TLDR: S2AP is a new method for adversarial pruning that improves neural network robustness against attacks by minimizing “sharpness” in the importance score landscape during pruning. This leads to more stable mask selection and better performance in compact, robust models across various architectures and datasets.
Deep neural networks, while incredibly powerful, face two significant challenges: their vulnerability to “adversarial attacks” and their often-large size, which makes them unsuitable for resource-constrained devices. Adversarial attacks involve subtle, often imperceptible changes to input data that can trick a network into making incorrect predictions. To address the size issue, a technique called “pruning” is used, where redundant or less impactful parts of a network are removed to make it more compact.
Combining these two concerns, “Adversarial Pruning” (AP) methods aim to create smaller networks that are also robust against adversarial attacks. These methods typically follow a three-step process: first, a robust model is trained; second, a “binary mask” is selected to determine which weights (connections) in the network to prune; and finally, the resulting smaller model is fine-tuned.
The challenge lies in the second step: selecting the binary mask. Existing AP methods often assign an “importance score” to each weight and then keep only those with the highest scores. However, optimizing these scores can lead to what scientists call “sharp local minima” in the robust loss landscape. Imagine this landscape as a bumpy terrain where the network’s performance is represented by its altitude. A sharp minimum is like a very narrow, deep valley. If the network lands in such a valley, even tiny shifts in the importance scores can cause large, undesirable changes in the selected mask, making the pruning process unstable and potentially reducing the network’s robustness.
To overcome this critical issue, researchers have proposed a novel plug-in method called Score-space Sharpness-aware Adversarial Pruning (S2AP). This innovative approach introduces the concept of “score-space sharpness minimization.” During the mask search phase, S2AP intentionally perturbs the importance scores and then minimizes the corresponding robust loss. This process encourages the network to find “flatter” minima in the score-space landscape – like a wide, gentle valley instead of a sharp one. A flatter landscape means that small variations in scores do not lead to drastic changes in the mask selection, thereby stabilizing the pruning process.
Extensive experiments were conducted to evaluate S2AP across various datasets, including CIFAR10, SVHN, and the larger-scale ImageNet. Different neural network architectures, such as ResNet18, VGG16, WideResNet-28-4, and even Vision Transformers, were tested at various sparsity levels (the percentage of weights pruned). The results consistently demonstrated that S2AP effectively minimizes sharpness in the score space, leading to a more stable mask selection and, crucially, improving the adversarial robustness of the pruned models. These improvements often came with negligible or even improved clean accuracy.
Furthermore, S2AP also refines the fine-tuning stage. After the optimal pruning mask is identified, the method aligns the fine-tuning objective with the sharpness minimization principle. It perturbs only the remaining, non-pruned weights and minimizes the robust loss, further enhancing the model’s robustness. This paper marks a significant step, being one of the first to explore adversarial pruning on transformer-based architectures.
The S2AP method is designed as a “plug-in,” making it highly versatile and easy to integrate into existing score-based adversarial pruning techniques without altering their core logic. This adaptability suggests that the principles of score-space sharpness minimization could be applied to a broader range of score-based optimization problems beyond just adversarial pruning.
Also Read:
- Equivariance: Building Intrinsically Robust AI Models
- C-SWAP: A New Approach to Efficient Neural Network Compression Using Explainable AI
For more in-depth technical details, you can refer to the full research paper: S2AP: Score-space Sharpness Minimization for Adversarial Pruning.
