Abstract
Recent studies have shown that deep neural networks (DNNs) are vulnerable to adversarial attacks. To this end, many defense approaches that attempt to improve the robustness of DNNs have been proposed. In a separate and yet related area, recent works have explored to quantize neural network weights and activation functions into low bit-width to compress model size and reduce computational complexity. In this work,we find that these two different tracks, namely the pursuit of network compactness and robustness, can bemerged into one and give rise to networks of both advantages. To the best of our knowledge, this is the first work that uses quantization of activation functions to defend against adversarial examples. We also propose to train robust neural networks by using adaptive quantization techniques for the activation functions. Our proposed Dynamic Quantized Activation (DQA) is verified through a wide range of experiments with the MNIST and CIFAR-10 datasets under different white-box attack methods, including FGSM, PGD, andC&W attacks. Furthermore, Zeroth Order Optimization and substitute model based black-box attacks are also considered in this work. The experimental results clearly show that the robustness of DNNs could be greatly improved using the proposed DQA.
Abstract (translated)
最近的研究表明，深度神经网络（DNN）容易受到对抗性攻击。为此，已经提出了许多试图改善DNN鲁棒性的防御方法。在一个单独但相关的领域，最近的研究工作已经探索了将神经网络权重和激活函数量化为低位宽以压缩模型大小并降低计算复杂度。在这项工作中，我们发现这两个不同的轨道，即追求网络紧凑性和鲁棒性，可以合并为一体，并产生两种优势的网络。据我们所知，这是第一个使用激活函数量化来抵御对抗性示例的工作。我们还建议通过使用自适应量化技术来激活功能来训练鲁棒神经网络。我们提出的动态量化激活（DQA）通过MNIST和CIFAR-10数据集在不同的白盒攻击方法（包括FGSM，PGD和C＆amp; W攻击）下的广泛实验来验证。此外，在这项工作中还考虑了零阶优化和基于替代模型的黑盒攻击。实验结果清楚地表明，使用提出的DQA可以大大提高DNN的鲁棒性。
URL
https://arxiv.org/abs/1807.06714
