Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks

1 Introduction . Deep neural networks ( DNNs ) are becoming standard models for many real-world applications such as image classification [ 1 ] , object detection [ 2 ] and natural language processing [ 3 ] . However , a line of research has shown that DNNs are vulnerable to adversarial examples ( attacks ) , which can be easily crafted by slightly perturbing the input instance to maximize the model ’ s prediction error [ 4–6 ] . This vulnerability of DNNs has become a major concern for their deployment in security-critical applications such as autonomous driving [ 7 , 8 ] and medical diagnosis [ 9 , 10 ] . A number of defense methods have been proposed to train adversarially robust DNNs [ 11–14 ] , among which adversarial training has demonstrated the most promising results [ 15–17 ] . Adversarial training can be viewed as a type of data augmentation that trains DNNs on adversarial ( instead of natural ) examples [ 15–19 ] . Based on adversarial training , a set of works have been proposed to understand its learning and convergence behaviors , and the key factors for training adversarially robust DNNs . For example , it has been found that adversarial training encourages the model to learn more robust or compact features [ 20 , 21 ] , and it requires more data [ 22–25 ] or higher capacity models to gain more robustness [ 15 , 26 ] . While these understandings have motivated several improved defense methods , it is still not clear , from an architectural perspective , what makes an adversarially robust DNN . †Correspondence to : Xingjun Ma ( danxjma @ gmail.com ) 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . In this paper , we present the first comprehensive investigation on the architectural ingredients of adversarially robust DNNs . Our investigation is based on adversarial training and WideResNet-34-10 ( WRN-34-10 ) [ 27 ] , one extensively tested architecture in the defense literature . Based on the base architectural configuration of WRN-34-10 , we apply a finely-controlled grid search to explore the impact of network width and depth configurations on the robustness of adversarial trained DNNs . The standard WRN-34-10 consists of 3 stages with each stage being a group of 5 ( i.e. , depth ) residual blocks and each residual block having 2 convolutional layers . We denote the three stages as Stage-1 , Stage-2 and Stage-3 following the direction from the input to the output . Each stage is configured by a depth ( number of residual blocks ) and a width ( number of filters ) factor . The hyper-parameters for width and depth of each stage control the scale of learnable parameters ( capacity ) . In this paper , we explore different configurations of width and depth for each of the three stages . Based on our explorations , we make the following key observations : • Simply increasing the number of parameters ( model capacity ) by upscaling width or depth does not necessarily lead to improved robustness . This contrasts with current beliefs that , under the same type of architecture , more parameters ( higher model capacity ) can improve adversarial robustness [ 15 , 26 , 28 ] . Adversarial training does require larger capacity models , but there exists a trade-off . We provide both theoretical and empirical evidences that wider/deeper models increase Lipschitzness ( larger Lipschitz constant ) . • For a larger model used in adversarial training , reducing capacity at the last stage ( Stage-3 ) of WRNs can achieve a better trade-off between capacity and Lipschitzness , thus improving adversarial robustness . This can be achieved by reducing either depth or width , with width reduction being slightly more effective . This highlights that smaller DNNs can also have better robustness if the parameter reduction is applied at the right place ( i.e. , the last stage ) . • Under the same type of architectures ( i.e. , WRNs ) and parameter budget , there may exist an optimal architectural configuration that can produce the most robust DNN . We show that the same configuration rule can also be applied to improve the robustness of VGGs , DenseNets ( DNs ) , as well as networks found by Differentiable Architecture Search ( DARTS ) . Furthermore , we provide a series of understandings for the above findings , which can not only provide useful insights for training more robust models with adversarial training , but also shed new light on the architectural ingredients of adversarially robust DNNs . 2 Related Work . 2.1 Adversarial Training . Adversarial training has been demonstrated to be the most reliable training method for obtaining adversarially robust DNNs [ 29 , 30 ] . The standard adversarial training ( SAT ) can be formulated as a min-max optimization framework as follows : arg min θ E ( x , y ) ∼D [ max x′ L ( fθ , x′ , y ) ] , ( 1 ) where the inner maximization generates adversarial examples x′ , the outer minimization trains the model on x′ , fθ denote the neural network and L ( · ) is the cross entropy ( CE ) loss . During the inner maximization process , SAT uses PGD to generate adversarial examples [ 15 ] : x′k = Π ( x ′ k−1 + α · sign ( ∇xL ( fθ , x′k−1 , y ) ) ) , ( 2 ) where sign ( · ) is the sign function , x′k is the adversarial example obtained at the k-th ( for overall K steps ) perturbation step , α is the step size , and Π is a projection ( clipping ) operation that projects the perturbation back onto the -ball centered around x if it goes beyond . Improved variants of SAT have also been proposed , such as the trade-off between adversarial robustness and natural accuracy ( TRADES ) [ 16 ] , Dynamic AdveRsarial Training ( DART ) [ 17 ] , Friendly Adversarial Training ( FAT ) [ 31 ] , Misclassification Aware adveRsarial Training ( MART ) [ 18 ] , Robust Self-Training ( RST ) [ 23 ] , Unsupervised Adversarial Training ( UAT ) [ 32 ] , Guided Adversarial Training ( GAT ) [ 33 ] , Max-Margin AT [ 34 ] , using Max-Mahalanobis Center ( MMC ) loss [ 35 ] , accelerated AT [ 36–38 ] , using pre-training [ 39 ] , incorporating hypersphere embedding [ 40 ] , self-progressing robust training [ 41 ] , Adversarial Weight Perturbation ( AWP ) [ 19 ] , Adversarial Distributional Training ( ADT ) [ 42 ] , Channel-wise Activation Suppressing ( CAS ) [ 21 ] , GeometryAware Instance-Reweighted Adversarial Training ( GAIRAT ) [ 43 ] and robustness distillation [ 44 , 45 ] . Adversarial Training has also been found to cause robust overfitting [ 46 ] , but it can be mitigated by smoothing techniques [ 47 ] . 2.2 Understanding Adversarially Trained DNNs . Understanding the working mechanism of adversarial training has been a hot research area . For example , it has been found that adversarial training encourages the model to learn more robust features [ 20 , 48 ] , have good generative ability [ 49 , 50 ] , improve the model ’ s transferability to downstream tasks [ 51 , 52 ] and improve performance on clean data [ 53 ] . It has also been found that using auxiliary training data with adversarial training can further improve adversarial robustness [ 22 , 23 ] , and that weight decay plays an important role in adversarial training [ 54 ] . Another important observation is that using WRNs instead of ResNets ( RNs ) can bring ∼ 3 % -5 % more robustness [ 16–18 ] . Other works also suggest that adversarial training requires deeper and wider models [ 15 , 26 , 55 ] . Also , the skip-connection operation used in WRN has been found can improve robustness for deeper architectures [ 56 ] and there exists a trade-off between depth and width for approximating natural functions [ 57 ] . On the other hand , there are also works showing that increasing the number of parameters for the same type of DNN architectures can only lead to limited robustness improvement [ 28 , 58 ] ; and wider networks may cause more perturbation instability [ 59 ] . Several recent works have applied neural architecture search ( NAS ) to search for more robust DNN architectures [ 60 ] . They found that , 1 ) densely connected cells result in improved robustness ; and 2 ) under certain computational budget , adding convolution operations to direct connection edge is effective . Other works improve the NAS search strategy by searching on targeted capacity [ 61 ] , maximizing certified lower bound [ 62 ] , using the log-normal distribution to approximate the Lipschitz constant [ 63 ] , using lower and upper confidence bounds in Bandit [ 64 ] , or using perturbation-based regularization [ 65 ] . Another study on hand-crafted versus NAS-based architectures shows that , without adversarial training , NAS-based architectures are more robust for small-scale datasets and simple tasks than hand-crafted architectures , however , hand-crafted architectures are more robust than NAS-based architectures as the dataset size or the task complexity increases [ 66 ] . Note that NAS is extremely time-consuming , especially when applied with adversarial training . Previous works using NAS find optimal topological connections within the cell structure [ 60 ] , but did not investigate depth/width configurations , which arguably has more impact on robustness ( e.g. , RNs vs. WRNs ) . In this work , we focus on fine-grained configuration exploration rather than blind search , which can produce more precise understandings of how depth and width affect robustness . 3 Wider and Deeper Models Increase Lipschitz Upper Bound . It has been theoretically shown that high Lipschitzness ( larger Lipschitz constant ) corresponds to low stability of the model ’ s output to input perturbations [ 59 ] . However , adversarial training does require a larger capacity model ( e.g. , RN vs. WRN ) [ 15 ] , an empirical finding that goes against the theoretical expectation . In this section , we first theoretically show a trade-off between network capacity ( width/depth ) and the Lipschitz upper bound . In Section 4 , we will empirically examine this trade-off and its relation to the improved adversarial robustness for larger capacity models . The Lipschitz constant L of a DNN measures the maximum rate of change in the output with the change in the input , and is closely related to adversarial robustness [ 4 ] . Formally , it is ‖fθ ( x ) − fθ ( x′ ) ‖ ≤ L ‖x− x′‖ . Theorem 1 ( Lipschitz Constant Upper Bound of a Neural Network with Gaussian Distributed Weights ) . Consider an n layer DNN f , where the weight parameters θ are independent Gaussian random variables distributed asN ( 0 , σ2θ ) with σ2θ denoting the variance of the Gaussian distribution , and where the activation functions are 1-Lipschitz . The expected Lipschitz constant of a DNN with hidden layer size h is upper bounded by : L ( fθ ) ≤ n∏ j=1 ( √ hj−1 + √ hj ) · σθj Theorem 2 . For a convolutional neural network f , each layer ’ s convolution operation with feature map sizeW ×m×m and kernel size k×k , where the weight parameters θ are independent Gaussian random variables distributed as N ( 0 , σ2θ ) , the expected Lipschitz constant is upper bounded by : L ( fθ ) ≤ n∏ j=1 ( mj √ Wj−1 + ( mj − kj + 1 ) √ Wj ) · σθj The proof for Theorem 1 and 2 is inspired by [ 67–69 ] and can be found in Appendix A.1 . This establishes a connection between the upper bound on the Lipschitz constant of a feed-forward DNN with n layers and width of hj for each layer . For the j-th layer of convolution operations , the Lipschitz constant upper bound increases with its input dimension ( Wj−1 ×mj ×mj ) and the number of output channels Wj . More simply , it is upper-bounded by the variance of the weight matrix and the input representation ’ s dimension plus the output representation ’ s dimension . For the entire network , the Lipschitz constant upper bound grows exponentially with the depth . This suggests that wider and deeper models have a relatively larger change of the output due to the changes in the input , i.e. , lower adversarial robustness . Several works attempt to regularize the network ’ s Lipschitz constant by using Parseval tight frames on the weight matrixes [ 70 ] , enforcing constraints on the singular values of the weight matrixes [ 71 ] , or via a Lipschitz-margin training [ 72 ] . However , a follow-up work points out that there exist both experimental and theoretical limitations for the above approaches [ 73 ] . Whilst the Lipschitz constant may not be used as a regularization , it has been widely adopted for analyzing the stability and adversarially robustness of DNNs [ 4 , 59 , 74 ] .

Summary: This paper conducts an empirical study on the effect of the model architectural on the model robustness. The experimental results show that more parameters do not necessarily lead to more robust model. Reduce capacity of the deeper layers can improve the robustness. With the same architectures, there may exist one optimal architectural configuration for producing the most robust DNN.