Neural networks trained with backpropagation, the standard algorithm of deep learning which uses weight transport, are easily fooled by existing gradient-based adversarial attacks. This class of attacks are based on certain small perturbations of the inputs to make networks misclassify them. We show that less biologically implausible deep neural networks trained with feedback alignment, which do not use weight transport, can be harder to fool, providing actual robustness. Tested on MNIST, deep neural networks trained without weight transport (1) have an adversarial accuracy of 98% compared to 0.03% for neural networks trained with backpropagation and (2) generate non-transferable adversarial examples. However, this gap decreases on CIFAR-10 but is still significant particularly for small perturbation magnitude less than 1 ⁄ 2. Deep neural networks trained with backpropagation (BP) are not robust against certain hardly perceptible perturbation, known as adversarial examples, which are found by slightly altering the network input and nudging it along the gradient of the network's loss function [1] . The feedback-path synaptic weights of these networks use the transpose of the forward-path synaptic weights to run error propagation. This problem is commonly named the weight transport problem. Here we consider more biologically plausible neural networks introduced by Lillicrap et al. [2] to run error propagation using feedbackpath weights that are not the transpose of the forward-path ones i.e. without weight transport. This mechanism was called feedback alignment (FA). The introduction of a separate feedback path in [2] in the form of random fixed synaptic weights makes the feedback gradients a rough approximation of those computed by backpropagation. Since gradient-based adversarial attacks are very sensitive to the quality of gradients to perturb the input and fool the neural network, we suspect that the gradients computed without weight transport cannot be accurate enough to design successful gradient-based attacks. Here we compare the robustness of neural networks trained with either BP or FA on three well-known gradient-based attacks, namely the fast gradient sign method (FGSM) [3] , the basic iterative method (BIM) and the momentum iterative fast gradient sign method (MI-FGSM) [4] . To the best of our knowledge, no prior adversarial attacks have been applied for deep neural networks without weight transport. We perform an empirical evaluation investigating both the robustness of deep neural networks without weight transport and the transferability of adversarial examples generated with gradient-based attacks. The results on MNIST clearly show that (1) FA networks are robust to adversarial examples generated with FA and (2) the adversarial examples generated by FA are not transferable to BP networks. On the other hand, we find that these two conclusions are not true on CIFAR-10 even if FA networks showed a significant robustness to Figure 1b , we denote by "BP → F A" the generation of adversarial examples using BP to fool the FA network, and "F A → BP " the generation of adversarial examples using FA to fool the BP network gradient-based attacks. Therefore, one should consider performing more exhaustive analysis on more complex datasets to understand the impact of the approximated gradients provided by feedback alignment on the adversarial accuracy of biologically plausible neural networks attacked with gradient-based methods.
Less biologically implausible deep neural networks trained without weight transport can be harder to fool.
{"src": "scitldr-AIC_train", "paper_id": "HkgSXQtIIB"}