[论文解读] On the Effect of Low-Rank Weights on Adversarial Robustness of Neural Networks

Peter Langenberg, Emilio Rafael Balda+2 more|arXiv (Cornell University)|Jan 29, 2019

Adversarial Robustness in Machine Learning参考文献 24被引用 6

一句话总结

本文研究了低秩和稀疏权重矩阵在提升深度神经网络对抗鲁棒性方面的作用。通过应用核范数和L1正则化以促进低秩和稀疏结构，作者展示了在FGSM和PGD攻击下鲁棒性的显著提升，尤其是在同时优化这两种特性时效果更佳，但性能仍不及对抗训练。

ABSTRACT

Recently, there has been an abundance of works on designing Deep Neural Networks (DNNs) that are robust to adversarial examples. In particular, a central question is which features of DNNs influence adversarial robustness and, therefore, can be to used to design robust DNNs. In this work, this problem is studied through the lens of compression which is captured by the low-rank structure of weight matrices. It is first shown that adversarial training tends to promote simultaneously low-rank and sparse structure in the weight matrices of neural networks. This is measured through the notions of effective rank and effective sparsity. In the reverse direction, when the low rank structure is promoted by nuclear norm regularization and combined with sparsity inducing regularizations, neural networks show significantly improved adversarial robustness. The effect of nuclear norm regularization on adversarial robustness is paramount when it is applied to convolutional neural networks. Although still not competing with adversarial training, this result contributes to understanding the key properties of robust classifiers.

研究动机与目标

• 探究低秩和稀疏权重结构是否有助于深度神经网络的对抗鲁棒性。
• 确定通过正则化促进这些结构特性是否能在不进行完整对抗训练的情况下提升鲁棒性。
• 分析在对抗训练过程中有效秩与有效稀疏性在权重矩阵中的相互作用。
• 评估对秩和稀疏性进行联合正则化是否比单独正则化更优。

提出的方法

• 作者使用有效秩和有效稀疏性作为度量，量化训练网络中权重矩阵的低秩和稀疏结构。
• 对卷积层和全连接层应用核范数正则化，以促进低秩结构。
• 使用L1正则化在权重矩阵中诱导稀疏性。
• 联合正则化策略在选定层上同时施加核范数和L1惩罚，以同步促进低秩和稀疏结构。
• 在MNIST和Fashion-MNIST上进行实验，使用ε = 0.05的FGSM和PGD攻击评估欺骗率。
• 训练后对权重矩阵进行可视化，定性确认低秩和稀疏模式的出现。

实验结果

研究问题

• RQ1 对抗训练是否自然导致深度神经网络中出现低秩和稀疏权重矩阵？
• RQ2 通过显式正则化促进低秩和稀疏权重结构是否能提升对抗鲁棒性？
• RQ3 同时应用低秩和稀疏正则化是否比单独应用任一正则化更有效？
• RQ4 有效秩和有效稀疏性在FGSM和PGD攻击下的鲁棒性方面有何相关性？
• RQ5 低秩和稀疏权重结构在多大程度上可复现对抗训练所达到的鲁棒性？

主要发现

• 对抗训练自然诱导出低秩和稀疏权重结构，表现为有效秩和有效稀疏性的降低。
• 对卷积层应用核范数正则化可显著提升对PGD和FGSM攻击的鲁棒性。
• 联合使用核范数和L1惩罚的正则化策略比单独正则化更优，尤其在卷积层上表现更佳。
• 即使仅使用L1正则化，也能降低有效秩，表明稀疏性与低秩结构之间存在隐含关联。
• 可视化结果证实，正则化后权重矩阵中出现了低秩和稀疏模式，尤其在第一和第二卷积滤波器中更为明显。
• 尽管有所改进，正则化模型的鲁棒性仍低于完整对抗训练模型，表明尚存在其他未被揭示的影响因素。