Improving Adversarial Robustness via Channel-wise Activation Suppressing

1 INTRODUCTION . Deep neural networks ( DNNs ) have become standard models for solving real-world complex problems , such as image classification ( He et al. , 2016 ) , speech recognition ( Wang et al. , 2017 ) , and natural language processing ( Devlin et al. , 2019 ) . DNNs can approximate extremely complex functions through a series of linear ( e.g . convolution ) and non-linear ( e.g . ReLU activation ) operations . Despite their superb learning capabilities , DNNs have been found to be vulnerable to adversarial examples ( or attacks ) ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) , where small perturbations on the input can easily subvert the model ’ s prediction . Adversarial examples can transfer across different models ( Liu et al. , 2017 ; Wu et al. , 2020a ; Wang et al. , 2021 ) and remain destructive even in the physical world ( Kurakin et al. , 2016 ; Duan et al. , 2020 ) , raising safety concerns in autonomous driving ( Eykholt et al. , 2018 ) and medical diagnosis ( Ma et al. , 2021 ) . Existing defense methods against adversarial examples include input denoising ( Liao et al. , 2018 ; Bai et al. , 2019 ) , defensive distillation ( Papernot et al. , 2016 ) , gradient regularization ( Gu & Rigazio , 2014 ) , model compression ( Das et al. , 2018 ) and adversarial training ( Goodfellow et al. , 2015 ; Madry et al. , 2018 ; Wang et al. , 2019 ) , amongst which adversarial training has demonstrated the most reliable robustness ( Athalye et al. , 2019 ; Croce & Hein , 2020b ) . Adversarial training is a data augmentation technique that trains DNNs on adversarial rather than natural examples . In adversarial training , natural examples are augmented ( or perturbed ) with the worst-case perturbations found within a small Lp-norm ball around them . This augmentation has been shown to effectively smooth out the loss landscape around the natural examples , and force the network to focus more on the pixels that are most relevant to the class . Apart from these interpretations , it is still not well understood , * Equal contribution . †Correspondence to : Yisen Wang ( yisen.wang @ pku.edu.cn ) , Shu-Tao Xia ( xiast @ sz.tsinghua.edu.cn ) . ar X iv :2 10 3 . 08 30 7v 1 [ cs .L G ] 1 1 M ar 2 02 1 from the activation perspective , how small input perturbations accumulate across intermediate layers to subvert the final output , and how adversarial training can help mitigate such an accumulation . The study of intermediate layer activation has thus become crucial for developing more in-depth understanding and robust DNNs . In this paper , we show that , if studied from a channel-wise perspective , strong connections between certain characteristics of intermediate activation and adversarial robustness can be established . Our channel-wise analysis is motivated by the fact that different convolution filters ( or channels ) learn different patterns , which when combined together , describe a specific type of object . Here , adversarial examples are investigated from a new perspective of channels in activation . Different from the existing activation works assuming different channels are of equal importance , we focus on the relationship between channels . Intuitively , different channels of an intermediate layer contribute differently to the class prediction , thus have different levels of vulnerabilities ( or robustness ) to adversarial perturbations . Given an intermediate DNN layer , we first apply global average pooling ( GAP ) to obtain the channel-wise activation , based on which , we show that the activation magnitudes of adversarial examples are higher than that of natural examples . This means that adversarial perturbations generally have the signal-boosting effect on channels . We also find that the channels are activated more uniformly by adversarial examples than that by natural examples . In other words , some redundant ( or low contributing ) channels that are not activated by natural examples , yet are activated by adversarial examples . We show that adversarial training can effectively address the high magnitude problem , yet fails to address the uniform channel activation problem , that is , some redundant and low contributing channels are still activated . This to some extent explains why adversarial training works but its performance is not satisfactory . Therefore , we propose a new training strategy named Channel-wise Activation Suppressing ( CAS ) , which adaptively learns ( with an auxiliary classifier ) the importance of different channels to class prediction , and leverages the learned channel importance to adjust the channels dynamically . The robustness of existing state-of-the-art adversarial training methods can be consistently improved if applied with our CAS training strategy . Our key contributions are summarized as follows : • We identify , from a channel-wise activation perspective , two connections between DNN activation and adversarial robustness : 1 ) the activation of adversarial examples are of higher magnitudes than that of natural examples ; and 2 ) the channels are activated more uniformly by adversarial examples than that by natural examples . Adversarial training only addresses the first issue of high activation magnitudes , yet fails to address the second issue of uniform channel activation . • We propose a novel training strategy to train robust DNN intermediate layers via Channelwise Activation Suppressing ( CAS ) . In the training phase , CAS suppresses redundant channels dynamically by reweighting the channels based on their contributions to the class prediction . CAS is a generic intermediate-layer robustification technique that can be applied to any DNNs along with existing defense methods . • We empirically show that our CAS training strategy can consistently improve the robustness of current state-of-the-art adversarial training methods . It is generic , effective , and can be easily incorporated into many existing defense methods . We also provide a complete analysis on the benefit of channel-wise activation suppressing to adversarial robustness . 2 RELATED WORK . Adversarial Defense . Many adversarial defense techniques have been proposed since the discovery of adversarial examples . Among them , many were found to have caused obfuscated gradients and can be circumvented by Back Pass Differentiable Approximation ( BPDA ) , Expectation over Transformation ( EOT ) or Reparameterization ( Athalye et al. , 2019 ) . Adversarial training ( AT ) has been demonstrated to be the most effective defense ( Madry et al. , 2018 ; Wang et al. , 2019 ; 2020b ) , which solves the following min-max optimization problem : min θ max x′∈B ( x ) L ( F ( x′ , θ ) , y ) , ( 1 ) where , F is a DNN model with parameters θ , x is a natural example with class label y , x′ is the adversarial example within the Lp-norm ball B ( x ) = { x′ : ‖ x′ − x ‖p≤ } centered at x , F ( x′ , θ ) is the output of the network , and L is the classification loss ( e.g . the cross-entropy loss ) . The inner maximization problem is dependent on the adversarial examples x′ generated within the -ball , while the outer minimization problem optimizes model parameters under the worst-case perturbations found by the inner maximization . There are other variants of adversarial training with some new objective function or regularization . For example , TRADES ( Zhang et al. , 2019 ) optimized a trade-off objective of adversarial robustness and accuracy . MART ( Wang et al. , 2020c ) applied a distinctive emphasis on misclassified versus correctly classified examples . AWP ( Wu et al. , 2020b ) incorporated the regularization on the weight loss landscape . However , apart from these improvements , it is still not well understood how adversarial training can help produce stateof-the-art robustness from the activation perspective . Activation Perspective of Adversarial Robustness . Some previous works have investigated the adversarial robustness from the architecture perspective , such as skip connection ( Wu et al. , 2020a ) and batch normalization ( Galloway et al. , 2019 ) . As for intermediate activation , Ma et al . ( 2018 ) characterized that adversarial activation forms an adversarial subspace that has much higher intrinsic dimensionality . Zhang et al . ( 2018 ) certified the robustness of neural networks with different activation functions . Xu et al . ( 2019 ) explored the influence of adversarial perturbations on activation from suppression , promotion and balance perspectives . Other works developed new activation operations with the manifold-interpolating data-dependent function ( Wang et al. , 2020a ) and adaptive quantization techniques ( Rakin et al. , 2018 ) . While these works directly modify the activation functions , there are also works focusing on the activation outputs . For instance , k-Winner-Takes-All ( kWTA ) ( Xiao et al. , 2020 ) taked the largest k feature values in each activation layer to enhance adversarial robustness . However , this has recently been shown not robust against adaptive attacks ( Tramer et al. , 2020 ) . Stochastic Activation Pruning ( SAP ) ( Dhillon et al. , 2018 ) taked the randomness and the value of features into consideration . Each activation is chosen with a probability proportional to its absolute value . Adversarial Neural Pruning ( ANP ) ( Madaan & Hwang , 2020 ) pruned out the features that are vulnerable to adversarial inputs using Bayesian method . Prototype Conformity Loss ( PCL ) ( Mustafa et al. , 2019 ) was proposed to cluster class-wise features and push class centers away from each other . Feature Denoising ( FD ) ( Xie et al. , 2019 ) added denoising layers to the network for sample-wise denoising on feature maps . However , these methods were developed based on observations on the full output ( e.g . the entire feature or activation map that does not distinguish different channels ) of DNN intermediate layers . In contrast , our CAS explores both channel importance and channel correlations , and the suppressing is done with the guidance of the labels . 3 CHANNEL-WISE ACTIVATION AND ADVERSARIAL ROBUSTNESS . In this part , we investigate two characteristics of DNN intermediate activation from a channel-wise perspective , and show two empirical connections between channel-wise activation and adversarial robustness . Specifically , we train ResNet-18 ( He et al. , 2016 ) and VGG16 ( Simonyan & Zisserman , 2014 ) on CIFAR-10 ( Krizhevsky et al. , 2009 ) using both standard training and adversarial training under typical settings . We then apply global average pooling to extract the channel-wise activation from the penultimate layer . We investigate the extracted channel-wise activation of both natural and adversarial examples from two perspectives : 1 ) the magnitude of the activation , and 2 ) the activation frequency of the channels . Channel-wise Activation Magnitude . Figure 1 illustrates the averaged activation magnitudes for both natural test examples and the corresponding adversarial examples crafted by PGD-20 attack ( Madry et al. , 2018 ) . For standard models ( trained on natural examples ) , the activation magnitudes of adversarial examples are generally higher than that of natural examples as shown in Figure 1 ( a ) /1 ( c ) . Adversarial perturbation exhibits a clear signal-boosting effect on the channels , which leads to the accumulation of adversarial distortions from the input to the output layer of the network . As shown in Figure 1 ( b ) /1 ( d ) , adversarial training can effectively narrow the magnitude gaps between natural and adversarial examples , interestingly by decreasing the activation magnitudes of adversarial examples . This is because adversarial training can restrict the Lipschiz constant of the model at deeper layers ( i.e . layers close to the output ) , which reduces the magnitude gaps caused by adversarial perturbations ( Finlay et al. , 2018 ; Sinha et al. , 2019 ) . Note that network architecture also influences activation magnitudes . Figure 1 show that magnitudes in VGG have much more zero values than those in ResNet , i.e . VGG produces more sparse channels than ResNet . Channel-wise Activation Frequency . Given a specific class , different convolution filters learn different patterns associated with the class . Similar to the robust vs. non-robust feature differentiation in adversarial training ( Ilyas et al. , 2019 ) , the intermediate filters ( or channels ) can also be robust or non-robust . Intuitively , for natural examples in the same class , robust channels produce more generic patterns and should be activated more frequently , yet the non-robust ones should be activated less frequently . As such , non-robust channels can cause more variations to the next layer if activated by adversarial perturbations , increasing the vulnerability to adversarial examples . To investigate this , we visualize the activation frequency of the channel-wise activation in Figure 2 . Here , we take one specific class ( e.g . class 0 ) of CIFAR-10 as an example . A channel is determined as activated if its activation value is larger than a threshold ( e.g . 1 % of the maximum activation value over all 512 channels ) . We count the activation frequency for each channel by natural examples and their PGD adversarial examples separately on standard or adversarially trained ResNet-18 models , and sort the channels in a descending order according to the activation frequency by natural examples . As can be observed in Figure 2 ( a ) , adversarial examples activate the channels more uniformly , and they tend to frequently activate those that are rarely activated by natural examples ( e.g . the right region in Figure 2 ( a ) ) . This observation is consistent across different classes . The low frequency channels are non-robust channels , and correspond to those redundant activation that are less important for the class prediction . It can also be observed that adversarial perturbations also inhibit those high frequency channels of natural examples ( the left region of Figure 2 ( a ) ) . Figure 2 ( b ) shows that , by training on adversarial examples , adversarial training can force the channels to be activated in a similar frequency by both natural and adversarial examples . However , there are still a certain proportion of the redundant channels ( e.g . channels # 350 - # 500 ) that are activated by adversarial examples . This motivates us to propose a Channel-wise Activation Suppressing ( CAS ) training strategy to avoid those redundant channels from being activated by adversarial examples . Figure 2 ( c ) shows the effectiveness of our CAS strategy applied with adversarial training , that is , our CAS can suppress all channels , especially those low frequency ones on natural examples . More visualizations of channel-wise activation frequency can be found in Appendix C .

Summary: This paper studies the use of channel suppression in improving robustness to adversarial examples. The authors make a convincing illustration in section 3 on how adversarial examples tend to activate more channels compared to natural examples, and adversarial training is not effective in reducing them. This provides a convincing motivation to their design of the Channel-wise Activation Suppression (CAS) module. Their CAS module is also effective in improving adversarial robustness when used in conjunction with different adversarial defense methods, including adversarial training, TRADES, and MART.