Heterogeneous Architecture Search Approach within Adversarial Dynamic Defense Framework
Abstract
Recent advances in adversarial attacks uncover the intrinsic vulnerability of modern deep neural networks (DNNs).
To address this issue, various methods have been proposed to design network architectures that are robust to one particular type of adversarial attack.
Recent research leverages the con- cept of dynamic defense framework (DDF) based on stochastic ensemble model for boosting the robustness of a DNN en-
semble against such adversarial attacks.
There is a need to enhance the diversity and gradient variations of the ensemble but stuck with the lack of efﬁcient networks.
In this paper, we propose a heterogeneous architecture searching method based on NAS.
Our method encourages heterogeneous networks, such that networks further improve diversity for ensemble, and thus, boost the adversarial robustness of DDF.
Experimental results suggest that the diversity existing among the family of heterogeneous networks does restrain the transferability of the adversarial sample, and achieve superior per- formance when evaluating the robustness on the ASR-vsdistortion benchmark in different attack environments.
Introduction
Deep neural network shows excellent performance in the application on standard classiﬁcation tasks.
Nevertheless, (Szegedy et al. 2013) proposed that even minor disturbances can mistakenly lead to the wrong prediction of state-of-theart (SOTA) classiﬁers.
With the sustainable development of adversarial attack, the defenders have proposed many strategies to enhance effect against the treat, most notably adversarial training (Goodfellow, Shlens, and Szegedy 2014;
Madry et al. 2017).
Adversarial training minimizes the loss of a DNN model on online-generated adversarial examples against the sample itself at each training step.
However, adversarial training leads to the degenerative generalization ability of DNN (Bai et al. 2021).
Thus, adversarially trained models can be conquered easily by newer or different types of attacks (Kang et al. 2019).
Such terrible generalization to other attacks prominently degrades the reliability of adversarial training.
Adversarial training, which are robust to a speciﬁc attack, are particularly passive in the arm race.
On the contrary, model ensemble is an effective defense strategy in practice to construct an ensemble of individual models (Kurakin et al. 2018).
Researchers build upon the dynamic defense framework (DDF) based on the stochastic model ensemble method (Qin et al. 2021).
The DDF method employs network architecture and smoothing parameters as ensemble attributes, and dynamically change attribute-based ensemble model before every inference prediction request.
To ensure an extensive range of gradient directions and meet the diverse needs of the stochastic ensemble, each model in the ensemble needs to have widely varied gradient information.
Other studies also pointed out the crucial role of this diversity in ensemble defense methods (Pang et al. 2019) and proposed methods (D’Angelo and Fortuin 2021; Wang et al.
to maintain diversity among the members and transform the maximum a posteriori inference into proper
Bayesian inference.
Neural architecture search (NAS) (Baker et al. 2016;
Zoph and Le 2016) affords the opportunity to discover diversiﬁed networks to produce an improved ensemble result.
As the goal of NAS is to ﬁnd various network architectures, the searched networks can replace the design implemented by human experts.
In this paper, we use NAS method to discover a family of heterogeneous networks, which improve the diversity needed for dynamic defense framework to achieve better performance on ensemble robustness.
Through this method, we discover heterogeneous networks that introduce model size and quantity as variable attributes for diversity, which achieves unpredictable gradient of ensemble.
The unpredictability of gradient makes it impossible for attackers to directly implement white-box attacks, and the inefﬁcient universality of the adversarial samples make the attacker helpless.
Method Dynamic defense framework
To begin with, we need to understand the concept of dynamic defense framework to capture the following idea of problem-solving.
The dynamic defense framework combines heterogeneous redundant model collection and stochastic ensemble strategy.
Heterogeneous redundant model collection.
According to the moving target defense (MTD) method (Jajodia et al.
, the basic requirements of the robust-control model are randomness, diversity, and dynamics.
As we can see, the heterogeneous redundant model collection is a good demonstration of dynamic defense framework.
The heterogeneity of the model structure leads to a large range of gradient directions for the ensemble.
Furthermore, the redundancy of the model library not only performs well in classiﬁcation but also makes the model structure diverse.
Stochastic ensemble method.
The stochastic ensemble method(SEM) randomness is reﬂected in the randomization of the model attributes θ .
The ensemble model f ens containing K numbers of models is deﬁned as follows:
[Equation]
Speciﬁcally, when the SEM is queried multiple times for gradient or output information, the ensemble is achieved through an utterly stochastic choice of the ensemble attributes θ in each query, which can effectively shield model gradient.
Before each rational prediction request, the adversarial samples generated by the white-box attack will be confused by the ensemble model based on the dynamic defense of variable attributes—the attack results in different update directions of gradients.
In short, dynamic defense framework is instrumental in confusing the attacker’s strategy.
It is achieved by randomly selecting ensemble attributes and reﬂecting the unconﬁrmed probabilistic gradient information during each iteration of the ensemble.
Searching heterogeneous model based on NAS
The research of DDF generates diversity by the designed networks, which is still preliminary work.
Broader diversity is needed, we have been explored a wider range of model diversity to make it more relevant.
Deﬁne proper search space .
For our complex task, we employ the cell-based search spaces to remains a solid searching capability while reducing the burden of computation.
Cell-based NAS aims to search for cells as the fundamental part of the whole architecture(Bender et al. 2018).
The architecture of each cell is an association of operations chosen from a predeﬁned operation space.
We have reduced the number of candidate operations to 3*3 separable convolution, identity, and zero, which can still maintain the diversity and possibility of solid search space (Xie et al. 2019).
It still maintains 4 14 − 1 ≈ 10 8 viable cells.
Moreover, the diverse hyperparameters of the network architecture plays crucial role in the searching progress.
Hyperparameters, like connection method, the number of convolutional layer and channels used for feature extraction, deﬁne which network architectures can be searched by the NAS.
Such a scale of search space can improve the dynamic property of the ensemble.
It effectively expands the diversity of the model collection.
Set diversity metrics of ensemble .
We choose diverse hyperparameters of the network architecture and quantity of ensemble networks as variable attributes of DDF.
These hyperparameters plays crucial role in the searching progress.
For example, architectural template, the number of convolutional layer and channels used for feature extraction, separate searched networks by NAS to disparate architectures.
Specially, we set connection mode as a variate of ensemble.
For cell-based settings, the possibilities we can choose from the convolution operations is 14.
As the dense connection mode beneﬁts the robustness of the network(Guo et al.
, we choose two types of connections.
On one hand, we limit the number of connections greater than 11 to maintain the robustness of network, part of the free-connection models show in Table1.
On the other hand, we release the cell-based constraint to further improve the diversity of the model, we put some of the dense-connection models in Table2.
[Table] [Table]
[Table]
[Table] [Table] [Table] [Table]
[Table]
Combine heterogeneity and robustness.
We implement the idea about searching for heterogeneous and robust architectures simultaneously in NAS search process without changing the weights of networks.
According to (Guo et al. 2020; Tang et al. 2021), network architecture, especially model size and families, has a signiﬁcant impact on model robustness.
Our proposed method applies generated adversarial sample of each sub-network by PGD attack (Madry et al.
to evaluate the sub-network itself during
NAS searching progress.
The problem of defending against bounded adversarial perturbations can be formulated as fol-
[Equation]
Where S = (cid:107) x − x (cid:48) (cid:107) p < ε , which deﬁnes the set of permissible disturbance inputs within the L p distance, where
M denotes the candidate network and D represents the data.
In our study, we mainly use PGD adversarial samples within the L 2 norm to obtain robust networks with different architectures.
Selecting variable attributes Dynamically for robust ensemble
For model ensemble, the gradient change is determined by the variation of dynamic attributes and gradient of each model.
We ultimately select four properties of the model as variable attributes, which are the number of models, the depth of models, the width of models, and the density of connections.
In each prediction, we randomly choose variable attributes when predicts output information multiple times.
As we contain the model diversity into the ensemble attributes, each iteration of the ensemble causes transformation for the direction of gradient.
Our experiments show that the randomness has a speciﬁc effect to confuse the attackers.
And the heterogeneous models further improves the robustness performance and solves the vulnerability of the ensemble under attack.
We provide the pseudo code of our heterogeneous architecture search algorithm for DDF as Algorithm 1.
end for 9: for j=0...
J do 10:
Randomly select the number of ensemble models N .
Perform ensemble and inference prediction.
12: end for
Experiment and Results
In this section, we evaluate our proposed method for its adversarial robustness by ASR-vs-distortion curve (Dong et al.
Unlike the traditional point estimation method, ASRvs-distortion curve is different from the validation of the robust radius, but the experiment of evaluating the robustness of the actual attack environment.
Experimental setup
In this subsection, we would demonstrate implementation details of our experiments.
As described in Sec. 2, we choose the number of models, the depth of models, the width of models, and the density of connections as the variable attributes of ensemble.
The evaluation is only on CIFAR-10.
We can ﬁnd the minimum perturbations of attacks by counting the number of the adversarial examples.
Not just single perturbation, but we calculate the accuracy or attack success rate for all possible values of ε , which represent the perturbation budget.
Then we perform a binary search on ε to ﬁnd its accurate minimum value that enables the generated adversarial example to fulﬁll the adversary’s goal.
We’ll show the accuracy (attack success rate) vs. perturbation budget curve, which can reveal a global understanding of the robustness of a classiﬁer.
To assess full-scale robustness, we set the search step to 10, and binary search step to 20 with
L 2 norm adversarial attacks.
In this paper, the DNN model under attack is used as the baseline model A for contrast.
Model B presents DNN models within DDF, model C presents SOTA architecture method Robnet(Guo
et al.
concerning the impact of architecture to robustness, model D presents single NAS model, E presents NAS models within DDF that ensemble the same quantity of sub-models as B. Specially, F presents the same model with E, but we sample the results of 10 disparate models on all distortion value under evaluation.
These sampled models cope with adversarial samples generated by diverse ensemble model.
Through observation for the attack success rate, we can have a explicit judgement whether the ensemble model could cutoff transferability of adversarial samples.
In order to control the potential empirical model risk, the abstention threshold α is set to 0.3 for bounding the acceptable probability of returning an incorrect prediction.
Robustness analysis
The result on ensemble models can be observed with PGD attack, which is commonly employed for evaluation because of its attack effectiveness in white-box settings.
Adversarial examples are crafted by untargeted method.
As shown in Figure 1, the ensemble model of the DNN is extremely vulnerable under white-box attacks, against which the attack success rate is higher when the perturbation stays low.
For the DNN ensemble method B and NAS ensemble method E, F, we can see NAS ensemble model,with the same quantity of sub-models, outperforms each case of the other methods with higher demand of perturbation budget.
On the observation of C and F, attacker overcome Robnet under lower perturbation values.
Heterogeneous architecture search method improves the robust performance of ensemble model by enhancing the diversity of sub-models, and solves the vulnerability of ensemble under white-box attacks.
Compare the performance of D with F, the DDF does improve the randomness of the gradient, which has a certain effect on the confusion of the gradient direction.
Transferability analysis
In this sub-section, we show that our method can ease the transferability of adversarial examples for the ensemble.
As
[Figure] [Figure]
NAS shown in Figure 1, F has a better robust performances than E, this reveals that adversarial sample crafted by one of our heterogeneous models have poor performance on the rest models.
In addition,for another transferability evaluation, we use random network as the substitute model to craft adversarial examples and feed to another two networks as the original model.
We apply PGD as the attack method, which are the most commonly used attacks in the black-box setting (Kurakin et al. 2018).
The perturbation parameters for both attacks are set to be 20/255.
We test untargeted mode and targeted mode.
The evaluation standard is different for two modes.
We take the classiﬁcation accuracy of the models on adversarial examples for untargeted mode, and success rate of fooling the models to predict speciﬁc target label for targeted mode.
The Figure 2 presents the pair-wise transferability with three models of NAS method and DNNs.
the adversarial samples effect on the model crafting them, but the disparate model can greatly hinder the transferability among heterogeneous models in both modes.
This phenomenon demonstrates the heterogeneity of our model library, which can further enhance ensemble robustness.
Conclusion
This study set out to improve the heterogeneity and diversity of dynamic defense framework generalized by DNNs.
In this paper, we take advantage of the diversity of network structures discovered by NAS, due to the complexity of ample search space and the maneuverability, which drives a heterogeneous model library.
Experimental results show that the diversity of searched models does enhance the performance of ensemble model and prevent the transferability of adversarial samples under different attack environments.
To further improve the robustness of dynamic defense framework and effectively prevent the transfer of adversarial sample on different models, the evaluation process of NAS needs a better expression of model diversity.