Can DBNNs Robust to Environmental Noise for Resource-constrained Scenarios?

Q1.The reviewer wants to know how robust of proposed algorithm can be against adversarial attacks with latest BNNs (e.g., CycleBNN, Fontana et al., 2024).

A1. Thanks for the reviewer's nice suggestion. We opted for a standard training and testing phase to introduce PGD attacks, thereby evaluating the effectiveness of the proposed approach in defending adversarial attacks. This mode more closely with the hypothesis considered in our manuscript, which posits that noise is encountered exclusively during the inference phase. Specifically, we use the LinfPGDAttack method from the library advertorch, with step size set to 7 and perturbation value set to $\epsilon=1/255$. Then, we added such adversarial perturbations to the test set of the CIFAR-100 task and measured the CycleBNN with ResNet18 backbone and our proposed method. In below table, experimental results demonstrate that DBNN models, which have not been trained with adversarial samples, are highly susceptible to strong PGD attacks (Similar issues have been reported in full-precision models during both standard training and adversarial attack testing [A1]). The proposed method still has a certain percentage improvement despite the serious degradation of the performance of unconstrained DBNN models.

Table 1. PGD performance comparison between CycleBNN and our on the CIRFA-100 dataset.

[A1] Towards Deep Learning Models Resistant to Adversarial Attacks. ICLR (Poster) 2018.

Q2. The theoretical analysis assumes Lipschitz continuity of binarized activation but does not provide the residual block analysis.

A2. Thank you very much for your comment, we also think that the Lipschitz continuous analysis of residual structure is very important. Due to space constraints, the corollary and relevant proof of this part are located in the Appendix of the manuscript. Please refer to Corollary A.2 (Appendix) on page 12. For the camera version, we will move it into the main paper.

Q3. Increase font size in Fig.4 for clearer visualization of feature maps.

Q3. Please forgive our mistakes, we have set the font size to 24 to make the text description in Figure 4 clearer.

Q4. Discuss potential risks of deploying noise-robust DBNNs in safety-critical medical applications (e.g., false negatives under extreme noise).

A4. Thank you very much for your constructive suggestions. First, false negatives represent a significant challenge in the field of medical imaging. However, if imaging alone cannot provide a definitive determination, a biopsy can be conducted, and its subsequent pathological analysis serves as the gold standard for diagnosis. In practical MRI, extreme noise perturbations caused by patient movement can occur. In such cases, experienced senior physicians on the medical team will implement appropriate corrective measures. This indicates that our proposed method is unlikely to encounter such issues under normal environmental noise conditions.

Q1: How does the proposed method generalize to non-vision tasks such as NLP?

A1: Thank you for your insightful question. From a theoretical perspective, extending to NLP tasks such as text classification or machine reading, it is necessary to first construct BERT models that binarize weights and activation, sort out their iterative and expansion forms, and the most critical step is to analyze the formalized upper bound of environmental noise perturbations for each layer. Because the structure of BERT is different from the DBNNs with ResNet backbone, it means that the Lipschitz constant of each part needs to be calculated carefully. This suggests that the upper bound of the binarized BERT model exhibits a slight deviation from Theorem 3. With a moderate adjustment, the theoretical analysis can be effectively applied to NLP tasks. On the other hand, the bio-electrical signal classification task and NLP task belong to the sequence modeling task. In particular, the data for the bio-electrical signal classification task are closely associated with time-dimensional information, and the proposed constraints have effectively validated the performance of the BNN model (e.g., A binary convolution layer as a replacement for the full-precision convolution layer).

Q2: What is the real-time inference impact of the L1,∞-norm constraints, particularly in resource-limited environments?

A2: Thank you for your nice question. In fact, the proposed constraints are incorporated into the training stage in the form of an objective function penalty term. This mean that the proposed method solely impacts the training cost, and thus no additional operations are introduced to the layers within the DBNNs. Consequently, it does not introduce extra time overhead during the model inference phase, thereby eliminating any inference concerns. Finally, DBNNs on the server side can achieve inference times at the second level.

Q3: Can you provide an ablation study to isolate the contribution of binary weights versus scaling factors in improving robustness?

A3: Thank you for your constructive suggestion. We found that the constraints on binary weights and scaling factors are indispensable to improve the robustness of DBNNs.

Table 1. Ablation study 1: Binary weights V.S. Scaling factors to improving robustness on the CIRFA-100 dataset. The w/o indicates that the constraint on the scaling factors has been removed.

Table 2. Ablation study 2: Binary weights V.S. Scaling factors to improving robustness of DBNNs on the Brain tumor dataset.

Q4: How does the proposed method compare to more recent adaptive fault-tolerance methods beyond traditional redundancy-based techniques?

A4: Thank you very much! The description of the manuscript may have given you some misunderstanding. We would like to clarify the distinction between the environmental noise robustness of DBNNs and adaptive error tolerance methods. Based on two recent works [1-2], adaptive fault tolerance methods focus on ensuring that hardware devices can continue performing tasks even after a fault occurs (i.e., The communication node is faulty). In contrast, the DBNN model exhibits approximately a 10-20% decrease in performance under environmental noise perturbations, rather than encountering fault. Therefore, we believe that it is not suitable to compare the adaptive fault-tolerance methods for hardware devices with the robustness improvement algorithm for DL models (DBNNs). Another reason is that the tasks targeted by these fault-tolerance algorithms differ significantly from the classification tasks of DBNNs, and their portability remains to be validated. We plan to investigate the effectiveness of adaptive fault-tolerance methods when the DBNN encounters fault.

[1] Ada-FA: A Comprehensive Framework for Adaptive Fault Tolerance and Aging Mitigation in FPGAs. IEEE Internet Things J. 11(10): 17688-17699 (2024)

[2] A Dynamic Adaptive Framework for Practical Byzantine Fault Tolerance Consensus Protocol in the Internet of Things. IEEE Trans. Computers 73(7): 1669-1682 (2024)

Many thanks to the reviewers for their positive comments and constructive comments.

Q1. However, its significance is somewhat limited by the lack of real-world deployment or validation on actual edge devices.

A1. We apologize for the fact that the inference experiments on actual edge devices. However, the PyTorch framework can integrate ONNX third-party libraries to support DBNN model transformation and facilitate deployment on the simulation platform of edge devices (i.e., Raspberry Pi Debian 12). Specifically, the CycleBNN method with a ResNet18 backbone, after being trained with our $L_{1,\infty}$-norm constraint loss, resulted in a checkpoint file size of 45.34MB. This is significantly smaller than the 8GB storage capacity of the Raspberry Pi 4B+ device. The inference of a single image under environmental noise takes only 1.6 seconds, which is deemed acceptable given that brain tumor-related tasks typically do not demand real-time processing capabilities. In particular, the performance of the Raspberry PI simulation environment provided by Docker is lower than that of the actual device. This indicates substantial potential for deploying our proposed method on the actual edge device.

Q2. The clarity of theoretical explanations and experimental results is generally strong, but some assumptions, such as the applicability of the bound across architectures.

A2. Thank you for the reviewer's valuable suggestions. We agree that the applicability of the bound across architectures plays an important role in ensuring the theoretical robustness analysis of DBNNs under environmental noise perturbations. We clarify that the DBNN-based model discussed primarily focuses on the binarization of weights and activations of CNN-based models. However, the multi-head self-attention mechanism in transformer-based models differs significantly from the convolution operations in CNNs, and ResNet-based backbones also lack a positional embedding layer. Thus, potential issues for applications of bound across architectures are more likely to stem from substantial architectural differences rather than from the assumptions of theoretical analysis. Nevertheless, we will conduct a rigorous analysis of the upper bound of environmental noise perturbations in both the position embedding layer and the multi-head self-attention layer after binarization, thereby extending the existing conclusions to the Transformer model.

Q1: Authors should give priority to the visual results of medical image classification in the main text.

A1: We extend our gratitude to the reviewer for providing this constructive suggestion. We fully concur with the suggestion to include visual results in the main text to effectively demonstrate the efficacy of the proposed method. The visualized results of brain tumors have been relocated to the experiment section.

Q2: The reviewer wants to know more about the cost of the BNN algorithm under environmental noise perturbations.

A2: Thank you very much for the valuable comment. We concur that, in addition to comparing the computational overhead with the LCR method (SOTA), which investigates BNN robustness, it is also essential to explore how the proposed $L_{1,\infty}$-norm constraints loss function influence the computational overhead of various popular BNN algorithms. To expedite the acquisition of experimental results, we measured the actual computation time on an A800 GPU.

Specifically, we have evaluated the training cost of a series of BNN-based methods on CIFAR-100 and Brain Tumor datasets. We have reported the average training time of each epoch and total test time. According to the results presented in the main paper and two table below, it can be observed that an appropriately designed penalty term not only enhances model robustness but also significantly improves training efficiency. In addition, the overhead in the test phase also encompasses the time required for adding environmental noise. The detailed computational overhead are presented below:

Table 1. Computational cost comparison between popular BNN-based methods and our on the CIFAR-100 dataset.

Table 2. Computational cost comparison between BNNs and our on the Brain tumor dataset.