[论文解读] Noisy Computations during Inference: Harmful or Helpful?

Minghai Qin, Dejan Vučinić|arXiv (Cornell University)|Nov 26, 2018

Adversarial Robustness in Machine Learning参考文献 23被引用 5

一句话总结

本文提出噪声注入训练与推理投票机制，以增强神经网络在硬件引起的推理噪声及黑盒对抗攻击下的鲁棒性。在噪声MNIST推理上实现了接近完美的准确率（高达99.5%），并通过推理阶段的乘法噪声使对抗鲁棒性提升0.5%–1.13%，表明噪声可在深度学习系统中被有益地利用。

ABSTRACT

We study two aspects of noisy computations during inference. The first aspect is how to mitigate their side effects for naturally trained deep learning systems. One of the motivations for looking into this problem is to reduce the high power cost of conventional computing of neural networks through the use of analog neuromorphic circuits. Traditional GPU/CPU-centered deep learning architectures exhibit bottlenecks in power-restricted applications (e.g., embedded systems). The use of specialized neuromorphic circuits, where analog signals passed through memory-cell arrays are sensed to accomplish matrix-vector multiplications, promises large power savings and speed gains but brings with it the problems of limited precision of computations and unavoidable analog noise. We manage to improve inference accuracy from 21.1% to 99.5% for MNIST images, from 29.9% to 89.1% for CIFAR10, and from 15.5% to 89.6% for MNIST stroke sequences with the presence of strong noise (with signal-to-noise power ratio being 0 dB) by noise-injected training and a voting method. This observation promises neural networks that are insensitive to inference noise, which reduces the quality requirements on neuromorphic circuits and is crucial for their practical usage. The second aspect is how to utilize the noisy inference as a defensive architecture against black-box adversarial attacks. During inference, by injecting proper noise to signals in the neural networks, the robustness of adversarially-trained neural networks against black-box attacks has been further enhanced by 0.5% and 1.13% for two adversarially trained models for MNIST and CIFAR10, respectively.

研究动机与目标

• 缓解神经形态推理中噪声计算的有害影响，特别是在低功耗嵌入式系统中。
• 探究在推理阶段引入噪声是否能增强对黑盒对抗攻击的鲁棒性。
• 通过训练网络使其对噪声具有鲁棒性，降低神经形态硬件的精度与功耗需求。
• 开发算法解决方案，在不增加延迟或功耗开销的前提下，提升神经网络在强模拟噪声下的性能。

提出的方法

• 噪声注入训练：在反向传播过程中，向激活值添加标准差为σ的乘法噪声，以模拟推理噪声。
• 基于投票的推理：对每个输入执行多次噪声前向传播，取多数预测结果以提升鲁棒性。
• 乘法噪声模型：噪声以x' = x × (1 + ε)的形式应用，其中ε ~ N(0, σ²)，模拟模拟电路的变异性。
• 对抗训练设置：训练两个独立网络——一个用于生成对抗样本（NN_adv），另一个用于验证鲁棒性（NN_val），并在NN_val的推理阶段注入噪声。
• 黑盒攻击评估：使用带有PGD和多次重启的迭代FGSM方法，测试对抗样本在具有和不具有推理噪声的网络之间的迁移性。
• 定量比较：在不同噪声水平（σ ∈ [0.0, 0.4]）下测量准确率，以评估噪声与鲁棒性之间的权衡。

实验结果

研究问题

• RQ1 噪声注入训练与基于投票的推理是否能在神经形态硬件的高推理噪声条件下显著提升准确率？
• RQ2 在推理阶段引入噪声是否能减少对高精度模拟元件的需求？
• RQ3 噪声推理是否能增强对抗训练网络对黑盒对抗攻击的鲁棒性？
• RQ4 何种推理噪声水平能最大化对可迁移对抗样本的防御效果？
• RQ5 当目标网络使用噪声推理时，对抗样本的迁移性如何变化？

主要发现

• 噪声注入训练结合投票机制，使在强噪声（SNR = 0 dB）下MNIST推理准确率从21.1%提升至99.5%，证明了对硬件噪声的极高鲁棒性。
• 在CIFAR10上，相同噪声条件下准确率从29.9%提升至89.1%，表明该方法在不同数据集间具有泛化能力。
• 在MNIST笔画序列上，准确率从15.5%提升至89.6%，证实了其在序列数据上的有效性。
• 在低至中等噪声（σ ≤ 0.4）条件下，仅通过噪声注入训练，MNIST的准确率从95.8%提升至99.4%，且未增加延迟或功耗成本。
• 噪声推理使对抗训练模型在MNIST上的对抗鲁棒性提升0.5%，在CIFAR10上提升1.13%，表明对黑盒攻击的防御能力得到改善。
• 最优噪声水平为：MNIST的σ = 0.2，CIFAR10的σ = 0.1，超过此水平后性能因噪声过大而下降。