10 | TRADES | 55.23 | 52.67 | 52.24 | 50.06
TRADES-HE | 61.45 | 52.08 | 51.57 | 49.86
TRADES-SI | 58.73 | 53.56 | 54.77 | 50.60
SVHN | TRADES | 61.28 | 57.39 | 56.90 | 50.82
TRADES-HE | 67.32 | 56.55 | 57.53 | 51.90
TRADES-SI | 62.68 | 57.93 | 58.87 | 52.13
CIFAR100 | TRADES | 31.39 | 27.10 | 26.68 | 25.04
TRADES-HE | 31.70 | 25.51 | 29.34 | 23.93
TRADES-SI | 33.54 | 28.19 | 29.66 | 25.86

####  5.5.1 Difference to hypersphere embedding (HE).

The closest work to our SI defense mechanism is hypersphere embedding (HE)
[34], which normalizes the features in the penultimate layer and the weights
in the softmax layer with an additive angular margin. HE replaces all logits
in the loss function of the original defense method with cosine angle, while
we use angle as a regularization to guide the training of the network. The
accuracy of TRADES embedded with SI and HE under adversarial attacks (i.e.,
PGD, PGDCW, SI-PGD, and AA) are recorded in TABLE X. From TABLE X one can
observe that, except for the PGD attack, the final robustness of TRADES-SI
increases by a substantial amount than TRADES-HE. Note that the improvement on
PGD performance of HE may be caused by the unstable property of PGD attack
under rescaled logits (i.e., divided by feature norm and weight norm), as
shown in Fig. 1. This also indicates that compared with HE using angle as the
discriminant information, it is more effective to use angle as a
regularization to assist model weight update. Only using angle without weight
and feature norm as discriminant information may reduce the discriminative
ability of the network.

####  5.5.2 A close look at the angle learned by SI mechanism

Figure 5: The value distribution of $\cos\bm{\theta}$ on TRADES and TRADES-SI.
The dataset is generated by PGD-10 on CIFAR-10 with ResNet18.

In this part, we explore how the distribution of cosine angle changes when we
apply SI defense mechanism on original defense method. We plot the histogram
of $\cos\bm{\theta}$ values in different defense methods (i.e., TRADES and
TRADES-SI) in Fig. 5, and find that the $\cos\bm{\theta}$ of TRADES-SI (i.e.,
yellow bars) have larger values than TRADES (i.e., blue bars). This is because
the regularization term added in the SI mechanism avoids the unlimited
increasing of the network weight by increasing the cosine angle value, thereby
avoiding the gradient vanishing and improving the robustness of the network.

##  6 Conclusion

In this paper, we first reveal the unstability of the standard PGD attack,
then we propose the Scale-Invariant adversarial attack (SI-PGD). We analyze
the intriguing benefits induced by the angle between the model weight and the
feature of the logits, and utilize the consine angle matrix of every input to
guide the generation of adversarial examples. We demonstrate that our SI-PGD
is consistently stronger than existing attacks across multiple defenses. We
further propose the Scale-Invariant (SI) adversarial defense mechanism, which
is concise and adaptable to be embeded in the popular adversarial defenses. SI
mechanism utilizes the proposed SI-PGD for both adversarial example generation
and adversarial training regularization, thereby achieving a significant
improvement in robustness over existing multi-step and single-step adversarial
training methods.

##  7 Acknowledgement

This work was supported by the National Natural Science Foundation of China
(Nos. 62136004, 61876082, 61732006), the National Key R&D Program of China
(Grant Nos. 2018YFC2001600, 2018YFC2001602), and also by the CAAI-Huawei
MindSpore Open Fund.

## References

  * [1] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in _International Conference on Learning Representations_ , 2015.
  * [2] A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” in _International Conference on Learning Representations_ , 2017\.
  * [3] J. Buckman, A. Roy, C. Raffel, and I. Goodfellow, “Thermometer encoding: One hot way to resist adversarial examples,” in _International Conference on Learning Representations_ , 2018.
  * [4] C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,” in _International Conference on Learning Representations_ , 2018.
  * [5] C. Guo, M. Rana, M. Cisse, and L. van der Maaten, “Countering adversarial images using input transformations,” in _International Conference on Learning Representations_ , 2018.
  * [6] A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in _International Conference on Machine Learning_. PMLR, 2018, pp. 274–283.
  * [7] H. Zhang, Y. Yu, J. Jiao _et al._ , “Theoretically principled trade-off between robustness and accuracy,” in _International Conference on Machine Learning_. PMLR, 2019, pp. 7472–7482.
  * [8] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in _International Conference on Learning Representations_ , 2018.
  * [9] M. Atzmon, N. Haim, L. Yariv, O. Israelov, H. Maron, and Y. Lipman, “Controlling neural level sets,” _arXiv preprint arXiv:1905.11911_ , 2019\.
  * [10] F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in _International Conference on Machine Learning_. PMLR, 2020, pp. 2206–2216.
  * [11] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in _2017 IEEE symposium on security and privacy (sp)_ , 2017, pp. 39–57.
  * [12] F. Croce and M. Hein, “Minimally distorted adversarial examples with a fast adaptive boundary attack,” in _International Conference on Machine Learning_. PMLR, 2020, pp. 2196–2205.
  * [13] M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square attack: a query-efficient black-box adversarial attack via random search,” in _European Conference on Computer Vision_. Springer, 2020, pp. 484–501.
  * [14] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in _International Conference on Learning Representations_ , 2014.
  * [15] H. Kannan, A. Kurakin, and I. Goodfellow, “Adversarial logit pairing,” _arXiv preprint arXiv:1803.06373_ , 2018.
  * [16] Y. Wang, D. Zou, J. Yi, J. Bailey, X. Ma, and Q. Gu, “Improving adversarial robustness requires revisiting misclassified examples,” in _International Conference on Learning Representations_ , 2019.
  * [17] A. Shafahi, M. Najibi, A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, and T. Goldstein, “Adversarial training for free!” _Advances in Neural Information Processing Systems 32_ , vol. 5, pp. 3358–3369, 2019.
  * [18] E. Wong, L. Rice, and J. Z. Kolter, “Fast is better than free: Revisiting adversarial training,” in _International Conference on Learning Representations_ , 2019.
  * [19] F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” in _International Conference on Learning Representations_ , 2018.
  * [20] G. Sriramanan, S. Addepalli, A. Baburaj _et al._ , “Guided adversarial attack for evaluating and enhancing adversarial defenses,” _Advances in Neural Information Processing Systems_ , vol. 33, 2020.
  * [21] M. Andriushchenko and N. Flammarion, “Understanding and improving fast adversarial training,” _Advances in Neural Information Processing Systems_ , vol. 33, 2020.
  * [22] A. Krizhevsky, G. Hinton _et al._ , “Learning multiple layers of features from tiny images,” 2009.
  * [23] Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y. Ng, “Reading digits in natural images with unsupervised feature learning,” 2011.
  * [24] F. Wang, X. Xiang, J. Cheng, and A. L. Yuille, “Normface: L2 hypersphere embedding for face verification,” in _Proceedings of the 25th ACM international conference on Multimedia_ , 2017, pp. 1041–1049.
  * [25] H. Wang, Y. Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu, “Cosface: Large margin cosine loss for deep face recognition,” in _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 2018, pp. 5265–5274.
  * [26] D. Hendrycks, K. Lee, and M. Mazeika, “Using pre-training can improve model robustness and uncertainty,” in _International Conference on Machine Learning_. PMLR, 2019, pp. 2712–2721.
  * [27] Y. Carmon, A. Raghunathan, L. Schmidt, and J. Duchi, “Unlabeled data improves adversarial robustness,” _Advances in Neural Information Processing Systems_ , 2019.
  * [28] V. Sehwag, S. Wang, P. Mittal, and S. Jana, “Hydra: Pruning adversarially robust neural networks,” _Advances in Neural Information Processing Systems_ , vol. 7, 2020.
  * [29] T. Pang, X. Yang, Y. Dong, H. Su, and J. Zhu, “Bag of tricks for adversarial training,” in _International Conference on Learning Representations_ , 2021\.
  * [30] S. Gowal, C. Qin, J. Uesato, T. Mann, and P. Kohli, “Uncovering the limits of adversarial training against norm-bounded adversarial examples,” _arXiv preprint arXiv:2010.03593_ , 2020.
  * [31] J. Uesato, B. O’Donoghue, P. Kohli _et al._ , “Adversarial risk and the dangers of evaluating against weak attacks,” in _International Conference on Machine Learning_ , 2018.
  * [32] J. Chen and Q. Gu, “Rays: A ray searching method for hard-label adversarial attack,” in _Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining_, 2020, pp. 1739–1747.
  * [33] D. Wu, S.-T. Xia, and Y. Wang, “Adversarial weight perturbation helps robust generalization,” _Advances in Neural Information Processing Systems_ , vol. 33, 2020.
  * [34] T. Pang, X. Yang, Y. Dong, K. Xu, J. Zhu, and H. Su, “Boosting adversarial training with hypersphere embedding,” _Advances in Neural Information Processing Systems_ , 2020.