Stochastic Quantized Activation: To prevent Overfitting in Fast Adversarial Training

1 INTRODUCTION . As Convolutional Neural Networks ( CNNs ) stand out as a solution to many real world computer vision tasks ( LeCun et al. , 2015 ; Angelova et al. , 2015 ; Levine et al. , 2016 ; Litjens et al. , 2017 ) , achieving a certain level of robustness has become indispensable for security-sensitive systems , such as autonomous driving , robot vision , and identity authentication . However , recent studies ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) have shown that the existing CNNs are vulnerable to small perturbations of the input that are intentionally or adversarially designed to fool the system . The adversarial attack is a serious problem since these maliciously designed attacks have shown effective in physical world scenarios , where inputs are obtained from signals of cameras and other sensors ( Kurakin et al. , 2016 ; Evtimov et al. , 2017 ) . Another disconcerting feature about adversarial examples is their transferability across different models ( Szegedy et al. , 2014 ; Papernot et al. , 2016 ; Liu et al. , 2016 ) that enables black-box attacks . In other words , adversarial examples can be designed from a different model without having the information about the target network . The most studied defense strategy against adversarial attacks is adversarial training ( Goodfellow et al. , 2015 ; Kurakin et al. , 2017 ; Tramr et al. , 2018 ; Madry et al. , 2018 ) , which increases robustness by augmenting training data with adversarial examples . Since adversarial training requires the model to train adversarial examples in addition to training data , the model consumes extra time to learn features of the examples via fine-tuning . Even though the model is trained on more examples , it still might be defenseless to new examples generated by different attack due to the overfitting problem . Recently , Madry et al . ( 2018 ) have found that adversarial training on examples created via gradient descent with random restarts , Projected Gradient Descent ( PGD ) training , results in a universally and partially unbreakable model on MNIST and CIFAR-10 . This method shows the state-of-the-art performance on MNIST and CIFAR-10 to the best of our knowledge , but the examples are created iteratively and the time increases proportionally to the number of steps . For instance , in our CIFAR10 training , FGSM training on ResNet18 took less than 2 hours for 30 epochs ; however , PGD training took about 30 hours for the same epochs . Thus , it is essential to find the universal method that is resistant against all of the attacks , with less computational cost . Since high dimensional representations of the neural networks give extreme complexity to the boundary of trained manifolds ( Tanay & Griffin , 2016 ; Dube , 2018 ) , we start from the idea that is to reduce degrees of freedom available to the adversary . In this sense , we propose a Stochastic Quantized Activation ( SQA ) that provides stochastic randomness to the output of an original activation and reduces the opportunity for the attacker to make adversaries . The best advantage of SQA is that SQA with fast adversarial training , training with only FGSM examples , allows the model to have robustness comparable to PGD training with less computational cost . In particular , although SQA is one of the obfuscated gradients defined by Athalye et al . ( 2018 ) , iterative optimization-based methods does not successfully circumvent our defense . Besides , SQA can be combined with any deep learning models with a few lines of code but guarantees a certain level of robustness against adversarial attacks . In this paper , we first explain existing methods for adversarial attacks and defenses we refer in Section 2 . We separate the existing defense strategies into two categories and analyze the strengths and weaknesses . In Section 3 , we introduce the procedure of SQA , with an algorithm described in 1 . In Section 4 , we show our experimental results on MNIST and CIFAR-10 and compare with existing defense systems . Lastly , we visualize the penultimate layer of our networks and compare how SQA with fast adversarial training , learns differently from the existing methods . Section 5 concludes the work and contributions of this paper are as follows : • We propose a Stochastic Quantized Activation ( SQA ) which achieves a significant level of robustness combined with FGSM training , comparable to state-of-the-art PGD adversarial training with much less computational cost . • Due to the efficiency and the flexibility of the proposed method , it can be fastly and widely applied to any existing deep neural networks and combine with other types of defense strategies . • We analytically demonstrate how SQA makes the model robust against adversaries in highlevel and low-level by using t-SNE , and plotting activation maps . 2 RELATED WORK . In this section , we investigate the existing methods of adversarial attacks and defenses that appear in the following subsections . First , we define the adversarial examples with the notations formally used in this paper . Let x denote input and y denote the prediction of the input from the DNN classifier f , y = f ( x ) . Then , an adversarial example is crafted by adding a malicious noise η into the original input x , causing a different prediction from the true label , y∗ . The formal representation is as follows , where x′ is an adversarial example and is the noise level . x′ = x+ · η , where f ( x′ ) 6= y∗ ( 1 ) 2.1 GENERATING ADVERSARIAL EXAMPLES . Fast Gradient Sign Method ( FGSM ) is a fast single-step method to create adversarial examples proposed by Goodfellow et al . ( 2015 ) . The authors suggest the adversarial examples are crafted because of the effects of the linear summation in DNNs , and the algorithm is as follows . x′ = x + · sign ( ∇x J ( f ( x ) , y∗ ) ) ( 2 ) Here J ( f ( x ) , y∗ ) is the loss between the output prediction f ( x ) and the true label y∗ . However , calculating the loss based on the difference between predictions and true labels makes the label leaking effect ( Kurakin et al. , 2017 ) , so one simple way to prevent it is to put the prediction y instead of y∗ . The intuition behind of the Equation 2 is that increasing loss J by perturbing the input x adding the gradient of loss , which makes the prediction get out of the extrema . Projected Gradient Descent ( PGD ) is one of the strongest known white box attacks ( Madry et al. , 2018 ) . It is a multi-step variant of FGSM , which means that it finds the adversarial perturbation ηn by using the same equation from FGSM , but iteratively . What makes this attack stronger is that it finds the adversary from starts with random -uniform perturbation clipped in the range of the normalized pixel values , [ 0,1 ] . x′0 = Clipx ( x+ uniform ( − , ) ) , x′n+1 = Clipx , ( x′n + α · sign ( ∇x J ( f ( x′n ) , y∗ ) ) ) ( 3 ) Carlini & Wagner Attack ( C & W Attack ) is strong optimization-based iterative attack proposed by Carlini & Wagner ( 2017 ) . It uses Adam ( Kingma & Ba , 2014 ) to optimize over the adversarial perturbation ηn using an auxiliary variable ωn and solves the equation below . minimize ||ηn||p + c · f ( xn + ηn ) where ηn = 1 2 ( tanh ( ωn ) + 1 ) − xn . ( 4 ) The function f ( · ) is defined as f ( x ) = max ( Z ( x ) y∗ −max i 6=y∗ ( Z ( x ) i ) , −κ ) , ( 5 ) and we can determine the confidence with which the misclassification occurs by adjusting κ . 2.2 DEFENSIVE STRATEGY . Adversarial training increases robustness by augmenting training data in relation to adversarial examples . Previous studies ( Goodfellow et al. , 2015 ; Kurakin et al. , 2017 ; Tramr et al. , 2018 ) have shown that adversarially training models improve the classification accuracy when presenting them with adversarial examples . However , the intrinsic problem of this method is the high cost associated with additionally generating adversarial examples and patching them into a training batch . For this reason , practical adversarial training on a large scale dataset such as ImageNet uses fast-generated adversarial examples using FGSM only for training data . However , Madry et al . ( 2018 ) have shown that FGSM adversaries don ’ t increase robustness especially for large since the network overfits to these adversarial examples . They instead , suggest to train the network with a multi-step FGSMk , PGD adversaries , and it shows the state-of-the-art performance on MNIST and CIFAR-10 . Obfuscated Gradients make the network hard to generate adversaries by not having useful gradients . Recently , Athalye et al . ( 2018 ) defined three types of obfuscated gradients : Shattered Gradients , Stochastic Gradients , and Exploding & Vanishing Gradients . ( Dhillon et al. , 2018 ; Buckman et al. , 2018 ; Song et al. , 2018 ; Xie et al. , 2018 ) have considered one of these gradients , but Athalye et al . ( 2018 ) make the attacks which successfully circumvent the defense by making 0 % accuracy on 6 out of 7 defenses at ICLR2018 . SQA can be considered as both shattered gradients and stochastic gradients . However , we found that our method does not overfit to the adversarial examples and shows robustness against the different type of attacks including the one used to break obfuscated gradients . The next section explains the details of our method . 3 STOCHASTIC QUANTIZED ACTIVATION . Algorithm 1 Stochastic Quantized Activation 1 : function FORWARD ( hi , λ ) 2 : gi ← ( hi −min∀j⊆J hiJ ) / ( max∀j⊆J hiJ −min∀j⊆J hiJ ) ∗ λ 3 : gi ← bgic + Bernoulli ( gi − bgic ) 4 : gi ← ( gi / λ ) ∗ ( max∀j⊆J hiJ −min∀j⊆J hiJ ) + min∀j⊆J hiJ 5 : return gi 6 : function BACKWARD ( ∂gi/∂hi ) 7 : return ∂gi/∂hi In this section , we introduce the concept of SQA starting from a typical low-bit representation in DNNs as prerequisites ( Courbariaux et al. , 2015 ) . Then , we show the procedure of our quantization stochasticity . The difference between typical low-bit DNNs ( Hubara et al. , 2016a ; Courbariaux et al. , 2015 ; Hubara et al. , 2016b ) and our proposed method is that we only consider the quantization of activations except weight vectors . We found that this does not significantly slow down the training with PyTorch ( Paszke et al. , 2017 ) but maintains full-precision weight representation , which enables easier convergence than BNNs without additional training strategies . BinaryConnect constraints the weights to either +1 or -1 during propagations ( Courbariaux et al. , 2015 ) . Two types of binarization , deterministic and stochastic , are introduced . They are respectively described by the following equations . wb = { +1 if w ≥ 0 , −1 otherwise . ( 6 ) wb = { +1 with probability p = σ ( w ) , −1 with probability 1− p. where σ ( x ) = clip ( x+ 1 2 , 0 , 1 ) = max ( 0 , min ( 1 , x+ 1 2 ) ) ( 7 ) BNNs are originally designed to reduce the significant amount of memory consumption and costs taken by propagating in full-precision networks . Recently , however , Galloway et al . ( 2018 ) shows another benefit of low-precision neural networks , which improves robustness against some adversarial attacks . Thus , we propose SQA , a stochastic activation function giving the quantized threshold effects into vanilla CNNs , which is described in Algorithm 1 . The algorithm can be divided into three steps . • Min-Max normalization with scaling • Stochastic Quantization • Inverse Min-Max normalization after rescaling Let hi be a latent space , the output from a ith convolutional layer after ReLU activation . We first perform min-max normalization , making hi ranging from 0 to 1 . Then we scale the hi ranging from 0 to λ by multiplying a scale factor λ , which determines the level of quantization from binary to quaternary in our experiment . In the next step , we stochastically quantize the scaled gi as gi presented in the below equation . gi = bgic + Bernoulli ( gi − bgic ) ( 8 ) This makes gi converge into the closest or second closest integers , either bgic or bgic + 1 with a probability of each , 1 - ( gi−bgic ) and gi−bgic . For instance , if we let gi = 1.7 , then the probability of gi = 1 is 0.3 and gi = 2 is 0.7 . The final step is rescaling gi into the range of original output ReLU activation hi . To rescale the value within the original range , gi is first divided by λ , and inverse min-max normalization is applied as presented in Algorithm 1 . Since it is impossible to find exact derivatives with respect of discretized activations , an alternative is to approximate it by a straight through estimator ( Bengio et al. , 2013 ) . The concept of a straight through estimator is fixing the incoming gradients to a threshold function equal to its outgoing gradients , ignoring the derivative of the threshold function itself . This is the reason why we rescale gi to the original range of hi . In other words , we do not want to consider the scale factors multiplied in the activation function when we use a straight through estimator .

Summary: This paper proposes to use a  stochastically quantized network combined with adversarial training to improve the robustness of models against adversarial examples. The main finding is that, compared to a full precision network, the quantized network can generalize to unseen adversarial attacks better while training only on FGSM-perturbed input. This provides a modest speedup over traditional adversarial training.