Sparsity Winning Twice: Better Robust Generalization from More Efficient Training

1 INTRODUCTION Deep neural networks ( DNNs ) are notoriously vulnerable to maliciously crafted adversarial attacks . To conquer this fragility , numerous adversarial defense mechanisms are proposed to establish robust neural networks ( Schmidt et al. , 2018 ; Sun et al. , 2019 ; Nakkiran , 2019 ; Raghunathan et al. , 2019 ; Hu et al. , 2019 ; Chen et al. , 2020c ; 2021e ; Jiang et al. , 2020 ) . Among them , adversarial training ( AT ) based methods ( Madry et al. , 2017 ; Zhang et al. , 2019 ) have maintained the state-of-the-art robustness . However , the AT training process usually comes with order-ofmagnitude higher computational costs than standard training , since multiple attack iterations are needed to construct strong adversarial examples ( Madry et al. , 2018b ) . Moreover , AT was recently revealed to incur severe robust generalization gaps ( Rice et al. , 2020 ) , between its training and testing accuracies , as shown in Figure 1 ; and to require significantly more training samples ( Schmidt et al. , 2018 ) to generalize robustly . * Equal Contribution . 1 In response to those challenges , Schmidt et al . ( 2018 ) ; Lee et al . ( 2020 ) ; Song et al . ( 2019 ) investigate the possibility of improving generalization by leveraging advanced data augmentation techniques , which further amplifies the training cost of AT . Recent studies ( Rice et al. , 2020 ; Chen et al. , 2021e ) found that early stopping , or several smoothness/flatness-aware regularizations ( Chen et al. , 2021e ; Stutz et al. , 2021 ; Singla et al. , 2021 ) , can bring effective mitigation . In this paper , a new perspective has been explored to tackle the above challenges by enforcing appropriate sparsity patterns during AT . The connection between robust generalization and sparsity is mainly inspired by two facts . On one hand , sparsity can effectively regularize the learning of over-parameterized neural networks , hence potentially benefiting both standard and robust generalization ( Balda et al. , 2019 ) . As demonstrated in Figure 1 , with the increase of sparsity levels , the robust generalization gap is indeed substantially shrunk while the robust overfitting is alleviated . On the other hand , one key design philosophy that facilitates this consideration is the lottery ticket hypothesis ( LTH ) ( Frankle & Carbin , 2019 ) . The LTH advocates the existence of highly sparse and separately trainable subnetworks ( a.k.a . winning tickets ) , which can be trained from the original initialization to match or even surpass the corresponding dense networks ’ test accuracies . These facts point out a promising direction that utilizing proper sparsity is capable of boosting robust generalization while maintaining competitive standard and robust accuracy . Although sparsity is beneficial , the current methods ( Frankle & Carbin , 2019 ; Frankle et al. , 2020 ; Renda et al. , 2020 ) often empirically locate sparse critical subnetworks by Iterative Magnitude Pruning ( IMP ) . It demands excessive computational cost even for standard training due to the iterative train-prune-retrain process . Recently , You et al . ( 2020 ) demonstrated that these intriguing subnetworks can be identified at the very early training stage using one-shot pruning , which they term as Early Bird ( EB ) tickets . We show the phenomenon also exists in the adversarial training scheme . More importantly , we take one leap further to reveal that even in adversarial training , EB tickets can be drawn from a cheap standard training stage , while still achieving solid robustness . In other words , the Early Bird is also a Robust Bird that yields an attractive win-win of efficiency and robustness - we name this finding as Robust Bird ( RB ) tickets . Furthermore , we investigate the role of sparsity in a scene where the sparse connections of subnetworks change on the fly . Specifically , we initialize a subnetwork with random sparse connectivity and then optimize its weights and sparse typologies simultaneously , while sticking to the fixed small parameter budget . This training pipeline , called as Flying Bird ( FB ) , is motivated by the latest sparse training approaches ( Evci et al. , 2020b ) to further reduce robust generalization gap in AT , while ensuring low training costs . Moreover , an enhanced algorithm , i.e. , Flying Bird+ , is proposed to dynamically adjust the network capacity ( or sparsity ) to pursue superior robust generalization , at few extra prices of training efficiency . Our contributions can be summarized as follows : • We perform a thorough investigation to reveal that introducing appropriate sparsity into AT is an appealing win-win , specifically : ( 1 ) substantially alleviating the robust generalization gap ; ( 2 ) maintaining comparable or even better standard/robust accuracies ; and ( 3 ) enhancing the AT efficiency by training only compact subnetworks . • We explore two alternatives for sparse adversarial training : ( i ) the Robust Bird ( RB ) training that leverages static sparsity , by mining the critical sparse subnetwork at the early training stage , and using only the cheapest standard training ; ( ii ) the Flying Bird ( FB ) training that allows for dynamic sparsity , which jointly optimizes both network weights and their sparse connectivity during AT , while sticking to the same sparsity level . We also discuss a FB variant called Flying Bird+ that adaptively adjusts the sparsity level on demand during AT . • Extensive experiments are conducted on CIFAR-10 , CIFAR-100 , and Tiny-ImageNet with diverse network architectures . Specifically , our proposals obtain 80.16 % ∼ 87.83 % training FLOPs and 80.16 % ∼ 87.83 % inference FLOPs savings , shrink robust generalization from 28.00 % ∼ 63.18 % to 4.43 % ∼ 34.44 % , and boost the robust accuracy by up to 0.60 % and the standard accuracy by up to 0.90 % , across multiple datasets and architectures . Meanwhile , combining our sparse adversarial training frameworks with existing regularizations establishes the new state-of-the-art results . 2 RELATED WORK . Adversarial training and robust generalization/overfitting . Deep neural networks present vulnerability to imperceivable adversarial perturbations . To deal with this drawback , numerous defense 2 approaches have been proposed ( Goodfellow et al. , 2015 ; Kurakin et al. , 2016 ; Madry et al. , 2018a ) . Although many methods ( Liao et al. , 2018 ; Guo et al. , 2018a ; Xu et al. , 2017 ; Dziugaite et al. , 2016 ; Dhillon et al. , 2018a ; Xie et al. , 2018 ; Jiang et al. , 2020 ) were later found to result from obfuscated gradients ( Athalye et al. , 2018 ) , adversarial training ( AT ) ( Madry et al. , 2018a ) , together with some of its variants ( Zhang et al. , 2019 ; Mosbach et al. , 2018 ; Dong et al. , 2018 ) , remains as one of the most effective yet costly approaches . A pitfall of AT , i.e. , the poor robust generalization , was spotted recently . Schmidt et al . ( 2018 ) showed that AT intrinsically demands a larger sample complexity to identify well-generalizable robust solutions . Therefore , data augmentation ( Lee et al. , 2020 ; Song et al. , 2019 ) is an effective remedy . Stutz et al . ( 2021 ) ; Singla et al . ( 2021 ) related robust generalization gap to curvature/flatness of loss landscapes . They introduced weight perturbing approaches and smooth activation functions to reshape the loss geometry and boost robust generalization ability . Meanwhile , the robust overfitting ( Rice et al. , 2020 ) in AT usually happens with or as a result of inferior generalization . Previous studies ( Rice et al. , 2020 ; Chen et al. , 2021e ) demonstrated that conventional regularization-based methods ( e.g. , weight decay and simple data augmentation ) can not alleviate robust overfitting . Then , numerous advanced algorithms ( Zhang et al. , 2020 ; 2021b ; Zhou et al. , 2021 ; Bunk et al. , 2021 ; Chen et al. , 2021a ; Dong et al. , 2021 ; Zi et al. , 2021 ; Tack et al. , 2021 ; Zhang et al. , 2021a ) arose in the last half year to tackle the overfitting , using data manipulation , smoothened training , and else . Those methods work orthogonally to our proposal as evidenced in Section 4 . Another group of related literature lies in the field of sparse robust networks ( Guo et al. , 2018b ) . These works either treat model compression as a defense mechanism ( Wang et al. , 2018 ; Gao et al. , 2017 ; Dhillon et al. , 2018b ) or pursue robust and efficient sub-models that can be deployed in resource-limited platforms ( Gui et al. , 2019 ; Ye et al. , 2019 ; Sehwag et al. , 2019 ) . Compared to those inference-focused methods , our goal is fundamentally different : injecting sparsity during training to reduce the robust generalization gap while improving training efficiency . Static pruning and dynamic sparse training . Pruning ( LeCun et al. , 1990 ; Han et al. , 2015a ) serves as a powerful technique to eliminate the weight redundancy in over-parameterized DNNs , which aims to obtain storage and computational savings with almost undamaged performance . It can roughly divided into two categories based on how to generate sparse patterns : ( i ) static pruning . It removes parameters ( Han et al. , 2015a ; LeCun et al. , 1990 ; Han et al. , 2015b ) or substructures ( Liu et al. , 2017 ; Zhou et al. , 2016 ; He et al. , 2017 ) based on optimized importance scores ( Zhang et al. , 2018 ; He et al. , 2017 ) or some heuristics like weight magnitude ( Han et al. , 2015a ) , gradient ( Molchanov et al. , 2019 ) , hessian ( LeCun et al. , 1990 ) statistics . The discarded elements usually will not participate in the next round of training or pruning . Static pruning can be flexibly applied prior to training , such as SNIP ( Lee et al. , 2019 ) , GraSP ( Wang et al. , 2020 ) and SynFlow ( Tanaka et al. , 2020 ) ; during training ( Zhang et al. , 2018 ; He et al. , 2017 ) ; and post training ( Han et al. , 2015a ) for different trade-off between training cost and pruned models ’ quality . ( ii ) dynamic sparse training . It updates model parameters and sparse connectivities at the same time , starting from a randomly sparsified subnetwork ( Molchanov et al. , 2017 ) . During the training , the removed elements have chances to be grown back if they potentially benefit to predictions . Among the huge family of sparse training ( Mocanu et al. , 2016 ; Evci et al. , 2019 ; Mostafa & Wang , 2019 ; Liu et al. , 2021a ; Dettmers & Zettlemoyer , 2019 ; Jayakumar et al. , 2021 ; Raihan & Aamodt , 2020 ) , the recent methods Evci et al . ( 2020a ) ; Liu et al . ( 2021b ) lead to the state-of-the-art performance . A special case of static pruning , Lottery tickets hypothesis ( LTH ) ( Frankle & Carbin , 2019 ) , demonstrates the existence of sparse subnetworks in DNNs , which are capable of training in isolation and reach a comparable performance of their dense counterpart . The LTH indicates the great potential to train a sparse network from scratch without sacrificing expressiveness and has recently drawn lots of attention from diverse fields ( Chen et al. , 2020b ; a ; 2021g ; f ; d ; c ; b ; 2022 ; Ding et al. , 2022 ; Gan et al. , 2021 ) beyond image recognition ( Zhang et al. , 2021d ; Frankle et al. , 2020 ; Redman et al. , 2021 ) .

Summary: Recent studies demonstrate adversarial training suffers from severe overfitting besides getting very expensive. This paper proposes to handle the two problems organically altogether, with the tool of sparse training.   The authors show that injecting appropriate sparsity forms in training could substantially shrink the robust generalization gap and alleviate the robust overfitting, meanwhile significantly saving training and inference FLOPs.