Towards Robust Neural Networks via Random Self-ensemble

By Xuanqing Liu, Minhao Cheng, Huan Zhang, Cho-Jui Hsieh. 2017

462 citations recorded by the source corpus.

Recent studies have revealed the vulnerability of deep neural networks: A small adversarial perturbation that is imperceptible to human can easily make a well-trained deep neural network misclassify. This makes it unsafe to apply neural networks in security-critical applications. In this paper, we propose a new defense algorithm called Random Self-Ensemble (RSE) by combining two important concepts: {\bf randomness} and {\bf ensemble}. To protect a targeted model, RSE adds random noise layers to the neural network to prevent the strong gradient-based attacks, and ensembles the prediction over random noises to stabilize the performance. We show that our algorithm is equivalent to ensemble an infinite number of noisy models $f_\epsilon$ without any additional memory overhead, and the proposed training procedure based on noisy stochastic gradient descent can ensure the ensemble model has a good predictive capability. Our algorithm significantly outperforms previous defense techniques on real data sets. For instance, on CIFAR-10 with VGG network (which has 92\% accuracy without any attack), under the strong C\&W attack within a certain distortion tolerance, the accuracy of unprotected model drops to less than 10\%, the best previous defense technique has $48\%$ accuracy, while our method still has $86\%$ prediction accuracy under the same level of attack. Finally, our method is simple and easy to integrate into any neural network.

Subfields: Artificial Intelligence, Model Architectures, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Model Architectures

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Feature Purification: How Adversarial Training Performs Robust Deep Learning (2020, background): “Since the original discovery of “adversarial examples”, a large body of works have been done emphasizing how to improve the robustness of the deep learning models against such perturbations [44, 63, 64, 83, 89].”
Certified Adversarial Robustness via Randomized Smoothing (2019, background): “Several works (Liu et al., 2018; Cao & Gong, 2017) proposed randomized smoothing as a heuristic defense, but did not prove any guarantees.”
Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness Against Adversarial Attack (2018, methodology): “Beyond that, several recent works utilizing similar concept as ours in their defense method are discussed as well, including certified robustness [26], random self-ensemble [27], and Adv-BNN [28].”
Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach (2018, background): “Model ensemble has also been discussed to increase the robustness to adversarial examples (Tram ` er et al., 2017; Liu et al., 2017).”
Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers (2019, background): “Randomized smoothing was proposed by several works [23, 3] as a heuristic defense without proving any guarantees.”
Disentangling Adversarial Robustness and Generalization (2018, methodology): “Defenses: Proposed defenses include detection and rejection methods [31, 25, 54, 60, 3, 63], pre-processing, quantization and dimensionality reduction methods [12, 73, 7], manifold-projection methods [39, 72, 82, 86], methods based on stochasticity/regularization or adapted architectures [109, 7, 68”
Towards Fast Computation of Certified Robustness for ReLU Networks (2018, methodology): “…thus proposed defensive or detection methods in order to increase the robustness of DNNs. Notable examples are defensive distillation (Papernot et al., 2016), adversarial retraining/training (Kurakin et al., 2017; Madry et al., 2018) and model ensembles (Tramèr et al., 2018; Liu et al., 2017a).”
Neural SDE: Stabilizing Neural ODE Networks with Stochastic Noise (2019, methodology): “Among them, random self-ensemble [6, 7] adds Gaussian noise to hidden states during both training and testing time.”
On the (In)fidelity and Sensitivity for Explanations. (2019, background): “Interestingly, recent research has shown that such random ensemble also lead to more robust prediction [24, 9].”
Efficient Bidirectional Neural Machine Translation (2019, background): “Analyzing of the Contribution of Right-To-Left Decoding Someone may argue that the improvements of our model come from the effects similar to self-ensemble (Laine and Aila, 2016; Liu et al., 2017), but not the bidirectionally generated sequence.”
Convergence of Adversarial Training in Overparametrized Neural Networks (2019, unknown): “Various kinds of defense methods have been proposed [23, 43, 30, 28, 39], but many of them are based on obfuscated gradients which does not really improve robustness under stronger attacks [3].”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “Building on the idea of injecting noise in the network while training [374], [375], He et al.”
Smooth Adversarial Training (2020, methodology): “Many efforts have been devoted to improving network resilience against adversarial attacks [47, 20, 73, 34, 43, 55].”
NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks (2019, background): “We exclude RSE and C AS -”
Towards Stable and Efficient Training of Verifiably Robust Neural Networks (2019, methodology): “ these deterministic veriﬁcation approaches, random smoothing can be used to increase the robustness of any model in a probabilistic manner (Cohen et al., 2019; Lecuyer et al., 2018; Li et al., 2018; Liu et al., 2018). 2.2 Robust Optimization and Veriﬁable Adversarial Defense To improve the robustne”
Learning Transferable Adversarial Examples via Ghost Networks (2018, unknown): “Meanwhile, defense techniques based on randomization [15, 29], input transformation [8], and training [17, 25] are also studied.”
Relating Adversarially Robust Generalization to Flat Minima (2021, methodology): “2, 3 [76] Xuanqing Liu, Minhao Cheng, Huan Zhang, and Cho-Jui Hsieh.”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, background): “To mitigate this, large efforts have been devoted to adversarial defense [7, 13, 36, 43, 44, 49, 52], via adversarial training [32, 37, 56, 62], input transformation [11, 21] or randomization [34, 61].”