Deep learning achieves state-of-the-art results in many tasks in computer vision and natural language processing. However, recent works have shown that deep networks can be vulnerable to adversarial perturbations, which raised a serious robustness issue of deep networks. Adversarial training, typically formulated as a robust optimization problem, is an effective way of improving the robustness of deep networks. A major drawback of existing adversarial training algorithms is the computational overhead of the generation of adversarial examples, typically far greater than that of the network training. This leads to the unbearable overall computational cost of adversarial training. In this paper, we show that adversarial training can be cast as a discrete time differential game. Through analyzing the Pontryagin's Maximal Principle (PMP) of the problem, we observe that the adversary update is only coupled with the parameters of the first layer of the network. This inspires us to restrict most of the forward and back propagation within the first layer of the network during adversary updates. This effectively reduces the total number of full forward and backward propagation to only one for each group of adversary updates. Therefore, we refer to this algorithm YOPO (You Only Propagate Once). Numerical experiments demonstrate that YOPO can achieve comparable defense accuracy with approximately 1/5 ~ 1/4 GPU time of the projected gradient descent (PGD) algorithm. Our codes are available at https://https://github.com/a1600012888/YOPO-You-Only-Propagate-Once.
翻译:深层次的学习在计算机视觉和自然语言处理的许多任务中取得了最先进的成果。然而,最近的著作表明,深层次的网络很容易受到对抗性干扰,这引起了深层次网络的严肃稳健问题。反向培训通常被视为一个稳健的优化问题,是提高深层次网络的稳健性的有效途径。现有的对抗性培训算法的一大缺点是,生成对抗性实例的计算间接费用,通常远大于网络培训。这导致对抗性培训的总体计算成本难以承受。在本文中,我们表明对抗性培训可以作为一种离散的时间差游戏进行。通过分析Pontryagin's 最大原则(PMP),我们观察到,反向式培训只是与网络第一层的参数相结合的。这激励我们限制网络第一层中的大多数前向和后向传播。在更新时,完全前向和后向传播的总数实际上减少至每一组敌对性更新的总数。因此,我们提到RO/5O的精确度,大约在1号O-NPO上展示了我们的防御性规则。