Stochastic Quantized Activation: To prevent Overfitting in Fast Adversarial Training

1 INTRODUCTION . As Convolutional Neural Networks ( CNNs ) stand out as a solution to many real world computer vision tasks ( LeCun et al. , 2015 ; Angelova et al. , 2015 ; Levine et al. , 2016 ; Litjens et al. , 2017 ) , achieving a certain level of robustness has become indispensable for security-sensitive systems , such as autonomous driving , robot vision , and identity authentication . However , recent studies ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) have shown that the existing CNNs are vulnerable to small perturbations of the input that are intentionally or adversarially designed to fool the system . The adversarial attack is a serious problem since these maliciously designed attacks have shown effective in physical world scenarios , where inputs are obtained from signals of cameras and other sensors ( Kurakin et al. , 2016 ; Evtimov et al. , 2017 ) . Another disconcerting feature about adversarial examples is their transferability across different models ( Szegedy et al. , 2014 ; Papernot et al. , 2016 ; Liu et al. , 2016 ) that enables black-box attacks . In other words , adversarial examples can be designed from a different model without having the information about the target network . The most studied defense strategy against adversarial attacks is adversarial training ( Goodfellow et al. , 2015 ; Kurakin et al. , 2017 ; Tramr et al. , 2018 ; Madry et al. , 2018 ) , which increases robustness by augmenting training data with adversarial examples . Since adversarial training requires the model to train adversarial examples in addition to training data , the model consumes extra time to learn features of the examples via fine-tuning . Even though the model is trained on more examples , it still might be defenseless to new examples generated by different attack due to the overfitting problem . Recently , Madry et al . ( 2018 ) have found that adversarial training on examples created via gradient descent with random restarts , Projected Gradient Descent ( PGD ) training , results in a universally and partially unbreakable model on MNIST and CIFAR-10 . This method shows the state-of-the-art performance on MNIST and CIFAR-10 to the best of our knowledge , but the examples are created iteratively and the time increases proportionally to the number of steps . For instance , in our CIFAR10 training , FGSM training on ResNet18 took less than 2 hours for 30 epochs ; however , PGD training took about 30 hours for the same epochs . Thus , it is essential to find the universal method that is resistant against all of the attacks , with less computational cost . Since high dimensional representations of the neural networks give extreme complexity to the boundary of trained manifolds ( Tanay & Griffin , 2016 ; Dube , 2018 ) , we start from the idea that is to reduce degrees of freedom available to the adversary . In this sense , we propose a Stochastic Quantized Activation ( SQA ) that provides stochastic randomness to the output of an original activation and reduces the opportunity for the attacker to make adversaries . The best advantage of SQA is that SQA with fast adversarial training , training with only FGSM examples , allows the model to have robustness comparable to PGD training with less computational cost . In particular , although SQA is one of the obfuscated gradients defined by Athalye et al . ( 2018 ) , iterative optimization-based methods does not successfully circumvent our defense . Besides , SQA can be combined with any deep learning models with a few lines of code but guarantees a certain level of robustness against adversarial attacks . In this paper , we first explain existing methods for adversarial attacks and defenses we refer in Section 2 . We separate the existing defense strategies into two categories and analyze the strengths and weaknesses . In Section 3 , we introduce the procedure of SQA , with an algorithm described in 1 . In Section 4 , we show our experimental results on MNIST and CIFAR-10 and compare with existing defense systems . Lastly , we visualize the penultimate layer of our networks and compare how SQA with fast adversarial training , learns differently from the existing methods . Section 5 concludes the work and contributions of this paper are as follows : • We propose a Stochastic Quantized Activation ( SQA ) which achieves a significant level of robustness combined with FGSM training , comparable to state-of-the-art PGD adversarial training with much less computational cost . • Due to the efficiency and the flexibility of the proposed method , it can be fastly and widely applied to any existing deep neural networks and combine with other types of defense strategies . • We analytically demonstrate how SQA makes the model robust against adversaries in highlevel and low-level by using t-SNE , and plotting activation maps . 2 RELATED WORK . In this section , we investigate the existing methods of adversarial attacks and defenses that appear in the following subsections . First , we define the adversarial examples with the notations formally used in this paper . Let x denote input and y denote the prediction of the input from the DNN classifier f , y = f ( x ) . Then , an adversarial example is crafted by adding a malicious noise η into the original input x , causing a different prediction from the true label , y∗ . The formal representation is as follows , where x′ is an adversarial example and is the noise level . x′ = x+ · η , where f ( x′ ) 6= y∗ ( 1 ) 2.1 GENERATING ADVERSARIAL EXAMPLES . Fast Gradient Sign Method ( FGSM ) is a fast single-step method to create adversarial examples proposed by Goodfellow et al . ( 2015 ) . The authors suggest the adversarial examples are crafted because of the effects of the linear summation in DNNs , and the algorithm is as follows . x′ = x + · sign ( ∇x J ( f ( x ) , y∗ ) ) ( 2 ) Here J ( f ( x ) , y∗ ) is the loss between the output prediction f ( x ) and the true label y∗ . However , calculating the loss based on the difference between predictions and true labels makes the label leaking effect ( Kurakin et al. , 2017 ) , so one simple way to prevent it is to put the prediction y instead of y∗ . The intuition behind of the Equation 2 is that increasing loss J by perturbing the input x adding the gradient of loss , which makes the prediction get out of the extrema . Projected Gradient Descent ( PGD ) is one of the strongest known white box attacks ( Madry et al. , 2018 ) . It is a multi-step variant of FGSM , which means that it finds the adversarial perturbation ηn by using the same equation from FGSM , but iteratively . What makes this attack stronger is that it finds the adversary from starts with random -uniform perturbation clipped in the range of the normalized pixel values , [ 0,1 ] . x′0 = Clipx ( x+ uniform ( − , ) ) , x′n+1 = Clipx , ( x′n + α · sign ( ∇x J ( f ( x′n ) , y∗ ) ) ) ( 3 ) Carlini & Wagner Attack ( C & W Attack ) is strong optimization-based iterative attack proposed by Carlini & Wagner ( 2017 ) . It uses Adam ( Kingma & Ba , 2014 ) to optimize over the adversarial perturbation ηn using an auxiliary variable ωn and solves the equation below . minimize ||ηn||p + c · f ( xn + ηn ) where ηn = 1 2 ( tanh ( ωn ) + 1 ) − xn . ( 4 ) The function f ( · ) is defined as f ( x ) = max ( Z ( x ) y∗ −max i 6=y∗ ( Z ( x ) i ) , −κ ) , ( 5 ) and we can determine the confidence with which the misclassification occurs by adjusting κ . 2.2 DEFENSIVE STRATEGY . Adversarial training increases robustness by augmenting training data in relation to adversarial examples . Previous studies ( Goodfellow et al. , 2015 ; Kurakin et al. , 2017 ; Tramr et al. , 2018 ) have shown that adversarially training models improve the classification accuracy when presenting them with adversarial examples . However , the intrinsic problem of this method is the high cost associated with additionally generating adversarial examples and patching them into a training batch . For this reason , practical adversarial training on a large scale dataset such as ImageNet uses fast-generated adversarial examples using FGSM only for training data . However , Madry et al . ( 2018 ) have shown that FGSM adversaries don ’ t increase robustness especially for large since the network overfits to these adversarial examples . They instead , suggest to train the network with a multi-step FGSMk , PGD adversaries , and it shows the state-of-the-art performance on MNIST and CIFAR-10 . Obfuscated Gradients make the network hard to generate adversaries by not having useful gradients . Recently , Athalye et al . ( 2018 ) defined three types of obfuscated gradients : Shattered Gradients , Stochastic Gradients , and Exploding & Vanishing Gradients . ( Dhillon et al. , 2018 ; Buckman et al. , 2018 ; Song et al. , 2018 ; Xie et al. , 2018 ) have considered one of these gradients , but Athalye et al . ( 2018 ) make the attacks which successfully circumvent the defense by making 0 % accuracy on 6 out of 7 defenses at ICLR2018 . SQA can be considered as both shattered gradients and stochastic gradients . However , we found that our method does not overfit to the adversarial examples and shows robustness against the different type of attacks including the one used to break obfuscated gradients . The next section explains the details of our method . 3 STOCHASTIC QUANTIZED ACTIVATION . Algorithm 1 Stochastic Quantized Activation 1 : function FORWARD ( hi , λ ) 2 : gi ← ( hi −min∀j⊆J hiJ ) / ( max∀j⊆J hiJ −min∀j⊆J hiJ ) ∗ λ 3 : gi ← bgic + Bernoulli ( gi − bgic ) 4 : gi ← ( gi / λ ) ∗ ( max∀j⊆J hiJ −min∀j⊆J hiJ ) + min∀j⊆J hiJ 5 : return gi 6 : function BACKWARD ( ∂gi/∂hi ) 7 : return ∂gi/∂hi In this section , we introduce the concept of SQA starting from a typical low-bit representation in DNNs as prerequisites ( Courbariaux et al. , 2015 ) . Then , we show the procedure of our quantization stochasticity . The difference between typical low-bit DNNs ( Hubara et al. , 2016a ; Courbariaux et al. , 2015 ; Hubara et al. , 2016b ) and our proposed method is that we only consider the quantization of activations except weight vectors . We found that this does not significantly slow down the training with PyTorch ( Paszke et al. , 2017 ) but maintains full-precision weight representation , which enables easier convergence than BNNs without additional training strategies . BinaryConnect constraints the weights to either +1 or -1 during propagations ( Courbariaux et al. , 2015 ) . Two types of binarization , deterministic and stochastic , are introduced . They are respectively described by the following equations . wb = { +1 if w ≥ 0 , −1 otherwise . ( 6 ) wb = { +1 with probability p = σ ( w ) , −1 with probability 1− p. where σ ( x ) = clip ( x+ 1 2 , 0 , 1 ) = max ( 0 , min ( 1 , x+ 1 2 ) ) ( 7 ) BNNs are originally designed to reduce the significant amount of memory consumption and costs taken by propagating in full-precision networks . Recently , however , Galloway et al . ( 2018 ) shows another benefit of low-precision neural networks , which improves robustness against some adversarial attacks . Thus , we propose SQA , a stochastic activation function giving the quantized threshold effects into vanilla CNNs , which is described in Algorithm 1 . The algorithm can be divided into three steps . • Min-Max normalization with scaling • Stochastic Quantization • Inverse Min-Max normalization after rescaling Let hi be a latent space , the output from a ith convolutional layer after ReLU activation . We first perform min-max normalization , making hi ranging from 0 to 1 . Then we scale the hi ranging from 0 to λ by multiplying a scale factor λ , which determines the level of quantization from binary to quaternary in our experiment . In the next step , we stochastically quantize the scaled gi as gi presented in the below equation . gi = bgic + Bernoulli ( gi − bgic ) ( 8 ) This makes gi converge into the closest or second closest integers , either bgic or bgic + 1 with a probability of each , 1 - ( gi−bgic ) and gi−bgic . For instance , if we let gi = 1.7 , then the probability of gi = 1 is 0.3 and gi = 2 is 0.7 . The final step is rescaling gi into the range of original output ReLU activation hi . To rescale the value within the original range , gi is first divided by λ , and inverse min-max normalization is applied as presented in Algorithm 1 . Since it is impossible to find exact derivatives with respect of discretized activations , an alternative is to approximate it by a straight through estimator ( Bengio et al. , 2013 ) . The concept of a straight through estimator is fixing the incoming gradients to a threshold function equal to its outgoing gradients , ignoring the derivative of the threshold function itself . This is the reason why we rescale gi to the original range of hi . In other words , we do not want to consider the scale factors multiplied in the activation function when we use a straight through estimator .

Summary: The paper proposes to quantize activation outputs in FGSM training. The algorithm itself is not novel. The straight through approach for training quantized network has been used in previous papers, as also pointed out by the authors. The new thing is that the authors found that quantization of activation function improves robustness, and the approach can be naturally combined with FGSM adversarial training. Experimental results show comparable (and slightly worse) results compared to adversarial training with PGD, while the proposed approach is faster in training time.