{'fraction_non_alphanumeric': 0.03096032628846867, 'fraction_numerical': 0.013941416388579904, 'mean_word_length': 4.891437308868501, 'pattern_counts': {'":': 0, '<': 2, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 5, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Adversarially Robust Neural Architectures

Deep Neural Network (DNN) are vulnerable to adversarial attack. Existing methods are devoted to developing various robust training strategies or regularizations to update the weights of the neural network. But beyond the weights, the overall structure and information flow in the network are explicitly determined by the neural architecture, which remains unexplored. This paper thus aims to improve the adversarial robustness of the network from the architecture perspective with NAS framework. We explore the relationship among adversarial robustness, Lipschitz constant, and architecture parameters and show that an appropriate constraint on architecture parameters could reduce the Lipschitz constant to further improve the robustness. For NAS framework, all the architecture parameters are equally treated when the discrete architecture is sampled from supernet. However, the importance of architecture parameters could vary from operation to operation or connection to connection, which is not explored and might reduce the confidence of robust architecture sampling. Thus, we propose to sample architecture parameters from trainable multivariate log-normal distributions, with which the Lipschitz constant of entire network can be approximated using a univariate log-normal distribution with mean and variance related to architecture parameters. Compared with adversarially trained neural architectures searched by various NAS algorithms as well as efficient human-designed models, our algorithm empirically achieves the best performance among all the models under various attacks on different datasets.


Introduction
Deep neural networks have shown remarkable performance in various applications, such as image classification [1,2,3], object detection [4], and machine translation [5]. However, recent works [6,7,8,9,10] have shown that DNNs are vulnerable to adversarial samples that can fool the networks to make wrong predictions with only perturbations of the input data, which has caused security issues. To deal with the threat of adversarial samples, the majority of existing works focus on robust training which optimizes the weights of robust DNNs through feeding adversarial samples generated by attack approaches (e.g. FGSM). Although the trained networks show good robustness on various attacks, the architectures of these networks are fixed during optimization, which limits the adversarial robustness improvement. The efficient architectures designed by human experts, such as AlexNet and ResNet [11,3], suggest that the DNN performance is subject to the architecture of network. Recent boosting tures and the adversarial robustness remain unexplored. In this paper, we explore the relationship between adversarial robustness and the architecture of network through establishing their connections to Lipschitz constant under NAS framework. Existing NAS algorithms used to utilize architecture parameters for sampling discrete superior architectures, where all the elements of architecture parameters are equally treated for selection without exploring their discrepancies, which reduces the reliability of sampled architecture and raises a demand for confidence learning of architecture parameters. Thus, we propose to sample architecture parameters from trainable distributions instead of initializing them directly.
Our proposed algorithm Adversarially Robust Neural Architecture Search with Confidence Learning (RACL) starts from the approximation of Lipschitz constant of entire neural network under NAS framework, where we derive the relationship between Lipschitz constant and architecture parameters. We further propose to sample architecture parameters from log-normal distributions. With the usage of the properties of log-normal distribution, we show that the Lipschitz constant of entire network can be approximated with another log-normal distribution with mean and variance related to architecture parameters so that a constraint can be formulated in a form of cumulative function to achieve Lipschitz constraint on the architecture. Our algorithm achieves an efficient robust architecture search and RACL empirically achieves superior adversarial robustness compared with other NAS algorithms as well as state-of-the-art models through a series of experiments under different settings.

Preliminary
Given the input x ∈ R D and annotated label vector y ∈ R M where M is the total number of classes, the neural network N maps perturbed inputx = x+δ to a label vectorŷ = N (x; W, A). The network architecture is represented by A, and its filter weight is denoted as W . The objective of adversarial attacks is to find the perturbed inputx which leads to wrong predictions through maximizing the classification loss asx = argmax where L CE (ŷ, y) = − M i=1 y (i) log(ŷ (i) ), and the perturbation is constrained by its l p -norm. Various powerful attacks have been proposed and shown high attack success rates, such as Fast Gradient Sign Method (FGSM) [13] and Projected Gradient Descent (PGD) [14]. To defend these attacks, regularizing the weight matrix of each layer to form a Lipschitz constrained network has been proven to be beneficial for the adversarial robustness [15,16].
Let F = L • N be the mapping from the input to the classification loss, and the difference of loss after an adversarial attack can be bounded as where λ F is the Lipschitz constant of function F with respect to . p . Together with δ p , the generalization error with perturbed input can be bounded as which suggests that neural networks can defend against adversarial examples with a smaller Lipschitz constant. Given a constraint on λ F , an adversarial robust formulation can be written as min where λ * F is the optimal Lipschitz constant. Existing works often consider a fixed network architecture A in Eq. (4), and focus on optimizing network weight for improved robustness, where the influence of architecture is ignored. Recent studies highlight the importance of architecture. Liu et al. conducts thorough experiments to empirically demonstrate that the better trade-offs of some pruning techniques mainly come from the architecture itself [17]. Boosting NAS algorithms involve optimization on architecture to obtain better performance with small model size [18,19]. We are therefore motivated to investigate the influence of neural architecture on the adversarial robustness.

Lipschitz Constraints in Neural Architecture
The discrete architecture A is determined by both connections and operations, which creates a huge search space. Differentiable Architecture Search algorithms provide an efficient solution through the continuous relaxation of the architecture representation [18,20,21]. Within the differentiable NAS framework, we decompose the entire neural network into cells. Each cell I is a directed acyclic graph (DAG) consisting of an ordered sequence of n nodes, where each node denotes a latent representation which is transformed from two previous latent representations and each edge (i, j) denotes an operation o from a pre-defined search space O which transforms I (i) . Following [19], the architecture parameters α which weighs operations and β which weighs input flows are introduced to form an operation mixture with weighted inputs. The intermediate node is computed as where I (0) and I (1) are fixed as inputs nodes during the searching phase and the last node is formed by channel-wise concatenating of previous intermediate nodes I = ∪ n−1 i=2 I (i) as the output of cell. The entire neural network is constructed through two different types of cells including the normal cell, where all the operations have strides of 1, and the reduction cell, where all the operations have strides of 2. With normal and reduction cells stacked in series, the entire neural network can be formed as N = I 1 • I 2 • · · · • I N • C, where N denotes the number of cells and C denotes the classifier. Following [19], after the searching phase, the operation o with the maximum β (i,j) α (i,j) o for each edge (i, j) is selected and the connection of each node j to its two precedents i < j with maximum β (i,j) α (i,j) o is selected so that a discrete superior architecture can be sampled from the supernet.
We now explore the relationship between architecture parameters α, β and Lipschitz constant of network. Since the entire neural network is constructed by stacking cells in series as [I 1 , I 2 , ..., I N ], Eq. 2 can be further decomposed as as where λ l , λ C and λ(I N ) denote the Lipschitz constants of loss function, classifier and cell I N respectively. By rewriting I N −1 (x) − I N −1 (x) in a format of its previous cells till the input of cell becomes the image for I 1 and considering I 1 (x) − I 1 (x) λ(I 1 ) x − x = λ(I 1 ) δ , Eq. 6 can be unfolded recursively and rewritten as It is obvious that the adversarial robustness can be bounded by the Lipschitz constants of cells. Eq. 7 also suggests that the impact of perturbation grows exponentially with the number of cells, which further highlights the influence of cell designing.
As λ l and λ C in Eq. 7 are not related to the architecture, we next focus on the discussion on λ(I k ). Based on the operation mixture defined in Eq. 5, the variation of node I k . For simplicity of notation, we omit the subscript k and for each node and we have where λ (i,j) denotes the Lipschitz constant of transformation from node i to j and λ o denotes the Lipschitz constant of operation o. Similarly, we can unfold Eq. 8 recursively for entire cell by rewriting in a format of its previous node, and have Through substituting λ(I k ) in Eq. 7 by the one in Eq. 9 and taking λ l and λ C as a unified constant C, the lipschitz constant λ F is bounded by the product of the Lipschitz constant of intermediate nodes as According to the definition, the Lipschitz constant of operations without convolutional layers can be summarized as follows, (1). average pooling: S −0.5 where S denotes the stride of pooling layer, (2). max pooling: 1, (3). identity connection: 1, (4). Zeroize: 0. For the rest operations including depthwise separate conv and dilated depth-wise separate conv, we focus on the L 2 bounded perturbations and according to the definition of spectral norm, the Lipschitz constant of these operations is the spectral norm of its weight matrix where λ o 2 = W o 2 , which also is the maximum singular value of W , marked as Λ 1 . However, directly computing Λ 1 is not practical through gradient descent. The power iteration method can be applied for an efficient approximation of Λ 1 [22]. Note that although the perturbation is L 2 bounded, the robustness against L ∞ can be also achieved, as stated by [23].

Confident Architecture Sampling
The architecture is determined by parameters α and β, which further influence the Lipschitz constants of the network, as shown in Eq. 10. Existing NAS algorithms used to initialize them as trainable parameters without in-depth analysis. However, these weightings on operations or connections naturally could have different levels of importance. E.g., the connection of the first node and the one of the intermediate nodes have different influences on the final performance, but they are treated equally in NAS framework. Instead, we tend to explore the confidence on the architecture parameters by regarding them as variables sampled from distributions during architecture search.
For distributions, a naive selection can be a multivariate normal distribution. However, according to the Lipschitz constant form in Eq. 10, the sampled values from this distribution need to be positive since λ F is always positive. Thus, we turn to log-normal distribution LN since it guarantees positive sampled values. Most importantly, there are several nice properties, including the weighted sum of multiple independent LN 1,...,n can be approximated with another LN and the product of multiple independent LN 1,...,n induces to LN with mean and variance of the sum of those in LN 1,...,n . Thus we propose to sample α from multivariate log-normal distributions, denoted as Back to the Lipschitz constant, the multivariate log-normal distribution over α induces a univariate log-normal distribution over the upper boundary of Lipschitz constant of edge based on the operation mixture o∈O α (i,j) o λ o since it can be treated as the weighted sum of multiple log-normal distributed variables. Note that λ o is treated as constant here since the weights are fixed when optimizing architecture parameters. The is proposed Lipschitz confidence constraint is shown in Fig .1.
Although there is no closed-form expression of its probability density function, the distribution can be approximated using another log-normal distribution following [24] as: , σ 2 I (i,j) ), where λ (i,j) denotes the upper boundary of λ (i,j) . For simplicity, we denote the mean for λ (i,j) as µ I (i,j) and variance as σ 2 I (i,j) . Similarly, we sample β from a multivariate log-normal distribution N (µ β , Σ β ). For variable β (i,j) λ (i,j) , it can be treated as the product of two log-normal distributions, which also follows a log-normal distribution whose mean is the sum of means of two distributions and variance as well. Thus, to generalize the distribution over edge λ (i,j) to the one over intermediate in Eq 11 and obtain the log-normal distribution of λ (j) = i<j β (i,j) λ (i,j) as with mean and variance which are denoted as µ I (j) and σ 2 I (j) . According to Eq. 10, λ F is bounded by the product of λ (j) . Thus, λ F follows the log-normal distribution with mean µ = In(C) + N k n j µ I (j) and variance σ 2 = N k n j σ 2 I (j) . We introduce a confidence hyperparameter η ∈ [0, 1] to enable confidence learning with such an constraint as where λ * is the desired Lipschitz constant of F, Note that in Eq. 13, the variance of λ F is reduced to satisfy the inequality, which strengths the confidence on the approximation of Lipschitz constant of λ F , compared with the one in Eq. 10 without confidence learning. To obtain a convex constraint in µ and Σ, we reformulate Eq. 13 through the format of cumulative function as where Φ denotes the cumulative function of the normal distribution since ln(λ F )−µ σ is a random variable following the normal distribution. Thus, we establish direct relationship among µ, σ and η as Through omitting the square root on σ, we achieve a convex constraint. Together with the objective in Eq. 4, we rewrite the optimization objective as Intuitively, the constraint in Eq. 16 reveals the influence of σ on sampling architecture parameters. As σ increases, the value of µ decreases to satisfy the inequality where the corresponding µ α and µ β becomes 0 for relatively large σ, which implies that the operations or connections are unlikely to be sampled when its corresponding confidence is low. Thus, the architecture can be sampled based on its confidence in the Lipschitz constraint.
We apply the ADMM optimization framework to solve this constrained optimization through incorporating the constraint to form a minimax problem so that Eq. 16 can be rewritten as where θ is the dual variable and ρ is positive number predefined in ADMM. The first step is to update µ while fixing other variables and the second step is to update σ while fixing other variables as where µ α , Σ α , µ β , Σ β are updated through back-propagation. The dual variable θ is updated with learning rate of rho as

Experiments
In this section, we conduct a series of experiments to empirically demonstrate the effectiveness of proposed RACL algorithm. We retrain the searched neural architecture and compare it with various neural architectures searched by NAS algorithms as well as state-of-the-art network architectures. We show that under the same adversarial training setting, the robust neural architectures searched by RACL achieve better robustness than other NAS algorithms.

Experimental Setup
Following previous works [18,19], we search the robust neural architectures on CIFAR-10 dataset which contains 50K training images and 10K validation images over 10 classes. During the searching phase, the training set is divided into two parts with equal size for architecture and weight optimization respectively. The search space includes 8 candidates: 3 × 3 and 5 × 5 separable convolutions, 3 × 3 and 5 × 5 dilated separable convolutions, 3 × 3 max pooling, 3 × 3 average pooling, skip connection, and zero, as suggested by previous works [18,19]. The supernet is constructed by stacking 8 cells including 6 normal cells and 2 reduction cells, each of which contains 6 nodes. For training settings, we followed the setups of PC-DARTS [18]. The searching phase took 50 epochs with a batch size of 128. We used SGD with momentum. The initial learning rate is 0.1 with a momentum of 0.9 and a weight decay is 0.0003 to update the supernet weights. Architecture parameters were updated with Adam with a learning rate of 0.0006 and a weight decay of 0.001. We extensively evaluate the proposed algorithm on three datasets including CIFAR-10, CIFAR-100, and MNIST. The searched superior discrete architecture is sampled based on the proposed sampling strategy and retrained with the entire training set. An illustration of the searched normal cell and reduction cell is shown in Figure  2. Following previous adversarial training algorithms [25,14], we train the searched architectures in an adversarial manner. For CIFAR-10 and CIFAR-100, we use PGD adversarial training with the total perturbation size = 8/255. The number of attack iteration is set to 7 with a step size of 2/255. For MNIST, = 76.5/255 with a step size of 20/255.
Robustness of Architecture with AT We retrain the searched cells using PGD adversarial training for all the models to evaluate the robustness of RACL on the main benchmark of defense mechanisms. The iteration of PGD attack is set to 20 with a step size of 2/255, as suggested by [12]. Although adversarial training is a strong defense method, the impact of architecture is always ignored. In this     [12]. For a fair comparison, we compare RACL with those in RobNet family which have the similar model size as RACL. Compared to RobNet-small and RobNet-medium, RACL consistently achieves the best performance with fewer parameters, which highlights the superiority of proposed RACL algorithm.
Robustness of Architecture without AT We remove the adversarial training and directly retrain the searched cells with clean images to evaluate how different neural architectures influence the robustness. For PGD attacks, the iteration is set to 10 with a step size of /10. As shown in the right part of Table 1, although the adversarial accuracy cannot be competitive, there exists an obvious gap between state-of-the-art cells and adversarially robust cell. E.g., RACL achieves an accuracy of 4.68% with 3.56% improvement over the one of PC-DARTS under MIM attack, which demonstrates that the architecture itself could provide robustness. And the gap can be maintained (49.09% → 54.73%) or even enlarged after adversarial training through comparing the left and right parts of PC-DARTS and RACL, which demonstrates the effectiveness of RACL on adversarial robustness.
Comparison with existing defense mechanisms To illustrate how robust architecture further improves the performance of adversarial training, we compare RACL with previously proposed defense mechanisms on different datasets, including CIFAR-10/100 and MNIST. The perturbation budget is set to 8/255 for CIFAR-10/100 and 76.5/255 for MNIST. Our baseline is PGD-AT since the searched cells are PGD-adversarially retrained as in [14]. RACL is also compared with L2NNN [23] which proposes to control Lipschitz constant to maximize confidence gaps, ADP [29] which introduce the adaptive diversity promoting regularization to encourage diversity for robustness improvement as well as TRADES [28] which proposes a regularization to encourage local Lipschitzness. The results are shown in Table 4. RACL achieves the best performance among all the datasets, which demonstrates the superiority of adversarial training with a robust neural architecture.

Against Black-box Attacks
We next evaluate the robustness of RACL under black-box attacks. Following previous literature [14,30], we apply transfer-based black-box attacks which generate adversarial samples using a victim model and feeds them to the target models. In this paper, we use a VGG-19 network as the victim model and the performances of different models are compared when they are fed with transferred adversarial samples. In Table 2, we show the results of NAS algorithms under different black-box attacks. Compared with NAS algorithms, RACL achieves the highest accuracy under all three black-box attacks, which demonstrates the effectiveness of proposed algorithm.
Following [12], we further conduct the transferability test on CIFAR-10. We use different NAS algorithms as source models to generate adversarial samples through 10-iteration PGD attack and feed them to other target models as cross black-box attack. The results are shown in Table 3. Each row denotes the robustness of different target models under the black-box attack from the same source model. Correspondingly, each column denotes the robustness of a target model under the attack from different source models. Comparing each row, RACL achieves the best accuracy under the attacks from different source models, which highlights the superiority of RACL under black-box settings. Furthermore, through comparing the transferability between each model pair, RACL tends to generate stronger adversarial samples. E.g., ours → AmoebaNet achieves the successful attack success rate of 35.01% and AmoebaNet → ours achieves the successful attack success rate of 30.81%.

Robustness under Various Perturbation Size and Attack Iterations
We further conduct experiments with different white-box attack parameters, including the size of perturbation and the number of iterations. The detailed results are shown in Table 3. Following [12], we strength the adversarial attack through boosting the attack iterations to 100 for PGD attack with step size of 2/255. The comparison with other baselines are shown in Figure 3 [12], RACL achieves better performance with fewer parameters than RobNet-small and RobNet-medium with 0.97% and 0.08% accuracy improvement respectively. Besides attack iterations, we evaluate the adversarial robustness under different perturbation budget. As shown in Figure 3 (b, c), the total perturbation size ranges from 0.01 to 0.07 for both PGD and FGSM attack. Our proposed RACL algorithm always performs better than other baselines under different perturbation budget, which illustrates that RACL can provide stronger defense against various adversarial attacks.

Ablation Analysis
In this section, we conduct ablation studies on the hyperparameters of RACL algorithm as well as confidence learning. The ablation analysis is shown in Table 5. We first remove the confidence learning and applies the constraint in Eq. 10. Comparing the first and last row, the adversarial accuracy obtains a relatively large increment with confidence learning, which highlights the necessity of proposed confident architecture sampling. We then investigate the influence of hyperparameter ρ  and report the performance of searched robust cell on CIFAR-10 under different value of ρ. Through comparison, ρ with a large value could hurt the classification performance on clean images. On the contrary, ρ with small value reduces the influence of Lipschitz constraint and results in inferior adversarial accuracy. The influence of confidence hyperparameter η is also investigated. From Eq. 16, η controls the balance between the mean and variance of Lipschitz constant λ F . Comparing the last two rows, η is set to 0.9 to obtain the best adversarial accuracy.

Related Work
Szegedy et al. first revealed the adversarial samples, which demostrated that neural networks are vulnerable to adversarial attacks [13]. Vast techniques have been introduced to generate adversarial samples in both white-box case where the model is fully accessible [31,8,32,33] and black-box case where adversaries can only query the outputs of the models [34,35,36,37]. Besides classification, adversarial attacks have been applied to other tasks, such as detection and segmentation [38,39].
Recently, more attention has been paid to defense methods which tackle the vulnerability of neural networks through improving the adversarial robustness. Gradient Masking methods hide the gradient information to confound the adversaries [40,41], however, they cannot defend attacks based on approximate gradient [42]. Adversarial training is naturally introduced to defend attacks through feeding adversarial examples into the training stage to form a min-max game where the inner maximum generates adversarial samples to maximize the classification loss and outer minimum optimizes model parameters to minimize the loss. Different attack strategies have been applied to generate adversarial examples for adversarial training, such as PGD attack [14] and FGSM attack [31]. Recently, some regularization methods have been introduced to defend against attacks. [15,16] propose to constrain the Lipschitz constant of network to improve the adversarial robustness.
Although vast approaches have been proposed to defend against adversarial samples, most of them focus on optimizing the weights based on different strategies, and the impact of architecture has been ignored. Recently, neural architecture search has received more and more attention due to its high performance. Early NAS approaches heavily relied on macro searching which directly searches the entire network [43,44]. For efficiency, more NAS approaches have applied micro search space where the cell is searched instead of the entire network and the cells are stacked in series to compose the whole network [45,26]. Recently, some differentiable searching algorithms have been introduced to boost the searching speed through a relaxation on search space to form a supernet with operation mixture to achieve differentiable architecture searching [18,46,19].

Conclusion
In this paper, we propose to tackle the vulnerability of neural networks by incorporating NAS frameworks. Through sampling architecture parameters from trainable log-normal distributions, we show that the approximated Lipschitz constant of the entire network can be formulated as a univariate log-normal distribution, which enables the proposed algorithm, Robust Architecture with Confidence Learning to form confidence learning of architecture parameters on the robustness through a Lipschitz constraint. Thorough experiments demonstrate the influence of architecture on adversarial robustness and the effectiveness of RACL under various attacks on different datasets.