Ensemble-in-One: Learning Ensemble within Random Gated Networks for Enhanced Adversarial Robustness

1 INTRODUCTION . With the convolutional neural networks ( CNNs ) becoming ubiquitous , the security and robustness of neural networks is attracting increasing interests . Recent studies find that CNN models are inherently vulnerable to adversarial attacks ( Goodfellow et al. , 2014 ) , which craft imperceptible perturbations on the images , referred to as adversarial examples , to mislead the neural network models . Even without accessing the target model , an adversary can still generate adversarial examples from other surrogate models to attack the target model by exploiting the adversarial transferability among them . Such vulnerability of CNN models has spurred extensive researches on improving the robustness against adversarial attacks . One stream of approaches targets on learning robust features for an individual model ( Madry et al. , 2017 ; Brendel et al. , 2020 ) . Informally , robust features are defined as the features that are less sensitive to the adversarial perturbations added on the inputs . A representative approach , referred to as adversarial training ( Madry et al. , 2017 ) , on-line generates adversarial examples on which the model minimizes the training loss . As a result , adversarial training encourages the model to learn the features that are less sensitive to the adversarial input perturbations , thereby alleviating the model ’ s vulnerability . However , such adversarial training methods often have to sacrifice the clean accuracy for enhanced robustness ( Zhang et al. , 2019 ) , since they exclude the non-robust features and become less distinguishable for the examples with high similarity in the feature space . Besides empowering improved robustness for an individual model , another stream of researches focuses on forming strong ensembles to improve the robustness ( Yang et al. , 2020 ; Bagnall et al. , 2017 ; Pang et al. , 2019 ; Kariyappa & Qureshi , 2019 ) . Generally speaking , an ensemble is constructed by aggregating multiple sub-models . Intuitively , an ensemble is promising to facilitate better robustness than an individual model because a successful attack needs to mislead the majority of the sub-models rather than just one . While the robustness of an ensemble highly relies on the diversity of the sub-models , recent study finds that CNN models trained independently on the same dataset are with highly-overlapped adversarial subspaces ( Tramèr et al. , 2017 ) . Therefore , many studies propose ensemble training methods to diversify the sub-models . For example , DVERGE ( Yang et al. , 2020 ) proposes to distill non-robust features corresponding to each sub-model ’ s vulnerability , then isolates the vulnerabilities of the sub-models by mutual learning such that impeding the adversarial transferability among them . There is another learned insight that the ensembles composed by more sub-models tend to capture greater robustness improvement . Table 1 shows the robustness trend of the ensembles trained with various ensemble training methods . Robustness improvement can be obtained by including more sub-models within the ensemble . This drives us to further explore whether the trend will continue when keeping enlarging the ensemble . However , existing ensemble construction methods are with poor scalability because of the rapidly increasing overhead , especially with mutual learning which trains the sub-models in a round-robin manner , the complexity will rise at a speed of O ( n2 ) . We propose Ensemble-in-One , a novel approach that can improve the scalability of ensemble training and introduce randomness mechanism for enhanced generalization , simultaneously obtaining better robustness and higher efficiency . For a dedicated CNN model , we conduct a Random Gated Network ( RGN ) by substituting each parameterized layer with a Random Gated Block ( RGB ) on top of the neural architecture . Through this , the network can instantiate numerous sub-models by controlling the gates in each block . Ensemble-in-One substantially reduces the complexity when scaling up the ensemble . In summary , the contributions of this work are listed as below : • Ensemble-in-One is a simple but effective method that learns adversarially robust ensembles within one over-parametrized random gated network . The EIO construction enables us to employ ensemble learning techniques to learn more robust individual models with minimal computational overheads and no extra inference overhead . • Extensive experiments demonstrate the effectiveness of Ensemble-in-One . It outperforms the previous ensemble training methods with even less computational overhead . Moreover , EIO also achieves better accuracy-robustness trade-offs than adversarial training method . 2 RELATED WORK . 2.1 ADVERSARIAL ATTACKS AND COUNTERMEASURES .. The inherent vulnerability of CNN models poses challenges on the security of deep learning systems . An adversary can apply an additive perturbation on an original input to generate an adversarial example that induces wrong prediction in CNN models ( Goodfellow et al. , 2014 ) . Denoting an input as x , the goal of adversarial attacks is to find a perturbation δ s.t . xadv = x + δ can mislead the model , where ||δ||p satisfies the intensity constraint ||δ||p ≤ . To formulate that , the adversarial attack aims at maximizing the loss L for the model with parameters θ on the input-label pair ( x , y ) , i.e . δ = argmaxδLθ ( x + δ , y ) , under the constraint that the ` p norm of the perturbation should not exceed the bound . Usually , we use ` ∞ norm ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ) of the perturbations to measure the attack ’ s effectiveness or model ’ s robustness . An attack that requires smaller perturbation to successfully deceive the model is regarded to be stronger . Correspondingly , a defense that enforces the attacks to enlarge perturbation intensity is regarded to be more robust . Various adversarial attack methods have been investigated to strengthen the attack effectiveness . The fast gradient sign method ( FGSM ) ( Goodfellow et al. , 2014 ) exploits the gradient descent method to generate adversarial examples . As an improvement , many studies further show the attack can be strengthened through multi-step projected gradient descent ( PGD ) ( Madry et al. , 2017 ) generation , random-starting strategy , and momentum mechanism ( Dong et al. , 2017 ) . Then SGM ( Wu et al. , 2020 ) further finds that adding weight to the gradients going through the skip connections can make the attacks more effective . Other prevalent attack approaches include C & W losses ( Carlini & Wagner , 2017b ) , M-DI2-FGSM ( Xie et al. , 2019 ) , etc . These attacks provide strong and effective ways to generate adversarial examples , rendering a huge threat to real-world deep learning systems . To improve the robustness of CNN systems , there are also extensive countermeasures for adversarial attacks . One active research direction targets improving the robustness of individual models . Adversarial training ( Madry et al. , 2017 ) optimizes the model on the adversarial examples generated in every step of the training stage . Therefore , the optimized model will tend to drop non-robust features to converge better on the adversarial data . However , adversarial training encourages the model to fit the adversarial examples , thereby reducing the generalization on the clean data and causing significant degradation of the clean accuracy . 2.2 TEST-TIME RANDOMNESS FOR ADVERSARIAL DEFENSE . Besides the aforementioned training techniques , there exist studies that introduce test-time randomness to improve the robustness . Feinman et . al . ( Feinman et al. , 2017 ) utilize the uncertainty measure in dropout networks to detect adversarial examples . Dhillon et . al . ( Dhillon et al. , 2018 ) and Xie et . al . ( Xie et al. , 2017 ) incorporate layer-wise weighted dropout and random input transformations during test time to improve the robustness . Test-time randomness is found to be effective in increasing the required distortion on the model , since test-time randomness makes generating white-box adversarial examples almost as difficult as generating transferable black-box ones ( Carlini & Wagner , 2017a ) . Nevertheless , test-time randomness increases the inference cost and can be circumvented to some extent with the expectation-over-transformation technique ( Athalye et al. , 2018 ) . 2.3 ENSEMBLE TRAINING FOR ADVERSARIAL DEFENSE .. Besides improving the robustness of individual models , another recent research direction is to investigate the robustness of model ensembles in which multiple sub-models work together . The basic idea is that multiple sub-models can provide diverse decisions . Ensemble methods can combine multiple weak models to jointly make decisions , thereby assembling as a stronger entirety . However , it is demonstrated that independent training of multiple models tends to capture similar features , which would not provide diversities among them ( Kariyappa & Qureshi , 2019 ) . Therefore , several studies propose ensemble training methods to fully diversify the sub-models to improve the ensemble robustness . For example , Pan et . al . treat the distribution of output predictions as a diversity measurement and they propose an adaptive diversity promoting ( ADP ) regularizer ( Pang et al. , 2019 ) to diversify the non-max predictions of sub-models . Sanjay et . al . regard the gradients w.r.t . the inputs as a discrimination of different models , thus they propose a gradient alignment loss ( GAL ) ( Kariyappa & Qureshi , 2019 ) which takes the cosine similarity of the gradients as a criterion to train the sub-models . The very recent work DVERGE ( Yang et al. , 2020 ) claims that the similar non-robust features captured by the sub-models cause high adversarial transferability among them . Therefore , the authors exploit non-robust feature distillation and adopt mutual learning to diversify and isolate the vulnerabilities among the sub-models , such that the within-ensemble transferability is highly impeded . However , as mentioned before , such ensemble methods are overwhelmed by the fast-increasing overhead when scaling up the ensemble . For example , DVERGE takes 11 hours to train an ensemble with three sub-models while needs approximately 50 hours when the sub-model count increases to eight . Therefore , a more efficient ensemble construction method is highly demanded to tackle the scaling problem . 3 ENSEMBLE-IN-ONE . 3.1 BASIC MOTIVATION . The conventional way to construct ensembles is to simply aggregate multiple sub-models by averaging their predictions , which is inefficient and hard to scale up . An intuitive way to enhance the scalability of the ensemble construction is to introduce an ensemble for each layer in the network . As shown in Fig.1 , we can augment a dynamic network by augmenting each parameterized layer with an n-path gated block . Then by selecting the paths along the augmented layer , the dynamic network can instantiate nL varied sub-models ideally . Taking ResNet-20 as an example , by replacing each convolution layer ( ignoring the skip connection branch ) with a two-path gated module , the overall path count will approach 219 = 524288 . Such augmentation way provides an approximation to training a very large ensemble of sub-models . Then through vulnerability diversification mutual learning , each path tends to capture better robustness . Following this idea , we propose Ensemblein-One to further improve the robustness of both individual models and ensembles . 3.2 CONSTRUCTION OF THE RANDOM GATED NETWORK . Denote a candidate neural network as N ( o1 , o2 , ... , om ) , where oi represents an operator in the network . To transform the original network into a random gated network ( RGN ) , we first extract the neural architecture to obtain the connection topology and layer types . On top of that , we replace each parameterized layer ( mainly convolutional layer , optionally followed by a batch normalization layer ) with a random gated block ( RGB ) . As shown in Fig . 2 , each RGB simply repeats the original layer by n times , and leverages binary gates with uniform probabilities to control the open or mutation of corresponding sub-layers . These repeated sub-layers are with different weight parameters . We denote the RGN as N ( d1 , d2 , ... , dm ) , where di = ( oi1 , ... , oin ) . Let gi be the gate information in the ith RGB , then a specific path derived from the RGN can be expressed as P = ( g1 · d1 , g2 · d2 , ... , gm · dm ) . For each RGB , when performing the computation , only one of the n gates is opened at a time , and the others will be temporarily muted . Thus by , only one path of activation is active in memory during training , which reduces the memory occupation of training an RGN to the same level of training an individual model . Moreover , to ensure that all paths can be equally sampled and trained , each gate in a RGB is chosen with identical probability , i.e . 1/n if each RGB consists of n sub-operators . Therefore , the binary gate function can be expressed as : gi = [ 1 , 0 , ... , 0 ] with probability 1/n , [ 0 , 1 , ... , 0 ] with probability 1/n , ... [ 0 , 0 , ... , 1 ] with probability 1/n . ( 1 ) An RGN is analogous to the super network in parameter-sharing neural architecture search , and the forward process of an RGN is similar to evaluating a sub-architecture ( Pham et al. , 2018 ; Cai et al. , 2018 ) . Compared to conventional ensemble training methods , our method is easier to scale up the ensemble . It only incurs n×memory occupation for the weight storage , while still keeping the same memory requirement for activation as an individual model .

Summary: This paper proposes a robust training and defending method RGN by applying control gates with binary status. During the training, the proposed method generates adversarial examples in a clean-label attack manner and mitigates the adversarial perturbation through training on another path. During the inference, RGN finds a subnetwork to defend against adversarial attacks.