Defensive Tensorization: Randomized Tensor Parametrization for Robust Neural Networks

1 INTRODUCTION . Deep neural networks ( DNNs ) are powerful predictive models that achieve impressive accuracy across a wide range of artificial intelligence tasks , including image classification ( He et al. , 2016 ; Krizhevsky & Hinton , 2009 ) and speech recognition ( Amodei et al. , 2016a ; Graves et al. , 2013 ; Graves & Jaitly , 2014 ) . The popularity of DNNs in production-ready systems has raised a serious security concern as DNNs are found to be susceptible to a wide range of adversarial attacks ( Madry et al. , 2017 ; Akhtar & Mian , 2018 ; Dong et al. , 2018 ; Huang et al. , 2017 ; Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ) , where small and imperceptible perturbations of the input data lead to incorrect predictions by the networks . These shortcomings pose an obstacle in wide-scale adoption of DNNs and expose an inherent weakness in their reliability . This is especially important when such models become part of security and safety related solutions ( Amodei et al. , 2016b ) . This susceptibility of DNNs to adversarial perturbations has led to a large volume of work that attempts to design robust networks ( Dhillon et al. , 2018 ; Lin et al. , 2019 ; Samangouei et al. , 2018 ; Song et al. , 2017 ; Guo et al. , 2017 ) . However , advances in designing robust DNNs have been followed with stronger perturbation schemes that defeat such defences ( Athalye et al. , 2018 ) . Most defenses that rely on randomization , either apply randomized transformations to the input , e.g . ( Xie et al. , 2018 ) , or randomization applied within the network , e.g. , on the activations ( Dhillon et al. , 2018 ) or on the weights directly ( Wang et al. , 2018 ) . However , all these approaches typically introduce artificats ( e.g . sparsity in the weights or activations ) and can be defeated by carefully crafted attacks ( Athalye et al. , 2018 ) . In addition , it is preferable to not to rely on modifications of the inputs but have a network that is inherently robust against attacks . In this paper , we take a different approach to randomization . We first parametrize the network using tensor factorization , effectively introducing a latent subspace spanning the weights . We then apply randomization in that latent subspace , enabling us to create models that are robust to adversarial attacks , without modifying directly the weights , activations or inputs . In summary , we make the following contributions : • We propose a novel adversarial defence technique that relies on a latent randomized tensor parametrization of each layer in the network and can be seamlessly integrated within any network architecture . • We thoroughly evaluate the robustness of our method against various adversarial attacks and show that it consistently and significantly improves over the current state-of-the-art especially when combined with adversarial training . • We show that our method successfully hardens the models against these attacks for both quantized and real-valued nets . • We verify that our strategy works across domains , by experimenting on both image-based and audio-based classification . 2 RELATED WORK . In this Section , we review the related work on adversarial attacks ( Section 2.1 ) and defences ( Section 2.2 ) , followed by an overview of tensor methods for deep learning ( Section 2.3 ) . 2.1 ADVERSARIAL ATTACKS . First , we review a few of the most popular adversarial attacks alongside the current defense strategies employed . Given a data sample , e.g. , an image X , an adversary will try to find a small perturbation , often imperceptible to a human eye , but that , added to the input sample , will cause it to be misclassified by the target model , with high confidence . Mathematically , the attacked generates a perturbation ∆ bounded in terms of some ` p norm , i.e . ‖∆‖p ≤ , typically with p = 2 or p = ∞ . The adversarial sample is obtained by adding the perturbation to the input sample Xadv = X + ∆ . Several ways of obtaining this adversarial perturbations have been proposed ( Goodfellow et al. , 2014 ; Athalye et al. , 2018 ; Carlini & Wagner , 2017 ) . Among them , black box attacks , consider the network as a black-box in which the attacker has no information regarding its architecture or the gradients . White-box attacks on the contrary , assume complete access to the network architecture and all its parameters . Moreover , attacks can either be untargeted , in which case the goal is simply to make the network predict any wrong label , or targeted , in which case the aim is to force the network to predict a specific label , independently from the input sample . Next , we introduce the main white-box attacks used in this paper . Fast Gradient Sign Method ( FGSM ) is a single-step , gradient based technique , introduced by Goodfellow et al . ( 2014 ) to generate ` ∞-bounded adversarial perturbations as follows : Xadv = X + · sgn ( ∇XL ( θ , X , y ) ) ( 1 ) where θ is the parameters of the target neural network . While the single gradient-step nature of FGSM makes it better for transferability attacks , this can also lead to a suboptimal ascent direction . Basic Iterative Method ( BIM ) and Projected Gradient Descend ( PGD ) aims to address the shortcoming of FGSM by running it for several iterations . Kurakin et al . ( 2016 ) propose BIM , in which the FGSM is run for for several iteration , clipping the values of the perturbation at each step to be inside the bounds . Madry et al . ( 2017 ) further improve upon this by prepending BIM with a random start and replacing clipping with a projection onto the acceptable set : X t+1adv = ΠX+S ( X t adv + α · sgn ( ∇XL ( θ , Xtadv , y ) ) , ( 2 ) where α is the step size and ΠX+S is a projection operation forcing the generated adversarial samples to be in the ` p ball S around X . A model resilient to PGD attacks is considered to be reasonably resistant to all first order attacks ( Madry et al. , 2017 ) . 2.2 ADVERSARIAL DEFENCES . Despite recent advances , developing robust neural networks remains an open , challenging problem ( Athalye et al. , 2018 ) . Current defense strategies typically attempt to either detect the adversarial samples and denoise them , or inject adversarial samples during training . The latter is known as adversarial training ( Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ; Madry et al. , 2017 ) and is considered the most resilient defense technique . However , the above mentioned defences typically do not increase the robustness to black box attacks . In addition they can typically be defeated using two-step approaches ( Tramèr et al. , 2017 ) . Feature squeezing is another model hardening approach introduced by Xu et al . ( 2017 ) . This technique proposes to reduce the complexity of the data representation which in turn causes the adversarial perturbations to disappear due to lower sensitivity . Guo et al . ( 2017 ) proposes a set of five transformation , namely image cropping and re-scaling , bitdepth reduction , JPEG compression , pixel dropping and image quilting , that applied to the image to increase the robustness to adversarial attacks of a given model . However , even the combination of all these transformations was shown to be vulnerable to carefully tuned attacks ( Athalye et al. , 2018 ) . Samangouei et al . ( 2018 ) introduces the so-called Defense-GAN technique . The main idea is to project the samples into the manifold of a generator before classifying them . Similarly , Song et al . ( 2017 ) uses a PixelCNN instead of a generative model . Despite the variety of recently proposed defence strategies , in ( Athalye et al. , 2018 ) the authors show that most of the existing defense techniques rely on one form of gradient obfuscation ( gradients shattering , stochastic gradients and vanishing/exploding gradients ) , proposing both a method to detect such class of defences and to defeat them . As opposed to all the aforementioned works which either manipulate the data samples ( Samangouei et al. , 2018 ; Song et al. , 2017 ; Guo et al. , 2017 ) or introduce stochasticity on the activations ( Dhillon et al. , 2018 ) or weights Wang et al . ( 2018 ) of each layer , we propose a novel defense strategy that leverages tensor factorization of the weights in order to apply randomization in that latent space , before reconstructing the weights the weights . The approach is introduced in details in section 3 . 2.3 TENSOR METHODS IN DEEP LEARNING AND RANDOMIZED TENSOR DECOMPOSITION . Tensors are high dimensional generalizations of matrices ( Kolda & Bader , 2009 ) . Recently , tensor decompositions have found a surge of applications in deep learning , mainly focusing on networks compression and acceleration . By parametrizing layers of neural networks using tensor decomposition , or even whole networks ( Kossaifi et al. , 2019a ) , the number of parameters can be reduced with little to no loss of performance , and in some cases the operations can be done more efficiently ( Lebedev et al. , 2015 ; Novikov et al. , 2015 ; Kim et al. , 2016 ; Astrid & Lee , 2017 ) . In some cases , tensor decompositions can exhibit high computational cost and possibly low convergence rates when applied to massive data . To accelerate computation , and enable them to scale , several randomized tensor decompositions have been developed . In this way , CP decomposition can be done by selecting randomly elements from the original tensor ( Battaglino et al. , 2018 ) , or using randomization to solve the problem on one or several smaller tensors before projecting back the result to the original space ( Erichson et al. , 2017 ; Sidiropoulos et al. , 2014 ; Vervliet et al. , 2014 ) . Wang et al . ( 2015 ) proposed a fast yet provable randomized CP decomposition using FFT to perform tensor contraction . Randomization approaches have also be explored for fast approximation of other tensor decompositions , e.g. , Tucker decomposition via sketching ( Tsourakakis , 2010 ; Zhou et al. , 2014 ) and tensor ring using tensor random projections ( Yuan et al. , 2019 ) . These methods are orthogonal to our approach and can be combined with it . As opposed to the aforementioned works , which focus on compression or efficiency , we explore tensor factorization methods in the context of adversarial defense , proposing a novel approach in which the weight tensor of each convolutional layer are parametrized using a randomized tensor decomposition that significantly hardens the model , increasing its robustness to a wide range of adversarial attacks . Our method is generic and can be applied to both real-valued networks and binary ones . In addition , it is orthogonal to the existing defence methods and can be combined with existing defenses such as adversarial training . The method is introduced in details in section 3 . 3 DEFENSIVE TENSORIZATION . In this section , we introduce our method for the defense against adversarial attack . Our defense leverages a randomized higher-order factorization method , which is used as the basis for our defense . Typically , defensive methods relying on randomization do so by introducing sparsity in either the weights or the input activation tensors of the layers of the deep neural neural network . For instance , Dhillon et al . ( 2018 ) sparsify the input tensor , by stochastically pruning some of the activations and scaling up the remaining ones . Wang et al . ( 2018 ) apply sparsification to the weights directly using dropout both during training and testing . However , all these approaches degrade per- formance by setting activations to zero , and , while rescaling the non-zero entries can mitigate the issue , increasing the sparsity ( and therefore the efficiency of the defense ) translates into large losses in performance . By contrast , we propose to rely on a latent parametrization of the layers using tensor decomposition . Intuitively , a latent subspace spanning the weights is learnt , along with a non-linear projection to and from that subspace . The sparsity inducing randomization is applied in the latent space . Upon projection , the resulting weights are dense and yet preserve the robustness against adversarial attacks . This allows us to built models that are both more robust to adversarial methods than existing works , while preserving high classification accuracy . Notation : Throughout the papers , we denote vectors ( 1storder tensors ) as small bold letters v , matrices ( 2ndorder tensors ) as bold capital letters M and tensors , which generalize the concept of matrices for orders ( number of dimensions ) higher than 2 , in capital calligraphic letters X . The n–mode product is defined , for a given tensor X ∈ RD0×D1×···×DN and a matrix M ∈ RR×Dn , as the tensor T = X ×n M ∈ RD0×···×Dn−1×R×Dn+1×···×DN , with : Ti0 , i1 , ··· , in = ∑Dn k=0 Min , kXi0 , i1 , ··· , in . Latent high-order parametrization of the network : We introduce tensor factorization in the context of deep neural networks . Note that this method is independent of the dimensionality of the input but we introduce it here , without loss of generality , for the case of a 4 dimensional kernel of 2D convolutions . Specifically , we consider a deep neural network composed of L layers convolutional layers , interlaced with non-linearities Φl , l ∈ [ 1 . . L ] . Let ’ s consider a convolutional layer l ∈ [ 1 . . L ] , taking as input an activation tensor Xl and parametrized by a weight tensor Wl ∈ RF , C , H , W , where F , C , H , W correspond respectively to number of Filters ( e.g . output channels ) , input Channels , Height and Width of the convolutional kernel . The output of that layer , after applying non-linearity , will be Φ ( Xl ? Wl ) . We introduce a latent parametrization of the weight kernelWl by expressing it as a low-rank tensor , in this paper using a Tucker decomposition Kolda & Bader ( 2009 ) . In other words we expressWl in a latent subspace as a core tensor Gl . The mapping to and from this subspace is done via factor matrices UFl , U C l , U H l and U W l : Wl = Gl ×0 UFl ×1 UCl ×2 UHl ×3 UWl . Randomizing in the latent subspace : In addition to the above deterministic decomposition , we introduce , for each layer , a randomization term stochastically controlling the rank of the decomposition . To do so , we introduce diagonal sketching matrices MF , MC , MH and MW , the diagonal entries of which are i.i.d . and follow a Bernoulli distribution parametrized by probability θ ∈ [ 0 , 1 ] . Specifically , we samples random vectors λF ∈ RO , λC ∈ RC , λH ∈ RH and λW ∈ RW , the entries of which are i.i.d . following a Bernoulli distribution parametrized by probability θ . We can then define the sketching matrices as MO = diag ( λF ) , MC = diag ( λC ) , MH = diag ( λH ) and MW = diag ( λW ) . This randomization is then applied not directly to the weight tensor W , but rather in the low-rank subspace , effectively randomizing the rank of the convolutional kernel : W̃l = ( Gl ×0 MF × · · · ×3 MW ) ︸ ︷︷ ︸ randomized core Ĝl ×0 ( UFl M > F ) × · · · ×3 ( UWl M > W ) ︸ ︷︷ ︸ randomized factors ÛFl , Û I l , Û H l , Û W l ( 3 ) This stochastic reduction of the rank can be done without affecting performance thanks to the overparametrization of deep networks , which , while crucial for learning ( Du & Lee , 2018 ; Soltanolkotabi et al. , 2018 ) , create large amounts of redundancies . In addition , since Gl ×0 MF ×0 ( UFl M > F ) = Gl ×0 ( UFl M > FMF ) , and MF , MI , MH and MW are idempotent , eq . 3 can be simplified to : W̃l = ( Gl ×0 MF × · · · ×3 MW ) ×0 UFl × · · · ×3 UWl = G̃l ×0 UFl × · · · ×3 UWl ( 4 ) In other words , we sketch the core tensor , then project it back using the original factors . An important detail is that the randomization terms from the above equation , G̃ = G ×0 MF × · · · ×N MW is never explicitly computed using actual tensor contractions . Instead , the elements sampled are directly selected from the core and the corresponding factors , which is much more computationally effective . For the binary case , we additionally apply the process from eq . ( 5 ) by plugging in eq . ( 4 ) . The randomization being done in the latent subspace , it induces no sparsity , unlike pruning or dropout based methods and the reconstructed weights are dense . Since the weights are learnt endto-end with randomization on the latent cores , the network naturally learns not to rely on any single latent component for prediction , thus learning intrinsically more robust representations . The result is a network that is naturally more robust to perturbations in the inputs .

Summary: This paper tackles the problem of designing neural network architectures that are robust to adversarial attacks. Several defense techniques against adversarial attacks have been proposed, mainly adversarial training (train on perturbed inputs) and introducing random perturbation to the weights or activations of the network. The paper claims that one limitation of the second approach is that it introduces artifacts (e.g. sparsity). The authors propose a simple but original idea to address this issue: parameterize the network's weight matrices as low rank tensors (in the Tucker format) and randomize the weights by sketching the core tensor of the Tucker decomposition (in effect, the sketching amounts to randomly setting fibers of the core tensor to 0).