Defensive Tensorization: Randomized Tensor Parametrization for Robust Neural Networks

1 INTRODUCTION . Deep neural networks ( DNNs ) are powerful predictive models that achieve impressive accuracy across a wide range of artificial intelligence tasks , including image classification ( He et al. , 2016 ; Krizhevsky & Hinton , 2009 ) and speech recognition ( Amodei et al. , 2016a ; Graves et al. , 2013 ; Graves & Jaitly , 2014 ) . The popularity of DNNs in production-ready systems has raised a serious security concern as DNNs are found to be susceptible to a wide range of adversarial attacks ( Madry et al. , 2017 ; Akhtar & Mian , 2018 ; Dong et al. , 2018 ; Huang et al. , 2017 ; Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ) , where small and imperceptible perturbations of the input data lead to incorrect predictions by the networks . These shortcomings pose an obstacle in wide-scale adoption of DNNs and expose an inherent weakness in their reliability . This is especially important when such models become part of security and safety related solutions ( Amodei et al. , 2016b ) . This susceptibility of DNNs to adversarial perturbations has led to a large volume of work that attempts to design robust networks ( Dhillon et al. , 2018 ; Lin et al. , 2019 ; Samangouei et al. , 2018 ; Song et al. , 2017 ; Guo et al. , 2017 ) . However , advances in designing robust DNNs have been followed with stronger perturbation schemes that defeat such defences ( Athalye et al. , 2018 ) . Most defenses that rely on randomization , either apply randomized transformations to the input , e.g . ( Xie et al. , 2018 ) , or randomization applied within the network , e.g. , on the activations ( Dhillon et al. , 2018 ) or on the weights directly ( Wang et al. , 2018 ) . However , all these approaches typically introduce artificats ( e.g . sparsity in the weights or activations ) and can be defeated by carefully crafted attacks ( Athalye et al. , 2018 ) . In addition , it is preferable to not to rely on modifications of the inputs but have a network that is inherently robust against attacks . In this paper , we take a different approach to randomization . We first parametrize the network using tensor factorization , effectively introducing a latent subspace spanning the weights . We then apply randomization in that latent subspace , enabling us to create models that are robust to adversarial attacks , without modifying directly the weights , activations or inputs . In summary , we make the following contributions : • We propose a novel adversarial defence technique that relies on a latent randomized tensor parametrization of each layer in the network and can be seamlessly integrated within any network architecture . • We thoroughly evaluate the robustness of our method against various adversarial attacks and show that it consistently and significantly improves over the current state-of-the-art especially when combined with adversarial training . • We show that our method successfully hardens the models against these attacks for both quantized and real-valued nets . • We verify that our strategy works across domains , by experimenting on both image-based and audio-based classification . 2 RELATED WORK . In this Section , we review the related work on adversarial attacks ( Section 2.1 ) and defences ( Section 2.2 ) , followed by an overview of tensor methods for deep learning ( Section 2.3 ) . 2.1 ADVERSARIAL ATTACKS . First , we review a few of the most popular adversarial attacks alongside the current defense strategies employed . Given a data sample , e.g. , an image X , an adversary will try to find a small perturbation , often imperceptible to a human eye , but that , added to the input sample , will cause it to be misclassified by the target model , with high confidence . Mathematically , the attacked generates a perturbation ∆ bounded in terms of some ` p norm , i.e . ‖∆‖p ≤ , typically with p = 2 or p = ∞ . The adversarial sample is obtained by adding the perturbation to the input sample Xadv = X + ∆ . Several ways of obtaining this adversarial perturbations have been proposed ( Goodfellow et al. , 2014 ; Athalye et al. , 2018 ; Carlini & Wagner , 2017 ) . Among them , black box attacks , consider the network as a black-box in which the attacker has no information regarding its architecture or the gradients . White-box attacks on the contrary , assume complete access to the network architecture and all its parameters . Moreover , attacks can either be untargeted , in which case the goal is simply to make the network predict any wrong label , or targeted , in which case the aim is to force the network to predict a specific label , independently from the input sample . Next , we introduce the main white-box attacks used in this paper . Fast Gradient Sign Method ( FGSM ) is a single-step , gradient based technique , introduced by Goodfellow et al . ( 2014 ) to generate ` ∞-bounded adversarial perturbations as follows : Xadv = X + · sgn ( ∇XL ( θ , X , y ) ) ( 1 ) where θ is the parameters of the target neural network . While the single gradient-step nature of FGSM makes it better for transferability attacks , this can also lead to a suboptimal ascent direction . Basic Iterative Method ( BIM ) and Projected Gradient Descend ( PGD ) aims to address the shortcoming of FGSM by running it for several iterations . Kurakin et al . ( 2016 ) propose BIM , in which the FGSM is run for for several iteration , clipping the values of the perturbation at each step to be inside the bounds . Madry et al . ( 2017 ) further improve upon this by prepending BIM with a random start and replacing clipping with a projection onto the acceptable set : X t+1adv = ΠX+S ( X t adv + α · sgn ( ∇XL ( θ , Xtadv , y ) ) , ( 2 ) where α is the step size and ΠX+S is a projection operation forcing the generated adversarial samples to be in the ` p ball S around X . A model resilient to PGD attacks is considered to be reasonably resistant to all first order attacks ( Madry et al. , 2017 ) . 2.2 ADVERSARIAL DEFENCES . Despite recent advances , developing robust neural networks remains an open , challenging problem ( Athalye et al. , 2018 ) . Current defense strategies typically attempt to either detect the adversarial samples and denoise them , or inject adversarial samples during training . The latter is known as adversarial training ( Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ; Madry et al. , 2017 ) and is considered the most resilient defense technique . However , the above mentioned defences typically do not increase the robustness to black box attacks . In addition they can typically be defeated using two-step approaches ( Tramèr et al. , 2017 ) . Feature squeezing is another model hardening approach introduced by Xu et al . ( 2017 ) . This technique proposes to reduce the complexity of the data representation which in turn causes the adversarial perturbations to disappear due to lower sensitivity . Guo et al . ( 2017 ) proposes a set of five transformation , namely image cropping and re-scaling , bitdepth reduction , JPEG compression , pixel dropping and image quilting , that applied to the image to increase the robustness to adversarial attacks of a given model . However , even the combination of all these transformations was shown to be vulnerable to carefully tuned attacks ( Athalye et al. , 2018 ) . Samangouei et al . ( 2018 ) introduces the so-called Defense-GAN technique . The main idea is to project the samples into the manifold of a generator before classifying them . Similarly , Song et al . ( 2017 ) uses a PixelCNN instead of a generative model . Despite the variety of recently proposed defence strategies , in ( Athalye et al. , 2018 ) the authors show that most of the existing defense techniques rely on one form of gradient obfuscation ( gradients shattering , stochastic gradients and vanishing/exploding gradients ) , proposing both a method to detect such class of defences and to defeat them . As opposed to all the aforementioned works which either manipulate the data samples ( Samangouei et al. , 2018 ; Song et al. , 2017 ; Guo et al. , 2017 ) or introduce stochasticity on the activations ( Dhillon et al. , 2018 ) or weights Wang et al . ( 2018 ) of each layer , we propose a novel defense strategy that leverages tensor factorization of the weights in order to apply randomization in that latent space , before reconstructing the weights the weights . The approach is introduced in details in section 3 . 2.3 TENSOR METHODS IN DEEP LEARNING AND RANDOMIZED TENSOR DECOMPOSITION . Tensors are high dimensional generalizations of matrices ( Kolda & Bader , 2009 ) . Recently , tensor decompositions have found a surge of applications in deep learning , mainly focusing on networks compression and acceleration . By parametrizing layers of neural networks using tensor decomposition , or even whole networks ( Kossaifi et al. , 2019a ) , the number of parameters can be reduced with little to no loss of performance , and in some cases the operations can be done more efficiently ( Lebedev et al. , 2015 ; Novikov et al. , 2015 ; Kim et al. , 2016 ; Astrid & Lee , 2017 ) . In some cases , tensor decompositions can exhibit high computational cost and possibly low convergence rates when applied to massive data . To accelerate computation , and enable them to scale , several randomized tensor decompositions have been developed . In this way , CP decomposition can be done by selecting randomly elements from the original tensor ( Battaglino et al. , 2018 ) , or using randomization to solve the problem on one or several smaller tensors before projecting back the result to the original space ( Erichson et al. , 2017 ; Sidiropoulos et al. , 2014 ; Vervliet et al. , 2014 ) . Wang et al . ( 2015 ) proposed a fast yet provable randomized CP decomposition using FFT to perform tensor contraction . Randomization approaches have also be explored for fast approximation of other tensor decompositions , e.g. , Tucker decomposition via sketching ( Tsourakakis , 2010 ; Zhou et al. , 2014 ) and tensor ring using tensor random projections ( Yuan et al. , 2019 ) . These methods are orthogonal to our approach and can be combined with it . As opposed to the aforementioned works , which focus on compression or efficiency , we explore tensor factorization methods in the context of adversarial defense , proposing a novel approach in which the weight tensor of each convolutional layer are parametrized using a randomized tensor decomposition that significantly hardens the model , increasing its robustness to a wide range of adversarial attacks . Our method is generic and can be applied to both real-valued networks and binary ones . In addition , it is orthogonal to the existing defence methods and can be combined with existing defenses such as adversarial training . The method is introduced in details in section 3 . 3 DEFENSIVE TENSORIZATION . In this section , we introduce our method for the defense against adversarial attack . Our defense leverages a randomized higher-order factorization method , which is used as the basis for our defense . Typically , defensive methods relying on randomization do so by introducing sparsity in either the weights or the input activation tensors of the layers of the deep neural neural network . For instance , Dhillon et al . ( 2018 ) sparsify the input tensor , by stochastically pruning some of the activations and scaling up the remaining ones . Wang et al . ( 2018 ) apply sparsification to the weights directly using dropout both during training and testing . However , all these approaches degrade per- formance by setting activations to zero , and , while rescaling the non-zero entries can mitigate the issue , increasing the sparsity ( and therefore the efficiency of the defense ) translates into large losses in performance . By contrast , we propose to rely on a latent parametrization of the layers using tensor decomposition . Intuitively , a latent subspace spanning the weights is learnt , along with a non-linear projection to and from that subspace . The sparsity inducing randomization is applied in the latent space . Upon projection , the resulting weights are dense and yet preserve the robustness against adversarial attacks . This allows us to built models that are both more robust to adversarial methods than existing works , while preserving high classification accuracy . Notation : Throughout the papers , we denote vectors ( 1storder tensors ) as small bold letters v , matrices ( 2ndorder tensors ) as bold capital letters M and tensors , which generalize the concept of matrices for orders ( number of dimensions ) higher than 2 , in capital calligraphic letters X . The n–mode product is defined , for a given tensor X ∈ RD0×D1×···×DN and a matrix M ∈ RR×Dn , as the tensor T = X ×n M ∈ RD0×···×Dn−1×R×Dn+1×···×DN , with : Ti0 , i1 , ··· , in = ∑Dn k=0 Min , kXi0 , i1 , ··· , in . Latent high-order parametrization of the network : We introduce tensor factorization in the context of deep neural networks . Note that this method is independent of the dimensionality of the input but we introduce it here , without loss of generality , for the case of a 4 dimensional kernel of 2D convolutions . Specifically , we consider a deep neural network composed of L layers convolutional layers , interlaced with non-linearities Φl , l ∈ [ 1 . . L ] . Let ’ s consider a convolutional layer l ∈ [ 1 . . L ] , taking as input an activation tensor Xl and parametrized by a weight tensor Wl ∈ RF , C , H , W , where F , C , H , W correspond respectively to number of Filters ( e.g . output channels ) , input Channels , Height and Width of the convolutional kernel . The output of that layer , after applying non-linearity , will be Φ ( Xl ? Wl ) . We introduce a latent parametrization of the weight kernelWl by expressing it as a low-rank tensor , in this paper using a Tucker decomposition Kolda & Bader ( 2009 ) . In other words we expressWl in a latent subspace as a core tensor Gl . The mapping to and from this subspace is done via factor matrices UFl , U C l , U H l and U W l : Wl = Gl ×0 UFl ×1 UCl ×2 UHl ×3 UWl . Randomizing in the latent subspace : In addition to the above deterministic decomposition , we introduce , for each layer , a randomization term stochastically controlling the rank of the decomposition . To do so , we introduce diagonal sketching matrices MF , MC , MH and MW , the diagonal entries of which are i.i.d . and follow a Bernoulli distribution parametrized by probability θ ∈ [ 0 , 1 ] . Specifically , we samples random vectors λF ∈ RO , λC ∈ RC , λH ∈ RH and λW ∈ RW , the entries of which are i.i.d . following a Bernoulli distribution parametrized by probability θ . We can then define the sketching matrices as MO = diag ( λF ) , MC = diag ( λC ) , MH = diag ( λH ) and MW = diag ( λW ) . This randomization is then applied not directly to the weight tensor W , but rather in the low-rank subspace , effectively randomizing the rank of the convolutional kernel : W̃l = ( Gl ×0 MF × · · · ×3 MW ) ︸ ︷︷ ︸ randomized core Ĝl ×0 ( UFl M > F ) × · · · ×3 ( UWl M > W ) ︸ ︷︷ ︸ randomized factors ÛFl , Û I l , Û H l , Û W l ( 3 ) This stochastic reduction of the rank can be done without affecting performance thanks to the overparametrization of deep networks , which , while crucial for learning ( Du & Lee , 2018 ; Soltanolkotabi et al. , 2018 ) , create large amounts of redundancies . In addition , since Gl ×0 MF ×0 ( UFl M > F ) = Gl ×0 ( UFl M > FMF ) , and MF , MI , MH and MW are idempotent , eq . 3 can be simplified to : W̃l = ( Gl ×0 MF × · · · ×3 MW ) ×0 UFl × · · · ×3 UWl = G̃l ×0 UFl × · · · ×3 UWl ( 4 ) In other words , we sketch the core tensor , then project it back using the original factors . An important detail is that the randomization terms from the above equation , G̃ = G ×0 MF × · · · ×N MW is never explicitly computed using actual tensor contractions . Instead , the elements sampled are directly selected from the core and the corresponding factors , which is much more computationally effective . For the binary case , we additionally apply the process from eq . ( 5 ) by plugging in eq . ( 4 ) . The randomization being done in the latent subspace , it induces no sparsity , unlike pruning or dropout based methods and the reconstructed weights are dense . Since the weights are learnt endto-end with randomization on the latent cores , the network naturally learns not to rely on any single latent component for prediction , thus learning intrinsically more robust representations . The result is a network that is naturally more robust to perturbations in the inputs .

Summary: In this paper, the authors propose a randomization-based tensorization framework towards robust network learning. The high-level idea of this work is to reparameterize the network parameters W of each layer with low-rank tensors, where the factor matrices are injected with randomization through randomly sampled sketching matrices. Since the randomization is is done within a subspace than directly on the weight matrix itself, the authors claim that this brings certain advantages such as less sparsity.