A Winning Hand: Compressing Deep Networks Can Improve Out-of-Distribution Robustness

1 Introduction . Deep Neural Networks ( DNNs ) have achieved unprecedented success in a wide range of applications due to their remarkably high accuracy [ 15 ] . However , this high performance stems from significant growth in DNN model size ; i.e. , massive overparameterization . Furthermore , these highly overparameterized models are known to be susceptible to the out-of-distribution ( OOD ) shifts encountered during their deployment in the wild [ 5 ] . This resource-inefficiency and OOD brittleness of state-of-the-art ( SOTA ) DNNs severely limits the potential applications DL can make an impact on . For example , consider the “ Mars rover mission ” that uses laser-induced breakdown spectroscopy ( LIBS ) to search for microbial life . It is well accepted that endowing the rover with DNNs to analyze complex LIBS spectra could produce scientific breakthroughs [ 3 ] . However , employing DNNs in such circumstances is challenging : 1 ) as these devices are battery operated , the model has to be lightweight so it consumes less memory with reduced power consumption , and 2 ) the model must be able to efficiently handle domain shifts in spectra caused by environmental noise . These requirements are not specific only to the aforementioned use case but arise in any resource-limited application using DL in the wild . The fact that SOTA DNNs do not satisfy compactness and OOD robustness requirements is holding us back from leveraging advances in DL to make scientific discoveries . ∗equal contribution 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . This work is driven by two questions around this crucial problem . Q1 . Can we show the existence of compact , accurate , and robust DNNs ( CARDs ) ? Q2 . If yes , can we apply existing robustness improvement techniques to CARDs to further amplify performance while maintaining compactness ? Notably , there have been some recent successes in addressing each of the challenges CARDs present in isolation . The authors in [ 24 , 27 ] developed data augmentation methods for achieving high OOD robustness without sacrificing accuracy on the clean data . The authors in [ 12 , 9 ] developed pruning and quantization approaches for achieving high accuracy at extreme levels of model compression . However , efforts towards achieving model compactness , high accuracy , and OOD robustness simultaneously have mostly been unsuccessful . For example , [ 26 ] and [ 32 ] recently showed that compressed DNNs achieve accuracies similar to the original networks ’ but are far more brittle when faced with OOD data . Perhaps unsurprisingly , the current solution in the robust DL community to improve the OOD robustness ( and accuracy ) is to increase the model size ( e.g. , [ 25 , 16 , 8 ] ) . In this paper , we demonstrate that these negative results are a byproduct of inapt compression strategies , and the inability to create CARDs is not fundamental ( answering Q1 in the affirmative ) . Specifically , we perform a large-scale comparison by varying architectures , training methods , and pruning rates for a range of compression techniques . We find that in contrast to traditional pruning methods ( e.g. , fine tuning [ 18 ] and gradual magnitude pruning [ 60 ] ) , “ lottery ticket-style ” compression approaches [ 12 , 43 , 41 , 9 ] can surprisingly be used to create CARDs . In other words , we are able to create extremely compact ( i.e. , sparse and , optionally , binary ) CARDs that are significantly more robust compared to their larger and full-precision counterparts while having comparable test accuracy . Our results are in sharp contrast to the existing observation that compression is harmful to OOD robustness . In fact , we show that compression is capable of providing improved robustness . We subsequently explore the possibility of using existing robustness-improvement techniques in conjunction with compression strategies to further improve the performance of CARDs . Empirically , we show the compatibility of CARDs with popular existing strategies , such as data augmentation and model size increase . We also propose a new robustness-improvement strategy that leverages the compactness of CARDs via ensembling—this ensembling approach is referred to as a domainadaptive CARD-Deck and uses a gating module to dynamically choose appropriate CARDs for each test sample such that the spectral-similarity of the chosen CARDs and test data is maximized . This proposed adaptive ensembling approach builds a “ winning hand '' of CARDs that establishes a new state-of-the-art robustness ( and accuracy ) on the popular OOD benchmark datasets CIFAR-10-C and CIFAR-100-C with a compact ensemble [ 8 ] ( answering Q2 in the affirmative ) . Broad implications of our findings are as follows . First , there exist sparse networks early in training ( sometimes at initialization ) that can be trained to become CARDs ( i.e. , we extend the lottery ticket hypothesis [ 12 ] to robust neural networks via our CARD hypothesis ) . Second , within a random-weight neural network , there exist CARDs which ( despite having untrained weights ) perform comparably to more computationally expensive DNNs ( i.e. , we extend the strong lottery ticket hypothesis [ 41 ] to robust neural networks via our CARD hypothesis ) . Third , compression can be complementary with existing robustness-improving strategies , which suggests that appropriate compression approaches should be considered whenever training models that may be deployed in the wild . To summarize our main contributions : • Contrary to most prior results in the literature , we show that compression can improve robustness , providing evidence via extensive experiments on benchmark datasets , supporting our CARD hypothesis . Our experiments suggest “ lottery ticket-style ” pruning methods and a sufficiently overparameterized model are key factors for producing CARDs ( Section 2.2 ) . • As corruptions in benchmark datasets could be limited ( or biased ) to certain frequency ranges , we tested the ability of compression to improve robustness to Fourier basis perturbations . This analysis corroborates findings on CIFAR-10/100-C and further highlights that models compressed via different methods have different robustness levels ( Section 2.3 ) . • Leveraging the compactness of CARDs , we develop a test-time adaptive ensembling method , called a domain-adaptive CARD-Deck , that utilizes CARDs trained with existing techniques for improving OOD robustness . Resulting models set a new SOTA performance [ 8 ] on CIFAR-10-C and CIFAR-100-C while maintaining compactness ( Section 3 ) . • Finally , we provide theoretical support for the CARD hypothesis and the robustness of the domain-adaptive CARD-Deck ensembling method ( Section 4 ) . 2 Is the inability to create CARDs fundamental ? . Recent studies of the effects of model compression on OOD robustness have been mostly negative . For instance , Hooker et al . [ 26 ] showed that gradual magnitude pruning [ 60 ] of a ResNet-50 [ 19 ] trained on ImageNet [ 44 ] caused accuracy to decrease by as much as 40 % on corrupted images from ImageNet-C [ 23 ] , while performance on the non-corrupted validation images remained strong . Liebenwein et al . [ 32 ] reported similar findings for different pruning approaches [ 43 , 2 ] applied to a ResNet-20 model [ 19 ] tested on an analogously corrupted dataset , CIFAR-10-C . Consistent with these findings , Hendrycks et al . [ 25 ] found that increasing model size tended to improve robustness.2 Critically , these studies suggest that model compression may be at odds with the simultaneous achievement of high accuracy and OOD ( natural corruption ) robustness . However , it ’ s possible that these negative results are a byproduct of inapt compression strategies and/or insufficient overparameterization of the network targeted for compression . As such , to motivate the scientific question of interest and our empirical/theoretical analyses , we propose the following alternative hypothesis . CARD Hypothesis . Given a sufficiently overparameterized neural network , a suitable model compression ( i.e. , pruning and binarization ) scheme can yield a compact network with comparable ( or higher ) accuracy and robustness than the same network when it is trained without compression . 2.1 Model compression approaches . For a comprehensive analysis of existing pruning methods , we introduce a framework inspired by those in [ 43 , 51 ] that covers traditional-through-emerging pruning methodologies . Broadly , this framework places a pruning method into one of three categories : ( a ) traditional , ( b ) rewindingbased lottery ticket , and ( c ) initialization-based ( strong ) lottery ticket . Specific pruning methods considered in these respective categories are : ( a ) fine-tuning and gradual magnitude pruning , ( b ) weight rewinding and learning rate rewinding , and ( c ) edgepopup and biprop . Precise definitions of these pruning methods and discussion of differences are available in Appendix A.1 . Briefly , fine-tuning ( FT ) [ 18 ] prunes models once at the end of normal training , then fine-tunes the models for a given number of epochs to recover accuracy lost due to pruning ; while gradual magnitude pruning ( GMP ) [ 60 ] prunes models throughout training . Weight rewinding ( LTH ) [ 12 , 13 ] is iterative like GMP but fully trains the network , prunes , rewinds the unpruned weights ( and learning rate schedule ) to their values early in training , then fully trains the subnetwork before pruning again ; learning rate rewinding ( LRR ) [ 43 ] is identical to LTH , except only the learning rate schedule is rewound , not the unpruned weights . Finally , edgepopup ( EP ) [ 41 ] does not weight-train the network but instead prunes a randomly initialized network , using training data to find weights whose removal improves accuracy ( notably , EP can , and does here , operate on signed initialization ) ; biprop ( BP ) [ 9 ] proceeds similarly but incorporates a binarization scheme resulting in a binary-weight network regardless of the initialization used . For all of these methods , we make use of global unstructured pruning , which allows for different pruning percentages at each layer of the network . For BP and EP , we additionally consider layerwise pruning , which prunes the same percentage across all layers . We use the hyperparameters specifically tuned for each approach ; see Appendix B for additional details . 2.2 Accuracy-robustness comparison of global pruning methods . To test the CARD hypothesis , we use : five models ( VGG [ 12 , 46 ] and ResNet [ 19 ] style architectures of varying size ) , five sparsity levels ( 50 % , 60 % , 80 % , 90 % , 95 % ) , and six model compression methods ( FT , GMP , LTH , LRR , EP , BP ) . For each model , sparsity level , and compression method , five realizations are trained on the CIFAR-10 training set [ 28 ] . Model accuracy and robustness are measured using top-1 accuracy on the CIFAR-10 and CIFAR-10-C test sets , respectively . CIFAR-10C contains 15 different common corruptions from four categories : noise , blur , weather , and digital corruptions [ 23 ] . As a baseline , we train 5 realizations of each model without compression . In Figure 1 , we plot our experimental results . Accuracy and robustness values are averaged over the five realizations and plotted relative to the average non-compressed baseline performance . The y-axis measures relative difference in percentage points . The mean baseline accuracy and robustness for each architecture is listed as the reference accuracy in each plot . The first row of plots indicate 2For additional discussion of this and more related work , please see Appendix A. accuracy ( top-1 accuracy on CIFAR-10 relative to baseline ) while the second row indicate robustness ( top-1 accuracy on CIFAR-10-C relative to baseline ) . At each sparsity level , error bars extend to the minimum and maximum relative percentage point difference across all realizations . Our results for traditional methods , i.e. , Fine-Tuning and Gradual Magnitude Pruning , are consistent with previous works [ 26 , 32 ] as the robustness of models pruned using these methods degrades relative to the dense models ’ , particularly in higher pruning regimes . However , we find that rewinding and initialization based pruning approaches consistently produce notable gains in robustness relative to dense baselines while matching ( and sometimes surpassing ) the accuracy of the dense baseline . In particular , the rewinding class of methods provide a consistent , moderate improvement to both accuracy and robustness while the initialization class provides more substantial gains in robustness even when the accuracy is slightly below the baseline accuracy . The significance of overparameterization to finding highly compact CARDs using initialization methods is evident for all architecture types , as the robustness of these models in higher pruning regimes improves at increasing levels of parameterization for a given architecture class . However , even in models with fewer parameters , we find that initialization methods are able to provide notable robustness gains . Additional experiments involving initialization methods are provided in Appendix C. Specifically , a comparison of the performance EP and BP using layerwise and global pruning is performed in Section C.1 and a comparison of full-precision and binary-weight EP models in Section C.2 . Empirical results in Section C.2 indicate that robustness gains provided by EP- and BP-pruned models may be a feature of initialization pruning methods and not solely due to weight-binarization .

Summary: This paper explores the possibility and practibility to build compact, accurate, and robust deep neural networks (CARDs). The authors first conduct extensive empirical studies to verify the existence of CARDs. Meanwhile, to better understand CARDs, authors further analyze the Fourier sensitivity in the spectral domain. Based on the empirical observations, a domain-adaptive ensembling approach (CARDs-Deck) is proposed as a practical algorithm to utilize the CARDs models, which is able to achieve new SOTA results for robustness and accuracy on CIFAR-10. The paper is quite informative and solid throughout the text, and the claims are well supported by empirical observations. There are also theoretical analysis that justifies CARDs in depth.