随着深度学习的快速发展，神经网络的大小变得越来越大，以使培训和推理经常压倒硬件资源。鉴于神经网络通常被过度参数化，减少这种计算开销的一种有效方法是神经网络修剪，通过删除训练有素的神经网络中的冗余参数。最近观察到，修剪不仅可以减少计算开销，而且可以改善深神经网络（NNS）的经验鲁棒性，这可能是由于消除了虚假相关性的同时保留了预测精度。本文首次证明，修剪通常可以在完整的验证设置下改善基于RELU的NN的认证鲁棒性。使用流行的分支机构（BAB）框架，我们发现修剪可以通过减轻线性放松和子域分裂问题来增强认证稳健性验证的估计结合紧密度。我们通过现成的修剪方法验证了我们的发现，并进一步提出了一种基于稳定性的新修剪方法，该方法量身定制了用于减少神经元不稳定性的新方法，该方法在增强认证的鲁棒性方面优于现有的修剪方法。我们的实验表明，通过适当修剪NN，在标准培训下，其认证准确性最多可提高8.2％，在CIFAR10数据集中的对抗培训下最多可提高24.5％。我们还观察到存在经过认证的彩票票，这些彩票可以符合不同数据集的原始密集型号的标准和认证的稳健精度。我们的发现提供了一个新的角度来研究稀疏性与鲁棒性之间的有趣相互作用，即通过神经元稳定性解释稀疏性和认证鲁棒性的相互作用。代码可在以下网址提供：https：//github.com/vita-group/certifiedpruning。

可认证的鲁棒性是在安全至关重要的情况下采用深层神经网络（DNN）的高度理想的属性，但通常需要建立乏味的计算。主要障碍在于大型DNN中的大量非线性。为了权衡DNN表现力（要求更多的非线性）和鲁棒性认证可伸缩性（更喜欢线性性），我们提出了一种新颖的解决方案来通过“授予”适当的线性水平来策略性地操纵神经元。我们建议的核心是首先将无关紧要的依赖神经元线性化，以消除既有用于DNN性能的多余的非线性组件，又对其认证有害。然后，我们优化替换线性激活的相关斜率和截距，以恢复模型性能，同时保持认证性。因此，典型的神经元修剪可以被视为一种特殊情况，即授予固定零斜率和截距的线性功能，这可能过于限制网络灵活性并牺牲其性能。在多个数据集和网络骨架上进行的广泛实验表明，我们的线性嫁接可以有效地收紧认证界限； （2）在没有认证的鲁棒培训的情况下实现竞争性认证的鲁棒性（即CIFAR-10型号的30％改进）； （3）将完整的验证扩展到具有17m参数的大型对抗训练的模型。代码可在https://github.com/vita-group/linearity-grafting上找到。

The compute-intensive nature of neural networks (NNs) limits their deployment in resource-constrained environments such as cell phones, drones, autonomous robots, etc. Hence, developing robust sparse models fit for safety-critical applications has been an issue of longstanding interest. Though adversarial training with model sparsification has been combined to attain the goal, conventional adversarial training approaches provide no formal guarantee that the models would be robust against any rogue samples in a restricted space around a benign sample. Recently proposed verified local robustness techniques provide such a guarantee. This is the first paper that combines the ideas from verified local robustness and dynamic sparse training to develop `SparseVLR'-- a novel framework to search verified locally robust sparse networks. Obtained sparse models exhibit accuracy and robustness comparable to their dense counterparts at sparsity as high as 99%. Furthermore, unlike most conventional sparsification techniques, SparseVLR does not require a pre-trained dense model, reducing the training time by 50%. We exhaustively investigated SparseVLR's efficacy and generalizability by evaluating various benchmark and application-specific datasets across several models.

由于稀疏神经网络通常包含许多零权重，因此可以在不降低网络性能的情况下潜在地消除这些不必要的网络连接。因此，设计良好的稀疏神经网络具有显着降低拖鞋和计算资源的潜力。在这项工作中，我们提出了一种新的自动修剪方法 - 稀疏连接学习（SCL）。具体地，重量被重新参数化为可培训权重变量和二进制掩模的元素方向乘法。因此，由二进制掩模完全描述网络连接，其由单位步进函数调制。理论上，从理论上证明了使用直通估计器（STE）进行网络修剪的基本原理。这一原则是STE的代理梯度应该是积极的，确保掩模变量在其最小值处收敛。在找到泄漏的Relu后，SoftPlus和Identity Stes可以满足这个原理，我们建议采用SCL的身份STE以进行离散面膜松弛。我们发现不同特征的面具梯度非常不平衡，因此，我们建议将每个特征的掩模梯度标准化以优化掩码变量训练。为了自动训练稀疏掩码，我们将网络连接总数作为我们的客观函数中的正则化术语。由于SCL不需要由网络层设计人员定义的修剪标准或超级参数，因此在更大的假设空间中探讨了网络，以实现最佳性能的优化稀疏连接。 SCL克服了现有自动修剪方法的局限性。实验结果表明，SCL可以自动学习并选择各种基线网络结构的重要网络连接。 SCL培训的深度学习模型以稀疏性，精度和减少脚波特的SOTA人类设计和自动修剪方法训练。

The deployment of deep convolutional neural networks (CNNs) in many real world applications is largely hindered by their high computational cost. In this paper, we propose a novel learning scheme for CNNs to simultaneously 1) reduce the model size; 2) decrease the run-time memory footprint; and 3) lower the number of computing operations, without compromising accuracy. This is achieved by enforcing channel-level sparsity in the network in a simple but effective way. Different from many existing approaches, the proposed method directly applies to modern CNN architectures, introduces minimum overhead to the training process, and requires no special software/hardware accelerators for the resulting models. We call our approach network slimming, which takes wide and large networks as input models, but during training insignificant channels are automatically identified and pruned afterwards, yielding thin and compact models with comparable accuracy. We empirically demonstrate the effectiveness of our approach with several state-of-the-art CNN models, including VGGNet, ResNet and DenseNet, on various image classification datasets. For VGGNet, a multi-pass version of network slimming gives a 20× reduction in model size and a 5× reduction in computing operations.

Structural pruning of neural network parameters reduces computation, energy, and memory transfer costs during inference. We propose a novel method that estimates the contribution of a neuron (filter) to the final loss and iteratively removes those with smaller scores. We describe two variations of our method using the first and secondorder Taylor expansions to approximate a filter's contribution. Both methods scale consistently across any network layer without requiring per-layer sensitivity analysis and can be applied to any kind of layer, including skip connections. For modern networks trained on ImageNet, we measured experimentally a high (>93%) correlation between the contribution computed by our methods and a reliable estimate of the true importance. Pruning with the proposed methods leads to an improvement over state-ofthe-art in terms of accuracy, FLOPs, and parameter reduction. On ResNet-101, we achieve a 40% FLOPS reduction by removing 30% of the parameters, with a loss of 0.02% in the top-1 accuracy on ImageNet. Code is available at https://github.com/NVlabs/Taylor_pruning.

最近的几项著作从经验上发现，鉴定学习率对于神经网络结构修剪的最终表现至关重要。进一步的研究发现，网络训练性通过修剪答案而破坏，因此呼吁迫切需要在填充之前恢复训练性。现有的尝试建议利用重量正交化以实现动态等轴测图，以提高训练性。但是，它们仅适用于线性MLP网络。如何开发一种维护或恢复可训练性并且可扩展到现代深网的过滤器修剪方法仍然难以捉摸。在本文中，我们提出了维护修剪（TPP）的训练性，这是一种基于正则化的结构化修剪方法，可以有效地维持稀疏期间的训练性。具体而言，TPP将卷积内核的革兰氏矩阵正规化，以从保存的过滤器中解除修剪过滤器。除了卷积层外，我们还建议将BN参数正规化，以更好地保留训练性。从经验上讲，TPP可以与线性MLP网络上的基地真相动力学恢复方法竞争。在非线性网络（RESNET56/VGG19，CIFAR数据集）上，它的表现优于其他对应解决方案。此外，与许多表现最好的滤镜修剪方法相比，TPP还可以在ImageNet上与现代深层网络（RESENET）有效地工作，从而提供了令人鼓舞的性能。据我们所知，这是第一种在大规模深度神经网络修剪过程中有效维持训练性的第一种方法。

深度神经网络（DNN）的巨大进步导致了各种任务的最先进的性能。然而，最近的研究表明，DNNS容易受到对抗的攻击，这在将这些模型部署到自动驾驶等安全关键型应用时，这使得非常关注。已经提出了不同的防御方法，包括：a）经验防御，通常可以在不提供稳健性认证的情况下再次再次攻击; b）可认真的稳健方法，由稳健性验证组成，提供了在某些条件下的任何攻击和相应的强大培训方法中的稳健准确性的下限。在本文中，我们系统化了可认真的稳健方法和相关的实用和理论意义和调查结果。我们还提供了在不同数据集上现有的稳健验证和培训方法的第一个全面基准。特别是，我们1）为稳健性验证和培训方法提供分类，以及总结代表性算法的方法，2）揭示这些方法中的特征，优势，局限性和基本联系，3）讨论当前的研究进展情况TNN和4的可信稳健方法的理论障碍，主要挑战和未来方向提供了一个开放的统一平台，以评估超过20种代表可认真的稳健方法，用于各种DNN。

Many applications require sparse neural networks due to space or inference time restrictions. There is a large body of work on training dense networks to yield sparse networks for inference, but this limits the size of the largest trainable sparse model to that of the largest trainable dense model. In this paper we introduce a method to train sparse neural networks with a fixed parameter count and a fixed computational cost throughout training, without sacrificing accuracy relative to existing dense-tosparse training methods. Our method updates the topology of the sparse network during training by using parameter magnitudes and infrequent gradient calculations. We show that this approach requires fewer floating-point operations (FLOPs) to achieve a given level of accuracy compared to prior techniques. We demonstrate state-of-the-art sparse training results on a variety of networks and datasets, including ResNet-50, MobileNets on Imagenet-2012, and RNNs on WikiText-103. Finally, we provide some insights into why allowing the topology to change during the optimization can overcome local minima encountered when the topology remains static * .

当与分支和界限结合使用时，结合的传播方法是正式验证深神经网络（例如正确性，鲁棒性和安全性）的最有效方法之一。但是，现有作品无法处理在传统求解器中广泛接受的切割平面限制的一般形式，这对于通过凸出凸松弛的加强验证者至关重要。在本文中，我们概括了结合的传播程序，以允许添加任意切割平面的约束，包括涉及放宽整数变量的限制，这些变量未出现在现有的结合传播公式中。我们的广义结合传播方法GCP-crown为应用一般切割平面方法}开辟了一个机会进行神经网络验证，同时受益于结合传播方法的效率和GPU加速。作为案例研究，我们研究了由现成的混合整数编程（MIP）求解器生成的切割平面的使用。我们发现，MIP求解器可以生成高质量的切割平面，以使用我们的新配方来增强基于界限的验证者。由于以分支为重点的绑定传播程序和切削平面的MIP求解器可以使用不同类型的硬件（GPU和CPU）并行运行，因此它们的组合可以迅速探索大量具有强切割平面的分支，从而导致强大的分支验证性能。实验表明，与VNN-Comp 2021中最佳工具相比，我们的方法是第一个可以完全求解椭圆形的基准并验证椭圆21基准的两倍的验证者，并且在oval21基准测试中的最佳工具也明显超过了最先进的验证器。广泛的基准。 GCP-Crown是$ \ alpha $，$ \ beta $ -Crown验证者，VNN-COMP 2022获奖者的一部分。代码可在http://papercode.cc/gcp-crown上获得

基于基于不完整的神经网络验证如冠的绑定传播非常有效，可以显着加速基于神经网络的分支和绑定（BAB）。然而，绑定的传播不能完全处理由昂贵的线性编程（LP）求解器的BAB常规引入的神经元分割限制，导致界限和损伤验证效率。在这项工作中，我们开发了一种基于$ \ beta $ -cra所做的，一种基于新的绑定传播方法，可以通过从原始或双空间构造的可优化参数$ \ beta $完全编码神经元分割。当在中间层中联合优化时，$ \ Beta $ -CROWN通常会产生比具有神经元分裂约束的典型LP验证更好的界限，同时像GPU上的皇冠一样高效且并行化。适用于完全稳健的验证基准，使用BAB的$ \ Beta $ -CROWN比基于LP的BAB方法快三个数量级，并且比所有现有方法更快，同时产生较低的超时率。通过早期终止BAB，我们的方法也可用于有效的不完整验证。与强大的不完整验证者相比，我们始终如一地在许多设置中获得更高的验证准确性，包括基于凸屏障破碎技术的验证技术。与最严重但非常昂贵的Semidefinite编程（SDP）的不完整验证者相比，我们获得了更高的验证精度，验证时间较少三个级。我们的算法授权$ \ alpha，\ \β$ -craft（Alpha-Beta-Crown）验证者，VNN-Comp 2021中的获胜工具。我们的代码可在http://papercode.cc/betacrown提供

最近的作品试图通过对比原始扰动大的域进行攻击，并在目标中增加各种正则化项，从而提高受对抗训练的网络的验证性。但是，这些算法表现不佳或需要复杂且昂贵的舞台训练程序，从而阻碍了其实际适用性。我们提出了IBP-R，这是一种新颖的经过验证的培训算法，既简单又有效。 IBP-R通过基于廉价的间隔结合传播对扩大域的对抗域进行对抗性攻击来诱导网络可验证性，从而最大程度地减少了非凸vex验证问题与其近似值之间的差距。通过利用最近的分支机构和结合的框架，我们表明IBP-R获得了最先进的核能 - 智能权准折衷，而在CIFAR-10上进行了小型扰动，而培训的速度明显快于相关的先前工作。此外，我们提出了一种新颖的分支策略，该策略依赖于基于$ \ beta $ crown的简单启发式，可降低最先进的分支分支算法的成本，同时产生可比质量的分裂。

卷积神经网络（CNNS）在许多实际应用中成功了。但是，它们的高计算和存储要求通常使它们难以在资源受限的设备上部署。为了解决这个问题，已经提出了许多修剪算法用于CNN，但大多数人不能将CNNS提交给合理的水平。在本文中，我们提出了一种基于递归最小二乘（RLS）优化的训练和修剪CNN的新颖算法。在为某些时期培训CNN之后，我们的算法组合了逆输入自相关矩阵和权重矩阵，以按层评估和修剪不重要的输入通道或节点层。然后，我们的算法将继续培训修剪的网络，并且在修剪的网络恢复旧网络的完整性能之前，不会进行下一次修剪。此外，对于CNN，所提出的算法可用于前馈神经网络（FNN）。在MNIST，CIFAR-10和SVHN数据集上的三个实验表明，我们的算法可以实现更合理的修剪，并且具有比其他四个流行的修剪算法更高的学习效率。

经认证的稳健性是安全关键应用中的深度神经网络的理想性质，流行的训练算法可以通过计算其Lipschitz常数的全球界限来认证神经网络的鲁棒性。然而，这种界限往往松动：它倾向于过度规范神经网络并降低其自然精度。绑定的Lipschitz绑定可以在自然和认证的准确性之间提供更好的权衡，但通常很难根据网络的非凸起计算。在这项工作中，我们通过考虑激活函数（例如Relu）和权重矩阵之间的相互作用，提出了一种有效和培训的\ emph {本地} Lipschitz上限。具体地，当计算权重矩阵的诱发标准时，我们消除了相应的行和列，其中保证激活函数在每个给定数据点的邻域中是常数，它提供比全局Lipschitz常数的可怕更严格的绑定神经网络。我们的方法可用作插入式模块，以拧紧在许多可认证的训练算法中绑定的Lipschitz。此外，我们建议夹住激活功能（例如，Relu和Maxmin），具有可读的上限阈值和稀疏性损失，以帮助网络实现甚至更严格的本地嘴唇尖端。在实验上，我们表明我们的方法始终如一地优于Mnist，CiFar-10和Tinyimagenet数据集的清洁和认证准确性，具有各种网络架构的清洁和认证的准确性。

While machine learning is traditionally a resource intensive task, embedded systems, autonomous navigation, and the vision of the Internet of Things fuel the interest in resource-efficient approaches. These approaches aim for a carefully chosen trade-off between performance and resource consumption in terms of computation and energy. The development of such approaches is among the major challenges in current machine learning research and key to ensure a smooth transition of machine learning technology from a scientific environment with virtually unlimited computing resources into everyday's applications. In this article, we provide an overview of the current state of the art of machine learning techniques facilitating these real-world requirements. In particular, we focus on deep neural networks (DNNs), the predominant machine learning models of the past decade. We give a comprehensive overview of the vast literature that can be mainly split into three non-mutually exclusive categories: (i) quantized neural networks, (ii) network pruning, and (iii) structural efficiency. These techniques can be applied during training or as post-processing, and they are widely used to reduce the computational demands in terms of memory footprint, inference speed, and energy efficiency. We also briefly discuss different concepts of embedded hardware for DNNs and their compatibility with machine learning techniques as well as potential for energy and latency reduction. We substantiate our discussion with experiments on well-known benchmark datasets using compression techniques (quantization, pruning) for a set of resource-constrained embedded systems, such as CPUs, GPUs and FPGAs. The obtained results highlight the difficulty of finding good trade-offs between resource efficiency and predictive performance.

We propose a new formulation for pruning convolutional kernels in neural networks to enable efficient inference. We interleave greedy criteria-based pruning with finetuning by backpropagation-a computationally efficient procedure that maintains good generalization in the pruned network. We propose a new criterion based on Taylor expansion that approximates the change in the cost function induced by pruning network parameters. We focus on transfer learning, where large pretrained networks are adapted to specialized tasks. The proposed criterion demonstrates superior performance compared to other criteria, e.g. the norm of kernel weights or feature map activation, for pruning large CNNs after adaptation to fine-grained classification tasks (Birds-200 and Flowers-102) relaying only on the first order gradient information. We also show that pruning can lead to more than 10× theoretical reduction in adapted 3D-convolutional filters with a small drop in accuracy in a recurrent gesture classifier. Finally, we show results for the largescale ImageNet dataset to emphasize the flexibility of our approach.

Low-rankness plays an important role in traditional machine learning, but is not so popular in deep learning. Most previous low-rank network compression methods compress the networks by approximating pre-trained models and re-training. However, the optimal solution in the Euclidean space may be quite different from the one in the low-rank manifold. A well-pre-trained model is not a good initialization for the model with low-rank constraints. Thus, the performance of a low-rank compressed network degrades significantly. Compared to other network compression methods such as pruning, low-rank methods attracts less attention in recent years. In this paper, we devise a new training method, low-rank projection with energy transfer (LRPET), that trains low-rank compressed networks from scratch and achieves competitive performance. First, we propose to alternately perform stochastic gradient descent training and projection onto the low-rank manifold. Compared to re-training on the compact model, this enables full utilization of model capacity since solution space is relaxed back to Euclidean space after projection. Second, the matrix energy (the sum of squares of singular values) reduction caused by projection is compensated by energy transfer. We uniformly transfer the energy of the pruned singular values to the remaining ones. We theoretically show that energy transfer eases the trend of gradient vanishing caused by projection. Third, we propose batch normalization (BN) rectification to cut off its effect on the optimal low-rank approximation of the weight matrix, which further improves the performance. Comprehensive experiments on CIFAR-10 and ImageNet have justified that our method is superior to other low-rank compression methods and also outperforms recent state-of-the-art pruning methods. Our code is available at https://github.com/BZQLin/LRPET.

轻量级模型设计已成为应用深度学习技术的重要方向，修剪是实现模型参数和拖鞋的大量减少的有效均值。现有的神经网络修剪方法主要从参数的重要性开始，以及设计参数评估度量来迭代地执行参数修剪。这些方法不是从模型拓扑的角度研究的，可能是有效但不高效的，并且需要完全不同的不同数据集修剪。在本文中，我们研究了神经网络的图形结构，并提出了常规的基于图的修剪（RGP）来执行单次神经网络修剪。我们生成常规图，将图的节点度值设置为满足修剪比率，并通过将边缘交换以获得最佳边缘分布来降低曲线图的平均最短路径长度。最后，将获得的图形映射到神经网络结构中以实现修剪。实验表明，曲线图的平均最短路径长度与相应神经网络的分类精度负相关，所提出的RGP显示出强的精度保持能力，具有极高的参数减少（超过90％）和拖鞋（更多超过90％）。

我们为神经网络提出了一种新颖，结构化修剪算法 - 迭代，稀疏结构修剪算法，称为I-Spasp。从稀疏信号恢复的思想启发，I-Spasp通过迭代地识别网络内的较大的重要参数组（例如，滤波器或神经元），这些参数组大多数对修剪和密集网络输出之间的残差贡献，然后基于这些组阈值以较小的预定定义修剪比率。对于具有Relu激活的双层和多层网络架构，我们展示了通过多项式修剪修剪诱导的错误，该衰减是基于密集网络隐藏表示的稀疏性任意大的。在我们的实验中，I-Spasp在各种数据集（即MNIST和ImageNet）和架构（即馈送前向网络，Resnet34和MobileNetv2）中进行评估，其中显示用于发现高性能的子网和改进经过几种数量级的可提供基线方法的修剪效率。简而言之，I-Spasp很容易通过自动分化实现，实现强大的经验结果，具有理论收敛保证，并且是高效的，因此将自己区分开作为少数几个计算有效，实用，实用，实用，实用，实用，实用，实用，实用和可提供的修剪算法之一。

We propose a method to learn deep ReLU-based classifiers that are provably robust against normbounded adversarial perturbations on the training data. For previously unseen examples, the approach is guaranteed to detect all adversarial examples, though it may flag some non-adversarial examples as well. The basic idea is to consider a convex outer approximation of the set of activations reachable through a norm-bounded perturbation, and we develop a robust optimization procedure that minimizes the worst case loss over this outer region (via a linear program). Crucially, we show that the dual problem to this linear program can be represented itself as a deep network similar to the backpropagation network, leading to very efficient optimization approaches that produce guaranteed bounds on the robust loss. The end result is that by executing a few more forward and backward passes through a slightly modified version of the original network (though possibly with much larger batch sizes), we can learn a classifier that is provably robust to any norm-bounded adversarial attack. We illustrate the approach on a number of tasks to train classifiers with robust adversarial guarantees (e.g. for MNIST, we produce a convolutional classifier that provably has less than 5.8% test error for any adversarial attack with bounded ∞ norm less than = 0.1), and code for all experiments is available at http://github.com/ locuslab/convex_adversarial.