Patent Application
20230078473
The present disclosure relates to deep neural networks (DNN), and in particular to protection of DNNs from adversarial attacks.
Recently, deep neural networks (DNNs) have been deployed in many safety-critical applications. The security of DNN models has been widely scrutinized using adversarial input examples, where the adversary maliciously crafts and adds input noise to fool a DNN model. Recently, the vulnerability of model parameter (e.g., weight) perturbation has raised another dimension of security concern on the robustness of DNN model itself.
Adversarial weight attack can be defined as an attacker perturbing target DNN model parameters stored or executing in computing hardware to achieve malicious goals. Such perturbation of model parameters is feasible due to the development of advanced hardware fault injection techniques, such as row hammer attack, laser beam attack and under-voltage attack. Moreover, due to the development of side-channel attacks, it has been demonstrated that the complete DNN model information can be leaked during inference (e.g., model architecture, weights, and gradients). This allows an attacker to exploit a DNN inference machine (e.g., GPU, FPGA, mobile device) under an almost whitebox threat model. Inspired by the potential threats of fault injection and side-channel attacks, several adversarial DNN model parameter attack algorithms have been developed to study the model behavior under malicious weight perturbation.
A robust and accurate binary neural network, referred to as RA-BNN, is provided to simultaneously defend against adversarial noise injection and improve accuracy. Recently developed adversarial weight attack, also known as bit-flip attack (BFA), has shown enormous success in compromising deep neural network (DNN) performance with an extremely small amount of model parameter perturbation. To defend against this threat, embodiments of RA-BNN adopt a complete binary (i.e., for both weights and activation) neural network (BNN) to significantly improve DNN model robustness (defined as the number of bit-flips required to degrade the accuracy to as low as a random guess).
However, such an aggressive low bit-width model suffers from poor clean (i.e., no attack) inference accuracy. To counter this, a novel and efficient two-stage network growing method is proposed and referred to as early growth. Early growth selectively grows the channel size of each BNN layer based on channel-wise binary masks training with Gumbel-Sigmoid function. Apart from recovering the inference accuracy, the RA-BNN after growing also shows significantly higher resistance to BFA.
Evaluation on the CIFAR-10 dataset shows that the proposed RA-BNN can improve the clean model accuracy by ˜2-8%, compared with a baseline BNN, while simultaneously improving the resistance to BFA by more than 125×. Moreover, on the ImageNet dataset, with a sufficiently large (e.g., 5,000) amount of bit-flips, the baseline BNN accuracy drops to 4.3% from 51.9%, while the RA-BNN accuracy only drops to 37.1% from 60.9% (a 9% clean accuracy improvement).
An exemplary embodiment provides an RA-BNN. The RA-BNN includes a first DNN layer having a non-binary input and binarized weights; a last DNN layer having a non-binary input and binarized weights; and one or more intermediate DNN layers between the first DNN layer and the last DNN layer, wherein the one or more intermediate DNN layers have binary inputs and binarized weights.
Another exemplary embodiment provides a method for strengthening a BNN against adversarial noise injection. The method includes binarizing weights of each layer of the BNN; and binarizing inputs of each intermediate layer of the BNN between a first layer and a last layer such that an input of the first layer is not binarized.
Another exemplary embodiment provides a method for training a BNN using early growth. The method includes training and channel-wise growing the BNN from an initial BNN to a larger BNN; and retraining the larger BNN to minimize a defined loss.
Those skilled in the art will appreciate the scope of the present disclosure and realize additional aspects thereof after reading the following detailed description of the preferred embodiments in association with the accompanying drawing figures.
The foregoing purposes and features, as well as other purposes and features, will become apparent with reference to the description and accompanying figures below, which are included to provide an understanding of the invention and constitute a part of the specification, in which like numerals represent like elements, and in which:
The embodiments set forth below represent the necessary information to enable those skilled in the art to practice the embodiments and illustrate the best mode of practicing the embodiments. Upon reading the following description in light of the accompanying drawing figures, those skilled in the art will understand the concepts of the disclosure and will recognize applications of these concepts not particularly addressed herein. It should be understood that these concepts and applications fall within the scope of the disclosure and the accompanying claims.
It will be understood that, although the terms first, second, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element could be termed a second element, and, similarly, a second element could be termed a first element, without departing from the scope of the present disclosure. As used herein, the term “and/or” includes any and all combinations of one or more of the associated listed items.
It will be understood that when an element such as a layer, region, or substrate is referred to as being “on” or extending “onto” another element, it can be directly on or extend directly onto the other element or intervening elements may also be present. In contrast, when an element is referred to as being “directly on” or extending “directly onto” another element, there are no intervening elements present. Likewise, it will be understood that when an element such as a layer, region, or substrate is referred to as being “over” or extending “over” another element, it can be directly over or extend directly over the other element or intervening elements may also be present. In contrast, when an element is referred to as being “directly over” or extending “directly over” another element, there are no intervening elements present. It will also be understood that when an element is referred to as being “connected” or “coupled” to another element, it can be directly connected or coupled to the other element or intervening elements may be present. In contrast, when an element is referred to as being “directly connected” or “directly coupled” to another element, there are no intervening elements present.
Relative terms such as “below” or “above” or “upper” or “lower” or “horizontal” or “vertical” may be used herein to describe a relationship of one element, layer, or region to another element, layer, or region as illustrated in the Figures. It will be understood that these terms and those discussed above are intended to encompass different orientations of the device in addition to the orientation depicted in the Figures.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. As used herein, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises,” “comprising,” “includes,” and/or “including” when used herein specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
“About” as used herein when referring to a measurable value such as an amount, a temporal duration, and the like, is meant to encompass variations of ±20%, ±10%, ±5%, ±1%, and ±0.1% from the specified value, as such variations are appropriate.
Throughout this disclosure, various aspects of the invention can be presented in a range format. It should be understood that the description in range format is merely for convenience and brevity and should not be construed as an inflexible limitation on the scope of the invention. Accordingly, the description of a range should be considered to have specifically disclosed all the possible subranges as well as individual numerical values within that range. For example, description of a range such as from 1 to 6 should be considered to have specifically disclosed subranges such as from 1 to 3, from 1 to 4, from 1 to 5, from 2 to 4, from 2 to 6, from 3 to 6 etc., as well as individual numbers within that range, for example, 1, 2, 2.7, 3, 4, 5, 5.3, 6 and any whole and partial increments therebetween. This applies regardless of the breadth of the range.
Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. It will be further understood that terms used herein should be interpreted as having a meaning that is consistent with their meaning in the context of this specification and the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.
A robust and accurate binary neural network, referred to as RA-BNN, is provided to simultaneously defend against adversarial noise injection and improve accuracy. Recently developed adversarial weight attack, also known as bit-flip attack (BFA), has shown enormous success in compromising deep neural network (DNN) performance with an extremely small amount of model parameter perturbation. To defend against this threat, embodiments of RA-BNN adopt a complete binary (i.e., for both weights and activation) neural network (BNN) to significantly improve DNN model robustness (defined as the number of bit-flips required to degrade the accuracy to as low as a random guess).
However, such an aggressive low bit-width model suffers from poor clean (i.e., no attack) inference accuracy. To counter this, a novel and efficient two-stage network growing method is proposed and referred to as early growth. Early growth selectively grows the channel size of each BNN layer based on channel-wise binary masks training with Gumbel-Sigmoid function. Apart from recovering the inference accuracy, the RA-BNN after growing also shows significantly higher resistance to BFA.
Evaluation on the CIFAR-10 dataset shows that the proposed RA-BNN can improve the clean model accuracy by ˜2-8%, compared with a baseline BNN, while simultaneously improving the resistance to BFA by more than 125×. Moreover, on the ImageNet dataset, with a sufficiently large (e.g., 5,000) amount of bit-flips, the baseline BNN accuracy drops to 4.3% from 51.9%, while the RA-BNN accuracy only drops to 37.1% from 60.9% (a 9% clean accuracy improvement).
Among the popular adversarial weight attacks, bit-flip attack (BFA) is proven to be highly successful in hijacking DNN functionality (e.g., degrading accuracy as low as random guess) by flipping an extremely small amount (e.g., tens out of millions) of weight memory bits stored in computer main memory. In this context, robustness of a DNN is defined herein as the degree of DNN resistance against bit-flip attack, meaning a more robust network should require a greater number of bit-flips to hijack its function.
A series of defense works have attempted to mitigate such a potent threat. Among them, the binary weight neural network has proven to be the most successful one in defending against BFAs. For example, binarization of weight has been shown to improve model robustness by 4×-28×. Note that prior BFA defense work has not explored the impact of binary activation. However, for a binary weight neural network, with a sufficiently large amount of attack iterations, the attacker can still successfully degrade its accuracy to as low as random guess. More importantly, due to aggressively compressing the floating-point weights (i.e., 32 bits or more) into binary (1 bit), BNN inevitably sacrifices its clean model accuracy by 10-30%. Therefore, one goal of embodiments described herein is to construct a robust and accurate binary neural network (with both binary weight and activation) to simultaneously defend against BFAs and improve clean model accuracy.
To illustrate the motivation of this disclosure, the accuracy and robustness of a ResNet-20 network (as described in Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun, “Deep Residual Learning for Image Recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 770-778, 2016) was tested with different bit-widths of weights and activation using CIFAR-10 dataset (as described in Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton, Cifar-10 (canadian institute for advanced research), URL http://www.cs.toronto.edu/kriz/cifar.html, 2010), following the same BFA methods in prior works.
As a result of this trend, many prior works investigated different ways of training a complete BNN. However, a general conclusion among them is that BNN suffers from heavy inference accuracy loss. A similar trend is observed in
To achieve this, a robust and accurate binary neural network (RA-BNN) is disclosed, which provides a novel defense scheme against BFA. The defense scheme includes two key components. First, advantage is taken of the BNN's capability in providing improved resistance against bit-flip attack through completely binarizing both activations and weights of every DNN layer. Second, to address the clean model accuracy loss, a novel BNN network growing method, early growth, is introduced. Early growth selectively grows the output channels of every BNN layer to recover accuracy loss. Moreover, apart from recovering accuracy, increasing the channel size can also help to resist BFA attack.
Embodiments described herein provide several technical contributions. First, the proposed RA-BNN, utilizing BNN's intrinsic robustness improvement against BFA attack, binarizes both weight and activation of the DNN model. Unlike most prior BNN related works, the weights of every layer are binarized, including the first and last layer. This is referred to herein as complete BNN. In addition, all activations except the input going into the first (i.e., input image) and last layer (i.e., final classification layer) are binarized.
Second, to compensate clean model accuracy loss of a complete BNN model, early growth provides a trainable mask-based growing method to gradually and selectively grow the output channels of BNN layers. Since the network growing inevitably requires large computing complexity, to improve training efficiency early growth follows a two-stage training mechanism with an early stop mechanism of network growth. The first stage is to jointly train binary weights and channel-wise masks through Gumbel-Sigmoid function at the early iterations of training. As the growth of binary channels converges, it goes to the second stage, where the channel growing is stopped and only the binary weights will be trained based on the network structure trained in the first stage to further minimize accuracy loss.
Finally, extensive evaluations are performed on CIFAR-10, CIFAR-100 and ImageNet datasets on popular DNN architectures (e.g., ResNets, VGG). Evaluation on the CIFAR-10 dataset shows that the proposed RA-BNN can improve the clean accuracy by ˜2-8% of a complete BNN while improving the resistance to BFA by more than 125×. On the ImageNet dataset, RA-BNN gains 9% clean model accuracy compared to state-of-the-art baseline BNN model while completely defending against BFA (i.e., 5,000 bit-flips only degrade the accuracy to around 37%). In comparison, the baseline BNN accuracy degrades to 4.3% with 5,000 bit-flips.
A key defense intuition of the proposed RA-BNN is inspired by the BNN's intrinsic improved robustness against adversarial weight noise. The resistance of binarized weights to BFA is a well-investigated phenomenon. The evaluation presented in Table 1 also demonstrates the efficacy of a binary weight model in comparison to an 8-bit quantized weight model. However, unlike prior works, embodiments described herein completely binarize DNN model including both weights and activations. Surprisingly, Table 1 shows that a complete BNN requires ˜39× more bit-flips than an 8-bit model to achieve the same attack objective (i.e., 10% accuracy).
Observation 1: A complete binary neural network (i.e., both binary weights and activations) improves the robustness of a DNN significantly (e.g., ˜39× in the example of Table 1).
As shown in Table 1, while the complete BNN may provide superior robustness, it comes at the cost of reducing the test accuracy by 10.0% (from 92.7% to 82.33%) even on a small dataset with 10 classes.
Observation 2: By multiplying the input and output channel width with a large factor (e.g., 3), BNN accuracy degradation is largely compensated.
Inspired by observations 1 and 2, embodiments described herein aim to resolve the accuracy and robustness trade-off presented in
To achieve this, embodiments provide a channel width optimization technique called early growth, which is a general method of growing a given complete BNN model at early training iterations by selectively and gradually growing certain channels of each layer.
In summary, the defense intuition is to leverage binary weights and activations to improve the robustness of DNN, while growing channel size of each individual BNN layer using the proposed early growth method to simultaneously recover the accuracy loss and further boost the robustness. Early growth ensures two key advantages of interest: i) the constructed RA-BNN does not suffer from heavy clean model accuracy loss, and ii) it supplements the intrinsic robustness improvement through marginally increasing BNN channel size.
The proposed RA-BNN includes two aspects to improve robustness and accuracy simultaneously. First, the weights of every DNN layer are binarized, including the first and last layers. Further, to improve the robustness, the inputs going into each layer are also binarized, except the first and last one. Such a complete BNN with binary weights and activation is a principal component of the defense mechanism. Second, to recover the accuracy and further improve the robustness of a complete BNN model, early growth is proposed as a fast and efficient way of growing a BNN with a trainable channel width of each individual layer.
Although some prior approaches also utilize mask-based learning to grow DNN models, there are two key differences to highlight here: 1) such past approaches jointly train the mask and weight for the whole training process, which is unstable and suffers from higher training cost. Embodiments of RA-BNN instead adopt a two-step training scheme with an early stop of growing, improving the training efficiency and thus scalability. 2) More importantly, the prior approaches generate the binary mask by learning full precision mask following non-differential Bernoulli sampling, which leads to a multiplication between full precision weight and full precision mask in the forward pass. This method is not efficient in BNN training with binary weight, where it is much preferred to only use binary-multiplication with both operands (i.e., weight and mask) in binary format. To achieve this goal, a differentiable Gumbel-Sigmoid method is proposed, as will be discussed below, to learn binary mask and guarantee binary-multiplication between weight and mask in the forward path.
The first step is to construct a complete BNN with binary weights and activations. Training a neural network with binary weights and activations presents the challenge of approximating the gradient of a non-linear sign function. To compute the gradient efficiently and improve the binarization performance, embodiments use a training aware binary approximation function instead of the direct sign function:
where i is the current training iteration and T is the total number of iterations.
At the early training stage, i/T is low, and the above function is continuous. As the training progresses, the function gradually becomes a sign function whose gradient can be computed as:
For weight binarization, z represents full-precision weights (z=wƒp), and for activation binarization, z represents full-precision activation input going into the next convolution layer (z=αƒp). The RA-BNN binarizes the weights of every layer including the first and last layers. However, for activation, RA-BNN binarizes every input going into the convolution layer except the first layer input.
The goal of the proposed early growth method is to grow each layer's channel-width of a given BNN model during training to help recover the inference accuracy and further improve the robustness. As shown in
In order to gradually grow the network by increasing the output channel size, the channel-wise binary mask is utilized as an indicator (e.g., on/off). Considering a convolution layer with input channel size cin, output channel size cout, filter size k×k and output filter wj ∈ R{k×k×cout}; then the jth (j ∈1, 2, . . . cout) output feature from a convolution operation becomes:
houtj=conv(hin, wbj⊙mbj) Equation 4
where wbj ⊙ [−1,1] is a binary weight (wbj=ƒ(wƒpj)), and mbj ⊙ [0,1] is a binary mask.
When the binary mask is set to 0, the entire jth output filter is detached from the model. As both weight and mask are in binary format, such element-wise multiplication can be efficiently computed using a binary multiplication operation (e.g., XNOR), instead of floating-point multiplication. This is the reason to guarantee both the weight and mask are in binary format in the forward path. The growing stage starts from a given baseline model (e.g., ×1 channel width) and each channel is associated with a trainable mask. During training, a new output filter channel will be created (i.e., growing) when the mask switches from 0 to 1 for the first time. An example of this growing procedure is illustrated in
where g(.) is the complete BNN inference function. However, the discrete states (i.e., non-differential) of the binary masks mb make their optimization using gradient descent a challenging problem.
The conventional way of generating the binary trainable mask is to train a learnable real-valued mask (mƒp) followed by a hard threshold function (e.g., sign function) to binarize it. However, such a hard threshold function is not differentiable, the general solution is to approximate the gradients by skipping the threshold function during back-propagation and update the real-value masks directly.
This disclosure instead proposes a method to eliminate the gradient estimation step and make whole mask learning procedure differentiable, and thus compatible with the existing gradient-based back-propagation training process. First, the hard threshold function is relaxed to a continuous logistic function:
where β is a constant scaling factor. Note that the logistic function becomes closer to the hard thresholding function for higher β values.
where π0 represents σ(mƒp). g0 and g1 are samples from Gumbel distribution. The temperature T is a hyper-parameter to adjust the range of input values, where choosing a larger value could avoid gradient vanishing during back-propagation. Note that the output of p(mƒp) becomes closer to a Bernoulli sample as T is closer to 0. Equation 7 can be further simplified as:
Benefiting from the differentiable property of Equation 6 and Equation 8, the real-value mask mƒp can be embedded with existing gradient based back-propagation training without gradient approximation. During training, most values in the distribution of p(mƒp) will move towards either 0 or 1. To represent p(mƒp) as binary format, a hard threshold (e.g., 0.5) is used during forward-propagation of training, which has no influence on the real-value mask to be updated for back-propagation as shown in
After stage-1, the grown BNN structure (i.e., channel index for each layer) is obtained, which is indicated by the channel-wise mask mb. Then, in stage-2, the new BNN model wƒp* is constructed using the weight channels with mask values as 1 in mb and the rest is discarded. In stage-2 training, the newly constructed BNN's weight parameters will be trained without involving any masks. The re-training optimization objective can be formulated as:
After completing the re-training stage, a complete BNN is obtained with simultaneously improved robustness and clean model accuracy.
RA-BNN is evaluated on three popular vision datasets: CIFAR-10, CIFAR-100, and ImageNet (as described in Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton, “ImageNet Classification with Deep Convolutional Neural Networks,” in Advances in Neural Information Processing Systems, pages 1097-1105, 2012). In the evaluation, the dataset is split following the standard practice of splitting it into training and test data 1. ResNet-20, ResNet-18, and a small VGG architecture (as described in Mingbao Lin, Rongrong Ji, Zihan Xu, Baochang Zhang, Yan Wang, Yongjian Wu, Feiyue Huang, and Chia-Wen Lin, “Rotated Binary Neural Network,” in Advances in Neural Information Processing Systems 33 (NeurIPS), 2020, referred to herein as “RBNN”) are trained for CIFAR-10 dataset. For both CIFAR-100 and ImageNet, the efficacy of the method is demonstrated in ResNet-18.
The same DNN architecture, training configuration, and hyper-parameters as RBNN are followed. The same weight binarization method as RBNN is also followed, including applying the rotation on the weight tensors before binarization.
Un-targeted BFA degrades the DNN accuracy close to a random guess level (1/no. of class)×100 (e.g., 10% for CIFAR-10, 1% for CIFAR-100, and 0.1% for ImageNet). N-to-1 targeted attack is also performed where the attacker classifies all the inputs into a specific target class, which again will degrade the overall test accuracy to a random guess level. The attack three rounds are run and the best round is reported in terms of the number of bit-flips required to achieve the desired objective. The maximum number of bits the attacker can flip is assumed to be 5,000, based on practical prior experiments. To get around strong bit-flip protection schemes requires around 95 hours to flip 91 bits using double-sided row-hammer attack. At this rate, to flip 5,000 bits, it would take around seven months, which is practically impossible. Thus, if the defense can resist 5,000 bit-flips, it can safely be claimed that RA-BNN can completely defend against BFA.
The first step of the training phase is to perform growing. To do so, it is necessary to initialize the mask values. The mask values of the base model (×1) are initialized to be equal to 1. Thus, the base architecture channels always remain attached to the model at the beginning of the training. Next, the rest of the masks are initialized with a negative value within the range of −1 to −0.1 to keep their corresponding binary mask value (mb) equal to 0 initially.
After growing, the model is generally re-initialized keeping only the channels with mask values equal to 1 and discarding the rest of the channels for VGG, AlexNet or other architectures without residual connection. However, in particular for residual models (e.g., ResNet-18), each layer within the basic-block is ensured to have the same size (i.e., equal to the size of the layer with maximum channel size) to avoid output size mismatch between the residual connections and next layer. Next, the β values are also initialized by setting them equal to 1. Besides at each iteration of the growing stage, the beta values are updated using a beta scheduler.
Clean Accuracy % (CA) is the percentage of test samples correctly classified by the DNN model when there is no attack.
Post-Attack Accuracy % (PA) is defined as the test accuracy after conducting the BFA attack on the DNN model.
To measure the model robustness, the number of bit-flips required to degrade the DNN accuracy to a random guess level (e.g., 10.0% for CIFAR-10) is reported.
To evaluate the DNN model size, the total number of weight bits (B) present in the model is reported in millions.
The performance of the proposed RA-BNN method in recovering the accuracy of a BNN is presented in Table 2. First, for CIFAR-10, the clean accuracy drops by 3.6% after binarization. However, by growing the model by 2× from a base (1×) BNN model, the proposed early growth helps to recover the clean accuracy back to 92.9%. Similarly, for CIFAR-100 and ImageNet, the clean accuracy drops by ˜9% and ˜18% after weight and activation binarization of every layer for ResNet-18. Again, after growing the base (1×) BNN model to a 6.5× size, early growth recovers ˜9% of the clean accuracy on ImageNet.
In summary, complete binarization impacts the clean accuracy of BNN by up to 18% degradation on a large-scale dataset (e.g., ImageNet). Thus, recovering the accuracy near the baseline full-precision model becomes extremely challenging. Moreover, unlike prior BNNs that do not binarize the first and last layers, embodiments described herein binarize every layer and achieve 60.9% clean accuracy. The next subsection demonstrates that the RA-BNN's under-attack accuracy still holds to 37% while all the other baseline models drop below 5% (see Table 4).
Table 3 summarizes the robustness analysis on CIFAR-10 dataset. First, for un-targeted attack, the proposed RA-BNN improves the resistance to BFA by requiring 125× more bit-flips for ResNet-20. As for ResNet-18 and VGG, they demonstrate even higher resistance to BFA. The attack fails to degrade the accuracy below 72% even after 5,000 flips on VGG architecture. Similarly, the attack fails to break the defense on ResNet-18 architecture as well. Even after 5,000 flips the test accuracy still holds at 51.29%, while it requires only 17-30 flips to completely malfunction the baseline models (e.g., 4-bit/8-bit). In conclusion, the proposed RA-BNN increases the model's robustness to BFA significantly, most notably completely defending BFA on the VGG model.
However, the targeted BFA is more effective against the RA-BNN. As Table 3 shows, RA-BNN still improves the resistance to BFA by 37× and 199× on ResNet-20 and ResNet-18 architectures, respectively, in comparison to 8-bit model counterparts. For the VGG model, the targeted BFA can only degrade the DNN accuracy to 78.99% even after 5,000 bit-flips; thus completely defending the attack. In summary, BFA can degrade the DNN accuracy to near-random guess level (i.e., 10%) with only ˜4-34 bit-flips. But RA-BNN improves the resistance to BFA significantly. Even after 37-294× more bit-flips, it still fails to achieve the desired attack goal.
The proposed RA-BNN improves the resistance to BFA on large-scale datasets (e.g., CIFAR-100 and ImageNet) as well. As presented in Table 4, the baseline 8-bit models require less than 25 bit-flips to degrade the interference accuracy close to a random guess level. While binary model improves the resistance to BFA, it is still possible to significantly reduce (e.g., 4.3%) the inference accuracy with a sufficiently large (e.g., 5,000) amount of bit-flips. But the proposed RA-BNN outperforms both 8-bit and binary baseline, as even after 5,000 bit-flips the accuracy only degrades to 37.1% on ImageNet.
The RA-BNN defense performance in comparison to other SOTA BNN is summarized in Table 5. An impressive 62.9% Top-1 clean accuracy on ImageNet is achieved, beating all the prior BNN works by a fair margin. However, this improvement in clean accuracy comes at the cost of additional model size overhead (e.g., memory) which will be discussed in Section 5.D.
Apart from accuracy gain, the RA-BNN's major goal is to improve the robustness to BFA. The superior defense performance is summarized in Table 6, where RA-BNN again outperforms all existing defenses. Even in comparison to the best existing defense binary weight model, BFA requires 28× more bit-flips to break the defense.
From the evaluation results presented above (e.g., Table 3), it is evident that the accuracy and robustness improvement of RA-BNN comes at the expense of larger model size. But even after growing the binary model size, RA-BNN remains within 26-90% of the size of an 8-bit model, while achieving more than 125× improvement in robustness. To give an example, the RA-BNN model size increases by 4× in comparison to a baseline binary model for VGG. Still, the RA-BNN can achieve similar accuracy as a 4-bit model with comparable model size (Table 3). However,
Similarly, the RA-BNN ResNet-18 model size is 2× (same size as 2-bit) than a binary baseline model. Again, the accuracy of this model is comparable to a 4-bit model as shown in Table 3. Thus, in conclusion, the proposed RA-BNN model stays within the memory budget of a 2- to 6-bit model while improving the resistance to BFA by more than 125× with significantly higher (2-9%) clean accuracy than a binary model.
Previous BFA defense works have demonstrated that the majority of the bit-flips occur in the first and last layer of a DNN. However, after binarization, it is observed that most of the bit-flips exist in the last two layers. The reason being RA-BNN binarizes every layer weight and activation except the input activation going into the last layer. Otherwise, all the other layer input is constrained within binary values. As a result, the input going into the last layer contains floating-point values, which is the only vulnerable point to cause significant error in the final classification layer computation by injecting faults into the last two layers. Thus, binarizing the input going into the last layer can nullify BFA attacks even further.
The process optionally continues at operation 704, with training and channel-wise growing the BNN from an initial BNN to a larger BNN. The process optionally continues at operation 706, with retraining the larger BNN to minimize a defined loss. Operations 704 and 706 may comprise an early growth approach to training the BNN and may further include steps and operations described above and in
Although the operations of
In some aspects of the present invention, software executing the instructions provided herein may be stored on a non-transitory computer-readable medium, wherein the software performs some or all of the steps of the present invention when executed on a processor.
Aspects of the invention relate to algorithms executed in computer software. Though certain embodiments may be described as written in particular programming languages, or executed on particular operating systems or computing platforms, it is understood that the system and method of the present invention is not limited to any particular computing language, platform, or combination thereof. Software executing the algorithms described herein may be written in any programming language known in the art, compiled or interpreted, including but not limited to C, C++, C #, Objective-C, Java, JavaScript, MATLAB, Python, PHP, Perl, Ruby, or Visual Basic. It is further understood that elements of the present invention may be executed on any acceptable computing platform, including but not limited to a server, a cloud instance, a workstation, a thin client, a mobile device, an embedded microcontroller, a television, or any other suitable computing device known in the art.
Parts of this invention are described as software running on a computing device. Though software described herein may be disclosed as operating on one particular computing device (e.g. a dedicated server or a workstation), it is understood in the art that software is intrinsically portable and that most software running on a dedicated server may also be run, for the purposes of the present invention, on any of a wide range of devices including desktop or mobile devices, laptops, tablets, smartphones, watches, wearable electronics or other wireless digital/cellular phones, televisions, cloud instances, embedded microcontrollers, thin client devices, or any other suitable computing device known in the art.
Similarly, parts of this invention are described as communicating over a variety of wireless or wired computer networks. For the purposes of this invention, the words “network”, “networked”, and “networking” are understood to encompass wired Ethernet, fiber optic connections, wireless connections including any of the various 802.11 standards, cellular WAN infrastructures such as 3G, 4G/LTE, or 5G networks, Bluetooth®, Bluetooth® Low Energy (BLE) or Zigbee® communication links, or any other method by which one electronic device is capable of communicating with another. In some embodiments, elements of the networked portion of the invention may be implemented over a Virtual Private Network (VPN).
The exemplary computer system 900 in this embodiment includes a processing device 902 or processor, a system memory 904, and a system bus 906. The system memory 904 may include non-volatile memory 908 and volatile memory 910. The non-volatile memory 908 may include read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), and the like. The volatile memory 910 generally includes random-access memory (RAM) (e.g., dynamic random-access memory (DRAM), such as synchronous DRAM (SDRAM)). A basic input/output system (BIOS) 912 may be stored in the non-volatile memory 908 and can include the basic routines that help to transfer information between elements within the computer system 900.
The system bus 906 provides an interface for system components including, but not limited to, the system memory 904 and the processing device 902. The system bus 906 may be any of several types of bus structures that may further interconnect to a memory bus (with or without a memory controller), a peripheral bus, and/or a local bus using any of a variety of commercially available bus architectures.
The processing device 902 represents one or more commercially available or proprietary general-purpose processing devices, such as a microprocessor, central processing unit (CPU), or the like. More particularly, the processing device 902 may be a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, a processor implementing other instruction sets, or other processors implementing a combination of instruction sets. The processing device 902 is configured to execute processing logic instructions for performing the operations and steps discussed herein.
In this regard, the various illustrative logical blocks, modules, and circuits described in connection with the embodiments disclosed herein may be implemented or performed with the processing device 902, which may be a microprocessor, field programmable gate array (FPGA), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), or other programmable logic device, a discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. Furthermore, the processing device 902 may be a microprocessor, or may be any conventional processor, controller, microcontroller, or state machine. The processing device 902 may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration).
The computer system 900 may further include or be coupled to a non-transitory computer-readable storage medium, such as a storage device 914, which may represent an internal or external hard disk drive (HDD), flash memory, or the like. The storage device 914 and other drives associated with computer-readable media and computer-usable media may provide non-volatile storage of data, data structures, computer-executable instructions, and the like. Although the description of computer-readable media above refers to an HDD, it should be appreciated that other types of media that are readable by a computer, such as optical disks, magnetic cassettes, flash memory cards, cartridges, and the like, may also be used in the operating environment, and, further, that any such media may contain computer-executable instructions for performing novel methods of the disclosed embodiments.
An operating system 916 and any number of program modules 918 or other applications can be stored in the volatile memory 910, wherein the program modules 918 represent a wide array of computer-executable instructions corresponding to programs, applications, functions, and the like that may implement the functionality described herein in whole or in part, such as through instructions 920 on the processing device 902. The program modules 918 may also reside on the storage mechanism provided by the storage device 914. As such, all or a portion of the functionality described herein may be implemented as a computer program product stored on a transitory or non-transitory computer-usable or computer-readable storage medium, such as the storage device 914, volatile memory 910, non-volatile memory 908, instructions 920, and the like. The computer program product includes complex programming instructions, such as complex computer-readable program code, to cause the processing device 902 to carry out the steps necessary to implement the functions described herein.
An operator, such as the user, may also be able to enter one or more configuration commands to the computer system 900 through a keyboard, a pointing device such as a mouse, or a touch-sensitive surface, such as the display device, via an input device interface 922 or remotely through a web interface, terminal program, or the like via a communication interface 924. The communication interface 924 may be wired or wireless and facilitate communications with any number of devices via a communications network in a direct or indirect fashion. An output device, such as a display device, can be coupled to the system bus 906 and driven by a video port 926. Additional inputs and outputs to the computer system 900 may be provided through the system bus 906 as appropriate to implement embodiments described herein.
The operational steps described in any of the exemplary embodiments herein are described to provide examples and discussion. The operations described may be performed in numerous different sequences other than the illustrated sequences. Furthermore, operations described in a single operational step may actually be performed in a number of different steps. Additionally, one or more operational steps discussed in the exemplary embodiments may be combined.
Those skilled in the art will recognize improvements and modifications to the preferred embodiments of the present disclosure. All such improvements and modifications are considered within the scope of the concepts disclosed herein and the claims that follow.
This application claims priority to U.S. Provisional Application No. 63/243,762, filed Sep. 14, 2021, incorporated herein by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 63243762 | Sep 2021 | US |
