Improving Adversarial Robustness via Channel-wise Activation Suppressing

1 INTRODUCTION . Deep neural networks ( DNNs ) have become standard models for solving real-world complex problems , such as image classification ( He et al. , 2016 ) , speech recognition ( Wang et al. , 2017 ) , and natural language processing ( Devlin et al. , 2019 ) . DNNs can approximate extremely complex functions through a series of linear ( e.g . convolution ) and non-linear ( e.g . ReLU activation ) operations . Despite their superb learning capabilities , DNNs have been found to be vulnerable to adversarial examples ( or attacks ) ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) , where small perturbations on the input can easily subvert the model ’ s prediction . Adversarial examples can transfer across different models ( Liu et al. , 2017 ; Wu et al. , 2020a ; Wang et al. , 2021 ) and remain destructive even in the physical world ( Kurakin et al. , 2016 ; Duan et al. , 2020 ) , raising safety concerns in autonomous driving ( Eykholt et al. , 2018 ) and medical diagnosis ( Ma et al. , 2021 ) . Existing defense methods against adversarial examples include input denoising ( Liao et al. , 2018 ; Bai et al. , 2019 ) , defensive distillation ( Papernot et al. , 2016 ) , gradient regularization ( Gu & Rigazio , 2014 ) , model compression ( Das et al. , 2018 ) and adversarial training ( Goodfellow et al. , 2015 ; Madry et al. , 2018 ; Wang et al. , 2019 ) , amongst which adversarial training has demonstrated the most reliable robustness ( Athalye et al. , 2019 ; Croce & Hein , 2020b ) . Adversarial training is a data augmentation technique that trains DNNs on adversarial rather than natural examples . In adversarial training , natural examples are augmented ( or perturbed ) with the worst-case perturbations found within a small Lp-norm ball around them . This augmentation has been shown to effectively smooth out the loss landscape around the natural examples , and force the network to focus more on the pixels that are most relevant to the class . Apart from these interpretations , it is still not well understood , * Equal contribution . †Correspondence to : Yisen Wang ( yisen.wang @ pku.edu.cn ) , Shu-Tao Xia ( xiast @ sz.tsinghua.edu.cn ) . ar X iv :2 10 3 . 08 30 7v 1 [ cs .L G ] 1 1 M ar 2 02 1 from the activation perspective , how small input perturbations accumulate across intermediate layers to subvert the final output , and how adversarial training can help mitigate such an accumulation . The study of intermediate layer activation has thus become crucial for developing more in-depth understanding and robust DNNs . In this paper , we show that , if studied from a channel-wise perspective , strong connections between certain characteristics of intermediate activation and adversarial robustness can be established . Our channel-wise analysis is motivated by the fact that different convolution filters ( or channels ) learn different patterns , which when combined together , describe a specific type of object . Here , adversarial examples are investigated from a new perspective of channels in activation . Different from the existing activation works assuming different channels are of equal importance , we focus on the relationship between channels . Intuitively , different channels of an intermediate layer contribute differently to the class prediction , thus have different levels of vulnerabilities ( or robustness ) to adversarial perturbations . Given an intermediate DNN layer , we first apply global average pooling ( GAP ) to obtain the channel-wise activation , based on which , we show that the activation magnitudes of adversarial examples are higher than that of natural examples . This means that adversarial perturbations generally have the signal-boosting effect on channels . We also find that the channels are activated more uniformly by adversarial examples than that by natural examples . In other words , some redundant ( or low contributing ) channels that are not activated by natural examples , yet are activated by adversarial examples . We show that adversarial training can effectively address the high magnitude problem , yet fails to address the uniform channel activation problem , that is , some redundant and low contributing channels are still activated . This to some extent explains why adversarial training works but its performance is not satisfactory . Therefore , we propose a new training strategy named Channel-wise Activation Suppressing ( CAS ) , which adaptively learns ( with an auxiliary classifier ) the importance of different channels to class prediction , and leverages the learned channel importance to adjust the channels dynamically . The robustness of existing state-of-the-art adversarial training methods can be consistently improved if applied with our CAS training strategy . Our key contributions are summarized as follows : • We identify , from a channel-wise activation perspective , two connections between DNN activation and adversarial robustness : 1 ) the activation of adversarial examples are of higher magnitudes than that of natural examples ; and 2 ) the channels are activated more uniformly by adversarial examples than that by natural examples . Adversarial training only addresses the first issue of high activation magnitudes , yet fails to address the second issue of uniform channel activation . • We propose a novel training strategy to train robust DNN intermediate layers via Channelwise Activation Suppressing ( CAS ) . In the training phase , CAS suppresses redundant channels dynamically by reweighting the channels based on their contributions to the class prediction . CAS is a generic intermediate-layer robustification technique that can be applied to any DNNs along with existing defense methods . • We empirically show that our CAS training strategy can consistently improve the robustness of current state-of-the-art adversarial training methods . It is generic , effective , and can be easily incorporated into many existing defense methods . We also provide a complete analysis on the benefit of channel-wise activation suppressing to adversarial robustness . 2 RELATED WORK . Adversarial Defense . Many adversarial defense techniques have been proposed since the discovery of adversarial examples . Among them , many were found to have caused obfuscated gradients and can be circumvented by Back Pass Differentiable Approximation ( BPDA ) , Expectation over Transformation ( EOT ) or Reparameterization ( Athalye et al. , 2019 ) . Adversarial training ( AT ) has been demonstrated to be the most effective defense ( Madry et al. , 2018 ; Wang et al. , 2019 ; 2020b ) , which solves the following min-max optimization problem : min θ max x′∈B ( x ) L ( F ( x′ , θ ) , y ) , ( 1 ) where , F is a DNN model with parameters θ , x is a natural example with class label y , x′ is the adversarial example within the Lp-norm ball B ( x ) = { x′ : ‖ x′ − x ‖p≤ } centered at x , F ( x′ , θ ) is the output of the network , and L is the classification loss ( e.g . the cross-entropy loss ) . The inner maximization problem is dependent on the adversarial examples x′ generated within the -ball , while the outer minimization problem optimizes model parameters under the worst-case perturbations found by the inner maximization . There are other variants of adversarial training with some new objective function or regularization . For example , TRADES ( Zhang et al. , 2019 ) optimized a trade-off objective of adversarial robustness and accuracy . MART ( Wang et al. , 2020c ) applied a distinctive emphasis on misclassified versus correctly classified examples . AWP ( Wu et al. , 2020b ) incorporated the regularization on the weight loss landscape . However , apart from these improvements , it is still not well understood how adversarial training can help produce stateof-the-art robustness from the activation perspective . Activation Perspective of Adversarial Robustness . Some previous works have investigated the adversarial robustness from the architecture perspective , such as skip connection ( Wu et al. , 2020a ) and batch normalization ( Galloway et al. , 2019 ) . As for intermediate activation , Ma et al . ( 2018 ) characterized that adversarial activation forms an adversarial subspace that has much higher intrinsic dimensionality . Zhang et al . ( 2018 ) certified the robustness of neural networks with different activation functions . Xu et al . ( 2019 ) explored the influence of adversarial perturbations on activation from suppression , promotion and balance perspectives . Other works developed new activation operations with the manifold-interpolating data-dependent function ( Wang et al. , 2020a ) and adaptive quantization techniques ( Rakin et al. , 2018 ) . While these works directly modify the activation functions , there are also works focusing on the activation outputs . For instance , k-Winner-Takes-All ( kWTA ) ( Xiao et al. , 2020 ) taked the largest k feature values in each activation layer to enhance adversarial robustness . However , this has recently been shown not robust against adaptive attacks ( Tramer et al. , 2020 ) . Stochastic Activation Pruning ( SAP ) ( Dhillon et al. , 2018 ) taked the randomness and the value of features into consideration . Each activation is chosen with a probability proportional to its absolute value . Adversarial Neural Pruning ( ANP ) ( Madaan & Hwang , 2020 ) pruned out the features that are vulnerable to adversarial inputs using Bayesian method . Prototype Conformity Loss ( PCL ) ( Mustafa et al. , 2019 ) was proposed to cluster class-wise features and push class centers away from each other . Feature Denoising ( FD ) ( Xie et al. , 2019 ) added denoising layers to the network for sample-wise denoising on feature maps . However , these methods were developed based on observations on the full output ( e.g . the entire feature or activation map that does not distinguish different channels ) of DNN intermediate layers . In contrast , our CAS explores both channel importance and channel correlations , and the suppressing is done with the guidance of the labels . 3 CHANNEL-WISE ACTIVATION AND ADVERSARIAL ROBUSTNESS . In this part , we investigate two characteristics of DNN intermediate activation from a channel-wise perspective , and show two empirical connections between channel-wise activation and adversarial robustness . Specifically , we train ResNet-18 ( He et al. , 2016 ) and VGG16 ( Simonyan & Zisserman , 2014 ) on CIFAR-10 ( Krizhevsky et al. , 2009 ) using both standard training and adversarial training under typical settings . We then apply global average pooling to extract the channel-wise activation from the penultimate layer . We investigate the extracted channel-wise activation of both natural and adversarial examples from two perspectives : 1 ) the magnitude of the activation , and 2 ) the activation frequency of the channels . Channel-wise Activation Magnitude . Figure 1 illustrates the averaged activation magnitudes for both natural test examples and the corresponding adversarial examples crafted by PGD-20 attack ( Madry et al. , 2018 ) . For standard models ( trained on natural examples ) , the activation magnitudes of adversarial examples are generally higher than that of natural examples as shown in Figure 1 ( a ) /1 ( c ) . Adversarial perturbation exhibits a clear signal-boosting effect on the channels , which leads to the accumulation of adversarial distortions from the input to the output layer of the network . As shown in Figure 1 ( b ) /1 ( d ) , adversarial training can effectively narrow the magnitude gaps between natural and adversarial examples , interestingly by decreasing the activation magnitudes of adversarial examples . This is because adversarial training can restrict the Lipschiz constant of the model at deeper layers ( i.e . layers close to the output ) , which reduces the magnitude gaps caused by adversarial perturbations ( Finlay et al. , 2018 ; Sinha et al. , 2019 ) . Note that network architecture also influences activation magnitudes . Figure 1 show that magnitudes in VGG have much more zero values than those in ResNet , i.e . VGG produces more sparse channels than ResNet . Channel-wise Activation Frequency . Given a specific class , different convolution filters learn different patterns associated with the class . Similar to the robust vs. non-robust feature differentiation in adversarial training ( Ilyas et al. , 2019 ) , the intermediate filters ( or channels ) can also be robust or non-robust . Intuitively , for natural examples in the same class , robust channels produce more generic patterns and should be activated more frequently , yet the non-robust ones should be activated less frequently . As such , non-robust channels can cause more variations to the next layer if activated by adversarial perturbations , increasing the vulnerability to adversarial examples . To investigate this , we visualize the activation frequency of the channel-wise activation in Figure 2 . Here , we take one specific class ( e.g . class 0 ) of CIFAR-10 as an example . A channel is determined as activated if its activation value is larger than a threshold ( e.g . 1 % of the maximum activation value over all 512 channels ) . We count the activation frequency for each channel by natural examples and their PGD adversarial examples separately on standard or adversarially trained ResNet-18 models , and sort the channels in a descending order according to the activation frequency by natural examples . As can be observed in Figure 2 ( a ) , adversarial examples activate the channels more uniformly , and they tend to frequently activate those that are rarely activated by natural examples ( e.g . the right region in Figure 2 ( a ) ) . This observation is consistent across different classes . The low frequency channels are non-robust channels , and correspond to those redundant activation that are less important for the class prediction . It can also be observed that adversarial perturbations also inhibit those high frequency channels of natural examples ( the left region of Figure 2 ( a ) ) . Figure 2 ( b ) shows that , by training on adversarial examples , adversarial training can force the channels to be activated in a similar frequency by both natural and adversarial examples . However , there are still a certain proportion of the redundant channels ( e.g . channels # 350 - # 500 ) that are activated by adversarial examples . This motivates us to propose a Channel-wise Activation Suppressing ( CAS ) training strategy to avoid those redundant channels from being activated by adversarial examples . Figure 2 ( c ) shows the effectiveness of our CAS strategy applied with adversarial training , that is , our CAS can suppress all channels , especially those low frequency ones on natural examples . More visualizations of channel-wise activation frequency can be found in Appendix C .

Summary: The authors studied the behavior of adversarial examples from the channel view of activations, which is very novel. They focused on the magnitude and frequency of activations and found that state-of-the-art adversarial defense (adversarial training) only addressed the magnitude issue but the frequency distribution issue remains. This provided a novel perspective for us to understand why state-of-the-art adversarial training method works to a certain extent but not so good. Then, the authors proposed a Channel-wise Activation Suppressing (CAS) to address the frequency distribution to further improve the adversarial robustness. CAS is generic, effective, and can be easily incorporated into many existing defense methods.