Bidirectional Learning for Robust Neural Networks

TL;DR

This paper introduces bidirectional learning (BL) techniques to enhance neural network robustness against noise and adversarial attacks, demonstrating improved accuracy and state-of-the-art results on handwritten digit datasets.

Contribution

The paper proposes two novel BL-based methods, bidirectional propagation of errors and hybrid adversarial networks, to improve neural network robustness and accuracy against adversarial and noisy inputs.

Findings

Both methods improve robustness to noise and adversarial examples.

HAN with convolutional architecture achieves state-of-the-art accuracy.

Methods show different benefits depending on architecture and task.

Abstract

A multilayer perceptron can behave as a generative classifier by applying bidirectional learning (BL). It consists of training an undirected neural network to map input to output and vice-versa; therefore it can produce a classifier in one direction, and a generator in the opposite direction for the same data. The learning process of BL tries to reproduce the neuroplasticity stated in Hebbian theory using only backward propagation of errors. In this paper, two novel learning techniques are introduced which use BL for improving robustness to white noise static and adversarial examples. The first method is bidirectional propagation of errors, which the error propagation occurs in backward and forward directions. Motivated by the fact that its generative model receives as input a constant vector per class, we introduce as a second method the hybrid adversarial networks (HAN). Its generative model receives a random vector as input and its training is based on generative adversarial networks (GAN). To assess the performance of BL, we perform experiments using several architectures with fully and convolutional layers, with and without bias. Experimental results show that both methods improve robustness to white noise static and adversarial examples, and even increase accuracy, but have different behavior depending on the architecture and task, being more beneficial to use the one or the other. Nevertheless, HAN using a convolutional architecture with batch normalization presents outstanding robustness, reaching state-of-the-art accuracy on adversarial examples of hand-written digits.