Model compression is widely employed to deploy convolutional neural networks on devices with limited computational resources or power limitations. For high stakes applications, such as autonomous driving, it is, however, important that compression techniques do not impair the safety of the system. In this paper, we therefore investigate the changes introduced by three compression methods - post-training quantization, global unstructured pruning, and the combination of both - that go beyond the test accuracy. To this end, we trained three image classifiers on two datasets and compared them regarding their performance on the class level and regarding their attention to different input regions. Although the deviations in test accuracy were minimal, our results show that the considered compression techniques introduce substantial changes to the models that reflect in the quality of predictions of individual classes and in the salience of input regions. While we did not observe the introduction of systematic errors or biases towards certain classes, these changes can significantly impact the failure modes of CNNs and thus are highly relevant for safety analyses. We therefore conclude that it is important to be aware of the changes caused by model compression and to already consider them in the early stages of the development process.
Deep Neural Networks (DNNs) enable many complex
applications such as autonomous vehicles or automated
manufacturing processes. Especially for perception tasks,
Convolutional Neural Networks (CNNs) have shown impressive
results and have been adopted widely. However, to achieve
a high degree of performance, these networks often have
millions of parameters that require significant computing
power for inference, impeding the deployment on edge or
low-power mobile devices
In the following, we present the related work regarding CNNs compression and its relevance towards arguing the safety for ML-based systems. 2.1
Model pruning is a common technique for various ML
algorithms, such as decision trees (Mingers 1989) and
inductive logic programming
Another widespread model compression technique is
quantization that aims to reduce the number of bits required to
represent the parameters of a DNN. DNNs are usually trained
on hardware accelerators, such as GPUs or TPUs, that use
lfoating points, usually 32bit or 16bit, to represent the
parameters. A common technique is to quantize the parameters
to 8-bit integers, effectively reducing the size by a factor of
4 or 2 respectively and allowing the exploitation of 8-bit
optimized computations of mobile CPUs, while having
minimal impact on the model performance (Wu et al. 2016). In
practice, post-training quantization and quantization-aware
training are common. With post-training quantization, the
parameters of a model are quantized after the training phase
without requiring any fine-tuning. In contrast,
quantizationaware training models the parameter quantization during
training and is able to achieve even lower bit-widths. As
with pruning, both variants have implementations in
common ML frameworks. Research in that domain focuses on
achieving lower bit-widths, while only minimally impacting
the performance of models
Besides pruning and quantization, other model compression
techniques have been proposed. For instance, N2N
learning (Ashok et al. 2018) removes parts of a network and
afterwards shrinks them using a reinforcement learning
approach. With Knowledge distillation, one or more networks
are trained to serve as teacher models which a smaller
student model is trained to mimic
Compressed models have been extensively studied
regarding their robustness against adversarial attacks. For
instance,
Arguing the safety of ML-based systems is an emerging field
and highly relevant to enable the use of ML in safety-critical
applications. A promising direction are holistic assurance
strategies
In this section, we discuss our results and observed findings regarding the changes beyond test accuracy introduced when compressing image classifiers with pruning or quantization techniques. 3.1
To analyze the influence model architecture, we considered
three different networks. A ResNet-18 (~11m parameters)
We trained each model by minimizing the negative loglikelihood using Adam as an optimizer. To prevent overfitting, we stopped the training after the loss did not decrease for 40 epochs. To improve the base accuracy on CIFAR10, we transformed each image at each epoch by randomly lfipping it horizontally and by randomly cropping it back to 32x32px after adding a 4px padding each side.
To compress the models, we used the implementations for
pruning and quantization provided by the ML framework
PyTorch. We choose global unstructured pruning, using the
L1 norm to score the parameters of the model, whereby
the ones scored lowest are removed. We applied no
subsequent fine-tuning as it yielded the best results in our
experiments. Compared to structured pruning it is not as
applicable to practical applications, as without sparse tensor
computations it only affects the memory requirements of the
model. However, unstructured pruning is widely considered
in academia
For quantization, we chose a non-intrusive post-training approach with per-channel bit allocation, as it gave the best results in our experiments. We chose to quantize the weights of all models once to 8bit and once to 4bit. The first case enables the utilization of integer-based hardware accelerators, while the second one would require specialized hardware to gain additional benefits, apart from increased memory efficiency, compared to the 8-bit variant. The activation precision was kept at 8bit for both cases, as values below that severely impacted the accuracy of the models. Finally, we also combined both compression approaches by quantizing the pruned models with 8-bit precision for weights and activations. Table 1 lists all models and their compressed variants, stating their test accuracy and memory footprint. We do not provide a measure of the inference time as it greatly depends on the execution platform, e.g., if it can exploit the -10.0 10.0 sparseness of the pruned models or if it is optimized towards lfoating point or integer computations.
For the evaluation, we additionally generated saliency maps by computing the gradients for each input pixel regarding the target class and normalizing them to the range [0; 1] following (Simonyan, Vedaldi, and Zisserman 2014). Since PyTorch does not support gradient calculation for quantized tensors, we only generated saliency maps for the original and pruned variants of the models. 3.2
Table 1 shows the test accuracies of all configurations. Most configurations show only a slight drop in accuracy of less than 1 percentage point (pp), with the exception of some networks quantized with 4-bit weight precision. These are not considered further in the following sections as their substantial drop in accuracy already implies significant changes. 3.3
Pruning The accuracy on the entire test dataset did not reduce significantly after applying pruning for most conifgurations as Table 1 shows. However, we observe significant changes at the class level for many configurations, especially for GTSRB. For instance, Figure 1 shows the difference between the confusion matrices for the original and pruned ResNet-18 on GTSRB. While the test accuracy
GTSRB CIFAR-10
CIFAR-10 stayed the same, the accuracies and confusions of a few individual classes change significantly. As an example, class 0 (Speed limit 20km/h) is confused ~8pp more often with class 1 (Speed limit 30km/h) but on the other hand, class 40 (Roundabout mandatory) is mistaken ~11pp less often as class 37 (Go straight or left). Furthermore, class 40 is predicted more accurately by ~11pp whereas the accuracy of class 0 drops by ~10pp. Many more classes have changes in the accuracy or confusion in the range of up to 4pp that – depending on the concrete application – might also be relevant. Upon closer inspection, we find that for class 40 the correct predictions of the uncompressed model are a proper subset for the ones of the pruned network. For the remaining samples that were only predicted correctly by the pruned model, we find that the confidence is between 18pp and 24pp higher for the pruned model. This means, that for these particular samples there is a significant difference in how much support each of the networks generates for them and the increase in the correct predictions for this class by the pruned model is not just based on slight differences. Figure 2 summarizes the difference in confidence for the predicted class between the uncompressed and pruned ResNet-18. While the vast majority of predictions show a similar (≤ 2.5pp) confidence, for some samples the confidence changes significantly, up to 27.5pp. Although this only affects a small subset of all samples and the overall number of samples that are predicted differently is small with 0.6%, it is something to be aware of since it might have been caused by the introduction of additional failure modes. Depending at which stage of the system development model compression is considered this might have several implications. In the worst case, if model compression is performed immediately prior to the deployment without an extensive verification phase afterwards, these failure modes are not addressed, potentially leading to system failures during operations. But even in cases, where it is considered before the model verification it can significantly impact the development. As additional failure modes must be met with proper mitigation measures – e.g., in the form of safety monitors or considerations regarding the operational domain –, the development process can be prolonged if model compression is not considered as integral part of the system development.
For GTSRB, the overall effects regarding pruning are similar but more pronounced for LeNet and SqueezeNet compared to the ResNet-18. Here, for some classes the change in confusion or accuracy is a bit more noticeable with up to 15pp and the proportion of samples that are predicted differently is higher with 3.5% and 3% respectively. Also the mean difference in the confidence for each sample is significantly increased, even to the extent where a small fraction of samples for one variant generates full support for the target class and for the other one none, as Figure 3 highlights. The increase in the observed effects is likely due to the smaller initial sizes of LeNet and SqueezeNet compared to the ResNet-18. Although 72% of the ResNet18’s connections were pruned, it still has more than 7 times (SqueezeNet) and 89 times (LeNet) the number of parameters, potentially still containing redundant features.
One important finding on the imbalanced GTSRB is that pruning did not introduce significant biases against the infrequent classes for any of the networks. This also is evident when considering the diagonal in Figure 1, where no correlation between the change in accuracy and the frequency of the class is present. It is to mention, that the significant drop in accuracy for the most infrequent class 0 is only present for ResNet-18, for the other networks it is not present.
On CIFAR-10, the overall effects of pruning are similar to GTSRB but significantly less pronounced as Figure 4 shows. For SqueezeNet and LeNet the change in class-wise accuracies does not exceed 2.5pp or 4pp respectively. However, for these two networks it is to note that the overall number of samples that are predicted differently by the uncompressed and pruned variant is increased with 4.2% and 7.2% respectively. Referring to Figure 4 this effect can be explained as a result of previously wrong predictions that after applying pruning to the network are still predicted incorrectly but towards another class. Here, it is to highlight that for the classes airplane and horse this effect is the most prominent, with the first one being overall predicted less and the latter one being predicted more often by the pruned network, therefore introducing a slight bias respectively against or towards these classes. Overall, the increase in the intra-class confusion compared to GTSRB likely can be attributed to the different complexity of the tasks. While GTSRB has only very limited inter-class variance – a Speed limit (20km/h) sign always has the same shape and surface, the differences in the images stem from different lighting, viewing angles, etc. – for CIFAR-10 samples from the same class can vary greatly, increasing the likelihood of confusion.
Lastly, considering ResNet-18 on CIFAR-10, virtually no difference is observable between the uncompressed and pruned network. Only two samples are predicted differently and neither the uncompressed nor the pruned variant arrive at the correct prediction. Additionally, the confidence difference regarding the predicted class between both variants in all cases is ≤ 2.5pp. The likely reason for this similarity is that although 72.4% of the network have been pruned, the pruned network still contains enough redundancy to mimic the initial model and further pruning would be required to elicit any effects. In turn this also highlights that if pruning is performed conservatively and not to the absolute limit, i.e. until even slight changes in the overall accuracy are noticeable, a compressed variant might be achievable that virtually mimics the initial network.
Quantization Referring to Table 1, 8-bit quantization
shows very limited impact on the overall accuracy while
4bit quantization (with 8-bit activation precision) in half of
the experiments shows a significant drop in accuracy, a
common observation regarding the low precision in combination
with the static post-training quantization scheme
Comparing 4-bit (with 8-bit activation precision) quantization to 8-bit quantization for the configurations without a significant drop in accuracy, we find that the observed effects are the same but more pronounced for 4-bit quantization. As already observed when comparing pruning and 8-bit quantization, 4-bit quantization and 8-bit quantization show no consistent patterns regarding the impacted samples, further supporting the hypothesis that any sample or class can be affected.
Difference in accuracy to uncompressed model [pp] -4.0 -3.0 -2.0 -1.0 0.0 1.0 2.0 3.0 -4.0 Difference in accuracy to uncompressed model [pp] -2.0 0.0 2.0 4.0 6.0 Combined Pruning and Quantization Lastly, we combine pruning and quantization, by applying 8-bit quantization to the pruned models. As Table 1 shows, this has a slightly higher impact on the overall drop in accuracy than if the compression techniques would be applied individually, which is to be expected. Overall, the same general effects are observable as if pruning or quantization are applied individually as Figure 6 shows. Regarding the effect on individual classes, patterns present in both compression techniques are combined, sometimes amplifying, other times canceling out the effects. Potentially this could lead to drastic effects, however, in our experiments we did not observe any. Also, it is noticeable that generally the number of samples where the uncompressed and the compressed model disagree is slightly higher than for any of the single compression variants. Generally speaking, the combination of both compression techniques, however, shows no peculiarities and does not introduce significant additional effects. 3.4
In addition to the quantitative analysis performed in the previous section, we also qualitatively investigated the changes introduced by model compressing. For this, we generated saliency maps that highlight the salient input regions for a model’s decision regarding the target class. Since statically quantized models in PyTorch don’t support gradient calculation, we only analyze the changes between uncompressed and pruned model variants. In order to keep the number of images to analyze manageable, for each configuration we selected the 20 samples where the biggest difference in the saliency maps was present. To compare two saliency maps, we first performed a 3x3 average pooling with stride 3 over the saliency maps – to reduce the sensitivity towards pixellevel changes in the attention, putting a stronger emphasis on higher-level features – and afterwards computed the Mean Absolute Deviation (MAD) between the reduced saliency maps of the uncompressed and pruned model.
Figure 7 shows vfie selected saliency maps that summarize the observed findings. Overall, we did not observe any systematic changes between any model and its pruned variant. For example, in some instances, the pruned model focuses better on the foreground, giving the correct prediction, while the original model focuses on the background, classifying incorrectly, as Figure 7a representatively shows. However, this is not a consistent behavior, and the opposite effect can be observed as well, e.g., in Figure 7b, where the pruned model puts too much attention on the sky, classifying the image as an airplane. Furthermore, even for samples where both networks predict the same class, we can observe significant changes in the salience of different input regions, i.e, the models weight features differently or even rely on different ones. While in the previous sections we found virtually no differences between the uncompressed and pruned ResNet-18 on CIFAR-10, regarding their attention we could ifnd noticeable differences as Figures 7d and 7e show. This effect is also not limited to our selected samples, as Figure 8 shows. With an average MAD of 7.7% between the saliency maps of the uncompressed and pruned ResNet-18, it highlights that although the effects of model compression might -4.0Difference in accuracy to uncompressed model [pp] -2.0 0.0 2.0 4.0 6.0 horse horse not be noticeable at the level of dataset or even class-wise accuracy, it is definitely important to consider them in safety analyses, as it might, for example, introduce additional failures in corner cases where a model bases its decision on the wrong features.
In this paper, we investigated changes in the predictions of networks compressed with either post-training quantization, global unstructured pruning, or a combination of both. While the deviations from the test accuracy of the uncompressed model were minimal, we observed that the compression techniques still caused significant changes in the predictions. For one thing, we found that the accuracy of individual classes can change greatly – in our experiments up to 15pp – and that the confusion between classes can vary to the same extent. For another thing, our investigation showed that also the confidence regarding the target class can change significantly, with extreme cases were the uncompressed model has zero confidence in the target class while the compressed variant has full confidence, and vice versa. Lastly, our comparison of saliency maps for uncompressed and pruned models revealed the presence of significant differences, hinting towards the two variants relying on or weighting features differently. It is to mention, however, that we did not observe the introduction of systematic errors, e.g., in the form of biases against infrequent classes. Nonetheless, based on the effects we observed, we strongly suggest to view model ship frog frog (a) LeNet trained on CIFAR-10 (MAD=13%) ship frog (c) LeNet trained on CIFAR-10 (MAD=12%) frog frog (d) ResNet-18 trained on CIFAR-10 (MAD=16%) automobile automobile compression as integral part of any ML development cycle and to consider it in early development stages. Model compression can cause substantial changes in the predictions of a network and with that bears the potential to introduce additional failure modes. These must be addressed in the system development and the earlier they are known, the better mitigation measures can be integrated in the system, overall facilitating the development process.
Regarding future work, we suggest to expand our
experiments also to other model architectures, datasets, and
tasks and to investigate other compression techniques, e.g.,
quantization-aware training, structured pruning, or
knowledge distillation, as these are also highly relevant in practice.
Furthermore, we deem it as highly important to further
develop methods for systematically and rigorously analyzing
machine learning systems that go beyond averaging metrics,
as these hide many peculiarities that bear the potential for
failures. Lastly, we deem it equally as important to continue
research into the direction of continuous safety assurance
Luo, J.-H.; and Wu, J. 2020. AutoPruner: An End-to-End Trainable Filter Pruning Method for Efficient Deep Model Inference. Pattern Recognition, 107: 107461.
Mingers, J. 1989. An Empirical Comparison of Pruning Methods for Decision Tree Induction. Machine Learning, 4(2): 227–243.
Picardi, C.; Hawkins, R.; Paterson, C.; and Habli, I. 2019. A Pattern for Arguing the Assurance of Machine Learning in Medical Diagnosis Systems. In Computer Safety, Reliability, and Security, LNCS, 165–179. Cham: Springer International Publishing.
Renda, A.; Frankle, J.; and Carbin, M. 2019. Comparing Rewinding and Fine-Tuning in Neural Network Pruning. In ICLR 2019.
Simonyan, K.; Vedaldi, A.; and Zisserman, A. 2014. Deep inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps. In Proc. ICLR.
5
This work was funded by the Bavarian Ministry for Economic Affairs, Regional Development and Energy as part of a project to support the thematic development of the Institute for Cognitive Systems.