Brain-inspired hyperdimensional computing (HDC) classifiers have been emerging as light-weight machine learning alternatives to deep learning models [1]- [4]. More recently, a low-dimensional computing (LDC) classification framework has been proposed which, compared to traditional HDC-based classification models, improves the inference accuracy and meanwhile dramatically reduces the model size, inference latency and energy consumption by orders of magnitude [5].
Nonetheless, recent studies have shown that HDC-based classifiers are vulnerable to carefully crafted adversarial attacks in both white-box and black-box settings [6]- [9]. In such attacks, the adversarial perturbations introduced to the original input are visually indistinguishable but could make the output label deviate from the ground truth. There has been significant interest in the literature in constructing defenses to protect classification models against adversarial attacks, like obfuscating gradients, defensive distillation and retraining technique [8]- [13]. Unfortunately, these defenses are typically targeted to specific attacks. For example, obfuscating gradient technique takes advantage of gradient masking method and provides certain robustness against white-box iterative optimization attacks [13]- [16]. Thus, these defense techniques were broken soon by subsequent attacking schemes, which then drives the emergence of certified robustness for defenses [17], [18].
Certified defenses provide guarantee of robustness against all possible norm-bounded perturbation attacks. For example, methods proposed in work [19]- [21] alter the network configurations such as the network structure and activation function, which makes them struggle to generalize across different types of networks. Provable robustness technique via random smoothing requires taking the mean of the output vectors, which is susceptible to the outliers and lead to ambiguous outputs [22]- [26]. The study in [18] leverages differential privacy and provides a scheme which requires extra model structure like the separate auto-encoder. Interval bound propagation (IBP) technique bypasses the challenges of these methods. It is comparable to two forward passes through the network, without changing the original network and inducing extra structure [27]- [31].
In this paper, we make the first effort to study provable robustness of LDC models with IBP for classification against adversarial attacks. To obtain a certifiably robust LDC model against L 1 perturbation, the minimum difference between logits of the true class and any other class, called minimum margin, has to be larger than zero for any input perturbation within L 1 norm-bound ball. To this end, IBP is adopted to calculate the lower bound of the minimum margin. An appropriate loss function is defined to guarantee a non-negative value of the lower bound and thus a correct labelling over L 1 norm-bounded perturbed inputs. For evaluation, we train LDC models across a wide range of L 1 perturbation radii, referred to as training perturbation radius, based on both MNIST and fashion MNIST dataset. We also employ the elision technique to make the lower bound of the minimum margin tighter and compare the performance of the trained models in terms of nominal accuracy and verified accuracy. Besides, we implement a powerful white box attacking method, projected gradient descent (PGD), to each of the trained models and demonstrate a drastic reduction in attack success rate from 100% to below 0.1% with IBP robust training. The trained models also exhibit high performance with memory errors existing.
In a nutshell, an LDC classifier maps the encoding and inference process of HDC classifier into an equivalent compact neural network that includes a non-binary neural network for value representation followed by a binary neural network layer for sample encoding and another binary layer for inference. After training, it can extract optimized low-dimensional binary vectors to represent features and values for efficient inference.
We focus on certified robustness of an LDC model for classification tasks. The LDC model can be formulated as a function f ✓ : x ! R C , where the input data is in a normalized N-dimensional subspace x ✓ [0, 1] N . The model provides confidence scores
✓ is the set of trainable parameters of the model, which is trained to minimize the cross-entropy loss.
Specifically, an LDC classifier f ✓ can be equivalently mapped to a 3-stage neural network, including value layer, feature layer and class layer, respectively, as shown in Fig. 1. It can be mathematically represented as follows:
where x 0 ✓ [0, 1] N is the input. z i 0 is the ith dimension of z 0 for i = 1 to N . Bin(z) = sign(z) and Concat(z) is concatenating operation which joins the weighted sum of each item in the input vector into a single output vector. The trainable parameters
Adversarial attacks can be categorized into two settings, targeted attack and untargeted attack. The goal of targeted attack is to mislead the model to classify the adversarial example to an intended target class, y tg , instead of the true class, y true . On the other hand, an untargeted attacker makes the model misclassify the perturbed image as any class, y 0 , other than the original true class, y true . Both attacks can be formulated as bounded perturbation. For given input (x 0 , y true ), the attacker would like to generate a perturbed input A p,✏ (x 0 ) = {x : kx x 0 k p < ✏} such that F ✓ (x) 6 = y true . We use A p,✏ (x 0 ) to denote the perturbed input which is sampled from the region centered at x 0 with ✏ radius, where ✏ represents the perturbation magnitude measured by L p norm for p 1. Common choices of L p are L 1 , L 2 and L 1 .
To certify the robustness of a classifier against norm-bound perturbation, A p,✏ (x 0 ), we need to verify that for any possible perturbed input x 2 A p,✏ (x 0 ) the predicted class is always the true label y true . To achieving this purpose, we define a minimum margin, M (y true , y 0 ), as the minimum prediction logit difference between the true class label y true and any other class y 0 , when the input x is within the L p norm-bounded ball by ✏. 8x 2 A p,✏ (x 0 ) and y 0 6 = y true , we have
where e i is the i th standard basis vector. For any y 0 6 = y true , if we can verify that M (y true , y 0 ) > 0, which means the true label will always has the highest confidence score, f ✓ is certifiably robust at x 0 within radius ✏ with respect to L p norm.
It is highly non-trivial to find the exact minimum margin M (y true , y 0 ) (hereafter M y 0 ) and prove M y 0 > 0. Instead, we could look for a lower bound of M y 0 and control the value inside this bound. To this end, we consider the framework of IBP [27], [32] to train a provably robust LDC classifier to L 1 adversarial perturbation of size ✏ (which is stronger than L p adversarial perturbation with 1 p < 1). IBP is an algorithm that can be used to find a lower bound of the minimum margin M y 0 by bounding the activation z k of each layer. Specifically, it propagates the axis aligned bounding box from layer to layer using interval arithmetic. For L 1 norm-bounded perturbation by ✏, lower bounds and upper bounds of each layer can be represented by the following equations.
where
In LDC, there are three layers, thus k = 0 to 3. h k (z) is the transformation function of k-th layer, which is either affine transformation or element-wise monotonic activation function, Concat(•), Bin(•) and T anh(•). For the affine layer h k (z k 1 ) = W z k 1 + b, obtaining the upper bound and lower bound, i.e. solving the above optimization problem, can be done efficiently with two matrix multiplication as follows:
In the case of an LDC classifier, after propagation, we obtain the upper and lower bounds of the output logits, z3 and z 3 . With the bounds of z 3 and the IBP method for affine layer, a lower bound of minimum margin M y 0 can be computed as For any class label y 0 other than the true label y true , to make the lower bound of minimum margin, M y 0 , larger than 0, we can construct worst case prediction ẑk , where the logit of the true class is equal to its lower bound and the other logits are equal to their upper bound. Note that, if
We then minimize a worst-case cross entropy loss L(ẑ k , y true ) during the training procedure. However, a direct application of worst-case cross entropy loss alone does not work since the propagated bounds are too loose. In reality, As shown in Fig. 1, during training stage, we feed the network with both original training input, z 0 , its upper bound, z0 , and lower bound, z 0 , then minimize a combination of normal crossentropy loss and worst case cross-entropy loss.
where k is a trade-off parameter, which controls the relative weight of robust training versus fitting to the original input images.
Considering the fact that the last layer in LDC network is a linear layer, z 3 = W b 2 z 2 , to make the calculated lower bound of minimum margin, M y 0 , tighter, we elide the bound propagation of the last linear layer:
Thus, minimizing Ŵ z 2 over z 2 z 2 z2 , with Ŵ = (e ytrue e y 0 )W b 2 , gives a tighter lower bound, M e y 0 , of minimum margin M y 0 . By doing so, we could bypass the additional relaxation induced by the last linear layer.
We will present our evaluation results based on MNIST and fashion MNIST datasets in this section. We first discuss the experiment setup. In what follows, the nominal accuracy and verified accuracy are shown for each trained model with different training epsilon. Besides, the robustness results of our trained models against PGD attack and memory cell errors are also presented.
The hyperparameters related to the LDC model architecture follow those in [5], where D v /D f is set to 4/64 to get a good trade-off between good accuracy and a sufficiently small model size. The loss function of the training process uses CrossEntropyLoss(•), and Adam(•) method is adopted as the optimizer following SOTA training strategy for BNN [33]. Even if the Adam(•) method intrinsically adapts the learning rate to each parameter, tuning the initial learning rate and decay scheme for Adam(•) yield significant performance improvement [34]. Thus, we implement grid-search mechanism to find the best initial learning rate and weight decay. Besides, we also adopt exponential learning rate decay with decay rate b) Training: According to Section III, the final loss function to minimize is a combination of normal cross entropy loss and worst case cross entropy loss. The relative importance of the worst case loss is determined by the hyperparameter k. According to literature, it achieves better results by slowly reducing k starting from 1 until 0.5. The same strategy is used for training perturbation radius, staring with 0 and slowly being raised up to the target value. In reality, the total iteration in our experiment is set to 120000 with batch size of 64. During the first 2000 iterations, the model is trained to reduce nominal loss alone, which can be regarded as a warm up period. Starting from the 2000th iteration, the model entered a linearly ramp up phase by gradually decreasing parameter k and increasing the perturbation radius. After 10000 iterations, parameter k and the training perturbation radius settle to 0.5 and the target radius respectively.
We train LDC classifiers using a range of perturbation radii ✏ ✓ {0, 0.02, 0.05, 0.08, 0.1} on both MNIST and fashion MNIST datasets. Note that when training perturbation radius ✏ = 0, the normal training with standard cross-entropy loss is performed. After training, we obtain 5 robust models for each dataset. During testing, we test each of the trained models against adversarial perturbation from 0 to 0.12. We add the test adversarial perturbation to each test image and compute the worst case prediction, based on which we obtain the inference accuracy over the test set, which is called verified accuracy. Note that when test perturbation radius is 0, the nominal test accuracy is obtained, which is called nominal accuracy.
To test the effectiveness of elision technique, we compare the nominal accuracy of five trained models with and without eliding the last layer. Fig. 2(a) presents the results based on MNIST dataset. From the figure we can see the nominal test accuracy of standard LDC model with zero training perturbation radius is around 93%. The red line shows the results when eliding the last layer during IBP procedure. The blue line displays that without elision technique. In both lines, the nominal accuracy is decreasing with the increasing of training perturbation radius. This corroborate that the addition of verification loss deteriorate the ability of the model fitting to the dataset. However, the red line is sliding slower than the blue one. This is because that the elision of the last layer makes the calculated bound tighter and the penalty to the nominal accuracy becomes less severe compared to that of standard IBP method without elision scheme. Similarly, we give the experiment results of nominal accuracy on the basis of fashion MNIST dataset, referring to Fig. 2(b), revealing the akin results.
On the other hand, we demonstrate the verified accuracy of the trained models with standard IBP method without elision of the last layer. We choose a spectrum of test perturbation radii from 0 to 0.12 spaced by 0.02. Fig. 3
We also assess the trained models' robustness against a powerful attack method called PGD. PGD is a white-box attack algorithm which means the attacker has full access to the model, including models' weights and gradients. It is actually an iterative version of FGSM [35]. In our experiment, we calculate the attack success rate (ASR) of PGD method under 200 iterations. Specifically, we use FGSM to introduce adversarial perturbation to each test image, which can be correctly classified by model. We calculate the percentage of images that can be crafted within 200 iterations to mislead the classifier, which is denoted as ASR. To attack a trained model with a specific training ✏, we use the same amount of perturbation ✏ in PGD algorithm. Note that for the model without robust training, the PGD attacking perturbation ✏ is 0.02. We use ASR of PGD to indicate the model robustness.
Fig. 4(a) and fig. 4(b) are the results of PGD to the robust LDC models on the basis of MNIST and fashion MNIST dataset, respectively. From the figure, we can see that for both MNIST and fashion MNIST dataset, PGD can achieve 100% attack success rate attacking the models without robust training. However, to the models trained with IBP, the ASR decrease significantly. PGD fails to attack the models trained with IBP across the full training perturbation spectrum.
LDC classifiers have orders-of-magnitude less dimensions than their HDC counterparts. While the prior study has shown that LDC classifiers are still robust to memory errors in the hardware [5], it is not clear if our novel IBP robust training method will break such robustness and introduce vulnerabilities for LDC classifiers. Thus, in addition to perturbation attacks, we also evaluate the performance of LDC model with IBP robust training in the presence of erroneous memory cells in the hardware. To demonstrate robustness against such hardware errors, we conduct RTL fault simulations where we inject memory bit flips during every clock cycle of execution. In the simulation, we set the probability of failure for each memory cell to be 10 5 , 10 4 , 10 3 , 10 2 , 10 1 , respectively. Fig. 5(a) and Fig. 5(b) present the test accuracy with memory errors. X axis displays the probability of failure for each memory cell in every clock cycle. From the figures we can see that for both MNIST and fashion MNIST dataset, the accuracy diminishes when the training perturbation radius increases. And for each model, the performance maintains a high accuracy when the probability is lower than 10 2 even if the accuracy starts to drop afterwards. Thus, with our robust training, LDC classifiers are still robust against memory errors.
V. CONCLUSION In this paper, we propose IBP to achieve certified robustness for LDC classifiers against all possible L 1 norm-bounded adversarial attacks. Specifically, based on IBP, the worst case prediction logits can be computed based on the upper bound and the lower bound of the output bounding box during training. Thus, by minimizing the loss between the worst case prediction and the true label, the predicted label could be kept invariant over all possible adversarial perturbations within L 1 normbounded ball. We evaluate our algorithm on both MNIST and fashion MNIST datasets, demonstrating that it can withstand projected gradient descent (PGD) attacks.
Authorized licensed use limited to: Northeastern University. Downloaded on September 12,2023 at 17:55:10 UTC from IEEE Xplore. Restrictions apply.