Robust low-rank training via approximate orthonormal constraints

Summary

This work demonstrates that conventional low-rank training methods suffer from poor adversarial robustness, which is hypothesized to stem from ill conditioning of weight matrices during training. The authors address this by constraining low-rank weight matrices to be approximately orthogonal.

Strengths

I found this paper to be a solid contribution, although my lack of familiarity with low-rank approaches means I'm not exactly sure which parts of the paper are novel. 1. The observation in Figure 1 that low-rank training methods lead to exploding conditioning numbers is quite interesting and is not something I have seen before in the literature. 2. The empirical gains in the experimental section are substantial, even if only using a FGSM atatck. 3. The paper is very well-written and organized, with clear explanations and visualizations. 4. The approximation guarantee is a nice inclusion of theory to explain the numerical advantages of avoiding high-curvature stiffness points.

Weaknesses

5. The observation behind S1 was left unexplained: why do low-rank constrained matrices lead to large condition numbers? This might be out of scope but felt somewhat unsatisfying. 6. The empirical evaluations only used the fast gradient sign method, which is a weak attack. This is my biggest reason for not giving an full accept rating -- I'd like to at least see PGD on this problem, although the results for FGSM are reasonably convincing.

Questions

7. Precisely which parts of the algorithm in 4.2 are original? My impression is that the main contribution is step (4), the projection onto $\Sigma_s(\epsilon)$. 8. In proposition 1, X is referred to as the "feature space" -- is this a deliberate deviation from the more standard terminology of "input space"? Or am I missing something here. 9. Related to question 2, I'm a little confused about the notation in Proposition 1. The $cond(f; x)$ definition boils down to the function $f$ taking $x$ as an input; proposition 1 uses $cond(\sigma_i; x)$, even though $\sigma_i$ is at an intermediate layer in the network and does not directly take $x$ as an argument. My interpretation would be that this should read $\cond(\sigma_i, W_i z_i)$. It doesn't really affect anything downstream as we're just taking the sup over the argument to the condition number anyways, but the notation seems a bit imprecise to me as on the LHS of the inequality we're taking the sup over caligraphic X representing the input space, and on the right hand side it's the sup over caligraphic X representing the feature space, I feel that each intermediate feature space should have its own notation $X_i$ or something of the sort. 10. In 157 the condition number for logistic sigmoid requires nonnegative features, which does not seem to be satisfied in general for intermediate neural network layers. 11. In theorem 1, what is the significance of the phrase "assuming no numerical errors" -- is this referring to rounding errors, or something more serious like non-invertibility of a matrix during execution? 12. The definition of relative error in equation (1) doesn't sit perfectly right with me, as it is dependent on the normalization of the inputs. If all inputs were shifted by some large amount, the relative error would increase although nothing important about the data has changed. Also, the relative error at x=0 is always zero (or undefined?) which doesn't make a lot of sense to me. Would appreciate any clarity here.

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

4 excellent

Presentation

4 excellent

Contribution

3 good

Limitations

Limitations are explicitly addressed in section 4.2.

Summary

This paper proposes a training approach that can improve the robustness of low-rank DNN models from scratch. This method enforces the low-rank components onto the Stifel manifold and ensures well-conditioning to achieve robustness. Experimental results show that the proposed training method demonstrates robustness to the data perturbation.

Strengths

+ The robustness of low-rank format DNN models is an important topic because it can improve the security of efficient DNN models. + Training low-rank models without initializing from a pre-trained dense model is also important to save energy costs. + This paper provides much theoretical stuff.

Weaknesses

- The contribution is incremental. Improving the robustness of a compressed model using condition number is already proposed in [R1]. The main contribution of this paper is to re-apply it to low-rank formats. Improving the robustness of low-rank DNN models is also investigated in [R2]. - The motivation why using conditioning numbers in low-rank scenarios is unclear. - This paper leverages Riemannian optimization to enforce the orthogonality of the left and right components, $U$ and $V$. However, this optimization algorithm contains a lot of matrix multiplications, which are extremely costly. The overall computational cost is overhead, so the proposed method is opposite to the meaning of low-rank training, which aims to save training FLOPs. - In terms of the compression approach, why should we choose low-rankness? The overall performance of robustness and compression ratio is better than sparsity or other trends of compression techniques? This paper does not compare with any other related works like [R1] in experiments. - The dataset and selected models in experiments are trivial. Lager datasets like ImageNet and advanced models like ResNet-50 and MobileNet should be tested. [R1] Learning Extremely Lightweight and Robust Model with Differentiable Constraints on Sparsity and Condition Number [R2] On the Effect of Low-Rank Weights on Adversarial Robustness of Neural Networks

Questions

See Weaknesses.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.

Soundness

2 fair

Presentation

2 fair

Contribution

2 fair

Limitations

N/A

Summary

In this paper, the authors propose a low-rank training algorithm that incorporates approximate orthonormal constraints. Through a comparative analysis with previous methods for training orthonormal neural networks, the experimental results demonstrate the superiority of the proposed algorithm.

Strengths

1. An algorithm was introduced to ensure that the condition number of weight matrices remains close to $1$ during the training process. 2. Comprehensive experimental results were provided in the main paper.

Weaknesses

1. Some terminologies are not defined. 2. While the theoretical analysis provides some insights, it may not fully capture the advantages of the algorithm.

Questions

1. Some terminologies are not pre-defined. For instance, concepts like the Stiefel manifold and tangent space may be unfamiliar to readers who have not previously explored low-dimensional spaces. Moreover, it is crucial to establish definitions for significant notations beforehand. 2. Theorem 1 establishes that the estimated matrices are closely aligned with the noisy target matrices. Nevertheless, in practical implementations, our main concern lies in the error between the estimated output and the target output. While it is possible to prove that an individual estimated weight matrix is close to its target counterpart, it does not directly guarantee that the final error won't exponentially grow as a result of multiple products and layers. Therefore, it might be worthwhile to explore how the significance of this theorem can be introduced in light of addressing the overall error in the system, considering the cumulative effects of multiple products and layers. 3. There is a missing $.$ in Eqn.(1).

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

N/A

Summary

Some work has used low-rank matrix factorizations in order to reduce training and inference costs. However, the authors demonstrate that these low-rank models are actually more brittle, i.e., susceptible to adversarial perturbations -- they tend to have large/exploding singular values. Consequently, the authors propose a technique to train low-rank networks while constraining the condition number, alleviating this problem.

Strengths

- The paper triangulates a well-defined problem and proposes an effective solution -- the paper was generally quite clear and well-motivated - Demonstrates the method works in practical experience and also via an approximation theorem - Investigation of exploding singular values in low-rank networks - Comparisons for a variety of compression ratios / perturbation magnitudes - Good explanation of background and related work

Weaknesses

- Would be good to substantiate "improving the network robustness without affecting training nor inference costs" -- it's not obvious this is true to me since the method involves, e.g., projection onto the Stiefel manifold - A conclusion would be nice -- I think you could save space by removing the definition of robust accuracy, which readers probably know

Questions

This is minor, but why did you only produce perturbations with FGSM as opposed to, e.g., PGD? I'd be curious how your compressed models withstand somewhat more powerful adversaries.

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

The authors have adequately addressed limitations, e.g., noting that they introduce a new hyperparameter that may have to be tuned.

Summary

A brief summary of the paper is as follows: - Motivation: Make deep neural networks more efficient while maintaining robustness to adversarial attacks. - The authors propose a combined low-rank and approximate orthonormalisation constraint to help simultaneous model conditioning and compression during training. - The results show that both accuracy and adversarial robustness remain high. It is well written and tackles an important problem, however it is missing references and comparisons to key existing works.

Strengths

The main strength of this paper lies in the writing and the novelty of the approach. Optimizing the low-rank decompositions alongside an orthonormal constraint is a very interesting approach that deserves an in-depth study. Preventing explosion of singular values is important and an interesting research direction that will be of value beyond low-rank neural networks and adversarial attacks. After addressing the weaknesses of this paper, the strengths can make this paper into a very complete piece of work.

Weaknesses

- Paper does not mention previous studies that approach this same problem: adversarial robustness with low-rank constraints. [1] introduces tensor dropout, a method of increasing robustness (including robustness to adversarial attacks) using a stochastic dropout mechanism in the learned weight decompositions. It would be good to get a comparison to that baseline or at the very least a discussion of the similarities and differences between the approaches. - More discussion of the results and method would be good. There a number of questions that arise with this work that remain unanswered. Even though answering all of them might be out of scope for a single paper, it would be worth having the authors discuss more aspects of the approach they introduce here. I refer to my list of questions below, all of which would be interesting discussion points where the pros and cons of different decisions can be weighted. - The paper is missing a well-defined conclusion. That means the paper ends abruptly without comment on the impact of this work and what the authors see as possible next steps. [1] Kolbeinsson, A., Kossaifi, J., Panagakis, Y., Bulat, A., Anandkumar, A., Tzoulaki, I., & Matthews, P. M. (2021). Tensor dropout for robust learning. IEEE Journal of Selected Topics in Signal Processing, 15(3), 630-640.

Questions

These are questions that I have for the authors but I highly recommend they consider expanding the discussion and limitations part of their paper. They could touch on these points. - In the end of the abstract it is stated that "This is shown by extensive numerical evidence and by our main approximation theorem that shows the computed robust low-rank network well-approximates the ideal full model, provided a highly performing low-rank sub-network exists." My question is: is it possible to check if a highly performing subnetwork exists, and does the orthonormal constraint affect the group of available subnetworks? - Related, how is the r parameter selected? Any suggestions for practice? - “Works only for wide enough networks” How wide is enough? - What is the added computational complexity of the new optimization? What is the time/memory cost relationship between the low-rank and the full network? - Why are VGG16 tested instead of the more common Resnets? - What attack is used for the adversarial experiments? - How sensitive is the method to choice of r?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

2 fair

Contribution

3 good

Limitations

The paper has a brief discussion on the limitations but this should be expanded to greatly improve the paper. Getting more candid explanations and thoughts on the limitations from the authors themselves would be welcomed. Possible discussion points would be the sensitivity to parameter r (related to compression ratio). This is a trade off between performance and computation and can be different for different applications, however it is important to know the scope of available r values. Another very interesting limitation is the additional time cost of this method, specifically in relation to the additional optimization steps that need to be done. What is the relative added computation of this? A discussion of what conditions are needed for this optimization is of value would be very welcome.

Reply to authors

I thank the reviewers for their response. Similar to them, I am surprised to see that they consider a missing conclusion, missing references and missing details on complexity to be minor points. I consider them quite important, hence my score. I also believe the authors misinterpreted the reason I highlighted the missing references. That is likely due to my comment not being clear enough. The work presented here and reference [1] in my previous comment are not methodologically very similar, however it is important to acknowledge related work (even if the approach is not comparable) when making statements such as "However, their [low-rank weights parametrization models'] robustness with respect to adversarial perturbations has been largely unexplored so far." is not representative without full acknowledgement. To be very clear, the methodology of this work and that in [1] do not overlap so that it raises any special concerns over novelty. They simply exist in the same domain: using low-rank networks to improve adversarial robustness. With the conclusion added, complete references for related work and the seven loose ends that I questioned in my review all amended, I am prepared to upgrade my score.