Parseval Networks: Improving Robustness to Adversarial Examples

By Moustapha Cissé, Piotr Bojanowski, Edouard Grave, Yann Dauphin, Nicolas Usunier. 2017

896 citations recorded by the source corpus.

We introduce Parseval networks, a form of deep neural networks in which the Lipschitz constant of linear, convolutional and aggregation layers is constrained to be smaller than 1. Parseval networks are empirically and theoretically motivated by an analysis of the robustness of the predictions made by deep neural networks when their input is subject to an adversarial perturbation. The most important feature of Parseval networks is to maintain weight matrices of linear and convolutional layers to be (approximately) Parseval tight frames, which are extensions of orthogonal matrices to non-square matrices. We describe how these constraints can be maintained efficiently during SGD. We show that Parseval networks match the state-of-the-art in terms of accuracy on CIFAR-10/100 and Street View House Numbers (SVHN) while being more robust than their vanilla counterpart against adversarial examples. Incidentally, Parseval networks also tend to train faster and make a better usage of the full capacity of the networks.

Subfields: Artificial Intelligence, Instrumentation, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Instrumentation

In Safety, Robustness & Interpretability

Citations in the corpus

mixup: Beyond Empirical Risk Minimization (2017, methodology): “Among the several methods aiming to solve this problem, some have proposed to penalize the norm of the Jacobian of the model to control its Lipschitz constant (Drucker & Le Cun, 1992; Cisse et al., 2017; Bartlett et al., 2017; Hein & Andriushchenko, 2017).”
Learning Overparameterized Neural Networks via Stochastic Gradient Descent on Structured Data (2018, background): “[3, 23, 21] proved spectrally-normalized margin-based generalization bounds, [9, 23] derived bounds from a PAC-Bayes approach, and [1, 33, 4] derived bounds from the compression point of view.”
Word Translation Without Parallel Data (2017, methodology): “In this work, we propose to use a simple update step to ensure that the matrix W stays close to an orthogonal matrix during training (Cisse et al. (2017)).”
Certified Robustness to Adversarial Examples with Differential Privacy (2018, methodology): “network training process to minimize the number of robustness violations [30], [50], [12].”
Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness (2019, methodology): “…papers take different approaches to achieving this result, ranging from robust optimization (Madry et al., 2017) to training models to have Lipschitz constants (Cisse et al., 2017) to models which are provably robust to small `p perturbations (Wong & Kolter, 2018; Raghunathan et al., 2018).”
Ensemble Adversarial Training: Attacks and Defenses (2017, neutral): “…techniques against adversarial examples in deep neural networks have been proposed (Gu & Rigazio, 2014; Luo et al., 2015; Papernot et al., 2016c; Nayebi & Ganguli, 2017; Cisse et al., 2017) and many remain vulnerable to adaptive attackers (Carlini & Wagner, 2017a;b; Baluja & Fischer, 2017).”
Certified Adversarial Robustness via Randomized Smoothing (2019, methodology): “Some conservative methods bound the global Lipschitz constant of the neural network (Gouk et al., 2018; Tsuzuku et al., 2018; Anil et al., 2019; Cisse et al., 2017), but these approaches tend to be very loose on expressive networks.”
Theoretical evidence for adversarial robustness through randomization: the case of the Exponential family (2019, methodology): “We also apply a Parseval normalization to every convolutions layers (Cisse et al., 2017) during training.”
Certified Defenses against Adversarial Examples (2018, background): “This yields the following upper bound that we denote by f spectral : This measure of vulnerability to adversarial examples based on the spectral norms of the weights of each layer is considered in Szegedy et al. (2014) and Cisse et al. (2017).”
The Robust Manifold Defense: Adversarial Training using Generative Models (2017, background): “Common defense approaches involve modifying the training dataset such that the classiﬁer is made more robust [20], [41], modifying the network architecture to increase robustness [11] or performing defensive distillation [37].”
PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples (2017, background): “Some other work has focused on modifying the classiﬁer architecture to increase its robustness, e.g ., Gu & Rigazio (2014), Cisse et al. (2017) and Nayebi & Ganguli (2017).”
DeepXplore: Automated Whitebox Testing of Deep Learning Systems (2017, background): “This observation has inspired several researchers to try to improve the robustness and reliability of DNNs [9, 13, 17, 30, 32, 46, 51, 53, 62, 84, 89, 90].”
Countering Adversarial Images using Input Transformations (2018, background): “Unfortunately, recent research has demonstrated that existing models are not robust to small, adversarially designed perturbations of the input (Biggio et al., 2013; Szegedy et al., 2014; Goodfellow et al., 2015; Kurakin et al., 2016a; Cisse et al., 2017a).”
Adversarial Vulnerability of Neural Networks Increases With Input Dimension (2018, background): “Two notable exceptions are Hein and Andriushchenko (2017) and Cisse et al. (2017), who offer adversarial robustness guarantees”
Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning (2018, neutral): “id layer. However, techniques proposed have either restricted the ability to train a neural network (e.g., RBF units [64]) or demonstrated marginal improvements in robustness (e.g., Parseval networks [77]). The approach introduced in Section IV instead uses a nearest neighbors operation to ensure re”
Towards a Definition of Disentangled Representations (2018, background): “…worth mentioning many other ways ideas from group theory have inﬂuenced machine learning, such as orthonormality constraints on network weights [30, 18], extensions to convolutional network architectures that build in full aﬃne invariance rather than just translation invariance [33], and…”
Sorting out Lipschitz function approximation (2018, methodology): “Cisse et al. [12] regularize the weights of the neural network to obey an orthonormality constraint and utilize Lipschitz activation functions.”