[Paper Review] MeanSparse: Post-Training Robustness Enhancement Through Mean-Centered Feature Sparsification

Sajjad Amini, Mohammadreza Teymoorianfard+2 more|arXiv (Cornell University)|Jun 9, 2024

Machine Learning and Data Classification4 citations

TL;DR

MeanSparse enhances adversarial robustness of post-trained ConvNets by sparsifying mean-centered feature activations, reducing non-robust feature variance without degrading clean accuracy. It sets new SOTA on CIFAR-10 (72.08% AutoAttack accuracy) and ImageNet-1K (59.64%), outperforming prior models with minimal inference cost.

ABSTRACT

We present a simple yet effective method to improve the robustness of both Convolutional and attention-based Neural Networks against adversarial examples by post-processing an adversarially trained model. Our technique, MeanSparse, cascades the activation functions of a trained model with novel operators that sparsify mean-centered feature vectors. This is equivalent to reducing feature variations around the mean, and we show that such reduced variations merely affect the model's utility, yet they strongly attenuate the adversarial perturbations and decrease the attacker's success rate. Our experiments show that, when applied to the top models in the RobustBench leaderboard, MeanSparse achieves a new robustness record of 75.28% (from 73.71%), 44.78% (from 42.67%) and 62.12% (from 59.56%) on CIFAR-10, CIFAR-100 and ImageNet, respectively, in terms of AutoAttack accuracy. Code is available at https://github.com/SPIN-UMass/MeanSparse

Motivation & Objective

• To improve the robustness of adversarially trained CNNs without retraining.
• To address the persistence of non-robust features in AT models despite training.
• To explore activation function design as a complementary path to adversarial robustness.
• To develop a post-training, plug-and-play method that enhances robustness with negligible accuracy cost.

Proposed method

• Introduces mean-based sparsification: applying a sparsity operator to feature maps after subtracting their mean across the training set.
• Uses a hyperparameter α to define the range around the mean where feature values are set to zero, effectively blocking high-probability, low-information variations.
• Applies the sparsification operator as a differentiable, learnable activation-like layer after each convolutional block in a trained model.
• Employs a proximal operator formulation to compute the sparsification, minimizing ℓ₀-like regularization while preserving robustness.
• Applies the method post-adversarial training, requiring no retraining or architectural changes.
• Uses channel-wise mean and standard deviation estimates from the training set to compute the sparsification threshold.

Experimental results

Research questions

• RQ1 Can sparsifying mean-centered features in a post-training setting improve adversarial robustness?
• RQ2 Does the method generalize across different activation functions and model architectures?
• RQ3 Can mean-centered sparsification reduce the impact of non-robust features without degrading clean accuracy?
• RQ4 How does the method perform under diverse attack types (ℓ∞, ℓ2) and adversarial training methods?
• RQ5 Is the performance gain due to the mean-centering or the sparsity mechanism itself?

Key findings

• MeanSparse improves AutoAttack accuracy on CIFAR-10 from 71.07% to 72.08% when applied to the top RobustBench model, setting a new SOTA.
• On ImageNet-1K, it increases the AutoAttack accuracy of the third-ranked model from 59.56% to 59.64%, surpassing the first-ranked model.
• Clean accuracy remains nearly unchanged at 93.24% (from 93.27%) on CIFAR-10, indicating minimal utility cost.
• The method is effective across multiple activation functions, including ReLU and Swish, showing robustness is not dependent on activation choice.
• MeanSparse improves robustness against both ℓ∞ and ℓ2 attacks, even when models are trained only for ℓ∞ robustness.
• Performance is sensitive to per-channel mean and variance estimation; global statistics do not yield the same gains.