On Robustness of Neural Ordinary Differential Equations

1 INTRODUCTION Neural ordinary differential equations ( Chen et al. , 2018 ) form a family of models that approximate nonlinear mappings by using continuous-time ODEs . Due to their desirable properties , such as invertibility and parameter efficiency , neural ODEs have attracted increasing attention recently ( Dupont et al. , 2019 ; Liu et al. , 2019 ) . For example , Grathwohl et al . ( 2018 ) proposed a neural ODE-based generative model—the FFJORD—to solve inverse problems ; Quaglino et al . ( 2019 ) used a higher-order approximation of the states in a neural ODE , and proposed the SNet to accelerate computation . Along with the wider deployment of neural ODEs , robustness issues come to the fore . However , the robustness of neural ODEs is still yet unclear . In particular , it is unclear how robust neural ODEs are in comparison to the widely-used CNNs . Robustness properties of CNNs have been studied extensively . In this work , we present the first systematic study on exploring the robustness properties of neural ODEs . To do so , we consider the task of image classification . We expect that results would be similar for other machine learning tasks such as regression . Neural ODEs are dimension-preserving mappings , but a classification model transforms a high-dimensional input—such as an image—into an output whose dimension is equal to the number of classes . Thus , we consider the neural ODE-based classification network ( ODENet ) whose architecture is shown in Figure 1 . An ODENet consists of three components : the feature extractor ( FE ) consists of convolutional layers which maps an input datum to a multi-channel feature map , a neural ODE that serves as the nonlinear representation mapping ( RM ) , and the fully-connected classifier ( FCC ) that generates a prediction vector based on the output of the RM . The robustness of a classification model can be evaluated through the lens of its performance on perturbed images . To comprehensively investigate the robustness of neural ODEs , we perturb original images with commonly-used perturbations , namely , random Gaussian noise ( Szegedy et al. , 2013 ) and harmful adversarial examples ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ) . We conduct experiments in two common settings—training the model only on authentic non-perturbed images and training the model on authentic images as well as the Gaussian perturbed ones . We observe that ODENets are more robust compared to CNN models against all types of perturbations in both settings . We then provide an insightful understanding of such intriguing robustness of neural ODEs by exploiting a certain property of the flow ( Dupont et al. , 2019 ) , namely that integral curves that start at distinct initial states are nonintersecting . The flow of a continuous-time ODE is defined as the family of solutions/paths traversed by the state , starting from different initial points , and an integral curve is a specific solution for a given initial point . The non-intersecting property indicates that an integral curve starting from some point is constrained by the integral curves starting from that point ’ s neighborhood . Thus , in an ODENet , if a correctly classified datum is slightly perturbed , the integral curve associated to its perturbed version would not change too much from the original one . Consequently , the perturbed datum could still be correctly classified . Thus , there exists intrinsic robustness regularization in ODENets , which is absent from CNNs . Motivated by this property of the neural ODE flow , we attempt to explore a more robust neural ODE architecture by introducing stronger regularization on the flow . We thus propose a Time-Invariant Steady neural ODE ( TisODE ) . The TisODE removes the time dependence of the dynamics in an ODE and imposes a steady-state constraint on the integral curves . Removing the time dependence of the derivative results in the time-invariant property of the ODE . To wit , given a solution z1 ( t ) , another solution z̃1 ( t ) , with an initial state z̃1 ( 0 ) = z1 ( T ′ ) for some T ′ > 0 , can be regarded as the −T ′- shift version of z1 ( t ) . Such a time-invariant property would make bounding the difference between output states convenient . To elaborate , let the output of a neural ODE correspond to states at time T > 0 . By the time-invariant property , the difference between outputs , ‖z̃1 ( T ) − z1 ( T ) ‖ , equals to ‖z1 ( T + T ′ ) − z1 ( T ) ‖ . To control this distance , a steady-state regularization term is introduced to the overall objective to constrain the change of a state after time exceeds T . With the time-invariant property and the steady-state term , we show that TisODE even is more robust . We do so by evaluating the robustness of TisODE-based classifiers against various types of perturbations and observe that such models are more robust than vanilla ODE-based models . In addition , some other effective architectural solutions have also been recently proposed to improve the robustness of CNNs . For example , Xie et al . ( 2017 ) randomly resizes or pads zeros into test images to destroy the specific structure of adversarial perturbations . Besides , the model proposed by Xie et al . ( 2019 ) contains feature denoising filters to remove the feature-level patterns of adversarial examples . We conduct experiments to show that our proposed TisODE can work seamlessly and in conjunction with these methods to further boost the robustness of deep models . Thus , the proposed TisODE can be used as a generally applicable and effective component for improving the robustness of deep models . In summary , our contributions are as follows . Firstly , we are the first to provide a systematic empirical study on the robustness of neural ODEs and find that the neural ODE-based models are more robust compared to conventional CNN models . This finding inspires new applications of neural ODEs in improving robustness of deep models , a problem that concerns many deep learning theorists and practitioners alike . Secondly , we propose the TisODE method , which is simple yet effective in significantly boosting the robustness of neural ODEs . Moreover , the proposed TisODE can also be used in conjunction with other state-of-the-art robust architectures . Thus , TisODE can serve as a drop-in module to improve the robustness of deep models effectively . 2 PRELIMINARIES ON NEURAL ODE It has been shown that a residual block ( He et al. , 2016 ) can be interpreted as the discrete approximation of an ODE by setting the discretization step to be one . When the discretization step approaches zero , it yields a family of neural networks , which are called neural ODEs ( Chen et al. , 2018 ) . Formally , in a neural ODE , the relation between input and output is characterized by the following set of equations : dz ( t ) dt = fθ ( z ( t ) , t ) , z ( 0 ) = zin , zout = z ( T ) , ( 1 ) where fθ : Rd × [ 0 , ∞ ) → Rd denotes the trainable layers that are parameterized by weights θ and z : [ 0 , ∞ ) → Rd represents the d-dimensional state of the neural ODE . We assume that fθ is continuous in t and globally Lipschitz continuous in z . In this case , the input zin of the neural ODE corresponds to the state at t = 0 , and the output zout is associated to the state at some T ∈ ( 0 , ∞ ) . Because fθ governs how the state changes with respect to time t , we also use fθ to denote the dynamics of the neural ODE . Given input zin , the output zout can be computed by solving the ODE in ( 1 ) . If T is fixed , the output zout only depends on the input zin and the dynamics fθ , which also corresponds to the weighted layers in the neural ODE . Therefore , the neural ODE can be represented as the d-dimensional function φT ( · , · ) of the input zin and the dynamics fθ , i.e. , zout = z ( T ) = z ( 0 ) + ∫ T 0 fθ ( z ( t ) , t ) dt = φT ( zin , fθ ) . The terminal time T of the output state z ( T ) is set to be 1 in practice . Several methods have been proposed for training neural ODEs , such as the adjoint sensitivity method ( Chen et al. , 2018 ) , SNet ( Quaglino et al. , 2019 ) , and the auto-differentiation technique ( Paszke et al. , 2017 ) . In this work , we use the most straightforward technique , i.e. , updating the weights θ with the autodifferentiation technique in the PyTorch framework . 3 AN EMPIRICAL STUDY ON THE ROBUSTNESS OF ODENETS Robustness of deep models has gained increased attention , as it is imperative that deep models employed in critical applications , such as healthcare , are robust . The robustness of a model is measured by the sensitivity of the prediction with respect to small perturbations on the inputs . In this study , we consider three commonly-used perturbation schemes , namely random Gaussian perturbations , FGSM ( Goodfellow et al. , 2014 ) adversarial examples , and PGD ( Madry et al. , 2017 ) adversarial examples . These perturbation schemes reflect noise and adversarial robustness properties of the investigated models respectively . We evaluate the robustness via the classification accuracies on perturbed images , in which the original non-perturbed versions of these images are all correctly classified . For a fair comparison with conventional CNN models , we made sure that the number of parameters of an ODENet is close to that of its counterpart CNN model . Specifically , the ODENet shares the same network architecture with the CNN model for the FE and FCC parts . The only difference is that , for the RM part , the input of the ODE-based RM is concatenated with one more channel which represents the time t , while the RM in a CNN model has a skip connection and serves as a residual block . During the training phase , all the hyperparameters are kept the same , including training epochs , learning rate schedules , and weight decay coefficients . Each model is trained three times with different random seeds , and we report the average performance ( classification accuracy ) together with the standard deviation . 3.1 EXPERIMENTAL SETTINGS Dataset : We conduct experiments to compare the robustness of ODENets with CNN models on three datasets , i.e. , the MNIST ( LeCun et al. , 1998 ) , the SVHN ( Netzer et al. , 2011 ) , and a subset of the ImageNet datset ( Deng et al. , 2009 ) . We call the subset ImgNet10 since it is collected from 10 synsets of ImageNet : dog , bird , car , fish , monkey , turtle , lizard , bridge , cow , and crab . We selected 3,000 training images and 300 test images from each synset and resized all images to 128× 128 . Architectures : On the MNIST dataset , both the ODENet and the CNN model consists of four convolutional layers and one fully-connected layer . The total number of parameters of the two models is around 140k . On the SVHN dataset , the networks are similar to those for the MNIST ; we only changed the input channels of the first convolutional layer to three . On the ImgNet10 dataset , there are nine convolutional layers and one fully-connected layer for both the ODENet and the CNN model . The numbers of parameters is approximately 280k . In practice , the neural ODE can be solved with different numerical solvers such as the Euler method and the Runge-Kutta methods ( Chen et al. , 2018 ) . Here , we use the easily-implemented Euler method in the experiments . To balance the computation and the continuity of the flow , we solve the ODE initial value problem in equation ( 1 ) by the Euler method with step size 0.1 . Our implementation builds on the open-source neural ODE codes.1 Details on the network architectures are included in the Appendix . Training : The experiments are conducted using two settings on each dataset—training models only with original non-perturbed images and training models on original images together with their perturbed versions . In both settings , we added a weight decay term into the training objective to regularize the norm of the weights , since this can help control the model ’ s representation capacity and improve the robustness of a neural network ( Sokolić et al. , 2017 ) . In the second setting , images perturbed with random Gaussian noise are used to fine-tune the models , because augmenting the dataset with small perturbations can possibly improve the robustness of models and synthesizing Gaussian noise does not incur excessive computation time . 3.2 ROBUSTNESS OF ODENETS TRAINED ONLY ON NON-PERTURBED IMAGES The first question we are interested in is how robust ODENets are against perturbations if the model is only trained on original non-perturbed images . We train CNNs and ODEnets to perform classification on three datasets and set the weight decay parameters for all models to be 0.0005 . We make sure that both the well-trained ODENets and CNN models have satisfactory performances on original non-perturbed images , i.e. , around 99.5 % for MNIST , 95.0 % for the SVHN , and 80.0 % for ImgNet10 . Since Gaussian noise is ubiquitous in modeling image degradation , we first evaluated the robustness of the models in the presence of zero-mean random Gaussian perturbations . It has also been shown that a deep model is vulnerable to harmful adversarial examples , such as the FGSM ( Goodfellow et al. , 2014 ) . We are also interested in how robust ODENets are in the presence of adversarial examples . The standard deviation σ of Gaussian noise and the l∞-norm $ of the FGSM attack for each dataset are shown in Table 1 . From the results in Table 1 , we observe that the ODENets demonstrate superior robustness compared to CNNs for all types of perturbations . On the MNIST dataset , in the presence of Gaussian 1https : //github.com/rtqichen/torchdiffeq . perturbations with a large σ of 100 , the ODENet produces much higher accuracy on perturbed images compared to the CNN model ( 73.2 % vs. 56.4 % ) . For the FGSM-0.3 adversarial examples , the accuracy of ONEnet is around twice as high as that of the CNN model . On the SVHN dataset , ODENets significantly outperform CNN models , e.g. , for the FGSM-5/255 examples , the accuracy of the ODENet is 43.0 % , which is much higher than that of the CNN model ( 13.7 % ) . On the ImgNet10 , for both cases of σ = 25 and FGSM-8/255 , ODENet outperforms CNNs by a large margin of around 9 % . 3.3 ROBUSTNESS OF ODENETS TRAINED ON ORIGINAL IMAGES TOGETHER WITH GAUSSIAN PERTURBATIONS Training a model on original images together with their perturbed versions can improve the robustness of the model . As mentioned previously , Gaussian noise is commonly assumed to be present in real-world images . Synthesizing Gaussian noise is also fast and easy . Thus , we add random Gaussian noise into the original images to generate their perturbed versions . ODENets and CNN models are both trained on original images together with their perturbed versions . The standard deviation of the added Gaussian noise is randomly chosen from { 50 , 75 , 100 } on the MNIST dataset , { 15 , 25 , 35 } on the SVHN dataset , and { 10 , 15 , 25 } on the ImgNet10 . All other hyperparameters are kept the same as above . The robustness of the models is evaluated under Gaussian perturbations , FGSM adversarial examples , and PGD ( Madry et al. , 2017 ) adversarial examples . The latter is a stronger attacker compared to the FGSM . The l∞-norm $ of the PGD attack for each dataset is shown in Table 2 . Based on the results , we observe that ODENets consistently outperform CNN models on both two datasets . On the MNIST dataset , the ODENet outperforms the CNN against all types of perturbations . In particular , for the PGD-0.2 adversarial examples , the accuracy of the ODENet ( 64.7 % ) is much higher than that of the CNN ( 32.9 % ) . Besides , for the PGD-0.3 attack , the CNN is completely misled by the adversarial examples , but the ODENet can still classify perturbed images with an accuracy of 13.0 % . On the SVHN dataset , ODENets also show superior robustness in comparison to CNN models . For all the adversarial examples , ODENets outperform CNN models by a margin of at least 10 percentage points . On the ImgNet10 dataset , the ODENet also performs better than CNN models against all forms of adversarial examples . 3.4 INSIGHTS ON THE ROBUSTNESS OF ODENETS From the results in Sections 3.2 and 3.3 , we find ODENets are more robust compared to CNN models . Here , we attempt to provide an intuitive understanding of the robustness of the neural ODE . In an ODENet , given some datum , the FE extracts an informative feature map from the datum . The neural ODE , serving as the RM , takes as input the feature map and performs a nonlinear mapping . In practice , we use the weight decay technique during training which regularizes the norm of weights in the FE part , so that the change of feature map in terms of a small perturbation on the input can be controlled . We aim to show that , in the neural ODE , a small change on the feature map will not lead to a large deviation from the original output associated with the feature map . Theorem 1 ( ODE integral curves do not intersect ( Coddington & Levinson , 1955 ; Younes , 2010 ; Dupont et al. , 2019 ) ) . Let z1 ( t ) and z2 ( t ) be two solutions of the ODE in ( 1 ) with different initial conditions , i.e . z1 ( 0 ) ∕= z2 ( 0 ) . In ( 1 ) , fθ is continuous in t and globally Lipschitz continuous in z . Then , it holds that z1 ( t ) ∕= z2 ( t ) for all t ∈ [ 0 , ∞ ) . To illustrate this theorem , considering a simple 1- dimensional system in which the state is a scalar . As shown in Figure 2 , equation ( 1 ) has a solution z1 ( t ) starting from A1 = ( 0 , z1 ( 0 ) ) , where z1 ( 0 ) is the feature of some datum . Equation ( 1 ) also has another two solutions z2 ( t ) and z3 ( t ) , whose starting points A2 = ( 0 , z2 ( 0 ) ) and A3 = ( 0 , z3 ( 0 ) ) , both of which are close to A1 . Suppose A1 is between A2 and A3 . By Theorem 1 , we know that the integral curve z1 ( t ) is always sandwiched between the integral curves z2 ( t ) and z3 ( t ) . Now , let $ < min { |z2 ( 0 ) −z1 ( 0 ) | , |z3 ( 0 ) −z1 ( 0 ) | } . Consider a solution z̃1 ( t ) of equation ( 1 ) . The integral curve z̃1 ( t ) starts from a point Ã1 = ( 0 , z̃1 ( 0 ) ) . The point Ã1 is in the $ -neighborhood of A1 with |z̃1 ( 0 ) −z1 ( 0 ) | < $ . By Theorem 1 , we know that |z̃1 ( T ) − z1 ( T ) | ≤ |z3 ( T ) − z2 ( T ) | . In other words , if any perturbation smaller than $ is added to the scalar z1 ( 0 ) in A1 , the deviation from the original output z1 ( T ) is bounded by the distance between z2 ( T ) and z3 ( T ) . In contrast , in a CNN model , there is no such bound on the deviation from the original output . Thus , we opine that due to this non-intersecting property , ODENets are intrinsically robust . 4 TISODE : BOOSTING THE ROBUSTNESS OF NEURAL ODES In the previous section , we presented an empirical study on the robustness of ODENets and observed that ODENets are more robust compared to CNN models . In this section , we explore how to boost the robustness of the vanilla neural ODE model further . This motivates the proposal of time-invariant steady neural ODEs ( TisODEs ) . 4.1 TIME-INVARIANT STEADY NEURAL ODES steady-state constraint . In the neural ODE characterized by equation ( 1 ) , the dynamics fθ ( z ( t ) , t ) depends on both the state z ( t ) at time t and the time t itself . In contrast , if the neural ODE is modified to be time-invariant , the time dependence of the dynamics is removed . Consequently , the dynamics depends only on the state z . So , we can rewrite the dynamics function as fθ ( z ) , and the neural ODE is characterized as dz ( t ) dt = fθ ( z ( t ) ) ; z ( 0 ) = zin ; zout = z ( T ) . ( 2 ) Let z1 ( t ) be a solution of ( 2 ) on [ 0 , ∞ ) and $ > 0 be a small positive value . We define the set M1 = { ( z1 ( t ) , t ) |t ∈ [ 0 , T ] , ‖z1 ( t ) −z1 ( 0 ) ‖ ≤ $ } . This set contains all points on the curve of z1 ( t ) during [ 0 , T ] that are also inside the $ -neighborhood of z1 ( 0 ) . For some element ( z1 ( T ′ ) , T ′ ) ∈ M1 , let z̃1 ( t ) be the solution of ( 2 ) which starts from z̃1 ( 0 ) = z1 ( T ′ ) . Then we have z̃1 ( t ) = z1 ( t+ T ′ ) ( 3 ) for all t in [ 0 , ∞ ) . The property shown in equation ( 3 ) is known as the time-invariant property . It indicates that the integral curve z̃1 ( t ) is the −T ′ shift of z1 ( t ) ( Figure 3 ) . We can regard z̃1 ( 0 ) as a slightly perturbed version of z1 ( 0 ) , and we are interested in how large the difference between z̃1 ( T ) and z1 ( T ) is . In a robust model , the difference should be small . By equation ( 3 ) , we have ‖z̃1 ( T ) − z1 ( T ) ‖ = ‖z1 ( T +T ′ ) − z1 ( T ) ‖ . Since T ′ ∈ [ 0 , T ] , the difference between z1 ( T ) and z̃1 ( T ) can be bounded as follows , ‖z̃1 ( T ) −z1 ( T ) ‖= ∥∥∥∥∥ ∫ T+T ′ T fθ ( z1 ( t ) ) dt ∥∥∥∥∥≤ ∥∥∥∥∥ ∫ T+T ′ T |fθ ( z1 ( t ) ) | dt ∥∥∥∥∥≤ ∥∥∥∥∥ ∫ 2T T |fθ ( z1 ( t ) ) | dt ∥∥∥∥∥ , ( 4 ) where all norms are ℓ2 norms and |fθ| denotes the element-wise absolute operation of a vectorvalued function fθ . That is to say , the difference between z̃1 ( T ) and z1 ( T ) can be bounded by only using the information of the curve z1 ( t ) . For any t′ ∈ [ 0 , T ] and element ( z1 ( t′ ) , t′ ) ∈ M1 , consider the integral curve that starts from z1 ( t′ ) . The difference between the output state of this curve and z1 ( T ) satisfies inequality ( 4 ) . Therefore , we propose to add an additional term Lss to the loss function when training the timeinvariant neural ODE : Lss = N∑ i=1 ∥∥∥∥∥ ∫ 2T T |fθ ( zi ( t ) ) | dt ∥∥∥∥∥ , ( 5 ) where N is the number of samples in the training set and zi ( t ) is the solution whose initial state equals to the feature of the ith sample . The regularization term Lss is termed as the steady-state loss . This terminology “ steady state ” is borrowed from the dynamical systems literature . In a stable dynamical system , the states stabilize around a fixed point , known as the steady-state , as time tends to infinity . If we can ensure that Lss is small , for each sample , the outputs of all the points in Mi will stabilize around zi ( T ) . Consequently , the model is robust . This modification of the neural ODE is dubbed Time-invariant steady neural ODE . 4.2 EVALUATING ROBUSTNESS OF TISODE-BASED CLASSIFIERS Here , we conduct experiments to evaluate the robustness of our proposed TisODE , and compare TisODE-based models with the vanilla ODENets . We train all models with original non-perturbed images together with their Gaussian perturbed versions . The regularization parameter for the steadystate loss Lss is set to be 0.1 . All other hyperparameters are exactly the same as those in Section 3.3 . From the results in Table 3 , we can see that our proposed TisODE-based models are clearly more robust compared to vanilla ODENets . On the MNIST dataset , when combating FGSM-0.3 attacks , the TisODE-based models outperform vanilla ODENets by more than 4 percentage points . For the FGSM-0.5 adversarial examples , the accuracy of the TisODE-based model is 6 percentage points better . On the SVHN dataset , the TisODE-based models perform better in terms of all forms of adversarial examples . On the ImgNet10 dataset , the TisODE-based models also outperform vanilla ODE-based models on all types of perturbations . In the presence of FGSM and PGD-5/255 examples , the accuracies are enhanced by more than 2 percentage points . 4.3 TISODE - A GENERALLY APPLICABLE DROP-IN TECHNIQUE FOR IMPROVING THE ROBUSTNESS OF DEEP NETWORKS In view of the excellent robustness of the TisODE , we claim that the proposed TisODE can be used as a general drop-in module for improving the robustness of deep networks . We support this claim by showing the TisODE can work in conjunction with other state-of-the-art techniques and further boost the models ’ robustness . These techniques include the feature denoising ( FDn ) method ( Xie et al. , 2019 ) and the input randomization ( IR ) method ( Xie et al. , 2017 ) . We conduct experiments on the MNIST and SVHN datasets . All models are trained with original non-perturbed images together with their Gaussian perturbed versions . We show that models using the FDn/IRd technique becomes much more robust when equipped with the TisODE . In the FDn experiments , the dot-product nonlocal denoising layer ( Xie et al. , 2019 ) is added to the head of the fully-connected classifier . From Table 4 , we observe that both FDn and IRd can effectively improve the adversarial robustness of vanilla CNN models ( CNN-FDn , CNN-IRd ) . Furthermore , combining our proposed TisODE with FDn or IRd ( TisODE-FDn , TisODE-IRd ) , the adversarial robustness of the resultant model is significantly enhanced . For example , on the MNIST dataset , the additional use of our TisODE increases the accuracies on the PGD-0.3 examples by at least 10 percentage points for both FDn ( 8.2 % to 28.2 % ) and IRd ( 55.5 % to 66.0 % ) . However , on both MNIST and SVHN datasets , the IRd technique improves the robustness against adversarial examples , but its performance is worse on random Gaussian noise . With the help of the TisODE , the degradation in the robustness against random Gaussian noise can be effectively ameliorated . 5 RELATED WORKS In this section , we briefly review related works on the neural ODE and works concerning improving the robustness of deep neural networks . Neural ODE : The neural ODE ( Chen et al. , 2018 ) method models the input and output as two states of a continuous-time dynamical system by approximating the dynamics of this system with trainable layers . Before the proposal of neural ODE , the idea of modeling nonlinear mappings using continuous-time dynamical systems was proposed in Weinan ( 2017 ) . Lu et al . ( 2017 ) also showed that several popular network architectures could be interpreted as the discretization of a continuoustime ODE . For example , the ResNet ( He et al. , 2016 ) and PolyNet ( Zhang et al. , 2017 ) are associated with the Euler scheme and the FractalNet ( Larsson et al. , 2016 ) is related to the Runge-Kutta scheme . In contrast to these discretization models , neural ODEs are endowed with an intrinsic invertibility property , which yields a family of invertible models for solving inverse problems ( Ardizzone et al. , 2018 ) , such as the FFJORD ( Grathwohl et al. , 2018 ) . Recently , many researchers have conducted studies on neural ODEs from the perspectives of optimization techniques , approximation capabilities , and generalization . Concerning the optimization of neural ODEs , the auto-differentiation techniques can effectively train ODENets , but the training procedure is computationally and memory inefficient . To address this problem , Chen et al . ( 2018 ) proposed to compute gradients using the adjoint sensitivity method ( Pontryagin , 2018 ) , in which there is no need to store any intermediate quantities of the forward pass . Also in Quaglino et al . ( 2019 ) , the authors proposed the SNet which accelerates the neural ODEs by expressing their dynamics as truncated series of Legendre polynomials . Concerning the approximation capability , Dupont et al . ( 2019 ) pointed out the limitations in approximation capabilities of neural ODEs because of the preserving of input topology . The authors proposed an augmented neural ODE which increases the dimension of states by concatenating zeros so that complex mappings can be learned with simple flow . The most relevant work to ours concerns strategies to improve the generalization of neural ODEs . In Liu et al . ( 2019 ) , the authors proposed the neural stochastic differential equation ( SDE ) by injecting random noise to the dynamics function and showed that the generalization and robustness of vanilla neural ODEs could be improved . However , our improvement on the neural ODEs is explored from a different perspective by introducing constraints on the flow . We empirically found that our proposal and the neural SDE can work in tandem to further boost the robustness of neural ODEs . Robust Improvement : A straightforward way of improving the robustness of a model is to smooth the loss surface by controlling the spectral norm of the Jacobian matrix of the loss function ( Sokolić et al. , 2017 ) . In terms of adversarial examples ( Carlini & Wagner , 2017 ; Chen et al. , 2017 ) , researchers have proposed adversarial training strategies ( Madry et al. , 2017 ; Elsayed et al. , 2018 ; Tramèr et al. , 2017 ) in which the model is fine-tuned with adversarial examples generated in realtime . However , generating adversarial examples is not computationally efficient , and there exists a trade-off between the adversarial robustness and the performance on original non-perturbed images ( Yan et al. , 2018 ; Tsipras et al. , 2018 ) . In Wang et al . ( 2018a ) , the authors model the ResNet as a transport equation , in which the adversarial vulnerability can be interpreted as the irregularity of the decision boundary . Consequently , a diffusion term is introduced to enhance the robustness of the neural nets . Besides , there are also some works that propose novel architectural defense mechanisms against adversarial examples . For example , Xie et al . ( 2017 ) utilized random resizing and random padding to destroy the specific structure of adversarial perturbations ; Wang et al . ( 2018b ) and Wang et al . ( 2018c ) improved the robustness of neural networks by replacing the output layers with novel interpolating functions ; In Xie et al . ( 2019 ) , the authors designed a feature denoising filter that can remove the perturbation ’ s pattern from feature maps . In this work , we explore the intrinsic robustness of a specific novel architecture ( neural ODE ) , and show that the proposed TisODE can improve the robustness of deep networks and can also work in tandem with these state-of-the-art methods Xie et al . ( 2017 ; 2019 ) to achieve further improvements . 6 CONCLUSION In this paper , we first empirically study the robustness of neural ODEs . Our studies reveal that neural ODE-based models are superior in terms of robustness compared to CNN models . We then explore how to further boost the robustness of vanilla neural ODEs and propose the TisODE . Finally , we show that the proposed TisODE outperforms the vanilla neural ODE and also can work in conjunction with other state-of-the-art techniques to further improve the robustness of deep networks . Thus , the TisODE method is an effective drop-in module for building robust deep models . ACKNOWLEDGEMENT This work is funded by a Singapore National Research Foundation ( NRF ) Fellowship ( R-263-000D02-281 ) . Jiashi Feng was partially supported by NUS IDS R-263-000-C67-646 , ECRA R-263-000-C87-133 , MOE Tier-II R-263-000-D17-112 and AI.SG R-263-000-D97-490 REFERENCES Lynton Ardizzone , Jakob Kruse , Sebastian Wirkert , Daniel Rahner , Eric W Pellegrini , Ralf S Klessen , Lena Maier-Hein , Carsten Rother , and Ullrich Köthe . Analyzing inverse problems with invertible neural networks . arXiv preprint arXiv:1808.04730 , 2018 . Nicholas Carlini and David Wagner . Towards evaluating the robustness of neural networks . In 2017 IEEE Symposium on Security and Privacy ( SP ) , pp . 39–57 . IEEE , 2017 . Pin-Yu Chen , Huan Zhang , Yash Sharma , Jinfeng Yi , and Cho-Jui Hsieh . Zoo : Zeroth order optimization based black-box attacks to deep neural networks without training substitute models . In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , pp . 15–26 . ACM , 2017 . Tian Qi Chen , Yulia Rubanova , Jesse Bettencourt , and David K Duvenaud . Neural ordinary differential equations . In Advances in neural information processing systems , pp . 6571–6583 , 2018 . Earl A Coddington and Norman Levinson . Theory of ordinary differential equations . Tata McGrawHill Education , 1955 . Jia Deng , Wei Dong , Richard Socher , Li-Jia Li , Kai Li , and Li Fei-Fei . Imagenet : A large-scale hierarchical image database . In 2009 IEEE conference on computer vision and pattern recognition , pp . 248–255 . Ieee , 2009 . Emilien Dupont , Arnaud Doucet , and Yee Whye Teh . Augmented neural odes . arXiv preprint arXiv:1904.01681 , 2019 . Gamaleldin F Elsayed , Shreya Shankar , Brian Cheung , Nicolas Papernot , Alex Kurakin , Ian Goodfellow , and Jascha Sohl-Dickstein . Adversarial examples that fool both human and computer vision . arXiv preprint arXiv:1802.08195 , 10 , 2018 . Ian J Goodfellow , Jonathon Shlens , and Christian Szegedy . Explaining and harnessing adversarial examples . arXiv preprint arXiv:1412.6572 , 2014 . Will Grathwohl , Ricky TQ Chen , Jesse Betterncourt , Ilya Sutskever , and David Duvenaud . Ffjord : Free-form continuous dynamics for scalable reversible generative models . arXiv preprint arXiv:1810.01367 , 2018 . Kaiming He , Xiangyu Zhang , Shaoqing Ren , and Jian Sun . Deep residual learning for image recognition . In Proceedings of the IEEE conference on computer vision and pattern recognition , pp . 770–778 , 2016 . Ralph Howard . The gronwall inequality . lecture notes , 1998 . Gustav Larsson , Michael Maire , and Gregory Shakhnarovich . Fractalnet : Ultra-deep neural networks without residuals . arXiv preprint arXiv:1605.07648 , 2016 . Yann LeCun , Léon Bottou , Yoshua Bengio , Patrick Haffner , et al . Gradient-based learning applied to document recognition . Proceedings of the IEEE , 86 ( 11 ) :2278–2324 , 1998 . Xuanqing Liu , Si Si , Qin Cao , Sanjiv Kumar , and Cho-Jui Hsieh . Neural sde : Stabilizing neural ode networks with stochastic noise . arXiv preprint arXiv:1906.02355 , 2019 . Yiping Lu , Aoxiao Zhong , Quanzheng Li , and Bin Dong . Beyond finite layer neural networks : Bridging deep architectures and numerical differential equations . arXiv preprint arXiv:1710.10121 , 2017 . Aleksander Madry , Aleksandar Makelov , Ludwig Schmidt , Dimitris Tsipras , and Adrian Vladu . Towards deep learning models resistant to adversarial attacks . arXiv preprint arXiv:1706.06083 , 2017 . Yuval Netzer , Tao Wang , Adam Coates , Alessandro Bissacco , Bo Wu , and Andrew Y Ng . Reading digits in natural images with unsupervised feature learning . 2011 . Adam Paszke , Sam Gross , Soumith Chintala , Gregory Chanan , Edward Yang , Zachary DeVito , Zeming Lin , Alban Desmaison , Luca Antiga , and Adam Lerer . Automatic differentiation in pytorch . 2017 . Lev Semenovich Pontryagin . Mathematical theory of optimal processes . Routledge , 2018 . Alessio Quaglino , Marco Gallieri , Jonathan Masci , and Jan Koutnı́k . Accelerating neural odes with spectral elements . arXiv preprint arXiv:1906.07038 , 2019 . Jure Sokolić , Raja Giryes , Guillermo Sapiro , and Miguel RD Rodrigues . Robust large margin deep neural networks . IEEE Transactions on Signal Processing , 65 ( 16 ) :4265–4280 , 2017 . Christian Szegedy , Wojciech Zaremba , Ilya Sutskever , Joan Bruna , Dumitru Erhan , Ian Goodfellow , and Rob Fergus . Intriguing properties of neural networks . arXiv preprint arXiv:1312.6199 , 2013 . Florian Tramèr , Alexey Kurakin , Nicolas Papernot , Ian Goodfellow , Dan Boneh , and Patrick McDaniel . Ensemble adversarial training : Attacks and defenses . arXiv preprint arXiv:1705.07204 , 2017 . Dimitris Tsipras , Shibani Santurkar , Logan Engstrom , Alexander Turner , and Aleksander Madry . Robustness may be at odds with accuracy . arXiv preprint arXiv:1805.12152 , 2018 . B. Wang , B. Yuan , Z. Shi , and S. Osher . ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies . arXiv e-prints , art . arXiv:1811.10745 , Nov 2018a . Bao Wang , Alex T Lin , Zuoqiang Shi , Wei Zhu , Penghang Yin , Andrea L Bertozzi , and Stanley J Osher . Adversarial defense via data dependent activation function and total variation minimization . arXiv preprint arXiv:1809.08516 , 2018b . Bao Wang , Xiyang Luo , Zhen Li , Wei Zhu , Zuoqiang Shi , and Stanley Osher . Deep neural nets with interpolating function as output activation . In Advances in Neural Information Processing Systems , pp . 743–753 , 2018c . E Weinan . A proposal on machine learning via dynamical systems . Communications in Mathematics and Statistics , 5 ( 1 ) :1–11 , 2017 . Cihang Xie , Jianyu Wang , Zhishuai Zhang , Zhou Ren , and Alan Yuille . Mitigating adversarial effects through randomization . arXiv preprint arXiv:1711.01991 , 2017 . Cihang Xie , Yuxin Wu , Laurens van der Maaten , Alan L Yuille , and Kaiming He . Feature denoising for improving adversarial robustness . In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pp . 501–509 , 2019 . Ziang Yan , Yiwen Guo , and Changshui Zhang . Deep defense : Training dnns with improved adversarial robustness . In Advances in Neural Information Processing Systems , pp . 419–428 , 2018 . Laurent Younes . Shapes and diffeomorphisms , volume 171 . Springer , 2010 . Xingcheng Zhang , Zhizhong Li , Chen Change Loy , and Dahua Lin . Polynet : A pursuit of structural diversity in very deep networks . In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pp . 718–726 , 2017 . 7 APPENDIX 7.1 NETWORKS USED ON THE MNIST , THE SVHN , AND THE IMGNET10 DATASETS In Table 5 , the four arguments of the Conv layer represent the input channel , output channel , kernel size , and the stride . The two arguments of the Linear layer represents the input dimension and the output dimension of this fully-connected layer . In the network on the ImgNet10 , the BasicBlock refers to the standard architecture in ( He et al. , 2016 ) , the three arguments of the BasicBlock represent the input channel , output channel and the stride of the Conv layers inside the block . Note that we replace the BatchNorm layers in BasicBlocks as the GroupNorm to guarantee that the dynamics of each datum is independent of other data in the same mini-batch . 7.2 THE CONSTRUCTION OF IMGNET10 DATASET 7.3 GRONWALL ’ S INEQUALITY We formally state the Gronwall ’ s Inequality here , following the version in ( Howard , 1998 ) . Theorem 2 . Let U ⊂ Rd be an open set . Let f : U × [ 0 , T ] → Rd be a continuous function and let z1 , z2 : [ 0 , T ] → U satisfy the initial value problems : dz1 ( t ) dt = f ( z1 ( t ) , t ) , z1 ( t ) = x1 dz2 ( t ) dt = f ( z2 ( t ) , t ) , z2 ( t ) = x2 Assume there is a constant C ≥ 0 such that , for all t ∈ [ 0 , T ] , ‖f ( z2 ( t ) , t ) − f ( z1 ( t ) , t ) ) ‖ ≤ C‖z2 ( t ) − z1 ( t ) ‖ Then , for any t ∈ [ 0 , T ] , ‖z1 ( t ) − z2 ( t ) ‖ ≤ ‖x2 − x1‖ · eCt . 7.4 MORE EXPERIMENTAL RESULTS 7.4.1 COMPARISON IN THE SETTING OF ADVERSARIAL TRAINING We implement the adversarial training of the models on the MNIST dataset , and the adversarial examples for training are generated in real-time via the FGSM method ( epsilon=0.3 ) during each epoch ( Madry et al. , 2017 ) . The results of the adversarially trained models are shown in Table 7 . We can observe that the neural ODE-based models are consistently more robust than CNN models . The proposed TisODE also outperforms the vanilla neural ODE . 7.4.2 EXPERIMENTS ON THE CIFAR10 DATASET We conduct experiments on CIFAR10 to compare the robustness of CNN and neural ODE-based models . We train all the models only with original non-perturbed images and evaluate the robustness of models against random Gaussian noise and FGSM adversarial attacks . The results are shown in Table 8 . We can observe that the ONENet is more robust than the CNN model in terms of both the random noise and the FGSM attack . Besides , our proposal , TisODE , can improve the robustness of the vanilla neural ODE . Here , we control the number of parameters to be the same for all kinds of models . We use a small network , which consists of five convolutional layers and one linear layer . 7.4.3 AN EXTENSION ON THE COMPARISON BETWEEN CNNS AND ODENETS Here , we compare CNN and neural ODE-based models by controlling both the number of parameters and the number of function evaluations . We conduct experiments on the MNIST dataset , and all the models are trained only with original non-perturbed images . For the neural ODE-based models , the time range is set from 0 to 1 . We use the Euler method , and the step size is set to be 0.05 . Thus the number of evaluations is 1/0.05 = 20 . For the CNN models ( specifically ResNet ) , we repeatedly concatenate the residual block for 20 times , and these 20 blocks share the same weights . Our experiments show that , in this condition , the neural ODE-based models still outperform the CNN models ( FGSM-0.15 : 87.5 % vs. 81.9 % , FGSM-0.3 : 53.4 % vs. 49.7 % , PGD-0.2 : 11.8 % vs. 4.8 % ) .

Summary: The paper is concerned with neural ODE-based networks, specifically their robustness. While ODEs are a classical subject in mathematics with many applications in the sciences and beyond, neural ODEs are a recently proposed family of models for nonlinear mappings in the context of machine learning systems. There they show promise and are an active field of research.