Title: TRIPLE WINS: BOOSTING ACCURACY, ROBUSTNESS AND EFFICIENCY TOGETHER BY ENABLING INPUT-ADAPTIVE INFERENCE

Abstract: Deep networks were recently suggested to face the odds between accuracy (on clean natural images) and robustness (on adversarially perturbed images) (Tsipras et al., 2019) . Such a dilemma is shown to be rooted in the inherently higher sample complexity (Schmidt et al., 2018) and/or model capacity (Nakkiran, 2019), for learning a high-accuracy and robust classifier. In view of that, give a classification task, growing the model capacity appears to help draw a win-win between accuracy and robustness, yet at the expense of model size and latency, therefore posing challenges for resource-constrained applications. Is it possible to co-design model accuracy, robustness and efficiency to achieve their triple wins? This paper studies multi-exit networks associated with input-adaptive efficient inference, showing their strong promise in achieving a "sweet point" in cooptimizing model accuracy, robustness and efficiency. Our proposed solution, dubbed Robust Dynamic Inference Networks (RDI-Nets), allows for each input (either clean or adversarial) to adaptively choose one of the multiple output layers (early branches or the final one) to output its prediction. That multi-loss adaptivity adds new variations and flexibility to adversarial attacks and defenses, on which we present a systematical investigation. We show experimentally that by equipping existing backbones with such robust adaptive inference, the resulting RDI-Nets can achieve better accuracy and robustness, yet with over 30% computational savings, compared to the defended original models.

1. INTRODUCTION:

Deep networks, despite their high predictive accuracy, are notoriously vulnerable to adversarial attacks (Goodfellow et al., 2015; Biggio et al., 2013; Szegedy et al., 2014; Papernot et al., 2016) . While many defense methods have been proposed to increase a model's robustness to adversarial examples, they were typically observed to hamper its accuracy on original clean images. Tsipras et al. (2019) first pointed out the inherent tension between the goals of adversarial robustness and standard accuracy in deep networks, whose provable existence was shown in a simplified setting. Zhang et al. (2019) theoretically quantified the accuracy-robustness trade-off, in terms of the gap between the risk for adversarial examples versus the risk for non-adversarial examples.

It is intriguing to consider whether and why the model accuracy and robustness have to be at odds. Schmidt et al. (2018) demonstrated that the number of samples needed to achieve adversarially robust generalization is polynomially larger than that needed for standard generalization, under the adversarial training setting. A similar conclusion was concurred by Sun et al. (2019) in the standard training setting. Tsipras et al. (2019) considered the accuracy-robustness trade-off as an inherent trait of the data distribution itself, indicating that this phenomenon persists even in the limit of infinite data. Nakkiran (2019) argued from a different perspective, that the complexity (e.g. capacity) of a robust classifier must be higher than that of a standard classifier. Therefore, replacing a largercapacity classifier might effectively alleviate the trade-off. Overall, those existing works appear to suggest that, while accuracy and robustness are likely to trade off for a fixed classification model and on a given dataset, such trade-off might be effectively alleviated ("win-win"), if supplying more training data and/or replacing a larger-capacity classifier.

On a separate note, deep networks also face the pressing challenge to be deployed on resourceconstrained platforms due to the prosperity of smart Internet-of-Things (IoT) devices. Many IoT applications naturally demand security and trustworthiness, e.g., , biometrics and identity verification, but can only afford limited latency, memory and energy budget. Hereby we extend the question: can we achieve a triple-win, i.e., , an accurate and robust classfier while keeping it efficient?

This paper makes an attempt in providing a positive answer to the above question. Rather than proposing a specific design of robust light-weight models, we reduce the average computation loads by input-adaptive routing to achieve triple-win. To this end, we introduce the input-adaptive dynamic inference (Teerapittayanon et al., 2017; Wang et al., 2018a) , an emerging efficient inference scheme in contrast to the (non-adaptive) model compression, to the adversarial defense field for the first time. Given any deep network backbone (e.g., , ResNet, MobileNet), we first follow (Teerapittayanon et al., 2017) to augment it with multiple early-branch output layers in addition to the original final output. Each input, regardless of clean or adversarial samples, adaptively chooses which output layer to take for its own prediction. Therefore, a large portion of input inferences can be terminated early when the samples can already be inferred with high confidence.

Up to our best knowledge, no existing work studied adversarial attacks and defenses for an adaptive multi-output model, as the multiple sources of losses provide much larger flexibility to compose attacks (and therefore defenses), compared to the typical single-loss backbone. We present a systematical exploration on how to (white-box) attack and defense our proposed multi-output network with adaptive inference, demonstrating that the composition of multiple-loss information is critical in making the attack/defense strong. Fig. 1 illustrates our proposed Robust Dynamic Inference Networks (RDI-Nets). We show experimentally that the input-adaptive inference and multiloss flexibility can be our friend in achieving the desired "triple wins". With our best defended RDI-Nets, we achieve better accuracy and robustness, yet with over 30% inference computational savings, compared to the defended original models as well as existing solutions co-designing robustness and efficiency (Gui et al., 2019; Guo et al., 2018) . The codes can be referenced from https://github.com/TAMU-VITA/triple-wins. 

2. RELATED WORK:



2.1. ADVERSARIAL DEFENSE:

A magnitude of defend approaches have been proposed (Kurakin et al., 2017; Xu et al., 2018; Song et al., 2018; Liao et al., 2018) , although many were quickly evaded by new attacks (Carlini & Wagner, 2017; Baluja & Fischer, 2018) . One strong defense algorithm that has so far not been fully compromised is adversarial training (Madry et al., 2018) . It searches for adversarial images to augment the training procedure, although at the price of higher training costs (but not affecting inference efficiency). However, almost all existing attacks and defenses focus on a single-output classification (or other task) model. We are unaware of prior studies directly addressing attacks/defenses to more complicated networks with multiple possible outputs.

One related row of works are to exploit model ensemble (Tramèr et al., 2018; Strauss et al., 2017) in adversarial training. The gains of the defended ensemble compared to a single model could be viewed as the benefits of either the benefits of diversity (generating stronger and more transferable perturbations), or the increasing model capacity (consider the ensembled multiple models as a compound one). Unfortunately, ensemble methods could amplify the inference complexity and be detrimental for efficiency. Besides, it is also known that injecting randomization at inference time helps mitigate adversarial effects (Xie et al., 2018; Cohen et al., 2019) . Yet up to our best knowledge, no work has studied non-random, but rather input-dependent inference for defense.

2.2. EFFICIENT INFERENCE:

Research in improving deep network efficiency could be categorized into two streams: the static way that designs compact models or compresses heavy models, while the compact/compressed models remain fixed for all inputs at inference; and the dynamic way, that at inference the inputs can choose different computational paths adaptively, and the simpler inputs usually take less computation to make predictions. We briefly review the literature below.

Static: Compact Network Design and Model Compression. Many compact architectures have been specifically designed for resource-constrained applications, by adopting lightweight depthwise convolutions (Sandler et al., 2018) , and group-wise convolutions with channel-shuffling (Zhang et al., 2018) , to just name a few. For model compression, Han et al. (2015) first proposed to sparsify deep models by removing non-significant synapses and then re-training to restore performance. Structured pruning was later on introduced for more hardware friendliness (Wen et al., 2016) . Layer factorization (Tai et al., 2016; Yu et al., 2017) , quantization (Wu et al., 2016) , model distillation (Wang et al., 2018c) and weight sharing (Wu et al., 2018) have also been respectively found effective.

Dynamic: Input-Adaptive Inference. Higher inference efficiency could be also accomplished by enabling input-conditional execution. (Figurnov et al., 2017; Wang et al., 2018a; b; 2019) allow for an input to choose between passing through or skipping each layer. The approach could be integrated with RDI-Nets too, which we leave as future work.

2.3. BRIDGING ROBUSTNESS WITH EFFICIENCY:

A few studies recently try to link deep learning robustness and efficiency. Guo et al. (2018) observed that in a sparse deep network, appropriately sparsified weights improve robustness, whereas over-sparsification (e.g., less than 5% nonzero weights) in turn makes the model more fragile. Two latest works (Ye et al., 2019; Gui et al., 2019) examined the robustness of compressed models, and concluded similar observations that the relationship between mode size and robustness depends on compression methods and are often non-monotonic. Lin et al. (2019) found that activation quantization may hurt robustness, but can be turned into effective defense if enforcing continuity constraints.

Different from above methods that tackle robustness from static compact/compressed models, the proposed RDI-Nets are the first to address robustness from the dynamic input-adaptive inference.

Our experiment results demonstrate the consistent superiority of RDI-Nets over those static methods (Section 4.3). Moreover, applying dynamic inference top of those static methods may further boost the robustness and efficiency, which we leave as future work.

3. APPROACH:

With the goal of achieving inference efficiency, we first look at the setting of multi-output networks and the specific design of RDI-Net in Section 3.1. Then we define three forms of adversarial attacks for multi-output networks in Section 3.2 and their corresponding defense methods in Section 3.3.

Note that RDI-Nets achieve "triple wins"via reducing the average computation loads through inputadaptive routing. It is not to be confused with any specifically-designed robust light-weight model.

3.1. DESIGNING RDI-NETS FOR HIGHER INFERENCE EFFICIENCY:

Given an input image x, an N -output network can produce a set of predictions [ ŷ1 , ..., ŷN ] by a set of transformations

[f θ1 (•), ..., f θ N (•)]

. θ i denote the model parameter of f θi , i = 1, ..., N , and f θi s will typically share some weights. With an input x, one can express ŷi = f θi (x). We assume that the final prediction will be one chosen (NOT fused) from [ ŷ1 , ..., ŷN ] via some deterministic strategy.

We now look at RDI-Nets as a specific instance of multi-output networks, specifically designed for the goal of more efficient, input-adaptive inference. As shown in Fig. 1 , for any deep network (e.g., , ResNet, MobileNet), we could append K side branches (with negligible overhead) to allow for early-exit predictions. In other words, it becomes a (K + 1)-output network, and the subneworks with the K +1 exits, from the lowest to the highest (the original final output), correspond to

[f θ1 (•), ..., f θ K+1 (•)].

They share their weights in a nested fashion: θ 1 ⊆ θ 2 ... ⊆ θ K+1 , with θ K+1 including the entire network's parameters.

Our deterministic strategy in selecting one final output follows (Teerapittayanon et al., 2017) . We set a confidence threshold t k for each k-th exit, k = 1, ..., K + 1, and each input x will terminate inference and output its prediction in the earliest exit (smallest k), whose softmax entropy (as a confidence measure) falls below t k . All computations after the k-th exit will not be activated for this x. Such a progressive and early-halting mechanism effectively saves unnecessary computation for most easier-to-classify samples, and applies in both training and inference. Note that, if efficiency is not the concern, instead of choosing (the earliest one), we could have designed an adaptive or randomized fusion of all f θi predictions: but that falls beyond the goal of this work.

The training objective for RDI-Nets could be written as

EQUATION

For each exit loss, we minimize a hybrid loss of accuracy (on clean x) and robustness (on x adv ). The K + 1 exits are balanced with a group of weights {w i } K+1 i=1 . More details about RDI-Net structures, hyperparameters, and inference branch selection can be founded in Appendix A, B, and C.

In what follows, we discuss three ways to generate x adv in RDI-Nets, and then their defenses.

3.2. THREE ATTACK FORMS ON MULTI-OUTPUT NETWORKS:

We consider white box attacks in this paper. Attackers have access to the model's parameters, and aim to generate an adversarial image x adv to fool the model by perturbing an input x within a given magnitude bound.

We next discuss three attack forms for an N -output network. Note that they are independent of, and to be distinguished from attacker algorithms (e.g., , PGD, C&W, FGSM): the former depicts the optimization formulation, that can be solved any of the attacker algorithms.

Single Attack Naively extending from attacking single-output networks, a single attack is defined to maximally fool one f θi (•) only, expressed as:

EQUATION

)

where y is the ground truth label, and φ is the loss for f θi (we assume softmax for all). is the perturbation radius and we adopt ∞ ball for an empirically strong attacker. Naturally, an N -output network can have N different single attacks. However, each single attack is derived without being aware of other parallel outputs. The found x adv i is not necessarily transferable to other f θj s (j = i), and therefore can be easily bypassed if x is re-routed through other outputs to make its prediction.

Average Attack Our second attack maximizes the average of all f θi losses, so that the found x adv remains in effect no matter which one f θi is chosen to output the prediction for x:

x adv avg = arg max

EQUATION

The average attack addresses takes into account the attack transferablity and involves all θ j s into optimization. However, while only one output will be selected for each sample at inference, the average strategy might weaken the individual defense strength of each f θi .

Max-Average Attack Our third attack aims to emphasize individual output defense strength, more than simply maximizing an all-averaged loss. We first solve the N single attacks x adv i as described in Eqn. 2, and denote their collection as Ω. We then solve the max-average attack via the following:

EQUATION

Note Eqn. 4 differs from Eqn. 3 by adding an Ω constraint to balance between "commodity" and "specificity". The found x adv max both strongly increases the averaged loss values from all f i s (therefore possessing transferablity), and maximally fools one individual f θi s as it is selected from the collection Ω of single attacks.

3.3. DEFENCE ON MULTI-OUTPUT NETWORKS:

For simplicity and fair comparison, we focus on adversarial training (Madry et al., 2018) as our defense framework, where the three above defined attack forms can be plugged-in to generate adversarial images to augment training, as follows (Θ is the union of learnable parameters):

EQUATION

where x adv ∈ {x adv i , x adv avg , x adv max }. As f i s partially share their weights θ i in a multi-output network, the updates from different f i s will be averaged on the shared parameters.

4. EXPERIMENTAL RESULTS:



4.1. EXPERIMENTAL SETUP:

Evaluation Metrics We evaluate accuracy, robustness, and efficiency, using the metrics below:

• Testing Accuracy (TA): the classification accuracy on the original clean test set.

• Adversarial Testing Accuracy (ATA): Given an attacker, ATA stands for the classification accuracy on the attacked test set. It is the same as the "robust accuracy" in (Zhang et al., 2019) . • Mega Flops (MFlops): The number of million floating-point multiplication operations consumed on the inference, averaged over the entire testing set. Datasets and Benchmark Models We evaluate three representative CNN models on two popular datasets: SmallCNN on MNIST (Chen et al., 2018); ResNet-38 (He et al., 2016) and MobileNet-V2 (Sandler et al., 2018) on CIFAR-10. The three networks span from simplest to more complicated, and covers a compact backbone. All three models are defended by adversarial training, constituting strong baselines. Table 1 reports the models, datasets, the attacker algorithm used in attack & defense, and thee TA/ATA/MFlops performance of three defended models.

Attack and Defense on RDI-Nets We build RDI-Nets by appending side branch outputs for each backbone. For SmallCNN, we add two side branches (K = 2). For ResNet-38 and MobileNet-V2, we have K = 6 and K = 2, respectively. The branches are designed to cause negligible overheads: more details of their structure and positions can be referenced in Appendix B. We call those result models RDI-SmallCNN, RDI-ResNet38 and RDI-MobileNetV2 hereinafter.

We then generate attacks using our three defined forms. Each attack form could be solved with various attacker algorithms (e.g., PGD, C&W, FGSM), and by default we solve it with the same attacker used for each backbone in Table 1 . If we fix one attacker algorithm (e.g., PGD), then TA/ATA for a single-output network can be measured without ambiguity. Yet for (K+1)-output RDI-Nets, there could be at least K+3 different ATA numbers for one defended model, depending on what attack form in Section 3.1 to apply (K+1 single attacks, 1 average attack, and 1 maxaverage attack). For example, we denote by ATA (Branch1) the ATA number when applying the single attack generated from the first side output branch (e.g., x adv 1 ); similarly elsewhere. We also defend RDI-Nets using adversarial training, using the forms of adversarial images to augment training. By default, we adopt three adversarial training defense schemes: Main Branch (single attack using x adv K+1 )1 ,Average (using x adv avg ),and Max-Average (using x max avg ), in addition to the undefended RDI-Nets (using standard training) denoted as Standard.

We cross evaluate ATAs of different defenses and attacks, since an ideal defense shall protect against all possible attack forms. To faithfully indicate the actual robustness, we choose the lowest number among all K + 3 ATAs, denoted as ATA (Worst-Case), as the robustness measure for an RDI-Net.

Table 1 : Benchmarking results of adverserial training of three networks. PGD-40 denotes running the projected gradient descent attacker (Madry et al., 2018) for 40 iterations. We set the perturbation size as 0.3 for MNIST and 8/255 for CIFAR-10 in ∞ norm (adopted by all following experiments). 2 , with several meaningful observations to be drawn. First, the undefended models (Standard) are easily compromised by all attack forms. Second, The single attack-defended model (Main Branch) achieves the best ATA against the same type of attack, i.e., ATA (Main Branch), and also seems to boost the closest output branch's robustness, i.e., ATA (Branch 2). However, its defense effect on the further-away Branch 1 is degraded, and also shows to be fragile under two stronger attacks (Average, and Max-Average). Third, both Average and Max-Average defenses achieve good TAs, as well as ATAs against all attack forms (and therefore Worst-Case), with Max-Average slightly better at both (the margins are small due to the data/task simplicity; see next two).

Model:

Moreover, compared to the strong baseline of SmallCNN defended by PGD (40 iterations)-based adversarial training, RDI-SmallCNN with Max-Average defense wins in terms of both TA and ATA. Impressively, that comes together with 34.30% computational savings compared to the baseline. Here the different defense forms do not appear to alter the inference efficiency much: they all save around 34% -36% MFlops compared to the backbone. 3 and 4 , respectively. Most findings seem to concur with MNIST experiments. Specifically, on the more complicated CIFAR-10 classification task, Max-Average defense achieves much more obvious margins over Average defense, in terms of ATA (Worst-Case): 2.79% for RDI-ResNet38, and 1.06% for RDI-MobileNetV2. Interestingly, the Average defense is not even the strongest in defending average attacks, as Max-Average defense can achieve higher ATA (Average) in both cases.

We conjecture that averaging all branch losses might "over-smooth" and diminish useful gradients.

Compared to the defended ResNet-38 and MobileNet-V2 backbones, RDI-Nets with Max-Average defense achieve higher TAs and ATAs for both. Especially, the ATA (Worst-Case) of RDI-ResNet-38 surpasses the ATA of ResNet-38 defended by PGD-adversarial training by 1.03%, while saving around 30% inference budget. We find that different defenses on CIFAR-10 have more notable impacts on computational saving. Seemingly, a stronger defense (Max-Average) requires inputs to go through the scrutiny of more layers on average, before outputting confident enough predictions: a sensible observation as we expect. 

4.3. COMPARISON WITH DEFENDED SPARSE NETWORKS:

An alternative to achieve accuracy-robust-efficiency trade-off is by defending a sparse or compressed model. Inspired by (Guo et al., 2018; Gui et al., 2019) , we compare RDI-Net with Max-Average defense to the following baseline: first compressing the network with a state-of-the-art model compression method (Huang & Wang, 2018) , and then defend the compressed network using the PGD-10 adversarial training. We sample different sparsity ratios in (Huang & Wang, 2018) to obtain models of different complexities. Fig. 6 in Appendix visualizes the comparison on ResNet-38: for either method, we sample a few models of different MFLOPs. At similar inference costs (e.g., 49.38M for pruning + defense, and 48.35M for RDI-Nets), our proposed approach consistently achieves higher ATAs (> 2%) than the strong pruning + defense baseline, with higher TAs. We also compare with the latest ATMC algorithm (Gui et al., 2019) that jointly optimizes robustness and efficiency, applied the same ResNet-38 backbone. As shown in Table 5, at comparable MFlops, RDI-ResNet-38 surpasses ATMC by 0.3% in terms of ATA, with a similar TA.

4.4. GENERALIZED ROBUSTNESS AGAINST OTHER ATTACKERS:

In the aforementioned experiments, we have only evaluated on RDI-Nets against "deterministic" PGD-based images. We show that RDI-Nets also achieve better generalized robustness against other "randomized" or unseen attackers. We create the new "random attack": that attack will randomly combine the multi-exit losses, and summarize the results in Table 6 . We also follow the similar setting in Gui et al. (2019) and report the results against FGSM (Goodfellow et al., 2015) and WRM (Sinha et al., 2018) attacker, in Tables 7 and 8 respectively (more complete results can be found in Appendix D). 

5. DISCUSSION AND ANALYSIS:

Intuition: Multi-Output Networks as Special Ensembles Our intuition on defending multioutput networks arises from the success of ensemble defense in improving both accuracy and robustness (Tramèr et al., 2018; Strauss et al., 2017) , which also aligns with the model capacity hypothesis (Nakkiran, 2019) . A general multi-output network (Xu et al., 2019) could be decomposed by an ensemble of single-output models, with weight re-using enforced among them. It is thus more compact than an ensemble of independent models, and the extent of sharing weight calibrates ensemble diversity versus efficiency. Therefore, we expect a defended multi-output network to (mostly) inherit the strong accuracy/robustness of ensemble defense, while keeping the inference cost lower.

Do "Triple Wins" Go Against the Model Capacity Needs? We point out that our seemingly "free" efficiency gains (e.g., not sacrificing TA/ATA) do not go against the current belief that a more accurate and robust classifier relies on a larger model capacity (Nakkiran, 2019) . From the visualization, there remains to be a portion of clean/adversarial examples that have to utilize the full inference to predict well. In other words, the full model capacity is still necessary to achieve our current TAs/ATAs. Meanwhile, just like in standard classification (Wang et al., 2018a) , not all adversarial examples are born equally. Many of them can be predicted using fewer inference costs (taking earlier exits). Therefore, RDI-Nets reduces the "effective model capacity" averaged on all testing samples for overall higher inference efficiency, while not altering the full model capacity.

6. CONCLUSION:

This paper targets to simultaneously achieve high accuracy and robustness and meanwhile keeping inference costs lower. We introduce the multi-output network and input-adaptive dynamic inference, as a strong tool to the adversarial defense field for the first time. Our RDI-Nets achieve the "triple wins" of better accuracy, stronger robustness, and around 30% inference computational savings. Our future work will extend RDI-Nets to more dynamic inference mechanisms.

CIFAR-10:

We take ResNet-38 and MobileNetV2 as the backbone architectures. For RDI-ResNet38, we initialize learning rate as 0.1 and decay it by a factor of 10 at 32000th and 48000th iteration. The learning procedure stops at 55000 iteration. For RDI-MobileNetV2, the learning rate is set to 0.05 and is lowered by 10 times at 62000th and 70000th iteration. We stop the learning procedure at 76000 iteration. For hybrid loss, we follow the discussion in (Hu et al., 2019) and set {w i } N +1 i=1 of RDI-ResNet38 and RDI-MobileNetV2 as {0.5, 0.5, 0.7, 0.7, 0.9, 0.9, 2} and {0.5, 0.5, 1}, respectively. For adversarial defense/attack, the perturbation size and step size are set as 8/255 and 2/255. 10-steps PGD is performed for defense and 20-steps PGD is utilized for evaluation. class, the entropy of y is defined as follow,

B NETWORK STRUCTURE OF RDI-NETS:

EQUATION

where is a small positive constant used for robust entropy computation. To perform fast inference on a (K+1)-output RDI-Net, we need to determine K threshold numbers, i.e., {t i } K i=1 , so that the input x will exit at ith branch if the entropy of y i is larger than t i . To choose {t i } K i=1 , Huang et al. ( 2018) provides a good starting point by fixing exiting probability of each branch classifiers equally on validation set so that each sample can equally contribute to inference. We follow this strategy but adjust the thresholds to make the contribution of middle branches slightly larger than the early branches. The threshold numbers for RDI-SmallCNN, RDI-ResNet38, and RDI-MobilenetV2 are set to be {0.023, 0.014}, {0.32, 0.36, 0.39, 0.83, 1.12, 1.35}, and {0.267, 0.765}, respectively. 

D GENERALIZED ROBUSTNESS:

Here, we introduce the attack form of random attack and report the complete results against FGSM (Goodfellow et al., 2015) and WRM (Sinha et al., 2018) attacker under various attack forms, in Tables 9 and 10 , respectively.

Random Attack the attack exploits multi-loss flexibility by randomly fusing all f θi losses. Given a N -output network, we have a fusion vector C ∈ R N ∼ D, where D is some distribution (uniform by default). We denote c j as the jth element of C and x adv rdm can be found by:

x adv rdm = arg max It is expected to challenge our defense, due to the infinitely many ways of randomly fusing outputs. 

:

We tried adversarial training using other K earlier side branch single attacks, and found their TA/ATA to be much more deteriorated compared to the main branch one. We thus report this only for compactness.

ACKNOWLEDGEMENTWe would like to thank Dr. Yang Yang from Walmart Technology for highly helpful discussions throughout this project.

Figures and Tables:

Figure 1: Our proposed RDI-Net framework, a defended multi-output network enabling dynamic inference. Each image, being it clean or adversarially perturbed, adaptively picks one branch to exit.

Figure 2: The exiting behaviours of RDI-ResNet38 defended by (a) Single attack defense (Main Branch); (b) Average defense; and (c) Max-Average defense.

Figure 5: Network architecture of RDI-MobilenetV2. Two branch classfiers are inserted after 3rd inverted residual block and 11th inverted residual block in the orignal MobilenetV2.

Figure 6: Performance comparison between RDI-Net and the pruning + defense baseline. Each marker represents a model, whose size is proportional to its MFlops. γ is the sparsity trade-off parameter: the larger the sparser (smaller model).

The performance of RDI-SmallCNN. The "Average MFlops" is calculated by averaging the total flop costs consumed over the inference of the entire set (different samples take different FLOPs due to input-adaptive inference). The perturbation size and step size are 0.3 and 0.01, respectively.

Table content: <table><tr><td>Defense Method</td><td colspan="4">Standard Main Branch Average Max-Average</td></tr><tr><td>TA</td><td>99.48%</td><td>99.50%</td><td colspan="2">99.51% 99.52%</td></tr><tr><td>ATA (Branch 1)</td><td>6.60%</td><td>60.50%</td><td colspan="2">98.69% 98.52%</td></tr><tr><td>ATA (Branch 2)</td><td>3.16%</td><td>98.14%</td><td colspan="2">97.64% 97.62%</td></tr><tr><td>ATA (Main Branch)</td><td>1.32%</td><td>96.70%</td><td colspan="2">96.30% 96.43%</td></tr><tr><td>ATA (Average)</td><td>2.61%</td><td>61.35%</td><td colspan="2">97.37% 97.42%</td></tr><tr><td>ATA (Max-Average)</td><td>2.10%</td><td>61.83%</td><td colspan="2">96.82% 96.89%</td></tr><tr><td>ATA (Worst-Case)</td><td>1.32%</td><td>60.50%</td><td colspan="2">96.30% 96.43%</td></tr><tr><td>Average MFlops</td><td>5.89</td><td>5.89</td><td>5.95</td><td>6.08</td></tr><tr><td colspan="2">Computation Saving 36.40%</td><td>36.40%</td><td colspan="2">35.70% 34.30%</td></tr><tr><td colspan="5">CIFAR-10 Experiments The results on RDI-ResNet38 and RDI-MobileNetV2 are presented in</td></tr><tr><td>Tables</td><td/><td/><td/><td/></tr></table>

Visualization of Adaptive Inference BehaviorsWe visualize the exiting behaviors of RDI-ResNet38 in Fig 4.2. We plot each branch exiting percentage on clean set and adversarial sets (worst-case) of examples. A few interesting observations can be found. First, we observe that the single-attack defended model can be easily fooled as adversarial examples can be routed through other less-defended outputs (due to the limited transferability of attacks between different outputs). Second, the two stronger defenses (Average and Max-Average) show much more uniform usage of multiple outputs. Their routing behaviors for clean examples are almost identical. For adversarial examples, Max-Average tends to call upon the full inference more often (i.e., more "conservative").

Table content: <table/>

The performance evaluation on RDI-ResNet38. The perturbation size and step size are 8/255 and 2/255, respectively.

Table content: <table><tr><td>Defence Method</td><td colspan="4">Standard Main Branch Average Max-Average</td></tr><tr><td>TA</td><td>92.43%</td><td>83.74%</td><td colspan="2">82.42% 83.79%</td></tr><tr><td>ATA (Branch1)</td><td>0.12%</td><td>12.02%</td><td colspan="2">71.56% 69.71%</td></tr><tr><td>ATA (Branch2)</td><td>0.01%</td><td>5.58%</td><td colspan="2">66.67% 63.11%</td></tr><tr><td>ATA (Branch3)</td><td>0.04%</td><td>42.73%</td><td colspan="2">60.65% 60.72%</td></tr><tr><td>ATA (Branch4)</td><td>0.06%</td><td>34.95%</td><td colspan="2">50.17% 47.82%</td></tr><tr><td>ATA (Branch5)</td><td>0.06%</td><td>41.77%</td><td colspan="2">44.83% 45.53%</td></tr><tr><td>ATA (Branch6)</td><td>0.11%</td><td>41.68%</td><td colspan="2">45.83% 44.12%</td></tr><tr><td>ATA (Main Branch)</td><td>0.13%</td><td>42.74%</td><td colspan="2">47.52% 49.82%</td></tr><tr><td>ATA (Average)</td><td>0.01%</td><td>9.14%</td><td colspan="2">42.09% 43.32%</td></tr><tr><td>ATA (Max-Average)</td><td>0.01%</td><td>7.15%</td><td colspan="2">40.53% 43.43%</td></tr><tr><td>ATA (Worst-Case)</td><td>0.01%</td><td>5.58%</td><td colspan="2">40.53% 43.32%</td></tr><tr><td>Average MFlops</td><td>29.41</td><td>48.27</td><td>56.90</td><td>57.81</td></tr><tr><td colspan="2">Computation Saving 62.96%</td><td>39.20%</td><td colspan="2">28.35% 27.20%</td></tr></table>

The performance evaluation on RDI-MobilenetV2. The perturbation size and step size are 8/255 and 2/255, respectively.

Table content: <table><tr><td/><td/><td>Defence Method</td><td colspan="3">Standard Main Branch Average Max-Average</td></tr><tr><td/><td/><td>TA</td><td>93.22%</td><td>85.28%</td><td>82.14% 84.91%</td></tr><tr><td/><td/><td>ATA (Branch1)</td><td>0.35%</td><td>37.40%</td><td>67.65% 71.78%</td></tr><tr><td/><td/><td>ATA (Branch2)</td><td>0%</td><td>47.35%</td><td>50.38% 50.15%</td></tr><tr><td/><td/><td>ATA (Main Branch)</td><td>0%</td><td>46.69%</td><td>49.33% 46.99%</td></tr><tr><td/><td/><td>ATA (Average)</td><td>0%</td><td>35.20%</td><td>45.93% 47.00%</td></tr><tr><td/><td/><td>ATA (Max-Average)</td><td>0%</td><td>36.66%</td><td>49.33% 50.18%</td></tr><tr><td/><td/><td>ATA (Worst-Case)</td><td>0%</td><td>35.20%</td><td>45.93% 46.99%</td></tr><tr><td/><td/><td>Average MFlops</td><td>49.78</td><td>52.81</td><td>58.23</td><td>60.84</td></tr><tr><td/><td/><td colspan="2">Computation Saving 42.72%</td><td>39.23%</td><td>33.00% 29.99%</td></tr><tr><td/><td>100</td><td/><td/><td/></tr><tr><td/><td/><td>Clean</td><td/><td/></tr><tr><td/><td/><td>Adv (Worst-Case)</td><td/><td/></tr><tr><td>Exiting Percentage</td><td>40 60 80</td><td/><td/><td/></tr><tr><td/><td>20</td><td/><td/><td/></tr><tr><td/><td>0</td><td>1st 2nd 3rd 4th 5th 6th main</td><td/><td/></tr><tr><td/><td/><td>Branch Number</td><td/><td/></tr></table>

Performance comparison between RDI-ResNet38 and ATMC.

Table content: <table><tr><td>Methods</td><td>TA</td><td colspan="2">ATA MFlops</td></tr><tr><td>ATMC (Gui et al. (2019))</td><td colspan="2">83.81 43.02</td><td>56.82</td></tr><tr><td colspan="3">RDI-ResNet-38 (Worst-Case) 83.79 43.32</td><td>57.81</td></tr></table>

Performance on RDI-ResNet38 against random attack. The perturbation size and step size are 8/255 and 2/255, respectively. More details of random attack can be referenced in Appendix D.

Table content: <table><tr><td>Defence Method</td><td colspan="4">Standard Main Branch Average Max-Average</td></tr><tr><td>TA</td><td>92.43%</td><td>83.74%</td><td colspan="2">82.42% 83.79%</td></tr><tr><td>ATA (Random)</td><td>0.01%</td><td>10.33%</td><td colspan="2">43.11% 44.86%</td></tr><tr><td>Average MFlops</td><td>27.33</td><td>52.36</td><td>55.21</td><td>56.54</td></tr><tr><td colspan="2">Computation Saving 65.58%</td><td>34.07%</td><td colspan="2">30.48% 28.80%</td></tr></table>

Performance on RDI-ResNet38 (defended with PGD) against FGSM attack (perturbation size is 8/255). The original defended ResNet38 by PGD under the same attack has ATA 51.11%.

Table content: <table><tr><td>Defence Method</td><td colspan="4">Standard Main Branch Average Max-Average</td></tr><tr><td>TA</td><td>92.43%</td><td>83.74%</td><td colspan="2">82.42% 83.79%</td></tr><tr><td>ATA (Main Branch)</td><td>11.51%</td><td>51.45%</td><td colspan="2">53.64% 54.72%</td></tr><tr><td>ATA (Average)</td><td>11.41%</td><td>50.21%</td><td colspan="2">51.81% 53.20%</td></tr><tr><td>ATA (Max-Average)</td><td>2.09%</td><td>47.53%</td><td colspan="2">50.63% 52.40%</td></tr><tr><td>ATA (Worst-Case)</td><td>2.09%</td><td>47.53%</td><td colspan="2">50.63% 51.05%</td></tr><tr><td>Average MFlops</td><td>65.74</td><td>55.27</td><td>58.27</td><td>59.67</td></tr><tr><td colspan="2">Computation Saving 17.21%</td><td>30.40%</td><td colspan="2">26.40% 24.86%</td></tr></table>

Performance on RDI-ResNet38 (defended with PGD) against WRM attack (perturbation size is 0.3). The original defended ResNet38 by PGD under the same attack has ATA 83.35%.

Table content: <table><tr><td>Defence Method</td><td colspan="4">Standard Main Branch Average Max-Average</td></tr><tr><td>TA</td><td>92.43%</td><td>83.74%</td><td colspan="2">82.42% 83.79%</td></tr><tr><td>ATA (Main Branch)</td><td>34.42%</td><td>83.74%</td><td colspan="2">82.42% 83.78%</td></tr><tr><td>ATA (Average)</td><td>26.48%</td><td>83.69%</td><td colspan="2">82.36% 83.77%</td></tr><tr><td>ATA (Max-Average)</td><td>23.51%</td><td>83.73%</td><td colspan="2">82.40% 83.78%</td></tr><tr><td>ATA (Worst-Case)</td><td>23.51%</td><td>83.69%</td><td colspan="2">82.36% 83.77%</td></tr><tr><td>Average MFlops</td><td>50.05</td><td>50.46</td><td>52.89</td><td>52.38</td></tr><tr><td colspan="2">Computation Saving 36.98%</td><td>36.46%</td><td colspan="2">33.40% 34.04%</td></tr></table>

To build RDI-Nets, we follow the similar setting in Teerapittayanon et al. (2017) by appending additional branch classifiers at equidistant points throughout a given network, as illustrated in Fig 3, Fig 4 and Fig 5. A few pooling operations, light-weight convolutions and fully-connected layers are appended to each branch classifiers. Note that the extra flops introduced by side branch classifiers are less than 2% than the original ResNet-38 or MobileNetV2. Network architecture of RDI-SmallCNN. Two branch classifiers are inserted after 1st convolutional layer and 3rd convolutional layer in the original SmallCNN.

Table content: <table><tr><td>FC</td><td>FC</td><td/><td>Fully Connected Layer</td></tr><tr><td>Branch 1</td><td>Branch 2</td><td/><td>Convolutional Layer</td></tr><tr><td>Conv</td><td/><td>Conv</td><td>Inverted Residul Block</td></tr><tr><td/><td/><td/><td>FC</td></tr><tr><td/><td/><td/><td>Main Branch</td></tr><tr><td>Conv</td><td/><td/></tr><tr><td/><td>Inverted Residul Blocks</td><td/></tr><tr><td>Branch 1</td><td/><td/></tr><tr><td>FC</td><td>Branch 2</td><td/></tr><tr><td/><td/><td colspan="2">Fully Connected Layer</td></tr><tr><td>Conv</td><td>FC</td><td colspan="2">Convolutional Layer</td></tr><tr><td/><td/><td/><td>Main Branch</td></tr><tr><td>Conv</td><td/><td>FC</td></tr><tr><td colspan="4">Branch 1 Figure 3: Main Branch FC FC FC Fully Connected Layer Convolutional Layer Branch 2 FC Branch 3 Branch 4 FC Conv Conv Conv Branch 5 Branch 6 Residul Block Conv FC FC</td></tr><tr><td>Conv</td><td/><td/></tr><tr><td>Residul Block Group 1</td><td>Residul Block Group 2</td><td colspan="2">Residul Block Group 3</td></tr><tr><td colspan="4">Figure 4: Network architecture of RDI-ResNet38. In each residual block group, two branch classi-</td></tr><tr><td colspan="3">fiers are inserted after 1st residual block and 4th residual block.</td></tr></table>

The performance evaluation on RDI-ResNet38 (defended with PGD) against FGSM attack. The perturbation size is 8/255. The ATA of the original defended ResNet38 by PGD under the same attacker is 51.11%.

Table content: <table><tr><td>Defence Method</td><td colspan="4">Standard Main Branch Average Max-Average</td></tr><tr><td>TA</td><td>92.43%</td><td>83.74%</td><td colspan="2">82.42% 83.79%</td></tr><tr><td>ATA (Branch1)</td><td>20.69%</td><td>66.06%</td><td colspan="2">72.77% 72.76%</td></tr><tr><td>ATA (Branch2)</td><td>16.15%</td><td>53.87%</td><td colspan="2">70.40% 69.71%</td></tr><tr><td>ATA (Branch3)</td><td>8.13%</td><td>63.70%</td><td colspan="2">64.19% 65.14%</td></tr><tr><td>ATA (Branch4)</td><td>10.09%</td><td>56.67%</td><td colspan="2">58.45% 58.20%</td></tr><tr><td>ATA (Branch5)</td><td>9.45%</td><td>50.81%</td><td colspan="2">52.76% 52.96%</td></tr><tr><td>ATA (Branch6)</td><td>10.22%</td><td>50.34%</td><td colspan="2">53.17% 51.05%</td></tr><tr><td>ATA (Main Branch)</td><td>11.51%</td><td>51.45%</td><td colspan="2">53.64% 54.72%</td></tr><tr><td>ATA (Average)</td><td>11.41%</td><td>50.21%</td><td colspan="2">51.81% 53.20%</td></tr><tr><td>ATA (Max-Average)</td><td>2.09%</td><td>47.53%</td><td colspan="2">50.63% 52.40%</td></tr><tr><td>ATA (Worst-Case)</td><td>2.09%</td><td>47.53%</td><td colspan="2">50.63% 51.05%</td></tr><tr><td>Average MFlops</td><td>65.74</td><td>55.27</td><td>58.27</td><td>59.67</td></tr><tr><td colspan="2">Computation Saving 17.21%</td><td>30.40%</td><td colspan="2">26.40% 24.86%</td></tr></table>

The performance evaluation on RDI-ResNet38 (defended with PGD) against WRM attack. The perturbation size is 0.3. The ATA of the original defended ResNet38 by PGD under the same attacker is 83.35%.

Table content: <table><tr><td>Defence Method</td><td colspan="4">Standard Main Branch Average Max-Average</td></tr><tr><td>TA</td><td>92.43%</td><td>83.74%</td><td colspan="2">82.42% 83.79%</td></tr><tr><td>ATA (Branch1)</td><td>46.60%</td><td>83.73%</td><td colspan="2">82.42% 83.78%</td></tr><tr><td>ATA (Branch2)</td><td>71.33%</td><td>83.73%</td><td colspan="2">82.42% 83.79%</td></tr><tr><td>ATA (Branch3)</td><td>23.51%</td><td>83.73%</td><td colspan="2">82.41% 83.78%</td></tr><tr><td>ATA (Branch4)</td><td>33.41%</td><td>83.73%</td><td colspan="2">82.42% 83.78%</td></tr><tr><td>ATA (Branch5)</td><td>42.35%</td><td>83.73%</td><td colspan="2">82.41% 83.78%</td></tr><tr><td>ATA (Branch6)</td><td>47.77%</td><td>83.74%</td><td colspan="2">82.40% 83.78%</td></tr><tr><td>ATA (Main Branch)</td><td>34.42%</td><td>83.74%</td><td colspan="2">82.42% 83.78%</td></tr><tr><td>ATA (Average)</td><td>26.48%</td><td>83.69%</td><td colspan="2">82.36% 83.77%</td></tr><tr><td>ATA (Max-Average)</td><td>23.51%</td><td>83.73%</td><td colspan="2">82.40% 83.78%</td></tr><tr><td>ATA (Worst-Case)</td><td>23.51%</td><td>83.69%</td><td colspan="2">82.36% 83.77%</td></tr><tr><td>Average MFlops</td><td>50.05</td><td>50.46</td><td>52.89</td><td>52.38</td></tr><tr><td colspan="2">Computation Saving 36.98%</td><td>36.46%</td><td colspan="2">33.40% 34.04%</td></tr></table>

Peer review (iclr2020):
This paper proposes a framework coined as ‘Robust Dynamic Inference Networks (RDI-Nets)’. The goal is concurrently achieving accuracy, robustness and efficiency via ‘input-adaptive inference’ and ‘multi-loss flexibility’ on a multi-output architecture. The observation is that in a deep architecture, the representations in earlier layers can also be used for solving a specific downstream classification task. So by attaching several final classification stages at the intermediate layers and by using the uncertainty of the softmax output as a decision criteria as when to use the current output as the final decision, the authors aim to achieve a triple win. The paper then proposes some attack criteria for a multi-output network. The paper is not very well written. The paper has a designated related work section but the entire paper reads from its abstract to conclusions constantly like a literature review. This makes it hard to focus and identify the original contribution. The proposed architecture is only introduced later in detail in 3.3 after the attacks. I found the organization and writing style not very reader friendly. The authors provide a large experimental section, however the key problem with the paper is that it blurs the evaluation issue. While the observation of using uncertainty of estimates at intermediate levels has some intuitive appeal, the decision criteria that the authors propose requires careful selection of thresholds and a good calibration. But given the thresholds the final decision is just a function of the entire network - as it should be. So a natural attack here is just attacking this decision function (or an approximate differentiable proxy) to see if this model provides extra robustness. Is such an evaluation available? Otherwise the proposed approach provides a false sense of robustness as the proposed attacks are not geared towards the actual underlying model. Minor: The definition of entropy in (6) is missing a minus sign. The notation f(	heta| x) for theta as parameters and x as input for a function is in conflict with probability notation of conditional probabilities.