S TOCHASTIC ACTIVATION PRUNING FOR ROBUST ADVERSARIAL DEFENSE
A BSTRACT
Neural networks are known to be vulnerable to adversarial examples.
Carefully chosen perturbations to real images, while imperceptible to humans, induce misclassiﬁcation and threaten the reliability of deep learning systems in the wild.
To guard against adversarial examples, we take inspiration from game theory and cast the problem as a minimax zero-sum game between the adversary and the model.
In general, for such games, the optimal strategy for both players requires a stochastic policy, also known as a mixed strategy .
In this light, we propose Stochastic
Activation Pruning ( SAP ), a mixed strategy for adversarial defense.
SAP prunes a random subset of activations (preferentially pruning those with smaller magnitude) and scales up the survivors to compensate.
We can apply SAP to pretrained networks, including adversarially trained models, without ﬁne-tuning, providing robustness against adversarial examples.
Experiments demonstrate that SAP confers robustness against attacks, increasing accuracy and preserving calibration.
I NTRODUCTION
While deep neural networks have emerged as dominant tools for supervised learning problems, they remain vulnerable to adversarial examples (Szegedy et al., 2013).
Small, carefully chosen perturbations to input data can induce misclassiﬁcation with high probability.
In the image domain, even perturbations so small as to be imperceptible to humans can fool powerful convolutional neural networks (Szegedy et al., 2013; Goodfellow et al., 2014).
This fragility presents an obstacle to using machine learning in the wild.
For example, a vision system vulnerable to adversarial examples might be fundamentally unsuitable for a computer security application.
Even if a vision system is not explicitly used for security, these weaknesses might be critical.
Moreover, these problems seem unnecessary.
If these perturbations are not perceptible to people, why should they fool a machine?
Since this problem was ﬁrst identiﬁed, a rapid succession of papers have proposed various techniques both for generating and for guarding against adversarial attacks.
Goodfellow et al.
(2014) introduced a simple method for quickly producing adversarial examples called the fast gradient sign method (FGSM).
To produce an adversarial example using FGSM, we update the inputs by taking one step in the direction of the sign of the gradient of the loss with respect to the input.
To defend against adversarial examples some papers propose training the neural network on adversarial examples themselves, either using the same model (Goodfellow et al., 2014; Madry et al., 2017), or using an ensemble of models (Tramèr et al., 2017a).
Taking a different approach, Nayebi & Ganguli (2017) draws inspiration from biological systems.
They propose that to harden neural networks against adversarial examples, one should learn ﬂat, compressed representations that are sensitive to a minimal number of input dimensions.
This paper introduces Stochastic Activation Pruning ( SAP ), a method for guarding pretrained networks, against adversarial examples.
During the forward pass, we stochastically prune a subset of the activations in each layer, preferentially retaining activations with larger magnitudes.
Following the pruning, we scale up the surviving activations to normalize the dynamic range of the inputs to the subsequent layer.
Unlike other adversarial defense methods, our method can be applied post-hoc to pretrained networks and requires no additional ﬁne-tuning.
P RELIMINARIES
We denote an n -layered neural network h : X → Y as a chain of functions h
= h n ◦ h n − 1 ◦ . . .
◦
h 1 , where each h i consists of a linear transformation W i followed by a non-linearity φ i .
Given a set of nonlinearities and weight matrices, a neural network provides a nonlinear mapping from inputs x ∈ X to outputs ˆ y ∈ Y , i.e.
[Equation]
In supervised classiﬁcation and regression problems, we are given a data set D of pairs ( x, y ) , where each pair is drawn from an unknown joint distribution.
For the classiﬁcation problems, y is a categorical random variable, and for regression, y is a real-valued vector.
Conditioned on a given dataset, network architecture, and a loss function such as cross entropy, a learning algorithm, e.g. stochastic gradient descent, learns parameters θ := { W i } ni =1 in order to minimize the loss.
We denote J ( θ, x, y ) as the loss of a learned network, parameterized by θ , on a pair of ( x, y ) .
To simplify notation, we focus on classiﬁcation problems, although our methods are broadly applicable.
Consider an input x that is correctly classiﬁed by the model h .
An adversary seeks to apply a small additive perturbation ∆ x , x adv = x + ∆ x , such that h ( x ) (cid:54) =
h ( x adv ) , subject to the constraint that the perturbation is imperceptible to a human.
For perturbations applied to images, the l ∞ -norm is considered a better measure of human perceptibility than the more familiar l 2 norm Goodfellow et al.
Throughout this paper, we assume that the manipulative power of the adversary, the perturbation ∆ x , is of bounded norm (cid:107) ∆ x (cid:107) ∞ ≤ λ .
Given a classiﬁer, one common way to generate an adversarial example is to perturb the input in the direction that increases the cross-entropy loss.
This is equivalent to minimizing the probability assigned to the true label.
Given the neural network h , network parameters θ , input data x , and corresponding true output y , an adversary could create a perturbation ∆ x as follows
[Equation]
Due to nonlinearities in the underlying neural network, and therefore of the objective function J , the optimization Eq. 1, in general, can be a non-convex problem.
Following Madry et al.
Goodfellow et al.
(2014), we use the ﬁrst order approximation of the loss function
[Equation]
where J = ∇ x J.
The ﬁrst term in the optimization is not a function of the adversary perturbation, therefore reduces to
[Equation]
Given the input, label and a ﬁxed model, an adversary chooses r to be in the direction of sign of
J ( θ, x, y ) , i.e. ∆ x = λ · sign ( J ( θ, x, y )) .
This is the FGSM technique due to Goodfellow et al.
Note that FGSM requires an adversary to access the model in order to compute the gradient.
S TOCHASTIC ACTIVATION PRUNING
Consider the defense problem from a game-theoretic perspective (Osborne & Rubinstein, 1994).
The adversary designs a policy in order to maximize the defender’s loss, while knowing the defenders policy.
At the same time defender aims to come up with a strategy to minimize the maximized loss.
Therefore, we can rewrite Eq.
1 as follows
[Equation]
where ρ is the adversary’s policy, which provides r ∼ ρ in the space of bounded (allowed) perturbations (for any r in range of ρ , (cid:107) r (cid:107) ∞ ≤ λ ) and π is the defenders policy which provides p ∼ π , an instantiation of its policy.
The adversary’s goal is to maximize the loss of the defender by perturbing the input under a strategy ρ and the defender’s goal is to minimize the loss by changing model parameters θ to M p ( θ ) under strategy π .
The optimization problem in Eq.
2 is a minimax zero-sum game between the adversary and defender where the optimal strategies ( π ∗ , ρ ∗ ) , in general, are mixed
Nash equilibrium, i.e. stochastic policies.
Intuitively, the idea of SAP is to stochastically drop out nodes in each layer during forward propagation.
We retain nodes with probabilities proportional to the magnitude of their activation and scale up the surviving nodes to preserve the dynamic range of the activations in each layer.
Empirically, the approach preserves the accuracy of the original model.
Notably, the method can be applied post-hoc to already-trained models.
Formally, assume a given pretrained model, with activation layers ( ReLU, Sigmoid, etc. ) and input pair of ( x, y ) .
For each of those layers, SAP converts the activation map to a multinomial distribution, choosing each activation with a probability proportional to its absolute value.
In other words, we obtain the multinomial distribution of each activation layer with L 1 normalization of their absolute values onto a L 1 -ball simplex.
Given the i ’th layer activation map, h i ∈ R a i , the probability of sampling the j ’th activation with value ( h i )
j is given by
[Equation]
We draw random samples without replacement from the activation map given the probability distribution described above.
This makes it convenient to determine whether an activation would be sampled at all.
If an activation is sampled, we scale it up by the inverse of the probability of sampling it over all the draws.
If not, we set the activation to 0 .
In this way, SAP preserves inverse propensity scoring of each activation.
Under an instance p of policy π , we draw r ip samples with replacement from this multinomial distribution.
The new activation map, M p ( h i ) is given by
[Equation]
where I (( h i ) j ) is the indicator function that returns 1 if ( h i )
j was sampled at least once, andotherwise.
The algorithm is described in Algorithm 1.
In this way, the model parameters are changed from θ to M p ( θ ) , for instance p under policy π , while the reweighting 1 − (1 − p ij ) r ip preserves
E p ∼ π [ M p ( h i ) j ] =
( h i ) j .
If the model was linear, the proposed pruning method would behave the same way as the original model in expectation.
In practice, we ﬁnd that even with the non-linearities in deep neural networks, for sufﬁciently many examples, SAP performs similarly to the un-pruned model.
This guides our decision to apply SAP to pretrained models without performing ﬁne-tuning. 12: for j do 13: 14: return
3. A DVANTAGE AGAINST ADVERSARIAL ATTACK
We attempt to explain the advantages of SAP under the assumption that we are applying it to a pre-trained model that achieves high generalization accuracy.
For instance p under policy π , if the number of samples drawn for each layer i , r ip , is large, then fewer parameters of the neural network are pruned, and the scaling factor gets closer to 1 .
Under this scenario, the stochastically pruned model performs almost identically to the original model.
The stochasticity is not advantageous in this case, but there is no loss in accuracy in the pruned model as compared to the original model.
On the other hand, with fewer samples in each layer, r ip , a large number of parameters of the neural network are pruned.
Under this scenario, the SAP model’s accuracy will drop compared to the original model’s accuracy.
But this model is stochastic and has more freedom to deceive the adversary.
So the advantage of SAP comes if we can balance the number of samples drawn in a way that negligibly impacts accuracy but still confers robustness against adversarial attacks.
SAP is similar to the dropout technique due to Srivastava et al.
However, there is a crucial difference: SAP is more likely to sample activations that are high in absolute value, whereas dropout samples each activation with the same probability.
Because of this difference, SAP , unlike dropout, can be applied post-hoc to pretrained models without signiﬁcantly decreasing the accuracy of the model.
Experiments comparing SAP and dropout are included in section 4.
Interestingly, dropout confers little advantage over the baseline.
We suspect that the reason for this is that the dropout training procedure encourages all possible dropout masks to result in similar mappings.
3. A DVERSARIAL ATTACK ON SAP
If the adversary knows that our defense policy is to apply SAP , it might try to calculate the best strategy against the SAP model.
Given the neural network h , input data x , corresponding true output y , a policy ρ over the allowed perturbations, and a policy π over the model parameters that come from SAP (this result holds true for any stochastic policy chosen over the model parameters), the adversary determines the optimal policy ρ ∗
[Equation]
Therefore, using the result from section 2, the adversary determines the perturbation ∆ x as follows;
[Equation]
To maximize the term, the adversary will set r to be in the direction of sign of E
p ∼ π
[ J ( M p ( θ ) , x, y )] .
Analytically computing E p ∼ π
[ J ( M p ( θ ) , x, y )] is not feasible.
However, the adversary can use
Monte Carlo sampling to estimate the expectation as (cid:101) J
( M p ( θ ) , x, y ) .
Then, using FGSM, ∆ x = λ · sign ( (cid:101) J ( M p ( θ ) , x, y )) .
E XPERIMENTS
Our experiments to evaluate SAP address two tasks: image classiﬁcation and reinforcement learning.
We apply the method to the ReLU activation maps at each layer of the pretrained neural networks.
To create adversarial examples in our evaluation, we use FGSM, ∆ x = λ · sign ( J ( M p ( θ ) , x, y )) .
For stochastic models, the adversary estimates J ( M p ( θ ) , x, y ) using Monte Carlo sampling unless otherwise mentioned.
All perturbations are applied to the pixel values of images, which normally take values in the range 0 - 255 .
So the fraction of perturbation with respect to the data’s dynamic range would be λ 256 .
To ensure that all images are valid, even following perturbation, we clip the resulting pixel values so that they remain within the range [0 , 255] .
In all plots, we consider perturbations of the following magnitudes λ
= { 0 , 1 , 2 , 4 , 8 , 16 , 32 , 64 } .
To evaluate models in the image classiﬁcation domain, we look at two aspects: the model accuracy for varying values of λ , and the calibration of the models (Guo et al., 2017).
Calibration of a model is the relation between the conﬁdence level of the model’s output and its accuracy.
A linear calibration
[Figure]
It is worth restating that obtaining the iterative attack of SAP models is much more expensive and noisier than the iterative attack of dense models.
is ideal, as it suggests that the accuracy of the model increases with the conﬁdence level of its output.
For stochastic models, we compute the output as an average over multiple forward passes.
To evaluate models in the reinforcement learning domain, we look at the average score that each model achieves on the games played, for varying values of λ .
The higher the score, the better is the model’s performance.
Because the units of reward are arbitrary, we report results in terms of the the relative percent change in rewards.
4. A DVERSARIAL ATTACKS IN IMAGE CLASSIFICATION
The CIFAR- 10 dataset (Krizhevsky & Hinton, 2009) was used for the image classiﬁcation domain.
We trained a ResNet- 20 model (He et al., 2016) using SGD, with minibatches of size 512 , momentum of 0 .
9 , weight decay of 0 . 0001 , and a learning rate of 0 .
5 for the ﬁrst 100 epochs, then 0 .
for the next 30 epochs, and then 0 .
005 for the next 20 epochs.
This achieved an accuracy of 89 .
8% with cross-entropy loss and ReLU non-linearity.
For all the ﬁgures in this section, we refer to this model as the dense model.
The accuracy of the dense model degrades quickly with λ .
For λ = 1 , the accuracy drops down to 66 .
3% , and for λ = 2 it is 56 .
These are small (hardly perceptible) perturbations in the input images, but the dense model’s accuracy decreases signiﬁcantly.
4.1. S TOCHASTIC ACTIVATION PRUNING ( SAP )
We apply SAP to the dense model.
For each activation map h i ∈
R a i , we pick k % of a i activations to keep.
Since activations are sampled with replacement, k can be more than 100 .
We will refer to k as the percentage of samples drawn.
Fig.
1a plots performance of SAP models against examples perturbed with random noise.
Perturbations of size λ = 64 are readily perceptible and push all models under consideration to near-random outputs, so we focus our attention on smaller values of λ .
Fig.
1b plots performance of these models against adversarial examples.
With many samples drawn, SAP converges to the dense model.
With few samples drawn, accuracy diminishes, even without perturbation.
The plot explains this balance well.
We achieve the best performance with ∼ 100% samples picked.
We will now only look at SAP 100% ( SAP - 100 ).
Against adversarial examples, with λ = 1 , 2 and 4 , we observe a 12 .
3% and 12 .
8% absolute increase in accuracy respectively.
However, for λ = 0 , we observe a 6 . 5% absolute decrease in accuracy.
For λ = 16 again, there is a 5 . 2% absolute decrease in accuracy.
4.1. D ROPOUT ( DRO )
Dropout , a technique due to Srivastava et al.
(2014), was also tested to compare with SAP .
Similar to the SAP setting, this method was added to the ReLU activation maps of the dense model.
We see that low dropout rate perform similar to the dense model for small λ values, but its accuracy starts decreasing very quickly for higher λ values (Fig. 2a).
We also trained ResNet- 20 models, similar [Figure] to the dense model, but with different dropout rates.
This time, the models were trained forepochs, with an initial learning rate of 0 . 5 , reduced by a factor of 0 .
1 after 100 , 150 , 190 andepochs.
These models were tested against adversarial examples with and without dropout during validation (Figs. 2b and 2c respectively).
The models do similar to the dense model, but do not provide additional robustness.
4.1. A DVERSARIAL TRAINING ( ADV )
Adversarial training (Goodfellow et al., 2014) has emerged a standard method for defending against adversarial examples.
It has been adopted by Madry et al.
; Tramèr et al.
(2017a) to maintain high accuracy levels even for large λ values.
We trained a ResNet- 20 model, similar to the dense model, with an initial learning rate of 0 . 5 , which was halved every 10 epochs, for a total ofepochs.
It was trained on a dataset consisting of 80% un-perturbed data and 20% adversarially perturbed data, generated on the model from the previous epoch, with λ = 2 .
This was done on the CIFAR- 10 dataset.
This achieved an accuracy of 75 . 0% on the un-perturbed validation set, with cross-entropy loss and ReLU non-linearity.
Note that the model capacity was not changed.
When tested against adversarial examples, the accuracy dropped to 72 .
9% and 67 .
5% for λ
= 1 , 2 and 4 respectively.
We ran SAP - 100 on the ADV model (referred to as ADV + SAP - 100 ).
The accuracy in the no perturbation case was 74 .
For adversarial examples, both models act similar to each other for small values of λ .
But for λ = 16 and 32 , ADV + SAP - 100 gets a higher accuracy than ADV by an absolute increase of 7 . 8% and 7 . 9% respectively.
We compare the accuracy- λ plot for dense, SAP - 100 , ADV and ADV + SAP - 100 models.
This is illustrated in Fig.
3 For smaller values of λ , SAP - 100 achieves high accuracy.
As λ gets larger, ADV + SAP - 100 performs better than all the other models.
We also compare the calibration plots for these models, in Fig.
The dense model is not linear for any λ (cid:54) = 0 .
The other models are well calibrated (close to linear), and behave similar to each other for λ ≤ 4 .
For higher values of λ , we see that ADV + SAP - 100 is the closest to a linearly calibrated model.
4. A DVERSARIAL ATTACKS IN DEEP REINFORCEMENT LEARNING ( RL )
Previously, (Behzadan & Munir, 2017; Huang et al., 2017; Kos & Song, 2017) have shown that the reinforcement learning agents can also be easily manipulated by adversarial examples.
The
RL agent learns the long term value Q ( a, s ) of each state-action pair ( s, a ) through interaction with an environment, where given a state s , the optimal action is arg max a Q ( a, s ) .
A regression based algorithm, Deep Q-Network (DQN)(Mnih et al., 2015) and an improved variant, Double DQN (DDQN) have been proposed for the popular Atari games (Bellemare et al., 2013) as benchmarks.
We deploy DDQN algorithm and train an RL agent in variety of different Atari game settings.
Similar to the image classiﬁcation experiments, we tested SAP on a pretrained model (the model is described in the Appendix section A), by applying the method on the ReLU activation maps.
SAPwas used for these experiments.
Table 1 speciﬁes the percentage relative increase in rewards of
SAP - 100 as compared to the original model.
For all the games, we observe a drop in performance for
[Figure]
the no perturbation case.
But for λ (cid:54) = 0 , the relative increase in rewards is positive (except for λ
=in the BattleZone game), and is very high in some cases ( 3425 .
9% for λ = 1 for the Bowling game).
4. A DDITIONAL BASELINES
In addition to experimenting with SAP , dropout, and adversarial training, we conducted extensive experiments with other methods for introducing stochasticity into a neural network.
These techniques included 0 -mean Gaussian noise added to weights (RNW), 1 -mean multiplicative Gaussian noise for the weights (RSW), and corresponding additive (RNA) and multiplicative (RSA) noise added to [Table] [Figure] the activations.
We describe each method in detail in Appendix B. Each of these models performs worse than the dense baseline at most levels of perturbation and none matches the performance of
SAP .
Precisely why SAP works while other methods for introducing stochasticity do not remains an open question that we continue to explore in future work.
4. M ONTE C ARLO SAMPLES FOR GRADIENT ESTIMATION AND DENSE MODEL ATTACK
Previously, the adversary used a 100 Mote Carlo samples to estimate the gradient with respect to the SAP models to create adversarial examples.
In Fig.
6 we compare the performance of SAPagainst different kinds of adversarial examples - generated on the dense model and generated on
SAP - 100 with different number of Monte Carlo samples taken.
We see that if the adversary uses the dense model to generate adversarial examples, SAP - 100 model’s accuracy decreases.
Additionally, if the adversary uses the SAP - 100 model to generate adversarial examples, as the number Monte Carlo samples it uses to estimate the gradient is increased, the lower the accuracy gets.
But for low amounts of perturbation ( λ = 1 and 2 ), SAP - 100 does better than the dense model.
Computing a single backward pass of the SAP - 100 model for 512 examples takes ∼ 20 seconds on 8 GPUs.
If the adversary uses 100 and 1000 Monte Carlo samples to estimate the gradient, for the same number of examples under the same setting, it would take ∼ 0 .
6 and ∼ 6 hours respectively.
Considering that there are 10000 images just in the validation set for CIFAR- 10 , that is a lot of computational power for the adversary.
4. I TERATIVE ADVERSARIAL ATTACK
A more sophisticated technique for producing adversarial perturbations (than FGSM) is to apply multiple and smaller updates to the input in the direction of the local sign-gradients.
This can be done by taking small steps of size k ≤ λ in the direction of the sign-gradient at the updated point and repeating the procedure (cid:100) λk (cid:101) times (Kurakin et al., 2016) as follows
[Equation]
where function clip x,λ is a projection into a L ∞ -ball of radius λ centered at x , and also into the hyper-cube of image space (each pixel is clipped to the range of [0 , 255] ).
The dense and SAPmodels are tested against this adversarial attack, with k = 1 .
(Fig. 1c).
The accuracies of the dense model at λ = 0 , 1 , 2 and 4 are 89 .
1% and 31 . 0% respectively.
The accuracies of the
SAP - 100 model against attacks computed on its own (with 10 Monte Carlo samples taken at each step to estimate the gradient) are 83 .
2% and 76 .
7% , respectively, for λ = 0 , 1 , 2 , 4 .
The SAP - 100 model provides accuracies of 83 .
2% , 67 . 0% and 50 .
8% , respectively, against attacks computed on the dense model, also, with the perturbations in the range λ = 0 , 1 , 2 , 4 .
Iterative attacks on the SAP models are much more expensive and noisy than iterative attacks on dense models.
This is why the adversarial attack computed on the dense model results in lower accuracies on the
SAP - 100 model than the adversarial attack computed on the SAP - 100 model itself.
R ELATED WORK
Robustness to adversarial attack has recently emerged as a serious topic in machine learning (Goodfellow et al., 2014; Kurakin et al., 2016; Papernot & McDaniel, 2016; Tramèr et al., 2017b; Fawzi et al., 2018).
Goodfellow et al.
(2014) introduced FGSM.
Kurakin et al.
(2016) proposed an iterative method where FGSM is used for smaller step sizes, which leads to a better approximation of the gradient.
Papernot et al.
(2017) observed that adversarial examples could be transferred to other models as well.
Madry et al.
(2017) introduce adding random noise to the image and then using the
FGSM method to come up with adversarial examples.
Being robust against adversarial examples has primarily focused on training on the adversarial examples.
Goodfellow et al.
(2014) use FGSM to inject adversarial examples into their training dataset.
Madry et al.
(2017) use an iterative FGSM approach to create adversarial examples to train on.
Madry et al.
(2017) introduced an ensemble adversarial training method of training on the adversarial examples created on the model itself and an ensemble of other pre-trained models.
These works have been successful, achieving only a small drop in accuracy form the clean and adversarially generated data.
Nayebi & Ganguli (2017) proposes a method to produce a smooth input-output mapping by using saturating activation functions and causing the activations to become saturated.
C ONCLUSION
We introduced SAP , demonstrating that it confers signiﬁcant improvements in the robustness of pre-trained models against adversarial examples.
The approach guards networks without requiring any additional training.
In the image classiﬁcation domain, we showed that in the adversarial setting, applying SAP improves both the accuracy of the model and its calibration, achieving close to linear calibration for small perturbations and outperforming other models.
Applying SAP is enough to be robust against small perturbation values.
For larger perturbations, even SAP models suffer, but they compare favorably to their dense counterparts.
Notably, SAP can be combined with adversarial training, compounding the respective beneﬁts of each approach.
Even in the domain of reinforcement learning, SAP is able to defend against adversarial examples better than the original model
A R EINFORCEMENT LEARNING MODEL ARCHITECTURE
For the experiments in section 4.2, we trained the network with RMSProp, minibatches of size 32 , a learning rate of 0 . 00025 , and a momentum of 0 .
95 and as in (Mnih et al., 2015) where the discount factor is γ = 0 .
99 , the number of steps between target updates to 10000 steps.
We updated the network every 4 steps by randomly sampling a minibatch of size 32 samples from the replay buffer and trained the agents for a total of 100 M steps per game.
The experience replay contains the 1 M most recent transitions.
For training we used an ε -greedy policy with ε annealed linearly from 1 to 0 .
1 over the ﬁrst 1 M time steps and ﬁxed at 0 .
1 thereafter.
The input to the network is 4 × 84 × 84 tensor with a rescaled, gray-scale version of the last four observations.
The ﬁrst convolution layer has 32 ﬁlters of size 8 with a stride of 4 .
The second convolution layer has 64 ﬁlters of size 4 with stride 2 .
The last convolution layer has 64 ﬁlters of size 3 followed by two fully connected layers with size 512 and the ﬁnal fully connected layer Q-value of each action where ReLU rectiﬁer is deployed for the nonlinearity at each layer.
B O THER METHODS ON CIFAR -
We tried a variety of different methods that could be added to pretrained models and tested their performance against adversarial examples.
The following is a continuation of section 4.1, where we use the dense model again on the CIFAR- 10 dataset.
B. R ANDOM NOISY WEIGHTS ( RNW )
One simple way of introducing stochasticity to the activations is by adding random Gaussian noise to each weight, with mean 0 and constant standard deviation, s .
So each weight tensor W i now changes to M ( W i ) , where the j ’th entry is given by
[Equation]
These models behave very similar to the dense model (Fig.
5a, the legend indicates the value of s ).
While we test several different values of s , we do not observe any signiﬁcant improvements regarding robustness against adversarial examples.
As s increased, the accuracy for non-zero λ decreased.
B. R ANDOMLY SCALED WEIGHTS ( RSW )
Instead of using additive noise, we also try multiplicative noise.
The scale factor can be picked from a Gaussian distribution, with mean 1 and constant standard deviation s .
So each weight tensor W i now changes to M ( W i ) , where the j ’th entry is given by
[Equation]
These models perform similar to the dense model, but again, no robustness is offered against adversarial examples.
They follow a similar trend as the RNW models (Figure 5b, the legend indicates the value of s ).
B. D ETERMINISTIC WEIGHT PRUNING ( DWP )
Following from the motivation of preventing perturbations to propagate forward in the network, we tested deterministic weight pruning, where the top k % entries of a weight matrix were kept, while the rest were pruned to 0 , according to their absolute values.
This method was prompted by the success achieved by this pruning method, introduced by Han et al.
(2015), where they also ﬁne-tuned the model.
For low levels of pruning, these models do very similar to the dense model, even against adversarial examples (Fig. 5c, the legend indicates the value of k ).
The adversary can compute the gradient of the sparse model, and the perturbations propagate forward through the surviving weights.
For higher levels of sparsity, the accuracy in the no-perturbation case drops down quickly.
B. S TOCHASTIC WEIGHT PRUNING ( SWP )
Observing the failure of deterministic weight pruning, we tested a mix of stochasticity and pruning, the stochastic weight pruning method.
Very similar to the idea of SAP , we consider all the entries of a weight tensor to be a multinomial distribution, and we sample from it with replacement.
For a weight tensor W i ∈ R a i , we sample from it r
i times with replacement.
The probability of sampling ( W i )
j is given by
[Equation]
The new weight entry, M ( W i ) j , is given by
[Equation]
where I ( W ij ) is the indicator function that returns 1 if W ij was sampled at least once, and
0 otherwise.
For these experiments, for each weight matrix W i ∈
R m i , the number of samples picked were k % of m i .
Since samples were picked with replacement, k could be more than 100 .
We will refer to k as the percentage of samples drawn.
These models behave very similar to the dense model.
We tried drawing range of percentages of samples, but no evident robustness could be seen against adversarial examples (Figure 5d, the legend indicates the value of k ).
For a small s , it is very similar to the dense model.
As s increases, the these models do marginally better for low non-zero λ values, and then drops again (similar to the SAP case).
B. R ANDOM NOISY ACTIVATIONS ( RNA )
Next we change our attention to the activation maps in the dense model.
One simple way of introducing stochasticity to the activations is by adding random Gaussian noise to each activation entry, with mean 0 and constant standard deviation, s .
So each activation map h i now changes to
M ( h i ) , where the j ’th entry is given by
[Equation]
0 , s 2 ) .
These models too do not offer any robustness against adversarial examples.
Their accuracy drops quickly with λ and s (Fig.
5e, the legend indicates the value of s ).
B. R ANDOMLY SCALED ACTIVATIONS ( RSA )
Instead of having additive noise, we can also make the model stochastic by scaling the activations.
The scale factor can be picked from a Gaussian distribution, with mean 1 and constant standard deviation s .
So each activation map h i now changes to M ( h i ) , where the j ’th entry is given by
[Equation]
These models perform similar to the dense model, exhibiting no additional robustness against adversarial examples (Figure 5f, the legend indicates the value of s ).