Neural Architecture Dilation for Adversarial Robustness

Abstract: With the tremendous advances in the architecture and scale of convolutional neural networks (CNNs) over the past few decades, they can easily reach or even exceed the performance of humans in certain tasks. However, a recently discovered shortcoming of CNNs is that they are vulnerable to adversarial attacks. Although the adversarial robustness of CNNs can be improved by adversarial training, there is a trade-off between standard accuracy and adversarial robustness. From the neural architecture perspective, this paper aims to improve the adversarial robustness of the backbone CNNs that have a satisfactory accuracy. Under a minimal computational overhead, the introduction of a dilation architecture is expected to be friendly with the standard performance of the backbone CNN while pursuing adversarial robustness. Theoretical analyses on the standard and adversarial error bounds naturally motivate the proposed neural architecture dilation algorithm. Experimental results on real-world datasets and benchmark neural networks demonstrate the effectiveness of the proposed algorithm to balance the accuracy and adversarial robustness.


Reviews and author responses:

In this paper, the authors proposed NADAR to balance the natural accuracy and adversarial robustness by dilating the standard trained model. Specifically, given a backbone trained on the standard dataset, the authors added some cells as the dilation network to enhance the adversarial robustness with adversarial training. To reduce the computation overhead, the architectures of cells are optimized according to the FLOPs. Then the overall framework is optimized by the ADMM. The authors also gave some simple theoretical analysis. To demonstrate the effectiveness of the proposed method, the authors evaluated it on multiple datasets (i.e., MNIST, CIFAR-10/100, and ImageNet) under different network architectures and attack methods.  The perspective for the trade-off between natural and adversarial accuracy is novel, and the method is well designed and presented.
However, there are still some problems remaining.

1. The reason for introducing the FLOPs-aware architecture optimization.
   The authors should check the influence of the FLOPs on the robustness. As the goal of this paper is to enhance the robustness with additional structures (and more FLOPs), the architecture optimization part seems just to be a trade-off.
2. Unfair comparison under different model capacities.
   As we all know, a larger/wider model helps natural accuracy and robustness. The proposed method introduces a larger model which is unfair to compare with baselines.
3. The performance is poor.
   Note that nowadays the PGD-10 is the standard adversarial training instead of PGD-7 [1]. Besides, as overfitting exists [2], the authors should also report the best and the last results.
   The results the authors reported are much lower than the current standard. For example, the adversarial accuracy for adversarial training method for CIFAR-10 using WRN-28-10 should be FGSM: 61+, PGD-20: 56+, and PGD-100: 55+, which are higher than NADAR (using WRN-32-10, which should be better). The authors should check the real SOTA for adversarial robustness.
   Though the authors claimed that they focused on both standard and adversarial accuracy, the natural accuracy is still lower than the standard model and some of the baselines. It makes the proposed method just another trade-off method between natural and adversarial accuracy.
4. The running time.
   Since adversarial training is time-consuming, I wonder how long does the NARDAR take. 

[1] Bag of Tricks for Adversarial Training
[2] Overfitting in adversarially robust deep learning


------------------------------after post-rebuttal------------------------------------
The authors' responses are well addressed my concerns for fair comparison and wrong accuracy. I raise my score to 6. Thanks.
 The paper tries to improve the robustness of deep neural networks, which has a positive societal impact.

 **1. Is some part of DNN being reduced?**

No. Compressing the backbone is not one of the aims of this work. There are works compress networks to save computation budget, but they suffer from large accuracy drops. This work does the opposite. We slightly sacrifice the computation budget and earn a performance improvement.

**2. Performance on natural images & maybe a new trade-off**

Regarding FAT, it has a different purpose than ours. They use a friendly attack method and aim to preserve the standard accuracy. Although their standard accuracy is around 3% higher than us, their adversarial accuracy is low. For examples, their PGD-20 accuracy is only marginally higher than the vanilla PGD-7 training and is around 7% lower than us.

Regarding TRADES, it is unfair to only compare the standard accuracy under their TRADES-1 setting. They have a parameter to control the trade-off, and it is easy to tune it for better performance on one aspect. If you consider both standard and adversarial, our trade-off ratios are better than both the TRADES-1 and 6 settings as discussed in Section 5.2. Furthermore, if we compare the adversarial accuracy under similar standard accuracy, on a setting proposed by TRADES, where the network is trained on MNIST with a small CNN, we can reach 94.33% vs. their 93.87% under PGD-40 attack, when have a similar standard accuracy (99.33% vs. our 99.34%, with $1/\lambda=0.6$ for TRADES).

This work indeed reaches a new and better trade-off. The trade-off between natural and adversarial accuracy is inevitable [1], but we can manage to pursue a maximal robustness gain while preserving a minimal accuracy drop. As [2] points out, capacity plays an important role in adversarial robustness, and networks require larger capacity for adversarial than standard tasks. This finding motivates us to dilate the existing backbones for better adversarial accuracy, and at the meantime, we propose a standard performance constraint to minimize the standard accuracy drop. The dilation together with the standard performance constraint deliver a better trade-off, as discussed in the previous paragraph.

**Reference:**

[1] Robustness May Be at Odds with Accuracy, ICLR 2019.

[2] Towards Deep Learning Models Resistant to Adversarial Attacks, ICLR 2018.


 **1. The influence of the FLOPs on the robustness**

We study the relationship between FLOPs and robustness in Table 3 in the supplementary material. The robustness does not always grow as the FLOPs growing. We use three different scale of dilation networks, including $3\times3$ (3 blocks and each block has 3 layers), $3\times6$ and $3\times9$. We found that the $3\times6$ network is a proper setting. The $3\times3$ network is not large enough, but if we keep growing the network size, it will drop the performance. It is worth noting that the $3\times3$ network also has a better performance than the backbone ($47.78\pm0.41$% under PGD-20 vs. $45.84$%)

**2. Different model capacities**

As we claim on lines 49-51 in our paper, this work is based upon the precondition that we have already had an architecture with satisfactory standard accuracy. Then, we aim to study how to properly dilate the architectures for maximal robustness gain while preserving a minimal accuracy drop.

In Figure 3 of the supplementary material, we show that blindly enlarging the network size cannot always guarantee a better robustness than the backbone, but if we design the dilation with NADAR, the results architectures can consistently outperform the backbone and other dilated networks with similar FLOPs.

**3. The experimental results**

*3.1. PGD-10 for AT*

PGD-7 is the most common adversarial training setting. Although [1] reports the PGD-10 test results in their tables, they do not mention the number of steps for PGD training. As the origin work [3] uses 7 steps for training and many follow up works [4, 5] have followed this setting, we use it as well. Besides, [1] directly cites [3], we can speculate that they also use 7 steps in training instead of 10 steps as in their test.

*3.2. The best and last results*

We report the best epoch in our paper. We do not encounter very serious overfitting problem. Our last 10 epochs reach an average standard accuracy of $84.19\pm2.04$% and an average robust accuracy of $51.78\pm1.61$% under PGD-20. Our best epoch reaches 86.23% and 53.43%. If we encountered overfitting, it would be easily avoided by early stopping.

*3.3. Comparison to SOTAs*

According to results in [2]: The 61% accuracy under FGSM is reached on SVHN, which is much smaller than CIFAR-10. The 56.8% accuracy is reached under PGD-10 instead of PGD-20. The 55% accuracy is reached with TRADES training instead of PGD-7 training. We would like to further discuss the WRN architecture in the following response, 3.4 WRN architecture, and comparison of our method to TRADES in the following response, 3.5 Another trade-off.

*3.4. WRN architecture*

We check the official code releases of [1,2], and both of them use WRN34-10 for the Wide ResNet experiments. The paper [2] is inconsistent with their code [link1], which might be a mistake. We also check other baselines [3, 6, 7], and they all use the 34-10 setting for WRN. We refer to this architecture as WRN32-10 because we do not count 2 fully connected layers and only count convolution layers. We would like to change our counting method and refer to it as WRN34-10 in our final version for consistency with others.

*3.5. Another trade-off*

It is normal that the standard accuracy of any robust model is lower than the standard model, especially when the standard model has 0% accuracy under adversarial attacks. Because our method pursues a maximal robustness gain while preserving a minimal accuracy drop, a fair comparison should compare both the standard and adversarial robust with other robust models:

- Comparing to the PGD-7 trained network, our method can reach both better standard and adversarial accuracy, when we retrain our dilated architecture with the same training setting as them.

- Comparing to TRADES, they aim to improve the trade-off by modifying the training method, but our trade-off ratios are better than both the TRADES-1 and 6 settings as discussed in Section 5.2, when we only use the vanilla PGD-7 to retrain our dilated architecture. Furthermore, if we compare the adversarial accuracy under similar standard accuracy, on a setting proposed by TRADES, where the network is trained on MNIST with a small CNN, we can reach 94.33% vs. their 93.87% under PGD-40 attack, when have a similar standard accuracy (99.33% vs. our 99.34%, with $1/\lambda=0.6$ for TRADES).

All in all, we indeed reach a new and better trades-off.

**4. The running time**

With WRN32-10 as the backbone and on a NVIDIA V100 GPU, searching with costs around 40 GPU hours, and retraining costs around 28 GPU hours. Comparing to our baselines, PGD-7 needs 90 GPU hours, and FreeAT-8 needs 13 GPU hours. Our running time is in a reasonable range.

**Reference:**

[1] Bag of Tricks for Adversarial Training, ICLR 2021.

[2] Overfitting in adversarially robust deep learning, ICML 2020.

[3] Towards Deep Learning Models Resistant to Adversarial Attacks, ICLR 2018.

[4] When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attacks, CVPR 2020.

[5] Adversarially Robust Neural Architectures, arXiv 2020.

[6] Theoretically principled trade-off between robustness and accuracy, ICML 2019.

[7] Adversarial training for free!, NIPS 2019.

[link1] https://github.com/locuslab/robust_overfitting/blob/c47a25c5e00c8b2bb35488d962c04dd771b7e9af/train_cifar.py#L211


 **1. Arch. in Table 1**

We use WRN32-10 as the backbone, and the searched architectures are as shown in Fig. 1 in the supplementary material.

**2. The best epoch’s performance in Table 1**

We report the best epoch in our paper. We do not encounter very serious overfitting problem. Our last 10 epochs reach an average standard accuracy of $84.19\pm2.04$% and an average robust accuracy of $51.78\pm1.61$% under PGD-20. Our best epoch reaches 86.23% and 53.43%. If we encountered overfitting, it would be easily avoided by early stopping.

**3. AA acc. in Table 4**

Our NADAR-B architecture can reach 50.44% AA accuracy, comparing to 44.04%, 43.21%, 41.47%, and 43.01% of PGD, FastAT, FreeAT and TRADES, respectively. We will add the results in the final version.

**4. Training time**

Because many baselines only report training costs on Tiny-ImageNet and do not report training costs on CIFAR-10, we do the same. Regarding the training time on CIFAR-10, the retraining of NADAR costs around 28 GPU hours on a NVIDIA V100 GPU.


 **1. Why choose FreeAT over FastAT**

We admit that FastAdv can provide higher efficiency improvement than FreeAT. However, it reaches lower robust accuracy than FreeAT (around 45% vs. 46.82% on CIFAR-10). Considering that we also use other technique to improve the efficiency (i.e., partial-channel connections), the accuracy would be the first priority when comparing them. Therefore, we choose FreeAT over FastAT as one of our speed-up methods.

**2. FLOPs-awareness comparing to robust pruning methods**

The FLOPs-awareness in our work is introduced to limit the growth of model size during dilation, instead of compressing the backbone. We have different aims comparing to those pruning methods, so we cannot compare the compression ratio to them. Besides, although robust pruning methods can reach high compression, they suffer significant performance drops instead of improvements when the ratio raises.


This paper proposed neural architecture dilation for adversarial robustness (NADAR), which searches for a dilation architecture to pursue a maximal robustness gain while preserving a minimal (standard) accuracy drop. A FLOPS-aware approach is used to prevent increasing the computation cost too much. Experimental results show the effectiveness of the proposed algorithm.  This work propose a novel method to solve the well-known accuracy-robustness trade-off in adversarial training by increasing the model capacity with neural architecture dilation. Experiments shows that the dilation can effectively increase the adversarial accuracy, and the standard performance constraint can guarantee a competitive standard accuracy. Those experimental results can support their main claims. Besides, theoretical analysis is also provided to justify why dilation works and why the standard performance constraint is important.

My concerns:
1. What is Arch. in Table 1?
2. In Table 1, it seems that the paper reported the accuracy of the last epoch. It would be more interesting to discuss the best epoch's performance. 
3. In Table 4, you report the acc against 4 attacks. Can you also report the final AA acc? 
4. Besides Params and FLOPS, I am also curious about the training time of these methods. 
 Please refer to the main review.

In this paper, an architecture dilation method is proposed to keep the performance on natural images for adversarial training. The idea is interesting, actually, is on the opposite way of regular thoughts that try to improve robustness by structure reduction.   I agree with the authors that the current adversarial training is more like a data-argumentation method than improving robustness of the DNNs themselves. Thus, adversarial training is a trade-off between natural and adversarial examples. To really improve the DNNs structure, the author propose to dilate the architecture, not to reduce it in regular thought. I do not totally agree with the author's idea but indeed it is reasonable in the view of improving adaption for both natural and adversarial examples.

Thus, it is a good attempt to see the performance of dilating the DNNs. But I think the result is not very encouraging. See Table 1 and Table 2. Although there is improvement from TRADES, there is still a big accuracy drop on accuracy on natural images by over 10% from natural training. I read the explanation on the modification over previous ICML submission. The previous comments were mainly about the experiments, so is my concern. Generally, I would like to give a weak rejection and glad to see the authors' reply on the experiment results. 

There are some detailed questions/comments.

1. The mainstream of architecture optimization for adversarial robustness is reduction not dilation. I would like to know, via NAS proposed in this paper, is there some part of the DNN being reduced, even the main purpose is to dilate it.

2. It is required to keep the standard performance. However, in numerical experiments, the performance on natural images is still not good, which also makes the analysis less meaningful to me. 

3. In experiment, the main purpose that keep performance on natural images has not been reached, I have to say. Compared to standard training, the drop is significant. Even some adversarial training methods, like FAT, TRADES-1, have better performance on natural images. Indeed, their performance under attack is worse than the proposed one, that makes the proposed method be a trade-off, maybe a new trade-off.  no

This work proposes a neural architecture dilation for adversarial robustness (NADAR) method with standard performance constraint. It aims to dilate neural networks for better robustness while does not harm the standard accuracy too much. A FLOPs constraint is also applied to control the computation cost growth. The authors provide both theoretical analysis and experimental results to evaluate their algorithm.  The balance between robustness and accuracy is a crucial topic in the field of adversarial robustness. The authors propose a novel perspective to solve the problem by enlarging the capacity of an existing network on demand. It sounds reasonable that models with larger capacity have better trade-off between robustness and accuracy. They perform experiments with Wide ResNet and ResNets as backbones on several common datasets, including CIFAR10/100 and ImageNet. Results under different attack methods are reported, which is convincing. Firstly, as adversarial training with PGD is costly, the authors choose FreeAT for efficient optimization of the architecture. They even perform ablation study to select hyper-parameter for it in the supplementary material. However, they also mention another choice, i.e. FastAT, which is equally important but is not discussed. Why does the authors choose FreeAT over FastAT? This is rarely explained in the paper. 

Secondly, regarding the FLOPs-awareness, they do not include any baselines, such as robust pruning methods. How efficient is the compression by FLOPs-awareness comparing to them?

Meta-review: The tradeoff between natural accuracy and adversarial accuracy is critical in adversarial training, and this paper proposed a quite different point of view: instead of neural architecture compression, *neural architecture dilation* may be more appropriate for achieving the goal. I personally think the new point of view may open the door to a new world. While there were some concerns in the beginning, the authors have done a particularly good job in their rebuttal. In the end, 3 reviewers hold positive opinions and 1 reviewer is fine with either acceptance or rejection. Thus, I think it should be accepted for publication.

Decision: accept