论文标题
改进的基于梯度的对抗性攻击了量化网络
Improved Gradient based Adversarial Attacks for Quantized Networks
论文作者
论文摘要
由于在量化网络上的位操作导致的有效记忆力和更快的计算，神经网络量化变得越来越流行。即使它们具有出色的概括功能，它们的稳健性也不是很好的理解。在这项工作中，我们系统地研究了量化网络对基于梯度的对抗攻击的鲁棒性，并证明这些量化模型遭受了梯度消失的问题并显示出虚假的鲁棒性感。通过将梯度消失在受过训练的网络中的较差的前向信号传播中，我们引入了一种简单的温度缩放方法来减轻此问题，同时保留决策界限。尽管对现有基于梯度的对抗攻击进行了简单修改，但对具有多个网络体系结构的多个图像分类数据集进行了实验，表明我们的温度缩放攻击获得了量化网络上的接近完美的成功率，同时胜过对对抗训练的模型以及浮动点网络的原始攻击。代码可从https://github.com/kartikgupta-at-anu/attack-bnn获得。
Neural network quantization has become increasingly popular due to efficient memory consumption and faster computation resulting from bitwise operations on the quantized networks. Even though they exhibit excellent generalization capabilities, their robustness properties are not well-understood. In this work, we systematically study the robustness of quantized networks against gradient based adversarial attacks and demonstrate that these quantized models suffer from gradient vanishing issues and show a fake sense of robustness. By attributing gradient vanishing to poor forward-backward signal propagation in the trained network, we introduce a simple temperature scaling approach to mitigate this issue while preserving the decision boundary. Despite being a simple modification to existing gradient based adversarial attacks, experiments on multiple image classification datasets with multiple network architectures demonstrate that our temperature scaled attacks obtain near-perfect success rate on quantized networks while outperforming original attacks on adversarially trained models as well as floating-point networks. Code is available at https://github.com/kartikgupta-at-anu/attack-bnn.
