鲁棒神经网络的训练方法研究进展与前景

doi:10.3981/j.issn.2097-0781.2023.01.006

前瞻科技 ›› 2023, Vol. 2 ›› Issue (1): 78-89.DOI: 10.3981/j.issn.2097-0781.2023.01.006

鲁棒神经网络的训练方法研究进展与前景

梁震¹(), 刘万伟²^,^†(), 吴陶然³^,⁴, 任德金³^,⁴, 薛白³

1.国防科技大学量子信息研究所兼高性能计算国家重点实验室，长沙 410073
2.国防科技大学计算机学院，长沙 410073
3.中国科学院软件研究所计算机科学国家重点实验室，北京 100190
4.中国科学院大学计算机科学与技术学院，北京 100190

收稿日期:2022-12-24 修回日期:2023-02-01 出版日期:2023-03-20 发布日期:2023-03-27
通讯作者: ^†
作者简介:梁震，博士研究生。主要研究方向为AI可解释性与AI形式化验证等。电子信箱：liangzhen@nudt.edu.cn。
刘万伟，教授，中国计算机学会高级会员。主要研究方向为自动机理论、形式化方法、AI形式化验证等。在IEEE Transactions on Sustainable Energy、ACM Transactions on Quantum Computing、ICSE、ASE、CAV、TACAS、IJCAI等期刊/会议发表多篇论文。参与开发的验证工具在TACAS SV-comp比赛中多次获得第一名。电子信箱：wwliu@nudt.edu.cn。
基金资助:
国家自然科学基金(61872371);国家自然科学基金(61836005);国家自然科学基金(62032024)

Advances and Prospects of Training Methods for Robust Neural Networks

LIANG Zhen¹(), LIU Wanwei²^,^†(), WU Taoran³^,⁴, REN Dejin³^,⁴, XUE Bai³

1. Institute of Quantum Information & State Key Laboratory of High Performance Computing, National University of Defense Technology, Changsha 410073, China
2. College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China
3. State Key Laboratory of Computer Science, Institute of Software, Chinese Academy of Sciences, Beijing 100190, China
4. School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing 100190, China

Received:2022-12-24 Revised:2023-02-01 Online:2023-03-20 Published:2023-03-27
Contact: ^†

摘要/Abstract

摘要：

近年来，深度神经网络已经发展成为深度学习的重要计算模型，神经网络的鲁棒性对于其在安全攸关领域的部署至关重要。因此，如何训练鲁棒的神经网络是备受学术界和工业界关注的热点问题。文章介绍了目前主流的3类鲁棒神经网络的训练方法，即基于数据增强训练、基于对抗训练和利普希茨鲁棒性训练;并介绍了其各自方法的核心思想、代表性研究工作和适用范围。同时，将近年来的鲁棒神经网络训练方法的优缺点进行比较，对应到神经网络训练的要素上进行深入分析和对照，并对各类训练方法得到的神经网络的鲁棒性的评价指标进行了介绍和比较。最后，分析了目前鲁棒神经网络训练的难点和热点，展望了该领域可能的研究方向，并提出建议。

关键词: 深度神经网络, 鲁棒性, 神经网络训练

Abstract:

In recent years, deep neural networks have developed into important computing models for deep learning, whose robustness is essential for their deployment in safety-critical areas. Therefore, the way to train robust neural networks is a popular issue that has attracted the attention of academia and industry. In this paper, three mainstream classes of training methods for robust neural networks are introduced, i.e., the method based on data enhancement, that based on adversarial training, and the Lipschitz robust training method. Meanwhile, their core ideas, representative work, and the application scope are introduced. Then, the advantages and disadvantages of the training methods in recent years are compared, and in-depth analysis and comparison are carried out when they correspond to key elements in neural network training. The robustness evaluation metrics of neural networks obtained by these training methods are introduced and compared. Finally, hotspots and challenges of robust neural network training are analyzed, and the possible future directions and some suggestions are briefly summarized.

Key words: deep neural network, robustness, neural network training

梁震, 刘万伟, 吴陶然, 任德金, 薛白. 鲁棒神经网络的训练方法研究进展与前景[J]. 前瞻科技, 2023, 2(1): 78-89.

LIANG Zhen, LIU Wanwei, WU Taoran, REN Dejin, XUE Bai. Advances and Prospects of Training Methods for Robust Neural Networks[J]. Science and Technology Foresight, 2023, 2(1): 78-89.

图/表 2

参考文献 41

[1]	Karch T, Teodorescu L, Hofmann K, et al. Grounding spatio-temporal language with transformers[J]. Advances in Neural Information Processing Systems, 2021, 34: 5236-5249.
[2]	Wang J, Wang K C, Rudzicz F, et al. Grad2Task: Improved few-shot text classification using gradients for task representation[J]. Advances in Neural Information Processing Systems, 2021, 34: 6542-6554.
[3]	Dahnert M, Hou J, Nießner M, et al. Panoptic 3D scene reconstruction from a single RGB image[J]. Advances in Neural Information Processing Systems, 2021, 34: 8282-8293.
[4]	Tian Y, Yang W, Wang J. Image fusion using a multi-level image decomposition and fusion method[J]. Applied Optics, 2021, 60(24): 7466-7479. DOI URL
[5]	Geiger A, Lenz P, Urtasun R. Are we ready for autonomous driving? The kitti vision benchmark suite[C]// Proceedings of the 2012 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE Press, 2012: 3354-3361.
[6]	Zheng X, Zhu J. Efficient LiDAR odometry for autonomous driving[J]. IEEE Robotics and Automation Letters, 2021, 6(4): 8458-8465. DOI URL
[7]	中国计算机学会. CCF 2019—2020 中国计算机科学技术发展报告[M]. 北京: 机械工业出版社, 2020.
[8]	Liu W W, Song F, Zhang T H R, et al. Verifying ReLU neural networks from a model checking perspective[J]. Journal of Computer Science and Technology, 2020, 35(6): 1365-1381. DOI
[9]	Liang Z, Ren D, Liu W, et al. Safety verification for neural networks based on set-boundary analysis[DB/OL]. arXiv preprint: 2210.04175, 2022.
[10]	Gehr T, Mirman M, Drachsler-Cohen D, et al. AI2: Safety and robustness certification of neural networks with abstract interpretation[C]// Proceedings of the 2018 IEEE Symposium on Security and Privacy. Piscataway: IEEE Press, 2018: 3-18.
[11]	Katz G, Barrett C, Dill D L, et al. Reluplex: An efficient SMT solver for verifying deep neural networks[C]// Majumdar R, Kunčak V.Proceedings of the 29th International Conference on Computer Aided Verification. Cham: Springer, 2017: 97-117.
[12]	邱锡鹏. 神经网络与深度学习[M]. 北京: 机械工业出版社, 2020.
[13]	Casadio M, Komendantskaya E, Daggitt M L, et al. Neural network robustness as a verification property: A principled case study[C]// Shoham S, Vizel Y. Proceedings of the 34th International Conference on Computer Aided Verification. Cham: Springer, 2022: 219-231.
[14]	Ehlers R. Formal verification of piece-wise linear feed-forward neural networks[C]// D’Souza D, Kumar K N. Proceedings of the 15th International Symposium on Automated Technology for Verification and Analysis. Cham: Springer, 2017: 269-286.
[15]	Lomuscio A, Maganti L. An approach to reachability analysis for feed-forward ReLU neural networks[DB/OL]. arXiv preprint: 1706.07351, 2017.
[16]	Singh G, Gehr T, Mirman M, et al. Fast and effective robustness certification[J]. Advances in Neural Information Processing Systems, 2018, 31: 10825-10836.
[17]	Yang X, Yamaguchi T, Tran H D, et al. Neural network repair with reachability analysis[C]// Bogomolov S, Parker D. Proceedings of the 20th International Conference on Formal Modeling and Analysis of Timed Systems. Cham: Springer, 2022: 221-236.
[18]	Usman M, Gopinath D, Sun Y, et al. NN repair: Constraint-based repair of neural network classifiers[C]// Silva A, Leino K R M.Proceedings of the 33rd International Conference on Computer Aided Verification. Cham: Springer, 2021: 3-25.
[19]	Sun B, Sun J, Pham L H, et al. Causality-based neural network repair[C]// Proceedings of the 2022 IEEE/ACM 44th International Conference on Software Engineering. Piscataway: IEEE Press, 2022: 338-349.
[20]	Shorten C, Khoshgoftaar T M. A survey on image data augmentation for deep learning[J]. Journal of Big Data, 2019, 6(1): 1-48. DOI
[21]	Goodfellow I J, Shlens J, Szegedy C. Explaining and harnessing adversarial examples[DB/OL]. arXiv preprint: 1412.6572, 2014.
[22]	Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks[DB/OL]. arXiv preprint: 1706.06083, 2017.
[23]	Kurakin A, Goodfellow I, Bengio S. Adversarial machine learning at scale[DB/OL]. arXiv preprint: 1611.01236, 2016.
[24]	Tsipras D, Santurkar S, Engstrom L, et al. Robustness may be at odds with accuracy[DB/OL]. arXiv preprint: 1805.12152, 2018.
[25]	Zhang H, Yu Y, Jiao J, et al. Theoretically principled trade-off between robustness and accuracy[C]// Proceedings of the 36th International Conference on Machine Learning. New York: PMLR, 2019: 7472-7482.
[26]	Mirman M, Gehr T, Vechev M. Differentiable abstract interpretation for provably robust neural networks[C]// Proceedings of the 35th International Conference on Machine Learning. New York: PMLR, 2018: 3578-3586.
[27]	Gowal S, Dvijotham K, Stanforth R, et al. On the effectiveness of interval bound propagation for training verifiably robust models[DB/OL]. arXiv preprint: 1810.12715, 2018.
[28]	Zhang H, Chen H, Xiao C, et al. Towards stable and efficient training of verifiably robust neural networks[DB/OL]. arXiv preprint: 1906.06316, 2019.
[29]	Fazlyab M, Robey A, Hassani H, et al. Efficient and accurate estimation of lipschitz constants for deep neural networks[J]. Advances in Neural Information Processing Systems, 2019, 32: 11423-11434.
[30]	Pauli P, Koch A, Berberich J, et al. Training robust neural networks using Lipschitz bounds[J]. IEEE Control Systems Letters, 2021, 6: 121-126. DOI URL
[31]	Gouk H, Frank E, Pfahringer B, et al. Regularisation of neural networks by enforcing Lipschitz continuity[J]. Machine Learning, 2021, 110(2): 393-416. DOI
[32]	Leino K, Wang Z, Fredrikson M. Globally-robust neural networks[C]// Proceedings of the 38th International Conference on Machine Learning. New York: PMLR, 2021: 6212-6222.
[33]	Singh G, Gehr T, Püschel M, et al. An abstract domain for certifying neural networks[J]. Proceedings of the ACM on Programming Languages, 2019, 3(POPL): 1-30.
[34]	Balunovic M, Baader M, Singh G, et al. Certifying geometric robustness of neural networks[J]. Advances in Neural Information Processing Systems, 2019, 32: 15287-15297.
[35]	Su D, Zhang H, Chen H, et al. Is robustness the cost of accuracy? A comprehensive study on the robustness of 18 deep image classification models[C]// Farrari V, Hebert M, Sminchisescu C, et al.Proceedings of the 15th European Conference on Computer Vision. Cham: Springer, 2018: 631-648.
[36]	Xie C, Yuille A, Intriguing properties of adversarial training at scale[DB/OL]. arXiv preprint: 1906.03787, 2019.
[37]	Guo M, Yang Y, Xu R, et al. When NAS meets robustness: In search of robust architectures against adversarial attacks[C]// Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE Press, 2020: 631-640.
[38]	Bender G, Kindermans P J, Zoph B, et al. Understanding and simplifying one-shot architecture search[C]// Proceedings of the 35th International Conference on Machine Learning. New York: PMLR, 2018: 550-559.
[39]	Cai H, Gan C, Wang T, et al. Once-for-all: Train one network and specialize it for efficient deployment[DB/OL]. arXiv preprint: 1908.09791, 2019.
[40]	Xiao K Y, Tjeng V, Shafiullah N M, et al. Training for faster adversarial robustness verification via inducing ReLU stability[DB/OL]. arXiv preprint: 1809.03008, 2018.
[41]	Dvijotham K, Gowal S, Stanforth R, et al. Training verified learners with learned verifiers[DB/OL]. arXiv preprint: 1805.10265, 2018.

类别	定义	应用场景	可解释性	满足难度
分类鲁棒性	正确分类的样本经过扰动后仍可被神经网络正确分类	分类神经网络	高	容易
标准鲁棒性	输入扰动后，网络输出的变化范围在用户指定的范围内	一般神经网络	中	一般
利普希茨鲁棒性	神经网络输出的变化范围与输入的扰动范围存在常数约束	一般神经网络	低	困难

类别	定义	应用场景	可解释性	满足难度
分类鲁棒性	正确分类的样本经过扰动后仍可被神经网络正确分类	分类神经网络	高	容易
标准鲁棒性	输入扰动后，网络输出的变化范围在用户指定的范围内	一般神经网络	中	一般
利普希茨鲁棒性	神经网络输出的变化范围与输入的扰动范围存在常数约束	一般神经网络	低	困难

方法	核心思想	训练要素	适用性	实际效果	方法评价
基于数据增强训练	采样	数据集	高	差	简单易行，但采样得到的对抗样本比例低，该方法实际可行性差
基于攻击样本训练	网络攻击	数据集	高	一般	更高效地寻找对抗样本，但需要的采样（迭代）次数多，效率较低
基于网络验证训练	边界过近似	损失函数	中	好	训练过程同时优化网络准确性和最差鲁棒性违背情况，可行性强
利普希茨鲁棒性训练	网络参数约束	损失函数	低	一般	针对利普希茨鲁棒性，损失函数添加正则化项约束利普希茨常数

方法	核心思想	训练要素	适用性	实际效果	方法评价
基于数据增强训练	采样	数据集	高	差	简单易行，但采样得到的对抗样本比例低，该方法实际可行性差
基于攻击样本训练	网络攻击	数据集	高	一般	更高效地寻找对抗样本，但需要的采样（迭代）次数多，效率较低
基于网络验证训练	边界过近似	损失函数	中	好	训练过程同时优化网络准确性和最差鲁棒性违背情况，可行性强
利普希茨鲁棒性训练	网络参数约束	损失函数	低	一般	针对利普希茨鲁棒性，损失函数添加正则化项约束利普希茨常数

鲁棒神经网络的训练方法研究进展与前景

Advances and Prospects of Training Methods for Robust Neural Networks

RichHTML

PDF

可视化

摘要/Abstract

引用本文

使用本文

图/表 2

参考文献 41

相关文章 0

编辑推荐

Metrics

访问统计

友情链接

联系我们

官方微信公众号