SlowGuess/NeurIPS_2023_OCR huggingface dataset:
One Less Reason for Filter-Pruning: Gaining Free Adversarial Robustness with Structured Grouped Kernel Pruning
Shaochen (Henry) Zhong $^{1}$ , Zaichuan You $^{*2}$ , Jiamu Zhang $^{*2}$ , Sebastian Zhao $^{*3}$ , Zachary LeClaire $^{2}$ , Zirui Liu $^{1}$ , Daochen Zha $^{1}$ , Vipin Chaudhary $^{2}$ , Shuai Xu $^{2}$ , and Xia Hu $^{1}$
$^{1}$ Department of Computer Science, Rice University {shaochen.zhong, zirui.liu, daochen.zha, xia.hu}@rice.edu  $^{2}$ Department of Computer and Data Sciences, Case Western Reserve University {zxy456, jxz1217, zjl16, vipin, sxx214}@case.edu  $^{3}$ Electrical Engineering and Computer Sciences, UC Berkeley sebbyzhao@berkeley.edu
Densely structured pruning methods utilizing simple pruning heuristics can deliver immediate compression and acceleration benefits with acceptable benign performances. However, empirical findings indicate such naively pruned networks are extremely fragile under simple adversarial attacks. Naturally, we would be interested in knowing if such a phenomenon also holds for carefully designed modern structured pruning methods. If so, then to what extent is the severity? And what kind of remedies are available? Unfortunately, both questions remain largely unaddressed: no prior art is able to provide a thorough investigation on the adversarial performance of modern structured pruning methods (spoiler: it is not good), yet the few works that attempt to provide mitigation often do so at various extra costs with only to-be-desired performance.
In this work, we answer both questions by fairly and comprehensively investigating the adversarial performance of  $10+$  popular structured pruning methods. Solution-wise, we take advantage of Grouped Kernel Pruning (GKP)'s recent success in pushing densely structured pruning freedom to a more fine-grained level. By mixing up kernel smoothness — a classic robustness-related kernel-level metric — into a modified GKP procedure, we present a one-shot-post-train-weight-dependent GKP method capable of advancing SOTA performance on both the benign and adversarial scale, while requiring no extra (in fact, often less) cost than a standard pruning procedure. Please refer to our GitHub repository for code implementation, tool sharing, and model checkpoints.
Convolutional neural networks (CNNs) have demonstrated solid performance on tasks centered around computer vision. However, with modern CNNs growing in both widths and depths, the issue of over-parameterization has drawn increasing attention due to such networks often requiring large computational resources and memory capacity. To mitigate the burden, network pruning — the study of removing redundant parameters from original networks without significant performance loss — has become a popular approach for its simplicity and directness [LeCun et al., 1989, Blalock et al., 2020, He and Xiao, 2023].
* Equal contribution. Order determined alphabetically by last names.
Despite the popularity of the pruning field in general, few prior arts have been available to provide improved adversarial robustness under the constraint of (densely) structured pruning; even though empirical findings show vanilla structured pruning methods implemented with naive pruning strategies often experience huge performance drop on such adversarial tasks [Wang et al., 2018, Sehwag et al., 2020, Vemparala et al., 2021]. More concerning, no prior art has made an effort to provide a comprehensive investigation on whether the same phenomenon also exists under carefully designed modern structured pruning methods, where such methods are often capable of delivering excellent benign accuracy retention after pruning (sometimes, even improvements).
Below, we provide a walk-through of why a densely structured method and having an adversarially robust pruned model are preferable and important, to how we developed our solution by leveraging the power of increased structural pruning freedom (grouped kernel pruning) with kernel-level metrics (kernel smoothness). In the later sections of this paper, we replicate and evaluate around 13 popular densely structured pruning methods and variants against various white box (evasion) adversarial attacks, where our proposed method showcases clear dominance.
1.1 Structured v.s. Unstructured Pruning: Accuracy-Efficiency Trade-off
Most of the existing CNN pruning methods can be roughly categorized into structured and unstructured pruning. Note we said roughly because there is no universally agreed delineation between structured and unstructured pruning methods. The general consensus is that methods considered more unstructured often enjoy a higher degree of freedom on where to apply their pruning strategies (e.g., weight-level pruning) and therefore result in better accuracy retention.
In contrast, structured pruning methods often prune weights in a grouped manner following some kind of architecturally defined constraints (e.g., filter-level pruning). Compared to their unstructured counterparts, structured pruning methods are more hardware-friendly and easier to obtain compression and acceleration on commodity hardware, though at the cost of worse accuracy retention. This difference is due to unstructurally pruned networks' tendency to have pruned (zeroed) parameters randomly distributed in the weight matrix, leading to poor data reuse and locality [Yang et al., 2018]. Such unstructurally pruned networks struggle to have wall-clock time speed up without supports like custom-indexing, special operation design, sparse operation libraries, or even dedicated hardware setups [Yang et al., 2018, Han et al., 2016, He and Xiao, 2023].
Among all structured pruning methods, one popular line of research is to produce pruned networks that are entirely dense, a.k.a. densely structured, where the pruned weights are stored in the normal dense tensor format. Such format of a pruned network is considered to be most library/hardware-friendly and, therefore, most deployable in a practical context. With such significant benefits, densely structured pruning methods consist of the absolute majority of structured pruning methods.
Figure 1: Visualization of different pruning granularities.
Densely structured pruning methods come with different pruning granularities, where a significant portion of prior arts prune at a filter or channel level. These two types of pruning are historically considered to be the limit of densely structured pruning, as showcased in Figure 1: if we go down one more level, we will have kernel pruning; however, its pruned network is not dense. This is until recently, authors from Zhong et al. [2022] utilized kernel pruning with grouped convolution, where they prune at a grouped kernel level to ensure an entirely dense pruned network. To the best of our knowledge, grouped kernel pruning carries the highest degree of pruning freedom among all densely structured pruning methods.
1.2 Pruned Models Are Fragile Under Adversarial Attacks — But Why Do We Care?
Empirical findings like Wang et al. [2018] suggest that although pruned neural networks may have acceptable benign accuracy, they are often more vulnerable to adversarial attacks. Adversarial robustness is recognized as a long-standing metric to evaluate model quality, as a model with undesired adversarial robustness can be easily exploited to produce wrong and potentially harmful output, resulting in fairness and accountability issues.
We would argue such robustness properties are especially valued under the context of (structured) pruning, where pruned models are often deployed to resource-constraint devices with less central oversight available and requiring execution in a more real-time manner. Imagine if an OCR model for real-time check redeeming can be maliciously exploited to read the number 1 as 9; the result will surely be unpleasant for many parties involved.
To alleviate such a problem (though not under a pruning context), prior arts like Wang et al. [2020b] demonstrate the adversarial robustness of a convolutional network is largely correlated to its sensitivity to high-frequency components (HFC), where such sensitiveness can be mitigated with some simple kernel-level operations like kernel smoothness. More on this in Section 2.
1.3 Solution: Grouped Kernel Pruning with Adversarial-Robustness-Boosting Kernel Metrics
With the recent Grouped Kernel Pruning (GKP) framework pushing the pruning freedom of densely structured pruning to a (close) kernel-level [Zhong et al., 2022], we explore the unique possibility of mixing up adversarial-robustness-boosting kernel metrics — such as kernel smoothness — into the procedure of GKP. We present Smoothly Robust Grouped Kernel Pruning (SR-GKP), a densely structured pruning method that works in a simple post-train one-shot manner, but is often capable of delivering competitive benign performance and much stronger adversarial performance against SOTA filter and channel pruning methods that require more sophisticated procedures. Solution-wise, our main claims and contributions are:
- Free improvement on adversarial robustness. Our method has no extra (in fact, often less) cost compared to a standard pruning method, making the gained adversarial robustness entirely free.
- One-shot & post-train & weight-dependent: the simplest procedure with most compatibility. Our method is a one-shot-post-train-weight-dependent<sup>1</sup> structured pruning method for CNN that follows the classic train - prune - fine-tune procedure, where all excessive components are pruned all at once before fine-tuning. This means it is compatible with any trained CNNs (as it does not interfere with the training pipeline) yet straightforward to execute, as the pruning procedure before fine-tuning does not rely on access to data but only the trained model's parameters.
- Raise attention to the important but overlooked field of adversarially robust structured pruning. Our method is among the few structured pruning methods capable of delivering pruned networks with improved adversarial performance — a field with severe problems, but receives little recognition or solutions.
On the investigation side, we are the first to comprehensively reveal:
- Drastic adversarial performance difference under a similar benign report. We found that while different carefully designed modern densely structured pruning methods may showcase similar benign performance, most are done so at the cost of adversarial robustness.
- One less reason for filter/channel pruning: further endorsing GKP. Filter and channel pruning methods have dominated the field of densely structured pruning for years; our work — together with Zhong et al. [2022] and Park et al. [2023] — showcased that when done right, grouped kernel pruning-based methods are superior under both benign and adversarial tasks, making it a promising direction for future densely structured pruning research.
<sup>1</sup>Note the term "one-shot" can be ambiguous under a pruning context. Some literature, including ours, refer to "one-shot" as the pruning procedure is done all at once before fine-tuning [Liu et al., 2019, Frankle and Carbin, 2019, Renda et al., 2020]; yet, some other work refers to "one-shot" as without requiring a fine-tuning stage [Chen et al., 2023, Frantar et al., 2023]. We hereby clarify that our proposed method still requires a fine-tuning stage after pruning. Further, Only-Train-One (OTO) [Chen et al., 2023] — a popular series of iterative from-scratch pruning methods known for its automatically applicable property — utilizes the term "one-shot" in a manner in line with "one-stop," highlighting its end-to-end nature and model-agnostic capability. For disambiguation, we hereby clarify that our method is, in fact, limited to CNN pruning, requires a trained model to start with, and does not possess such model-agnostic or automatically applicable properties.
For added bonuses, we are the first ones to reproduce and comprehensively report the benign and adversarial performances of multiple structured pruning methods under a fair setting. We believe the lack of such fair and comprehensive reports (on both benign and adversarial tasks) is mainly due to the lack of user-friendly tools. Thus, alongside our method implementation and checkpoint files, we also provide the pruning community a lightweight open-sourced tool capable of a plug-and-play style of testing different victim models with various adversarial attacks while supporting all procedures a modern pruning method may require.
2 Related Work and Discussion
Due to the page limitation, we will discuss related work regarding white box evasion adversarial attacks, adversarially robust structured pruning, and grouped kernel pruning. Other related topics, such as the compression/acceleration implications of structured and unstructured pruning methods, input component frequency with kernel smoothness, as well as other related ML efficiency and AI safety literature, will be introduced in Appendix B.
Adversarial Attacks. Neural networks are known to be vulnerable to adversarial attacks, i.e., a small perturbation applied to the inputs can mislead models to make wrong predictions Szegedy et al. [2014], Goodfellow et al. [2014]. In practice, popular adversarial attacks can often be categorized as white-box and black-box evasion attacks. The difference being white-box attacks have access to the entirety of the model, including input features, architectures, and model parameters, while black-box attacks' access is often constrained (e.g., only input-output pair). Thus, white-box attacks are almost always more effective and efficient than black-box ones; in fact, many classic black-box attacks are constructed in a way to approximate the information that is directly accessible by white-box attacks (e.g., gradient) [Chen et al., 2020]. We opt for white-box attacks for the scope of this paper, given one significant use case of structurally pruned models is edge-device deployments, where the model is more likely to be accessed. Also, white-box attacks generally offer a more straightforward workflow with harder challenges posed.
Structured Pruning for Adversarial Robustness. Structured pruning methods, which arguably carry the most practical significance, have been heavily studied throughout the years [Molchanov et al., 2017, Yu et al., 2018, He et al., 2019, Wang et al., 2019a,b, Lin et al., 2019, He et al., 2018, Li et al., 2021, Zhong et al., 2022]. Despite their popularity, few of them focus on adversarial robustness. To the best of our knowledge, there are only four prior arts presenting structured pruning methods while claiming improved performance on adversarial robustness metrics [Vemparala et al., 2021, Ye et al., 2019, Sehwag et al., 2020, Zhao and Wressnegger, 2023]. Unfortunately, Vemparala et al. [2021] does not have a public repository for code, Ye et al. [2019] does not have any experiment on standard BasicBlock ResNets for comparative investigation despite their popularity. [Blalock et al., 2020], Sehwag et al. [2020] and Zhao and Wressnegger [2023] mostly propose unstructured methods with only a few structurally pruned ablation studies conducted on limited model-dataset combinations, with some of their structured pruning implementation not published.
The lack of traffic, infrastructure, or baseline in this area has undoubtedly created deterrents to all interested scholars. To fill the gap, we provide the community an open-sourced toolkit capable of testing various victim models against different adversarial attacks under a pruning context, coming with  $10+$  popular structured pruning methods already integrated for comparative evaluation. Model checkpoints are also available for direct evaluations.
Grouped Kernel Pruning. Our work relies on the GKP framework — particularly inspired by the recent work of Zhong et al. [2022]. The core of GKP is grouped kernel pruning and reconstruction to a grouped convolution format, where this combination has been explored a few times under the context of structure pruning.
Specifically, Zhong et al. [2022] proposed their take on grouped kernel pruning with a three-stage procedure: filter clustering, generating then deciding which grouped kernel pruning strategy to employ, then reconstructing to grouped convolution format via permutation. This particular framework solved the previous drawback of requiring a complex procedure, yet a rich set of experiment results was showcased to demonstrate its performance advantages against many SOTA structured pruning methods. Our proposed method is largely enabled by the extra pruning freedom that GKP provides.
Outside of Zhong et al. [2022], concurrent work like Zhang et al. [2022a] and follow-up work like Park et al. [2023] have showcased the excellent benign performance of different GKP implementations under a benign context.
3.1 Motivation: Pruning May Amplify Overfitting to High-Frequency Components
Wang et al. [2020b] suggests CNNs are prone to overfitting high-frequency components (HFC) of inputs — a type of feature that is not robust yet can be easily replicated with adversarial perturbations. Though Wang's finding is towards an unpruned model, such phenomenon can be found, and in fact, even amplified, under a structural pruning setting.
Figure 2: A frog figure from CIFAR-10 test set in its original, LFC, and HFC-reconstructed formats. The output indicates the correctness of classification results when testing through an unpruned and a L1Norm pruned ResNet-56 (pruning rate  $\approx 43.75\%$  to be consistent with Table 2).
A classic demonstration of such phenomena can be seen in Figure 2. Despite the frog-labeled figure reconstructed with only low-frequency components showing visible resemblance to its original benign format, a ResNet-56 model pruned by L1Norm filter pruning [Li et al., 2017] cannot classify it correctly. However, such pruned models can somehow correctly classify the same input reconstructed with only HFCs, even if it already lost all semantics of a frog to a human audience. This indicates a model pruned by methods without having adversarial robustness in consideration is more likely to overfit to HFC.
Table 1: Unpruned and structurally pruned ResNet-56 v. HFC/LFC-reconstructed CIFAR-10 test set.  $\theta$  represents the cutoff threshold (for  $0\leq \theta \leq 1$ ). With a higher  $\theta$ , the HFC-reconstructed images will exclusively include more high-frequency information; vice-versa for a lower  $\theta$ . Pruning rate  $\approx$ $43.75\%$ ; pruned model checkpoints are taken from Table 2.
INPUT	UNPRUNED BASELINE	CC PRUNED	NPPM PRUNED	L1NORM-B PRUNED
FULL (θ = 0.0)	93.24	94.04	93.55	92.62
HFC (θ = 0.3)	77.05	80.22	78.08	79.83
HFC (θ = 0.5)	50.77	57.49	55.47	56.06
HFC (θ = 0.7)	22.79	25.78	21.92	27.15
We emphasize that the above example (Figure 2) is not a cherry-picked one. As shown in Table 1, by reconstructing the entire test set of CIFAR-10 with solely their high-frequency components, we find that a structurally pruned model is more prone to fitting HFCs than its unpruned counterpart under various settings. This is potentially because HFCs are easily learnable features under a benign setting, so pruned models want to "make most use" of their remaining weights given the reduced network capacity, and therefore become even more overfitted to HFCs by treating them as short-cut features.
Kernel smoothness as an indicator for learning from HFC. Fortunately, Wang et al. [2020b] suggests kernel smoothness is highly correlated to the learning of HFC. Specifically, Wang et al. [2020b] found that a CNN with "smoother" kernels — where neighbor weights within a 2D kernel have less of a value difference — will reduce the overfitting of HFCs, thus making the model more robust against adversarial perturbations. For the ease of the following conversation, we define the kernel smoothness of a convolution kernel  $k$  for  $k \in \mathbb{R}^{H \times W}$  to be:
$$
\operatorname {s m o o t h n e s s} (k) = \sum_ {i = 1} ^ {h \times w} \sum_ {\substack {j \in \text {values} \\ \text {border with } k _ {i}}} \left| k _ {j} ^ {2} - k _ {i} ^ {2} \right|, \tag{1}
$$
where  $H$  and  $W$  are the kernel dimensions; in most CNNs, such dimensions are set to  $3 \times 3$ .
The finding of kernel smoothness and adversarial robustness presents a unique opportunity under the context of GKP. Prior to GKP, densely structured pruning is almost always done at a filter/channel level, where kernel-level metrics/operation have little bearing when relaxed (see Appendix C.1.3). However, GKP prunes at a (close) kernel level, where a kernel-level metric may still retain its power.
3.2 Mixing Smoothness into Grouped Kernel Pruning Procedure
It is natural to want to encapsulate some kernel-level operations/metrics — in this case, kernel smoothness — into the procedure of GKP. However, the challenge comes with how we can do it in an efficient and effective manner. Particularly, how can we achieve improved adversarial performance without sacrificing benign tasks?
For the ease of illustration, let  $W^{\ell} \in \mathbb{R}^{C_{\mathrm{out}}^{\ell} \times C_{\mathrm{in}}^{\ell} \times H^{\ell} \times W^{\ell}}$  be the weight of the  $\ell$ -th convolutional layer, which consist of  $C_{\mathrm{out}}^{\ell}$  filters, with each filter consisting of  $C_{\mathrm{in}}^{\ell}$  number of  $H^{\ell} \times W^{\ell}$  2D kernels. According to Zhong et al. [2022], a standard GKP procedure has two potential stages:
Stage 1: Filter grouping stage: where the  $C_{\mathrm{out}}^{\ell}$  filters are clustered into  $n$  equal-sized filter groups  $\{FG_i^\ell, FG_j^\ell, \ldots, FG_n^\ell\}$ , with each filter group  $FG^{\ell} \in \mathbb{R}^{C_{\mathrm{out}}^{\ell}/n \times C_{\mathrm{in}}^{\ell} \times H^{\ell} \times W^{\ell}}$ .
Stage 2: Pruning strategies obtaining/pruning stage: where the pruning method generates a set of "candidate" grouped kernel pruning strategies to be evaluated and select from; a grouped kernel is defined as a  $\mathbf{G}K \in \mathbf{F}\mathbf{G}^{\ell}$  with  $\mathbf{G}K$  having a shape of  $C_{\mathrm{out}}^{\ell} / n \times 1 \times H^{\ell} \times W^{\ell}$ . Finally, we evaluate all collected candidate strategies and decide which to pursue.
However, how to apply kernel smoothness-related criteria to such stages is a non-trivial question. Our empirical results from some proof-of-concept experiments suggest some naive applications either will not work at all or will only work by significantly sacrificing the performance on benign tasks: e.g., if we simply replace Stage 2 above by pruning the grouped kernels with greater  $\sum_{k\in GK}$  smoothness  $(k)$ , we will experience a huge drop on benign accuracy (Appendix C). Therefore, we must drive our attention to discover some more sophisticated ways of mixing up such criteria into the above stages.
3.2.1 Smoothness Snaking: Is Filter Clustering the Only Right Answer for GKP?
Per TMI-GKP [Zhong et al., 2022], filters within the same convolutional layer are grouped into several equal-sized groups by a filter clustering schema, which consist of some different combinations of dimensionality reduction and clustering techniques. The motivation of grouping by clustering is natural as it establishes a preferable search space for pruning algorithms, where the power of pruned components can likely be retrained via similar unpruned components within the same group. However, later procedures of TMI-GKP (e.g., Stage 2 per Section 3.2) then seek to maintain a diverse representation of kept components within each filter group, which begs the question: is filter clustering the only right answer for GKP? If finding a diverse set of unpruned grouped kernels is the goal, why not have filter groups with filter diversity to start with? And if the answer to the first question is "No." How can we utilize this opportunity to mix up with kernel smoothness criteria?
Figure 3: Smoothness Snaking For Filter Grouping (Stage 1)