Despite the remarkable performance of deep neural networks on various computer vision tasks, they are known to be susceptible to adversarial perturbations, which makes it challenging to deploy them in real-world safety-critical applications. In this paper, we conjecture that the leading cause of adversarial vulnerability is the distortion in the latent feature space, and provide methods to suppress them effectively. Explicitly, we define \emph{vulnerability} for each latent feature and then propose a new loss for adversarial learning, \emph{Vulnerability Suppression (VS)} loss, that aims to minimize the feature-level vulnerability during training. We further propose a Bayesian framework to prune features with high vulnerability to reduce both vulnerability and loss on adversarial samples. We validate our \emph{Adversarial Neural Pruning with Vulnerability Suppression (ANP-VS)} method on multiple benchmark datasets, on which it not only obtains state-of-the-art adversarial robustness but also improves the performance on clean examples, using only a fraction of the parameters used by the full network. Further qualitative analysis suggests that the improvements come from the suppression of feature-level vulnerability.
Shenzhen Institutes of Advanced Technology（深圳先进技术研究院）；University of Cambridge（剑桥大学）
Making deep convolutional neural networks more accurate typically comes at the cost of increased computational and memory resources. In this paper, we reduce this cost by exploiting the fact that the importance of features computed by convolutional layers is highly input-dependent, and propose feature boosting and suppression (FBS), a new method to predictively amplify salient convolutional channels and skip unimportant ones at run-time. FBS introduces small auxiliary connections to existing convolutional layers. In contrast to channel pruning methods which permanently remove channels, it pres…
PruNeRF: Segment-Centric Dataset Pruning via 3D Spatial Consistency
Korea Advanced Institute of Science and Technology (KAIST)（韩国科学技术院（KAIST））；NAVER AI Lab（NAVER AI实验室）；AI Institute of Seoul National University（首尔国立大学AI研究所）；AITRICS
Uncovering Logit Suppression Vulnerabilities in LLM Safety Alignment
Huazhong University of Science and Technology（华中科技大学）；Nanyang Technological University（南洋理工大学）；University of New South Wales（新南威尔士大学）；Nankai University（南开大学）
Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks
Tsinghua University（清华大学）；Institute for Artificial Intelligence, Tsinghua University（清华大学人工智能研究院）；State Key Lab on Intelligent Technology and Systems, Tsinghua University（清华大学智能技术与系统国家重点实验室）；Department of Computer Science and Technology, Tsinghua University（清华大学计算机科学与技术系）
CleanUMamba: A Compact Mamba Network for Speech Denoising using Channel Pruning
Faculty of Electrical Engineering, Mathematics and Computer Science, Delft University of Technology（电气工程、数学和计算机科学学院，代尔夫特理工大学）；Leiden Institute of Advanced Computer Science (LIACS), Leiden University（先进计算机科学研究所（LIACS），莱顿大学）
We study the role of magnitude structured pruning as an architecture search to speed up the inference time of a deep noise suppression (DNS) model. While deep learning approaches have been remarkably successful in enhancing audio quality, their increased complexity inhibits their deployment in real-time applications. We achieve up to a 7.25X inference speedup over the baseline, with a smooth model performance degradation. Ablation studies indicate that our proposed network re-parameterization (i.e., size per layer) is the major driver of the speedup, and that magnitude structured pruning does …
The vulnerability of deep neural networks against adversarial examples - inputs with small imperceptible perturbations - has gained a lot of attention in the research community recently. Simultaneously, the number of parameters of state-of-the-art deep learning models has been growing massively, with implications on the memory and computational resources required to train and deploy such models. One approach to control the size of neural networks is retrospectively reducing the number of parameters, so-called neural network pruning. Available research on the impact of neural network pruning on…
Boston University（波士顿大学）；Northeastern University（东北大学）；IBM Research（IBM研究院）
Despite achieving remarkable success in various domains, recent studies have uncovered the vulnerability of deep neural networks to adversarial perturbations, creating concerns on model generalizability and new threats such as prediction-evasive misclassification or stealthy reprogramming. Among different defense proposals, stochastic network defenses such as random neuron activation pruning or random perturbation to layer inputs are shown to be promising for attack mitigation. However, one critical drawback of current defenses is that the robustness enhancement is at the cost of noticeable pe…
Oregon State University（俄勒冈州立大学）；Google Brain（谷歌大脑）
Recent increases in the computational demands of deep neural networks (DNNs) have sparked interest in efficient deep learning mechanisms, e.g., quantization or pruning. These mechanisms enable the construction of a small, efficient version of commercial-scale models with comparable accuracy, accelerating their deployment to resource-constrained devices. In this paper, we study the security considerations of publishing on-device variants of large-scale models. We first show that an adversary can exploit on-device models to make attacking the large models easier. In evaluations across 19 DNNs, b…
Corrupting Attention: Evasion-Based Adversarial Attacks on Encoder Attention in Detection Transformers
Queensland University of Technology（昆士兰科技大学）；Agency for Science, Technology and Research, Singapore（新加坡科技研究局）；National University of Singapore（新加坡国立大学）；Indraprastha Institute of Information Technology, Delhi（英迪拉普拉斯塔信息技术学院（德里））
Lipschitz Constant Meets Condition Number: Learning Robust and Compact Deep Neural Networks
Software Engineering Institute, East China Normal University（华东师范大学软件工程学院）；School of Artificial Intelligence, University of Chinese Academy of Sciences（中国科学院大学人工智能学院）；Tianjin University（天津大学）
University of Maryland, College Park（马里兰大学帕克分校）；Vrije Universiteit Amsterdam（阿姆斯特丹自由大学）
Deep neural networks (DNNs) have been shown to tolerate "brain damage": cumulative changes to the network's parameters (e.g., pruning, numerical perturbations) typically result in a graceful degradation of classification accuracy. However, the limits of this natural resilience are not well understood in the presence of small adversarial changes to the DNN parameters' underlying memory representation, such as bit-flips that may be induced by hardware fault attacks. We study the effects of bitwise corruptions on 19 DNN models---six architectures on three image classification tasks---and we show …
