Tensor Dropout for Robust Learning
Arinbjörn Kolbeinsson Jean Kossaifi Yannis Panagakis Adrian Bulat Anima Anandkumar Ioanna Tzoulaki Paul Matthews



















Tensor Dropout for Robust Learning
    Arinbjörn Kolbeinsson*         Jean Kossaifi*         Yannis Panagakis         Adrian Bulat
 

        Animashree Anandkumar        Ioanna Tzoulaki        Paul M. Matthews
* indicates equal contribution
A. Kolbeinsson, P. M. Matthews are with Imperial College London
I. Tzoulaki is with Imperial College London &  University of Ioannina
J. Kossaifi and A. Anandkumar are with NVIDIA
Y. Panagakis is with University of Athens
A. Bulat is with Samsung AI

    December 30, 2023
=========================================================================================================================================================================================================================================================================================================================================================================================================================================================================




CNNs achieve remarkable performance by leveraging deep, over-parametrized architectures, trained on large datasets. However, they have limited generalization ability to data outside the training domain, and a lack of robustness to noise and adversarial attacks. By building better inductive biases, we can improve robustness and also obtain smaller networks that are more memory and computationally efficient. While standard CNNs use matrix computations, we study tensor layers that involve higher-order computations and provide better inductive bias. Specifically, we impose low-rank tensor structures on the weights of tensor regression layers to obtain compact networks, and propose tensor dropout, a randomization in the tensor rank for robustness.
We show that our approach outperforms other methods for large-scale image classification on ImageNet and CIFAR-100. We establish a new state-of-the-art accuracy for phenotypic trait prediction on the largest dataset of brain MRI, the UK Biobank brain MRI dataset, where multi-linear structure is paramount. In all cases, we demonstrate superior performance and significantly improved robustness, both to noisy inputs and to adversarial attacks. We rigorously validate the theoretical validity of our approach by establishing the link between our randomized decomposition and non-linear dropout.














§ INTRODUCTION


Deep neural networks have evolved into powerful predictive models with remarkable performance on computer vision tasks <cit.>. Such models are usually over-parameterized, involving an enormous number (typically tens of millions) of parameters. This is much larger than the typical number of available training samples, making deep networks prone to overfitting <cit.>. Coupled with overfitting, deep networks lack robustness to small adversarial or noise perturbations <cit.>. In computer vision tasks, such as image classification or regression, perturbed examples are often perceived identically to the original ones by humans while lead arbitrarily different predictions by networks. In addition, not only are these neural networks lacking in robustness, they are also over-confident when (wrongly) predicting on noisy inputs <cit.>.
These shortcomings pose a possible obstacle for mass deployment of systems relying on deep learning in sensitive fields such as medical image analysis for disease prediction and expose an inherent weakness in their reliability.

To improve the robustness of deep neural networks to (adversarial or random) perturbations
and prevent them from overfitting, several methods that essentially affect the parameters of deep networks via regularization have been investigated. In particular, the link between regularization and robustness of deep neural networks to adversarial perturbations have been recently established in <cit.>.
These regularization mostly fall into two categories: structural changes to the architecture to make them inherently more robust and regularization methods that constrain directly the parameters. 
The latter category is well studied in the context of deep learning. In this context, regularization can be applied in the form of added randomness during training and/or testing. This can be applied to the activations through dropout <cit.> or to the weights (DropConnect <cit.>). Regularization functions (e.g., ℓ_2- or ℓ_1- norm) can also be directly applied to network’s parameters <cit.>.

However, a more powerful class of regularization focuses on structural changes to the architecture of the network itself. The most notable such approach is based on tensor methods and accounts for the structure in the data. Machine learning is in essence the learning from data, and tensor methods allow to fully leverage the structure in that data. This  is  because  the  unknown  transformation
from  input  image  to  the  output  label  is  in  general  a  tensor map.
The data typically manipulated by deep neural networks is typically 3 dimensional (e.g. RGB images, brain MRI) or 4 dimensional (e.g. videos, functional MRI images, etc). Preserving multi-dimensional structure is crucial for performance.  
By limiting the network to matrix operations (e.g. with flattening layers followed by one or more fully-connected), we are ignoring this structure, resulting in deteriorated performance <cit.>.
In contrast, tensor methods allow to leverage that structure to improve the model, reduce the number of parameters and improve computational efficiency.  One way this is done is by leveraging the multi-linear correlations in the network <cit.>. 


In this paper, we introduce a novel higher-order randomized factorization method to improve the performance and robustness of deep networks to adversarial and random perturbations. We apply this stochastic decomposition to tensor regression layers which we use to entirely replace flattening and fully-connected layers. This preserves the structure of multi-dimensional data (e.g., images and MRI data) by expressing an output tensor as the result of a tensor contraction between the input tensor and some low-rank regression weight tensors. Instead of using the deterministic reconstruction of the regression weight tensor, our randomized tensor decomposition leads to the stochastic reduction of the rank during both training and inference. This is related to non-linear dropout on tensor factorization, which, by randomly dropping units during training, prevents over-fitting. However, rather than dropping random elements from the activation tensor, this is done on the rank of the regression weight tensor.

We conduct thorough experiments in image classification and phenotypic trait prediction from MRI analysis. Specifically, we apply our method to the UK Biobank brain MRI dataset for estimating brain-age, a metric which has been associated with a range of diseases and mortality <cit.>, and could be an early predictor for Alzheimer's disease <cit.>. A more accurate and robust metric of brain condition can consequently lead to more accurate disease diagnoses.

Summary of contributions:


  * We propose tensor dropout, a novel method, a novel stochastic tensor decomposition where non-linear dropout is applied in the latent subspace spanned by a low-rank factorization.

  * We apply tensor dropout to tensor regression layers and show that it improves the inductive bias of convolutional neural networks (CNNs) by fully leveraging the structure in the data via a stochastic tensor decomposition.

  * We demonstrate superior performance against both regular deep network architectures with fully-connected layers and networks with tensor regression layers that do not incorporate our proposed randomized decomposition.

  * We establish a new state-of-the-art for large scale regression from MRI data on the UK Biobank dataset, the largest dataset of brain MRI. We demonstrate that our model is significantly more robust to noise in the input, as occurs naturally during capture.

  * Our method makes neural networks significantly more robust to adversarial noise, without adversarial training.

  * We show that our proposed method implicitly regularizes the tensor decomposition. We establish theoretically and empirically the link between tensor dropout and the deterministic low-rank tensor regression.

  * We validate all aspects of our method on the CIFAR-100 image classification dataset in thorough ablation studies.









§ RELATED WORK

In this section, we review the most closely related work to ours.

Network regularization and dropout. Several methods that improve generalization by mitigating overfitting have been developed in the context of deep learning. The interested reader is referred to the work of <cit.> and the references therein for a comprehensive survey of regularization techniques for deep networks.
The most closely related regularization method to our approach is Dropout <cit.>, which is probably the most widely adopted technique for training neural networks while preventing overfitting. Concretely, during training, each unit (i.e., neuron) is equipped with a binary Bernoulli random variable and only the network’s weights whose corresponding Bernoulli variables are sampled with value 1 are updated at each back-propagation step. At each iteration, those Bernoulli variables are re-sampled again and the weights are updated accordingly. Our proposed regularization method can be interpreted as dropout on low-rank tensor regression, a fact which we proved in Section (<ref>). 


Randomized tensor decompositions.
Tensor decompositions exhibit high computational cost and low convergence rate when applied to massive multi-dimensional data. To accelerate computation, and enable them to scale, randomized approaches have been employed. A randomized least squares algorithm for CP decomposition is proposed by <cit.>, which is significantly faster than traditional one. In <cit.>, CP is applied on a small tensor generated by multi-linear random projection of the high-dimensional tensor. The CP decomposition of the large-scale tensor is obtained by back projection of the CP decomposition of the small tensor. <cit.> introduce a fast yet provable randomized CP decomposition that performs randomized tensor contraction using FFT. Methods in <cit.> are highly computationally efficient algorithms for computing large-scale CP decompositions by applying random projections into a set of small tensors, derived by subdividing a tensor into a set of blocks. Fast randomized algorithms that approximate Tucker decomposition using Sketching have also been investigated <cit.>. More recently, a randomized tensor ring decomposition that employs tensor random projections has been developed in <cit.>. The most similar method to ours is that of <cit.>, where elements of the tensor are sampled randomly, and each factor of the decomposition updated in an iterative manner. By contrast, our method allows for end-to-end training, and applies randomization on the fibers of the tensor, effectively randomizing the rank of the weight tensor.




§ PRELIMINARIES AND TENSOR REGRESSION LAYERS

In this section, we introduce the notations and preliminary notions necessary to introduce our stochastic rank regularization, including tensor regression layers.




Notation: We denote v to be vectors (1order tensors) and M to be matrices (2order tensors).  is the identity matrix. We denote as X tensors of order N ≥ 3, and denote its element (i, j, k) as X_i_0, i_1, ⋯, i_N -  or  X(i_0, i_1, ⋯, i_N -). A colon is used to denote all elements of a mode e.g. the mode-0 fibers of X are denoted as X_, i_1, ⋯, i_N. The transpose of M is denoted M. 
For any tensor X, we denote X^*2 the Hadamard power of 2, which squares each element of the tensor.
Finally, for any i, j ∈, i < j, ij denotes the set of integers { i, i+1, ⋯ , j-1, j}, and i  j the integer division of i by j.

Tensor unfolding:
	Given a tensor,
	X∈^I_0 × I_1 ×⋯× I_N,
	its mode-n unfolding is a matrix X_[n]∈^I_n, I_M, 
	with M = ∏_k=0,
k ≠ n^N I_k, defined by the mapping from 
	(i_0, i_1, ⋯, i_N) to (i_n, j), with 
	
    j = ∑_k=0,
    k ≠ n^N i_k ×∏_m=k+1,
     m ≠ n^N I_m.

	
Tensor vectorization: 	Given a tensor,
	X∈^I_0 × I_1 ×⋯× I_N, 
	we can flatten it into a vector vec(X) 
	of size (I_0 ×⋯× I_N) 
	defined by the mapping from element
	(i_0, i_1, ⋯, i_N) of X to element j of vec(X), with 
	
    j = ∑_k=0^N i_k ×∏_m=k+1^N I_m.


Mode-n product:
For a tensor X∈^I_0 × I_1 ×⋯× I_N and a matrix M∈^J × I_n, the n-mode product of a tensor 
is a tensor of size 
(I_0 ×⋯× I_n-1× J × I_n+1×⋯× I_N) 
and can be expressed using unfolding of X 
and the classical dot product as:

    (X×_n M)_[n] = MX_[n]∈^I_0 ×⋯× I_n-1× R × I_n+1×·× I_N


Inner product:
For two tensors of matching sizes, X, Y∈^I_0  ×⋯× I_N, we denote by 
XY∈ the contraction of X by Y along each mode.

    XY_N = ∑_i_0=0^I_0∑_i_1=0^I_1⋯∑_i_n=0^I_NX_i_0, i_1, ⋯, i_nY_i_0, i_1, ⋯, i_n



Kruskal tensor:
Given a tensor X∈^I_0 × I_1 ×⋯× I_N - 1, 
the Canonical-Polyadic decomposition (CP), also called PARAFAC, decomposes it into a sum of R rank-1 tensors. The number of terms in the sum, R, is known as the rank of the decomposition. Formally, we find the vectors 𝐮^(0)_k , 𝐮^(1)_k, ⋯, 𝐮^(N )_k, for k = 0R-1, as well as an optional vector of weights λ∈^R to absorbs the magnitude of the factors such that:

    X
    = ∑_k=0^R-1λ_k u^(0)_k∘u^(1)_k∘⋯∘u^(N)_k_rank-1 components,


For any k ∈0N, these vectors 𝐮^(k)_r, r ∈0R-1 can be collected in matrices, called factors or the decomposition, and defined as 𝐔^(k) = [ 𝐮^(k)_0, 𝐮^(k)_1, ⋯, 𝐮^(k)_R-1].
The decomposition can be denoted more compactly as
X = λ; 𝐔^(0), ⋯, 𝐔^(N ).

Tucker tensor:
Given a tensor X∈^I_0 × I_1 ×⋯× I_N, 
we can decompose it into a low rank core 
G∈^R_0 × R_1 ×⋯× R_N - 
by projecting along each of its modes
with projection factors 
( U^(0), ⋯,U^(N)), with U^(k)∈^R_k, I_k, k ∈ (0, ⋯, N).
The tensor in its decomposed form  can then be written:

    X   = 
    G×_0 U^(0)×_1  U^(1)×⋯×_NU^(N)
       = GU^(0),
    		  ⋯,
              U^(N)

Note that the Kruskal form of a tensor can be seen as a Tucker tensor with a super-diagonal core.

Tensor diagrams: In order to represent easily tensor operations, we adopt the tensor diagrams, where tensors are represented by vertices (circles) and edges represent their modes. The degree of a vertex then represents its order. Connecting two edges symbolizes a tensor contraction between the two represented modes. Figure <ref> presents a tensor diagram of the tensor regression layer and its stochastic rank-regularized counter-part.


 Tensor regression layers:
 Reducing the storage and computational costs of deep networks has become critical for meeting the
requirements of environments with limited memory or computational resources.
To this end, a surge of network compression and approximation algorithms have recently been proposed in the context of deep learning. By leveraging the redundancy in network parameters, methods such as <cit.> employ low-rank approximations
of deep networks’ weight matrices (or tensors) for parameter reduction. Network compression methods in the frequency domain <cit.> have also been investigated. An alternative approach for reducing the number of effective parameters in deep nets relies on sketching, whereby, given a matrix or tensor of input data or parameters, one first compresses it to a much smaller matrix (or tensor) by multiplying it by a (usually) random matrix with certain properties <cit.>.

A particularly appealing approach to network compression, especially for visual data (and other types of multidimensional and multi-aspect data), is tensor regression networks <cit.>. Deep neural networks typically leverage the spatial structure of input data via series of convolutions, point-wise non-linearities, pooling, etc.
However, this structure is usually wasted by the addition, at the end of the networks' architectures, of a flattening layer followed by one or several fully-connected layers. 
A recent line of study focuses on alleviating this using tensor methods. <cit.> proposed tensor contraction as a layer, to reduce the size of activation tensors, and demonstrated large space savings with this layer. 
Recently, tensor regression networks <cit.> propose to replace fully-connected layers entirely with a tensor regression layer (TRL). This tensor regression layers preserves the structure by expressing an output tensor as the result of a tensor contraction between the input tensor and some low-rank regression weight tensors.

More specifically, we assume we have a set of S input activation tensors
X^(k)∈^I_0 × I_1 ×⋯× I_N
and corresponding target labels y^(k)∈, with k ∈0N. Not that here, for clarity, we introduce the tensor regression layer for scalar targets. In practice the target is typically a vector or a tensor.
A tensor regression layer estimates the regression weight tensor 
W∈^I_0 × I_1 ×⋯× I_N,
expressed under some low-rank decomposition.
For instance, using a rank–(R_0, ⋯, R_N) Tucker decomposition, we have:

    y^(k)    = X^(k)W + b 
    with    W 
             =  
             G×_0 U^(0)×_1 U^(1)⋯×_N U^(N)

with G∈^R_0 ×⋯× R_N, 
U^(k)∈^I_k × R_k 
for each 
k in 0N
and U^(N)∈^O × R_N.

In addition to preserving and leveraging the structure in the input, TRL allow for large space savings without sacrificing accuracy. <cit.> explore the same model with various low-rank structures on the regression weights.



§ TENSOR DROPOUT


In this section, we introduce our tensor dropout and apply it to tensor regression layers. Specifically, we propose a new stochastic rank-regularization, applied to low-rank tensors in decomposed forms. This formulation is general and can be applied to any type of decomposition. We introduce it here, without loss of generality, to the case of Tucker and CP decompositions.


Randomized tensor regression layer
We propose a novel randomized decomposition on W, which applies dropout in the latent subspace spanned by a tensor decomposition.
For instance, for an N–order regression weight with a Tucker structure, we can define for each k ∈0N, a sketch matrix M^(k)∈^R_k× R_k (e.g. a random projection or column selection matrix). This can then be used to sketch the factors U^(k) of the decomposition as Ũ^(k) = U^(k)(M^(k)) be a sketch of factor matrix , and the core tensor  G as G̃ = G×_0  M^(0)×⋯×_NM^(N).

Applying this to tensor regression, we can apply this tensor dropout technique to the regression weights. Given an activation tensor X∈^I_0 ×⋯× I_N and a set of S target labels y^(k), a Randomized-Tensor Regression Layer (R-TRL) is obtained from equation <ref> and aims at minimizing the empirical risk:

    1/S-1∑^S-1_k=0(y^(k) - W̃X^(k))^2,

where W̃ is a stochastic low-rank approximation of Tucker decomposition. In other words, in addition to the low-rank structure of the weights, we apply our tensor dropout in the latent subspace spanned by the decomposition.

For instance, in the case of a Tucker R-TRL, we have:

    W̃ 
     =  
     G̃×_0 Ũ^(0)×⋯×_NŨ^(N)


This is the core of our proposed R-TRL, which incorporates tensor dropout within a TRL. 
Even though several sketching methods have been proposed, we focus here on R-TRL with two different types of binary sketching matrices, namely binary matrix sketching with replacement and binary diagonal matrix sketching with Bernoulli entries, which we detail below.




 §.§ Bernoulli Tucker randomized tensor regression

For any n ∈0N, let λ^(n)∈^R_N be a random vector, the entries of which are i.i.d. Bernoulli(θ), then a diagonal Bernoulli sketching matrix is defined as M^(n) = diag(λ^(n)).

When the low-rank structure on the weight tensor W̃ of the TRL is imposed using a Tucker decomposition, the randomized Tucker approximation is expressed as:

    W̃ 
        =     G×_0  M^(0)×⋯×_NM^(N)
       ×_0 (U^(0)(M^(0)))
        ×⋯×_N(U^(N)(M^(N))) 
         = G̃Ũ^(0), ⋯, Ũ^(N)


The main advantage of considering the above-mentioned sampling matrices is that the products Ũ^(k) = U^(k)(M^(k)) or G̃ = G×_0  M^(0)×⋯×_NM^(N) are never explicitly computed, we simply select the elements from G and the corresponding factors.

Interestingly, in analogy to dropout, where each hidden unit is dropped independently with probability 1 - θ, in the proposed randomized tensor decomposition, the columns of the factor matrices and the corresponding fibers of the core tensor are dropped independently and consequently the rank of the tensor decomposition is stochastically dropped.

The tensor dropout acts as an implicit regularizer on the regression, by limiting the rank, at each iteration. This can be shown by examining the expectation of the stochastic loss, which can be expressed deterministically as the unrandomized empirical loss, plus an additional regularization term.

Tensor Dropout with Tucker decomposition is a deterministic regularized loss. (Proof in Appendix <ref>)

The minimization objective (equation <ref>) can be reformulated by expanding the tensor contractions, and the expectation of the minimization objective becomes:

    λ1/S-1∑^S-1_k=0(y^(k) - W̃X^(k))^2
        = 1/S-1∑^S-1_k=0(y^(k) - θ^NWX^(k))^2 
        + θ^N(1-θ^N)/S-1∑^S-1_k=0G^⋆ 2×_0 (U^(0))^⋆ 2…×_N (U^(N))^⋆ 2(X^(k))^⋆ 2.






 §.§ Bernoulli CP randomized tensor regression


An interesting special case of equation (<ref>) is when the weight tensor W̃ of the TRL is expressed using a CP decomposition. 
In that case, we set M = M^(0) = ⋯ = M^(N) = (λ), with, for any k ∈0R, λ_k ∼Bernoulli(θ).

Then a randomized CP approximation is expressed as:

    W̃    = 
        ∑_k=0^R-1Ũ^(0)_k ∘⋯∘Ũ^(N)_k


The above randomized CP decomposition on the weights is equivalent to the following formulation (see proof in Appendix <ref>):

    W̃ 
        =    λ; 𝐔^(0), ⋯, 𝐔^(N)


Based on the previous stochastic regularization, for an activation tensor X and a corresponding label vector y, the optimization problem for our tensor regression layer with stochastic regularization is given by:

    min_U^(0), ⋯,  U^(N)(y^(k) - 
        λ; 𝐔^(0), ⋯, 𝐔^(N)X^(k))^2


In addition, the above stochastic optimization loss can be rewritten as a deterministic regularized one:
Tensor Dropout with CP decomposition is equivalent to a deterministic regularized loss. (Proof in Appendix <ref>)

    λ1/S-1∑^S-1_k=0(y^(k) - 
        λ; 𝐔^(0), ⋯, 𝐔^(N)X^(k))^2
        = 1/S-1∑^S-1_k=0(y^(k) - 
    θ𝐔^(0), ⋯, 𝐔^(N)X^(k))^2 
        + θ(1-θ)/S-1∑^S-1_k=0(𝐔^(0))^⋆ 2, ⋯, (𝐔^(N))^⋆ 2(X^(k))^⋆ 2.








 §.§ R-TRL with replacement

Previously, we focus on the R-TRL with Bernoulli sampling only. Our model is more general and can be applied to many different sampling settings. 
Here, we introduce one such case: the R-TRL with binary sketching matrix (i.e. with replacement). Specifically, we first choose θ∈ [0, 1]. 

Mathematically, we then introduce the uniform sampling matrices
M^(0)∈^R_0× R_0,
⋯, 
M^(N)∈^R_N× R_N. 
M_j is a uniform sampling matrix, selecting K_j elements, where K_j = R_j θ.
In other words, for any i ∈0N, M^(i) verifies:

    M^(i)(j, :) = 
        0    j > K 
    _m(r, :), m ∈0R_i

In practice this is done efficiently by selecting directly the correct elements from G and its corresponding factors.



§ EXPERIMENTAL EVALUATION


In this section, we present the numerical simulations, experimental setting, databases used and implementation details. We experimented on several datasets across various tasks, namely image classification and MRI-based regression.
All methods were implemented [code will be released upon acceptance to reproduce all results] using PyTorch <cit.> and TensorLy <cit.>. For all adversarial attacks, we used Foolbox <cit.>.




 §.§ Numerical experiments on synthetic data






Here, we empirically demonstrate the equivalence between our stochastic rank regularization and the deterministic regularization based formulation of the dropout.

To do so, we first created a random regression weight tensor W to be a third order tensor of size (25 × 25 × 25), formed as a rank–10 Kruskal tensor, the factors of which were sampled from an i.i.d. Gaussian distribution.
We then generated a tensor of 5 000 random samples, X of size (5 000 × 25 × 25 × 25), the elements of which were sampled from a Normal distribution. Finally, we constructed the corresponding response array y of size 5 000 as: ∀ i ∈15 000,  y_i = X_iW.
Using the same regression weight tensor and same procedure, we also generated 1000 testing samples and labels.

We use this data to train a CP R-TRL with our Tensor Dropout with rank 15, using both our Bernoulli stochastic formulation (equation 9 in main paper) and its deterministic counter-part (equation 10 in main paper). We train for 500 epochs, with a mini-batch size of 100, and an initial learning rate of 10e-4, which we decrease by a factor of 10 every 200 epochs. Figure <ref> shows the loss function as a function of the epoch number. As expected, both formulations are identical.



 §.§ Large Scale Image Classification

In this section, we report results for large-scale image classification on the ImageNet dataset.



  
ImageNet <cit.> is a large dataset for image classification composed of 1.2 million training images and 50,000 images for validation.
We evaluate the classification error in terms of top-1 and top-5 classification accuracy on a 224 × 224 single center crop from the raw input images.
For training, we use a ResNet-101 and follow the same procedure and setting as <cit.>. Note that the original ResNet paper <cit.> reports 10-crop validation error on ImageNet. Since then, single-crop has become the more common method of processing. The ResNet authors reported their single-crop results in their up-to-date code repository <cit.>.



The results, Table <ref>, show that our method outperforms the baselines, with higher classification accuracy even for large values of θ. This suggests the stochastic rank regularization helps constrain the learned representations to be more general. That leads to reduced over-fitting and better out-of-sample generalizability. The improvement of tensor dropout is greater than that of regular dropout, which has been reported to be around 0.3 percentage points in previous studies on ResNets trained on ImageNet <cit.>.



  
Robustness study
In addition to improving performance by reducing over-fitting, we demonstrate that our proposed stochastic regularization makes the model more robust to perturbations in the input, for both random noise and adversarial attacks.

In particular, we tested robustness to adversarial examples produced using three different types of attack: Fast Gradient Sign Method (FGSM) <cit.>, Basic Iterative Method (BIM) <cit.> and Projected Gradient Descend (PGD) <cit.> in Foolbox <cit.>. All attacks were untargeted. We note, that in <cit.>, the authors showed that a method robust to PGD attack is reasonably robust to any form of first order gradient based attacks. In this method, the sign of the optimization gradient multiplied by the perturbation magnitude is added to the image in a single iteration. The perturbations we used are of magnitudes λ× 10^-3, λ∈{2, 8, 16}
. For an input image normalized in the range [0, 1], λ will be divided by 255. For the iterative methods BIM and PGD, we follow <cit.> setting the step size to 1 and the number of iterations to min(λ+4,1.25λ). This fixed computational budget provides a compromise between the resources available to the attacker and the computational cost of the experiments.

As the results from Table <ref> show, the proposed approach is significantly more robust to adversarial attacks across the entire range of adversarial noise tested. This further highlights that R-TRL is able to generalize better.



Moreover, in figure <ref>, we report the classification accuracy as a function of the added adversarial noise. Specifically, following <cit.>, we sampled 1,000 unseen test images. The models were trained without any adversarial training and adversarial noise was added using the Fast Gradient Sign method. Our Tucker R-TRL model is much more robust to adversarial attacks.

Adversarial defenses through randomness have been explored before, in different forms. For example, perturbing the input with isotropic Gaussian noise gives substantial and certifiable robustness to attacks on ImageNet <cit.>, and adding random noise to each layer of the network provides defense against strong attacks <cit.>. However, these prior methods differ fundamentally to the one we present here. The randomness in our method is concerned with the rank of the factor tensors during training only and not perturbing the input or weights. Theoretically, our method is more related to regular dropout as we show in section <ref>.






 §.§ Phenotypic trait prediction from MRI data

Contemporary neurological research often uses scalar measures of brain or grey matter volumes over time as a proxy for brain neuronal volume. For example, to provide estimates of neuronal loss over time <cit.>. However, the global and local structure of brain tissue also change <cit.>, causing structural and textural changes that are not captured by scalar volume measures. CNNs are more suited for learning these intricate and complex relationships. However, the highly multi-dimensional mappings come with added risk of overfitting. Model generalizability is therefore paramount in this domain, providing a concrete demonstration of the strengths of the tensor dropout.

In a regression setting, we investigate the performance of our method on a very large MRI dataset on the task of age prediction.

The difference between an individual's chronologial age and the age as predicted by a trained model is often referred to as brain-age. This metric which has been associated with diseases <cit.> and increased risk of mortality <cit.>. A more accurate and robust metric of brain condition can consequently lead to more accurate disease diagnoses.

In addition to the general neuroradiological motivations outlined above, this task is particularly interesting since MRI volumes are large 3D tensors, all modes of which carry important information. The spatial information is traditionally discarded during the flattening process, which we avoid by using a tensor regression layer. In these experiments we train the entire model, but any pre-trained network can be easily modified post-hoc to make use of the TRL.



  
UK Biobank brain MRI dataset <cit.> is the world's largest MRI imaging database of its kind. The aim of the UK Biobank Imaging Study is to capture MRI scans of vital organs for 100,000 primarily healthy individuals by 2022. Associations between these images and lifestyle factors and health outcomes, both of which are already available in the UK Biobank, will enable researchers to improve diagnoses and treatments for numerous diseases.

The data we use here consists of T1-weighted 182×218×182 MR images of the brain captured on a 3 T Siemens Skyra system. 11,500 are used for training, 3,800 are used for validation and 3,800 samples are used to test. The target label is the age for each individual at the time of MRI capture. We use skull-stripped images that have been aligned to the MNI152 template <cit.> for head-size normalization. We then center and scale each image to zero mean and unit variance for intensity normalization.





  
Results: For MRI-based experiments we implement an 18-layer ResNet with three-dimensional convolutions. We minimize the mean squared error using Adam <cit.>, starting with an initial learning rate of 10^-4, reduced by a factor of 10 at epochs 25, 50, and 75. We train for 100 epochs with a mini-batch size of 8 and a weight decay (L_2 penalty) of 5×10^-4. For Tucker-based R-TRL we used a tensor with rank 128 × 6 × 7 × 6. For CP-based R-TRL we used a Kruskal tensor with 82 components.
 As previously observed, our randomized tensor regression network outperforms the 3D-ResNet baseline by a large margin, Table <ref>.
To put this into context, the current state-of-art for convolutional neural networks on age prediction from brain MRI on most datasets is an MAE of around 3.6 years <cit.>.


  
Robustness study:
We tested the robustness of our model to  white Gaussian noise added to the MRI data. Noise in MRI data typically follows a Rician distribution but can be approximated by a Gaussian for signal-to-noise ratios (SNR) greater than 2 <cit.>. As both the signal (MRI voxel intensities) and noise are zero-mean, we define SNR = σ_signal^2/σ_noise^2, where σ is the variance. We incrementally increase the added noise in the test set and compare the error rate of the models.





The ResNet with R-TRL is significantly more robust to added white Gaussian noise compared to the same architectures without it (figure <ref>). At signal-to-noise ratios below 10, the accuracy of a standard fully-connected ResNet is worse than a naive model that predicts the mean of training set (MAE = 7.9 years).
Brain morphology is an important attribute that has been associated with various biological traits including cognitive function and overall health <cit.>. By keeping the structure of the brain represented in MRI in every layer of the architecture, the model has more information to learn a more accurate representation of the entire input.
Randomly dropping the rank forces the representation to be robust to confounds. This a particularly important property for MRI analysis since intensities and noise artifacts can vary significantly between MRI scanners <cit.>. Randomized tensor regression layers enable both more accurate and more robust trait predictions from MRI that can consequently lead to more accurate disease diagnoses.




 §.§ Ablation Studies on CIFAR-100


In the image classification setting, we perform a thorough study of our method on the CIFAR-100 dataset. We empirically compare our approach to both standard baseline, traditional tensor regression, and regular dropout, and assess the robustness of each method in the face of adversarial noise.



  
CIFAR-100 <cit.> consists of 60,000 32 × 32 RGB images in 100 classes, divided into 50,000 images for training and 10,000 for testing. We pre-processed the data by centering and scaling each image and then augmented the training images with random cropping and random horizontal flipping.

We compare the randomized tensor regression layer to full-rank tensor regression, average pooling and a fully-connected layer in an 18-layer residual network (ResNet) <cit.>. For all networks, we used a batch size of 128 and trained for 400 epochs, and minimized the cross-entropy loss using stochastic gradient descent (SGD). The initial learning rate was set to 0.01 and lowered by a factor of 10 at epochs 150, 250 and 350. We used a weight decay (L_2 penalty) of 10^-4 and a momentum of 0.9.





  
Classification results:
Table <ref> presents results obtained on the CIFAR-100 dataset, on which our method matches or outperforms other methods, including the same architectures without R-TRL.
Our regularization method makes the network more robust by reducing over-fitting, thus allowing for superior performance on the testing set.



A natural question is whether the model is sensitive to the choice of rank and θ (or drop rate when sampling with repetition). To assess this, we show the performance as a function of both rank and θ in figure <ref>. The reduction in rank is presented as the compression ratio = size of full tensor/size of factorized cores and factors. As can be observed, there is a large surface for which performance remains the same while decreasing both parameters (note the logarithmic scale for the rank). This means that, as demonstrated, choosing good values for CIFAR-100 was not a problem. Rank insensitivity cannot be guaranteed across all tasks and datasets, but rank-selection was not found to be an issue for ImageNet or MRI tasks.








  
Performance as a function of rank and θ in replacement R-TRL

To illustrate the generality of our approach, which does not depend on the Bernoulli sampling, we perform a similar experiment with a different randomization: instead of using a Bernoulli random variable, we sample components with replacement according to a uniform sampling matrix (figure  <ref>). As for the Bernoulli case, there is a large surface for which performance remains the same while decreasing both parameters.



  
Comparison with regular dropout
One question is whether our proposed tensor dropout is more robust than traditional dropout applied directly to the weights. To test this, we apply FGSM adversarial perturbations to each method, with varying magnitudes λ× 10^-3, λ∈{1, 2, 4, 8, 16, 32, 64, 128}. We sample 1,000 images from the test set <cit.>. The models were trained without any adversarial training, on the training set, and adversarial noise was added to the test samples using the Fast Gradient Sign method. The results of which can be seen in figure <ref>. Our model is much more robust to adversarial attacks. Intuitively our method is able to leverage redundancies in the latent subspace, without creating holes in the weights, unlike dropout. In addition, since the randomization is used only during training (and not at test time), this forces the latent decomposition to be over-complete and account for noise, thus rendering the model more robust to perturbation.



§ CONCLUSION

We introduced tensor dropout, a novel randomized tensor decomposition, suitable for end-to-end training of tensor regression layers. Adding stochasticity on the rank during training renders the network significantly more robust and leads to better performance. This results in networks that are more resilient to noise, both adversarial and random, without any addition such as adversarial training. Our results demonstrate superior performance on a variety of real-life, large-scale challenging tasks, including MRI data and images, as well as increased robustness. Finally, we establish the link between this randomized TRL and dropout on the deterministic TRL.


 


































§ ACKNOWLEDGMENT

This research has been conducted using the UK Biobank Resource under Application
Number 18545.









ieeetr




















§ CONNECTION BETWEEN STOCHASTIC AND DETERMINISTIC REGRESSION


In this section, we study the empirical risk minimization of Tensor Dropout. We establish the link between Tensor Dropout with stochastic Tucker decomposition and the deterministic regularized loss. We do this by proving the equality between equations <ref> and <ref> (Theorem <ref>).


The minimization objective in equation <ref> can be reformulated by expanding the tensor contractions in Tucker form as:

    W̃_i_0, …,i_N
        =
        ∑_r_0=1^R_0⋯∑_r_N=1^R_Ng_r_0, …,r_Nλ_r_0^(0)…λ_r_N^(N)U_i_0r_0^(0)…U_i_Nr_N^(N)


By considering the expectation over the empirical risk, we get:

    λ1/S-1∑^S-1_k=0(y^(k) - W̃X^(k))^2   =
    1/S-1∑^S-1_k=0λ(y^(k) - W̃X^(k))^2
       =
    1/S-1∑^S-1_k=0λ(
    y^(k) - W̃X^(k))^2
    _E 
    + 1/S-1∑^S-1_k=0y^(k) - W̃X^(k)_V



The expectation E and variance V can then be written separately, using the Tucker expansion from Equation <ref>:

    E    =
    1/S-1∑^S-1_k=0(
    y^(k) - 
    ∑_i_0⋯∑_i_NX_i_0, …,i_N^(k)∑_r_0⋯∑_r_Ng_r_0, …,r_Nλ_r_0^(0)…λ_r_N^(N)U_i_0r_0^(0)…U_i_Nr_N^(N))
    ^2 
        = 1/S-1∑^S-1_k=0(y^(k) - θ^NWX^(k))^2
     as λ^(0), …,  λ^(N) are i.i.d.



    V    =
    1/S-1∑^S-1_k=0(
    (-1)^2
    ∑_i_0⋯∑_i_N(X_i_0, …,i_N^(k))^2
    ∑_r_0⋯∑_r_Ng_r_0, …,r_N^2
    λ_r_0^(0)…λ_r_N^(N)
    )
    (U_i_0r_0^(0))^2 … (U_i_Nr_N^(N))^2
    )
    
        =
    1/S-1θ^N(1-θ^N)
    ∑^S-1_k=0(
    ∑_i_0⋯∑_i_N
    (X_i_0, …,i_N^(k))^2
    G^⋆ 2×_0 (U^(0))^⋆ 2…×_N (U^(N))^⋆ 2) 
        =
    θ^N(1-θ^N)/S-1∑^S-1_k=0G^⋆ 2×_0 (U^(0))^⋆ 2…×_N (U^(N))^⋆ 2(X^(k))^⋆ 2)


Therefore, 

    𝔼_ λ[  1/S-1∑^S-1_k=0(y^(k) - W̃X^(k))^2
     ] 
    =      1/S-1∑^S-1_k=0(y^(k) - θ^NWX^(k))^2 
        + θ^N(1-θ^N)/S-1∑^S-1_k=0G^⋆ 2×_0 (U^(0))^⋆ 2…×_N (U^(N))^⋆ 2(X^(k))^⋆ 2.






§ 


In this section, we study Tensor Dropout's empirical risk minimization and establish the link between Tensor Dropout with stochastic CP decomposition and the corresponding deterministic regularized loss (Theorem <ref>). To do so, we first establish the equality between <ref> and <ref>. 
We then prove Theorem <ref>, which is the equivalence of equations <ref> and <ref>.


Here we prove the following equivalence (equations <ref> and <ref>):

    W̃    = 
        ∑_k=0^R-1Ũ^(0)_k ∘⋯∘Ũ^(N)_k
        = 
        ∑_k=0^R-1λ_k U^(0)_k ∘⋯∘U^(0)_N 
        =
        λ; 𝐔^(0), ⋯, 𝐔^(N)


This can be seen by looking at the individual elements of the sketched factors.
Let k ∈0N and i_k ∈0I_k, r ∈0R-1. Then 

    Ũ_i_k, r^(k) = ∑_j=0^R-1U_i_k, j^(k)M_j, r.

Since M = diag(λ), ∀ i, j ∈0R-1, M_ij = 0 if i ≠ j, and λ_i otherwise, we get 

    Ũ_i_k, r^(k) = λ_r U_i_k, r^(k).

It follows that W̃_i_0, i_1, ⋯, i_N =
∑_r=0^R-1λ_k U^(0)_k ∘⋯∘λ_k U^(N)_k
Since λ_r ∈{0, 1}, we have 

    W̃_i_0, i_1, ⋯, i_N = 
      ∑_r=0^R-1λ_k (U^(0)_k ∘⋯∘U^(N)_k)






Here we prove that Tensor Dropout with stochastic CP decomposition is equivalent to deterministic regularized loss.
By considering the expectation over the empirical risk, we get:

    λ1/S-1∑^S-1_k=0(y^(k) - W̃X^(k))^2   =
    1/S-1∑^S-1_k=0λ(y^(k) - W̃X^(k))^2
       =
    1/S-1∑^S-1_k=0λ(
    y^(k) - W̃X^(k))^2
    _E 
    + 1/S-1∑^S-1_k=0y^(k) - W̃X^(k)_V


For Tensor dropout where weights are constructed with CP factors: 
W̃ = ∑_r=0^R-1λ_nU_i_0r_0^(0)…U_i_Nr_N^(N)
the minimization objective can be written as:


    E    =
    1/S-1∑^S-1_k=0(
    y^(k) - 
    ∑_i_0=1^I_0⋯∑_i_N=1^I_N∑_r=0^R-1λ_nU_i_0r_0^(0)…U_i_Nr_N^(N)
    (X^(k))^⋆ 2)
    ^2 
        = 1/S-1∑^S-1_k=0(y^(k) - θ^NWX^(k))^2



    V    =
    1/S-1∑^S-1_k=0(-1)^2
    ∑_i_0⋯∑_i_N(X_i_0, …,i_N^(k))^2
    ∑_r=0^R-1θ
    (U_i_0,r^(0))^2 … (U_i_Nr^(N))^2 
        =θ(1-θ)/S-1∑^S-1_k=0
    (U^(0))^⋆ 2, …, U^(N))^⋆ 2(X^(k))^⋆ 2



Therefore,

    𝔼_ λ[  1/S-1∑^S-1_k=0(y^(k) - 
            λ; 𝐔^(0), ⋯, 𝐔^(N)X^(k))^2
     ] 
    = 
           1/S-1∑^S-1_k=0(y^(k) - 
        θ𝐔^(0), ⋯, 𝐔^(N)X^(k))^2 
        + θ(1-θ)/S-1∑^S-1_k=0(𝐔^(0))^⋆ 2, ⋯, (𝐔^(N))^⋆ 2(X^(k))^⋆ 2





