Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks

1 Introduction . There has been an enormous interest in deploying deep neural networks ( DNNs ) into numerous real-world applications requiring strict security . Meanwhile , DNNs are vulnerable to adversarial attacks , i.e. , an imperceptible perturbation to the input can mislead DNNs trained on clean images into making erroneous predictions . To enhance DNNs ’ robustness , adversarial training augmenting the training set with adversarial samples is commonly regarded as the most effective defense method . Nevertheless , adversarial training is time-consuming as each stochastic gradient descent ( SGD ) iteration requires multiple gradient computations to produce adversarial images . In fact , its actual slowdown factor over standard DNN training depends on the number of gradient steps used for adversarial example generation , which can result in a 3∼30 times longer training time [ 1 ] . In this work , we ask an intriguing question : “ Can we find robust subnetworks within randomly initialized networks without any training ” ? This question not only has meaningful practical implication 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . but also potential theoretical ones . If the answer is yes , it will shed light on new methods towards robust DNNs , e.g. , adversarial training might not be indispensable towards adversarial robustness ; furthermore , the existence of such robust subnetworks will extend the recently discovered lottery ticket hypothesis ( LTH ) [ 2 ] , which articulates that neural networks contain sparse subnetworks that can be effectively trained from scratch when their weights being reset to the original initialization , and thus our understanding towards robust DNNs . In particular , we make the following contributions : • We discover for the first time that there exist subnetworks with inborn robustness , matching or surpassing the robust accuracy of adversarially trained networks with comparable model sizes , within randomly initialized networks without any model training . We name such subnetworks Robust Scratch Tickets ( RSTs ) , which are also by nature efficient . Distinct from the popular LTH , neither the original dense networks nor the identified RSTs need to be trained . For example , RSTs identified from a randomly initialized ResNet101 achieve a 3.56 % /4.31 % and 1.22 % /4.43 % higher robust/natural accuracy than the adversarially trained dense ResNet18 with a comparable model size , under a perturbation strength of n = 2 and n = 4 , respectively . • We propose a general method to search for RSTs within randomly initialized networks , and conduct extensive experiments to identify and study the consistent existence and properties of RSTs under different DNN models , datasets , sparsity patterns , and attack methods , drawing insights regarding the relationship between DNNs ’ robustness and their initialization/overparameterization . Our findings on RSTs ’ existence and properties have opened up a new perspective for studying DNN robustness and can be viewed as a complement to LTH . • We identify the poor adversarial transferability between RSTs of different sparsity ratios drawn from the same randomly initialized dense network , and propose a Random RST Switch ( R2S ) technique , which randomly switches between different RSTs , as a novel defense method built on top of RSTs . While an adversarially trained network shared among datasets suffers from degraded performance , our R2S enables the use of one random dense network for effective defense across different datasets . 2 Related Works . Adversarial attack and defense . DNNs are vulnerable to adversarial attacks , i.e. , an imperceptible perturbation on the inputs can confuse the network into making a wrong prediction [ 3 ] . There has been a continuous war [ 4 , 5 ] between adversaries and defenders . On the adversary side , stronger attacks continue to be proposed , including both white-box [ 6 , 7 , 8 , 9 , 10 ] and black-box ones [ 11 , 12 , 13 , 14 , 15 ] , to notably degrade the accuracy of the target DNNs . In response , on the defender side , various defense methods have been proposed to improve DNNs ’ robustness against adversarial attacks . For example , randomized smoothing [ 16 , 17 ] on the inputs can certifiably robustify DNNs against adversarial attacks ; [ 18 , 19 , 20 , 21 , 22 ] purify the adversarial examples back to the distribution of clean ones ; and [ 23 , 24 , 25 ] adopt detection models to distinguish adversarial examples from clean ones . In particular , adversarial training [ 26 , 6 , 27 , 28 ] is currently the most effective defense method . In this work , we discover the existence of RST , i.e. , there exist subnetworks with inborn robustness that are hidden in randomly initialized networks without any training . Model robustness and efficiency . Both robustness and efficiency [ 29 ] matter for many DNNpowered intelligent applications . There have been pioneering works [ 30 , 31 , 32 , 33 , 34 ] that explore the potential of pruning on top of robust DNNs . In general , it is observed that moderate sparsity is necessary for maintaining DNNs ’ adversarial robustness , over-sparsified DNNs are more vulnerable [ 30 ] , and over-parameterization is important for achieving decent robustness [ 6 ] . Pioneering examples include : [ 31 ] finds that naively pruning an adversarially trained model will result in notably degraded robust accuracy ; [ 35 ] for the first time finds that quantization , if properly exploited , can even enhance quantized DNNs ’ robustness by a notable margin over their full-precision counterparts ; and [ 32 ] adopts pruning techniques that are aware of the robust training objective via learning a binary mask on an adversarially pretrained network ; and [ 34 ] prunes vulnerable features via a learnable mask and proposes a vulnerability suppression loss to minimize the feature-level vulnerability . In contrast , our work studies the existence , properties , and potential applications of RSTs , drawn from randomly initialized networks . Lottery ticket hypothesis . The LTH [ 2 ] shows that there exist small subnetworks ( i.e. , lottery tickets ( LTs ) ) within dense , randomly initialized networks , that can be trained alone to achieve comparable accuracies to the latter . The following works aim to : ( 1 ) study LTs ’ properties [ 36 , 37 , 38 , 39 ] , ( 2 ) improve LTs ’ performance [ 40 , 41 , 42 , 43 ] , and ( 3 ) extend LTH to various networks/tasks/trainingpipelines [ 44 , 45 , 46 , 47 , 48 , 49 , 50 ] . The LTs drawn by existing works need to be ( 1 ) drawn from a pretrained network ( except [ 43 ] ) , and ( 2 ) trained in isolation after being drawn from the dense network . In contrast , RSTs are drawn from randomly initialized networks and , more importantly , no training is involved . We are inspired by [ 51 ] , which finds that randomly weighted networks contain subnetworks with impressive accuracy and [ 52 , 53 ] , which provide theoretical support for [ 51 ] and extend [ 51 ] to identify binary neural networks in randomly weighted networks , respectively . While DNNs ’ adversarial robustness is important , it is not clear whether robust subnetworks exist within randomly initialized networks . We provide a positive answer and conduct a comprehensive study about the existence , properties , and potential applications for RSTs . 3 Robust Scratch Tickets : How to Find Them . In this section , we describe the method that we adopt to search for RSTs within randomly initialized networks . As modern DNNs contain a staggering number of possible subnetworks , it can be nontrivial to find subnetworks with inborn robustness in randomly weighted networks . 3.1 Inspirations from previous works . Our search method draws inspiration from prior works . In particular , [ 31 ] finds that naively pruning an adversarially trained model will notably degrade the robust accuracy , [ 32 ] learns a binary mask on an adversarially pretrained network to make pruning techniques aware of model robustness , and [ 51 ] shows that randomly weighted networks contain subnetworks with impressive nature accuracy , inspiring us to adopt learnable masks on top of randomly initialized weights to identify the RSTs . 3.2 The proposed search strategy . Overview . Our search method adopts a sparse and learnable mask < associated with the weights of randomly initialized networks , where the search process for RSTs is equivalent to only update < without changing the weights as inspired by [ 32 , 51 ] . To search for practically useful RSTs , the update of < has to ( 1 ) be aware of the robust training objective , and ( 2 ) ensure that the sparsity of < is sufficiently high , e.g. , higher than a specified value ( 1 − : / # ) where : is the number of remaining weights and # is the total number of weights . In particular , we adopt an adversarial search process to satisfy ( 1 ) and binarize < to activate only a fraction of the weights in the forward pass to satisfy ( 2 ) . Objective formulation . We formulate the learning process of < as a minimax problem : arg min < ∑ 8 max ‖X ‖∞≤n ℓ ( 5 ( < ̂ \ , G8 + X ) , H8 ) B.C . | | < ̂ | |0 6 : ( 1 ) where ℓ is the loss function , 5 is a randomly initialized network with random weights \ ∈ R # , G8 and H8 are the 8-th input and label pair , denotes element-wise product operation , X is a small perturbation applied to the inputs and n is a scalar that limits the perturbation magnitude in terms of the ! 8= 5 norm . Following [ 51 ] , < ̂ ∈ { 0 , 1 } 3 approximates the top : largest elements of < ∈ R # using 1 and 0 otherwise during the forward pass to satisfy the target sparsity constraint , while all the elements in < will be updated during the backward pass via straight-through estimation [ 54 ] . Such an adversarial search process guarantees the awareness of robustness , which differs from vanilla adversarial training methods [ 26 , 6 , 27 , 28 ] in that here the model weights are never updated . After the adversarial search , a found RST is claimed according to the finally derived binary mask < ̂ . As discussed in Sec . 4.5 , < ̂ can have different sparsity patterns , e.g. , element-wise , row-wise , or kernel-wise , where RSTs are consistently observed . Inner optimization . We solve the inner optimization in Eq . 1 with Projected Gradient Descent ( PGD ) [ 6 ] which iteratively adopts the sign of one-step gradient as an approximation to update X with a small step size U , where the C-th iteration can be formulated as : XC+1 = 2 ; 8 ? n { XC + U · B86= ( ∇XC ℓ ( 5 ( < ̂ \ , G8 + XC ) , H8 ) ) } ( 2 ) where 2 ; 8 ? n denotes the clipping function that enforces its input to the interval [ −n , n ] . As shown in Sec . 4.6 , other adversarial training methods can also be adopted to draw RSTs . 4 The Existence of Robust Scratch Tickets . In this section , we validate the consistent existence of RSTs across different networks and datasets with various sparsity patterns and initialization methods based on the search strategy in Sec . 3 .

Summary: This paper studies the inherent adversarial robustness of subnetowrks inside a full network. It names such subnetworks as Robust Scratch Tickets (RSTs). RSTs have good properties, as they possess robustness even without adversarial training. The paper further studies the existence and properties of RSTs under various aspects. The overall findings are interesting and motivating regarding the architectural robustness.