Model Compression with Adversarial Robustness: A Unified Optimization Framework

Shupeng Gui,Haotao Wang,Chen Yu,Haichuan Yang,Zhangyang Wang,Ji Liu
DOI: https://doi.org/10.48550/arXiv.1902.03538
2019-12-29
Abstract:Deep model compression has been extensively studied, and state-of-the-art methods can now achieve high compression ratios with minimal accuracy loss. This paper studies model compression through a different lens: could we compress models without hurting their robustness to adversarial attacks, in addition to maintaining accuracy? Previous literature suggested that the goals of robustness and compactness might sometimes contradict. We propose a novel Adversarially Trained Model Compression (ATMC) framework. ATMC constructs a unified constrained optimization formulation, where existing compression means (pruning, factorization, quantization) are all integrated into the constraints. An efficient algorithm is then developed. An extensive group of experiments are presented, demonstrating that ATMC obtains remarkably more favorable trade-off among model size, accuracy and robustness, over currently available alternatives in various settings. The codes are publicly available at: <a class="link-external link-https" href="https://github.com/shupenggui/ATMC" rel="external noopener nofollow">this https URL</a>.
Machine Learning
What problem does this paper attempt to address?
The problem that this paper attempts to solve is: how to compress the deep neural network model without compromising its robustness against adversarial attacks and while maintaining the accuracy of the model. Existing research usually focuses on compressing the model through various methods (such as pruning, factorization, quantization) to reduce the model size, inference latency and energy consumption, but these methods often overlook whether the compressed model can still resist adversarial attacks. This paper proposes a new framework - Adversarially Trained Model Compression (ATMC). This framework aims to achieve efficient model compression while maintaining or even enhancing its robustness against adversarial attacks by integrating adversarial training and model compression techniques. Specifically, the ATMC framework takes adversarial training as part of the optimization objective and introduces a novel structured compression constraint that combines three mainstream compression methods: pruning, factorization and quantization. Through this framework, the authors develop an effective algorithm to solve this challenging constrained - optimization problem and, through extensive experiments, verify that ATMC can achieve a better balance among model size, accuracy and robustness than existing methods under different settings. This indicates that through the ATMC framework, the model can be effectively compressed and its ability to resist adversarial attacks can be enhanced without sacrificing model performance.