Utilising the nonlinear nature of RBF, investigate the benefit of replacing fully connected layer by RBF kernels in terms of:
- Classification accuracy;
- Robustness against adversarial attack.
- train a vanilla RBF classifier on CIFAR100 (Le net)
python main.py --mode train --dataset cifar-100 --D_out 100 --model_name vanilla_rbf
- load trained classifier, keep training
python main.py --mode train --load_ckpt True --dataset cifar-100 --D_out 100 -model_name vanilla_rbf
- train a vanilla RBF classifier on Cat v Dog dataset (download from link, unzip and move train and all its content into advRBF/data, rename train as catvdog)
python main.py --mode train --load_ckpt True --dataset catvdog -model_name vanilla_rbf
- train vanilla RBF classifier and run adversarial attack using CIFAR10
python main.py --mode ftt --dataset CIFAR-10 --D_out 10 -model_name vanilla_rbf
main.py: parse arguments, call train/test/attack solver.py: call trainable models (vanilla, vanilla_rbf, attack), run train/test/attack
vanilla.py, vanilla_rbf.py: define NNs rbf.py: define RBF layer, called by vanilla_rbf.py attack.py: define fgsm/i-fgsm data_loader.py: load data for CIFAR10/CIAFAR100/catvdog
Below tables are the pre and post-attack accuracy and loss, measured at testing. All hyperparameters used are as default (eps = 0.02, 10 Gaussian kernels are used in place of fc2)
| Method | Before Attack Accuracy (loss) | After Attack Accuracy (loss) |
|---|---|---|
| Vanilla | 0.64 (1.082) | 0.19 (3.262) |
| RBF | 0.61 (1.088) | 0.16 (3.377) |
| Method | Before Attack Accuracy (loss) | After Attack Accuracy (loss) |
|---|---|---|
| Vanilla | 0.29 (3.021) | 0.10 (4.755) |
| RBF | 0.31 (2.882) | 0.05 (5.855) |
Using less parameters, RBF model beats baseline performance on CIFAR100 but not on CIFAR10, with a penalty of increased vulnerability to gradient-based adversarial attack (FGSM used).
Initial assessment is the Gaussians at fc2 smoothes the piecewise linear function of the vanilla CNN (which uses solely ReLu), and therefore makes it easier for white-box attack to trace the gradient and find efficient attacks.