A Winning Hand: Compressing Deep Networks Can Improve Out-of-Distribution Robustness

1 Introduction . Deep Neural Networks ( DNNs ) have achieved unprecedented success in a wide range of applications due to their remarkably high accuracy [ 15 ] . However , this high performance stems from significant growth in DNN model size ; i.e. , massive overparameterization . Furthermore , these highly overparameterized models are known to be susceptible to the out-of-distribution ( OOD ) shifts encountered during their deployment in the wild [ 5 ] . This resource-inefficiency and OOD brittleness of state-of-the-art ( SOTA ) DNNs severely limits the potential applications DL can make an impact on . For example , consider the “ Mars rover mission ” that uses laser-induced breakdown spectroscopy ( LIBS ) to search for microbial life . It is well accepted that endowing the rover with DNNs to analyze complex LIBS spectra could produce scientific breakthroughs [ 3 ] . However , employing DNNs in such circumstances is challenging : 1 ) as these devices are battery operated , the model has to be lightweight so it consumes less memory with reduced power consumption , and 2 ) the model must be able to efficiently handle domain shifts in spectra caused by environmental noise . These requirements are not specific only to the aforementioned use case but arise in any resource-limited application using DL in the wild . The fact that SOTA DNNs do not satisfy compactness and OOD robustness requirements is holding us back from leveraging advances in DL to make scientific discoveries . ∗equal contribution 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . This work is driven by two questions around this crucial problem . Q1 . Can we show the existence of compact , accurate , and robust DNNs ( CARDs ) ? Q2 . If yes , can we apply existing robustness improvement techniques to CARDs to further amplify performance while maintaining compactness ? Notably , there have been some recent successes in addressing each of the challenges CARDs present in isolation . The authors in [ 24 , 27 ] developed data augmentation methods for achieving high OOD robustness without sacrificing accuracy on the clean data . The authors in [ 12 , 9 ] developed pruning and quantization approaches for achieving high accuracy at extreme levels of model compression . However , efforts towards achieving model compactness , high accuracy , and OOD robustness simultaneously have mostly been unsuccessful . For example , [ 26 ] and [ 32 ] recently showed that compressed DNNs achieve accuracies similar to the original networks ’ but are far more brittle when faced with OOD data . Perhaps unsurprisingly , the current solution in the robust DL community to improve the OOD robustness ( and accuracy ) is to increase the model size ( e.g. , [ 25 , 16 , 8 ] ) . In this paper , we demonstrate that these negative results are a byproduct of inapt compression strategies , and the inability to create CARDs is not fundamental ( answering Q1 in the affirmative ) . Specifically , we perform a large-scale comparison by varying architectures , training methods , and pruning rates for a range of compression techniques . We find that in contrast to traditional pruning methods ( e.g. , fine tuning [ 18 ] and gradual magnitude pruning [ 60 ] ) , “ lottery ticket-style ” compression approaches [ 12 , 43 , 41 , 9 ] can surprisingly be used to create CARDs . In other words , we are able to create extremely compact ( i.e. , sparse and , optionally , binary ) CARDs that are significantly more robust compared to their larger and full-precision counterparts while having comparable test accuracy . Our results are in sharp contrast to the existing observation that compression is harmful to OOD robustness . In fact , we show that compression is capable of providing improved robustness . We subsequently explore the possibility of using existing robustness-improvement techniques in conjunction with compression strategies to further improve the performance of CARDs . Empirically , we show the compatibility of CARDs with popular existing strategies , such as data augmentation and model size increase . We also propose a new robustness-improvement strategy that leverages the compactness of CARDs via ensembling—this ensembling approach is referred to as a domainadaptive CARD-Deck and uses a gating module to dynamically choose appropriate CARDs for each test sample such that the spectral-similarity of the chosen CARDs and test data is maximized . This proposed adaptive ensembling approach builds a “ winning hand '' of CARDs that establishes a new state-of-the-art robustness ( and accuracy ) on the popular OOD benchmark datasets CIFAR-10-C and CIFAR-100-C with a compact ensemble [ 8 ] ( answering Q2 in the affirmative ) . Broad implications of our findings are as follows . First , there exist sparse networks early in training ( sometimes at initialization ) that can be trained to become CARDs ( i.e. , we extend the lottery ticket hypothesis [ 12 ] to robust neural networks via our CARD hypothesis ) . Second , within a random-weight neural network , there exist CARDs which ( despite having untrained weights ) perform comparably to more computationally expensive DNNs ( i.e. , we extend the strong lottery ticket hypothesis [ 41 ] to robust neural networks via our CARD hypothesis ) . Third , compression can be complementary with existing robustness-improving strategies , which suggests that appropriate compression approaches should be considered whenever training models that may be deployed in the wild . To summarize our main contributions : • Contrary to most prior results in the literature , we show that compression can improve robustness , providing evidence via extensive experiments on benchmark datasets , supporting our CARD hypothesis . Our experiments suggest “ lottery ticket-style ” pruning methods and a sufficiently overparameterized model are key factors for producing CARDs ( Section 2.2 ) . • As corruptions in benchmark datasets could be limited ( or biased ) to certain frequency ranges , we tested the ability of compression to improve robustness to Fourier basis perturbations . This analysis corroborates findings on CIFAR-10/100-C and further highlights that models compressed via different methods have different robustness levels ( Section 2.3 ) . • Leveraging the compactness of CARDs , we develop a test-time adaptive ensembling method , called a domain-adaptive CARD-Deck , that utilizes CARDs trained with existing techniques for improving OOD robustness . Resulting models set a new SOTA performance [ 8 ] on CIFAR-10-C and CIFAR-100-C while maintaining compactness ( Section 3 ) . • Finally , we provide theoretical support for the CARD hypothesis and the robustness of the domain-adaptive CARD-Deck ensembling method ( Section 4 ) . 2 Is the inability to create CARDs fundamental ? . Recent studies of the effects of model compression on OOD robustness have been mostly negative . For instance , Hooker et al . [ 26 ] showed that gradual magnitude pruning [ 60 ] of a ResNet-50 [ 19 ] trained on ImageNet [ 44 ] caused accuracy to decrease by as much as 40 % on corrupted images from ImageNet-C [ 23 ] , while performance on the non-corrupted validation images remained strong . Liebenwein et al . [ 32 ] reported similar findings for different pruning approaches [ 43 , 2 ] applied to a ResNet-20 model [ 19 ] tested on an analogously corrupted dataset , CIFAR-10-C . Consistent with these findings , Hendrycks et al . [ 25 ] found that increasing model size tended to improve robustness.2 Critically , these studies suggest that model compression may be at odds with the simultaneous achievement of high accuracy and OOD ( natural corruption ) robustness . However , it ’ s possible that these negative results are a byproduct of inapt compression strategies and/or insufficient overparameterization of the network targeted for compression . As such , to motivate the scientific question of interest and our empirical/theoretical analyses , we propose the following alternative hypothesis . CARD Hypothesis . Given a sufficiently overparameterized neural network , a suitable model compression ( i.e. , pruning and binarization ) scheme can yield a compact network with comparable ( or higher ) accuracy and robustness than the same network when it is trained without compression . 2.1 Model compression approaches . For a comprehensive analysis of existing pruning methods , we introduce a framework inspired by those in [ 43 , 51 ] that covers traditional-through-emerging pruning methodologies . Broadly , this framework places a pruning method into one of three categories : ( a ) traditional , ( b ) rewindingbased lottery ticket , and ( c ) initialization-based ( strong ) lottery ticket . Specific pruning methods considered in these respective categories are : ( a ) fine-tuning and gradual magnitude pruning , ( b ) weight rewinding and learning rate rewinding , and ( c ) edgepopup and biprop . Precise definitions of these pruning methods and discussion of differences are available in Appendix A.1 . Briefly , fine-tuning ( FT ) [ 18 ] prunes models once at the end of normal training , then fine-tunes the models for a given number of epochs to recover accuracy lost due to pruning ; while gradual magnitude pruning ( GMP ) [ 60 ] prunes models throughout training . Weight rewinding ( LTH ) [ 12 , 13 ] is iterative like GMP but fully trains the network , prunes , rewinds the unpruned weights ( and learning rate schedule ) to their values early in training , then fully trains the subnetwork before pruning again ; learning rate rewinding ( LRR ) [ 43 ] is identical to LTH , except only the learning rate schedule is rewound , not the unpruned weights . Finally , edgepopup ( EP ) [ 41 ] does not weight-train the network but instead prunes a randomly initialized network , using training data to find weights whose removal improves accuracy ( notably , EP can , and does here , operate on signed initialization ) ; biprop ( BP ) [ 9 ] proceeds similarly but incorporates a binarization scheme resulting in a binary-weight network regardless of the initialization used . For all of these methods , we make use of global unstructured pruning , which allows for different pruning percentages at each layer of the network . For BP and EP , we additionally consider layerwise pruning , which prunes the same percentage across all layers . We use the hyperparameters specifically tuned for each approach ; see Appendix B for additional details . 2.2 Accuracy-robustness comparison of global pruning methods . To test the CARD hypothesis , we use : five models ( VGG [ 12 , 46 ] and ResNet [ 19 ] style architectures of varying size ) , five sparsity levels ( 50 % , 60 % , 80 % , 90 % , 95 % ) , and six model compression methods ( FT , GMP , LTH , LRR , EP , BP ) . For each model , sparsity level , and compression method , five realizations are trained on the CIFAR-10 training set [ 28 ] . Model accuracy and robustness are measured using top-1 accuracy on the CIFAR-10 and CIFAR-10-C test sets , respectively . CIFAR-10C contains 15 different common corruptions from four categories : noise , blur , weather , and digital corruptions [ 23 ] . As a baseline , we train 5 realizations of each model without compression . In Figure 1 , we plot our experimental results . Accuracy and robustness values are averaged over the five realizations and plotted relative to the average non-compressed baseline performance . The y-axis measures relative difference in percentage points . The mean baseline accuracy and robustness for each architecture is listed as the reference accuracy in each plot . The first row of plots indicate 2For additional discussion of this and more related work , please see Appendix A. accuracy ( top-1 accuracy on CIFAR-10 relative to baseline ) while the second row indicate robustness ( top-1 accuracy on CIFAR-10-C relative to baseline ) . At each sparsity level , error bars extend to the minimum and maximum relative percentage point difference across all realizations . Our results for traditional methods , i.e. , Fine-Tuning and Gradual Magnitude Pruning , are consistent with previous works [ 26 , 32 ] as the robustness of models pruned using these methods degrades relative to the dense models ’ , particularly in higher pruning regimes . However , we find that rewinding and initialization based pruning approaches consistently produce notable gains in robustness relative to dense baselines while matching ( and sometimes surpassing ) the accuracy of the dense baseline . In particular , the rewinding class of methods provide a consistent , moderate improvement to both accuracy and robustness while the initialization class provides more substantial gains in robustness even when the accuracy is slightly below the baseline accuracy . The significance of overparameterization to finding highly compact CARDs using initialization methods is evident for all architecture types , as the robustness of these models in higher pruning regimes improves at increasing levels of parameterization for a given architecture class . However , even in models with fewer parameters , we find that initialization methods are able to provide notable robustness gains . Additional experiments involving initialization methods are provided in Appendix C. Specifically , a comparison of the performance EP and BP using layerwise and global pruning is performed in Section C.1 and a comparison of full-precision and binary-weight EP models in Section C.2 . Empirical results in Section C.2 indicate that robustness gains provided by EP- and BP-pruned models may be a feature of initialization pruning methods and not solely due to weight-binarization .

Summary: This paper studies on whether pruning is able to improve the model robustness. This paper first show that with a proper pruning algorithm, the robustness can be achieved. Then a spectrum analysis is proposed to visualize what kind of heat map is suitable for robustness. Thirdly, a test-time augmentation approached is proposed to further improve the robustness.