Holistic Adversarially Robust Pruning
Authors: Qi Zhao
Christian Wressnegger
Venue: ICLR 2023 poster (2023)
Keywords: adversarial robustness
model pruning

Abstract: Neural networks can be drastically shrunk in size by removing redundant parameters. While crucial for the deployment on resource-constraint hardware, oftentimes, compression comes with a severe drop in accuracy and lack of adversarial robustness. Despite recent advances, counteracting both aspects has only succeeded for moderate compression rates so far. We propose a novel method, HARP, that copes with aggressive pruning significantly better than prior work. For this, we consider the network holistically. We learn a global compression strategy that optimizes how many parameters (compression rate) and which parameters (scoring connections) to prune specific to each layer individually. Our method fine-tunes an existing model with dynamic regularization, that follows a step-wise incremental function balancing the different objectives. It starts by favoring robustness before shifting focus on reaching the target compression rate and only then handles the objectives equally. The learned compression strategies allow us to maintain the pre-trained model’s natural accuracy and its adversarial robustness for a reduction by 99% of the network’s original size. Moreover, we observe a crucial influence of non-uniform compression across layers. The implementation of HARP is publicly available at https://intellisec.de/research/harp.

Published as a conference paper at ICLR 2023
HOLISTIC ADVERSARIALLY ROBUST PRUNING
Qi Zhao and Christian Wressnegger
KASTEL Security Research Labs, Karlsruhe Institute of Techhology, Germany
ABSTRACT
Neural networks can be drastically shrunk in size by removing redundant param- eters. While crucial for the deployment on shource-constrain hardware, often- times, compression comes with a severe drop in accuracy and lack of adversarial robustness. Despite recent advances, counteracting both aspects has only suc- ceeded for moderate compression rates so far. We propose novel method, HARP, that copes with aggressive pruning significantly better than prior work. For this, we consider the network holistically. We learn a global compression strategy that optimizes how many parameters (compression rate) and which parameters (scoring connections) to prune specific each layer individually. Our method fine-tunes an existing model with dynamic regularization, that follows a step-wise incremental function balancing the different objectives. It starts by favoring ro- bustness before shifting focus on reaching the target compression rate and only then handles the objectives equally. The learned compression strategies allow us maintain the pre-trained model's natural accuracy and its adversarial robustness for reduction by 99 % of the network's ' original size. Moreover, we observe a crucial influence of non-uniform compression across layers. The implementation of HARP is publicly available at htttps://intelliieee de de/rresaacchhaarg
INTRODUCTION
Deep neural networks (DNNs) yield remarkable performances in classification tasks in various do- mains (He al. 2016 Cakir & Dogdu 2018 Schroff et al. 2015 Li al. 2022) but are vulnerable to input manipulation attacks such as adversarial examples SZzgedy et al.) 2014). Small pertur- bations to benign inputs can cause worst-case errors in prediction. To date, the most promising defensive approach against this sort of attacks is adversarial training introduced by Madry et al. (2018) and further refined ever since (Shafahi et al., 2019: Zhang et al., 2019. Wang et al. 2020). It introduces adversarial examples into the training process, diminishing the generalization gap be- tween natural performance and adversarial robustness. However, there is evidence indicating that higher robustness requires pecetttrtttrr networks that have wider layers and higher structural complexity (Madry et al. 2018 Zhang et al. 2019 Wu et al. 202T). rendering the task of combining both objectives compression and robustness inherently difficult.
Neural network pruning (ann et al. 2016 Yang et al. 2017 He et al. 2017). ), for instance, has been proven be extraordinary valuable tool for compressing neural networks. The model can be reduced to a fraction of its size by removing redundancy at different structural granularity (Li et al. 2017 Mao al. 20117] Kollek et al. [2021). However, pruning inflicts a certain recession in model accuracy (Han et al. 2016) and adversarial robustness (Timpl et al.) 2021) that is unavoidable the stronger the model is compressed. The aim of adversarial robust pruning hence to maintain the accuracy and robustness of an already adversarially pre-trained model as good as possible. Despite great efforts (Ye et al. 2019 Sehwag et al. 2020 Madaan et al., 2020: Özdenizci & Legenstein Lee et al. 2022), this dual objective has only been achieved for moderate compression so far.
2021
In this paper, we start from the hypothesis that effective adversarially robust pruning requires a non- uniform compression strategy with learnable pruning masks, and propose our method HARP. We follow the three-stage pruning pipeline proposed by Han et al. (2015) to improve upon pre-trained models, where we jointly optimize score-based pruning masks and layer-wise compression rates during fine-tuning As high robustness challenges the compactness objective (Timpl et al.) 2021), employ a step-wis increasing weighted-contre control of the number of weights to be pruned, such that we can learn masks and rates simultaneously. Our approach explores a global pruning strategy that allows for on-par natural accuracy with little robustness degradation only.

---

Published as a conference paper at ICLR 2023
Accnnyy (59
Acturacy (8)
X
EAst
R-ADKOM
BC3-2
10
10
99.5%
Weight pruning
Spunity
Spursity
CIFAR-
SVIIN
Figure 1: Overview of pruning weights of a VGG16 model for CIFAR-10 (left) and SVHN (right) with PGD-10 adversarial training. Solid lines show the natural accuracy of HARP, HYDRA, Robust- ADMM and BCS-P (cf. Table 7). Dashed lines represent the robustness against AUTOATTACK.
In summary, we make the following contributions:
Novel pruning technique for pre-trained models. We optimize how many parameters and which parameters to prune for each layer individually, resulting in a global but non-uniform pruning strategy. That is, the overall network is reduced by predetermined rate governed by the target hardware's ' limits, but layers are compressed varyingly strongly. We show that both aspects are needed for HARP to take full effect (ef. [Section 4.1
Significant improvement over related work. An overview of our method's performance is presented in Fig. T for a PGD-AT trained VGGI6 model learned on CIFAR-IO (left) and SVHN (right), providing first glimpse of the yield advances. No less importantly, conduct experiments with small (CIFAR-IK 10, SVHN) as well as large-scale (ImageNet) datasets across different robust training methods and various attacks (cf. [Section 4.2)
Importance of non-uniform pruning for adversarial robustness. We emphasize the supe- riority of non-uniform strategies (Zhao et al., 2022) by extending existing adversarially robust pruning-technique
We demonstrate that HYDRA (Sehwag et al. (2020) and Robust-ADMM (Ye et al.] 2019) yield better results when used with non-uniform strategies determined by
ERK (Evci al. 2020 and LAMP (Lee al. 2021
Refcion 4.3)
NEURAL NETWORK PRUNING
Removing redundant parameters reduces a network's overall memory footprint and necessary com- putations, allowing for demand-oriented adaptation of neural networks to resource-constrained
environments (Han et al. 2015 2016, Wen et al. 2016: Huang et al., 2018 He et al. 2018 2017
7 Li
al. 2017; Mao et al. 2017: Molchanov et al. (017)) Neural network pruning attempts to find
nary mask () for each layer / a network with layers represented by its parameters and ( respectively. The overall pruming-man mask thus is denoted as M = (M()) . ..... (....M(.)..
These masks specify which parameters of the layer g( to remove (zero out) and which to keep, yielding reduced parameter set (()) (()) c ( where @ is the Hadamard product. Based on this, we define the overall compression rate a as the ratio of parameters preserved after pruning, 2o. to the number of parameters in the model, O. Compression rates for individual layers a are defined analogously. Note, that a network's 's sparsity is defined inversely, meaning, 99.9 % sparsity refers to a compression 0.001. In further follow, we consider (()) E Re!" xe! xx!" ( where
c. and (f) represent input and output channels, respectively, and (9) is the kernel size.
Han et al. (2055) propose a three stage pipeline for network pruning, starting with (1) training an wwer-parameterized network, followed by (2) removing redundancy per layer according to some pruning criterion, before (3) recovering network performance via fine-tuning. The actual pruning strategy, that decides on the pruning mask M, is obtained in the second step. While integrated approaches (pruning during model training) exist (e.g., Vemparala et al. 2021 Özdenizci & Legen-
stein 2021), the staged process remains most common (Liu et al. 2019: Sehwag et | 2020 Lee
et al. 2022) as it allows to benefit from recent advantages in adversarial training (Shatahi et al. 2019
Zhang et al. 2019 Wang et al. 2020) out-of-the-hox.
2

---

Published as a conference paper at ICLR 2023
3 HOLISTIC ADVERSARIALLY ROBUST PRUNING
Two aspects are crucial when pruning neural networks: How many and which parameters to prune. Current state-of-the-art methods for adversarially robust pruning focus on the latter, allocating a fixed compression budget governed by the target hardware's 's limits and using it uniformly for each layer (e.g.. Ye et al. 2019; Sehwag et al. 2020). We argue that learning the optimal pruning amount- the compression rate per layer is equally crucial. HARP thus integrates measures for compression rates and scoring connections in an empirical min-max optimization problem based on adversarial training learn suitable pruning mask M for pre-trained model f:
min r,S
max {Crobuet (0 ① M, x + 8.81} +y Cnw 1 ④ (MM.))).
(1)
(a (D.D)
The inner maximization generates adversarial examples from benign input æ with label from a distribution D {ær, y by adding noise 8, and incorporates these when minimizing the training loss Lce (Madry et al. 2018). The exact formulation of Lrobust depends on the pre- pre-trained model, for which we evaluate PGD-AT (Madry et al.) 2018). TRADES -AT (Zhang al., (019), and MART- AT (Wang et al.] 2020). Simultaneously, the model is subject to pruning mask M that involves two parameters: First, the compression quota r, which is learnable representation of compression rates, and second, scores S for determining the importance of the network's 's connections. In the following, we discuss HARP'S global compression control and describe how pruning strategics are learned, before elaborate on how to dynamically regularize the training process using by following step-wise incremental function balancing the different objectives.
Global compression control. The compression control encoded as an additional loss term L that considers compression for the entire network to reach a specific target compression ar However, it explicitly allows for layer-specific rates, yielding an overall non-uniform compression strategy: We measure the number of currently preserved (i.e., non-zero) weights across all L layers of the network, , = Σ/= (Aw we l11. relative to the targeted total number of parameters at a compression rate a₂:
{ 7,a 0, 0
-1 1, o)
Luw (0, (0,
== max
-
Additionally, we clip rates that would exceed the targeted compression-rate. Constraining the loss to positive values ensures to not encourage even lower compression rates that would potentially harm accuracy and robustness unnecessarily.
For learning the layer-specific compression rates, moreover, it is crucial that constrain the reduc- tion by a minimal compression amin = 0.1 x de as we need to prevent a layer from been removed completely. We thus limit the layers' compression (1) [amann 1]. order better control learning of the optimal pruning rate this range, we introduce a trainable parameter (!)) IR, which we refer to as compression quota, and constrain it by an activation function R -> [0min, 1). For the sake of the continuous derivability on r, we use the sigmoid function squeezed to the desired output range, yielding layer-wiee wise compression rate a = g()) where g r + (1 0min) sig(r) + Omsn-
Connection importance. For learning the actual pruning mask, in turn, we introduce another leamable parameter S, the connection importance-score matrix, to rate each pruning connection. In weight pruning, 5²()) originates !R<! xce? xA xx and is assigned values from activation func- tion Additionally, we use (") s(!)) to represent the function that determines the a-th per- centile layer the cutoff threshold for pruning parameters in accordance with compression rate (1) that is: (!) compression rate (!)), the binary pruning mask M()) thus trainable and defined as:
(²)) Due to the relation with 5!!) (and therefore also with (())) via
( ( = (1 (1>>P("<))s00)
(3)
Pruning the I-th layer can hence be expressed by the Hadamard product of the mask and the model's parameters 0 yielding the pruned model parameters (()) (()) & Ml)
3

---

Published as a conference paper at ICLR 2023
Learning pruning strategies. Binarizing importance scores to obtain pruning mask as described above is a non-differemtiable operation and prevents us from performing gradient descent over the masks. We, thus, follow the "straight through estimation" (STE) strategy (Hubara et al., 2016) as proposed by Kusupati al. (2020) to assign the updated gradients to the importance scores S()
directly and proceed similarly for compression quotas pl!);
ac
UC
o0
OM
OC
00
STE
(4)
dM
0S0)
θM (0) 00(h
0C
ac
O
aM())
ac
00(1)
Og(r(1)) 9 (((1(0)
O o (((r(1)
(5)
(-(1)
00th
dM
00 (
Finally, also the initialization of the connection importance-scores is crucial. We follow the lead of Schwag et al. (2020) and initialize the scores proportional the weights of the pre-trained model and use a scaling factor 77 / /k/fam-in")) with 6 and fan-in being the product of the receptive field size and the number of input channels, Our initialization for pruning weights, hence, follows the order of weight magnitudes Ye et al. 2019):
SW
max (00) m
& x x x xk()
HARP does not use fixed ratio for pruning parameters, but learns the optimal compression rate per layer. However, for initializing the compression quota r, we first align with uniform compression strategy that sets the same rate aimit on each layer and let the optimizer improve it (cf. Appendix A.3 for more details). For the activation function g(-) defined above, we thus yield:
(1) log
ainst
Oyzan
ainit
Balancing pruning objectives. HARP strives strike a balance between natural accuracy, adver- sarial robustness and compactness. For this, we employ step-wise incremental function to adapt the regularization parameter 7 throughout the learning process. We start by favoring robustness before shifting focus on reaching the target compression rate and only then handle the objectives equally.
Fig. 2 shows the relation of y and the two differ-
ent losses, Crobust against PGD-10 and Liw. on the y-axis over the epochs on the x-axis, exemplarily for weight pruming VGG16 (learned on CIFAR- 10) with a target compression a₂ = 0.01, that is, removing 99 % of the parameters. The model starts off from the uniform strategy with Gémit = 0.1, learning to be more robust while being only slightly penalized by Liw. As the model has been adversarially pre- trained, Probust is low already. Over time, put more focus on L up until we have reached our tar- get compression (y 0.11 in this example), causing it to decrease while Lrobust increases. Afterwards, the model aims for higher robustness under the found Law penalty, balancing both objectives. In Appendix I. study the influence of different step sizes and elaborate on the progression of the model's 's natural accuracy and adversarial robustness in Appendix A.3
Crabust Dha
192
Epoch
Figure 2: HARP'S dise regularization of pruning objectives for VGG16 on CIFAR-10 with a target sparsity of 99 %.
EVALUATION
We resume to demonstrate HARP'S effectivity pruning neural networks by comparing to existing state-of-the-art methods in Section 4.2) In [Section 4.1 we then perform ablation study regard- ing the learnable parameters used by our method. In particular, we show the influence of learning compression quotas and importance scores S, separately, to demonstrate that both indeed needed for successful, holistic pruning. [Section 4.3 and Appendix A.3] we then discuss the non-uniform nature of HARP'S pruning strategy and compare novel extensions of HYDRA and
4

---

Published as a conference paper at ICLR 2023
Robust-ADMM to non-uniform compression. In the appendix, additionally present the extended comparison to related work (Appendix A.2). elaborate on the pruned model's parameter distribu- tion (Appendix A.4). show HARP's performance naturally trained models (Appendix A.5 and extend HARP to channel pruning Appendix A.6).
Experimental setup. We evaluate HARP on two scall-scale datasets, CIFAR-10 (Krizhessky et a and SVHN (Netzer et al.] (01T). While the first is balanced, the second is not. Consequently, we use accuracy (ACC) as performance measure for the former, and the balanced accuracy (BACC) for the latter (Brodersen et al., 2010). Each dataset is learned with VGG16 (Simonyan & Zis- serman 2013) and ResNet18 (He et al. 2016) model. Additionally, we show the performance on the large-scale, balanced ImageNet dataset (Deng et al.] 2009) trained with ResNet50 network. We apply y = 0.01 for small-scale datasets, and increase Y to 0.1 for ImageNet to guarantee the arrival at the target compression rate dg. In the pruning and fine-tuning phase of HARP, we train for 20 epochs and 100 epochs, respectively.
Adversarial training. We adversarially train on the small-scale datasets, CIFAR- 10 and SVHN, with PGD-AT (Madry et al., 2018). TRADES-AT (Zhang et al.) 2019), and MART-AT (Wang al. 2020). For each, we use Too PGD-10 attacks with random initialization and a perturbation strength 8/255 with step size a 2/25s. We adopt stochastic gradient descent with cosine
learning-rate schedule [Loshchilov & Hutter) 2016) and a weight decay of 0.0005 (Pang et al.) 2021 For TRADES and MART, we follow the originally proposed regularization of X 6.0 and 5.0, respectively. To accelerate the training process for the large-scale ImageNet experiments, resort to FREE-AT (Shafahi et al.) 2019) with 4 replays, reducing the pruning and fine-tuning phase to 5 epochs and 25 epochs, and use a perturbation strength e 4/255 with step size a 1/255.
Adversarial robustness evaluation. To validate the pruned networks' adversarial robustness, use C& (Carlini & Wagner (017)) optimized by PGD and PGD-10 with the same settings used for training. Furthermore, we implement AUToPGD (APGD) (Croce & Hein (020a) with cross- entropy (CE) loss, 50 steps, and 5 restarts, and AUTOATTACK (AA) (Croce & Hein (202aa) using the standard ensemble out of AUTOPGI with CE-loss, Targeted- AUToPGD FAB (Croce Hein 2020b), and SQUAREATTACK (Croce et al. 2019). All attacks are carried out on the respective complete test dataset.
4.1 ABLATION STUDY
HARP features two important components: Learning compression quotas and learning what nections to prune. While we do argue that both aspects are crucial for effective adversarial robust pruning. in this section, we out analyze whether this indeed is the case. We perform an ablation study regarding the compression quota to be learned r and determining importance scores S. For the experiments reported in Table I we thus either learn compression quotas or importance scores, while keeping the other one constant consequently, we also do not balance pruning objectives here. Note that for the optimization on compression quotas r, importance scores S remain as initialized by Fiq. (9) while during investigating the influence of scores S, we use uniform compression. We denote our method with compression-rate optimization only as HARP-r, and with importance-score optimization only HARP-S.
As already observed Fig. moderate compression manages to maintain natural accuracy and adversarial robustness very well, such that in this study, focus 99 % and 99.9 % sparsity.
Table 1: Optimizing either compression rates (HARP-T) or importance scores (HARP-S)) Natural accuracy and PGD-10 adversarial robustness are presented left and right of the character.
Model
Adv. Training
99 Sparsily
99.9 % Sparsity
HARP-P
HARP-S
HARP
HARP-F
HARP-S
HAXP
PGD
76.39 / 46.64
72.05 43.69
80.25
50.36
41.66 /2..54
$7.66 35.92
63.99
39.39
ResNet18
TRADES
73.31
1:31//5.00 44
/ 46.37 75.50
71.78/
$0.16
13.31/45.11
75.50 /46337
77.78
50.16
MART
70.08 48.38
75.27 /47.11
75.88
50.79
70.08 48.38
75.27 147.11
75.88
50.79
PGD
65.09 39..8
78.50
48.71
36.76 28.02
50.33 34.03
59.13
37.36
VGG16
TRADES
72.91/444.52
/4..9
56.08 31.51
MART
71.63//48. /8.664
64.37 /4144
73.04/
51.09
37.19 30.68
49.51 36.29
55.02
39.39
5

---

Published as a conference paper at ICLR 2023
Interestingly, HARP-r appears to be particular beneficial for moderate to high compression, while HARP-S is increasingly important for aggressive pruning. In particular for VGG16 with its cascad- ing network architecture, this tendency apparent for different pre-training strategies. However, at either sparsity level the combination of both, that is, optimizing compression rates r and importance scores S, allows HARP excel.
4.2 ROBUST PRUNING WITH HARP
In this section, we report results of our comparative evaluation with Robust-ADMM Ye ct al. 2019) HYDRA (Sehwag et al. 2020). BCS-P (Özdenizei & Legenstein 2021), and MAD Lee et al. 2022] in pruning a neural network's 's weights. In particular, for aggressive compression yielding high sparsity, HARP excels and outperforms prior work. For the comparison Robust-ADMM and HYDRA, we perform systematic evaluation with CIFAR-10, SVHN, and ImageNet. For BCS-P and MAD, we revert the respective settings reported in the original papers.
Comparison to Robust-ADMM. The method by Ye al. 2019) is designed robustly prune neural networks on cus on pruning weights at this point and present further results on pruning channels in/Appendix A.6 Tables 2 to summarize the results for pruning models on CIFAR-10. 10, SVHN, and ImageNet, re- spectively. Robust-ADMM performs well for pruning network's 's weights to sparsity of 99 % for CIFAR-10 as well as SVHN. However, its performance drops drastically when increasing sparsity to 99.9 %. For SVHN, the models are even completely damaged, yielding a balanced accuracy of 10 %. Also for ImageNet, Robust-ADMM significantly harms the model robustness and natural performance. HARP, in turn, exceeds the performance of Robust-ADMM distinctively. Models pruned by our method preserve natural accuracy and robustness significantly better for high com- pression rates: At a sparsity of 99 %, the natural accuracy and the adversarial robustness is at a comparable level to the original model on CIFAR- 10 and SVHN. Even for aggressive pruning to sparsity of 99.9 %, the models show substantial resistance against adversarial inputs across training methods and considered attackers. On ImageNet, HARP outperforms Robust-ADMM in moderate and aggressive pruning with 20 percentage points for natural accuracy and 10 percentage points for robustness against various attacks.
(weights) and coarse-graines granularity (channels/filters) We fo-
Table 2: Comparing HARP with Robust-ADMi and HYDRA on models learned on CIFAR-10.
Adv. Training
Attack Type
Pre- Trained
99 % Sparsity
99.9 & Sparsity
R-ADMM
HYDRA
BCS-P
HARP
R-ADMM
HYDRA BCS-P
HARP
01
155
11
80.131on
23.84 14
63,80
PGD
50.05
n3
15.84=120
45.63
50.41:016
26.33
13 13.17-2210
39.26
PGD
CRW
47.95
39.91
43.05
42.68
47.751017
26.08 20.00.00
12.57
36. 36.1919m
APGD
47.78
41.41107
44.032119
44.791045
48.531004
25.57
12.63125
38.05
AA
45,30
37.64
40.89
40.55
45.58
18.80
23.97
12.03
34.32:030
R8
81,30
70.731110
75.07
71.77
77.90
37.39
14
29
64.99
PGD
$3.21
41.34+ 0.33
46.60
66.60=026
44.69=055
50.25+0011
21,41=057
26.30+aa7
19.674223
37.42+0030
TRADES
C&W
50.60
37.3 37.37 n.38
42,
80
41,85
46.54-1007
20:53:20:0
17.19
33.11 20.07
APGD
$1.88
40.72+
45 45-44
43.07+04
49.20++0.13
21.19-005
25.63
19.58+2.18
36.61 +-0as
36.69
#1.99=063
41.54+a37
45.53+00.6
18.30=
14.18
19.35
32.32+0356
80.16
74.14:2001
136
18.18
75.51
27.06
15.
20.09::415
60.21
42.12+
19339-131
47,23-+018
51.21+0019
27.72-+0.9
16.9943.19
MART
C&W
48.53
37.57
43.99-006
44,62+044
46.65 +0.1
19,89
26.45 +.76
17.04++..1
36.36+
APGD
$1.59
41. $1.34=t0ss 0.s
47.84=
107
46.04-2as
501.26+::15
18.04 1004:100
26.91 1:04
16.67:t:26
40,82
AA
46.39
36.68+
42.08-0.5
43,23+051
44.89+020
17.05
23.78+1188
14.97+281
34.95 +-25
79.68
0422
17.
70.07
78.21
21.28
23.41
10.00:::m
PGD
47,60
48.591111
20.58 17.45122
10.00::m
37.62
C&W
45.23
34.35
41.35
45.151033
17
20.991n98
10.001.0
13.93
APGD
45.05
36, 38.38++-10 0.74
39.84
39.84=086
42.48=003
46.61+-019
16.84=226
20.32+au.
10.00=:0m
36.11+0035
AA
42.12
36,15 n
1505
38.61
42.48::037
16, 16,29
19.74
10.001:0m
32.16::0.99
VGG16
80.18
64.59+ n.12
1.3
71.45+071
76.91+033
22, 76 1.44
28.23 +:44
10.00+am
62.46+
PGD
49.72
35.69 13.69++00
40.61
30.61=066
43,18+a05
47.79++0.18
15.60=002
20.52++a.8
10.00+=0m
34.32+0049
TRADES
C&W
31. 99:00
36.66-1105
41. 11:39
43.85
15.91
20.71
10.00
29.85
APGD
47.89
34.91 + 0.59
39.39-043
43,89-a5
46.32++029
14.63 0.5
20.04+aa22
10.00+am
33.26 33.26+00.50
AA
45.09
30.99 n.1
35.67=045
39.88+aa1
42.65++0116
13.17=006
18.46++071
10.00+amm
29.21
73.44
66.24:2.55
64.692004
73.49:t0.2 67.8
25.01
19.33
10.00:am
30.8
PGD
$1.51
25.20+ 050
44.18-1153
47.65+4050
51.03++-.13
17.95
17.95++a5
10.00+-om
40.21 -0321++031
MART
C&W
44.38
30.75
38.20
41.68104
44.34.0.44
18.49
17.60.20.
10.00:1.m
33.34
33,83
12.
46.53:a71
48.94:022
16.93=277
17.21
10.00::0m
38.56
AA
42,20
29.48+00 0.34
36.45-059
40.73+90
42.20++015
15.54+281
16.14+aa92
10.00+am
31.74

---

Published as a conference paper at ICLR 2023
Table 3: Comparing HARP with Robust-ADMM and HYDRA on models learned on SVHN.
Adv. Training
Attack Type
Pre- Trained
99 % Sparsity
99.9 % Sparsity
R-ADMM
HYDRA
BCS-P
HARP
R-ADMM
HYDRA
BCS-P
HARP
91,92
84.34+ 144
88.71=040
S8.39
90.70+
10.00=0000
3..00:
10.0000m
PGD
56,82
43.55+ L33
50.56+051
50.61
47.21+
10.00-0000
19.69+0.32
10.00+om
42.38
0224
PGD
C&W
52.41
38.38:
45.53
45.01
51.37:1:44
10.00
10.17
10.00::0m
37.72::014
APGD
40.15+
46,92=026
46.70=a05
47.40:+127
18.48-00.22
10.00:0m
AA
43,56
35.47+0077
42,40-025
42.60-0a6
42,07422.00
10.00-0.00
16.49++0.
10.00+0m
34.31 +-032
ResNet188
79.35 145
197
1..24
11.68
29.81
20.25
73.33 2:9
PGD
57.12
40.92 1.55
49. 10
50.66:2044
1.58
10
17
15.60
27.4
TRADES
C&W
51.40
35.3 147
43.93
45.32,1m
50.8611:49
10.42.995
14.07.19
199
14.35.159
32.74.911
APGD
45.60
37.811
45.92.105
43.64-::.44
10.49
14.37
15.57:16%
34,85
AA
42.08
32.95 1.49
40.68
43
36.42 26.42.4:242
12.52.2281
13.27:445
30.71
90.84
85 39.39
86, 164
87.17
25. 28.18 88.29
35.32.140
10.001:0m
14.9
PGD
59.53
44.13+1..1 1.31
-0087
51.21
27.25
14,40=2200
19.93
10.00=00m
41.16++0.76
MART
C&W
51,48
36.
50 1.28
077
45.49
18.77
13. 2:
10.
10.001.m
34,4612061
APGD
51.25
40. 17
1:16
47
g8
50.55 47.24
47.24
13.51
18.66.11.99
10.001.0m
38.27 1:09
42,93
34.29
40.08=0042
41.26:#053
41.90
11:50=1113
15.79
10.00+:m
31.92+0300
91.38
76.33+
85:62=006
84.72
08.977+0711
10.00
21.79+3..0
10.00=:0m
80.29
PGD
52.22
37.084
+0055
46.55
50.45+0045
10.00-0.00
13.75
10.00+0m
40.85
+060
PGD
C&W
47.74
30
39 05.5
41.70.1045
10.00
13.95
10.00:00
35.66
APGD
47.72
31.22 098
41.19=049
43.71+aa54
46.59
10.00
12.57+aa8
10.00+-om
37.17 0.44
43.59
27.391
36.24
39.622am
42.3611084
10.00.000
11.99109
10.001.m
32147.017
VGG16
88.66
74. 74.10 2:12
81887
84.13
84.691
10.00=0000
14.67:188
10.00::0m
75.78 0.55
PGD
$2.90
35. 3573771779
43.92
47.79
10.1
10.00
10.94
10.00
37.97
TRADES
C&W
47,06
37.94
42.91 1116
43.85
10.00
11.37:116
10.001.m
32.5611911
APGD
49.87
31 061
40.32_0000
44.83:104
46.33-2o55
10.00-0000
10.23:1
10.00:0m
34,88 1.440
AA
44.62
27 27.00g.m.
15.46
40,64.272
41,321:00
10.00.00m
10.07
10.001:0m
30.59.10.00
87.45
80.25+ 1.37
81.51+267
12.
84,09+c5::
10.00-000
17.02
10.00+-m
70.53
PGD
52.20
39107+2.11 211
46.00=047
46.64=074
49,93-4-844
10.00=00m
13.28
10.00=:0m
37.56:19.99
MART
C&W
44.98
31.07
37
39.90.081
42.70
10.00.000
13.10.2.1
10.00:::m
31.02:0775
APGD
46.30
33.24++14 1.64
38.88-088
41.23+aa77
43.73+-06
10.00-0.00
11.29++182
10.00+am
33.42+1.25
AA
40.43
26.69 1.00
31.31=085
33.00=a057
37
10.00=0000
11.13
10.00
27.18 1.05
Table 4: Comparing HARP with Robust-ADMM and HYDRA on ResNet50 models for ImageNet.
90 % Sparsity
99 % Sparsity
Attack
FREE-AT
R-ADMM
HYDRA
HARP
R-ADMM
HYDRA
HARP
60.25
35.26+004
49.44+005
55.21+0.35
11,41+032
27.00+am6
34.62+0a6
PGD
32.82
14,35+041
23.75+003
27.10=c4:
5,15=0.17
12.23++0.9
14.67+ +-032
C&W
30.67
12.35
21.602027
24.62
4.03-2022
11.22-20.8
12.42::03
APGD
13.53+0.99
23.14+0227
25.57+633
12.34+034
13.47+034
AA
28.79
11.01
19.88++029
22.57++041
3.69-2033
10.09
11.24+004
Sehwag et al. (2020) demonstrate remarkable performance on robustly pruning a model's weights, which we are able to confirm in our experiments. The results are pre- sented in Tables 2 to 4 for CI, SVHN, and ImageNet. HYDRA consistently improves upon Robust-ADMM for the sparsity levels considered in our experiments. However, while HYDRA maintains its natural accuracy and robustness for a sparsity of 99 % well, for 99.9 % its performance degrades heavily (similarly to Robust-ADMIN
Comparison to HYDRA.
Differently, HARP is able to maintain both accuracy metrics significantly better for aggressive pruning. In most cases, our method doubles the accu- racy of HYDRA sparsity of 99.9 %, yielding an unprecedentedly competitive performance for such highly compressed networks. Also, the additionally gained robustness stemming from using MART-AT rather than TRADES-AR AT nicely transfers models pruned by HARP, while HYDRA cannot benefit from this advantage at the same level. For ImageNet, HARP is also able to outperform HYDRA noticeably and has the highest effectiveness in suppressing the model performance reces- sion. However, the drop in performance from 90 % to 99 % sparsity is comparable to HYDRA and remains significant. Limiting the decay even further for large-scale datasets remains a challenge.
Comparison to BCS-P. Similar to our approach, BCS-P ÖÖdeenizii & Legenstein, 2021) strives for non-uniform compression strategy. To do so, they introduce "Bayesian Connectivity Sampling" for selecting important network elements from a global view. In contrast to HARP, it however does not follow the staged pruning-pipelinn end-to-end sparse
of Han et al. (2015) but achieves robust pruning via an In Fig. we present results of BCS-P for VGG16 model trained with PGD-AT on CIFAR-10 10, and explicitly investigate its performance at sparsity 99 % and 99.9 % on CIFAR-10 10 and SVHN in Tables 2) and 3 While it does not allow for channel pruning, BCS-P outperforms both HYDRA and Robust- ADMM in pruning VGG16's weights, while remains inferior HYDRA in pruning ResNet18. HARP, however, surpasses BCS-P significantly with
7

---

Published as a conference paper at ICLR 2023
increasing model sparsity and yields functional model at 99.9 % sparsity, while BCS-P P does not. InfSection 4.3, we analyze the strategies and attribute the observed collapse to a heavily pruned input layer. More comparative results and experiments ResNet18 are presented in Appendix A.2
Comparison to MAD. Lee et al. (2022) propose to compute an adversarial saliency map of a Approximate Curvature" (Martens & Grosse 2013) and mask out weights that are least relevant for robustness. Unfortunately, we have not been able to fully reproduce the MAD's results. We thus present the numbers reported by the authors of MAD along-side results for HARP in the experimental setup described in the original publication and adjust pre-training accordingly for CIFAR-10 and SVHN. Lee al. (2022) use PGD step-size of 0.0069 for adversarial pre-training over 60 epochs and 2 x 10 weight decay. At moderate compression (< 90 % sparsity) shown in Table 5| MAD and HARP are on par. Neither one harms the performance of the neural network for CIFAR-10 and SVHN. As indicated in Fig. 3 showing the PGD-10 adversarial robustness SVHN, this changes for 99 % sparsity. While method maintains robustness, MAD drops in performance significantly. In particular, is noteworthy that at sparsity of 19.9.9 9 % HARP achieves similar ad adversarial robustness than MAD a sparsity of 99 %, meaning, the network pruned by MAD is an order magnitude larger.
robustly pre-trained model via
Table 5: Pruning 90 % weights on pre-trained robust neural networks via HARP and MAD.
CIFAR-10 and
CIFAR-10
SVHN
Model
Pre-train
MAD
HARP
Pre-train MAD
HARP
VGG16
PGD-10
50.21
81.32
51.75
81.44
82.10
50.94
56.03
93.19
92.41
60.42
92.38
58.97
ResNet18
PGD-10
84.22
53.33
82.73
52.98
84,76
53.46
59.62
93.67
60.61
92.63
92.80
60.37
Figure 3: Comparing PGD-10 10 adversarial robustness of Robust-ADMM, HYDRA, MAD, and HARP on VGG16 models learned on 10. All pre-trained models are provided by Lee et al. (2022)
(a) CIFAR-10
(b) SVHN
60
60
111
50
50
Ascuricy
Accuracy
40
HARP HYDRA
MAD
HXRZ
MAD
R-ADMM
HYDKA
RADDMM
30
0%
90%
0%
90%
99%
99.95
Sparsity
Spursity
4.3 STRATEGY ANALYSIS
Also in conventional network pruning, non-uniform compression strategies have been proven effec- tive, for instance, ERK by Evei et al. (2020) and LAMP by Lee et al. (202I). While we are the first to show equivalent benefit for adversarial robust pruning, in this section, we investigate (a) if these approaches can also be applied to adversarial robust pruning, and (b) if they find similar com- pression strategies in comparison to HARP. Both ERK and LAMP focus model parameters and support weight pruning only. We adjust HYDRA to accept different compression rates per layer and
Table 6: Comparing performance improvement of Robust-ADMM and HYDRA by using ERK and LAMP and by HARP on CIFAR-10. Natural accuracy and PGD-10 robustness are presented left and right of the / character.
Model
Sparsity
R-ADMM
HYdRA
HARP
Original
LAMP
Original
w/
LAMP
ResNet18
99.9 %
99
71.42 /42.31
26.39
20.62
80.36 00.36/48.38
54.51/33.06
57.16/
$0.64/
48.28
34,05
34.55
75.53 84
26.08
/9.09
55.73 35.09
80.161
57.07
50.07
35.91
80.25
50.36 63.99
39.39
VGG16
99.9 %
99 %
62.28 /37.54
21.28 17.46
70.33 /43.30
42.35/29.11
74.38/
48.96
32.39
46.39
23.41 / /20.99
67.33
50.38 34.32
72.19/45.05
76.75
57.931
36.01
78.58
59.13/
37.36
8

---

Published as a conference paper at ICLR 2023
assign the strategies determined by ERK and LAMP. The results for pruning a PGD-AT pre- preitrdined VGG16 model are presented in Table 6 strategies that, however,
LAMP in particular produces very promising compression surpassed by HARP. For ImageNet learned with ResNet50, in turn, using LAMP and ERK with HYDRA impacts performance negatively, unlike HARP (cf. (Table 11 in IlAppendix A.3). In Fig. 4 we present the non-uniform compression strategies determined by the different approaches as (a) compression rates and (b) overall preserved parameters per layer. Ad- ditionally, show a uniform compression yielding 99.9 % sparsity reference. Note, that due to the layer's difference in size the absolute number of preserved parameters varies for the uniform strategy Fig. 4b also. It is interesting to see that LAMP puts more focus on layers the middle sacrificing input/output information, while HARP tends to focus on front and back layer stronger. ERK, in turn, even maintains large portions of fcl. Interestingly, BCS-P yields an almost uniform strategy although it strives for non-uniformity. Even worse, only two out of 1,728 parameters in VGG16's imput layer are preserved at 99.9 % sparsity, severely impacting performance.
Figure 4: Strategy comparison for pruning a VGG16 with target 99.9 % sparsity on CIFAR- 10.
(a) Layer-wise compression rates
HARP
LAMP
ERK
BCS.P
Uniform (R-ADMM, HYDRAA
0.1
Compression
0.01
0.001
0.0001
Layer
(b) Layer- wise preserved parameters
Presevved Params [x]0*]
HAXP
LAMP
ERK
BCS-P
Uniform (R-ADMM HYDRA)
2.5
1.5
0.5
Layer
CONCLUSIONS
For pruning neural networks it is crucial to decide how many and which parameters to prune. This does not only affect natural accuracy, but also the robustness against adversarial input manipulations. Maintaining adversarial robustness is crucial for safety-critical applications, such as autonomous driving and edge AI. Our method, HARP, incorporates global view of the network's compression and scores for gauging the importance of network connections into dynamically regularized loss formulation that allows to significantly outperform related work. We are the first reach competitive performance for highly aggressive pruning, aiming at up to 99.9 % network sparsity. Therewith, we show that learning global, but layer-specific and, thus, non-untn non-uniform compression strategy least as important deciding what connections to prune.
Limitations. Similarly to the majority of related work in the field, our method is of empirical nature and, thus, can benefit from future work theoretic analyses of how and why our prun- ing approach arrives at a particular compression strategy. our evaluation, we show that HARP'S compression is close the theoretically founded strategies of LAMP, raising the hope that a rig- orous theoretic justification is possible. Ideally this extends to theoretically determined, one-shot calculation that spares the computational effort of the optimization problem considered for HARP.

---

Published as a conference paper at ICLR 2023
ACKNOWLEDGEMENTS
The authors thank the anonymous reviewers for their valuable suggestions, and gratefully acknowl- edge funding by the Helmholtz Association (HGF) within topic "46.23 Engineering Secure Systems" and by SAP S.E. under project DE-2020-021.
ETHICS STATEMENT
Deep neural networks used in wide variety of applications. While these applications may have ethical implications, our method itself does not. HARP aims to compress an existing model, main- taining accuracy and resistance against input manipulation attacks. As such, method is agnostic to the underlying application. Moreover, we do not reveal any vulnerabilities in the robust model compression, do not any personalized data, and do not involve human subjects in our experi- ments.
REPRODUCIBILITY STATEMENT
For the sake of reproducibility and to foster future research, we make the implementations of HARP for holistic adversarially robust pruning publicly available at:
https://intellisec. /tt..aaeeeee..rcceccccccccccacce
REFERENCES
Kay Henning Brodersen, Cheng Soon Ong, Klaas Enno Stephan, and Joachim M. Buhmann. The balanced accuracy and its posterior distribution. In Proc. of the International Conference Pattern Recognition, pp. 3121-3124, 2010.
Bugra Cakir and Erdogan Dogdu. Malware classification using deep learning methods. In Proc. of the ACM Southeast Conference (ACMSE), 2018
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, In Proc. of the IEEE Symposium on Security and Privacy (S&P). pp. 39-57, 2017.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Proc. the International Conference Machine Learning (ICML), 2020a.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In Proc. of the International Conference on Machine Learning (ICML), 2020b.
Francesco Croce, Maksym Andriushchenko, and Matthias Hein. Provable robustness of relu net- works via maximization of linear regions. In Proc. of the International Conference on Artificial Intelligence and Statistics (AISTATS), 2019.
Deng, W. Dong, Socher, et al. ImageNet: A large-scale hierarchical image database. In Proc. of the IEEE Conference Computer Vision and Pattern Recognition (CVPR), 2009.
Utku Evci, Trevor Gale, Jacob Menick, Pablo Samuel Castro, and Erich Elsen. Rigging the lot- tery: Making all tickets winners. In Proc. of the International Conference on Machine Learning (ICML). pp. 2943-2952, 2020.
Song Han, Jeff Pool, John Tran, and William Dally. Learning both weights and connections for efficient neural network. In Proc. of the Annual Conference Neural Information Processing Systems (NeurIPS), 2015.
Song Han, Huizi Mao, and William J Dally. Deep compression: Compressing deep neural networks with pruning. trained quantization and huffman coding. Proc. of the International Conference on Learning Representations (ICLR), 2016.
10

---

Published as a conference paper at ICLR 2023
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770-778, 2016.
Yihui He, Xiangyu Zhang, and Jian Sun. Channel pruning for accelerating very deep neural net- works. In Proc. of the IEEE/CVF International Conference on Computer Vision (ICCV), 2017.
Yihui He, Ji Lin, Zhijian Liu, Hanrui Wang, Li-Jia Li, and Song Han. AMC: AutoMI. for model compression and acceleration on mobile devices. In Proc. of the European Conference on Com- puter Vision (ECCV), pp. 813-832, 2018.
Qiangui Huang. Shaohua Kevin Zhou, Suya You, and Ulrich Neumann. Learning to prune filters in convolutional neural networks. In Proc. of the IEEE Winter Conference on Applications of Computer Vision (WACV), pp. 709-718, 2018.
Itay Hubara, Matthieu Courbariaux, Daniel Soudry, Ran El-Yaniv, and Yoshua Bengio. Binarized neural networks. In Proc. of the Annual Conference on Neural Information Processing Systems (NeurIPS), 2016.
Kevin Kollek, Miguel Angel Aguilar, Marco Braun, and Anton Kummert. Improving neural network architecture compression by multi-grain pruning. In Proc. of the IEEE International Conference on Progress in Informatics and Computing (PIC), pp. 6-1,, 2021.
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. CIFAR (canadian institute for advanced re- search). httph://www www.otoooooooooooooooooo www.ttooedu//kiiiii cwf.rrraraaa// hhmm
Souvik Kundu, Mahdi Nazemi, Peter A. Beerel, and Massoud Pedram. DNR: A tunable robust pruning framework through dynamic network rewiring of dnns. In Proc. of the Asia and South Pacific Design Automation Conference (ASP-DAC), 2021.
Aditya Kusupati, Vivek Ramanujan, Raghav Somani, Mitchell Wortsman, Prateek Jain, Sham Kakade, and Ali Farhadi. Soft threshold weight reparameterizatioo for learnablesparsit.. In Proc. of the International Conference on Machine Learning (ICML), 2020.
Alexandre Lacoste, Alexandra Luccioni, Victor Schmidt, and Thomas Dandres. Quantifying the carbon emissions of machine learning. CoRR,
2019.
Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 2015.
Byung-Kwand Lee, Junho Kim, and Yong Man Ro. Masking adversarial damage: Finding adversarial saliency for robust and sparse network. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Jacho Lee, Sejun Park, Sangwoo Mo, Sungsoo Ahn, and Jinwoo Shin. Layer-adaptive sparsity for the magnitude-base pruning. In Proc. of the International Conference on Learning Representa- tions (ICLR), 2021.
Hao Li, Asim Kadav, Igor Durdanovic, Hanan Samet, and Hans Peter Graf. Pruning filters for efficient ConvNets. Proc. of the International Conference on Learning Representations (ICLR), 2017.
Qian Li, Hao Peng, Jianxin Li, Congying Xia, Renyu Yang, Lichao Sun, Philip S. Yu, and Lifang He. survey on text classification: From traditional deep learning. ACM Transactions on Intelligent Systems and Technology, 13(2), apr 2022.
Zhuang Liu, Mingjie Sun, Tinghui Zhou, Gao Huang, and Trevor Darrell. Rethinking the value of network pruning. In Proc. of the International Conference on Learning Representations (ICLR), 2019.
Ilya Loshchilov and Frank Hutter. SGDR: Stochastic gradient descent with restarts. In Proc. of the International Conference Learning Representations (ICLR), 2016.
Divyam Madaan, Jinwoo Shin, and Sung Ju Hwang. Adversarial neural pruning with latent vulner- ability suppression. In Proc. of the International Conference on Machine Learning (ICML), pp- 6575-6585, 2020.
11

---

Published as a conference paper at ICLR 2023
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proc. of the International Con- ference Learning Representations (ICLR), 2018.
Huizi Mao, Song Han, Jeff Pool, Wenshuo Li, Xingyu Liu, Yu Wang, and William Dally. Exploring the granularity of sparsity in convolutional neural networks. In Proc. of the IEEE Conference on Computer Vision and Patlern Recognition Workshops (CVPRW), pp. 1927-1934, 07 2017.
James Martens and Roger Grosse. Optimizing neural networks with kronecker- factorrd approximate curvature. In Proc. of the International Conference on Machine Learning (ICML), pp. 1408-24117 2015.
Dmitry Molchanov, Arsenii Ashukha, and Dmitry Vetrov. Variational dropout sparsifies deep neural networks. In Proc. of the International Conference on Machine Learning (ICML), pp. 2507,2507, 2017.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y. Ng. Reading digits in natural images with unsupervised feature learning. In Proc. of the NIPS Workshop on Deep Learning and Unsupervised Feature Learning. 2011.
Ozan Özdenizei and Robert Legenstein. Training adversarially robust sparse networks via bayesian connectivity sampling. In Proc. of the International Conference on Machine Learning (ICML),
pp. 8314-83222 2021.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In Proc. of the International Conference on Learning Representations (ICLR), 2021.
Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Parametric noise injection: Trainable random- ness improve deep neural network robustness against adversarial attack. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018.
Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 815-823, 2015.
Vikash Sehwag, Shiqi Wang, Prateek Mittal, and Suman Jana. HYDRA: Pruning adversarially robust neural networks. In Proc. of the Annual Conference on Neural Information Processing Systems (NeurIPS), 2020.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett (eds.), Proc. of the Annual Conference on Neural Information Processing Systems (NeurIPS), 2019.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In Proc. of the International Conference on Learning Representations (ICLR), 2015.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In Proc. of the International Conference on Learning Representations (ICLR), 2014.
Lukas Timpl, Rahim Entezari, Hanie Sedghi, Behnam Neyshabur, and Olga Saukh. Understanding the effect of sparsity on neural networks robustness. In Proc. of the ICML Workshop on Overpa- rameterization: Pitfalls & Opportunities, July 2021.
Manoj Rohit Vemparala, Nael Fasfous, Alexander Frickenstein, Sreetama Sarkar, Qi Zhao. Sabine Kuhn, Lukas Frickenstein, Anmol Singh, Christian Unger, Naveen Shankar Nagaraja, Christian Wressnegger, and Walter Stechele. Adversarial robust model compression using in in-train pruning. In Proc. of the CVPR Workshop on Safe Artificial Intelligence for Automated Driving (SAIAD), June 2021.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In Proc. of the International Conference on Learning Representations (ICLR), 2020.
12

---

Published as a conference paper at ICLR 2023
Wei Wen, Chunpeng Wu, Yandan Wang, Yiran Chen, and Hai Li. Learning structured sparsity in deep neural networks. In Proc. of the Annual Conference on Neural Information Processing Systems (NeurIPS), pp. 2082-2090, 2016.
Boxi Wu, Jinghui Chen, Deng Cai, Xiaofei He, and Quanquan Gu. Do wider neural networks really help adversarial robustness? In Proc. of the Annual Conference on Neural Information Processing Systems (NeurIPS), 2021.
Tien-Ju Yang, Yu-Hsin Chen, and Vivienne Sze. Designing energy-efficient convolutional neural networks using energy-aware pruning. In Proc. of the IEEE Conference Computer Vision and Pattern Recognition (CVPR), pp. 6071-6 July 2017.
Shaokai Ye, Xue Lin, Kaidi Xu, Sijia Liu, Hao Cheng, Jan-Henrik Lambrechts, Huan Zhang, Aojun Zhou, Kaisheng Ma, and Yanzhi Wang. Adversarial robustness vs. model compression, or both? In Proc. of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 111-120, 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled off between robustness and accuracy. In Proc. of the International Conference on Machine Learning (ICML), 2019.
Qi Zhao and Christian Wressnegger. Holistic adversarially robust pruning. In Proc. of the Interna- fional Conference on Learning Representations (ICLR), May 2023.
Qi Zhao, Tim Königl, and Christian Wressnegger. Non-uniform adversarially robust pruning. In Proc. of the International Conference on Automated Machine Learning (AutoML), 2022.
13

---

Published as a conference paper at ICLR 2023
Table 7: Overview of used method abbreviations.
Category
Used Abbreviation
Reference
PGD
Madry et al 2018
Atlacks
APGD. APGD. AUToPGD
C&W
Croce Wanner 201
AA, AUTOATTACK
Croce & Holn 20200
2018
Adversarial Training
TRADES-AT
7hamp ar
21119
MART
Wany
2020
Non uniform compression
LAMP
ERK
Evei el m1
2020
HYDRA
Sehwas et [220
Robust-ADMM, R-ADMM
Ye (011
Adversarially robust pruning
BCS-P
Izdenize & Legcnstein
2021
MAD
202]
HARP (Ours)
Zi300 & Wrssslnggerr
2023
A APPENDIX
We proceed to analyze the influence different step sizes to regularize HARP (Appendix A. before extend upon the empirical evidence of our methods performance: We broaden com- parison to related work by inspecting the performance of BCS-P and MAD on ResNet18 and ad- ditionally considering DNR (Appendix A.2). We also extend upon the analysis of HARP's pruning strategies (Appendix A.3), inspect the parameter distribution of the pruned models (Appendix A.4, and evaluate HARP's performance based on natural training (Appendix A.5p. Moreover, we demon- strate an extension of our method to channel/structural pruning (Appendix A.6) and present com- parison of training consumption for methods in our evaluation (Appendix A.7).
A.1 INFLUENCE OF DYNAMIC ON HARP'S PRUNING
In this section, we present results for different regularization step-sizes of HARP when pruning VGG16 sparsity of 99.9 9 %. As illustrated in Figs. 5a and 5b] HARP exhibits strong oscillation for small step sizes (7 < 0.1), while larger steps (7 1.0) restrict performance improvements. A step size of ? 0.01, turn, helps the model better converge. HARP performs similarly for a slightly changed step size of 0.005, but yielding the target compression is delayed. When
Figure 5: Different step-size for pruning 99.9 % weights of a VGGI6 by HARP on CIFAR-10.
(a) Clean
(b) PGD-10
(c) Compression rate
90
Accuracy [Sa]
Aucuracy [76]
Rate
.50
30
0.01
30
20
16
18
12
14
18
20
Epoch
Epuch
Epoch
(d) Layer-wise preserved parameters
Preverved Parums [x109)
2.0
1.5
1.0
0.5
10
12
13
1c1
102
523
Layer
14

---

Published as a conference paper at ICLR 2023
lowering the step size further to 0.001, the target compression cannot be reached anymore shown in Fig. 5cl Hence, small step sizes shorten the time for adversarial training but cannot guarantee yielding the target compression. In Fig. 5d summarize the generated strategies that satisfy the target compression. With decreasing 7, HARP preserves layer in front and at the end stronger. Model parameters in the middle layers sacrificed to preserve higher performance.
A.2 EXTENDED COMPARISON RELATED WORK
Comparison to BCS-P. Fig. 6 shows extended experiments for ResNet18. At sparsity 99.9 %, model collapse appears after BCS-P's pruming, particularly on SVHN. Fig. visualizes pruning strategies for ResNer18 8 SVHN. Similar to Fig. 4a BCS-P exhibits an almost uniform pruning strategy, compressing the input layer down to 0.0005. This reduction refers to one out of 1,728 pa- rameters which clearly cannot yield any meaningful prediction. Additionally, we extend to initialize BCS-P with LAMP non-uniform strategy (cf. Table 8). Similar to the effect on HYDRA, BCS-P significantly benefit from the non-uniform initialization. Especially, the plight of BCS-P at sparsity 99.9 % solved. However, HYDRA shows a better adaptability to LAMP's initialization. At the same time, HARP remains overall the best performance on both 99 % and 99.9 % sparsity.
Figure 6: Comparing HARP with BCS-P for pruning ResNet18 weights on CIFAR-10 10 and SVHN.
(a) CIFAR-10
(b) SVHN
Accuracy [96
Accuray
-00
50
30
30
Aar (BCS-))
AUTDATIACK (BCS-P)
Ror (llvae)
10
0%
90%
99%
99.9%
0%
90%
99%
99.9%
Sparsity
Sparsity
Figure 7: Strategy comparison for pruning ResNet18 with target 99.9 % sparsity on SVHN.
1.0
HARP
Uniform
BCS-P
Compression Rate
0.1
2-1
2/2
2.3
24
3-1
3-2 3-short 3-3
3-4
4-1
4-2 4-thort 4.3
44
3-1
5-2
5-bbott 5-3 5-4
101
Layer
Table LAMP initialization on HYDRA and BCS-P and their comparison to HARP on CIFAR- The natural accuracy and PGD-10 robustness are presented left and right of the / character.
Model
Sparsity
HydRa
BCS-P
HARP
Original
Original
LAMP
ResNe118
99 %
45.88
80.16/ 50.07
/45.32
72,58
45.42
80.25
50.36
99.9 %
34.55 26.08
57.07 35.91
21.78 12.78
56.33
35.21
63.99
39.39
VOG16
99.9 %
23.41/ 20.99
57.931
36.01
10.00/
10.00
43.77 30.34
43.71
59.13
37.36
Comparison to MAD.
We maintain the same training setting in 3 Similarly, MAD presents SVHN (ef Fig. 8) further enhance adversarial resistance by mod-
promising performance
15

---

Published as a conference paper at ICLR 2023
erately pruning. At the same time, HARP presents robustness improvement well in moderate pruning. In distinction from MAD, however, HARP remains the stable performance on pruning a higher sparsity while MAD performs less efficiently at aggressive pruning.
Figure 8: Comparing PGD-10 adversarial robustness of ResNet18 learned on SVHN and pruned by Robust-ADMM, HYDRA, MAD and HARP. All pre-trained robust models are from MAD.
(a) VGG16
(b) ResNet18
Accoracy [Se]
Accuracy [%6
50
50
40
40
110
21
HARP
110
11
HYDRA
R-ADMM
12
181
0%
90%
99%
99.9%
90%
99%
99.91
Spursity
Spanitty
Comparison to DNR. Kundu et al. 2021 propose a robust pruning framework, DNR, learn compact and robust neural network through dynamic network rewiring. To conduct the comparison, follow the authors training setting (Rakin et al.) 2018) and use the authors evaluation metries. Re- sults are reported in Table 9 At a high compression (50x) HARP plays its strengths. For CIFAR-10, our method yields robustness scores comparable
DNR compression of 20 The natural accuracy is slightly inferior, though. For the large-scale dataset, Tiny-ImageNet (Le & Yang 2015), turn, HARP yields higher robustness than DNR for compression up to 50x, but falls behind nat- ural accuracy again. In summary, HARP yields higher robustness while DNR seems favors natural accuracy.
Table 9: Comparing HARP with DNR in pruning neural network weights.
Model
Compression
Sparsity [%]
Natural
PGD-7
DNR
20.85
86.74
52.92
43.21
VGG16
20.85
95.4
85,09
53.55
45,34
CIFAR-10
100.00
99.0
81.35
50.83
42.75
DNR
47.35
ResNet18
21.57
95.2
86.97
56.33
49.31
HARP
50.00
98.0
84,30
53.87
46.78
100.00
99.0
82.35
$2.06
45.47
DNR
20.63
95.2
51.71
18.21
14.46
Tiny ImageNet
VGG16
50.35
HARP
50.00
98.0
50.21
19.61
16.24
A.3 EXTENDED STRATEGY ANALYSIS
In this section, we investigate the impact of non-uniform strategies on robust weight pruning. Firstly, we compare different strategies used to initialize HARP'S pruning in order to present the insensibility on HARP' layer-wise rate initialization. In the next step, we analyze the end-to-end learning process with regard to the stability of training with and without using non-uniform strategies HYDRA. Secondly, we assess HYDRA'S performance by using ERK and LAMP for ImageNet, demonstrating that the positive impact of the strategies' non non-uniformity is not consistent for different datasets.
Analysis of HARP's strategy initialization. As demonstrated by Sehwag et al. (2020), score ini- tialization is key to realize a improvement on the weight pruning. In Fig. 9 we provide the learning processes of HARP's pruning sparsity that are initialized by ERK, LAMP and the default uniform strategy. In comparison with ERK and LAMP, uniform strategy leads to a dramatic performance degradation after initialization. However, the training scores Sw and rates shows the cape of
16

---

Published as a conference paper at ICLR 2023
Figure 9: Processes of weight pruning on robust ResNet18 for CIFAR-10 by HARP with different initialization strategies: default Uniform (orange), ERK (gray) and LAMP (blue). Natural perfor- mance and PGD-10 adversarial robustness are presented as solid lines and dashed lines, respectively.
(a) 99 % Sparsity
(b) 99.9 % Sparsity
90
90
ERK: spesity anival mepoch 12 LAMP: sponsty arraal epoch 1o Unitonn: anival epoch
70
Accuracy (%)
Accuracy
50
30
ERK:
arrial spuch 1I
LAMP: spursity arivval 15
Unifuem sparityy spodi
10
10
Epoch
Epoch
recovering the network performance, resulting in a largely similar network performance to ERK and LAMP after the first epoch training. In the subsequent epochs, the learning curves on different initializations are essentially overlap. By further evaluating the final pruned networks after fine- tuning, results in Table 10 show that the difference between uniform adn non-uniform strategies negligible for the layer compression rate initialization. Confirming, that HARP is insensitive to different strategies initialization. Therewith, we rely on the uniform strategy as the default setting in experiments.
Table 10: Comparing different strategies initialization HARP for CIFAR-10.
Model
Sparsity
Uniform
ERK
LAMP
ReaNett8
99 99.9 %
80.25 50.36
79.42 0.83)/ 50.43 (+00077
(++0.3))
/0.0002355//3333330 50.33 0.03)
63.99 39.39
63.61 (-0.38) 39.20 (-0.19
63.64 (-0.5)) 39.43 000.4)
VGG16
99.9% %
99%
78.50/48.77 48.71
59.33/ 37.46
59.79
78.38 (-.12)))44) (++0.31) (+003))
( 37.72
(+0.266
59.85 (++0.52) 37.65
(4-.32)) 48.69 (002))
/
(-0.19)
Comparison of end-to-end compression pipelines. In Fig. 10 we presents a comparison be- tween different strategies on HYDRA and HARP across the end-to-end compression pipeline. For pruning 99 % weights, the potential of the original HYDRA is impaired by the use of a uniform strategy in the pruning phase, limiting the potential for improving via fine-tuning. At the same time, the non-uniform strategies ERK and LAMP prove their positive impact in the pruning stage. With- observe
out fine-tuning, they achieve already better results than HYDRA. In HARP'S pruning, down-up performance curve, indicating that the network performance recovers after the robust net- works is compressed. Further improved by fine-tuning, HARP achieves slightly better results than HYDRA with ERK and LAMP. In pruning a 99.9 % sparsity. HYDRA produces a dramatic decrease in performance that can, however, be compensated by using LAMP and ERK. Using HARP during pruning results in the highest network performance, approximating the final result after fine-tuning.
Comparing non-uniform strategies for ImageNet. Presented Table 6 HYDRA significantly improved by applying ERK and LAMP. In Table 11 we further investigate their impact on the large- scale dataset ImageNet. Compared to original HYDRA, using ERK and LAMP strategies leads to performance degradation, and with LAMP yields more harm than ERK at sparsity 99 %. Fig. 11 visualizes the strategies of sparsity 99 % for ImageNet experiments. Similar to Fig. 4 LAMP and ERK tend to preserve parameters, leading to global parameter distribution that approximates uniform shape. However, since HARP preserves more parameters in the former layers and the last fully connected layer, more input and output information preserved.
17

---

Published as a conference paper at ICLR 2023
Figure 10: End-to-end learning processes of weight pruning on pre-trained robust ResNet18 by
using HYDRA (green), HYDRA-ERK (gray), HYDRA-LAMP (blue), and HARP (orange).
(a) 99 Sparsity
(b) 99.9 Sparsity
80
60
60
Acanmcy (96)
Accuncy
20
20
mOLuihh mio ra (ndioaa--oe)
20
40
60
80
100
120
20
40
60
80
100
120
Epoch
Egoch
Table 11: Comparing HARP weight pruning with HYDRA, and HYDRA with ERK and LAMP for ImageNet. Values in brackets show the performance change by using ERK and LAMP HYDRA.
Attack
FREE-AT
90 % Sparsity
99 % Sparsity
HYDRA
HARP
HYDRA
HARP
Original
ERK
LAMP
Original
w/MAMP
60.25
49.08
44.69 (-4.39)
44.43
(-4.65)
55.21
27.88
24.38 (-3.50)
22.57 (-5.31)
34.62
32.82
23.25
20.95 (-2.30)
20.72
(-2.33)
27.10
12.35
10.57 (-1.78)
(-2.64)
14.67
CRW
30.67
21.21
19.21
(-2.00)
19.07
(-2.14)
24.62
11.32
9.51 (-1.81)
8.42 (-2.90)
12.42
APGD
31.54
22.97
20.38 (-2.99)
20.52 (-245)
25.57
12.52
10.12 (-2.40)
9.56 (-2.96)
13.47
28.79
19.76
17.42
(-2.34)
(-281)
22.57
8.64 (-1.37)
(-2.23)
Figure 11: Strategies of HARP, LAMP, and ERK for pruning 99 % sparsity ImageNet.
Preserved Parums [x10f]]
HARP
LAMP
ERK
Unifomm
2
2-3
222
220
243
11
213
222
433
133
463
81-1
512
S13
Schon
623
63.7
$311
$13
$33
Layer
A.4 PARAMETER DISTRIBUTION
HARP prunes neural networks by incorporating connection importance-scoree for learning prun- ing masks and the layers' compression rates into the optimization procedure. The pruned models particularly benefit from the non-uniformity of HARP's compression strategy, yielding high natural accuracy and high adversarial robustness. Ye et al. (2019) argue that wider parameter distributions promise higher robustness, while Sehwag et al. (2020) show that parameters close to zero are crucial preserve the adversarial robustness. In this section, we take VGG16 learned CIFAR-10 and SVHN as examples to analyze the difference in parameter distributions along the network's 's layers and compare HARP with Robust-ADMM and HYDRA.
Parameter distribution when pruning weights. Fig. 12a and Fig. 12b visualize the layer-wise weight distribution of VGG16 pruned by Robust-ADMia (blue), HYDRA (green), and HARP (or- ange) datasets CIFAR-10 and SVHN, respectively. Concatenated architectures such as VGG16 possess relatively high sparsity in the middle layers (Lee et al.) 2021 Evei et al.] 2020). This phe- nomenon also captured by HARP, which learns preserve the first six layers and the last layer.
18

---

Published as a conference paper at ICLR 2023
Figure 12: Parameter distribution of VGGI6 pruned to 99 % sparsity with PGD-AT.
(a) CIFAR-10
180
Lays Cane.
641
Light Cano
Upr
Layer
230
RADMM
HYDRA
Lxper Cww.
1ppml
SVHN
Liver C
Lover Cany
Leyer
Layer
Layer Cony.5
Lover Camu.
Layer C
Core
Zese
Ceer
1.0
130
19

---

Published as a conference paper at ICLR 2023
Another intriguing but interesting observation concerns non-zero parameters: Robust-ADMM tends to favor middle layers that contain many zero parameters. In contrast, HYDRA tries to push the model's weights "away" from zero, which reduces sparsity and thus achieves higher robustness than Robust-ADMM. Pruning weights with HARP, however, converges to a different distribution. All but the first and last layers, have weights with (mostly) smaller magnitude than for models pruned with HYDRA-fer of them, however, remain zero-valued. For instance, in the penultimate layer, preserved weights are close to zero and the distribution is more compact than those of HYDRA and Robust-ADMM, By comparing the parameter distribution of middle layers in CIFAR- 10 and SVHN, we observe that HYDRA tends to have a rather close-zero zero distribution in pruning networks for SVHN than its behavior in CIFAR-10. Recall [Tale and Table 3 the performance gap between HYDRA and HARP SVHN is smaller than in CIFAR-10. This implies an interesting phenomenon that encouraging a close-7ero distribution yields positive impact on pruning robust networks.
A.5 PERFORMANCE WITH NATURAL TRAINING
We extend our experiments to pruning naturally pre-trained networks with datasets CIFAR-10 and SVHN, and consider HYDRA, HYDRA with LAMP, and the original LAMP pruning in the com- parison. In Table 12 there exists no significant difference between the pruning methods at sparsity 90 %. For CIFAR-IO, HYDRA yields a larger performance drop at sparsity 99 %. In contrast, using LAMP directly or using HYDRA with LAMP's s strategy yields better results. With regards to the highest sparsity 99.9% %6 LAMP pruning and HYDRA with LAMP strategy have significantly better performance than original HYDRA. Meanwhile, HARP shows the highest compatibility to prune networks for CIFAR-IO 10. Additionally, in pruning sparsity 99.9 % for SVHN, HARP presents the pruning performance that deviates from the best result by more than 0.5 %. Conclusively, pruning naturally pre- rre-trained networks benefits more from the layer-wist wise specific non-uniform strategies. At the same time, HARP offers more significant improvement about concerning pruning robust net- works than other approaches.
Table 12: Comparing pruning weights of naturally pre-trained networks
Model
CIFAR-10
SVHN
Pre-train
Sparsity
HYDRA
LAMP
HYDRA LAMP
HARP
Pre-train Sparsity
HYDRA
LAMP
HYDRA
HARP
90
93.29
93.82
93.79
93.59
90%
95.79
96.10
95.97 93.91
95.71
VGG16
99
91.49
99 %
95.68
99.9 %
34.62
76.52
85.61
87.42
99.9 %
43.59
87.22
94.10
95.09
ResNer18
95.13
09
83.56
93.63
94.53
94.19
96.13
99
96.10
95.80
95.95
95.73
99.9 %
25.66
78.26
86.27
86.67
99.9 %
70.78
90.67
93.79
93.32
A.6 EXTENSION TO CHANNEL PRUNING
Structurally pruning neural networks has better compatibility with the hardware deployment, while its coarse pruning granularity leads to larger performance degradation than weight pruning, itself increasing the difficulty of pruning robust networks. In this section, we extend our method HARP on pruning network layer channels. To map HARP channel pruning, use FLOPs estimation (denoted as function F'OPS(())) to replace the sparsity in Cio. (expressed as Eq. (8). Moreover, determine ae by considering network global FLOPs reduction, in order for the pruned model to have the same size as uniform strategy would have in FLOPS.
FLOPs 0
Law oz) == max
a. FLOPs(O) 1, 0
(8)
Different from weight pruning, importance scores (()) originates _º for channel pruning. In ad- dition, use Eq. (9) to initialize (()) in channel pruning and follow the order of weight magnitude (Ye et al. 2019) by summing up the weights of each input channel (expressed as csum(-)) and normalizing by the maximal channel-wise summation.
20

---

Published as a conference paper at ICLR 2023
csumn $6 - max csum ( (10(0))
Algorithm I presents the complete implementation of HARP. Note that weight pruning is largely independent of the network architecture it does not change the layer's size (we merely zero out weights). However, pruning channels/filters requires special attention. When facing ResNet-like architectures, do not train the compression rates of all shorteut layers directly but update them by assigning the rate of the connected input layer in the residual block instead. This way, the pruned input layer aligns with the channel dimensionality of connected pruned shortcut-layers.
Comparing channel pruning with related work. Ye et al. (2019) have shown the capability of RoMust-ADMM in structurally pruning robust networks, controlling the network FLOPss straightfor- wardly by global structural compression rate. Similarly, HYDRA (Sehwag et al. 2020) extends to structural pruning and improves over magnitude-baat pruning with HARP, start off from the uniform strategy with airit = 1.0 and use y 0.02 to ensure the arrival at the target compression rate at As presented experiment results in Fig. 13 HARP shows promising performance in preserving robust model while pruning channels. Robust- ADMM possesses a similar performance on pruning up to 4.0 xFLOPs, while experiencing higher model performance degradation at xFLOPs of 10 and 20. Channel pruning with HYDRA, in turn, significantly harms model performance at 2.0 xFLOPs compression.
criterion (Han et al. 2015). For channel
910
500
70
Accuncy (9)
Accuncy
BA27
KADMM
RYDOA
Channel/Filen pruning
10
10
1
10
1.2
4
20
xFLOPs
XFLOPs
VGG16
ResNer18
Figure 13: Structural pruning by controlling FL.OPs on a VGG16 model and ResNet18 model for CIFAR-10. Solid lines show the natural accuracy of HARP (orange), HYDRA (green) and Robust- ADMM (blue). Dashed lines represent the methods" adversarial robustness of PGD-10.
Comparison to ANP-VS. Madaan al. (2220) propose to suppress the latent feature level vul- nerability in neural networks by gradually pruning a model during training based on regularized loss function. In the open-source implementation
done using image standardization (e.g., tf. image. ANP-VS pre-processing CIFAR-10 data le__iinne_saadaaa
() function). Standardization transforms the input to have mean 0.0 and variance 1.0, that is, input features may fall outside of an [0.0, 1.0 interval. However, ANP- VS clips adversarial perturbations to [0.0, 1.0], resulting in overall weaker adversarial examples used for the evaluation as it would be the case for 0-1 rescaling the inputs. Note, the latter is used for evaluating HARP in all experiments. We inves- tigate the influence of input ranges by comparing training with ANP-VS using both pre-processing steps (standardization and simple 0-1 re-scaling) un- der the otherwise exact same PGD settings. The original publication reports an original accuracy of 88. % adversarial accuracy of 56.2 % for VGG16 on CIFAR-10, which match our reproduced re- sults with standardization (cf. Table 13). We even yield higher compression in our experiments. With the correct input pre- pre-processing step (0-1 rescaling).
Table 13: Comparing ANP-VS with different pre- pr--eescesing methods.
Pre-processing
xFLOPS
Benign
PGD-40
Original (Madaan et 2020
2.41
18.18
56.21
Standardization
3.56
88.34
57.33
0.1 re scaling
3.82
76.30
31.10
however, ANP-VS yields a significantly worse result, showing the criticality of wrongly used pre- processing. With thus refrain from comparing HARP ANP-VS in pruning channels.
https:://gitthbb.cmm///////
21

---

Published as a conference paper at ICLR 2023
Algorithm Holistic Adversarially Robust Pruning
Input: pre-trained model and its parameters 0, number layers L, target compression rale dz, mini- mal compression rate Ominn training data-set D
Output: Compressed network M
Step 1: Initialization of trainable pruning parameters
For each layer initialize learnable rates (1) log and importance scores:
Ainit amrin
Ojnit
sW ("
csum @
1)
or 1 x xk00
max (axss(((000 20
Step 2: Strategy search via robust training
M arg min M
max (Crobust ( M, +6,4) + + Lhw o M, az),
(D
with M (M M (l)) and M (1opPaa(sss0)
Step 3: Fine-tuning of the pruned network 0 = OOOM M'
max { Loe (0, x + 6.u)
arg min (
A.7 TRAINING CONSUMPTION
In this section, we elaborate on the training (time) consumption of the pruning approaches consid- ered in our evaluation. As every method operates on the complete training dataset, we estimate the consumption
training epochs rather than wall-clock time as the latter varies with the used hardware and its load. We report the results in Table 14] The methods either follow three-stage pipeline (Han et al, 2013) or train the model from scratch with pruning considcrations their opti- mization. Consequently, the distribution of training effort per stage varies. Under this metric, MAD most efficient. However, when targeting a sparsity of 99 %. HARP arrives close its to best perfor- mance right after pruning (20 epochs) as can be seen in Fig. 10 At 99.9 % sparsity, our method uses 100 epochs for fine-tuning to recover natural accuracy but does not improve robustness anymore. Thus, HARP's pruning stage turns out to be most decisive but helps for aggressive pruning.
Table 14: Training consumption in different robust pruning methods
Method
Multi-Stage Pipeline
Number of Epochs
Han et al. 2015
Pre-training
Pruning
Fine-tuning
Total
ADMMM YYe al. 2019)
100
100
100
300
HYDRA (Shwwar
100
BCS- BCS-P Ozdemizz zoi
Legensiein 2021
X
200
200
MAD
Loe crai 2022
140
HARP (Ours)
100
220
A.8 CO2 EMISSION
We have conducted all our experiments on Nvidia -TXX33900 GPU cards and have consumed about 10, 198 GPU hours in total. This amounts to an estimated total CO2 emissions of 2,1177..2 27. kgCO2eq when using Google Cloud Platform in region europe-west.: sumes 100 % renewable-energy, such that specific CO2 emissions for the project amounts to 1.74 Kg202eq Estimates are conducted using the "Machine Learning Impact Calculator" (Lacoste)
However, our university con-
al. 2019
22


Reviews:
[{"review_id": "y3LItwmKsf", "reviewer": "Reviewer_LsE9", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes an algorithm for pruning of robust neural networks optimized under adversarial training objectives. The algorithm relies on simulatenously optimizing the (per-layer) compression rates and importance scores corresponding to the connections  that can be pruned, within a dynamic regularization scheme that balances the two objectives. This way the method allows a layer-wise non-uniform pruning scheme that preserves a whole-network sparsity rate at the end of optimization. Experimental results on CIFAR-10, SVHN and ImageNet show that the approach yields benefits particularly at very high sparsity rates starting from 99% and above.\n", "summary_of_the_review": "Generally I am convinced that the algorithm is neat and it indeed appears to be more powerful than R-ADMM (2019) and HYDRA (2020) type of methods that are more restricted to layer-wise uniform pruning percentages. However there are some ambiguities that needs to be clarified and I list my points below:\n- Overall, all figure comparisons should be also performed with a stronger attack than PGD-10 (which can be highly misleading here). Assuming that models were trained with 10-step PGD for any robust training loss as well, attack evaluations should be at least presented with 20- or 50-step PGD with 5 or 10 restarts. Going further, since the authors have involved AutoAttack evaluations, one could keep all evaluations simple by presenting all results in that setting too. For instance, can the authors present robust accuracies in Figures 1 2 and 3 under AA? \n- Attack configurations are major details that should be part of the main manuscript (at least summarized). Looking at the figure and table captions/legends, it is not possible to see with which objective the models were trained with (e.g., how many PGD steps), and what is the evaluation setting of the attack (i.e., equal number of PGD steps used during training?). For instance in Figures 2 and 3, robust training loss and attack evaluation settings are not clearly annotated.\n- Authors already state in their paper that BCS-P (2021) previously proposed a non-uniform compression strategy that outperformed HYDRA and R-ADMM. This already makes BCS-P a more relevant comparison baseline for HARP to outperform at all categories, but those evaluations appear shallow (only a single VGG16 model under the TRADES objective is studied). Can the authors extend these results on page 7 with a e.g., ResNet-18 and other robust training objectives? In that vein, for instance, authors can also include BCS-P in the plots of Figure 1.\n- The provided ImageNet model checkpoints by the authors that correspond to the Table 5 of the HYDRA paper, do not match with the results in the authors submission (Table 3). It appears like using the same dense model with Free-AT (60.25 clean acc), HYDRA achieves a different model at the end for e.g., 99% sparsity? Can the authors verify/discuss this?\n- All results compared at 99.9% appear like other methods could not get to work at that level of sparsity at all (i.e., trainings are early terminated as all clean accuracies are at chance level). At the right halves of Table 1 and 2 all accuracies are ~10-30%. How much in depth did the authors explore these methods (such best attempt details can be described in the Supplementary)? Similarly in Figure 2a and b, BCS-P appears to yield a randomly initialized 10% performing network. How much did the authors explore this method?\n- It appears like HARP necessitates a dense model to be adversarially trained in the first place, and moves on to a compute-heavy adversarial pruning phase afterwards. Given these limitations, a brief discussion of all compared methods in terms of training time and computational cost would be necessary, until one achieves the final sparse model with an associated clean/robust accuracy.\n- Can the authors provide a simulation/visualization of (possibly occurring) robust overfitting during the final stages of pruning at very high sparsity, while adapting gamma?\n- Figure 3 caption has a typo, HYDRA -> HARP. Also I believe comparisons to MAD would perhaps look better in a short table, since the available data points are very sparse.\n- The x-axis scale in Figure 1 plots looks a bit off?\n- There is a figure in page 4 without label/caption/number.", "strength_and_weaknesses": "Strengths: The paper is well written and easy to understand. Proposed algorithm scales to ImageNet and outperforms some previous methods at that scale. It is also nice that the approach is compatible with any robust training objective similar to the line of work by HYDRA and BCS-P.\n\nWeaknesses: Details describing adversarial robustness evaluation settings should be also present in the main manuscript rather than only the Supplementary. Current experimental comparisons need to be presented in a more rigorous fashion and also some of the evaluations at very high sparsity levels needs further analysis/clarification (see comments below).\n\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "jjVQqEHKFT9", "reviewer": "Reviewer_phem", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposees a novel method of HARP, which learns both compression rate and mask each layer to achieve a a high reduction rate while maintaining both the clean and adversarial accuracy of original models. Specifically, the method is delicately designed with many skills utilized to implement the non-uniform robust pruning. Experimental results validate the effectiveness of the proposed method.\n", "summary_of_the_review": "Excellent implementations to achieve adversarial robust pruning based on insight from previous works. The proposed HARP empirically works with great performance. Since the starting hypothesis is already proposed, more detailed intuitive or theoretical explanations are required to make it distinct with the previous works.", "strength_and_weaknesses": "### Strengths\n\n- The research is promising and practical in the real world. This work meets the need for  compact and adversarial-robust model under safety and computation efficiency critical scenarios. \n\n- Out of the hypothesis that layer-specific compression strategy is equally important as deciding which connections to prune, this work firstly implements non-uniform robust pruning with well-designed optimization process and firm engineering skills. \n\n- A range of experiments are neatly organized to empirically prove the correctness of the starting hypothesis in adversarial robust pruning  and demonstrate the superiority of the proposed method. \n\n### Weaknesses\n\n- There is not much novelty in the fundamental hypothesis in this work. Learnable non-uniform compression strategies have been already have been proven effective in pruning. As more parameters available for optimization, it's intuitively effective for more specific pruning task (e.g., adversarial robust pruning).\n\n- In Sec 4.3, some approaches are tried to explain the superiority of the proposed methods, but it only stucks on listing the found features. The paper could yet be strengthened further by providing more detailed interpretations over the observations.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "jLblgge-QWz", "reviewer": "Reviewer_GDVf", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a new method to prune a robust DNN with layer-wise compression rate and score-based pruning masks. Experimental study shows that, by taking advantage of both two factors, it maintains accuracy while allows for less robustness degradation than SOTAs.", "summary_of_the_review": "This paper proposes a method to prune a robust DNN with a non-uniform compression strategy. Interestingly the proposed pruning method outperforms existing ones both in terms of robustness and accuracy.", "strength_and_weaknesses": "Strength\n- It is good to see that the non-uniform compression strategy is beneficial also to adversarial (channel) pruning.\n- It shows large improvement over prior methods, robust-ADMM, HYDRA, BCS-P, and MAD.\n- It contains comprehensive discussion, extensive comparisons and ablation study.\n\nComments\n- As structural pruning is more useful and harder than weight pruning, I would suggest authors move some channel pruning results to the main text and compare with SOTAs.\n- It would be better to add the pre-trained model's performance to both Table-1 and Table-2.\n- In Table-2, why the variances of HYDRA with TRADES under 99% sparsity are such high? Can authors provide some insights about it?\n- Will the authors release the code?\n \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "T090RjrSiJ", "reviewer": "Reviewer_j8jC", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper presents a unified model compression to improve model robustness by learning the connection importance for each layer weights. In particular, the authors use a pre-trained model to learn the layer importance to meet a specific pruning budget, and gradually increases the pruning % unless a significant accuracy drop is observed.", "summary_of_the_review": "The paper presents a unified robust pruning framework that can reach SOTA accuracy by honoring the layer-wise connection sensitivity.", "strength_and_weaknesses": "## Strengths\n=============\n1. The paper is well written and organized.\n2. Results are inspiring and thorough. In particular, detailed results on large scale datasets like ImageNet is good.\n3. Literature survey is well up to date apart from few missing ones.\n\n## Weakness\n==============\n1. Please provide comparison with DNR [1] method. DNR provides better compression-vs-accuracy trade-offs for smaller and less deeper models like ResNet18, VGG16 (as per robustbench: https://github.com/RobustBench/robustbench).\n\n2. The paper uses pre-trained models to start compression and adversarial fine tuning, while there are existing works that did it from scratch [1].\n\n3. The contribution section is not clear, the authors mention about experiments in the contribution. Please be more clear in stating what is the explicit contribution of this manuscript.\n\n4. The question ***How many and which parameters to prune***, is not exactly correct in my opinion, as the ***how many*** part is governed by the target hardware's parameter support. Also, again, the learning of layer-wise pruning, that is indeed a crucial part of robust compression is being handled earlier [1]. \n\n5. Connection importance score has been well studied as well in the pruning literature [2-3].\n\nBased on the above four facts, I would really recommend the authors to reconsider the motivation of the current manuscript. This also translates to lack of significant contribution for the paper to cross the border of ICLR acceptance.\n\n6. Please detail about the training cost for HARP, including that of pre-training, to reach a specific parameter budget.\n\n7. The robust compression details are not clear. In particular, whether the authors use traditional PGD-7 attack to create adversary or leverage faster variants like FAT [4], should be mentioned with more clarity.\n\n8. Also, HYDRA is not the SOTA paper on robust pruning starting from a pretrained model.\n\n[1] DNR: A Tunable Robust Pruning Framework Through Dynamic Network Rewiring of DNNs, ASP-DAC 2021.\n\n[2] Snip: Single-shot network pruning based on connection sensitivity, ICLR 2019.\n\n[3] Pruning neural networks at initialization: Why are we missing the mark?, ICLR 2021.\n\n[4] Fast is better than free: Revisiting adversarial training, ICLR 2020.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster