[论文解读] Automatic Perturbation Analysis on General Computational Graphs.

Kaidi Xu, Zhouxing Shi+6 more|arXiv (Cornell University)|Feb 28, 2020

Adversarial Robustness in Machine Learning参考文献 45被引用 9

一句话总结

本文提出了一种针对通用计算图的自动扰动分析框架，支持在任意神经网络架构上进行可微分的、类似反向传播的线性边界计算。通过将CROWN等线性松弛方法推广为与PyTorch集成的基于图的算法，该框架实现了自动鲁棒性验证、认证防御，以及训练鲁棒性更强、优化景观更平坦的模型和对量化更鲁棒的模型等新应用。

ABSTRACT

Linear relaxation based perturbation analysis for neural networks, which aims to compute tight linear bounds of output neurons given a certain amount of input perturbation, has become a core component in robustness verification and certified defense. However, the majority of linear relaxation based methods only consider feed-forward ReLU networks. While several works extended them to relatively complicated networks, they often need tedious manual derivations and implementation which are arduous and error-prone. Their limited flexibility makes it difficult to handle more complicated tasks. In this paper, we take a significant leap by developing an automatic perturbation analysis algorithm to enable perturbation analysis on any neural network structure, and its computation can be done automatically in a similar manner as the back-propagation algorithm for gradient computation. The main idea is to express a network as a computational graph and then generalize linear relaxation algorithms such as CROWN as a graph algorithm. Our algorithm itself is differentiable and integrated with PyTorch, which allows to optimize network parameters to reshape bounds into desired specifications, enabling automatic robustness verification and certified defense. In particular, we demonstrate a few tasks that are not easily achievable without an automatic framework. We first perform certified robust training and robustness verification for complex natural language models which could be challenging with manual derivation and implementation. We further show that our algorithm can be used for tasks beyond certified defense - we create a neural network with a provably flat optimization landscape and study its generalization capability, and we show that this network can preserve accuracy better after aggressive weight quantization. Code is available at this https URL.

研究动机与目标

• 克服现有线性松弛方法仅限于前馈ReLU网络且需手动推导的局限性。
• 实现在任意神经网络架构上的自动、端到端扰动分析，无需繁琐的手动实现。
• 支持高级任务，如复杂模型（如自然语言模型中的Transformer）的认证鲁棒训练与鲁棒性验证。
• 将扰动分析的应用范围从认证防御扩展至优化景观设计与量化鲁棒性。
• 提供一种可微分的、与PyTorch集成的框架，支持联合优化网络参数以调控鲁棒性边界。

提出的方法

• 将神经网络表示为计算图，以系统化应用线性松弛技术。
• 将CROWN等线性松弛算法推广为可在计算节点上传播边界的图算法。
• 将扰动分析形式化为可微分过程，类似反向传播，从而支持基于梯度的网络参数优化。
• 与PyTorch集成，以支持自动微分并实现与鲁棒性目标无缝结合的训练。
• 支持对网络参数进行优化，以将边界调整为期望的规格，如更平坦的损失景观或更强的量化容忍度。
• 将该框架应用于复杂模型（包括自然语言模型），实现无需手动推导的认证鲁棒训练与验证。

实验结果

研究问题

• RQ1 能否将扰动分析自动化，应用于超越简单前馈ReLU网络的任意神经网络架构？
• RQ2 如何在通用计算图上高效且可微分地计算基于线性松弛的边界？
• RQ3 该框架能否支持复杂模型（如自然语言处理中使用的Transformer）的认证鲁棒训练与验证？
• RQ4 该框架能否用于设计具有可证明平坦优化景观的神经网络，以提升泛化性能？
• RQ5 该框架在多大程度上可增强模型在极端权重量化下的鲁棒性？

主要发现

• 所提出的框架可在任意神经网络结构上实现自动、可微分的扰动分析，消除了对手动推导的依赖。
• 该方法成功支持了复杂自然语言模型的认证鲁棒训练与验证，而这些任务在以往的手动方法下是不可行的。
• 该框架支持设计具有可证明平坦优化景观的神经网络，其泛化行为表现更优。
• 经量化后的模型在极端权重量化下仍保持更高准确率，表明其对参数压缩具有更强的鲁棒性。
• 与PyTorch的集成支持网络参数的端到端优化，以调控鲁棒性边界，从而在认证防御与模型设计方面开启新应用。