Defending Against Adversarial Attacks via Neural Dynamic System
Authors: Xiyuan Li
Xin Zou
Weiwei Liu
Venue: NeurIPS 2022 Accept (2022)
Keywords: ordinary differential equation (ODE)

Abstract: Although deep neural networks (DNN) have achieved great success, their applications in safety-critical areas are hindered due to their vulnerability to adversarial attacks. Some recent works have accordingly proposed to enhance the robustness of DNN from a dynamic system perspective. Following this line of inquiry, and inspired by the asymptotic stability of the general nonautonomous dynamical system, we propose to make each clean instance be the asymptotically stable equilibrium points of a slowly time-varying system in order to defend against adversarial attacks. We present a theoretical guarantee that if a clean instance is an asymptotically stable equilibrium point and the adversarial instance is in the neighborhood of this point, the asymptotic stability will reduce the adversarial noise to bring the adversarial instance close to the clean instance. Motivated by our theoretical results, we go on to propose a nonautonomous neural ordinary differential equation (ASODE) and place constraints on its corresponding linear time-variant system to make all clean instances act as its asymptotically stable equilibrium points. Our analysis suggests that the constraints can be converted to regularizers in implementation. The experimental results show that ASODE improves robustness against adversarial attacks and outperforms state-of-the-art methods.

Defending Against Adversarial Attacks via Neural Dynamic System
Xiyuan Li
Xin Zou School of Computer Science
Weiwei Liu"
School of Computer Science
School of Computer Science Wuhan University
Wuhan University dee_xxyuan@outlook. com
Wuhan University
zouxin2021 1ame221@@maall.mmmmm com
1 1iuweiwee1863@@mall.ccm
Abstract
Although deep neural networks (DNN) have achieved great success, their applica- tions in safety-critical areas are hindered due their vulnerability adversarial attacks. Some recent works have accordingly proposed to enhance the robust- ness of DNN from dynamic system perspective. Following this line of inquiry, and inspired by the asymptotic stability of the general nonautonomous dynami- cal system, propose make each clean instance be the asymptotically stable equilibrium points of a slowly time-varying system in order to defend against adversarial attacks. We present theoretical guarantee that if clean instance is an asymptotically stable equilibrium point and the adversarial instance is in the neighborhood of this point, the asymptotic stability will reduce the adversarial noise to bring the adversarial instance close to the clean instance. Motivated by our theoretical results, we go on to propose nonautonomous neural ordinary differential equation (ASODE) and place constraints on its corresponding linear variant system make all clean instances act as its asymptotically stable equilibrium points. Our analysis suggests that the constraints can be converted to regularizers in implementation. The experimental results show that ASODE improves robustness against adversarial attacks and outperforms the state-of-the-art methods.
Introduction
Deep neural networks (DNNs) have achieved great success range of tasks, including image
recognition [ 22. scene segmentation B S and action recognition [6] 77.. However, their
performance can be significantly affected by human-iimercees iimpr-ippprceptible perturbations that can drastically change the network's 's output 8 9 This phenomenon seriously restricts the application of DNN in safety-critical fields such as automatic driving.
Recently, some methods have been proposed to defend against adversarial attacks from the perspective of dynamic systems. The paper [10] proposes time-invariant steady neural ODE (TisODE) limit the evolution of the curves by forcing the integrand to be close to zero. However, this approach does guarantee that small perturbations of the initial point will lead small perturbations in the output at time T. To reduce perturbations on the initial point, SODEF (II] causes the extracted features to be located within neighborhood of the Lyapunov-stable equilibrium points of the autonomous ODE, However, there are still some drawbacks of SODEF: 1. In the papers 13), the general dynamical system explicitly depends on the argument and is referred to as a nonautonomous dynamical system. However, SODEF only considers the autonomous case, which is simply special class of ODE. As shown in Figure (a), Lyapunov stability only controls the perturbations of the input rather than eliminating the effects of perturbations; simply maintaining the perturbations may still lead
Corresponning author
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

Tieed
1.30
1.5
1.50
085
085
12
ude
(a) Lyapunov stability for z(t) =
(b) Asymptotic stability for x(t) = 0. 0.1z( x(t))
Figure 1: Comparison of Lyapunov stability and asymptotic stability at equilibrium point 1.
to the misclassification of SODEF. 3. SODEF ensures that the output of the extractor is located in the neighborhood of the Lyapunov-stabl equilibrium points; thus, the performance of SODEF depends on the extractor. Specifically, if the extracted features deviate from real features, SODEF would regard the false features the Lyapumov equilibrium points; accordingly, the perturbed input of neural ODE will converge to the incorrect features, which would lead to misclassification of SODEF. These also the major difference between SODEF and our method.
To solve the problems, this paper, we first divide the instances into clean instance x, perturbed instance X, and contaminated instance X, which are shown in Figure 2 Instances in the yellow and blue region of the same ball naturally have the same label y. Then, the vulnerability of DNN to perturbation can be illustrated as following: The function f is constructed by DNN. f makes correct prediction when the input instance clean, but makes wrong prediction when the input contaminated. In other words, we have f(x) y and f(x) & y. Therefore, we make x converge to x by dynamic system improve the robustness DNN. Compared with SODEF, we consider a more general nonautonomous case:
dz(() h(2(t).t)
dt
As shown in Figure (b), asymptotic stability helps reduce the perturbation as increases. Therefore, we make each clean instance into an asymptotically stable equilibrium point and locate the perturbed instance neighborhood. In order to do this, we transform the nonautonomous
Figure 2: The set including all yellow balls in the coordinate space is the clean instance domain X' For convenience, we magnify a yellow ball on the right. The point in the yellow ball corresponds to clean instance instance X that is still recognizable. The perturbed instance corresponds the blue and yellow regions. The instance in the blue region is referred to the contaminated instance & Instances in the yellow and blue region of the same ball naturally have the same label y. The red spiral line the trajectory along which the contaminated instance & converges to clean instance x.
We place perturbations on the instance in the yellow ball to form a perturbed

---

ODE ①
into a time-variant linear state-space space equation, as follows:
dz(t) ((t)(z(t)- x)).
(2)
dt
According to nonlinear dynamic system theory [14]. (2) is exponentially stable if the nonautonomous
ODE D a slowly varying system and the Jacobian matrix 2(t) = (z(()), 7) corresponds is exponentially stable. This holds because if all eigenvalues of A have negative real parts, A is exponentially stable. We use the wey-Desplanques theorem [5] to add constraints to the elements of Jacobian matrix A to ensure that all eigenvalues of A have negative real parts. We solve the stability of (T) by imposing constraints on its linearization. Additionally, rather than applying neural ODE to the output of the extractor, we instead apply neural ODE directly on the instance x E X' to eliminate the effects of perturbations. The process is also illustrated in Figure 2 where the perturbed instance x + d converges to the clean instance along the red trajectory. Based on the theoretical analysis above, we propose a stable neural ODE (ASODE) with asymptotic stable equilibrium points for defending against adversarial attacks, and further construct optimization formulation to make it satisfy the asymptotic stability. Moreover, we conduct experiments to compare the robustness of ASODE with ODE-Net [121. TisODE-Net [10] and SODEF M under different adversaril attacks on the CIFAR-10 16 and MNIST [7] datasets. The results shows that ASODE outperforms the state- thettrr SODEF. Moreover, both ASODE and SODEF far more robust than ODE-Net and TistDE-Net. For example, compared with the state-of-the neural ODE network SODEF under PGD attack on the MNIST and CIFAR-10 10 datasets, our ASODE improves the classification accuracy of adversarial examples by 1.60% and 1. 1.76%, respectively. Furthermore, compared with the TisODE-Net on the same datasets under PGD attack, ASODE improves the classification accuracy of adversarial examples by 45.07% and 53.53%, respectively.
which each frozen system
2 Related Work
Neural ODEs The relationship between the ODEs and neural networks has been illustrated by
[8] The papers [99 20 21 regard residual networks as a form of explicit Fuler discretization
with unit step size. Based on this, various perspectives and methods from numerical analysis have
been employed to improve the network architecture [8] (22), minimize memory overload [12, reduce
training time
23 and facilitate adaptivity to other models (e.g., transformers 24
Adversarial Defense Many methods have been proposed to improve the robustness of neural networks via training using different strategies, including Bayesian adversarial learning (25], various
regularization [26] 27), adversarial training and its variants (28 29 30 3T] Moreover, some works explore adversarial robustness from the perspective of the stability of the numerical ODE dynamic system. For example, 332 reduces feature noise using ODE to develop a robust architecture. [13]
proposes new robust architecture, improving the robustness of the original residual network family via the implicit Euler method of ODE.
Among the works, K3 is the first work to use control theory and dynamic systems to improve robustness, which is different from our work in the types of nonlinear system and the inputs. [34] uses the property of radial basis function (RBF) to improve the robust, not ODE. In the work most closely related to ours, [IT] designs a stable neural autonomous ODE with Lyapunov-stable equilibrium points for defending against adversarial attacks. The syapunov-stabilng ensures that the input features from the extractor with a small perturbation converge to the unperturbed input features. We study more general case called nonautonomous system. Based this, directly reduce the adversarial noise on the instance by ensuring that the perturbed instances are in the neighborhood of asymptotically stable equilibrium points of nonautonomous ODE. Therefore, we purify the sample and improve the network robustness.
of the autonomous ODE
3 Preliminaries
Let D be a probability distribution over X' V, where X' is the instance domain set and y is the
set of labels. (x,, Yn) is sampled from 2, where Xx E Rd yn E RT and n = 2, .... N. Dz is the marginal distribution of x over y. h(((t), t) is a continuous function of Rd x R into Rd: here, E R R (l E TR 1 1 0}, z E Idd z(t) R+ - Rd. Moreover, we use Vh(z, 1) to denote its Jacobian at C¹ represents the function with first-order derivative; || denotes
3

---

the Euclidean norm: I is a d-dimensional vector in which each element is equal to 1. Finally, Bx(x*) fx RR :||x ||x- xxI 5}.
The d-dimensional instance x X' can be seen point in the space R. However, shown in Figure 3 (c), not every point of I2 has the label y. Figure 3 (b) is the perturbed Figure 3 (a), in which the perturbation can be arbitrarily small. Figure (b) naturally has the label "6" and is in the instance domain. For each x E X, there exists a continuous bounded neighborhood B& (x) such that (x) X' and the instances in (x have the same label y. Thus, the instance domain X' corresponds to the bounded ball cloud in Ied, which is represented by the yellow balls in the coordinate space of Figure 2 In addition, if we apply perturbation to each x E X to form new instance domain X the elements of which are denoted by x, then we can determine that includes the adversarial samples and X c X. We make Dx the marginal distribution of x over These conclusions are directly demonstrated in the magnified ball of Figure 2 Based on the analysis of this magnified ball, we define clean instance for x X. perturbed instance for X E X,, and contaminated instance for & E fx X E X X)
6
6
(a) Clean instance
(b) Perturbed instance
(c) No label instance
Figure 3: Instances sampled from R 28228 The perturbed instance is in the neighborhood of the clean instance, but no label instance is far away from any clean instance.
Consider nonautonomous initial value ODE problem,
dz(t) h(z(t),t), 22 tu. dl
(3)
z(ta) = zo
Suppose the function h satisfies a global Lipschitz condition
14 section 2.4.2], then, the solution of
(3) is exist and unique over & E co). The solution of (1 is denoted as zt) with input z and output z(T) In (3) 2g is the initial value of ztt) at to- If to 0, we have z(0) Zg x. Meanwhile, let s Zn, lo. () denote the solution of (3) corresponding to the initial input 20 at lg- For
simplicity, we use s(x, 1) to denote szn, 0, t). Obviously, if the initial value for ODE 1 is given by 2(0) x, the two representations are equivalent, and we have 2(t) = s(x, 1). z(0) s(x, 0) z(T) = s(x, T).
Definition (Equilibrium
14) A vector x" is said to be an equilibrium of 7 if. h(xx,,,,.____ 1) = O.
11 0.
According to Definition 1 for any given x E X, the solution of (3 is z(1) = x, Z 0. then h(xx,) 1) = di = 0, and an equilibrium of (T.. On the other hand, if x is an equilibrium, has the unique solution z(t) x, 2 0 for the initial value z(0) x. In other words, if system starts in an equilibrium, it remains in that state thereafter.
A constant vector x" E RRd is a stable equilibrium point for D if. for each > 0 and each E R+ there exists ō(e, to) such that for each 2o Bs(x"), [[5 to,t)
Definition 2 (Stability
35
x"1 < e, Vt to.
As shown in Figure 1 (a), whose ODE is ((() = 0 with z(0) = x X' (here, x=1), for each > 0.
there exists 8 < S such that |]s(x + 5, x = ||x + x|| =
|||x ||x II x 6. Therefore, X is the stable equilibrium point of ODE and also the Lyapunov-stabl equilibrium point.
Definition 3 (Attractivity (55 A constant vector x* Rd is an altractive equilibrium point for T if for each in E I there exists 5(1n) > O such that for each 2o E BB Bx(x)), lim ||s(2o, lo, L)
t-0+00
x" x"| 0.

---

Definition 4 (Asymptotic stability (35)) A constant vector x" I is asymptotically stable if it is both stable and attractive.
It is worth noting that if an equilibrium is exponentially stable, it is also asymptotically stable with exponential convergence. As shown in Figure [ x 1 in Figure (b) is an attractive equilibrium in Figure (a) is not. Morcover, x 1 is also asymptotically stable in Figure (b).
point, but
Based on the notation above, we aim to make the contaminated instance converge to the clean instance x. In order to accomplish this evolution, we impose constraints on the ODE 1 to output (T) when the input z0) x Bg(x), In order to let lim ||s($; t)
0, where
E (x)),, we make all x E X the asymptotically stable equilibrium points.
Theorem Suppose the perturbed instance X produced by adding perturbation smaller than ô on the clean instance. If all the clean instances X are the asymptotically stable equilibrium points
of ODE dy. there exists 8 >> 0, for each contaminated instance & E {x x E X, $ X), there exists
X such that lim ||s($t, t) x
++++00
See proof in Appendix A.1
Theorem guarantees that if we make clean instance x into the asymptotically stable equilibrium point, nonautonomous ODE can shrink the perturbation and make the perturbed instance approach to the clean instance, which could help improve the robustness of the DNN and aid the DNN in defending against adversarial attack. Next, we talk about how to ensure the ODE has asymptotic stability.
4 Linearization and Stability of ODE
In order make the nonautonomous ODE ( have asymptotic stability, we linearize ODE using Lyapunov's 's linearization method. We then impose constraints on the linearization to make ODE asymptotically stable.
Suppose x" is an equilibrium point of nonautonomous systems
h(x", ()) 0, v4 2 0,
(4)
where h is C' function. We define
A(t) Thh(2, f) Oz
(5)
x=x
(z, h(z (t)(zz (x-xx)
(6)
Then, by the definition of the Jacobian, follows that for each fixed 2 0, it is true that
1 (2, 0)ll
lim ||
x+1 0.
(7)
However, it may not be true that
h (z, 1)
lim sup |x]| + e20
(8)
I x"
In other words, the convergence in may not be uniform in t. Provided that ( holds, the system dz(()
A(t) -x)x).
dt
is referred to as the linearization of [ around the equilibrium x"
Theorem Suppose that (4) holds and lzz,,) () is continuously differentiable. Define A(I), hy (2, 1) as in (5). (6), respectively, and assume that (8) holds and A(l) is bounded. xfx" is exponentially stable equilibrium of the linear system (9) then also an exponentially stable equilibrium of the system 7
5

---

See proof in Appendix A.2
In order make all the equilibrium points of (9) asymptotically stable, we deduce the stability of the nonautonomous system (I) by studying only the "frozen" systems; that is, the ODE ① with time "frozen" at r. In other words, if IR is any fixed number, we can think of the autonomous system
dz(() h(z(t), r), A4 0, dt
(10)
If x" is the equilibrium point, then A 1 ===x is a constant matrix and the linearization (9) becomes z(t) A(z x*). Moreover, we use (x, t) to denote the solution of frozen system (T), starting at time and state x, and evaluated at time Even if each of the frozen systems (IO)
exponentially stable, the overall system can be unstable [14]. Next, we will prove that if each
frozen system is exponentially stable and the system is slowly varying, the overall system is indeed exponentially stable.
Theorem Suppose (i) h C','nx",tt 0, and (ii) sup sup Vh[z- +)] = 7 < co.
zER" 120
(iti) there exist constants μ. such that |s, x², +)ll < pl|z x 2 0, Vz
R" Vr R+ (iv) suppose there is constant 0 such that
Ōh(z x*,1) S cliz - x 1
(11)
Öt
Then the nonautonomous systems is exponentially stable provided any number such that (p- 1)8
8(p-1)6-11 ppo
where p >
7 > 0.
See proof in Appendix A.3
Based on Theorems and we impose constraints on ODE (T)
be slowly varying systems and
linearize it to be (9). In order to make (9) stable, we transform the study of nonautonomous system (1) the study of autonomous system 110: in other words, we should make z(t) A x*)
asymptotically stable. The following two theorems provide ideas for solving this problem.
Theorem (114) The equation zz() Az is asymptotically stable if and only if all eigenvalues of
A have negative real parts.
Theorem (Levy-Desplangue) theorem 15
Let A = [aay] E
Mn. if |a,il
Σ |oaj] and a;s I
0 for all i -.... n, then every eigenvalue of A has negative real part.
According theorem we need make all eigenvalues of each Jabobian matrix A of (TO) at cquilibrium points have negative real parts. In addition, in the light of the Levy-Desplanques theorem [5], rather than computing the eigenvalues, we instead add constraints the elements of Jacobian matrix A to make all its eigenvalues have negative real parts. Finally, we make all equilibrium points of the nonautonomous system asymptotically stable by adding constraints on its linearization.
To sum up. we linearize the slowly varying nonautonomous ODE (1) and impose constraints on its linearization (9) to make all clean instances be the asymptotically stable equilibrium points of (1).
5 ASODE Architecture
This section proposes a stable neural ODE (ASODE) with asymptotically stable equilibrium points for defending against adversarial attacks. To make all clean instances into the asymptotically stable equilibrium points of neural ODE, we construct an optimization problem according to the constraints mentioned in section To solve this optimization problem, we propose an objective with constraints imposed on its regularizer.

---

ODE
model
dz(t) dt
z(0) Xn +
(g(2()),t)
z(T) Xn
y = fo(z(T))
Yn
Figure The architecture of our ASODE.
5.1 Architecture
Most physical systems are nonlinear and time-varying. If we apply DNNs to dynamic systems, some of them can be described by nonlinear differential equations of the form,
dz(t) ha (z()),), Vt E [0,
(12)
di
- (z(((())) = x, X'
(13)
where he is a neural ODE layer with parameter and defined as IR x IR+ - Rd. Similarly. fg is neural network with parameter and defined as I2 R.". Because the evolutionary time neural ODE cannot be infinity, we set the final evolutionary time T and L E [0, T). where T is positive integer. Inspired by the neural dynamical forms, we propose the ASODE architecture and present in Figure 4 The ASODE can be simplified as follows: ODE model. The ODE part can be regarded as a denoiser, which helps to reduce the noise, including the adversarial noise, to rectify the perturbed instance x, + 8. The output of ODE is rectified instance 2(T)) X, when T is sufficiently large. Subsequently, the rectified instance (T)) enters the grafted model fz. and the final output label not affected.
5.2 Asymptotic Stable Guarantee
As mentioned in section we make all x E the asymptotically stable equilibrium points of neural ODE (12). According to the analysis in section 4 we transform the slowly time-varying ODE (12) to the linear time-varying state equation ztt) = A (t) (z(t) x) and simplify the nonautonomous system
12) to autonomous system di
ho (z)))r).. We then make 2(() A(z x x) asymptotically ig x==x Next, we apply the
dz(()
(bb((z.))
theorem to add constraints on the elements of Jacobian matrix A to make all its cigenvalues have negative real parts. Therefore,
stable, where
we have the following optimization problem for the ODE part of ASODE:
min E 8
(LB,G) (x) x)]
(14)
x~
DD
S.t.E
X t)] S C1,,
(15)
Th (z, t) |1/ ||||| c2
E
(16)
E
v ho (x. t)) < 0,
(17)
E
[| 1)]al
-E Vho t)]s,]] > 0,
(18)
J+1
Vt E [0. 7] and i.j = 1,2, ,d,
1 Bs(x),
where t is the cross-entropy loss, 6 and 62 are small constants, and I (B
0, & Bx(x).
The optimization objective [14 can be illustrated as follows: For any E X, if the perturbed instance X (x),,, we want the the neural ODE 12 make x converge to x. Therefore, our
objective is to minimize the distance between s(X, T) and x. The constraint (15) means that we
set each x E X as the asymptotically stable equilibrium point of neural ODE (12) which requires
he(r, = 0 according to Definition I The constraint (16) implies that we make the neural ODE
7

---

the slowly time varying system, which requires
[ S <|||||| according to the formulation
in Theorem 3 The other conditions for Theorem are implicitly satisfied when is bounded. Besides, the constraints (17) and (18) follows the Le Desplanques Theorem 5 to make neural ODE
asymptotically stable.
5.3
Implementation
Rather than solving the optimization problem (4). we optimize the following empirical Lagrangian
(24 with a training set yn). n. 1,2, ... ,N.. Moreover, x (2) Xx
(K) are K samples
from (x,, used to represent X. In addition. 5 = 0. 1.... ,T are the discrete time points. The
correspondence and transformation between 14 and (24 are following:
K (s((x ,T), ,T,,,,). x,):
1
(s(x,, T), x.) +
(19)
NK
(x. 7)1b
(20)
NT
N
@h(s(xn: 1),t) 1)
( [|s(xn
(21)
NT
Ot
7=0
N
ΣΣΣ
Vhha 7lan)
(22)
NT N T-1
d
Σ j=1if
Vho 7)ool)
(23)
NT
The constraints 115 (16), 17 and 18) correspond to the discretization forms 20
22 and
23 respectively. Furthermore, the objective (I4) corresponds to (19). Based on the analysis of the
optimization problem (14), we get that the smaller the values (19)- 23 are, the better the neural
ODE is. Therefore, we construct the following empirical loss LODE:
K
T-1 +
LODE = min
Σ N 1=1
(s((xn) Xn)
+
1
(s((x
(b) (),, xn)
Σ
(24)
K
T
A=
ah(s(xn, t),t)
[ r)ll + 11(
||s(X
r)1
ai
Ōt
1=+
}}}
02
exp
(ho Dial + exp
(ho(X,,
T)]al +
Σ
Who T)ss ())
j=1.jzi
According to our proposed ASODE, finding the optimal 0 is the first phase in making the ODE 12 good denoiser that is capable of reducing the adversarial noise. We then fix the neural ODE 22 and train the grafted model as: min IF
( (f))( y)]. Its empirical loss is Lmodet:
(x,y)~
Lynddl
min
N Σ (ff vn).
(25)
In sum, our ASODE has two parts: the neural part plays the role of denoiser, and the grafted model has the ability of recognition. In order to obtain the dynamic systems as we expected, we propose two related optimization problems (24) and (25). Finally, we solve these two optimization problems
(24) and (25 to make all the clean instances be the asymptotically stable equilibrium points of the
neural ODE (2), thereby improving the robustness of our ASODE. The pseudo code of ASODE
algorithm is illustrated in Appendix B which is from bringing the process above together.

---

Experiments
In this section, conduct experiments the CIFAR-10 16 and MNIST 17 datasets evaluate the robustness of ASODE under different adversarial attacks. We follow the standard training. validation, and test splits in experiments. Moreover, compare the robustmess of ASODE with ODE-Net 12] TisODE-Net [00, and SODEF 11.
6.1 Setup
We apply different attack methods to attack our model, namely FGSM (29] and PGD [28]. Following the same experimental settings as for SODEF, we implement the following settings. 1. For the CIFAR-10 10 task, we use the model provided in [6] 2. For the MNIST task, we use the ResNet 8 model provided in PyTorch. The baselines are re-implemented according to the original paper. The neural ODE function he is made up of three fully connected layers whose input and output layers have the same dimension. During the training of ASODE, we first train the neural ODE for 50 epochs, after which we fix he and train f for another 100 epochs. We set the parameters di = 0.1 and 022 = 0.05 when training ASODE. In the below, the best results are marked bold.
6.2 Performance Under PGD and FGSM Attacks
We evaluate the robustmess of our ASODE under PGD) attack and FGSM attack. Specifically, we compare the robustness of ASODE with ODE-Net, TisODE-Net and SODEF on the MNIST and CIFAR-10. To facilitate fair comparison, we set T based on the original papers of the comparison models. The results on MNIST and CIFAR-10 are presented in Table and Table respectivey.. As the results show, under PGD and FGSM attacks, our model ASODE outperforms the state-of-the-art SODEF; moreover, ASODE also performs much better than ODE-Net and TisODE-Net. For example, compared with SODEF under PGD attack on the MNIST and CIFAR-10, our ASODE improves the classification accuracy of adversarial examples by 1.60% and 1.76% respectively. Furthermore. compared with TisODE-NO are increased by 45.07 45.07% and 53.53% respectively. The "NO ODE" Tables and corresponds to ASODE without the ODE part. For ablation studies, we find that ASODE is more robust than NO ODE, which indicates that ODE part (12) helps improve the robustness.
on the same datasets, the classification accuracy obtained by SODEF
Table 1 Classification accuracy (%) on adversarial MNIST examples with Loe norm, = 0.3.
Attack
No ODE
ODE
TisODE
SODEF
ASODE
None
99.45
99.40
99.41
99.44
99.44
FGSM
9.87
29.51
36.82
63.36
65.13
PGD
0.36
1.68
1.78
45.25
46.85
Table 2: Classification accuracy (%) on adversarial CIFAR-10
10 examples with Loo norm, = 0.031.
Attack
No ODE
ODE
TisODE
SODEF
ASODE
None
95.20
94.76
95.12
95.00
95.16
FGSM
47.54
45.12
43.37
68.05
69.94
PGD
3.18
3.50
3.82
55.59
57.35
7 Conclusion
In this paper, we develope a novel nonautonomous time-slowing varying neural ODE, ASODE, that makes all clean instances be its asymptotically stable equilibrium points. ASODE shrinks the adversarial noise and forces the adversarial instance to be close to the clean instance. The experimental results show that ASODE improves the robustness against adversarial attacks and outperforms the state-of-the-art methods.
Acknowledgements
This work is supported by the National Natural Science Foundation of China under Grant 61976161.

---

References
[1] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, pages 770-778, 2016.
[2] Weiwei Liu, Donna Xu, Ivor W. Tsang, and Wenjie Zhang. Metric learning for multi-output tasks. IEEE Transactions pattern analysis and machine intelligence, 41(2):408 422, 2019.
[3] Liang-Chieh Chen, George Papandreou, lasonas Kokkinos, Kevin Murphy, and Alan L. Yuille. Deeplab: Semantic image segmentation with deep convolutional nets, atrous convolution, and fully connected crfs. IEEE Transactions on Pattern Analysis and Machine Intelligence. 40(4):834-848, 2018.
[4] Xiuwen Gong, Dong Yuan, and Wei Bao. Discriminative metric learning for partial label learning. IEEE Transactions on Neural Networks and Learning Systems, pages 1-12, 2021.
[5] Xiuwen Gong, Dong Yuan, and Wei Bao. Top-k partial label machine. IEEE Transactions on Neural Networks and Learning Systems, pages 1-14, 2021.
[6] Du Tran, Heng Wang, Lorenzo Torresani, Jamie Ray, Yann LeCun, and Manohar Paluri. A closer look spatiotemporal convolutions for action recognition. In CVPR, pages 6450-6459, 2018.
[7] Xiuwen Gong, Jiahui Yang, Dong Yuan, and Wei Bao. Generalized large margin knn for partial label learning. IEEE Transactions on Multimedia, 24:1055-1065 1066, 2022.
[8] Christian Szegedy, Wojeiech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
[9] Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. Adversarial attacks on neural networks for graph data. In IJCAI, pages
2019.
[10] Hanshu Yan, Jiawei Du, Vincent Y. F. Tan, and Jiashi Feng. On robustness of neural ordinary differential equations. In ICLR, 2020.
[11] Qiyu Kang, Yang Song, Qinxu Ding, and Wee Peng Tay, Stable neural ODE with lyapunov- stable equilibrium points for defending against adversarial attacks, In NewrlPS, pages 14925- 14937, 2021.
[12] Tian Qi Chen, Yulia Rubanova, Jesse Bettencourt, and David Duvenaud. Neural ordinary differential equations. In NeurIPS, pages 6572-6583, 2018.
[13] Mingjie Li, Lingshen He, and Zhouchen Lin. Implicit euler skip connections: Enhancing adversarial robustness via numerical stability. In ICML,, volume 119, pages 5874-5883.
[14] Mathukumalli Vidyasagar. Nonlinear systems analysis. 2002.
[15] Horn Roger and Johnson Charles R. Matrix analysis. Cambridge university press, 2012.
[16] Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical report, 2009.
[17] Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(1 (((1)):277-232) 1998.
[18] Yiping Lu, Aoxiao Zhong, Quanzheng Li, and Bin Dong. Beyond finite layer neural networks: Bridging deep architectures and numerical differential equations. In ICML, volume 80, pages 3282-3291, 2018
[19] Eldad Haber and Lars Ruthotto. Stable architectures for deep neural networks. CoRR, Abs/1705.0334. 2017.
[20] Weinan. A proposal on machine learning via dynamical systems. Communications in Mathematics and Statistics, 5(1):1-11, 2017.
10

---

[21] Lars Ruthotto and Eldad Haber. Deep neural networks motivated by partial differential equations. Journal of Mathematical Imaging and Vision, 62(3):352-364, 2020.
[22] Marco Ciccone, Marco Gallieri, Jonathan Masci, Christian Osendorfer, and Faustino J. Gomez Nais-net: Stable deep networks from non-autonomous differential equations. In NeurIPS, pages 3029-3039, 2018.
[23] Bo Chang, Lili Meng, Eldad Haber, Frederick Tung, and David Begert. Multi-level residual networks from dynamical systems view. ICLR, 2018.
[24] Yiping Lu, Zhuohan Li, Di He, Zhiqing Sun, Bin Dong, Tao Qin, Liwei Wang, and Tie-Yan Liu. Understanding and improving transformer from multi-particle dynamic system point of view. CoRR, abs/1906.02762, 2019.
[25] Nanyang and Zhanxing Zhu. Bayesian adversarial learning. In NeurlPS, pages 6901, 2018.
[26] Daniel Jakubovitz and Raja Giryes. Improving DNN robustness to adversarial attacks using jacobian regularization. In ECCV, volume 11216, pages 525-541, 2018.
[27] Moustapha Cissé, Piotr Bojanowski, Edouard Grave, Yann N. Dauphin, and Nicolas Usumier. Parseval networks: Improving robustness to adversarial examples. ICML,, volume 70, pages 854-863. 2017.
[28] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
[29] lan Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. In ICLR, 2015.
[30] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, volume 97, pages 7472-7482. 2019.
[31] Zekai Wang and Weiwei Liu. Robustness verification for contrastive learning. In ICMI, volume 162, pages 22865-22883, 2022.
[32] Jan Svoboda, Jonathan Masci, Federico Monti, Michael M. Bronstein, and Leonidas J. Guibas. Peernets: Exploiting peer wisdom against adversarial attacks. In ICLR, 2019.
[33] Arash Rahnama, André T. Nguyen, and Edward Raff. Robust design deep neural networks against adversarial attacks based on Iyapunov theory. In CVPR, pages 8175-8184 2020.
[34] Battista Biggio, Giorgio Fumera, and Fabio Roli. Security evaluation of pattern classifiers under attack. IEEE Transactions on Knowledge and Data Engineering. 2017.
[35] Bhatia Nam Parshad and Szegö Giorgio P. Stability theory of dynamical systems. 2002.
[36] Kuang liu. pytorch- cifar
Github pytorch-cifar repository. May 1, 2022.
https://github.ccm http://itthub..ccmkkuaagiggi
[37] Chi-Tsong Chen.
Linear system theory and design. 1999.
[38] Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In ICML, volume 97, pages 144 2019.

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [N/A]
(c) Did you discuss any potential negative societal impacts of your work? [N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [Yes]
(b) Did you include complete proofs of all theoretical results? [Yes]
3. If you experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either the supplemental material or as URL)? [N/A]
(b) Did you specify all the training details (e.g., data splits. hyperparameters, how they were chosen)? [Yes]
(c) Did you report error bars (e.g.. with respect the random seed after running experi- ments multiple times)? [N/A]
(d) Did you include the total amount of compute and the type of resources used (c.g., type of GPUs, internal cluster, or cloud provider)? [N/A]
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [N/A]
(c) Did you include any new assets either in the supplemental material or as a URL? [N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you're rou're using/curating? [N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applicable? [N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent participant compensation? [N/A]
12


Reviews:
[{"review_id": "yRoy2uNt1u9", "reviewer": "Reviewer_i5LX", "summary": "The paper proposes a control theory approach to robustness by trying to turn \"clean\" data points into a kind of attractor basin, such that perturbations are \"denoised\" by being attracted back to better-behaved spaces of the neural network. This results in improved classification accuracy under strong attacks like PGD and AutoAttack ", "questions": "The following reproducibility checklist questions have been incorrectly marked as \"Not Applicable\", please answer them: \n\n* Did you describe the limitations of your work? [N/A] (You didn't, please address)\n* Did you discuss any potential negative societal impacts of your work? [N/A] \n* Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)? (You didn't, please address) \n* Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] (You did not, this is incorrect - e.g., optimizer details are missing) \n* Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)? [N/A]\n* Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [N/A] ", "limitations": "The approach is not applicable to any non-differentiable method like decision trees, and would be especially challenging to combine with current adversarial training techniques. These and other limitations should be addressed in the work. ", "rating": 7, "confidence": 5, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The idea of the paper is very interesting, and I like the approach. The improved robustness under attack is validating, my problems with the paper stem purely from its presentation. The paper does not state limitations, provides code, and is poorly organized for accessibility. \n\nThe paper can be hard to follow, e.g., Figure 2 is referenced before Figure 1 is even seen/referenced! In particular, there is a long theoretical journey to developing the proposed method that is very math-heavy. The work would benefit enormously from some pseudo code / a final \"bring it all together\" section. This is exacerbated by a lack of code and the authors ignoring/lying the reproducibility checklist (see questions), and I am strongly against an essentially unanotated equation (19) being the final distillation - its needlessly unreadable. \n\n\nI overall like the idea, but believe two key related works are missing from the discussion. Most importantly [A], which is the first work to use control theory and dynamic systems to improve robustness, showing global perturbation bounds for a neural network by treating the parameters as an evolving system that needs to be kept stable. Second [B] showed that RBF style functions are naturally more robust to attack, of which I think this work is related by using the ODE to create attractor basins near \"clean\" samples is reminiscent at a high level. \n\n[A] Rahnama, A., Nguyen, A. T., & Raff, E. (2020). Robust Design of Deep Neural Networks against Adversarial Attacks based on Lyapunov Theory. The IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 8178–8187. http://arxiv.org/abs/1911.04636\n[B] Biggio, B., Fumera, G., & Roli, F. (2014). Security evaluation of pattern classifiers under attack. IEEE Transactions on Knowledge and Data Engineering, 26(4), 984–996. https://doi.org/10.1109/TKDE.2013.57 \n\n-------------\n\nI was in a bad mood when I wrote the OG review, I again apologize. I think the revision has satisficed - though not fully satiated, improved readability. But I need to draw the line between what I would prefer vs what is indeed an improvement and valuable contribution. I've raised my score accordingly. If the authors feel they can further improve the presentation I'm willing to further raise if successful. \n\n----\n\nRe-reading I've updated my score. I'm having trouble separating my personal style preferences that are quite different from the reviews - and style differences are no reason to reject a work. So I'm hedging that others will find the paper more inviting given the improvements than I do. I think all objectively 'bad' writing style has been fixed. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "aujXMGeDIdB", "reviewer": "Reviewer_7GZb", "summary": "Inspired by the asymptotic stability of the general nonautonomous dynamical system, the asymptotic stability will reduce the adversarial noise to bring the adversarial instance close to the clean instance. Motivated by the theoretical results, the authors propose a nonautonomous neural ordinary differential equation (ASODE) and place constraints on its corresponding linear time-variant system to make all clean instances act as the asymptotically stable equilibrium points of a slowly time-varying system. In the implementation, the authors convert the constraints to regularizers of the loss function. The experimental results show that ASODE improves robustness against adversarial attacks and outperforms the state-of-the-art methods.", "questions": "See the weaknesses above.", "limitations": "The paper has no potential negative societal impact.", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The paper bridges the gap between the asymptotic stability of ODE and robustness against adversarial attacks. The asymptotic stability of ODE helps reduce the adversarial noise. \n\n2. The authors provide some theories to transform the general nonautonomous dynamical system into a linear time-variant system. Based on the transformation, the authors create a new loss function by the constraints on the linear time-variant system to make all clean instances act as the asymptotically stable equilibrium points. \n\n3. The authors carefully proved the claims and further propose a nonautonomous neural ordinary differential equation (ASODE) that uses the asymptotic stability of ODE to bring the adversarial instance close to the clean instance. Experiments show that ASODE improves robustness against adversarial attacks and outperforms the state-of-the-art methods, which shows the significance of this work.\n\n4. The analysis presented in the main paper and the appendix is thorough enough.\n\nWeaknesses:\n\n1. the reason why the authors use a dynamic system in this paper is not elaborated on.\n\n2. The application of theorem 2 and theorem 3 is unclear. What is the relationship between theorem 2 and theorem 3?\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "W2uX0i3N5O", "reviewer": "Reviewer_Ljok", "summary": "This paper studies the neural network robustness issue from the perspective of dynamical systems.\nThe paper illustrates the drawbacks of previous works in this direction and proposes an asymptotically stable ordinary differential equation to overcome those drawbacks.\n\nThere are two major advantages of this proposed method:\n\n1: ASODE considers asymptotically stable equilibrium points that can eliminate applied perturbations at initial conditions.\n\n2: ASODE considers nonautonomous dynamical systems that are more general than previous works that focused on autonomous systems.\n\nNumerical results have demonstrated promising improvements.", "questions": "I think the proposed ASODE has many overlaps with the SODEF method.\nCould the authors itemize the major difference between ASODE and SODEF? ", "limitations": "I did not find the discussion on the limitations of this proposed method.\nCould the author provide a detailed discussion on the limitations here?", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: This paper considers robustness from the perspective of a well-developed control field, which helps to effectively connect those two fields.\nThe idea of using asymptotically stability rather than just stability can guarantee to eliminate of applied perturbations.\nThe numerical experiments provided in the paper are very promising, against all perturbations, the proposed ASODE has shown improvement over the previous state-of-the-art methods.\n\nWeakness: I enjoyed reading this paper.\nHowever, I found some grammar issues.\nI suggest that authors carefully check the paper writing and improve the readability.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "2btIG11ZcbS", "reviewer": "Reviewer_v7EB", "summary": "The paper designs an ordinary differential equation (ODE) that can regularize adversarial training samples to be close to clean samples. The ODE is developed based on the asymptotic stability achieved by a slowly time-varying dynamic system. The evaluation involves different existing attacking methods and datasets with ResNet18. The experimental results show that the proposed ASODE can defend against existing attacks and outperforms SOTA defense methods. \n", "questions": "Line 269, why the model $\\textbf{f}_{\\widetilde{\\theta}}$ is only trained for 100 epochs? \n", "limitations": "**Writing issues**:\n\nIt would be better to introduce the meaning of a symbol at its first appearance. ", "rating": 4, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "\n**Strength**\n\n++ It is an interesting idea to mitigate noise and perturbation of adversarial attacks from the perspective of dynamic systems. \n\n++ The paper presents a detailed theoretical analysis of how a perturbed instance is optimized to converge to a clean instance. \n\n\n\n**Weakness**\n\n-- Lack of details of attack methods and their settings \n\n-- Missing ablation study of ASODE \n\n-- Missing sensitivity analysis of critical parameters of ASODE, such as the choice of $\\delta$\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept