Stochastic activation pruning for robust adversarial defense
Guneet S. Dhillon1,2, Kamyar Azizzadenesheli3, Zachary C. Lipton1,4, Jeremy Bernstein1,5, Jean Kossaifi1,6, Aran Khanna1, Anima Anandkumar1,5 1Amazon AI, 2UT Austin, 3UC Irvine, 4CMU, 5Caltech, 6Imperial College London
Abstract
Neural networks are known to be vulnerable to adversarial examples. Carefully chosen perturbations to real images, while imperceptible to humans, induce misclassification and threaten the reliability of deep learning systems in the wild. To guard against adversarial examples, we take inspiration from game theory and cast the problem as a minimax zero-sum game between the adversary and the model. In general, for such games, the optimal strategy for both players requires a stochastic policy, also known as a mixed strategy. In this light, we propose Stochastic Activation Pruning (SAP), a mixed strategy for adversarial defense. SAP prunes a random subset of activations (preferentially pruning those with smaller magnitude) and scales up the survivors to compensate. We can apply SAP to pretrained networks, including adversarially trained models, without fine-tuning, providing robustness against adversarial examples. Experiments demonstrate that SAP confers robustness against attacks, increasing accuracy and preserving calibration.
中文速览
对抗样本（adversarial examples）只需对图像施加人眼几乎察觉不到的微小扰动，就能让深度神经网络产生严重误分类，而现有防御方案大多需要重新训练模型，代价高昂。受博弈论启发，作者将攻防双方建模为一个零和极小极大博弈，指出最优防守策略应当是随机策略，并据此提出了"随机激活剪枝"（Stochastic Activation Pruning，SAP）方法：在前向传播时，按各激活值绝对大小成比例地随机丢弃一部分神经元，再对保留的神经元做逆概率加权缩放，从而在期望上保持原有输出不变。SAP最大的优势在于无需微调，可直接插入已训练好的模型（包括对抗训练模型），在CIFAR-10图像分类和Atari游戏强化学习两类任务上均显著提升了模型在对抗攻击下的准确率，同时保持了良好的概率校准性。这一即插即用的特性使其极具实用价值，为工业界已部署的深度学习系统提供了一条低成本的对抗鲁棒性强化路径。
原文 arXiv:1803.01442;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1803.01442v1