论文标题
使用贪婪的对抗修剪在网络压缩过程中硬化DNN防止转移攻击
Hardening DNNs against Transfer Attacks during Network Compression using Greedy Adversarial Pruning
论文作者
论文摘要
近年来，深神经网络（DNN）应用的流行和成功促使对DNN压缩的研究，例如修剪和量化。这些技术加速了模型推断，减少功耗，并降低运行DNN所需的硬件的大小和复杂性，而准确性几乎没有损失。但是，由于DNN容易受到对抗输入的影响，因此重要的是要考虑压缩与对抗性鲁棒性之间的关系。在这项工作中，我们研究了几种不规则的修剪方案和8位量化产生的模型的对抗性鲁棒性。此外，虽然常规修剪消除了DNN中最不重要的参数，但我们研究了一种非常规修剪方法的效果：根据对抗输入的梯度去除最重要的模型参数。我们称这种方法称贪婪的对抗修剪（GAP），我们发现这种修剪方法会导致对从其未压缩的对应物转移攻击的模型。
The prevalence and success of Deep Neural Network (DNN) applications in recent years have motivated research on DNN compression, such as pruning and quantization. These techniques accelerate model inference, reduce power consumption, and reduce the size and complexity of the hardware necessary to run DNNs, all with little to no loss in accuracy. However, since DNNs are vulnerable to adversarial inputs, it is important to consider the relationship between compression and adversarial robustness. In this work, we investigate the adversarial robustness of models produced by several irregular pruning schemes and by 8-bit quantization. Additionally, while conventional pruning removes the least important parameters in a DNN, we investigate the effect of an unconventional pruning method: removing the most important model parameters based on the gradient on adversarial inputs. We call this method Greedy Adversarial Pruning (GAP) and we find that this pruning method results in models that are resistant to transfer attacks from their uncompressed counterparts.
