Robust Binary Models by Pruning Randomly-initialized Networks
Abstract
Robustness to adversarial attacks was shown to require a larger model capacity, and thus a larger memory footprint.
In this paper, we introduce an approach to obtain robust yet compact models by pruning randomly-initialized binary networks.
Unlike adversarial training, which learns the model parameters, we initialize the model parameters as either +1 or − 1 , keep them fixed, and find a subnetwork structure that is robust to attacks.
Our method confirms the Strong Lottery Ticket Hypothesis in the presence of adversarial attacks, and extends this to binary networks.
Furthermore, it yields more compact networks with competitive performance than existing works by 1) adaptively pruning different network layers; 2) exploiting an effective binary initialization scheme; 3) incorporating a last batch normalization layer to improve training stability.
Our experiments demonstrate that our approach not only always outperforms the state-of-the-art robust binary networks, but also can achieve accuracy better than full-precision ones on some datasets.
Finally, we show the structured patterns of our pruned binary networks.
Introduction
Deep neural networks have achieved unprecedented success in machine learning [19, 30, 56].
However, their state-of-the-art performance comes with costs.
First, modern deep neural networks usually have millions of parameters, making them difficult to deploy on devices with limited memory or computational power.
Second, these models are vulnerable to adversarial attacks: imperceptible perturbations of the input can dramatically change their output and lead to incorrect predictions [55].
Furthermore, jointly addressing both issues is complicated by the fact that, as shown in [44, 60], achieving robustness against adversarial attacks typically requires higher network capacity.
In this paper we introduce an approach to obtaining compact and robust binary neural networks.
Our method follows a fundamentally different philosophy from typical adversarial training [44]: instead of using adversarial examples to train the model parameters, we fix the model parameters and search for a robust network structure.
To this end, and to simultaneously achieve compactness, we prune randomly-initialized binary networks.
The resulting sparse and binary networks have much smaller memory footprint than the dense or full-precision ones.
They are inherently lightweight and robust.
Our work is motivated by the Strong Lottery Ticket Hypothesis [51], which observed that within a random overparameterized network, there exists a subnetwork achieving performance similar to that of trained networks with the same number of parameters.
The Robust Scratch Ticket [22] extends this hypothesis to the context of adversarial robustness.
Here, we introduce a novel pruning strategy that yields higher compression rates, and investigate the case of binary model parameters.
Specifically, we develop an adaptive pruning strategy to adaptively use different pruning rates for different layers.
Furthermore, we introduce a normalization-based technique to increase the algorithm’s stability for binary networks.
The subnetworks obtained by our method are consequently more compact than a full-precision one, while achieving a similar robustness to attacks.
We conduct extensive experiments on standard benchmarks to confirm the effectiveness of our method.
We obtain both better performance and a more stable training behavior than existing works [22].
Furthermore, our approach outperforms the state-of-the-art robust binary networks [25], achieving performance on par with or even better than the state-of-the-art robust full-precision ones [8, 46, 54] while producing much more compact networks.
Finally, we conduct preliminary investigations on the structure of the robust subnetworks obtained by our algorithm.
We find our methods prefer to prune the whole channel or the kernel in the convolutional layers.
In addition, for two consecutive convolutional layers, the kernels pruned in the first layer are well aligned with the channels pruned in the second layer.
Altogether, our work sheds some light on understanding the structure of robust networks of high parameter sparsity, it also indicates the potential of regular pruning.
Our code is available at https://github.com/IVRL/RobustBinarySubNet.
Notation.
We use light letters, lowercase bold letters, and uppercase bold letters to represent scalars, vectors, and higher dimensional tensors, respectively.
⊙ is the elementwise multiplication operation.
We use the term adversarial budget to represent the range of allowable perturbations.
Specifically, the adversarial budget S ϵ is based on the l ∞ norm and defined as { ∆ |∥ ∆ ∥ ∞ ≤ ϵ } , with ϵ the strength of the adversarial budget.
We refer to the proportion of pruned parameters over the total number of parameters in a layer or a model as the pruning rate r .
Related Work
Adversarial Robustness.
Deep neural networks have been shown to be vulnerable to adversarial attacks [55, 45].
To generate adversarial examples, the Fast Gradient Sign Method (FGSM) [24] perturbs the input in the direction of the input gradient.
The Iterative Fast Gradient Sign Method (IFGSM) [38] improves FGSM by running it iteratively.
Projected Gradient Descent (PGD) [44] uses random initialization and multiple restarts on top of IFGSM to further strengthen the attack.
Recently,
AutoAttack (AA) [15] has led to state-of-the-art attacks by ensembling different types of attacks; it is used to reliably benchmark the robustness of models [13] and we thus use it in our experiments.
Many works have proposed defense mechanisms against these adversarial attacks.
Early ones [5, 47, 59] used obfuscated gradients [3, 15] and thus were ineffective against adaptive attacks.
As a consequence, adversarial training [44] and its variants [1, 6, 32, 52, 37, 58, 63, 64] have in practice become the mainstream approach to obtain robust models.
Specifically, given a dataset { ( x i , y i ) } Ni =1 , a model f parameterized by w and a loss function L , adversarial training solves the min-max optimization problem:
[Equation]
In practice, this is achieved by first generating adversarial examples x i + ∆ i , usually by PGD, and then using these examples to train the model parameters.
While effective, adversarial training was shown to require a larger model capacity [44, 60].
Specifically, as the model capacity decreases, adversarial training first fails to converge while the training on clean inputs still yields non-trivial performance.
Conversely, as the model capacity increases, the performance of training on clean inputs saturates before that of adversarial training.
This highlights the challenge of finding robust yet compact models.
Here, we introduce a solution to this problem.
Model Compression.
There are many ways to compress deep neural networks to achieve lower memory consumption and faster inference, including pruning, quantization, and parameter encoding.
The pioneering works used information-theoretic methods [39] or second-order derivatives [29] to compress models by removing unimportant weights.
The seminal work [28] proposed to prune the parameters with the smallest absolute values for deep networks.
This motivated many follow-up works, performing either irregular pruning [26, 61, 65], which removes individual parameters, or regular pruning [31, 42], which aims to discard entire convolutional kernels.
In contrast to pruning, quantization [67, 48, 34] seeks to reduce the memory consumption and inference time by using low-precision parameters.
An extreme case of quantization is binarization, which can take the form of only binarizing the parameters [10, 11] or binarizing both parameters and intermediate activations [33].
The models can be further compressed by combining pruning with quantization and
Huffman coding [27].
Recently, some efforts have been made to incorporate adversarial training into model compression.
[23, 40, 50] suggest quantization as a defense against adversarial attacks.
[46] uses Bayesian connectivity sampling to prune the network while preserving its robustness.
[8] dynamically generates a robust subnetwork during adversarial training.
[62] uses the alternating direction method of multipliers (ADMM) to alternatively conduct adversarial training and network pruning.
[25] extends this framework to include other model compression techniques, such as quantization.
Furthermore, [54] introduces the HYDRA framework, which improves the performance of compressed robust models by a three-phase method: Pretraining, score-based pruning, and fine-tuning.
Here, we follow a different strategy: Instead of performing adversarial training, we search for a robust binary subnetwork in a randomly-initialized one.
We show that our approach outperforms those based on adversarial training.
Lottery Ticket Hypothesis.
This hypothesis, introduced in [21], states that overparameterized neural networks contain sparse subnetworks that can be trained in isolation to achieve competitive performance.
These subnetworks are called the winning tickets .
Based on this interesting observation, [68, 51] further proposed the Strong Lottery Ticket Hypothesis .
They showed that there exist winning tickets with competitive performance even without training.
Furthermore, [9] proposed an iterative randomization scheme to reduce the size of the network in which one searches for the winning tickets.
[18] introduced the Multi-Prize Lottery Ticket Hypothesis to learn compact yet accurate binary networks by pruning and quantizing randomly weighted DNNs.
[17] showed that “lottery-ticket style” approaches can also improve robustness against corruption in the frequency domain.
The recent work of [22] combines robustness with the Strong Lottery Ticket Hypothesis and demonstrates the existence of robust sub-networks within a random network.
Here, we focus on lighterweight binary networks, and introduce an adaptive pruning strategy and last batch normalization layer to achieve higher pruning rates than [22] while maintaining a competitive accuracy.
Methodology 3.1 Preliminaries: Edge-Popup under Adversarial Attacks
Let us first formulate the problem in a similar manner to [22].
We consider a neural network f parameterized by w ∈ R n .
For an input sample ( x , y ) , the neural network outputs f
( w , x ) .
L ( f ( w , x ) , y ) then represents the training loss objective, where L is the softmax cross-entropy loss.
Given a dataset { ( x i , y i ) } Ni =1 , an adversarial budget S ϵ , and a predefined pruning rate r , we search for a binary pruning mask m that solves the following optimization problem:
[Equation]
Here, function sum calculates the summation of all the elements in a vector.
In contrast to adversarial training, we do not optimize the model parameters w in (2); instead w contains randomly-initialized parameters that are kept fixed during optimization.
As such, our algorithm aims to find a pruned network structure, encoded via the n -dimensional binary vector m , corresponding to a robust subnetwork.
Since the mask m is a discrete vector, it cannot be directly optimized by gradient-based methods.
To overcome this, we replace it with a continuous “score” variable, s ∈ R n , from which we calculate the mask as
[Equation]
where M is a binarization function.
It constructs a binary mask from the continuous-valued scores based on a pruning strategy and a required pruning rate r .
The pruning strategy can be global or layer-wise, and retains the parameters with the highest scores.
In the layer-wise case, it automatically determines the number of parameters retained in each layer.
To update the scores s , we use the same edge-popup strategy as in [22, 49].
Specifically, we use straight through estimation [4] to calculate the gradient ∂ L /∂ s .
Note that the approximation made in straight through estimation does not affect the adversarial example generation in adversarial training.
Our experiments will show that we can effectively generate adversarial examples by PGD.
We provide the pseudo-code of our algorithm in Appendix C.
3.2 Adaptive Pruning
As mentioned above, in addition to the given pruning rate r , the binarization function M in Equation (3) also depends on the pruning strategy.
[25] uses global pruning , retaining the (1 − r ) n parameters with the highest scores, regardless of which layer they belong to.
However, global pruning does not consider the topology of the network, and the fact that the magnitude of the scores s can differ from layer to layer.
Furthermore, when the pruning rate r is close to 1 , global pruning may prune some layers entirely, thus causing a trivial performance.
Therefore, other works [22, 51, 54] use layer-wise pruning strategies.
For an L -layer network with { n i } Li =1 parameters and a predefined pruning rate r , such strategies first allocate the number of parameters { m i } Li =1 to retain in each layer, and then retain the parameters with the highest scores in each layer.
In Appendix A.1, we discuss two special cases of layer-wise pruning: fixed pruning rate and fixed number of parameters .
With fixed pruning rate , we have 1 − r = m 1 n 1 = m 2 n 2 = ...
= m
L n L .
Theorem A. indicates that this maximizes the size of the search space of the subnetwork.
However, this strategy might retain too few parameters for the small layers when r is big, which has two serious drawbacks: 1) It greatly limits the expression power of the network; 2) it makes the edge-popup algorithm less stable, because adding or removing a single parameter then has a large impact on the network’s output.
This instability becomes even more pronounced in the presence of adversarial samples, because the gradients of the model parameters are more scattered than when training on clean inputs [41].
With fixed number of parameters , we have m 1 = m
= ...
= m
L .
When the allocated number of retained parameters exceeds the total number of the original parameters in one layer, we leave this layer totally unpruned.
As shown in Theorem A.2, this strategy maximizes the number of paths from the input layer to the output layer.
In contrast to the fixed pruning rate , a fixed number of parameters may retain too many parameters in small layers.
In the extreme case, some layers may be entirely unpruned when the pruning rate r is small.
This is problematic in our settings, since the model parameters are random and not updated.
In other words, the two strategies discussed above are two extremes: the fixed pruning rate one suffers when r is big, whereas the fixed number of parameters one suffers when r is small.
To address this, we propose a strategy in-between these two extremes.
Specifically, we determine the number of parameters retained in each layer by solving the following system of equations:
[Equation]
where p ∈ [0 , 1] is a hyper-parameter controlling the trade-off between the two extreme cases.
When p = 0 , the strategy (4) is the fixed number of parameters one.
When p = 1 , the strategy becomes the fixed pruning rate one.
By setting 0 < p < 1 , we can retain a higher proportion of parameters in the smaller layers without sacrificing the big layers too much.
We call this strategy adaptive pruning .
As discussed above, the strategy obtained with p = 1 tends to fail with a big r , while the strategy resulting from setting p =
tends to fail with a small r .
This indicates that we need to assign small values of p given a big r and big values of p otherwise.
We validate this and study the influence of p on the results of our approach in experiments.
3.3 Binary Initialization and Last Normalization Layer
Our work focuses on binary networks, which have a much smaller memory footprint than fullprecision networks but are more challenging to train.
To address this, we therefore study the influence of the binary initialization scheme and introduce a last normalization layer approach to facilitate training and boost the performance.
Binary initialization.
The empirical studies of [51] demonstrate the importance of the initialization scheme on the performance of a pruned network.
As a result, [51] proposes the Signed
Kaiming Constant initialization: The parameters in layer i are uniformly sampled from the set (cid:110) − (cid:113) 2 l
i − 1 (1 − r ) , (cid:113) 2 l i − 1 (1 − r ) (cid:111) , where l i − 1 represents the fan-out of the previous layer.
Correspondingly, the scores s are initialized based on a uniform distribution U [ − (cid:113) 1 l i − 1 , (cid:113) 1 l i − 1 ] .
The magnitude of the Signed Kaiming Constant initialization is carefully calculated to keep the variance of the intermediate activations stable from the input to the output.
In modern deep neural networks, the convolutional layers, potentially together with activation functions, are typically followed by a batch normalization layer.
In [51] and our settings, these batch normalization layers only estimate the running statistics of their inputs, they do not have trainable parameters representing affine transformations.
Because of these batch normalization layers, the magnitudes of the convolutional layers do not affect the outputs of the “convolution-batch norm” blocks.
Furthermore, the fullyconnected layers on top of the convolutional ones are homogeneous 2 because their bias terms are always initialized to zero and not updated during training.
The activation functions we use, such as
ReLU or leaky ReLU [43], are also homogeneous.
Therefore, the magnitudes of parameters in these fully-connected layers do not change the predicted labels of the model either.
Based on the analysis above, we conclude that the magnitudes of the model parameters at initialization do not change the predicted labels.
Therefore, we propose to scale the model parameters w in all linear layers, i.e., convolutional and fully-connected ones, so that they are all sampled from {− 1 , +1 } .
Correspondingly, the scores s are initialized based on a uniform distribution [ − a, a ] , where a is a factor controlling the variance.
Our binary initialization scheme is beneficial to model compression and acceleration, since there are no longer multiplication operations in linear layers.
We discuss the efficiency improvement of the binary networks in detail in Appendix A.2.
Theoretically, for the RN34 models we use in this paper, binary initialization can save approximately 45% and 32% FLOP operations compared with their full precision counterparts in the training phase and evaluation phase, respectively.
Since we use irregular pruning in our method, taking full advantage of this improvement requires lower-level and hardware customization.
Last normalization layer.
Although scaling the model parameters does not affect the expression power of the network nor change the predicted label given the input, it does change the optimization landscape of the problem (2), because the softmax cross-entropy function used to calculate the loss objective is not homogeneous.
Compared with the Signed Kaiming Constant method, our binary initialization multiplies the parameters initialized in the last layer by (cid:113)
[Equation]
(1 − r ).
Therefore, the output logits fed to the softmax cross-entropy function are also multiplied by the same factor.
In practice, (cid:113) l L
[Equation] [Equation]
1 − r )≫ 1 greatly increases the output logits.
Large logits will cause numerical instability and thus greatly worsen the optimization performance.
In particular, our detailed analysis in Appendix A.3 shows that such scaling causes gradient vanishing for correctly classified inputs and, even worse, gradient exploding for misclassified ones.
To address this issue, we add another 1-dimensional batch normalization layer at the end of the model, just before the softmax layer.
The analysis in Appendix A.3 shows this normalization layer cancels out the multiplication factor applied to the weights in the last layer and thus facilitates the optimization.
In our experiments, we show that this normalization layer greatly improves the performance of both the Signed Kaiming Constant method and our Binary Initialization one.
Furthermore, the last normalization layer also makes the performance more robust to different score s initializations.
Experiments
In this section, we present extensive experimental results to validate our approach.
First, we describe an ablation study and sensitivity analysis.
Then, we compare our performance with existing works, which achieve robustness and compression in either full-precision or binary cases.
We also include adversarial training [44] as a baseline.
Finally, we analyze the structure of the pruned networks that we obtain.
We show some interesting patterns of these post-pruning networks, suggesting the potential of our approach for more effective compression.
Unless explicitly stated otherwise, we use a 34-layer Residual Network (RN34) [30], the same as the one in [51, 54].
We use the CIFAR10 dataset [36] in the ablation study; we also use the CIFAR dataset [36] and the ImageNet100 dataset [16, 20] in the comparisons with the baselines.
4 We train the models for 400 epochs on CIFAR10/100 and 100 epochs on ImageNet100.
We use a cosine annealing learning rate scheduler with an initial value of 0 . 1 .
Unless specified, we employ PGD attacks [44] to generate adversarial examples during training, but we use AutoAttack (AA) [15] for our robustness evaluation.
While PGD is much faster than AutoAttack and thus suitable for training,
AutoAttack is the current state-of-the-art attack method, and we thus consider it a more reliable metric of robustness.
We use an l ∞ norm-based adversarial budget, and the perturbation strength ϵ is 8 / 255 for CIFAR10, 4 / 255 for CIFAR100 and 2 / 255 for ImageNet100.
More details about the experimental settings and hyper-parameters are listed in Appendix D.1.
4.1 Ablation Study and Sensitivity Analysis
Pruning Strategy and Pruning Rates.
We first focus on binary initialization and on the models with the last batch normalization layer (LBN).
We compare the performance of our method under different pruning rates r and adaptive pruning strategies with different values of p .
The scores s are initialized from a uniform distribution U [ − 0 .
Our results are summarized in Table 1, in which we include 7 different values of pruning rate r and 7 different values of p in the adaptive pruning strategy .
First, we notice that the best performance is achieved when r = 0 . 99 and p = 0 .
For the fixed pruning rate strategy ( p = 1 . 0 ), the best performance is achieved when r = 0 . 8 .
Compared with the vanilla (i.e., non-adversarial) case in [51], which uses the fixed pruning rate strategy and shows that r = 0 .
5 achieves the best clean accuracy, the best performance for robust accuracy is achieved at a much higher pruning rate.
This interesting observation is also consistent with the existing work [12], which shows that adversarial training implicitly encourages sparse convolutional kernels.
[Table]
r = 0 .r = 0 .r
= 0 .r
=
[Table]
Table 1 further demonstrates the benefits of our adaptive pruning strategy .
For larger pruning rates r , a smaller value of p prevails; for smaller pruning rates, a bigger value of p prevails.
This is consistent with our analysis in Section 3.2.
In particular, compared with the best results for a fixed pruning rate strategy ( p = 1 . 0 , r = 0 . 8 ), which is the pruning strategy used in [51], our best adaptive pruning ( p = 0 . 1 , r = 0 . 99 ) achieves not only better performance but also a higher pruning rate.
That is to say, using our adaptive pruning strategy improves both robustness and compression rates.
In Figure 4 of Appendix D.2.6, we provide the learning curves when r = 0 .
99 and when r = 0 .
Regardless of the pruning rate r , these curves indicate the importance of the pruning strategy: a well chosen p value not only improves the performance but also makes training more stable.
Last Normalization Layer.
We then study how the last batch normalization layer (LBN) introduced in Section 3.3 affects the performance.
We focus on the binary initialization first and report the performance of models with and without the last normalization layer under different values of a , the hyper-parameter controlling the variance of the initial score s .
Based on the results in Table 1, we use the adaptive pruning strategy with p = 0 .
1 and a pruning rate r = 0 .
The results are provided in Table 2 and clearly show that the last batch normalization layer (LBN) greatly improves the performance.
Furthermore, LBN makes the performance much less sensitive to the initialization of the scores, which in practice facilities the hyper-parameter selection.
Initialization Scheme.
Finally, we compare the performance of the binary initialization with the
Signed Kaiming Constant .
We fix the pruning rate to r = 0 .
and employ an adaptive pruning strategy with different values of p .
Our results are summarized in Table 3.
For binary initialization,
[Table] [Table]
[Table]
we use the optimal initialization scheme of the score s from Table 2; for Signed Kaiming Constant initialization, we use the optimal setting from [51] to initialize s .
Based on the results in Table
[Table]
we can conclude that the binary initialization achieves a comparable performance with the Signed Kaiming Constant .
Furthermore, the last batch normalization layer also improves the performance when using the Signed Kaiming Constant .
We show in Table 8 of
Appendix D.2.1 that these conclusions are also valid in a non-adversarial setting.
4.2 Comparison with Existing Methods
Baselines.
In this section, we compare our approach with the state-of-the-art methods targeting model compression and robustness.
Specifically, we include FlyingBird, FlyingBird+[8], Bayesian
Connectivity Sampling (BCS) [46], Robust Scratch Ticket (RST)
[22], HYDRA [54] and ATMC [25], as well as adversarial training (AT) [44] with early stopping [53].
Given our previous results, we fix the pruning rate to r = 0 . 99 .
For adversarial training, we use the full RN34 model and some smaller networks with approximately the same number of parameters as our pruned models.
These smaller networks have the same architecture as the RN34 except that they have fewer channels.
The details of these small networks are shown in Table 7 of Appendix D.1.
We follow the official implementations of all the baselines, and thus, unlike in our method, the normalization layers in all the baselines that update model parameters have an affine transformation with trainable parameters.
ATMC supports quantization but its parameterization introduces learnable quantized values.
That is, although the models obtained by ATMC’s 1-bit quantization have only two parameter values in each layer, these values are different from layer to layer and are not necessarily − 1 and +1 .
This means that, compared with the binary networks obtained with our method, those from ATMC have more trainable parameters and thus flexibility.
Nevertheless, we still include ATMC for comparison in the case of binary networks.
Similarly to our method, RST does not update the model parameters.
It initializes the model parameters with full-precision values, and we thus only provide full-precision results for RST.
The other baselines and AT are not designed for quantization and do not inherently support binary networks.
To address this, we use BinaryConnect [10] to replace the model’s linear layers so that their parameters are binary.
BinaryConnect generates binarized model parameters by taking the sign of the weights during the forward pass, and uses straight-through estimation [4] for gradient calculation.
Our method uses binary initialization and the last batch normalization layer, so the models we obtained are inherently binary.
In addition to using PGD-based adversarial examples, we accelerate our method by using adversarial examples based on FGSM [24] with ATTA [66].
FGSM with ATTA generates adversarial examples by one-step attacks with accumulated perturbations across epochs.
This is much cheaper than the 10 -step PGD attacks.
For CIFAR10 and CIFAR100, we provide the results of our method when using FGSM with ATTA as “Ours(fast)” in Table 4 for comparison.
For ImageNet100, since the dataset is bigger and the images are of much higher resolution, the computational cost for multi-step PGD is huge.
Therefore, we use FGSM with ATTA to generate adversarial examples for all methods on ImageNet100.
To decrease the memory overhead introduced
[Table]
FlyingBird
[Table]
FlyingBird
[Table] [Table]
HYDRA
[Table]
ization layer.
“Small RN34” refers to Small RN34-p0.1 in Table 7 of Appendix D.1.
The pruning rate is set to 0 .
99 except for the not-pruned methods.
Among the pruned models, the best results for the full-precision (FP) models are underlined; the best results for the binary models are marked in bold.
The values of ϵ for CIFAR10, CIFAR100 and ImageNet100 are 8 / 255 , 4 / 255 and 2 / 255 , respectively.
“-” means not applicable or trivial performance.
by ATTA, we only store the downsampled perturbations in the current epoch for the perturbation initialization of the next epoch.
We provide the pseudo-code and more details in Appendix C.
Results.
Our main results on CIFAR10, CIFAR100 and ImageNet100 are summarized in Table 4, where we report the robust accuracy under AutoAttack (AA), which is considered as a reliable evaluation metric for robustness [15].
The results of all baselines are based on their default settings in architecture and pruning strategy based on publicly available codes.
5 The exceptions are that we also include adaptive pruning ( p = 0 . 1 ) for HYDRA, ATMC, and the last batch normalization layer for RST, because we noticed such changes to improve their performance.
Our method using the adaptive pruning strategy ( p = 0 . 1 ) achieves better performance than all baselines in case of binary models.
On CIFAR10 and CIFAR100, we also achieve comparable performance to methods using full-precision models.
Furthermore, our method achieves results comparable with AT on the original unpruned models that has 100 × more trainable parameters.
In addition, our method based on FGSM with ATTA, which is much faster than multi-step PGD, also achieves better performance than all baselines in the case of binary networks.
On ImageNet100, our method, which aims to train binary networks, also outperforms most full-precision networks trained by the baselines.
BCS yields almost trivial performance on ImageNet100 (< 3%) and is thus not included.
This suggests that BCS cannot converge using a high compression rate and facing a complicated dataset.
Compared with adversarial training on the full network, which has 100 times as many parameters as ours, we achieve comparable performance with the binary networks, but worse performance than the full-precision networks.
Note that fitting the high-dimensional ImageNet dataset under adversarial attacks using only 1% of the binary parameters is extremely challenging.
As demonstrated in Table 4, many baselines only achieve low robust accuracy in this setting.
For all baselines except RST, the last normalization layer does not improve the performance; it even hurts the performance in the full-precision cases.
This is because these baselines (except RST) update the model parameters w .
In the full precision cases, the magnitude of w , and thus of the output logits, is automatically adjusted during training.
The issue resulting from large output logits that we pointed out in Section 3 does thus not happen in these cases, so the last batch normalization layer is not necessary.
In practice, we observed this layer to slow down the training convergence of these models.
[Table] [Table]
[Table]
For the pruning strategy, the proposed adaptive pruning strategy ( p = 0 . 1 ) consistently achieves better performance than the fix pruning rate strategy ( p = 1 . 0 ) and than global pruning .
FlyingBird,
FlyingBird+ and BCS dynamically assign retrained parameters during training, which has similar benefits to adaptive pruning but at the cost of training efficiency [8].
Furthermore, although the value of p is selected based on the ablation study on CIFAR10, it also performs well on CIFAR
and
ImageNet100.
This observation indicates that for a fixed value of r , the selection of p generalizes well across different datasets.
We further compare the baseline methods with various settings such as adding the last batch normalization layer, changing the pruning strategy, using different AT methods, and provide a complete set of comparison results in Appendix D.2.2.
The conclusions drawn from Table 4 remain valid.
[Table]
All the results in Table 4 are based on a RN34 architecture, Table 5 provides the results on CIFAR using a smaller 18-layer network (RN18) and a larger 50-layer network (RN50).
These results confirm the effectiveness of our method on different network architectures.
In addition to robust accuracy, Table 10 in Appendix D.2.3 demonstrates the accuracy on the clean test set for the models in Table 4.
Our method also yields competitive performance on clean inputs.
Specifically, we achieve the best performance among all methods for binary networks.
Combining the results in Table 4 and 10, we conclude that our method yields a better trade-off between accuracy on clean inputs and accuracy on adversarially perturbed inputs.
Finally, vanilla training can be considered as a special case of adversarial training, where ϵ = 0 .
Therefore, our method, as well as all baselines, are applicable to vanilla training.
The results when ϵ = 0 are provided in Table 11 of Appendix D.2.4.
Our method achieves the best performance among the pruned binary networks.
This indicates that our method is competitive under difference adversarial budgets.
4.3 Analysis of the Subnetwork Patterns
In this work, we use irregular pruning.
Compared with regular pruning, irregular pruning is more flexible but less structured, which means that it requires lower-level customization to fully take advantage of parameter sparsity for acceleration.
However, visualizing the masks m of the convolutional layers in our pruned binary network with a pruning rate r = 0 .
99 allowed us to find that the mask is structured to some degree.
For example, we visualize the mask of a convolutional layer withinput channels and 256 output channels in Figure 5 of Appendix D.2.5.
We notice that the retained parameters are quite concentrated and structured: Most retained parameters concentrate on few input or output channels, while many other channels ( 40% of the total) are completely pruned.
Furthermore, we visualize two consecutive convolutional layers in the same residual block of the
RN34 model.
We call them layer1 and layer2 following the forward pass.
In Figure 1, we plot the distribution of the retained parameters in each input channel and in each output channel, respectively.
We find that many output channels of layer1 and input channels of layer2, 40% of all channels in this case, are totally pruned.
As a reference, we also plot the distribution of random pruning, based on the average of 500 simulations.
As demonstrated in Figure 1, the distribution of the retained parameters in each channel is much more uniform in this case.
Our theoretical analysis in Appendix A. demonstrates that, in a randomly pruned network, it is almost impossible to have even one entirely pruned channel.
The comparison indicates that the mask m obtained by our method is structured
[Figure]
The observations in Figure 1 also hold for kernels: a few kernels, of size 3 × 3 and thus having 9 entries, are totally unpruned.
We show the distribution of the number of retained parameters in each kernel in Figure 2 and provide the distribution by random uniform pruning as a reference.
Random uniform pruning yields no kernels with more than 3 retained parameters, but many such kernels can be observed in the masks generated by our method.
Finally, in Figure 3 of Appendix D.2.5, we visualize the positions of the pruned output channels of layer1 and the pruned input channels of layer2.
We observe those pruned channels to be aligned.
That is, some neurons representing both the output channels of layer1 and the input channels of layer2 are entirely removed.
We defer additional discussions, figures and results to Appendix D.2.5.
The pattern of the structures learned by our method indicates the potential of regular pruning for a randomly-initialized network in the presence of adversarial attacks.
We leave this as future work.
[Figure]
Conclusion
We have proposed a method to obtain robust binary models by pruning randomly-initialized networks, thus extending the Strong Lottery Ticket Hypothesis to the case of robust binary networks.
In contrast to the state-of-the-art methods, we learn the structure of robust subnetworks without updating the parameters.
Furthermore, we have proposed an adaptive pruning strategy and last batch normalization layer to stabilize the training and improve performance.
Finally, we have relied on binary initialization to obtain more compact models.
Our extensive results on various benchmarks have demonstrated that our approach outperforms existing methods for training compressed robust models.
Furthermore, we have observed interesting structured patterns occurring in the parameters retained in the subnetworks.
This opens the door to further investigations on the structure of the robust subnetworks and on the design of regular pruning strategies in the adversarial scenario.
A.1.1 Fixed Pruning Rate
We consider an L -layer neural network and each layer has n 1 , n 2 , ..., n L parameters, we retrain m 1 , m 2 , ..., m L parameters after pruning.
As such, the total number of combinations Π Li =
(cid:18) n i m i (cid:19) is the size of search space of the subnetworks.
The following theorem shows, the fixed pruning rate strategy is the strategy which approximates the maximization of the total number of combinations.
Theorem A.1.
Consider an L -layer neural network with n 1 , n 2 , ..., n L parameters in each layer, we retain m 1 , m 2 , ..., m L parameters after pruning.
Given a predefined pruning rate r = 1 − (cid:80) Li =
m i (cid:80) Li =0 n i , the optimal numbers of post-pruning parameters { m i } Li =1 that maximizing the total number of combinations Π Li =
(cid:18) n i m i (cid:19) satisfy the following inequality:
[Equation]
We defer the proof to Appendix B.1.
Specifically, we let n k in (5) be the largest layer in the network without the loss of generality, we then have ∀ i ≤ j ≤ L, j ̸ = k ,
[Equation]
m j − m
[Equation]
n k n j
[Equation]
< n j n k + 1 ≤ 2 .
m j is the number of retained parameters and thus an integer, so Theorem A.1 indicates the pruning rate of each layer is close to each other when we aim to maximize the total number of combinations.
Therefore, we can consider the fixed pruning rate strategy, i.e., 1 − r
=
m 1 n 1 = m 2 n 2 = ...
= m
L n L , as an approximation to maximize the total number of combinations.
Drawbacks While this strategy may seem intuitive, it does not take the differences in layer size into account.
In practice, the number of parameters in different layers can vary widely.
For example, residual networks [30] have much fewer parameters in the first and last layers than in the middle ones.
Using fixed pruning rate thus yields very few parameters after pruning within such small layers.
For example, when r = 0 .
99 , only 17 parameters are left after pruning for a convolutional layer withinput channels, 64 output channels and a kernel size of 3 .
Such a small number of parameters has two serious drawbacks: 1) It greatly limits the expression power of the network; 2) it makes the edge-popup algorithm less stable, because adding or removing a single parameter then has a large impact on the network’s output.
This instability becomes even more pronounced in the presence of adversarial samples, because the gradients of the model parameters are more scattered than when training on clean inputs [41].
A.1.2 Fixed Number of Parameters
To overcome drawbacks of the fixed pruning rate strategy, we study an alternative strategy aiming to maximize the total number of paths from the input to the output in the pruned network.
For a feedforward network, the total number of such paths is upper bounded by Π Li =
1 m i .
The following theorem demonstrates that the pruning strategy that maximizes this upper bound consists of retaining the same number of parameters in every layer, except for the layers that initially have too few parameters, for which all parameters should then be retained.
This optimal strategy is the fixed number of parameters mentioned in Section 3.2.
Theorem A.2.
Consider an L -layer feedforward neural network with n 1 , n 2 , ..., n L parameters in its successive layers, from which we retain m 1 , m 2 , ..., m L parameters, respectively, after pruning.
Given a predefined sparsity ratio r = 1 − (cid:80) Li =
1 m i (cid:80) Li =1 n i , the numbers of post-pruning parameters { m i } Li =
that maximize the upper bound of the total number of the input-output paths Π Li
=1 m i have the following property: ∀ 1 ≤ j ≤ L , m j satisfies either of the following two conditions: 1) m j = n j ; 2)
∀ 1 ≤ k ≤ L, m j ≥ m k − 1 .
The two conditions in Theorem A.2 mean we retain the same number of parameters for each layer except for ones totally unpruned.
We defer the proof to Appendix B.2, where we use proof by contraction.
Drawbacks While this fixed number of parameters strategy addresses the problem of obtaining too small layers arising in the fixed pruning rate one, it suffers from overly emphasizing the influence of the small layers.
That is, the smaller layers end up containing too many parameters.
In the extreme case, some layers are totally unpruned when the pruning rate r is small.
This is problematic in our settings, since the model parameters are random and not updated.
The unpruned layers based on random parameters provide a large amount of noise in the forward process.
Furthermore, this strategy significantly sacrifices the expression power of the big layers.
A.2 Analysis of Acceleration by Binary Initialization
In this section, we analyze the acceleration benefit of binary initialization.
Since most of the forward and backward computational complexity for the models studied in this paper is consumed by the “Convolutional-BatchNorm-ReLU” block, the acceleration rate on such blocks is a good approximation of that on the whole network.
Therefore, we concentrate on the “ConvolutionBatchNorm-ReLU” block here.
For simplicity, we assume the feature maps and convolutional kernels are all squares.
Without the loss of generality, we consider r in -channel input feature maps of size s , the size of the convolutional kernel is c and the convolutional layer outputs r out channels.
Here, the binary layers represent the layer whose parameters are either − 1 or +1 .
Forward Pass For full-precision dense networks, the number of FLOP operations of the convolutional layer is 2 c 2 s 2 r in r out .
By contrast, the complexity can be reduced to c 2 s 2 r in r out for binary dense layers, convolution operation with a binary kernel does not include any multiplication operations.
Correspondingly, for sparse layers whose pruning ratio is r , the complexity of full-precision sparse networks and of the binary sparse networks can be reduced to 2(1 − r )
c 2 s 2 r in r out
and (1 − r )
c 2 s 2 r in r out , respectively.
The batch normalization layer will consume 3 s 2 r out FLOP operations during inference and 10 s 2 r out during training.
The additional operations during training are due to the update of running statistics.
Note that, the batch normalization layer in our random initialized network does not contain any trainable parameters, so there is no scaling parameters after normalization.
The ReLU layer will always consume s 2 r out FLOP operations.
To sum up, we calculate the complexity ratio of the binary “Convolution-BatchNorm-ReLU” block over its full-precision counterpart in the forward pass.
For dense layers, the ratio is c 2 r in +11 2 c 2 r in +11 for the training time and c 2 r in +4 2 c 2 r in +4 for the inference.
For sparse layers, the ratio is (1 − r ) c 2 r in +11 2(1 − r ) c
2 r in +11 for the training time and (1 − r ) c 2 r in +4 2(1 − r ) c
2 r in +4 for the inference.
Backward Pass Compared with the forward pass, the backward pass has some computational overhead, because we need to calculate the gradient with respect to the score variable s associated with the convolutional kernels.
For both dense and sparse networks, the overhead is 2 c 2 s 2 r in r out + c 2 r in r out for full precision layers and 2 c 2 s 2 r in r out for binary layers.
Note that, the overhead is independent of the pruning rate r because the pruning function is treated as the identity function in the backward pass.
In addition, the difference here between the full precision layer and binary layer arises from the multiplication when we backprop the gradient through the weights.
To sum up, we calculate the complexity ratio of the binary “Convolution-BatchNorm-ReLU” block over its full-precision counterpart in the backward pass.
We only back propagate the gradient in the training time, so the batch normalization layer is always the training mode.
For dense layers, the ratio is 3 c 2 s 2 r in +4 s 2 4 c 2 s 2 r in +4 s 2 + c 2 r in .
For sparse layers, the ratio is
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
Discussion We summarize the complexity in FLOP operations of the sparse “Convolution-BatchNormReLU” block in different scenarios.
We can now conclude that compared with the full precision block, the binary block decrease the overall complexity in two places: 1) we save (1 − r )
c 2 s 2 r in r out
FLOPs for the convolution and transpose convolution operations in the forward and backward pass, respectively; 2) for the backpropagation, we save c 2 r in r out FLOPs, because there is no multiplication when we backprop the gradient through the weights for binary blocks.
We consider the practical settings: r = 0 .
99 , c = 3 , r in = r out = 128 , s = 16 .
The complexity ratio of the binary block over the full precision block in the forward pass is (1 − r ) c 2 r in +11 2(1 − r ) c
2 r in +11 = 0 .
6616 for the training mode and (1 − r ) c 2 r in +4 2(1 − r )
c 2 r in +4 = 0 .
5740 for the evaluating mode, respectively.
The complexity ratio in the backward pass is
[Equation]
=
[Equation]
That is to say, compared with the full precision block, the binary block under this setting can save around 34% and 29% time in the forward and backward passes during training; for inference, it can save 43% time.
A.3 Analysis of the Normalization Layer before Softmax
We consider a L -layer neural network and each layer has l 1 , l 2 , ..., l L neurons.
Let u ∈ R l L − 1 ,
W ∈ R l L × l L − 1 , o ∈ R l L be the output of the penultimate’s output, the weight matrix of the last fully-connected layer and the last layer’s output, respectively.
In addition, we use c ∈ { 1 , 2 , ..., l L } to denote the label of the data and omit the bias term of the last layer since it is initialized as 0 and is not updated.
For the 1-dimensional batch normalization layer, we use b ∈ R l L and v ∈ R l L to represent the running mean and running standard deviation, respectively.
Therefore, the loss objective L wo and its gradient of the model without the 1-dimensional batch normalization layer is:
[Equation]
Correspondingly, the loss objective L wi and its gradient of the model with the 1-dimensional batch normalization layer is:
[Equation]
Now we consider the case when the model parameter W is multiplied by a factor α > 1 : W ′ =
α W and assume the output of the penultimate layer is unchanged.
In practice, α is far more than 1 .
For example, if the penultimate layer has 512 neurons, α will be 16 when we change kaiming constant initialization to binary initialization.
Based on this, the new output of the last layer is o ′ =
α o .
For the model with the normalization layer, the new statistics are b ′ =
α b and v ′ =
α v .
In this regard, we can then recalculate the gradient of the loss objective as follows:
[Equation]
We first study the case without the normalization layer.
The first term
[Equation]
of the gradient
[Equation]
converge to 1 ( j = argmax i o i ) exponentially.
For correctly classified inputs, ∂ L ′ wo ∂ o ′ j converge to exponentially with α .
In addition, the gradient ∂ L ′ wo ∂ u = W ′ T ∂
L ′ wo ∂ o ′
j = α W T ∂ L ′ wo ∂ o ′
j also vanish with α .
∂ L ′ wo ∂ u is backward to previous layers, leading to gradient vanishing.
For incorrectly classified inputs, ∂ L ′ wo ∂ o ′ j converge to 1 ( j = argmax i
o i ) − 1 ( j = c ) , which is a vector with c -th element being − 1 , the element corresponding to the output label being +1 and the rest elements being 0 .
In this case, the gradient backward ∂ L ′ wo ∂ u = α W T ∂ L ′ wo ∂ o
′ j will be approximately multiplied by α , causing gradient exploding.
By contrast, in the case of the model with the normalization layer, ∂ L ′ wi ∂ o ′ j = 1 α
∂
L wi ∂ o j .
The factor 1 α is cancelled out when we calculate ∂ L ′ wi ∂ u = W ′ T ∂ L ′ wi
∂ o = W T
∂ L wi ∂ o .
This means the gradient backward remains unchanged if we use the 1-dimensional batch normalization layer, which maintains the stability of training if we scale the model parameters.
To conclude, the 1-dimensional batch normalization layer is crucial to maintain the stability of training if we use binary initialization.
Without this layer, the training will suffer from gradient vanishing for correctly classified inputs and gradient exploding for incorrectly classified inputs.
A.4 Analysis of the structure of a randomly pruned network
In this section, we provide preliminary analysis of the structure of a randomly pruned network.
As a starting point, we first estimate the probability of k retained parameters in a 3 × 3 kernel.
Given the pruning rate r i for the layer i with n i weights, the number of the retained parameters is m i :=
(1 − r i ) n i .
We assume m i lies in a proper range:
9 ≪ m i < 19 n i .
This is true when n i is large and r i > 89 .
For each kernel j , we use X j to represent its number of retained parameters.
It is difficult to calculate
P ( X j = k ) directly because { X j } j are constrained by: 1) (cid:80) j X j = m i ; 2) ∀ j, 0 ≤ X j ≤ 9 .
However, in the case of random pruning, we have E [ X j ] = 9 m i n i =
− r i ) <
In this regard, we can make the approximation by removing the constraint X j ≤ 9 .
Therefore, we can reformulate the problem of calculating P ( X j = k ) as: Given m i steps, randomly select one box out of the total n i 9 boxes and put one apple in it.
P ( X j = k ) is then the probability for the box j to have k apples.
In this approximation, it is straightforward to have P ( X j = k ) =
(cid:0)
[Equation]
where P i = 9 n i .
Based on the assumption that n i is large, P i ≈ 0 .
Therefore, P ( X j = 0) =
(1 − 9 n i ) m i
≈
e 9(1 − r i ) .
For k > 1 , we apply Stirling approximation n !
≈ √ 2 πn ( ne ) n to the binomial coefficient, then
[Equation]
The second equality is based on the fact m i =
(1 − r i ) n i .
Since m i ≫ 9 > k by the assumption and n i ≫ m i , we can approximate (1 − 9 n i ) m i − k to 1 − 9( m i − k ) n i ≈ 1 , then
P ( X
[Equation]
=
[Equation]
(cid:114)
[Equation]
where c = 9 e (1 − r i ) is a constant.
As shown in the equation above, P ( X j = k ) decreases drastically when k increases.
Therefore, in a randomly pruned layer i with n i =
× 3 × 256 × 256 = 589824 and r i = 0 .
99 , it is almost impossible to see kernels who have at least 4 retained parameters, because according to the above formula, the estimated number of kernels in that layer having 3 retained parameters is n i 9 × P ( X j = 3)
≈ 8 . 19 , and the number of kernels having 4 retained parameters is ≈ 0.18.
Now we consider the number of retained parameters in a channel.
For the layer of r in input channels and r out output channels, it has r in × r out × 3 × 3 parameters.
We use Y j to represent the number of the retained parameters for the input channel j .
Similarly, for the random pruning, we have
[Equation]
where c ′ =
9 er out (1 − r i ) is a constant.
By plotting the distribution P ( Y j ) , it is easy to find that the distribution of Y j concentrates around the neighborhood of k
= m i a , and decreases significantly as Y j deviates from it.
B Proofs of Theoretical Results B.1 Proof of Theorem A.
Proof.
We pick arbitrary 0 < j, k ≤ L and generates two sequences { (cid:98) m i } Li =1 , { (cid:101) m i } Li =1 as follows:
[Equation]
Consider { m i } Li =1 the optimality that maximizes the combination number Π Li = (cid:18) n i m i (cid:19) .
We have the following inequality:
[Equation]
Reorganize the inequalities above, we obtain:
[Equation]
Consider 1 ≤ m j ≤ n j and 1 ≤ m k ≤ n k , we have m k − m j +1 n j n k ≤ 1 n j and m j − m k +1 n j n k ≤ 1 n k .
As a result, we have the following inequality:
[Equation]
This concludes the proof.
B.2 Proof of Theorem A.
Proof.
We proof the theorem by contradictory.
We assume the optimal { m i } Li =1 does not satisfy the property mentioned in Theorem A.2.
This means ∃ 1 ≤ j ≤ L such that m j < n j and ∃ 1 ≤ k ≤ L, m j < m k − 1 .
Based on this, we then construct a new sequence { (cid:98) m i } Li =1 as follows:
[Equation]
[Equation]
We then calculate the ratio of Π Li =1 (cid:98) m i and Π Li =
1 m i :
[Equation]
The last inequality is based on the assumption m j < m k − 1 .
(17) indicates Π Li
=1 (cid:98) m i >
Π Li =
1 m i , which contradicts the optimality of { m i } Li =1 .
C Algorithm
We provide the pseudo-code of the edge pop-up algorithm for adversarial robustness as Algorithm 1.
We use PGD to generate adversarial attacks.
Π S
ϵ mean projection into the set S ϵ .
Algorithm 1 Edge pop-up algorithm for adversarial robustness.
Input: training set D , batch size B , PGD step size α and iteration number n , adversarial budget
S ϵ , pruning rate r , mask function M , the optimizer.
Random initialize the model parameters w and the scores s .
for Sample a mini-batch { x i , y i } Bi =1 ∼ D do for i = 1, 2, ...,
B do
Sample a random noise δ within the adversarial budget S ϵ .
x (0) i
= x
i + δ for j = 1, 2, ..., n do x ( j ) i
= x ( j − 1)
i
[Equation] [Equation]
[Equation]
end for end for
Calculate the gradient g = 1 B (cid:80) Bi
=1 ▽ s L ( f
[Equation]
w ⊙ M
[Equation]
s , r ) , x ( n ) i ) , y i )
Update the score s using the optimizer.
end for
Output: the pruning mask M ( s , r ) .
We provide the pseudo-code of our algorithm on the ImageNet100 as Algorithm 2.
It incorporates
FGSM [57] with ATTA [7].
In addition, due to the high resolution and large size of the ImageNet dataset, we need to compress the initial perturbation directory to reduce the overhead of memory consumption.
Here, we choose to downsample the original perturbation to reduce its resolution for storage, and then upsample it back to the original resolution when using it as the initial perturbation.
D Experiments D.1 Experimental Settings
General The RN34 architecture we use in this paper is the same as the one in [51, 54], and it has 21265088 trainable parameters.
The bias terms of all linear layers are initialized 0, and are thus disabled.
We also disable the learnable affine parameters in batch normalization layers, following the setup of [51].
Unless specified, the number of training epochs for CIFAR10 and CIFAR100 is 400, and for ImageNet100 there are 100 training epochs.
The adversarial budget in this paper is based on l ∞ norm and the perturbation strength ϵ is 8 / 255 for CIFAR10, 4 / 255 for CIFAR100 and 2 / 255 for
ImageNet100.
The resolution of CIFAR10 and CIFAR100 is 32 × 32 ; the resolution of ImageNet is 224 × 224 .
ImageNet100 is a subset of ImageNet which consists of 100 classes.
The selection of these classes follows the settings of a python library called Continuum [20].
The PGD attacks used in our experiments have 10 iterations and the step size is one-quarter of the ϵ , respectively.
The
AutoAttack (AA) consists of the following four attacks: 1) the untargeted 100 -iteration AutoPGD based on cross-entropy loss; 2) the targeted 100 -iteration AutoPGD based on difference of logits ratio (DLR) loss; 3) the targeted 100 -iteration FAB attack [14]; 4) the black-box 5000 -query
Square
Input: training set D , batch size B , FGSM step size α , adversarial budget S ϵ , pruning rate r , mask function M , the optimizer.
Random initialize the model parameters w and the scores s .
Initialize the instance-to-perturbation dictionary M = {} for Sample a mini-batch { x i , y i } Bi =1 ∼ D do for i = 1 , 2 , ..., n do
Data augmentation x i ← A ( x i ) if x i in M then
Get the downsampled perturbation: δ ′ i
=
A ( M ( x i ))
Upsample δ ′ to the original resolution and get δ i .
else
Sample a random noise δ i within the adversarial budget S ϵ end if δ i ← δ i
+ α ▽ δ i L
( f ( w ⊙ M ( s , r ) , x i
+ δ i ) , y i )
δ i ← Π S
ϵ δ i Update the dictionary by the downsampled perturbation δ ′
i : M ( x i ) =
A − 1 ( δ ′ i ) end for end for
Calculate the gradient g
L
M s
, y
Update the score using the optimizer.
Output
M attack [2].
We use the same hyper parameters in all these component attacks as in the original
AutoAttack implementation.
We train the model using an SGD optimizer, with the momentum factor being 0 .
9 and the weight decay factor being 5 × 10 − 4 .
The learning rate is initially 0 .
1 and decays following the cosine annealing scheduler.
Finally, since adversarial training suffers from severe overfitting [53], we use a validation set consisting of 2% of the training data to select the best model during training.
Adversarial Training We apply the same settings as above to adversarial training, except the choice of optimizer and learning rate.
For full precision networks, we use an SGD optimizer with an initial learning rate of 0.1 and decreases by a factor of 10 in the 200th and 300th epoch for CIFAR10 and
CIFAR100 models.
For ImageNet100, the learning rate decreases by a factor of 10 in the 50th and 75th epoch.
For binary networks, we use Adam optimizer [35] suggested in [10] and have a cosine annealing learning rate schedule with an initial learning rate of 1 × 10 − 4 .
Baselines (FlyingBird(+), BCS, RST, HYDRA, ATMC)
Our results on the baselines are based on their original public implementation except that we use the validation set to pick the best model during training.
FlyingBird(+), BCS, and HYDRA do not inherently support binary networks, so we plug in the BinaryConnect algorithm [10] with the same settings as the ones in adversarial training.
We also plug in Algorithm 2 for fast training on ImageNet100.
We scale down the number of training epochs of FlyingBird(+), BCS, RST to 100 epochs, and HYDRA to 110 epochs (50 pretrain +prune + 50 finetune).
For ATMC, we use 50 epochs for each of the four training phases, adding up to 200 epochs in total.
In all baselines except RST, the batch normalization layers in the model have affine operations and are learnable.
This introduces additional trainable parameters and is different from the network used in our method.
Smaller RN34 Variants Based on the adaptive pruning strategy, we designed several smaller RN variants with approximately the same number of parameters as the pruned networks.
These variants have the same topology as RN34 but have fewer channels in each layer.
In Table 7, we provide architecture details based on different values of p when the pruning rate r is 0 . 99 .
The Small RN model in Table 4 represents the small model with p = 0 .
1 ( Small RN34-p0.1 in Table 7), since it has better performance than the other small networks.
[Table]
D.2 Additional Experimental Results D.2.1 Ablation Study in the Non-Adversarial Case
In the non-adversarial case, we train the models using clean inputs and report the clean accuracy in Table 8.
Other hyper-parameters here are the same as in Table 3.
Our conclusions from Tablealso hold true here: the binary initialization can achieves comparable performance as the Signed
Kaiming Constant ; the last batch normalization layer helps improve performance for both initialization schemes.
[Table]
D.2.2 More results of Baselines
We show in Table 9 the complete set of experiments of baseline algorithms on CIFAR10 and
CIFAR100 as a complementary of Table 4.
Specifically, we compare baselines with different architectures and with different pruning strategies.
First, the last batch normalization layer (LBN) does not improve the baselines that update model parameters in the full-precision setting, because the magnitude of the output logits can be automatically adjusted in these cases.
There is no need to insert another normalization layer.
For FlyingBird(+), BCS and HYDRA, adding LBN to a binary network will most likely be beneficial to a better performance.
This observation is consistent with our claim in Appendix A.3.
As for ATMC, it is actually not pruning a truly binary network since the value of model parameters are trainable and not necessarily +1 or − 1 , so adding LBN might not be useful in this case.
For the pruning strategy, adaptive pruning strategy with p = 0 .
1 always has better performance than the fixed pruning rate strategy, i.e., p = 1 . 0 .
This is because the pruning rate here is very high r = 0 . 99 , and we need a small value of p based on the analysis in Section 3.2.
Furthermore, we provide the performance of TRADES [64], which trades clean accuracy for adversarial accuracy.
Compared with adversarial training (AT), TRADES achieves competitive performance in the full precision cases, but it performance degrades significantly in the binary cases.
[Table]
D.2.3 Clean accuracy of Models in Table
Table 10 shows the accuracy on the clean test set of the models in Table 4.
In the CIFAR10 dataset, our pruned networks with both normal and fast pruning achieve the highest vanilla accuracy among all binary networks.
Although the accuracy is lower than full-precision networks by ATMC, our model performs notably better ( > 10% ) under AutoAttack.
In the CIFAR100 dataset, our model using FGSM with ATTA has the best vanilla accuracy among both full-precision networks and binary networks, and also achieves comparable robust accuracy to them, as shown in Table 4.
Our model using PGD also achieves competitive performance, better than all other binary networks.
In the
ImageNet100 dataset, our model still outperforms all other pruned binary models, although it is worse than some full precision models.
These results indicate that our models can achieve competitive robust accuracy without losing too much vanilla accuracy, hence more powerful in real applications where both robust and vanilla accuracy are important.
D.2.4 Our Method in the Non-adversarial Cases
Vanilla training can be considered as a special case of adversarial training: the case when ϵ = 0 .
Therefore, our methods, as well as baselines, are applicable to vanilla training.
The results of the cases when ϵ = 0 are demonstrated in Table 11.
Since there are no adversarial attacks in vanilla training,
Method
[Table]
Small
[Table]
FlyingBird
[Table]
FlyingBird+
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
HYDRA
[Table]
[Table] [Table]
Ours
[Table]
p =
[Table]
[Table] [Table]
Ours
[Table]
p = 0 .-
[Table] [Table]
in the full precision (FP) cases are underlined and the best results in the binary cases are marked in bold.
the acceleration used in “Ours (fast)” is not applicable here.
The results in Table 11 demonstrate the consistent observations with Table 4: our proposed methods achieve the best performance among binary networks.
Method
[Table]
AT
[Table] [Table]
[Table] [Table]
[Table]
AT
[Table] [Table]
[Table] [Table]
[Table] [Table]
AT
Small RN
Not Pruned
[Table] [Table]
FlyingBird
RN
Dynamic 93.
FlyingBird+
RN
Dynamic 92.
[Table]
Dynamic
[Table] [Table]
p =
[Table] [Table]
[Table] [Table]
RN
[Table]
p =
[Table]
HYDRA
RN p =
[Table] [Table]
[Table]
ATMC
RN
Global
[Table]
ATMC
RN p =
Ours
RN34-LBN p = 0 .-
the CIFAR10, CIFAR100 and ImageNet100 test sets for the baselines and our proposed method in the non-adversarial case, i.e., ϵ = 0 .
“RN34-LBN” represents
ResNet34 with the last batch normalization layer.
“Small RN34” refers to Small RN34-p0.1 in Tableof Appendix D.1.
The pruning rate is set to 0 .
99 except for the not-pruned methods.
Among the pruned models, the best results for the full-precision (FP) models are underlined; the best results for the binary models are marked in bold.
D.2.5 Mask of the Pruned Network
We have demonstrated that the masks of the pruned network obtained by our method are structured to some degree in Section 4.3.
We have also analyzed the structure of a randomly pruned network in
Appendix A.4.
Figure 5 shows the one of the convolutional layers in our pruned RN34 network.
We resize the layer parameters as grids of shape ( r out , r in ) for visualization.
Each grid represents a 3-by-3 kernel.
So the shape of parameters is ( r out × 3 , r in × 3) .
The retained parameters in each kernel are marked in blue.
The pruning rate for this layer is r = 0 .
We highlight the input channels that are totally pruned in orange.
We also use a white bar at the top of the figure to indicate these empty input channels.
In Section 4.3, we also point out the aligned pruning pattern in the two consecutive layers, layer1 and layer2, of the same residual block in RN34.
Figure 3 shows their pruning masks.
The side bars show which channel is non-empty(colored in blue).
For convenience, layer1 is resized in ( r out × 3 , r in × 3) , and layer2 is organized in ( r in × 3 , r out × 3) .
It is interesting that the pruned input channels of layer are well aligned with the pruned output channels of layer1.
Note that our finding also holds in the vanilla settings, i.e. pruning with clean examples.
We think this observation enables a possible way for regular pruning.
D.2.6 Learning Curves of Adaptive Pruning with Different p Values
We plot the learning curves when we use the adaptive pruning strategy with different values of p in Figure 4.
Here, we use r = 0 .
99 and r = 0 .
5 as two examples.
Based on the results of Table 1, our method achieves the best performance under p = 0 .
1 when r = 0 .
99 and under p = 1 .
when r = 0 .
The learning curves in Figure 4 indicate that the training process is quite unstable when using the inappropriate pruning strategy, leading to suboptimal performance.
[Figure]