Improving the Robustness of Model Compression by OnManifold Adversarial Training
Abstract
:1. Introduction
 We investigate the robustness of compressed DNN models against natural noise using onmanifold adversarial examples for the worstcase analysis, in particular at the regime of highly compressed models relevant for deploying DNNs on small embedded systems. To the best of our knowledge, there is no other work addressing this particular issue.
 We demonstrate our idea using samples from a known probability distribution. In this setting, we can generate onmanifold adversarial examples to their mathematical definition. We also experiment with our idea using real data sets, where onmanifold adversarial examples are generated using autoencoders since we do not know the true distribution of data. In both settings, we show that onmanifold adversarial training is effective for building robust highly compressed models.
 We also found in our experiments that onmanifold adversarial training appears to be more efficient in using model capacity than offmanifold adversarial training.
2. Related Works
2.1. Adversarial Attacks
2.1.1. WhiteBox Attacks Methods
2.1.2. BlackBox Attack Methods
2.2. Defense against Adversarial Attacks
2.3. Model Compression
2.4. Robust Model Compression
3. Background
3.1. Model Compression Based on Sparse Coding
3.2. Adversarial Example
3.2.1. Fast Gradient Sign Method
3.2.2. Projected Gradient Descent
3.3. Adversarial Training
3.3.1. FGSM Adversarial Training
3.3.2. PGD Adversarial Training
3.3.3. TRADES
4. Methodology
 To evaluate the robustness of compressed DNN models against natural noise.
 To improve the robustness of a compressed DNN model based on sparse coding with adversarial training.
4.1. OnManifold Adversarial Examples
4.1.1. Case One: Simulation Data
4.1.2. Case Two: Real Data
4.2. Model Compression with OnManifold Adversarial Training
Algorithm 1 Model compression by the onmanifold adversarial training algorithm 

4.3. Computational Cost
5. Experiments
5.1. Datasets and Models
 Simulation dataset: the simulation data described in Section 4.1.1, in which onmanifold adversarial examples have been generated based on known data distribution. The simulation dataset consists of 70,000 instances with 16dimensional inputs belonging to four different classes. We used the modified LeNet5 [55] as the classifier, which consists of two convolutional layers with maxpooling ($5\times 5$ kernel size; 32, 64 channels for simulation dataset; 64, 128 channels for MNIST), and two fully connected layers.
 MNIST [56]: the dataset for handwritten zipcode digit classification problem, originally intended for the faster distribution of physical mail in the US post offices—the images were taken with lowresolution ($28\times 28$) camera sensors. This dataset consists of 70,000 greyscale images, and the train/test split ratio is $6:1$. For the target classifier, we used the same model as in the simulation dataset with three fully connected layers.
 FashionMNIST [57] (FMNIST): FMNIST consists of 10 different categories of fashion product images. It also includes 70,000 greyscale images, and the train/test split ratio is $6:1$. We used a CNN with three convolutional layers ($4\times 4$ kernel size; 32, 64, 128 channels) and three fully connected layers.
 UCI human activity recognition [60] (HAR): HAR dataset consists of nine embedded sensors and data from accelerometers and gyroscopes in smartphones. The task of the dataset is to classify six different human activities with the sensor data received from smartphones. There is a total of 10,299 instances, and we used a train/test split ratio of $7:3$. For the classification problem, we adopted a onedimensional convolutional neural network model with three convolutional layers and three fully connected layers.
5.2. Methods
5.3. Robustness of Compressed Models on OnManifold Test Data
5.4. Robustness of Compressed Models on OffManifold Adversarial Test Data
6. Discussion
7. Conclusions
Author Contributions
Funding
Data Availability Statement
Conflicts of Interest
References
 Han, S.; Pool, J.; Tran, J.; Dally, W.J. Learning both weights and connections for efficient neural networks. arXiv 2015, arXiv:1506.02626. [Google Scholar]
 Han, S.; Mao, H.; Dally, W.J. Deep compression: Compressing deep neural network with pruning, trained quantization and huffman coding. In Proceedings of the 4th International Conference on Learning Representations, (ICLR 2016), San Juan, Puerto Rico, 2–4 May 2016; Conference Track Proceedings. Bengio, Y., LeCun, Y., Eds.; [Google Scholar]
 Wen, W.; Wu, C.; Wang, Y.; Chen, Y.; Li, H. Learning structured sparsity in deep neural networks. In Proceedings of the Advances in Neural Information Processing Systems 29: Annual Conference on Neural Information Processing Systems 2016, Barcelona, Spain, 5–10 December 2016; Lee, D.D., Sugiyama, M., von Luxburg, U., Guyon, I., Garnett, R., Eds.; pp. 2074–2082. [Google Scholar]
 Li, H.; Kadav, A.; Durdanovic, I.; Samet, H.; Graf, H.P. Pruning filters for efficient convnets. In Proceedings of the 5th International Conference on Learning Representations, (ICLR 2017), Toulon, France, 24–26 April 2017. Conference Track Proceedings. [Google Scholar]
 Louizos, C.; Welling, M.; Kingma, D.P. Learning sparse neural networks through L_{0} regularization. arXiv 2017, arXiv:1712.01312. [Google Scholar]
 Gong, Y.; Liu, L.; Yang, M.; Bourdev, L.D. Compressing deep convolutional networks using vector quantization. arXiv 2014, arXiv:1412.6115. [Google Scholar]
 Hubara, I.; Courbariaux, M.; Soudry, D.; ElYaniv, R.; Bengio, Y. Binarized neural networks. In Proceedings of the Advances in Neural Information Processing Systems 29: Annual Conference on Neural Information Processing Systems 2016, Barcelona, Spain, 5–10 December 2016; Lee, D.D., Sugiyama, M., von Luxburg, U., Guyon, I., Garnett, R., Eds.; pp. 4107–4115. [Google Scholar]
 Hinton, G.E.; Vinyals, O.; Dean, J. Distilling the knowledge in a neural network. arXiv 2015, arXiv:1503.02531. [Google Scholar]
 Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.J.; Fergus, R. Intriguing properties of neural networks. In Proceedings of the 2nd International Conference on Learning Representations, (ICLR 2014), Banff, AB, Canada, 14–16 April 2014; Conference Track Proceedings. Bengio, Y., LeCun, Y., Eds.; [Google Scholar]
 Goodfellow, I.J.; Shlens, J.; Szegedy, C. Explaining and harnessing adversarial examples. In Proceedings of the 3rd International Conference on Learning Representations, (ICLR 2015), San Diego, CA, USA, 7–9 May 2015; Conference Track Proceedings. Bengio, Y., LeCun, Y., Eds.; [Google Scholar]
 Kurakin, A.; Goodfellow, I.J.; Bengio, S. Adversarial machine learning at scale. In Proceedings of the 5th International Conference on Learning Representations, (ICLR 2017), Toulon, France, 24–26 April 2017. Conference Track Proceedings. [Google Scholar]
 Kurakin, A.; Goodfellow, I.J.; Bengio, S. Adversarial examples in the physical world. In Proceedings of the 5th International Conference on Learning Representations, (ICLR 2017), Toulon, France, 24–26 April 2017. Workshop Track Proceedings. [Google Scholar]
 Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; Vladu, A. Towards deep learning models resistant to adversarial attacks. In Proceedings of the 6th International Conference on Learning Representations, (ICLR 2018), Vancouver, BC, Canada, 30 April–3 May 2018. [Google Scholar]
 Carlini, N.; Wagner, D.A. Towards evaluating the robustness of neural networks. In Proceedings of the 2017 IEEE Symposium on Security and Privacy, (SP 2017), San Jose, CA, USA, 22–26 May 2017; pp. 39–57. [Google Scholar] [CrossRef] [Green Version]
 Zhang, H.; Yu, Y.; Jiao, J.; Xing, E.P.; Ghaoui, L.E.; Jordan, M.I. Theoretically principled tradeoff between robustness and accuracy. In International Conference on Machine Learning; PMLR; 2019; pp. 7472–7482. Available online: http://proceedings.mlr.press/v97/zhang19p.html (accessed on 22 November 2021).
 Wang, L.; Ding, G.W.; Huang, R.; Cao, Y.; Lui, Y.C. Adversarial Robustness of Pruned Neural Networks. ICLR Workshop Submission, Vancouver, BC, Canada, 2018. Available online: https://openreview.net/forum?id=SJGrAisIz (accessed on 22 November 2021).
 Ye, S.; Lin, X.; Xu, K.; Liu, S.; Cheng, H.; Lambrechts, J.; Zhang, H.; Zhou, A.; Ma, K.; Wang, Y. Adversarial robustness vs. model compression, or both? In Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision, (ICCV 2019), Seoul, Korea, 27 October–2 November 2019; pp. 111–120. [Google Scholar] [CrossRef] [Green Version]
 Gui, S.; Wang, H.; Yang, H.; Yu, C.; Wang, Z.; Liu, J. Model compression with adversarial robustness: A unified optimization framework. In Proceedings of the Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, (NeurIPS 2019), Vancouver, BC, Canada, 8–14 December 2019; Wallach, H.M., Larochelle, H., Beygelzimer, A., d’AlchéBuc, F., Fox, E.B., Garnett, R., Eds.; pp. 1283–1294. [Google Scholar]
 Sehwag, V.; Wang, S.; Mittal, P.; Jana, S. HYDRA: Pruning adversarially robust neural networks. In Proceedings of the Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, (NeurIPS 2020), Virtual, 6–12 December 2020; Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., Lin, H., Eds.; [Google Scholar]
 Lee, J.; Lee, S. Robust CNN compression framework for securitysensitive embedded systems. Appl. Sci. 2021, 11, 1093. [Google Scholar] [CrossRef]
 Stutz, D.; Hein, M.; Schiele, B. Disentangling adversarial robustness and generalization. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, (CVPR 2019), Long Beach, CA, USA, 16–20 June 2019; pp. 6976–6987. [Google Scholar] [CrossRef] [Green Version]
 Patel, K.; Beluch, W.; Zhang, D.; Pfeiffer, M.; Yang, B. Onmanifold Adversarial Data Augmentation Improves Uncertainty Calibration. In Proceedings of the 25th International Conference on Pattern Recognition, (ICPR 2020), Virtual Event/Milan, Italy, 10–15 January 2021; pp. 8029–8036. [Google Scholar] [CrossRef]
 MoosaviDezfooli, S.; Fawzi, A.; Frossard, P. DeepFool: A simple and accurate method to fool deep neural networks. In Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, 27–30 June 2016; pp. 2574–2582. [Google Scholar] [CrossRef] [Green Version]
 Papernot, N.; McDaniel, P.D.; Jha, S.; Fredrikson, M.; Celik, Z.B.; Swami, A. The Limitations of Deep Learning in Adversarial Settings. In Proceedings of the IEEE European Symposium on Security and Privacy, EuroS&P 2016, Saarbrücken, Germany, 21–24 March 2016; pp. 372–387. [Google Scholar] [CrossRef] [Green Version]
 Papernot, N.; McDaniel, P.D.; Goodfellow, I.J.; Jha, S.; Celik, Z.B.; Swami, A. Practical blackbox attacks against machine learning. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, AsiaCCS 2017, Abu Dhabi, United Arab Emirates, 2–6 April 2017; Karri, R., Sinanoglu, O., Sadeghi, A., Yi, X., Eds.; pp. 506–519. [Google Scholar] [CrossRef] [Green Version]
 Chen, P.; Zhang, H.; Sharma, Y.; Yi, J.; Hsieh, C. ZOO: Zeroth order optimization based blackbox attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, AISec@CCS 2017, Dallas, TX, USA, 3 November 2017; Thuraisingham, B.M., Biggio, B., Freeman, D.M., Miller, B., Sinha, A., Eds.; ACM: New York, NY, USA, 2017; pp. 15–26. [Google Scholar] [CrossRef] [Green Version]
 Brendel, W.; Rauber, J.; Bethge, M. Decisionbased adversarial attacks: Reliable attacks against blackbox machine learning models. In Proceedings of the 6th International Conference on Learning Representations, (ICLR 2018), Vancouver, BC, Canada, 30 April–3 May 2018. Conference Track Proceedings. [Google Scholar]
 Zhao, Z.; Dua, D.; Singh, S. Generating natural adversarial examples. In Proceedings of the 6th International Conference on Learning Representations, (ICLR 2018), Vancouver, BC, Canada, 30 April–3 May 2018. Conference Track Proceedings. [Google Scholar]
 Su, J.; Vargas, D.V.; Sakurai, K. One pixel attack for fooling deep neural networks. IEEE Trans. Evol. Comput. 2019, 23, 828–841. [Google Scholar] [CrossRef] [Green Version]
 Papernot, N.; McDaniel, P.D.; Wu, X.; Jha, S.; Swami, A. Distillation as a defense to adversarial perturbations against deep neural networks. In Proceedings of the IEEE Symposium on Security and Privacy, (SP 2016), San Jose, CA, USA, 22–26 May 2016; pp. 582–597. [Google Scholar] [CrossRef] [Green Version]
 Kannan, H.; Kurakin, A.; Goodfellow, I.J. Adversarial logit pairing. arXiv 2018, arXiv:1803.06373. [Google Scholar]
 Xu, W.; Evans, D.; Qi, Y. Feature squeezing: Detecting adversarial examples in deep neural networks. In Proceedings of the 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, CA, USA, 18–21 February 2018. The Internet Society. [Google Scholar]
 Metzen, J.H.; Genewein, T.; Fischer, V.; Bischoff, B. On detecting adversarial perturbations. In Proceedings of the 5th International Conference on Learning Representations, (ICLR 2017), Toulon, France, 24–26 April 2017. Conference Track Proceedings. [Google Scholar]
 Feinman, R.; Curtin, R.R.; Shintre, S.; Gardner, A.B. Detecting adversarial samples from artifacts. arXiv 2017, arXiv:1703.00410. [Google Scholar]
 Raghunathan, A.; Steinhardt, J.; Liang, P. Certified defenses against adversarial examples. In Proceedings of the 6th International Conference on Learning Representations, (ICLR 2018), Vancouver, BC, Canada, 30 April–3 May 2018. [Google Scholar]
 Meng, D.; Chen, H. MagNet: A twopronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, (CCS 2017), Dallas, TX, USA, 30 October–3 November 2017; Thuraisingham, B.M., Evans, D., Malkin, T., Xu, D., Eds.; pp. 135–147. [Google Scholar] [CrossRef]
 Ilyas, A.; Jalal, A.; Asteri, E.; Daskalakis, C.; Dimakis, A.G. The robust manifold defense: Adversarial training using generative models. arXiv 2017, arXiv:1712.09196. [Google Scholar]
 Samangouei, P.; Kabkab, M.; Chellappa, R. DefenseGAN: Protecting classifiers against adversarial attacks using generative models. In Proceedings of the 6th International Conference on Learning Representations, (ICLR 2018), Vancouver, BC, Canada, 30 April–3 May 2018. [Google Scholar]
 Shaham, U.; Yamada, Y.; Negahban, S. Understanding adversarial training: Increasing local stability of supervised models through robust optimization. Neurocomputing 2018, 307, 195–204. [Google Scholar] [CrossRef] [Green Version]
 Cai, Q.; Liu, C.; Song, D. Curriculum adversarial training. In Proceedings of the TwentySeventh International Joint Conference on Artificial Intelligence, (IJCAI 2018), Stockholm, Sweden, 13–19 July 2018; Lang, J., Ed.; pp. 3740–3747. [Google Scholar] [CrossRef] [Green Version]
 Song, Y.; Shu, R.; Kushman, N.; Ermon, S. Constructing unrestricted adversarial examples with generative models. In Proceedings of the Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, (NeurIPS 2018), Montréal, QC, Canada, 3–8 December 2018; Bengio, S., Wallach, H.M., Larochelle, H., Grauman, K., CesaBianchi, N., Garnett, R., Eds.; pp. 8322–8333. [Google Scholar]
 Lin, W.; Lau, C.P.; Levine, A.; Chellappa, R.; Feizi, S. Dual manifold adversarial robustness: Defense against Lp and nonLp adversarial attacks. In Proceedings of the Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, (NeurIPS 2020), Virtual, 6–12 December 2020; Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., Lin, H., Eds.; [Google Scholar]
 Lebedev, V.; Lempitsky, V.S. Fast convnets using groupwise brain damage. In Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, 27–30 June 2016; pp. 2554–2564. [Google Scholar] [CrossRef] [Green Version]
 He, Y.; Ding, Y.; Liu, P.; Zhu, L.; Zhang, H.; Yang, Y. Learning filter pruning criteria for deep convolutional neural networks acceleration. In Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, (CVPR 2020), Seattle, WA, USA, 13–19 June 2020; pp. 2006–2015. [Google Scholar] [CrossRef]
 Madaan, D.; Shin, J.; Hwang, S.J. Adversarial neural pruning with latent vulnerability suppression. In Proceedings of the 37th International Conference on Machine Learning, (ICML 2020), Virtual Event, 13–18 July 2020; Volume 119, pp. 6575–6585. [Google Scholar]
 Lee, H.; Battle, A.; Raina, R.; Ng, A.Y. Efficient sparse coding algorithms. In Advances in Neural Information Processing Systems 19, Proceedings of the Twentieth Annual Conference on Neural Information Processing Systems, Vancouver, BC, Canada, 4–7 December 2006; Schölkopf, B., Platt, J.C., Hofmann, T., Eds.; MIT Press: Cambridge, MA, USA, 2006; pp. 801–808. [Google Scholar]
 Needell, D.; Tropp, J.A. CoSaMP: Iterative signal recovery from incomplete and inaccurate samples. Commun. ACM 2010, 53, 93–100. [Google Scholar] [CrossRef]
 Hastie, T.; Tibshirani, R.; Friedman, J. The Elements of Statistical Learning; Springer Series in Statistics; Springer: New York, NY, USA, 2001. [Google Scholar]
 Constable, C.G. Parameter estimation in nonGaussian noise. Geophys. J. Int. 1988, 94, 131–142. [Google Scholar] [CrossRef] [Green Version]
 Kingma, D.P.; Welling, M. Autoencoding variational bayes. In Proceedings of the 2nd International Conference on Learning Representations, (ICLR 2014), Banff, AB, Canada, 14–16 April 2014; Conference Track Proceedings. Bengio, Y., LeCun, Y., Eds.; [Google Scholar]
 Rezende, D.J.; Mohamed, S. Variational inference with normalizing flows. In Proceedings of the 32nd International Conference on Machine Learning, (ICML 2015), Lille, France, 6–11 July 2015; Bach, F.R., Blei, D.M., Eds.; pp. 1530–1538. [Google Scholar]
 Hua, W.; Zhang, Y.; Guo, C.; Zhang, Z.; Suh, G.E. BulletTrain: Accelerating robust neural network training via boundary example mining. In Proceedings of the ThirtyFifth Conference on Neural Information Processing Systems; Available online: https://arxiv.org/pdf/2109.14707.pdf (accessed on 22 November 2021).
 Shafahi, A.; Najibi, M.; Ghiasi, A.; Xu, Z.; Dickerson, J.P.; Studer, C.; Davis, L.S.; Taylor, G.; Goldstein, T. Adversarial training for free! In Proceedings of the Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, (NeurIPS 2019), Vancouver, BC, Canada, 8–14 December 2019; Wallach, H.M., Larochelle, H., Beygelzimer, A., d’AlchéBuc, F., Fox, E.B., Garnett, R., Eds.; pp. 3353–3364. [Google Scholar]
 Hendrycks, D.; Mu, N.; Cubuk, E.D.; Zoph, B.; Gilmer, J.; Lakshminarayanan, B. AugMix: A simple data processing method to improve robustness and uncertainty. In Proceedings of the 8th International Conference on Learning Representations, (ICLR 2020), Addis Ababa, Ethiopia, 26–30 April 2020. [Google Scholar]
 Lecun, Y.; Bottou, L.; Bengio, Y.; Haffner, P. Gradientbased learning applied to document recognition. Proc. IEEE 1998, 86, 2278–2324. [Google Scholar] [CrossRef] [Green Version]
 LeCun, Y.; Cortes, C.; Burges, C. MNIST Handwritten Digit Database. ATT Labs [Online]. Available online: http://yann.lecun.com/exdb/mnist (accessed on 22 November 2021).
 Xiao, H.; Rasul, K.; Vollgraf, R. FashionMNIST: A novel image dataset for benchmarking machine learning algorithms. arXiv 2017, arXiv:1708.07747. [Google Scholar]
 Krizhevsky, A. Learning Multiple Layers of Features from Tiny Images. 2009. Available online: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.222.9220&rep=rep1&type=pdf (accessed on 22 November 2021).
 He, K.; Zhang, X.; Ren, S.; Sun, J. Deep residual learning for image recognition. In Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, 27–30 June 2016; pp. 770–778. [Google Scholar] [CrossRef] [Green Version]
 Human Activity Recognition Using Smartphones. UCI Machine Learning Repository. 2012. Available online: https://archive.ics.uci.edu/ml/datasets/human+activity+recognition+using+smartphones (accessed on 22 November 2021).
Methods  Model  OffManifold  OnManifold 

Compression  Perturbation  Perturbation  
FGSMAT [11]  √  
PGDAT [13]  √  
TRADES [15]  √  
ATMC [18]  √  √  
HYDRA [19]  √  √  
ANPVS [45]  √  √  
APD [20]  √  √  
Stutz et al. [21]  √  
DMAT [42]  √  √  
MCAT(on) (Ours)  √  √ 
Dataset  Sparsity  Original Accuracy  Method  Test Accuracy (%)  

Original  AdvOn  Combination (Original & AdvOn)  AdvOff  
Simulation  95%  97.20%  MC(regular)  96.93  56.50  76.72  16.32 
MCAT(on)  96.98  88.00  92.49  17.34  
MCAT(off)  92.69  79.50  86.09  23.45  
MCAT(dual)  95.30  80.00  87.65  25.45  
MCTRADES  95.96  79.50  87.73  46.68  
MNIST  95%  99.07%  MC(regular)  98.49  57.98  78.24  79.67 
MCAT(on)  97.31  72.90  85.11  93.51  
MCAT(off)  11.35  2.70  7.02  14.16  
MCAT(dual)  94.74  57.42  76.08  93.47  
MCTRADES  97.68  70.47  84.07  91.19  
FMNIST  90%  90.63%  MC(regular)  86.62  2.49  44.55  25.39 
MCAT(on)  86.51  95.61  91.06  17.29  
MCAT(off)  40.65  26.66  33.65  67.50  
MCAT(dual)  82.93  91.02  86.98  37.31  
MCTRADES  83.14  36.80  59.97  67.88  
CIFAR10  70%  84.28%  MC(regular)  78.41  16.53  47.47  51.04 
MCAT(on)  69.57  49.54  59.56  45.21  
MCAT(off)  49.74  38.48  44.11  45.58  
MCAT(dual)  71.32  43.79  57.55  64.95  
MCTRADES  75.99  22.86  49.43  68.12  
HAR  95%  90.97%  MC(regular)  87.78  0.00  43.89  27.09 
MCAT(on)  89.75  40.52  65.14  27.30  
MCAT(off)  63.22  0.00  31.61  41.16  
MCAT(dual)  73.33  40.52  56.92  52.62  
MCTRADES  87.51  0.00  43.76  65.53 
Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. 
© 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Kwon, J.; Lee, S. Improving the Robustness of Model Compression by OnManifold Adversarial Training. Future Internet 2021, 13, 300. https://doi.org/10.3390/fi13120300
Kwon J, Lee S. Improving the Robustness of Model Compression by OnManifold Adversarial Training. Future Internet. 2021; 13(12):300. https://doi.org/10.3390/fi13120300
Chicago/Turabian StyleKwon, Junhyung, and Sangkyun Lee. 2021. "Improving the Robustness of Model Compression by OnManifold Adversarial Training" Future Internet 13, no. 12: 300. https://doi.org/10.3390/fi13120300