This paper presents a dynamic network rewiring (DNR) method to generate pruned deep neural network (DNN) models that are robust against adversarial attacks yet maintain high accuracy on clean images. In particular, the disclosed DNR method is based on a unified constrained optimization formulation using a hybrid loss function that merges ultra-high model compression with robust adversarial training. This training strategy dynamically adjusts inter-layer connectivity based on per-layer normalized momentum computed from the hybrid loss function. In contrast to existing robust pruning frameworks that require multiple training iterations, the proposed learning strategy achieves an overall target pruning ratio with only a single training iteration and can be tuned to support both irregular and structured channel pruning. To evaluate the merits of DNR, experiments were performed with two widely accepted models, namely VGG16 and ResNet-18, on CIFAR-10, CIFAR-100 as well as with VGG16 on Tiny-ImageNet. Compared to the baseline uncompressed models, DNR provides over20x compression on all the datasets with no significant drop in either clean or adversarial classification accuracy. Moreover, our experiments show that DNR consistently finds compressed models with better clean and adversarial image classification performance than what is achievable through state-of-the-art alternatives.READ FULL TEXT VIEW PDF
In safety-critical but computationally resource-constrained applications...
It is well known that deep neural networks (DNNs) are vulnerable to
A typical deep neural network (DNN) has a large number of trainable
Neural network quantization and pruning are two techniques commonly used...
Dropout is a well-known regularization method by sampling a sub-network ...
Modern deep neural networks (DNNs) become frail when the datasets contai...
Deep Neural Network (DNN) is powerful but computationally expensive and
In recent years, deep neural networks (DNNs) have emerged as critical components in various applications, including image classification , speech recognition , medical image analysis  and autonomous driving adversarial examples
, i.e., maliciously generated images which are perceptually similar to clean ones with the ability to fool classifier models into making wrong predictions[2, 8]. Various recent work have proposed associated defense mechanisms including adversarial training , hiding gradients , adding noise to the weights , and several others .
Meanwhile, large model sizes have high inference latency, computation, and storage costs that represent significant challenges in deployment on IoT devices. Thus reduced-size models [19, 7] and model compression techniques e.g., pruning [4, 5, 12], have gained significant traction. In particular, earlier work showed that without a significant accuracy drop, pruning can remove more than of the model parameters [4, 5] and that ensuring the pruned models have structure can yield observed performance improvements on a broad range of compute platforms . However, adversarial training that increases network robustness generally demands more non-zero parameters than needed for only clean data  as illustrated in Fig. 1(a). Thus a naively compressed model performing well on clean images, can become vulnerable to adversarial images. Unfortunately, despite a plethora of work on compressed model performance on clean data, there have been only a few studies on the robustness of compressed models under adversarial attacks.
In particular, some prior works [32, 9] have tried to design a compressed yet robust model through a unified constrained optimization formulation by using the alternating direction method of multipliers (ADMM) in which dynamic regularization is the key to outperforming state of the art pruning techniques . However, in ADMM the network designer needs to specify layer-wise sparsity ratios, which requires prior knowledge of an effective compressed model. This knowledge may not be available and thus training may require multiple iterations to determine good layer-sparsity ratios. Another related research  has aimed to use pre-trained weights to perform robust pruning and has demonstrated the benefits of fine-tuning after training in terms of increased performances. In other schemes like Lasso , a target compression ratio cannot be set because the final compression ratio is not determined until training is completed. Moreover, Lasso requires separate re-training to increase the accuracy after the assignment of non-significant weights to zero, resulting in costly training.
In contrast, this paper presents dynamic network rewiring (DNR), a unified training framework to find a compressed model with increased robustness that does not require individual per-layer target sparsity ratios. In particular, we introduce a hybrid loss function for robust compression which has three major components: a clean image classification loss, a dynamic -regularizer term inspired by a relaxed version of ADMM , and an adversarial training loss. Inspired by sparse-learning-based training scheme of 
, we then propose a single-shot training framework to achieve a robust pruned DNN using the proposed loss. In particular, DNR dynamically arranges per layer pruning ratios using normalized momentum, maintaining the target pruning every epoch, without requiring any fine tuning.In summery, our key contributions are:
Given only a global pruning ratio, we propose a single-shot (non-iterative) training framework that simultaneously achieves ultra-high compression ratio, state-of-the-art accuracy on clean data, and robustness to perturbed images.
We extend the approach to support structured pruning technique, namely channel pruning, enabling benefits on a broader class of compute platforms. As opposed to conventional sparse-learning  that can perform only irregular pruning, models generated through structured DNR can significantly speed up inference. To the best of our knowledge, we are the first to propose a non-iterative robust training framework that supports both irregular and channel pruning.
We provide a comprehensive investigation of adversarial robustness for both channel and irregular pruning, and obtain insightful observations through evaluation on an extensive set of experiments on CIFAR-10 , CIFAR-100 , and Tiny-ImageNet  using variants of ResNet18  and VGG16 . Our proposed method consistently outperforms state-of-the-art (SOTA) [26, 32] approaches with negligible accuracy drop compared to the unpruned baselines.
We further empirically demonstrate the superiority of our scheme when used to target model compression on clean-only image classification task compared to SOTA non-iterative pruning mechanisms [4, 5, 12, 20].111This paper targets low-cost training, thus comparisons to iterative pruning methods (e.g., ) are out of scope.
Recently, various adversarial attacks have been proposed to find fake images, i,e., adversarial examples, which have barely-visible perturbations from real images but still manage to fool a trained DNN. One of the most common attacks is the fast gradient sign method (FGSM) 
. Given a vectorized inputx of the real image and corresponding label t, FGSM perturbs each element x in x along the sign of the associated element of the gradient of the inference loss w.r.t. x as shown in Eq. 1 and illustrated in Fig. 1(b). Another common attack is the projected gradient descent (PGD) . The PGD attack is a multi-step variant of FGSM where and the iterative update of the perturbed data in step is given in Eq. 2.
Here, the scalar corresponds to the perturbation constraint that determines the severity of the perturbation. generates the output of the DNN, parameterized by . Here, Proj projects the updated adversarial sample onto the projection space which is the - neighbourhood of the benign sample 222It is noteworthy that the generated are clipped to a valid range which for our experiments is . x. is the attack step size.
Note that these two strategies assume the attacker knows the details of the DNN and are thus termed as white-box attacks. We will evaluate the merit of our training scheme by measuring the robustness of our trained models to the fake images generated by these attacks. We argue that this evaluation is more comprehensive than using images generated by attacks that assume limited knowledge of the DNN . Moreover, we note that PGD is one of the strongest adversarial example generation algorithms  and use it as part of our proposed framework.
ADMM is a powerful optimization method used to solve problems with non-convex, combinatorial constraints 
. It decomposes the original optimization problem into two sub-problems and solves the sub-problems iteratively until convergence. Pruning convolutional neural networks (CNNs) can be modeled as an optimization problem where the cardinality of each layer’s weight tensor is bounded by its pre-specified pruning ratio. In the ADMM framework, such constraints are transformed to ones represented with indicator functions, such asfor and otherwise. Here, denotes the duplicate variable  and represents the target number of non-zero weights determined by pre-specified pruning ratios. Next, the original optimization problem is reformulated as:
. The first sub-problem uses stochastic gradient descent (SGD) to updatewhile the second sub-problem applies projection to find the assignment of that is closest to yet satisfies the cardinality constraint, effectively pruning weights with small magnitudes.
Not only can ADMM prune a model’s weight tensors but it also has as a dynamic regularizer. Such adaptive regularization is one of the main reasons behind the success of its use in pruning. However, ADMM-based pruning has several drawbacks. First, ADMM requires prior knowledge of the per-layer pruning ratios. Second, ADMM does not guarantee the pruning ratio will be met, and therefore, an additional round of hard pruning is required after ADMM completes. Third, not all problems solved with ADMM are guaranteed to converge. Fourth, to improve the convergence, needs to be progressively increased across several rounds of training, which increases training time .
Sparse learning  addresses the shortcomings of ADMM by leveraging exponentially smoothed gradients (momentum) to prune weights. It redistributes pruned weights across layers according to their mean momentum contribution. The weights that will be removed and transferred to other layers are chosen according to their magnitudes while the weights that are brought back (reactivated) are selected based on their momentum values. On the other hand, a major shortcoming of sparse learning compared to ADMM is that it does not benefit from a dynamic regularizer and thus often yields lower levels of accuracy. Furthermore, existing sparse-learning schemes only support irregular forms of pruning, limiting speed-up on many compute platforms. Finally, sparse-learning, to the best of our knowledge, has not previously been extended to robust model compression.
To tackle the shortcomings of ADMM and sparse-learning this section introduces a dynamic regularizer that enables non-iterative training to achieve high accuracy with compressed models. We then describe a hybrid loss function to provide robustness to the compressed models and an extension to support structured pruning.
For a DNN parameterized by with layers, we let represent the weight tensor of layer . In our sparse-learning approach, these weight tensors are element-wise multiplied () by corresponding binary mask tensors () to retain only a fraction of non-zero weights, thereby meeting a target pruning ratio. We update each layer mask in every epoch similar to . The number of non-zeros is updated based on the layer’s normalized momentum and the specific non-zero entries are set to favor large magnitude weights. We incorporate an ADMM dynamic regularizer  into this framework by introducing duplicate variable for the non-zero weights, which is in turn updated at the start of every epoch. Unlike , we only penalize differences between the masked weights () of a layer and their corresponding duplicate variable . Because the total cardinality constraint of the masked parameters is satisfied, i.e. , the indicator penalty factor is redundant and the loss function may be simplified as
where, is the dynamic penalizing factor. This simplification is particularly important because the indicator function used in Eq. 3 is non-differentiable and its removal in Eq. 4 enables the loss function to be minimized without decomposition into two sub-problems.333Note this simplified loss function also drops the term because is updated with at the beginning of each epoch, forcing the Lagrangian multiplier and its contribution to the loss function to be always 0. Moreover, SGD with this loss function converges similarly to the SGD with and more reliably than ADMM. Intuitively, the key role of the dynamic regularizer in this simplified loss function is to encourage the DNN to not change values of the weights that have large magnitude unless the corresponding loss is large, similar to what the dynamic regularizer does in ADMM-based pruning.
For a given input image x, adversarial training can be viewed as a min-max optimization problem that finds the model parameters that minimize the loss associated with the corresponding adversarial sample , as shown below:
In our framework, we use SGD for loss minimization and PGD to generate adversarial images. More specifically, to boost classification robustness on perturbed data we propose using a hybrid loss function that combines the proposed simplified loss function in Eq. 4 with adversarial image loss, i.e.,
provides a tunable trade-off between the two loss components.
Observation 1 A DNN only having a fraction of weights active throughout the training can be trained with the proposed hybrid loss to finally converge similar to that of the un-pruned model (mask ) to provide a robust yet compressed model.
This is exemplified in Fig. 2(a) which shows similar convergence trends for both pruned and unpruned models, simultaneously achieving both the target compression and robustness while also mitigating the requirement of multiple training iterations.
Let the weight tensor of a convolutional layer be denoted as , where and are the height and width of the convolutional kernel, and and represent the number of filters and channels per filter, respectively. We convert this tensor to a 2D weight matrix, with and being the number of rows and columns, respectively. We then partition this matrix into sub-matrices of rows and columns, one for each channel. To compute the importance of a channel , we find the Frobenius norm (F-norm) of corresponding sub-matrix, thus effectively compute = . Based on the fraction of non-zero weights that need to be rewired during an epoch , denoted by the pruning rate , we compute the number of channels that must be pruned from each layer, , and prune the channels with the lowest F-norms. We then compute each layer’s importance based on the normalized momentum contributed by its non-zero channels. These importance measures are used to determine the number of zero-F-norm channels that should be re-grown for each layer . More precisely, we re-grow the zero-F-norm channels with the highest Frobenius norms of their momentum. We note that this approach can easily be extended to enable various other forms of structured pruning. Moreover, despite supporting pruning of both convolution and linear layers, this paper focuses on reducing the computational complexity of a DNN. We thus experiment with pruning only convolutional layers because they dominate the computational complexity . The detailed pseudo-code of the proposed training framework is shown in Algorithm 1.
It is noteworthy that DNR’s ability to arrange per-layer pruning ratio for robust compression successfully avoids the tedious task of hand-tuning the pruning-ratio based on layer sensitivity. To illustrate this, we follow  to quantify the sensitivity of a layer by measuring the percentage reduction in classification accuracy on both clean and adversarial images caused by pruning that layer by without pruning other layers.
Observation 2 DNN layers’ sensitivity towards clean and perturbed images are not necessarily equal, thus determining layer pruning ratios for robust models is particularly challenging.
As exemplified in Fig. 2(b), for = there is significant difference in the sensitivity of the layers for clean and perturbed image classification. DNR, on the contrary, automatically finds per-layer pruning ratios (overlaid as pruning sensitivity as in ) that serves well for both types of image classification targeting a global pruning of .
Here, we first describe the experimental setup we used to evaluate the effectiveness of the proposed robust training scheme. We then compare our method against other state-of-the-art robust pruning techniques based on ADMM  and lasso . We also evaluate the merit of DNR as a clean-image pruning scheme and show that it consistently outperforms contemporary non-iterative model pruning techniques [20, 4, 5, 12]
. We finally present an ablation study to empirically evaluate the importance of the dynamic regularizer in the DNR’s loss function. We used Pytorch to write the models and trained/tested on AWS P3.2x large instances with an NVIDIA Tesla V100 GPU.
We selected three widely used datasets, CIFAR-10  CIFAR-100  and Tiny-ImageNet  and picked two well known CNN models, VGG16  and ResNet18 . Both CIFAR-10 and CIFAR-100 datasets have 50K training samples and 10K test samples with an input image size of . Training and test data size for Tiny-ImageNet are 100k and 10k, respectively where each image size is of
. For all the datasets we used standard data augmentations (horizontal flip and random crop with reflective padding) to train the models with a batch size of 128.
For PGD, we set to , the attack step size , and the number of attack iterations to , the same values as in . For FGSM, we choose the same value as above.
We performed DNR based training for 200/170/60 epochs for CIFAR-10/CIFAR-100/Tiny-ImageNet, with a starting learning rate of , momentum value of , and weight decay value of . For CIFAR-10 and CIFAR-100 the learning rate (LR) was reduced by a factor of after , , and epochs. For Tiny-ImageNet we reduced the LR value after and epochs. In addition, we hand-tuned to and set the pruning rate . We linearly decreased the pruning rate every epoch by . Finally, to balance between the clean and adversarial loss, we set to . Lastly, note that we performed warm-up sparse learning  for the first 5 epochs with only the clean image loss function before using the hybrid loss function with dynamic regularization (see Eq. 6) for robust compression for the remaining epochs.
Results on CIFAR datasets: We analyzed the impact of our robust training framework on both clean and adversarially generated images with various target compression ratios in the range , where model compression is computed as the ratio of total weights of the model to the non-zero weights in the pruned model. As shown in Figs. 3(a-b) DNR can effectively find a robust model with high compression and negligible compromise in accuracy. In particular, for irregular pruning our method can compress up to with negligible drop in accuracy on clean as well as PGD and FGSM based perturbed images, compared to the baseline non-pruned models, tested with VGG16 on CIFAR-10 and ResNet18 on CIFAR-100.444A similar trend is observed for VGG16 on CIFAR-100 and ResNet18 on CIFAR-10. These are not included in the paper due to space limitations.
Observation 3 As the target compression ratio increases, channel pruning degrades adversarial robustness more significantly than irregular pruning.
As we can see in Fig. 3(a-b), the achievable model compression with negligible accuracy loss for structured (channel) pruned models is lower than that achievable through irregular pruning. This trend matches with that of the model’s performance on clean image. However, as we can see in Fig. 3(c), the percentage of channels present in our channel-pruned models can be up to lower than its irregular counterparts, implying a similarly large speedup in inference time on a large range of compute platforms .
Results on Tiny-ImageNet: As shown in Table 1, DNR can compress the model up to without any compromise in performance for both clean and perturbed image classification.
It is also noteworthy that all our accuracy results for both clean and adversarial images correspond to models that provide the best test accuracy on clean images. This is because robustness gains are typically more relevant on models in which the performance on clean images is least affected.
|Pruning||Compression||% Channel||Accuracy (%)|
Here, were compare the performance of DNR with ADMM  and lasso based  robust pruning. For ADMM based robust pruning we followed a three stage compression technique namely pre-training, ADMM based pruning, and masked retraining, performing pruning for 30 epochs with as described in . lasso based pruning adds a regularizer to its loss function to penalize the weight magnitudes, where the regularizer coefficient determines the penalty factor. Table 2 shows that our proposed method outperforms both ADMM and Lasso based approaches by a considerable margin, retaining advantages of both worlds 555Romanized numbers in the table are results of our experiments, and italicized values are directly taken from the respective original papers.. In particular, compared to ADMM, with VGG16 (ResNet18) model on CIFAR-10, DNR provides up to () increased classification accuracy on perturbed images with () higher compression. Compared to Lasso, we achieve () higher compression and up to (), and () increased accuracy on perturbed and clean images, respectively, for VGG16 (ResNet18) on CIFAR-10 classification.
Observation 4 Naively tuned per-layer pruning ratio degrades both robustness and clean-image classification performance of a model.
For this, we evaluated robust compression using naive ADMM, i.e. using naively tuned per-layer pruning-ratio (all but the 1st layer for a total sparsity). As shown in Table 2, this clearly degrades the performance, implying layer-sparsity tuning is necessary for ADMM to perform well.
|No pre-||Per-layer||Target||Pruning||Compre-||Accuracy (%)|
To evaluate the merit of DNR as a clean-image only pruning scheme (DNR-C), we trained using DNR with the same loss function minus the adversarial loss term (by setting in Eq. 6) to reach a target pruning ratio. Table 3 shows that our approach consistently outperforms other state-of-the-art non-iterative pruning approaches based on momentum information [5, 4]
, reinforcement-learning driven auto-compression (AMC), and connection-sensitivity ††footnotemark: . The value in the seventh column represents the error difference from corresponding non-pruned baseline models. We also present performance on CIFAR-100 for VGG16 and ResNet18 and Tiny-ImageNet for VGG16.666To have an ”apple to apple” comparison we provide results on ResNet50 model for classification on CIFAR-10. All other simulations are done on only the ResNet18 variant of ResNet. In particular, we can achieve up to () compression on CIFAR-10 dataset with irregular (channel) pruning maintaining accuracy similar to the baseline. On CIFAR-100 compression of up to () yields no significant accuracy drop (less than in top-1 accuracy) with irregular (channel) pruning. Moreover, our evaluation shows a possible practical speed up of up to for CIFAR-10 and for CIFAR-100 can be achieved through channel pruning using DNR-C. For Tiny-ImageNet, DNR-C can provide compression and speed-up of up to and , respectively with negligible accuracy drop.
|Accuracy (%) with||Accuracy (%) with|
|Model||Method: DNR||irregular pruning||channel pruning|
To understand the performance of the proposed hybrid loss function with a dynamic regularizer, we performed ablation with both VGG16 and ResNet18 on CIFAR-10 for a target parameter density of and using irregular and channel pruning, respectively. As shown in Table 4, using the dynamic regularizer improves the adversarial classification accuracy by up to for VGG16 and for ResNet18 with similar clean-image classification performance.
Fig. 4 presents the performance of the pruned models as a function of the PGD attack iteration and the attack bound . In particular, we can see that, for both irregular and channel pruned models, the accuracy degrades with higher number of attack iterations. When increases, the accuracy drop is similar in both the pruning schemes. These trends suggest that our robustness is not achieved via gradient obfuscation .
This paper addresses the open problem of achieving ultra-high compression of DNN models while maintaining their robustness through a non-iterative training approach. In particular, the proposed DNR method leverages a novel sparse-learning strategy with a hybrid loss function that has a dynamic regularizer to achieve better trade-offs between accuracy, model size, and robustness. Furthermore, our extension to support channel pruning shows that compressed models produced by DNR can have a practical inference speed-up of up to .
Proceedings of the IEEE International Conference on Computer Vision, pp. 2722–2730. Cited by: §1.
Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770–778. Cited by: 3rd item, §4.1.1.
Technical report, Citeseer. Cited by: 3rd item, §4.1.1.