[论文解读] You Only Propagate Once: Painless Adversarial Training Using Maximal Principle

Dinghuai Zhang, Tianyuan Zhang+3 more|arXiv (Cornell University)|May 2, 2019

Adversarial Robustness in Machine Learning参考文献 22被引用 45

一句话总结

YOPO（You Only Propagate Once）是一种新颖的对抗性训练方法，利用庞特里亚金最大值原理（Pontryagin's Maximal Principle）通过将每次对抗性更新的完整前向和反向传播限制为仅一次，从而降低计算成本。由于对抗性更新仅依赖于第一层参数，YOPO 实现了与 PGD 相当的鲁棒准确率，同时仅需 PGD 所需 GPU 时间的 1/5 至 1/4。

ABSTRACT

Deep learning achieves state-of-the-art results in many tasks in computer vision and natural language processing. However, recent works have shown that deep networks can be vulnerable to adversarial perturbations, which raised a serious robustness issue of deep networks. Adversarial training, typically formulated as a robust optimization problem, is an effective way of improving the robustness of deep networks. A major drawback of existing adversarial training algorithms is the computational overhead of the generation of adversarial examples, typically far greater than that of the network training. This leads to the unbearable overall computational cost of adversarial training. In this paper, we show that adversarial training can be cast as a discrete time differential game. Through analyzing the Pontryagin's Maximal Principle (PMP) of the problem, we observe that the adversary update is only coupled with the parameters of the first layer of the network. This inspires us to restrict most of the forward and back propagation within the first layer of the network during adversary updates. This effectively reduces the total number of full forward and backward propagation to only one for each group of adversary updates. Therefore, we refer to this algorithm YOPO (You Only Propagate Once). Numerical experiments demonstrate that YOPO can achieve comparable defense accuracy with approximately 1/5 ~ 1/4 GPU time of the projected gradient descent (PGD) algorithm. Our codes are available at https://https://github.com/a1600012888/YOPO-You-Only-Propagate-Once.

研究动机与目标

• 为解决对抗性训练中因反复生成对抗样本而导致的高计算成本问题。
• 在不牺牲鲁棒性的前提下，减少对抗性训练过程中完整前向和反向传播的次数。
• 利用对抗性优化问题的结构特性，实现高效的参数更新。
• 开发一种在显著降低训练时间的同时保持高防御准确率的方法。

提出的方法

• YOPO 将对抗性训练建模为离散时间微分博弈，并应用庞特里亚金最大值原理（Pontryagin's Maximal Principle, PMP）分析最优性条件。
• 分析表明，对抗性更新仅依赖于网络第一层的参数。
• 这一洞察使得 YOPO 能够在对抗性更新期间，将大部分前向和反向传播限制在第一层。
• 全网络反向传播仅在每组对抗性更新中执行一次，从而大幅降低计算开销。
• 该方法在保持标准网络训练动态的同时，最小化深层中的冗余计算。
• YOPO 使用修改后的训练循环，跨多个对抗性步骤重用第一层的激活值和梯度。

实验结果

研究问题

• RQ1 能否通过利用优化问题的结构特性，显著降低对抗性训练的计算成本？
• RQ2 是否可能将全反向传播限制为每次对抗性更新仅一次，而不降低鲁棒性？
• RQ3 对抗性更新仅依赖第一层参数的依赖性，是否能够实现高效训练？
• RQ4 基于 PMP 的方法能否在显著降低训练时间的同时，实现与 PGD 相当的鲁棒性？

主要发现

• YOPO 在 CIFAR-10 和 SVHN 等标准基准数据集上实现了与 PGD 相当的防御准确率。
• YOPO 将 GPU 训练时间减少至 PGD 所需时间的约 1/5 至 1/4。
• 即使每组对抗性更新仅执行一次全反向传播，该方法仍能保持鲁棒性。
• 计算效率的提升无需修改网络架构或损失函数。
• 实证结果证实，PMP 的理论洞察在实践中成立，从而实现了高效且有效的训练。