Source-linked AI summary
Sparse DNNs with Improved Adversarial Robustness
Yiwen Guo, Chao Zhang, Changshui Zhang, Yurong Chen
TL;DR
DNNs are costly to compute and store and remain vulnerable to adversarial attacks, while prior evidence on how sparsity affects robustness is limited and inconsistent. The paper analyzes sparsity and robustness theoretically and empirically across linear classifiers and nonlinear DNNs. It finds that nonlinear DNNs can become more robust as sparsity increases, but over-sparsification eventually harms robustness, unlike some linear-model behavior under l2 attacks.
Problem
The paper addresses limited and conflicting evidence about how reducing DNN redundancy through sparsity relates to adversarial robustness.
Method
The paper combines theoretical and empirical analyses of linear classifiers and nonlinear DNNs under untargeted white-box attacks, using robustness metrics and pruning or l1 regularization to impose sparsity.
Results
Nonlinear DNNs can be more robust than dense references under both l∞ and l2 attacks as sparsity increases, whereas over-sparsification reduces robustness and l2 behavior differs from some linear models.
Takeaways & Limitations
Sparsity can improve nonlinear DNN adversarial robustness only within an appropriate range, so robustness should be evaluated during aggressive pruning rather than inferred from benign accuracy alone.
Takeaways & Limitations
The multi-class theoretical bounds rely on two additional assumptions, including that FGS-induced loss increases reduce expected accuracy and generally cannot repair an original misclassification.
Abstract
from arXiv · showhide
Deep neural networks (DNNs) are computationally/memory-intensive and vulnerable to adversarial attacks, making them prohibitive in some real-world applications. By converting dense models into sparse ones, pruning appears to be a promising solution to reducing the computation/memory cost. This paper studies classification models, especially DNN-based ones, to demonstrate that there exists intrinsic relationships between their sparsity and adversarial robustness. Our analyses reveal, both theoretically and empirically, that nonlinear DNN-based classifiers behave differently under $l_2$ attacks from some linear ones. We further demonstrate that an appropriately higher model sparsity implies better robustness of nonlinear DNNs, whereas over-sparsified models can be more difficult to resist adversarial examples.
1 Introduction
DNNs combine substantial computational and storage demands with vulnerability to adversarial examples, creating barriers to real-world and security-sensitive deployment. The paper therefore studies whether sparsity can reduce inefficiency without sacrificing robustness.
- More than 90% of connections in some well-trained DNNs can be removed without observed accuracy loss.The resulting sparsity provides substantial compression and speedups on GPUs and CPUs.
- Adversarial examples are perceptually similar to benign images yet can cause classifiers to make arbitrary predictions.Generic regularization methods such as dropout and weight decay do not reliably resist these attacks.
- The paper examines whether classifier inefficiency and adversarial robustness are intrinsically related, aiming to avoid improving one at the expense of the other.It analyzes these relationships using both theoretical and empirical perspectives.
- Sparse linear classifiers and nonlinear DNNs show different robustness behavior under l2 attacks.The paper introduces metrics to analyze this discrepancy.
- Higher sparsity improves nonlinear DNN robustness only up to a point, after which over-sparsified models become harder to defend against adversarial examples.This pattern is reported under both l∞ and l2 attacks.
2 Related Works
Prior work has rarely treated DNN efficiency and adversarial robustness together, especially theoretically. Existing studies provide limited linear-case theory, conflicting pruning experiments, or defenses focused mainly on activation sparsity.
- The paper assumes intrinsic relationships between sparsity and robustness and analyzes both linear classifiers and nonlinear DNNs.Its scope includes sparsity in middle-layer activations and connection weights.
- The relationship between DNN inefficiency and adversarial robustness had seldom been studied together from a theoretical perspective.Earlier sparsification defenses provided provable evidence mainly for linear and binary classification under l∞ attacks.
- Contemporaneous pruning studies experimentally reported opposite conclusions about how pruning affects DNN robustness.This disagreement motivates a more comprehensive analysis.
- Several defenses prune or randomize middle-layer activations, while paying little attention to connection sparsity.These approaches include removing adversarial-specific activations and stochastic activation pruning for gradient masking.
3 Sparsity and Robustness of Classifiers
The paper analyzes how weight and activation sparsity relate to adversarial robustness in linear classifiers and nonlinear DNNs under l∞ and l2 attacks. It develops robustness metrics and theoretical bounds, finding that sparsity can improve nonlinear DNN robustness but affects linear models differently across attack norms.
- Scope and metrics: The study evaluates classifier sparsity against untargeted white-box l∞ and l2 attacks using theoretical and practical analyses.It focuses on weight sparsity for linear models and both weight and activation sparsity for nonlinear DNNs.
- Scope and metrics: The robustness metrics r∞ and r2 measure expected accuracy on FGS examples and the decision margin between correctly classified examples, respectively.Higher values indicate stronger adversarial robustness, while r2 excludes originally misclassified examples.
- Linear models: For binary linear classifiers, greater sparsity is associated with stronger r∞ robustness, whereas r2 is not generally improved by sparsifying the weights.The paper notes that dense reference models can be nearly optimal for r2 under some data-distribution assumptions.
- Nonlinear DNNs: The nonlinear DNN analysis introduces local Lipschitz bounds incorporating weight masks and activation patterns to connect robustness with network sparsity.The framework represents layer activations with diagonal matrices and sparse connections with binary masks.
- Nonlinear DNNs: For over-parameterized nonlinear DNNs, appropriately higher weight or activation sparsity can enlarge the robustness margin, while excessive sparsification may undermine robustness.The theoretical discussion links this effect to the network’s local gradient-based robustness quantity, and experiments report the predicted contrast with linear models.
4 Experimental Results
Experiments evaluate robustness under l∞ and l2 attacks across linear classifiers and nonlinear networks with varying weight or activation sparsity. Sparse nonlinear DNNs generally become more robust until excessive sparsity degrades capacity, whereas linear models show different l2 behavior and over-pruned networks can lose robustness before benign accuracy declines.
- Experimental setup: Experiments evaluate l∞ and l2 robustness using FGS, randomized FGS, DeepFool, and C&W attacks across linear and nonlinear classifiers.Four robustness values can be calculated for each classification model from these attacks.
- Experimental setup: Progressive pruning iteratively removes small-magnitude nonzero weights and retrains models to produce a range of weight sparsities.The procedure prunes a portion of nonzero entries at each iteration and collects models from multiple dense references.
- Linear classifiers: Sparse linear models become more robust in r∞, while r2 remains similar or slightly weaker than dense references and can decline after the first pruning round.In the binary case, r2 decreases from 2.0103 ± 0.0022 to 2.0009 ± 0.0016 with DeepFool and from 2.3151 ± 0.0023 to 2.3061 ± 0.0023 with C&W’s attack.
- Nonlinear DNNs: Nonlinear DNNs show increased r∞ and r2 under different attacks as pruning continues, until threshold sparsities cause inevitable capacity degradation.This pattern appears in LeNet-300-100, LeNet-5, VGG-like networks, and ResNets.
- Activation sparsity: Activation sparsity also correlates positively with robustness within a certain range when encouraged through l1 regularization of activation tensors.The experiments use MNIST and evaluate both r∞ and r2.
- Over-pruning: Sharp robustness decreases, especially in r2, may precede benign accuracy degradation, and extremely compressed models are more vulnerable to DeepFool.The over 100× pruned LeNet-5 is also more vulnerable to FGS, motivating caution against over-pruning.
5 Conclusions
The paper concludes that sparsity and adversarial robustness have intrinsic relationships that differ between linear classifiers and nonlinear DNNs. Appropriate sparsity can improve nonlinear DNN robustness, but excessive sparsity harms network capacity and resistance to adversarial examples.
- Conclusions: Sparse nonlinear DNNs can be more robust than corresponding dense references under both l∞ and l2 attacks until sparsity reaches harmful thresholds.The paper studies these relationships theoretically and empirically and describes pruning and l1 regularization as ways to impose sparsity.