Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks

2021-10-26

Neural Information Processing Systems

AI Summary

Deep neural networks are vulnerable to adversarial attacks, and conventional robustness enhancement relies on weight training. Method: This paper discovers, for the first time, that strongly adversarially robust sparse subnetworks—termed Robust Scratch Tickets (RSTs)—naturally exist in randomly initialized deep networks, requiring no training whatsoever. These RSTs achieve adversarial accuracy on CIFAR-10/100 and ImageNet comparable to or exceeding that of adversarially trained models. Based on this finding, we propose the training-free Random RST Switching (R2S) defense paradigm, which dynamically selects among pre-identified RSTs during inference to enhance black-box robustness. Contribution/Results: Our work challenges the long-standing assumption that robustness must be learned through training, extending the Lottery Ticket Hypothesis to adversarial robustness. Extensive experiments confirm the ubiquity and transferability of RSTs, and demonstrate that, at equivalent sparsity levels, RSTs yield superior adversarial accuracy compared to trained counterparts.

Abstract

Deep Neural Networks (DNNs) are known to be vulnerable to adversarial attacks, i.e., an imperceptible perturbation to the input can mislead DNNs trained on clean images into making erroneous predictions. To tackle this, adversarial training is currently the most effective defense method, by augmenting the training set with adversarial samples generated on the fly. Interestingly, we discover for the first time that there exist subnetworks with inborn robustness, matching or surpassing the robust accuracy of the adversarially trained networks with comparable model sizes, within randomly initialized networks without any model training, indicating that adversarial training on model weights is not indispensable towards adversarial robustness. We name such subnetworks Robust Scratch Tickets (RSTs), which are also by nature efficient. Distinct from the popular lottery ticket hypothesis, neither the original dense networks nor the identified RSTs need to be trained. To validate and understand this fascinating finding, we further conduct extensive experiments to study the existence and properties of RSTs under different models, datasets, sparsity patterns, and attacks, drawing insights regarding the relationship between DNNs' robustness and their initialization/overparameterization. Furthermore, we identify the poor adversarial transferability between RSTs of different sparsity ratios drawn from the same randomly initialized dense network, and propose a Random RST Switch (R2S) technique, which randomly switches between different RSTs, as a novel defense method built on top of RSTs. We believe our findings about RSTs have opened up a new perspective to study model robustness and extend the lottery ticket hypothesis.

Problem

• Adversarial Attacks
• Deep Neural Networks
• Robust Network Architecture

Innovation

• Robustness Inherent Subnetworks
• Random Switching Defense Strategy
• Adversarial Attack Resistance