Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attacks

1 Introduction . Although deep learning has found successful applications in many tasks such as image classification [ 1 , 2 ] , speech recognition [ 3 ] , and natural language processing [ 4 ] , the vulnerability of deep learning to adversarial attacks ( e.g. , see [ 5 ] ) has limited its real-world applications due to performance and safety concerns in critical applications . Inputs corrupted with human-imperceptible perturbations can easily fool many vanilla deep neural networks ( DNNs ) into mis-classifying them and thus significantly impact their performance . Recent studies [ 6–8 ] have applied neural Ordinary Differential Equations ( ODEs ) [ 9 ] to defend against adversarial attacks . Some works like [ 6 ] have revealed interesting intrinsic properties of ∗First two authors contributed equally to this work . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . ODEs that make them more stable than conventional convolutional neural networks ( CNNs ) . The paper [ 6 ] proposes a time-invariant steady neural ODE ( TisODE ) using the property that the integral curves from a ODE solution starting from different initial points ( inputs ) do not intersect and always preserve uniqueness in the solution function space . However , this does not guarantee that small perturbations of the initial point lead to small perturbations of the integral curve output at a later time T . The authors thus proposed a regularizer to limit the evolution of the curves by forcing the integrand to be close to zero . However , neither the non-intersecting property nor the steady-state constraint used in TisODE can guarantee robustness against input perturbations since these constraints do not ensure that the inputs are within a neighborhood of Lyapunov-stable equilibrium points . An example is an ODE that serves as an identity mapping is not robust to input perturbations but satisfies all the constraints proposed in [ 6 ] . In this paper , our objective is to design a neural ODE such that the features extracted are within a neighborhood of the Lyapunov-stable equilibrium points of the ODE . We first develop a diversity promoting technique applied in the final fully connected ( FC ) layer to improve the ODE ’ s stability and analyze the reasons why . We then propose a stable neural ODE with Lyapunov-stable equilibrium points to eliminate the effects of perturbations in the input . From linear control theory [ 10 ] , a linear time-invariant system dz ( t ) / dt = Az ( t ) , where A is a constant matrix , is exponentially stable if all eigenvalues of A have negative real parts . Specifically , we propose to force the Jacobian matrix of the ODE used in the neural ODE to have eigenvalues with negative real parts . Instead of directly imposing constraints on the eigenvalues of the matrix , which lead to high computational complexity when the Jacobian matrix is large , we instead add constraints to the matrix elements to implicitly force the real parts of its eigenvalues to be negative . Our main contributions are summarized as follows : 1 . Based on the concept of Lyapunov-stable equilibrium points , we propose a simple yet effective technique to improve the robustness of neural ODE networks by fixing the final FC layer to be a matrix whose rows have unit norm and such that the maximum cosine similarity between any two rows is minimized . Such a FC layer can be constructed off-line . 2 . We propose a stable neural ODE for deFending against adversarial attacks ( SODEF ) to suppress the input perturbations . We derive an optimization formulation for SODEF to force the extracted feature points to be within a neighborhood of the Lyapunov-stable equilibrium points of the SODEF ODE . We provide sufficient conditions for learning a robust feature representation under SODEF . 3 . We test SODEF on several widely used datasets MNIST [ 11 ] , CIFAR-10 and CIFAR-100 [ 12 ] under well-known adversarial attacks . We demonstrate that SODEF is robust against adversarial white-box attacks with improvement in classification accuracy of adversarial examples under PGD attack [ 13 ] of up to 44.02 % , 52.54 % and 18.91 % percentage points compared to another current state-of-the-art neural ODE network TisODE [ 6 ] on MNIST , CIFAR-10 and CIFAR-100 , respectively . Similar improvements in classification accuracy of adversarial examples of up to 43.69 % , 52.38 % and 18.99 % percentage points compared to ODE net [ 9 ] are also obtained . The rest of this paper is organized as follows . We provide essential preliminaries on neural ODE and its stability analysis in Section 2 . In Section 3 , we present SODEF model architecture and its training method . We show how to maximize the distance between stable equilibrium points of neural ODEs . We propose an optimization and present theoretical results on its stability properties . We summarize experimental results in Section 4 and conclude the paper in Section 5 . The proofs for all lemmas and theorems proposed in this paper are given in the supplementary material . We also refer interested readers to the supplementary material for a more detailed account of related works [ 14–16 , 6 ] and some popular adversarial attacks [ 17 , 13 ] that are used to verify the robustness of our proposed SODEF . In the paper , we use lowercase boldface characters like z to denote vectors in Rn , capital boldface characters like A to denote matrices in Rn×n , and normal characters like z to denote scalars except that the notation ( x , y ) are normal characters reserved to denote the input and label pairs . A vector z ∈ Rn is represented as ( z ( 1 ) , z ( 2 ) , . . . , z ( n ) ) . The ( i , j ) -th element of a matrix A is Aij or [ A ] ij . The Jacobian matrix of a function f : Rn 7→ Rn evaluated at z is denoted as ∇f ( z ) . The set of functions Rn 7→ Rn with continuous first derivatives is denoted as C1 ( Rn , Rn ) . 2 Preliminaries : Neural ODE and Stability . In a neural ODE layer , the relation between the layer input z ( 0 ) and output z ( T ) is described as the following differential equation : dz ( t ) dt = fθ ( z ( t ) , t ) ( 1 ) where fθ : Rn × [ 0 , ∞ ) 7→ Rn denotes the non-linear trainable layers that are parameterized by weights θ and z : [ 0 , ∞ ) 7→ Rn represents the n-dimensional state of the neural ODE . Neural ODEs are the continuous analog of residual networks where the hidden layers of residual networks can be regarded as discrete-time difference equations z ( t + 1 ) = z ( t ) + fθ ( z ( t ) , t ) . In this work , for simplicity , we only consider the time-invariant ( autonomous ) case fθ ( z ( t ) , t ) = fθ ( z ( t ) ) , where the dynamical system does not explicitly depend on t. For such non-linear dynamical systems , the following theorem shows that under mild conditions , its behaviour can be studied via linearization near special points called hyperbolic equilibrium points . Theorem 1 ( Hartman–Grobman Theorem [ 18 ] ) . Consider a system evolving in time with state z ( t ) ∈ Rn that satisfies the differential equation dz ( t ) dt = f ( z ( t ) ) for some f ∈ C1 ( Rn , Rn ) , f ( z ) = ( f ( 1 ) ( z ) , . . . , f ( n ) ( z ) ) . Suppose the map has a hyperbolic equilibrium state z∗ ∈ Rn , i.e. , f ( z∗ ) = 0 and the Jacobian matrix ∇f = [ ∂f ( i ) /∂z ( j ) ] ni , j=1 of f evaluated at z = z∗ has no eigenvalue with real part equal to zero . Then there exists a neighbourhood Nz∗ of the equilibrium point z∗ and a homeomorphism g : Nz∗ 7→ Rn , such that g ( z∗ ) = 0 and in the neighbourhood Nz∗ , the flow of dz ( t ) dt = f ( z ( t ) ) is topologically conjugate by the continuous map z̄ ( t ) = g ( z ( t ) ) to the flow of its linearization dz̄ ( t ) dt = ∇f ( z∗ ) · z̄ ( t ) . The theorem states that when the Jacobian matrix at the zeros of f has no eigenvalue with zero real part , the behaviour of the original dynamical system can be studied using the simpler linearization of the system around those zeros . We next review some definitions and theorems from linear control theory [ 10 ] . Definition 1 ( Lyapunov Stability [ 10 ] ) . The linear time-invariant system dz̄ ( t ) dt = Az̄ ( t ) with constant matrix A is marginally stable or stable in the sense of Lyapunov if every finite initial state z̄ ( 0 ) excites a bounded response . It is asymptotically stable if every finite initial state excites a bounded response , which , in addition , approaches 0 as t→∞ . Theorem 2 ( Lyapunov Stability Theorem [ 10 ] ) . a ) The equation dz̄ ( t ) dt = Az̄ ( t ) ) is marginally stable if and only if all eigenvalues of A have zero or negative real parts and those with zero real parts are simple roots of the minimal polynomial of A. b ) The equation dz̄ ( t ) dt = Az̄ ( t ) is asymptotically stable if and only if all eigenvalues of A have negative real parts . In Theorem 1 , we say that a hyperbolic equilibrium point is Lyapunov-stable if all eigenvalues of the Jacobian matrix evaluated at it have negative real parts . From Theorems 1 and 2 , we see that a small perturbation around the Lyapunov-stable equilibrium point z ( 0 ) leads to z̃ ( t ) → z ( 0 ) as t→∞ , i.e. , ∃ δ > 0 such that for all z̃ ( 0 ) with ‖z ( 0 ) − z̃ ( 0 ) ‖2 < δ , we have ‖z̃ ( t ) − z ( 0 ) ‖2 → 0 as t→∞ , where z̃ ( t ) is the ODE solution for the perturbed input z̃ ( 0 ) . In the context of neural network adversarial attacks , if the malicious perturbations around the ODE input z ( 0 ) is small , then the output z ( T ) for large enough T will not be affected significantly by the perturbation . Consequently , the succeeding network layers after the neural ODE layer can still perform well without being affected by the input perturbation . The perturbation weakening phenomenon around Lyapunov-stable equilibrium points works like a noise filter and acts as a defense against adversarial attacks . We require the following definition and result in our stability analysis . Definition 2 ( Strictly diagonally dominant [ 19 ] ) . Let A ∈ Cn×n . We say that A is strictly diagonally dominant if |Aii| > ∑ j 6=i |Aij | for all i = 1 , ... , n. Theorem 3 ( Levy–Desplanques theorem [ 19 ] ) . If A ∈ Cn×n is strictly diagonally dominant and if every main diagonal entry of A is real and negative , then A is non-singular and every eigenvalue of A has negative real part . Lemma 1 . Given k distinct points zi ∈ Rn and matrices Ai ∈ Rn×n , i = 1 , ... , k , there exists a function f ∈ C1 ( Rn , Rn ) such that f ( zi ) = 0 and ∇fθ ( zi ) = Ai .

Summary: This paper proposes a neural network classifier architecture based on neural ODEs that is designed to be robust to adversarial attacks. In the proposed method, the classes are represented by vectors, chosen to be maximally separated in the output space w.r.t. cosine similarity. The neural ODE system is then encouraged to have equilibrium points at those class vectors via regularization; the idea is that perturbed outputs are pulled towards the equilibria as the ODEs evolve.