Source-linked AI summary
Towards Robust Neural Networks via Random Self-ensemble
Xuanqing Liu, Minhao Cheng, Huan Zhang, Cho-Jui Hsieh
TL;DR
Deep neural networks can be fooled by small, hard-to-see perturbations, limiting their use in security-sensitive settings. RSE adds random noise during training and inference and ensembles predictions across noisy models; the paper reports strong robustness to white-box attacks while retaining practical deployability.
Problem
Deep neural networks remain vulnerable to adversarial perturbations, while existing defenses provide limited improvement under attack, creating security concerns.
Method
RSE inserts random noise layers into neural networks during training and prediction, then ensembles predictions from the resulting noisy models.
Results
RSE is reported to be very robust against strong white-box attacks and to outperform existing defense algorithms in the experiments.
Takeaways & Limitations
RSE offers a simple, easily integrated defense that can be embedded into existing neural networks.
Takeaways & Limitations
The experiments focus on defending untargeted attacks, which the paper characterizes as harder for defenders than targeted attacks.
Abstract
from arXiv · showhide
Recent studies have revealed the vulnerability of deep neural networks: A small adversarial perturbation that is imperceptible to human can easily make a well-trained deep neural network misclassify. This makes it unsafe to apply neural networks in security-critical applications. In this paper, we propose a new defense algorithm called Random Self-Ensemble (RSE) by combining two important concepts: {\bf randomness} and {\bf ensemble}. To protect a targeted model, RSE adds random noise layers to the neural network to prevent the strong gradient-based attacks, and ensembles the prediction over random noises to stabilize the performance. We show that our algorithm is equivalent to ensemble an infinite number of noisy models $f_ε$ without any additional memory overhead, and the proposed training procedure based on noisy stochastic gradient descent can ensure the ensemble model has a good predictive capability. Our algorithm significantly outperforms previous defense techniques on real data sets. For instance, on CIFAR-10 with VGG network (which has 92\% accuracy without any attack), under the strong C\&W attack within a certain distortion tolerance, the accuracy of unprotected model drops to less than 10\%, the best previous defense technique has $48\%$ accuracy, while our method still has $86\%$ prediction accuracy under the same level of attack. Finally, our method is simple and easy to integrate into any neural network.
1 Introduction
Deep neural networks are vulnerable to imperceptible adversarial perturbations, while existing defenses provide limited gains. RSE combines noise and self-ensemble to improve robustness with minimal clean-accuracy impact and simple integration.
- Motivation: Adversarial perturbations can make accurately classified images appear natural while causing deep networks to misclassify, creating security concerns.These concerns are especially relevant to security-sensitive systems such as self-driving cars and medical imaging.
- Motivation: Existing defense algorithms have been shown to provide only marginal accuracy improvements under adversarial attacks.
- Random Self-Ensemble: RSE adds noise layers before convolution layers during training and prediction, perturbing gradients and ensembling predictions from multiple noisy forward passes.The approach combines randomness with ensemble prediction to improve robustness while stabilizing inference.
- Random Self-Ensemble: RSE is equivalent to ensembling infinitely many random models without additional memory overhead and is designed to improve robustness through Lipschitz regularization.
- Results: 86.1% prediction accuracy is retained by RSE on CIFAR-10 with VGG under the reported C&W attack, versus less than 10% for the unprotected model and 48% for the best previous defense.The unprotected VGG model has 92% accuracy without attack, and RSE is described as easy to implement and combine with any neural network.
2 Related Work
The related work defines adversarial attacks and white-box threat models, reviews gradient-based and other defenses, and motivates RSE as a practical alternative to finite model ensembles.
- Adversarial attacks: An adversarial attack seeks a small-distortion image change that causes a correctly classified input to receive a different prediction.
- Adversarial attacks: White-box attackers know the network structure and weights, enabling them to compute input gradients that characterize prediction sensitivity.
- Adversarial attacks: FGSM and its variants construct adversarial examples using gradient-based procedures, while C&W formulates attack generation as minimizing attack loss and distortion.The C&W attack is recognized as a strong test for defense methods.
- Adversarial attacks: For experiments, the paper focuses on untargeted attacks because defenders face them as the harder attack type to defend against.
- Defense methods: Prior defenses include defensive distillation and other white-box methods, but studies report that many are not truly effective when attackers know the defense mechanism.
- Defense methods: RSE addresses the practical cost of finite ensembles by generating noisy models through a noise-layer design that can be transplanted to architectures such as ResNet.Finite ensembles increase model size, whereas the proposed noisy architecture is intended for broader neural-network integration.
3 Proposed Algorithm: Random Self-Ensemble
Random Self-Ensemble (RSE) adds random noise layers during training and inference, then ensembles predictions from the resulting noisy models. The method targets robustness while controlling accuracy, memory cost, and inference-time sampling.
- Algorithm: Infinite noisy models can be generated on the fly without the k-fold memory increase required by conventional ensembles.Each random noise realization defines a model f_ε, allowing self-ensemble without storing separate model parameters.
- Algorithm: RSE inserts noise layers before each convolution layer, using random perturbations during training and multiple noisy forward passes during testing.Training uses noisy stochastic gradients; testing averages probability outputs across sampled noises before selecting the maximum-scoring class.
- Algorithm: n ≈10 ensemble samples are sufficient in practice because prediction performance saturates at that level.The number of samples can be increased when prediction time is not a concern.
- Mathematical explanations: Noisy-network training is equivalent to adding Lipschitz regularization, with noise variance balancing robustness against training loss.Smaller Lipschitz constants are associated in the paper with networks less sensitive to input changes and therefore more robust.
- Discussions: Both randomness and ensemble contribute to RSE, and removing either component significantly reduces performance.The figure compares noise during training, testing, or both, alongside a conventionally trained baseline; noisy test models use self-ensemble.
- Discussions: Noise is needed during both training and testing: test-only noise reduces performance to 20% without attack, while testing-time ensemble is crucial under smaller attacks.Training with noise helps produce filters robust to perturbed inputs, while inference-time noise perturbs gradients and provides diverse outputs.
4 Experiments
Experiments evaluate RSE across datasets, architectures, attack strengths, noise settings, and ensemble sizes. RSE generally improves robustness, with benefits depending on attack strength and practical trade-offs in ensemble size.
- Experimental setup: Experiments use CIFAR10 with VGG-16 and ResNeXt, STL10 with Model A, and white-box C&W attacks, including untargeted evaluation.The authors describe untargeted C&W as the most challenging setting for defenses and assume the attack knows RSE’s randomization procedure.
- Noise level: Both init-noise and inner-noise improve robustness, but higher noise reduces accuracy for weak attacks; σinit = 0.2 and σinner = 0.1 are selected for experiments.The noise levels are applied during both training and testing, with Gaussian noise used in all noise layers.
- Defense comparison: RSE accuracy remains above 75% when other methods fall below 30% under C&W attacks.The comparison covers defense methods at different attack-strength values c.
- Self-ensemble: 50-ensemble improves accuracy by ∼8% over 1-ensemble when c < 0.4, whereas ensemble performance worsens when c > 1.0 or average distortion exceeds 0.93.The authors conjecture that strong attacks cause most random submodels to predict incorrectly, making group decisions harmful.
- Self-ensemble: Accuracy saturates rapidly with ensemble size, and the authors find 10-ensemble sufficient for testing accuracy when prediction time matters.The paper also states that smaller injected noise weakens the ensemble benefit and causes earlier saturation.
- Defense comparison: RSE outperforms existing methods across CIFAR10+VGG16, CIFAR10+ResNeXt, and STL10+Model A under strong attacks in accuracy and average distortion.At average distortion 0.21 on CIFAR10+VGG16, C&W success exceeds 99% without defense but is approximately 20% with RSE.
5 Conclusion
RSE improves neural-network robustness against adversarial attacks by combining noisy models with an ensemble, while remaining easy to integrate into existing networks.
- RSE improves robustness against adversarial attacks by combining random noise with self-ensembled predictions.The method is equivalent to ensembling a huge amount of noisy models.
- The training process enables the ensemble model to generalize well.
- RSE is equivalent to adding a Lipchitz regularization that can improve neural-network robustness.
- Experiments demonstrate robustness against strong white-box attacks.
- RSE is simple to implement and can be embedded into an existing network.