Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks

1 Introduction . There has been an enormous interest in deploying deep neural networks ( DNNs ) into numerous real-world applications requiring strict security . Meanwhile , DNNs are vulnerable to adversarial attacks , i.e. , an imperceptible perturbation to the input can mislead DNNs trained on clean images into making erroneous predictions . To enhance DNNs ’ robustness , adversarial training augmenting the training set with adversarial samples is commonly regarded as the most effective defense method . Nevertheless , adversarial training is time-consuming as each stochastic gradient descent ( SGD ) iteration requires multiple gradient computations to produce adversarial images . In fact , its actual slowdown factor over standard DNN training depends on the number of gradient steps used for adversarial example generation , which can result in a 3∼30 times longer training time [ 1 ] . In this work , we ask an intriguing question : “ Can we find robust subnetworks within randomly initialized networks without any training ” ? This question not only has meaningful practical implication 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . but also potential theoretical ones . If the answer is yes , it will shed light on new methods towards robust DNNs , e.g. , adversarial training might not be indispensable towards adversarial robustness ; furthermore , the existence of such robust subnetworks will extend the recently discovered lottery ticket hypothesis ( LTH ) [ 2 ] , which articulates that neural networks contain sparse subnetworks that can be effectively trained from scratch when their weights being reset to the original initialization , and thus our understanding towards robust DNNs . In particular , we make the following contributions : • We discover for the first time that there exist subnetworks with inborn robustness , matching or surpassing the robust accuracy of adversarially trained networks with comparable model sizes , within randomly initialized networks without any model training . We name such subnetworks Robust Scratch Tickets ( RSTs ) , which are also by nature efficient . Distinct from the popular LTH , neither the original dense networks nor the identified RSTs need to be trained . For example , RSTs identified from a randomly initialized ResNet101 achieve a 3.56 % /4.31 % and 1.22 % /4.43 % higher robust/natural accuracy than the adversarially trained dense ResNet18 with a comparable model size , under a perturbation strength of n = 2 and n = 4 , respectively . • We propose a general method to search for RSTs within randomly initialized networks , and conduct extensive experiments to identify and study the consistent existence and properties of RSTs under different DNN models , datasets , sparsity patterns , and attack methods , drawing insights regarding the relationship between DNNs ’ robustness and their initialization/overparameterization . Our findings on RSTs ’ existence and properties have opened up a new perspective for studying DNN robustness and can be viewed as a complement to LTH . • We identify the poor adversarial transferability between RSTs of different sparsity ratios drawn from the same randomly initialized dense network , and propose a Random RST Switch ( R2S ) technique , which randomly switches between different RSTs , as a novel defense method built on top of RSTs . While an adversarially trained network shared among datasets suffers from degraded performance , our R2S enables the use of one random dense network for effective defense across different datasets . 2 Related Works . Adversarial attack and defense . DNNs are vulnerable to adversarial attacks , i.e. , an imperceptible perturbation on the inputs can confuse the network into making a wrong prediction [ 3 ] . There has been a continuous war [ 4 , 5 ] between adversaries and defenders . On the adversary side , stronger attacks continue to be proposed , including both white-box [ 6 , 7 , 8 , 9 , 10 ] and black-box ones [ 11 , 12 , 13 , 14 , 15 ] , to notably degrade the accuracy of the target DNNs . In response , on the defender side , various defense methods have been proposed to improve DNNs ’ robustness against adversarial attacks . For example , randomized smoothing [ 16 , 17 ] on the inputs can certifiably robustify DNNs against adversarial attacks ; [ 18 , 19 , 20 , 21 , 22 ] purify the adversarial examples back to the distribution of clean ones ; and [ 23 , 24 , 25 ] adopt detection models to distinguish adversarial examples from clean ones . In particular , adversarial training [ 26 , 6 , 27 , 28 ] is currently the most effective defense method . In this work , we discover the existence of RST , i.e. , there exist subnetworks with inborn robustness that are hidden in randomly initialized networks without any training . Model robustness and efficiency . Both robustness and efficiency [ 29 ] matter for many DNNpowered intelligent applications . There have been pioneering works [ 30 , 31 , 32 , 33 , 34 ] that explore the potential of pruning on top of robust DNNs . In general , it is observed that moderate sparsity is necessary for maintaining DNNs ’ adversarial robustness , over-sparsified DNNs are more vulnerable [ 30 ] , and over-parameterization is important for achieving decent robustness [ 6 ] . Pioneering examples include : [ 31 ] finds that naively pruning an adversarially trained model will result in notably degraded robust accuracy ; [ 35 ] for the first time finds that quantization , if properly exploited , can even enhance quantized DNNs ’ robustness by a notable margin over their full-precision counterparts ; and [ 32 ] adopts pruning techniques that are aware of the robust training objective via learning a binary mask on an adversarially pretrained network ; and [ 34 ] prunes vulnerable features via a learnable mask and proposes a vulnerability suppression loss to minimize the feature-level vulnerability . In contrast , our work studies the existence , properties , and potential applications of RSTs , drawn from randomly initialized networks . Lottery ticket hypothesis . The LTH [ 2 ] shows that there exist small subnetworks ( i.e. , lottery tickets ( LTs ) ) within dense , randomly initialized networks , that can be trained alone to achieve comparable accuracies to the latter . The following works aim to : ( 1 ) study LTs ’ properties [ 36 , 37 , 38 , 39 ] , ( 2 ) improve LTs ’ performance [ 40 , 41 , 42 , 43 ] , and ( 3 ) extend LTH to various networks/tasks/trainingpipelines [ 44 , 45 , 46 , 47 , 48 , 49 , 50 ] . The LTs drawn by existing works need to be ( 1 ) drawn from a pretrained network ( except [ 43 ] ) , and ( 2 ) trained in isolation after being drawn from the dense network . In contrast , RSTs are drawn from randomly initialized networks and , more importantly , no training is involved . We are inspired by [ 51 ] , which finds that randomly weighted networks contain subnetworks with impressive accuracy and [ 52 , 53 ] , which provide theoretical support for [ 51 ] and extend [ 51 ] to identify binary neural networks in randomly weighted networks , respectively . While DNNs ’ adversarial robustness is important , it is not clear whether robust subnetworks exist within randomly initialized networks . We provide a positive answer and conduct a comprehensive study about the existence , properties , and potential applications for RSTs . 3 Robust Scratch Tickets : How to Find Them . In this section , we describe the method that we adopt to search for RSTs within randomly initialized networks . As modern DNNs contain a staggering number of possible subnetworks , it can be nontrivial to find subnetworks with inborn robustness in randomly weighted networks . 3.1 Inspirations from previous works . Our search method draws inspiration from prior works . In particular , [ 31 ] finds that naively pruning an adversarially trained model will notably degrade the robust accuracy , [ 32 ] learns a binary mask on an adversarially pretrained network to make pruning techniques aware of model robustness , and [ 51 ] shows that randomly weighted networks contain subnetworks with impressive nature accuracy , inspiring us to adopt learnable masks on top of randomly initialized weights to identify the RSTs . 3.2 The proposed search strategy . Overview . Our search method adopts a sparse and learnable mask < associated with the weights of randomly initialized networks , where the search process for RSTs is equivalent to only update < without changing the weights as inspired by [ 32 , 51 ] . To search for practically useful RSTs , the update of < has to ( 1 ) be aware of the robust training objective , and ( 2 ) ensure that the sparsity of < is sufficiently high , e.g. , higher than a specified value ( 1 − : / # ) where : is the number of remaining weights and # is the total number of weights . In particular , we adopt an adversarial search process to satisfy ( 1 ) and binarize < to activate only a fraction of the weights in the forward pass to satisfy ( 2 ) . Objective formulation . We formulate the learning process of < as a minimax problem : arg min < ∑ 8 max ‖X ‖∞≤n ℓ ( 5 ( < ̂ \ , G8 + X ) , H8 ) B.C . | | < ̂ | |0 6 : ( 1 ) where ℓ is the loss function , 5 is a randomly initialized network with random weights \ ∈ R # , G8 and H8 are the 8-th input and label pair , denotes element-wise product operation , X is a small perturbation applied to the inputs and n is a scalar that limits the perturbation magnitude in terms of the ! 8= 5 norm . Following [ 51 ] , < ̂ ∈ { 0 , 1 } 3 approximates the top : largest elements of < ∈ R # using 1 and 0 otherwise during the forward pass to satisfy the target sparsity constraint , while all the elements in < will be updated during the backward pass via straight-through estimation [ 54 ] . Such an adversarial search process guarantees the awareness of robustness , which differs from vanilla adversarial training methods [ 26 , 6 , 27 , 28 ] in that here the model weights are never updated . After the adversarial search , a found RST is claimed according to the finally derived binary mask < ̂ . As discussed in Sec . 4.5 , < ̂ can have different sparsity patterns , e.g. , element-wise , row-wise , or kernel-wise , where RSTs are consistently observed . Inner optimization . We solve the inner optimization in Eq . 1 with Projected Gradient Descent ( PGD ) [ 6 ] which iteratively adopts the sign of one-step gradient as an approximation to update X with a small step size U , where the C-th iteration can be formulated as : XC+1 = 2 ; 8 ? n { XC + U · B86= ( ∇XC ℓ ( 5 ( < ̂ \ , G8 + XC ) , H8 ) ) } ( 2 ) where 2 ; 8 ? n denotes the clipping function that enforces its input to the interval [ −n , n ] . As shown in Sec . 4.6 , other adversarial training methods can also be adopted to draw RSTs . 4 The Existence of Robust Scratch Tickets . In this section , we validate the consistent existence of RSTs across different networks and datasets with various sparsity patterns and initialization methods based on the search strategy in Sec . 3 .

Summary: The paper describes the existence of highly robust subnetworks within neural networks with random weights. Further, the paper proposes a simple way to search for these subnetworks, characterizes their properties w.r.t. initialization, model size, attacks, models, search method, and the sparsity structure, and, finally, proposes a technique for ensembling these subnetworks into a more robust model. The experimental framework appears to be sound, and the results are impressive, showing the consistent existence (and high performance) of these subnetworks across several factors.