Source-linked AI summary
Adversarial Robustness vs Model Compression, or Both?
Shaokai Ye, Kaidi Xu, Sijia Liu, Jan-Henrik Lambrechts, Huan Zhang, Aojun Zhou, Kaisheng Ma, Yanzhi Wang, Xue Lin
TL;DR
DNN adversarial vulnerability is difficult to address because robust adversarial training requires substantially greater capacity than natural training. This paper combines ADMM-based weight pruning with adversarial training and finds that the framework preserves robustness while compressing models, whereas small models trained from scratch cannot achieve both robustness and high standard accuracy.
Problem
Adversarial robustness requires substantially greater network capacity than natural training, limiting adversarial training in resource-constrained systems.
Method
The paper concurrently applies ADMM-based weight pruning and adversarial training, supporting irregular and different regular pruning schemes.
Results
The framework preserves adversarial robustness while compressing models; irregular pruning best preserves both standard accuracy and adversarial robustness.
Takeaways & Limitations
Weight pruning is essential for reducing model size in adversarial training, while training a small model from scratch cannot achieve both adversarial robustness and high standard accuracy.
Abstract
from arXiv · showhide
It is well known that deep neural networks (DNNs) are vulnerable to adversarial attacks, which are implemented by adding crafted perturbations onto benign examples. Min-max robust optimization based adversarial training can provide a notion of security against adversarial attacks. However, adversarial robustness requires a significantly larger capacity of the network than that for the natural training with only benign examples. This paper proposes a framework of concurrent adversarial training and weight pruning that enables model compression while still preserving the adversarial robustness and essentially tackles the dilemma of adversarial training. Furthermore, this work studies two hypotheses about weight pruning in the conventional setting and finds that weight pruning is essential for reducing the network model size in the adversarial setting, training a small model from scratch even with inherited initialization from the large model cannot achieve both adversarial robustness and high standard accuracy. Code is available at https://github.com/yeshaokai/Robustness-Aware-Pruning-ADMM.
1. Introduction
DNN adversarial vulnerability motivates robust optimization, but adversarial training demands substantially more capacity than natural training. The paper proposes concurrent pruning and adversarial training to preserve robustness while compressing models.
- Adversarial attacks add crafted perturbations to benign examples, causing DNNs to predict target labels instead of correct labels.
- Min-max adversarial training models universal first-order attacks in an inner maximization while retaining training in the outer minimization.
- Adversarial robustness requires significantly greater network capacity than natural training, limiting deployment in resource-constrained systems.One cited example requires quadrupling a DNN model for strong robustness on MNIST.
- The proposed framework concurrently applies ADMM-based weight pruning and adversarial training, supporting irregular and multiple regular pruning schemes.The ADMM approach is selected for compatibility with adversarial training and flexibility across pruning schemes.
- Weight pruning is essential for reducing model size in adversarial training; small models trained from scratch cannot attain both robustness and high standard accuracy.
- Irregular pruning best preserves standard accuracy and adversarial robustness while compressing DNN models.
2. Related Work
Related work frames adversarial training as a capacity-intensive defense and weight pruning as a compression strategy. The paper examines pruning schemes and whether conventional pruning hypotheses extend to adversarial training.
- Adversarial Training: Adversarial training uses min-max optimization, with PGD solving the inner maximization over bounded perturbations.PGD uses sign-based projected gradient steps and may employ random starts during adversarial training.
- Adversarial Training: Adversarial training needs significantly more capacity than natural training and exhibits more severe overfitting.
- Weight Pruning: Weight pruning compresses DNNs by exploiting sparsity to remove synapses and neurons, using regular or irregular structures.Regular pruning includes filter and column pruning.
- Weight Pruning: The paper investigates filter, column, and irregular pruning with uniform pruning ratios across layers.Reducing model size by half means reducing each layer's size by half.
- Weight Pruning: ADMM is used because it supports the investigated pruning schemes and is compatible with adversarial training.
- Weight Pruning: The lottery ticket and scratch-training hypotheses were developed for general pruning, but their validity is insufficiently explained in adversarial training.
3. Concurrent Adversarial Training and Weight Pruning
The framework jointly performs adversarial training and weight pruning by formulating sparsity-constrained optimization for ADMM. Its alternating procedure combines adversarial updates with projection onto selectable pruning constraints.
- Framework formulation: The framework formulates concurrent adversarial training and weight pruning for ADMM-based optimization.The formulation introduces layer weights, auxiliary variables, sparsity indicators, and an augmented Lagrangian.
- Pruning constraints: The sparsity set S_i defines pruning constraints, while auxiliary variables enable their ADMM-based enforcement.Different choices of S_i support different weight-pruning schemes.
- Optimization procedure: ADMM iteratively updates weights, auxiliary variables, and Lagrangian multipliers within the concurrent training procedure.Algorithm 1 uses PGD inner iterations, Adam for the outer minimization, an auxiliary-variable update, and multiplier updates.
- ADMM subproblems: The weight-update subproblem retains the adversarial min-max objective and adds a strongly convex quadratic augmented term.PGD solves the inner maximization, while stochastic gradient descent addresses the outer minimization; global optimality is not guaranteed because the loss is non-convex.
- Pruning schemes: The framework supports filter, channel, and element pruning by retaining selected largest values or magnitudes and zeroing the rest.Filter pruning retains α_i largest filter norms, channel pruning retains β_i largest channel-location norms, and element pruning retains γ_i largest-magnitude elements.
- Evaluation variants: Algorithm 1 summarizes the concurrent framework, while post-pruning results with and without retraining are reported separately.The post-pruning comparison appears in Appendix A rather than in the concurrent optimization procedure.
4. Weight Pruning in the Adversarial Setting
In adversarial training, pruning from a larger model can produce smaller networks with strong natural and adversarial accuracy, unlike directly training small models from scratch. The results also challenge conventional pruning and lottery-ticket expectations in this setting.
- Weight Pruning in the Adversarial Setting: The section evaluates concurrent adversarial training and weight pruning using filter pruning across networks scaled by width factor w.Experiments cover MNIST and CIFAR10 models, including LeNet, VGG-16, and ResNet-18.
- Weight Pruning vs Training from Scratch: In adversarial training, pruning from a large model provides benefits in both natural test accuracy and adversarial robustness, unlike adversarially training a small model from scratch.The reported contrast is attributed as potentially related to over-parameterization.
- Weight Pruning vs Training from Scratch: A width-w = 1 model reaches only 11.35% natural and adversarial test accuracy under adversarial training, whereas pruning from w = 4 to w = 1 achieves 96.22% / 89.41%.The comparison is reported on MNIST and contrasts direct small-model training with concurrent adversarial training and pruning.
- Pruning to Inherit Winning Ticket or Else?: Inherited initialization without pruning does not reproduce pruning’s gains: adversarially training a size-w = 2 model from a size-w = 4 model yields only 11.35% / 11.35% accuracy.With concurrent adversarial training and pruning, the corresponding w = 4 to w = 2 result is 97.68% / 91.77%.
- Pruning to Inherit Winning Ticket or Else?: Only 1 of 10 trials succeeded for each of two initialization exceptions when adversarially training the smallest LeNet from scratch, and those exceptions still performed worse than the pruned model.The exceptions were Adam with uniform initialization and Adam with Kaiming normal initialization; most trials reached an 11.35% saddle point.
5. Pruning Schemes and Transfer Attacks
The concurrent framework was evaluated across pruning schemes and transfer attacks on CIFAR10 and MNIST. Pruning generally reduced both natural and adversarial accuracy, while transfer-attack results indicated robustness of the pruned models.
- Pruning Schemes: Natural and adversarial test accuracy decreased as the pruned size decreased across the evaluated pruning schemes.The framework compared filter, column, and irregular pruning from w = 16 to w = 1, 2, 4, 8.
- Pruning Schemes: Irregular pruning performed best among the evaluated filter, column, and irregular pruning schemes.
- Experimental Setting: The experiments used VGG-16 and ResNet-18 on CIFAR10, with adversarial accuracy assessed under transfer attacks.
- Transfer Attacks: Pruned models achieved better adversarial test accuracy than the original unpruned models against C&W ℓ∞ transfer attacks.
- Transfer Attacks: Cross-transfer attacks produced higher adversarial test accuracy than attacks generated by the corresponding pruned models themselves.This pattern held even for the worst case in each pruned model.
7. Conclusion
The paper concludes that concurrent adversarial training and weight pruning can compress adversarially trained models while preserving robustness. It also finds that small models trained from scratch, even with inherited initialization, cannot simultaneously achieve adversarial robustness and high standard accuracy.
- Concurrent adversarial training and weight pruning enables model compression while preserving adversarial robustness.
- Weight pruning is essential for reducing network size in the adversarial setting.
- Training a small model from scratch with inherited initialization cannot achieve adversarial robustness and high standard accuracy simultaneously.
- The work systematically investigates pruning schemes and their effects on adversarial robustness and model compression.
A. Performance of Post-pruning
Post-pruning without retraining failed on nearly all evaluated ResNet18 cases, whereas retraining improved results but remained below concurrent pruning for large reductions. ADMM also avoided large-pruning failures in an additional experiment.
- Post-pruning Results: Nearly all post-pruned ResNet18 models without retraining achieved 10.00/10.00 natural/adversarial accuracy.
- Post-pruning Results: Concurrent pruning outperformed post-pruning with retraining when the difference between the original and pruned model sizes was large.For the 16-to-1 case, concurrent pruning achieved 64.17/37.99 versus 60.26/36.18 for post-pruning with retraining.
- ADMM Comparison: ADMM achieved good results under large prune rates where post-pruning and concurrent pruning without ADMM produced failure cases.This comparison used LeNet under FashionMNIST with the same training time.
B. Initialization Analysis
The initialization analysis examines how initialization affects training a small robust model, using MNIST LeNet results across seven initialization methods and three optimizers.
- Initialization Analysis: The study evaluates seven initialization methods for a small robust MNIST LeNet model.
- Initialization Analysis: The initialization comparison includes Adam, SGD, and CosAnneal optimizers.
- Initialization Analysis: The evaluation reports natural and adversarial test accuracy for LeNet with w = 1.
C. Performance against C&W attack
Table C1 reports LeNet’s MNIST adversarial test accuracy under the C&W ℓ∞ attack using the proposed framework.
- The table evaluates adversarial test accuracy as the reported metric.Accuracy values are expressed as percentages.
- The evaluation uses the C&W ℓ∞ attack.
- The experiment is conducted on MNIST with a LeNet model.