Robust Binary Models by Pruning Randomly-initialized Networks

TL;DR

This paper presents a method to create robust, compact binary neural networks through pruning fixed-initialization models, outperforming existing methods and sometimes surpassing full-precision models in accuracy.

Contribution

It introduces a novel pruning approach for randomly-initialized binary networks that enhances robustness and compactness, confirming the Strong Lottery Ticket Hypothesis under adversarial conditions.

Findings

Outperforms state-of-the-art robust binary networks.

Achieves higher accuracy than full-precision models on some datasets.

Demonstrates structured pruning patterns in binary networks.

Abstract

Robustness to adversarial attacks was shown to require a larger model capacity, and thus a larger memory footprint. In this paper, we introduce an approach to obtain robust yet compact models by pruning randomly-initialized binary networks. Unlike adversarial training, which learns the model parameters, we initialize the model parameters as either +1 or -1, keep them fixed, and find a subnetwork structure that is robust to attacks. Our method confirms the Strong Lottery Ticket Hypothesis in the presence of adversarial attacks, and extends this to binary networks. Furthermore, it yields more compact networks with competitive performance than existing works by 1) adaptively pruning different network layers; 2) exploiting an effective binary initialization scheme; 3) incorporating a last batch normalization layer to improve training stability. Our experiments demonstrate that our approach not only always outperforms the state-of-the-art robust binary networks, but also can achieve accuracy better than full-precision ones on some datasets. Finally, we show the structured patterns of our pruned binary networks.