#  A Winning Hand: Compressing Deep Networks Can Improve Out-Of-Distribution
Robustness

James Diffenderfer, Brian R. Bartoldson, Shreya Chaganti11footnotemark: 1,
Jize Zhang, Bhavya Kailkhura
Lawrence Livermore National Laboratory
{diffenderfer2, bartoldson, chaganti1, zhang64<EMAIL_ADDRESS>
equal contribution

###### Abstract

Successful adoption of deep learning (DL) in the wild requires models to be:
(1) compact, (2) accurate, and (3) robust to distributional shifts.
Unfortunately, efforts towards simultaneously meeting these requirements have
mostly been unsuccessful. This raises an important question: “Is the inability
to create Compact, Accurate, and Robust Deep neural networks (CARDs)
fundamental?” To answer this question, we perform a large-scale analysis of
popular model compression techniques which uncovers several intriguing
patterns. Notably, in contrast to traditional pruning approaches (e.g., fine
tuning and gradual magnitude pruning), we find that “lottery ticket-style”
approaches can surprisingly be used to produce CARDs, including binary-weight
CARDs. Specifically, we are able to create extremely compact CARDs that,
compared to their larger counterparts, have similar test accuracy and matching
(or better) robustness—simply by pruning and (optionally) quantizing.
Leveraging the compactness of CARDs, we develop a simple domain-adaptive test-
time ensembling approach (CARD-Deck) that uses a gating module to dynamically
select appropriate CARDs from the CARD-Deck based on their spectral-similarity
with test samples. The proposed approach builds a “winning hand” of CARDs that
establishes a new state-of-the-art [8] on CIFAR-10-C accuracies (i.e., 96.8%
standard and 92.75% robust) and CIFAR-100-C accuracies (i.e., 80.6% standard
and 71.3% robust) with better memory usage than non-compressed baselines
(pretrained CARDs available at [8]). Finally, we provide theoretical support
for our empirical findings.

##  1 Introduction

Deep Neural Networks (DNNs) have achieved unprecedented success in a wide
range of applications due to their remarkably high accuracy [15]. However,
this high performance stems from significant growth in DNN model size; i.e.,
massive overparameterization. Furthermore, these highly overparameterized
models are known to be susceptible to the out-of-distribution (OOD) shifts
encountered during their deployment in the wild [5]. This resource-
inefficiency and OOD brittleness of state-of-the-art (SOTA) DNNs severely
limits the potential applications DL can make an impact on.

For example, consider the “Mars rover mission” that uses laser-induced
breakdown spectroscopy (LIBS) to search for microbial life. It is well
accepted that endowing the rover with DNNs to analyze complex LIBS spectra
could produce scientific breakthroughs [3]. However, employing DNNs in such
circumstances is challenging: 1) as these devices are battery operated, the
model has to be lightweight so it consumes less memory with reduced power
consumption, and 2) the model must be able to efficiently handle domain shifts
in spectra caused by environmental noise. These requirements are not specific
only to the aforementioned use case but arise in any resource-limited
application using DL in the wild. The fact that SOTA DNNs do not satisfy
compactness and OOD robustness requirements is holding us back from leveraging
advances in DL to make scientific discoveries.

This work is driven by two questions around this crucial problem. Q1. Can we
show the existence of compact, accurate, and robust DNNs (CARDs)? Q2. If yes,
can we apply existing robustness improvement techniques to CARDs to further
amplify performance while maintaining compactness?

Notably, there have been some recent successes in addressing each of the
challenges CARDs present in isolation. The authors in [24, 27] developed data
augmentation methods for achieving high OOD robustness without sacrificing
accuracy on the clean data. The authors in [12, 9] developed pruning and
quantization approaches for achieving high accuracy at extreme levels of model
compression. However, efforts towards achieving model compactness, high
accuracy, and OOD robustness simultaneously have mostly been unsuccessful. For
example, [26] and [32] recently showed that compressed DNNs achieve accuracies
similar to the original networks’ but are far more brittle when faced with OOD
data. Perhaps unsurprisingly, the current solution in the robust DL community
to improve the OOD robustness (and accuracy) is to increase the model size
(e.g., [25, 16, 8]).

In this paper, we demonstrate that these negative results are a byproduct of
inapt compression strategies, and the inability to create CARDs is not
fundamental (answering Q1 in the affirmative). Specifically, we perform a
large-scale comparison by varying architectures, training methods, and pruning
rates for a range of compression techniques. We find that in contrast to
traditional pruning methods (e.g., fine tuning [18] and gradual magnitude
pruning [60]), “lottery ticket-style” compression approaches [12, 43, 41, 9]
can surprisingly be used to create CARDs. In other words, we are able to
create extremely compact (i.e., sparse and, optionally, binary) CARDs that are
significantly more robust compared to their larger and full-precision
counterparts while having comparable test accuracy. Our results are in sharp
contrast to the existing observation that compression is harmful to OOD
robustness. In fact, we show that compression is capable of providing improved
robustness.

We subsequently explore the possibility of using existing robustness-
improvement techniques in conjunction with compression strategies to further
improve the performance of CARDs. Empirically, we show the compatibility of
CARDs with popular existing strategies, such as data augmentation and model
size increase. We also propose a new robustness-improvement strategy that
leverages the compactness of CARDs via ensembling—this ensembling approach is
referred to as a domain-adaptive CARD-Deck and uses a gating module to
dynamically choose appropriate CARDs for each test sample such that the
spectral-similarity of the chosen CARDs and test data is maximized. This
proposed adaptive ensembling approach builds a “winning hand" of CARDs that
establishes a new state-of-the-art robustness (and accuracy) on the popular
OOD benchmark datasets CIFAR-10-C and CIFAR-100-C with a compact ensemble [8]
(answering Q2 in the affirmative).

Broad implications of our findings are as follows. First, there exist sparse
networks early in training (sometimes at initialization) that can be trained
to become CARDs (i.e., we extend the lottery ticket hypothesis [12] to robust
neural networks via our CARD hypothesis). Second, within a random-weight
neural network, there exist CARDs which (despite having untrained weights)
perform comparably to more computationally expensive DNNs (i.e., we extend the
strong lottery ticket hypothesis [41] to robust neural networks via our CARD
hypothesis). Third, compression can be complementary with existing robustness-
improving strategies, which suggests that appropriate compression approaches
should be considered whenever training models that may be deployed in the
wild.

To summarize our main contributions:

  * •

Contrary to most prior results in the literature, we show that compression can
improve robustness, providing evidence via extensive experiments on benchmark
datasets, supporting our CARD hypothesis. Our experiments suggest “lottery
ticket-style” pruning methods and a sufficiently overparameterized model are
key factors for producing CARDs (Section 2.2).

  * •

As corruptions in benchmark datasets could be limited (or biased) to certain
frequency ranges, we tested the ability of compression to improve robustness
to Fourier basis perturbations. This analysis corroborates findings on
CIFAR-10/100-C and further highlights that models compressed via different
methods have different robustness levels (Section 2.3).

  * •

Leveraging the compactness of CARDs, we develop a test-time adaptive
ensembling method, called a domain-adaptive CARD-Deck, that utilizes CARDs
trained with existing techniques for improving OOD robustness. Resulting
models set a new SOTA performance [8] on CIFAR-10-C and CIFAR-100-C while
maintaining compactness (Section 3).

  * •

Finally, we provide theoretical support for the CARD hypothesis and the
robustness of the domain-adaptive CARD-Deck ensembling method (Section 4).

##  2 Is the inability to create CARDs fundamental?

Recent studies of the effects of model compression on OOD robustness have been
mostly negative. For instance, Hooker et al. [26] showed that gradual
magnitude pruning [60] of a ResNet-50 [19] trained on ImageNet [44] caused
accuracy to decrease by as much as 40% on corrupted images from ImageNet-C
[23], while performance on the non-corrupted validation images remained
strong. Liebenwein et al. [32] reported similar findings for different pruning
approaches [43, 2] applied to a ResNet-20 model [19] tested on an analogously
corrupted dataset, CIFAR-10-C. Consistent with these findings, Hendrycks et
al. [25] found that increasing model size tended to improve robustness.222For
additional discussion of this and more related work, please see Appendix A.

Critically, these studies suggest that model compression may be at odds with
the simultaneous achievement of high accuracy and OOD (natural corruption)
robustness. However, it’s possible that these negative results are a byproduct
of inapt compression strategies and/or insufficient overparameterization of
the network targeted for compression. As such, to motivate the scientific
question of interest and our empirical/theoretical analyses, we propose the
following alternative hypothesis.

CARD Hypothesis. _Given a sufficiently overparameterized neural network, a
suitable model compression (i.e., pruning and binarization) scheme can yield a
compact network with comparable (or higher) accuracy and robustness than the
same network when it is trained without compression._

###  2.1 Model compression approaches

For a comprehensive analysis of existing pruning methods, we introduce a
framework inspired by those in [43, 51] that covers traditional-through-
emerging pruning methodologies. Broadly, this framework places a pruning
method into one of three categories: (a) traditional, (b) rewinding-based
lottery ticket, and (c) initialization-based (strong) lottery ticket. Specific
pruning methods considered in these respective categories are: (a) fine-tuning
and gradual magnitude pruning, (b) weight rewinding and learning rate
rewinding, and (c) edgepopup and biprop. Precise definitions of these pruning
methods and discussion of differences are available in Appendix A.1.

Briefly, fine-tuning (FT) [18] prunes models once at the end of normal
training, then fine-tunes the models for a given number of epochs to recover
accuracy lost due to pruning; while gradual magnitude pruning (GMP) [60]
prunes models throughout training. Weight rewinding (LTH) [12, 13] is
iterative like GMP but fully trains the network, prunes, rewinds the unpruned
weights (and learning rate schedule) to their values early in training, then
fully trains the subnetwork before pruning again; learning rate rewinding
(LRR) [43] is identical to LTH, except only the learning rate schedule is
rewound, not the unpruned weights. Finally, edgepopup (EP) [41] does not
weight-train the network but instead prunes a randomly initialized network,
using training data to find weights whose removal improves accuracy (notably,
EP can, and does here, operate on signed initialization); biprop (BP) [9]
proceeds similarly but incorporates a binarization scheme resulting in a
binary-weight network regardless of the initialization used. For all of these
methods, we make use of global unstructured pruning, which allows for
different pruning percentages at each layer of the network. For BP and EP, we
additionally consider layerwise pruning, which prunes the same percentage
across all layers. We use the hyperparameters specifically tuned for each
approach; see Appendix B for additional details.

###  2.2 Accuracy-robustness comparison of global pruning methods

To test the CARD hypothesis, we use: five models (VGG [12, 46] and ResNet [19]
style architectures of varying size), five sparsity levels (50%, 60%, 80%,
90%, 95%), and six model compression methods (FT, GMP, LTH, LRR, EP, BP). For
each model, sparsity level, and compression method, five realizations are
trained on the CIFAR-10 training set [28]. Model accuracy and robustness are
measured using top-1 accuracy on the CIFAR-10 and CIFAR-10-C test sets,
respectively. CIFAR-10-C contains 15 different common corruptions from four
categories: noise, blur, weather, and digital corruptions [23]. As a baseline,
we train 5 realizations of each model without compression.

In Figure 1, we plot our experimental results. Accuracy and robustness values
are averaged over the five realizations and plotted relative to the average
non-compressed baseline performance. The y-axis measures relative difference
in percentage points. The mean baseline accuracy and robustness for each
architecture is listed as the reference accuracy in each plot. The first row
of plots indicate accuracy (top-1 accuracy on CIFAR-10 relative to baseline)
while the second row indicate robustness (top-1 accuracy on CIFAR-10-C
relative to baseline). At each sparsity level, error bars extend to the
minimum and maximum relative percentage point difference across all
realizations.

Figure 1: Suitable pruning approaches can improve robustness over dense
models: Comparing the Top-1 accuracy of pruned models relative to the average
of dense baseline models on CIFAR-10 and CIFAR-10-C demonstrates that CARDs
exist and can be produced using LRR, LTH, BP, or EP.

Our results for traditional methods, i.e., Fine-Tuning and Gradual Magnitude
Pruning, are consistent with previous works [26, 32] as the robustness of
models pruned using these methods degrades relative to the dense models’,
particularly in higher pruning regimes. However, we find that rewinding and
initialization based pruning approaches consistently produce notable gains in
robustness relative to dense baselines while matching (and sometimes
surpassing) the accuracy of the dense baseline. In particular, the rewinding
class of methods provide a consistent, moderate improvement to both accuracy
and robustness while the initialization class provides more substantial gains
in robustness even when the accuracy is slightly below the baseline accuracy.
The significance of overparameterization to finding highly compact CARDs using
initialization methods is evident for all architecture types, as the
robustness of these models in higher pruning regimes improves at increasing
levels of parameterization for a given architecture class. However, even in
models with fewer parameters, we find that initialization methods are able to
provide notable robustness gains.

Additional experiments involving initialization methods are provided in
Appendix C. Specifically, a comparison of the performance EP and BP using
layerwise and global pruning is performed in Section C.1 and a comparison of
full-precision and binary-weight EP models in Section C.2. Empirical results
in Section C.2 indicate that robustness gains provided by EP- and BP-pruned
models may be a feature of initialization pruning methods and not solely due
to weight-binarization.

###  2.3 Viewing the effect of compression on OOD robustness through a
spectral lens

As CIFAR-10-C corruptions are limited to certain frequency ranges and
combinations [55], it is of interest to validate if the robustness effects of
different pruning methods observed in Section 2.2 hold on a broader ranges of
frequencies. To this end, we perform a frequency-domain analysis by utilizing
the Fourier sensitivity method [55], which we briefly summarize below.

Given a model and a test dataset, each image in the test dataset is perturbed
using additive noise in the form of 2D Fourier basis matrices, denoted by
$U_{i,j}\in\mathbb{R}^{d1\times d2}$. Specifically, for an image $X$ and a 2D
Fourier basis matrix $U_{i,j}$ a perturbed image is computed by
$X_{i,j}=X+r\varepsilon U_{i,j}$, where $r$ is chosen uniformly at random from
$\\{-1,1\\}$ and $\varepsilon>0$ is used to scale the norm of the
perturbation. Note that each channel of the image is perturbed independently.
Given a set of test images, each Fourier basis matrix can be used to generate
a perturbed test set of images on which the test error for the model is
measured. Plotting the error rates as a function of frequencies $(i,j)$ yields
the Fourier error heatmap of a model – a visualization of the sensitivity of a
model to different frequency perturbations in the Fourier domain. Informally,
the center of the heat map contains perturbations corresponding to the lowest
frequencies and the edges correspond to the highest frequencies.

We generate heatmaps for models corresponding to each pruning method as well
as layerwise pruned models using EP and BP. The norm of the perturbation,
$\varepsilon$, is varied over the set $\\{3,4,6\\}$ to represent low, medium,
and high levels of perturbation severity. As a reference, we include heatmaps
for the dense (non-compressed) baseline model. Fourier heatmaps for the Conv8
architecture at 80% prune percentage are provided in Figure 2 while additional
heatmaps can be found in Section D.

---
Figure 2: Visualizing the response of compressed models to perturbations at
different frequencies: The top three rows are Fourier heatmaps for Conv8
trained on CIFAR-10 with 80% of weights pruned. The bottom three rows are
difference to the baseline with blue regions indicating lower error rate than
baseline. Init. methods provide up to a 50 percentage point improvement in
some instances.

Figure 2 illustrates that initialization pruning methods reduce the error rate
across nearly the full spectrum of Fourier perturbations relative to the dense
model. Additionally, initialization pruning methods using layerwise pruning
present a different response, or error rate, at certain frequency corruptions
when compared to heatmaps of global initialization pruning methods. The
difference heatmaps show that rewinding methods offer mild to moderate
improvements across much of the frequency spectrum with LRR outperforming LTH
in a few regions of the heatmap. The difference heatmaps also highlight that
traditional methods degrade the robustness to more Fourier perturbations than
other compression methods and result in an increased error rate of 10
percentage points (relative to the dense baseline) in some cases. These
findings further suggest that the robustness of a compressed model is
dependent on the compression method used or the resulting structure of the
sparsity. In Appendix E, we provide additional heatmaps to examine the impact
on robustness when varying the number of rewinding steps used by rewinding
methods.

To summarize, we have empirically verified our CARD hypothesis by
demonstrating that “lottery ticket-style” compression methods can produce
compact models with accuracy and robustness comparable to (or higher than)
their dense counterparts.

##  3 Creating a winning hand of CARDs

Having demonstrated that certain model compression techniques are capable of
producing CARDs, we explore using existing techniques for improving model
robustness in conjunction with compression strategies to produce CARDs that
further improve robustness. We consider three popular existing strategies for
improving model robustness and, further, propose a test-time adaptive
ensembling strategy, called a domain-adaptive CARD-Deck, that leverages these
strategies to maintain compactness and efficiency while improving accuracy and
robustness over individual CARDs.

###  3.1 Popular strategies for improving model robustness

#### Data augmentation.

A popular approach for improving robustness involves data augmentations. We
consider two augmentation techniques that are (at the time of writing) leading
methods on RobustBench [8]. The first is AugMix [24] which can provide
improved robustness without compromising accuracy by randomly sampling
different augmentations, applying them to a training image, then “mixing" the
resulting augmented image with the original. The second method independently
adds Gaussian noise $\mathcal{N}(\mu=0,\sigma=0.1)$ to all the pixels with
probability $p=0.5$ [27].

#### Larger models.

Another popular strategy for improving OOD robustness (and accuracy) in the
robust DL community is to increase the model size (e.g., [25, 16, 8]). Hence,
we also consider this strategy to investigate if the performance of CARDs can
be amplified by compressing larger models.

#### Model Ensembling.

It is natural to consider exploiting CARD compactness to amplify accuracy and
robustness by ensembling [40] CARDs. For example, an ensemble of two to six
CARDs pruned to 95% sparsity only uses 10% to 30% of the parameter count
required by a single dense model.

###  3.2 Playing the right CARD to improve accuracy-robustness performance

Ensembling CARDs trained with state-of-the-art data augmentation techniques
has the potential to provide additional robustness gains. We call such
ensembles CARD-Decks and propose two strategies: (1) domain-agnostic CARD-
Decks and (2) domain-adaptive CARD-Decks. In both strategies, the ensemble
consists of CARDs that have been trained on the same dataset under different
augmentation schemes. The domain-adaptive CARD-Deck utilizes a spectral-
similarity metric to select a subset of CARDs from the CARD-Deck that should
be used to make predictions based on the current test data. We first define
this metric then provide formal definitions for both CARD-Deck methods.

#### A spectral-similarity metric.

Let $x_{train}\in\mathbb{R}^{D_{1}\times D_{2}\times N}$ denote the N
unaugmented training images of dimension $D_{1}\times D_{2}$,
$A=\\{a_{k}\\}_{k=1}^{m}$ denote a set of $m$ different augmentation schemes,
and $\hat{S}_{a,P}(x)$ denote a sampling of $P$ images from $x$ where
augmentation $a\in A$ has been applied to $x$. Motivated by our analysis using
Fourier heatmaps, we propose a spectral-similarity metric to compare
representatives from augmented versions of the training sets,
$\\{\hat{S}_{a,P}(x_{train})\\}_{a\in A}$, to the test data. First, we define
$F(\cdot)$ as a map that computes the 1D radially-averaged power spectrum for
images of dimension $D_{1}\times D_{2}$ then takes the reciprocal of each
component. Our spectral-similarity metric is a map
$d_{ss}:\mathbb{R}^{D_{1}\times D_{2}\times P}\times\mathbb{R}^{D_{1}\times
D_{2}\times M}\to\mathbb{R}$ defined by $d_{ss}(\bm{X},\bm{Y})=\min_{1\leq
i\leq
P}\|(F(X_{i})/\|F(X_{i})\|)-\frac{1}{M}\sum_{j=1}^{M}(F(Y_{j})/\|F(Y_{j})\|)\|$.
In practice, we found that the 1D power spectra for different augmentation
types were more separable in the higher frequencies of the power spectrum
leading to the use of the reciprocal in the definition of $F(\cdot)$.

Figure 3: Selecting a “winning hand" using a domain-adaptive CARD-Deck: CARDs
are grouped based on the data augmentation scheme used during training. At
test time, a gating function identifies the augmentation scheme, $a^{*}$ with
data most similar to the test data. The CARDs trained using $a^{*}$ are used
and the average prediction is returned as the output.

#### A “winning hand” of CARDs by test-time ensembling.

An $n$-CARD-Deck ensemble is composed of $n$ CARDs given by
$f^{Deck}=\\{f^{a_{k}}\\}_{k=1}^{n}$ where $a_{k}$ is one of the $m$
augmentation schemes from $A$ and the superscript in $f^{a_{k}}$ denotes that
this CARD was trained used data from the distribution $S_{a_{k}}(x_{train})$.
Our domain-agnostic $n$-CARD-Deck averages the prediction of all $n$ CARDs in
the deck. Supposing that the output of each CARD in $f^{Deck}$ is softmax
vectors, then the output of the domain-agnostic $n$-CARD-Deck can be expressed
as $\frac{1}{n}\sum_{k=1}^{n}f^{a_{k}}(x_{test})$. In our domain-adaptive
CARD-Deck, a gating module uses the spectral-similarity metric $d_{ss}$ to
determine which augmentation method is most similar to a batch of $M$ test
images $x_{test}\in\mathbb{R}^{D_{1}\times D_{2}\times M}$ provided to the
ensemble. When an augmentation scheme, say $a\in A$, is identified as the most
similar to the incoming test data, the domain-adaptive CARD-Deck utilizes only
the CARDs that were trained using the data from the distribution
$S_{a}(x_{train})$. The set of the most similar augmentations is given by
$a^{*}\in\arg\min_{a\in A}d_{ss}(\hat{S}_{a,P}(x_{train}),x_{test})$. We note
that $a^{*}$ is likely to be a singleton set indicating that a single
augmentation scheme is most similar. If the domain-adaptive CARD-Deck contains
multiple CARDs trained using the same data augmentation scheme, prediction
averaging is used on these CARDs and returned as the CARD-Deck prediction.
Given $a^{*}$ and letting $\mathcal{I}(a)=\\{k:a_{k}\in a\\}$, the output of
the domain-adaptive CARD-Deck can be expressed as
$\frac{1}{|\mathcal{I}(a^{*})|}\sum_{k\in\mathcal{I}(a^{*})}f^{a_{k}}(x_{test})$.
As computing the spectral-similarity scheme is independent of CARD evaluation,
the domain-adaptive CARD-Deck provides reduced inference time over the domain-
agnostic CARD-Deck by only evaluating the CARDs necessary for prediction.
Figure 3 provides an illustration of the CARD-Deck design.

###  3.3 Experimental results

We experiment with four models of increasing size (ResNeXt-29, ResNet-18,
ResNet-50, WideResNet-18-2), three data augmentation methods (clean, AugMix,
Gaussian), two sparsity levels (90%, 95%), and six compression methods (LTH,
LRR, EP (layerwise and global), BP (layerwise and global)). For each model,
sparsity level, data augmentaion method, and compression method, three
realizations are trained on CIFAR-10 [28] and robustness is measured using
CIFAR-10-C. Model compactness is measured by calculating the memory usage
[54]. Similar experiments are performed for CIFAR-100 and CIFAR-100-C, however
only WideResNet-18-2 and four model compression methods (LTH, LRR, EP
(global), BP (global)) are used. As a baseline, three realizations of each
model are trained without compression for each data augmentation method.
Visualizations of key results are provided in this section and detailed
ablation studies are in Appendix F.

In addition to measuring the performance of CARDs for each configuration (i.e.
model, data augmentation, compression method, sparsity level), we also formed
domain-agnostic and domain-adaptive $n$-CARD-Decks of size $n\in\\{2,4,6\\}$
comprised of models using the same compression method and sparsity level. For
each $n$-CARD-Deck, half of the CARDs were trained using AugMix and the other
half were trained using the Gaussian augmentation. To facilitate computation
of the spectral-similarity metric in domain-adaptive CARD-Decks, for each
augmentation method $a\in\\{AugMix,Gaussian\\}$ we statically created a KD-
Tree containing $F(X)/\|F(X)\|$, for all $X\in\hat{S}_{a,P}(x_{train})$. In
our experiments, we took $P=5000$ and these KD-Trees were generated once and
saved (separate from inference process). At test time, batches of $M=100$ test
images were used in the spectral-similarity metric to determine which
augmentation method best represented the corrupted test data.

#### Test-time ensembling can provide a “winning hand”.

(a) CIFAR-10-C

(b) CIFAR-100-C

Figure 4: Accuracy, robustness, and memory trends. CARDs and CARD-Decks reduce
memory usage (as indicated by the area of each circle) while achieving
comparable or improved accuracy (x-axis) and robustness (y-axis). Annotation
indicates {Compression Method, Data Augmentation, ResNet-18 Width} with A for
AugMix, G for Gaussian, and AG for both (used by CARD-Decks).

Figure 4 provides a visualization of the performance (accuracy, robustness,
and memory usage) of several CARDs and CARD-Decks as well as dense baselines
and the previous SOTA model. This figure highlights our findings that both
CARD-Deck methods, domain-agnostic and adaptive, are capable of improving the
performance beyond the dense baselines while maintaining reduced memory usage.
Notably, we found a single LRR CARD (a WideResNet-18 at 96% sparsity) trained
with AugMix can attain 91.24% CIFAR-10-C accuracy, outperforming dense
ResNeXt-29 trained with AugMix (a state-of-the-art among methods that do not
require non-CIFAR-10 training data) by more than 2 percentage points simply by
pruning a larger model, i.e., WideResNet-18. Our best performing 6-CARD-Deck
using LRR WideResNet-18 models (53.58 MB) sets a new state-of-the-art for
CIFAR-10 and CIFAR-10-C accuracies of 96.8% and 92.75%, respectively. In
contrast, the previous best method [6] achieves accuracies (94.93%, 92.17%)
using increased memory (ResNet-50 with 94.12 MB), extra data (a super
resolution network was pre-trained with non-CIFAR-10 data), and a
computationally expensive adversarial training procedure. More impressively,
our computationally lighter binary-weight CARD-Decks provide comparable
accuracy and robustness to the dense baseline with memory usage as low as 1.67
MB. Similar trends hold on CIFAR-100-C where rewinding domain-adaptive CARD-
Decks set a new SOTA performance (80.6%, 71.3%) compared to the previous best
(78.90%, 65.14%) [24]. Note that the binary-weight CARD-Decks provide almost 5
percentage point robustness gain over the previous best at only 9% of the
memory usage. Note that the performance of EP and BP CARD-Decks can be further
improved by leveraging more computationally expensive training procedures,
e.g., tuning batchnorm parameters [9] or searching for EP and BP CARDs in
pretrained neural nets.

To summarize, CARD-Decks can maintain compactness while leveraging additional
robustness improvement techniques, LRR CARD-Decks set a new SOTA on CIFAR-10-C
and CIFAR-100-C in terms of accuracy and robustness, binary-weight CARD-Decks
can provide up to $\sim$105x reduction in memory while providing comparable
accuracy and robustness, and the domain-adaptive CARD-Decks used here are
$\sim$2x faster than the domain-agnostic CARD-Decks as only half of the CARDs
are used at inference. Additionally, for 2-CARD-Decks our domain-adaptive
method provides an average robustness gain of 1-2 percentage points over the
domain-agnostic method (see Appendix F).

##  4 Theoretical justifications

This section provides (1) theoretical results that provide support for the
CARD hypothesis beyond what we demonstrated empirically and (2) robustness
analysis for domain-adaptive CARD-Deck strategy.

###  4.1 Function approximation view of CARDs

By leveraging existing theoretical analyses of the Strong and Multi-Prize
Lottery Ticket Hypotheses [39, 38, 9], we can provide theoretical support for
the CARD hypothesis. While we were able to empirically produce CARDs within
the same architecture used by the dense model, to prove theoretical results
supporting the CARD hypothesis using existing techniques requires that the
compressed network be searched for within an architecture larger than the
architecture used for the dense model. An informal version of this result for
binary-weight CARDs is provided here relevant to models produced by joint
pruning and binarization compression strategies such as multi-prize tickets
[9].

######  Theorem 1.

Given a non-compressed network $F$ with depth $\ell$ and width $w$ with
bounded weights that achieves a desired target accuracy and robustness, a
random binary network of depth $2\ell$ and width $O\left((\ell
w^{3/2}/\varepsilon)+\ell w\log(\ell w/\delta)\right)$ contains with
probability $(1-\delta)$ a binary-weighted CARD that approximates the target
non-compressed network with error at most $\varepsilon$, for any
$\varepsilon,\delta>0$.

We note that Theorem 1 follows immediately from Theorem 2 in [9] and, thereby,
refer the reader to Theorem 2 in [9] for a formal statement.333Following the
acceptance of this paper, improved bounds on the depth and width have been
established [47]. This result provides a level of confidence with which one
can expect to find a binary-weight CARD that is an $\varepsilon$-approximation
of a target (i.e. trained and non-compressed) network. For full-precision
weight CARDs, tighter bounds on the depth and width of a fully-connected
network with ReLU activations containing a CARD that is an
$\varepsilon$-approximation of a target network follow from Theorem 3 in [38]
which also utilizes a more relaxed hypothesis set. Hence, theoretical results
supporting the existence of both full-precision and binary-weight CARDs, with
high probability, provided that a sufficiently overparameterized network is
used.

Leveraging these theoretical results, we provide a corollary on the
approximation capabilities of CARD-Deck. We denote by $F(\ell,\bm{w})$ a
fully-connected neural network with ReLU activations where $\ell$ denotes the
depth of the network and
$\bm{w}=[w_{0},w_{1},\ldots,w_{\ell}]\in\mathbb{N}^{\ell+1}$ is a vector where
component $i\in\\{1,\ldots,\ell\\}$ denotes the width of layer $i$ in $F$ and
$w_{0}$ denotes the input dimension of $F$.

######  Corollary 2 (CARD-Deck Approximation Theorem).

Let $\varepsilon>0$, $\delta>0$, $n\geq 1$, and
$\bm{\lambda}=[\lambda_{1},\ldots,\lambda_{n}]$ satisfying
$\sum_{k=1}^{n}\lambda_{k}=1$ and $\lambda_{k}\geq 0$, for all $k\in[n]$, be
given. Let $\mathcal{F}=\\{F_{k}(\ell_{k},\bm{w}_{k})\\}_{k=1}^{n}$ be a deck
of non-compressed fully-connected networks with ReLU activations. If the input
space $\mathcal{X}$ and each network in the collection $\mathcal{F}$ satisfies
the hypotheses of Theorem 3 in [38] (Theorem 2 in [9]), then with probability
$(1-\delta)^{n}$ there exists a deck of $n$ full-precision (binary-weight)
CARDs denoted $f^{Deck}=\\{f_{k}\\}_{k=1}^{n}$ of depth and width specified by
Theorem 3 in [38] (Theorem 2 in [9]) such that

$\displaystyle\sup_{x\in\mathcal{X}}\Big{\|}\sum_{k=1}^{n}\lambda_{k}f_{k}(x)-\sum_{k=1}^{n}\lambda_{k}F_{k}(\ell,\bm{w})(x)\Big{\|}\leq\varepsilon.$
(1)

A proof of Corollary 2 is provided in Appendix G. Note that the target non-
compressed networks in Corollary 2 could be trained on data sampled from
augmented distributions, such as augmented distributions using the AugMix and
Gaussian methods, provided that the weights of the resulting networks satisfy
the hypothesis required from the existing results in [38, 9]. Additionally,
the appropriate choice of $\bm{\lambda}$ in Corollary 2 can yield a domain-
agnostic or domain-adaptive CARD-Deck.

###  4.2 Robustness analysis of CARD-Deck

To provide the theoretical justification behind our CARD-Deck approach over a
single classifier, we first define a robustness measure for a given classifier
ensemble trained on a set of augmentations w.r.t. a corruption set encountered
at the test-time. We assume that each test sample may encounter a specific
corruption type $c$ from a given OOD set and be transformed to a corrupted
test sample $x_{c}$. Let us assume $f^{a}$ is learnt using a learning
algorithm $L$ using the augmented training data $S_{a}$ sampled from
distribution $\mathcal{D}_{a}$, thus, we have
$f^{Deck}=\\{f^{a}=L(S_{a})|a\in\mathbb{N}^{A}\\}$ where
$\mathbb{N}^{A}=\\{1,\cdots,A\\}$. Let us denote by $\hat{S_{a}}$ an empirical
distribution w.r.t. sampled dataset $S_{a}$.

######  Definition 1 (Average OOD Robustness).

Let $f^{Deck}=\\{f^{a}|a\in\mathbb{N}^{A}\\}$ denote a CARD-Deck trained using
an augmentation set
${S^{A}=\\{S_{a}\sim\mathcal{D}_{a}|a\in\mathbb{N}^{A}\\}}$. We define the
average out-of-distribution robustness for a CARD-Deck w.r.t. corruption set
$\mathcal{D}^{C}=\\{\mathcal{D}_{c}|c\in\mathbb{N}^{C}\\}$ as

$Rob(\mathcal{D}^{C},f^{Deck})=\sum_{a=1}^{|A|}\sum_{c=1}^{|C|}Rob(\mathcal{D}_{c},f^{a})w_{c}^{a},$
(2)

where
$Rob(\mathcal{D}_{c},f^{a})=\operatorname*{\mathbb{E}}_{(x_{c},y)\sim\mathcal{D}_{c}}\left[\inf_{f^{a}(x_{c}^{\prime})\neq
y}d(x_{c}^{\prime},x_{c})\right]$ with $x_{c}^{\prime}$ being a perturbed
version of $x_{c}$, $d$ corresponds to a distance metric, and $w_{c}^{a}$
denotes the probability of $f^{Deck}$ gating module selecting the classifier
$f^{a}$ to make a prediction on test data coming from corruption type $c$.

This definition refers to the expectation of the distance to the closest
misclassified corrupted sample for a given test sample. Note that this is a
stronger notion of robustness then the generalization error corresponding to a
corrupted data distribution. Having this definition, our goal is to provide a
lower bound on the average OOD robustness of $f^{Deck}$ and show that the use
of domain-adaptive classifier ensemble achieves a better OOD robustness
compared to the case where we use just a single classifier $f^{a}$. To
understand this quantity better, we derive the following decomposition (see
Appendix G):

$Rob(\mathcal{D}^{C},f^{Deck})\geq\sum_{a,c}w_{c}^{a}[\underbrace{Rob(\hat{S_{a}},f^{a})}_{(a)}-\underbrace{\|Rob(\mathcal{D}_{a},f^{a})-Rob(\hat{S_{a}},f^{a})\|}_{(b)}-\underbrace{\|Rob(\mathcal{D}_{c},f^{a})-Rob(\mathcal{D}_{a},f^{a})\|}_{(c)}].$

This shows that the average OOD robustness can be bounded from below in terms
of the following three error terms for a classifier-corruption pair weighted
by their selection probabilities: (a) empirical robustness, (b) generalization
gap, and (c) out-of-distribution-shift. This implies that in order to bound
the average OOD robustness, we need to bound both the generalization gap and
the OOD-shift. Next, we provide a bound on the OOD-shift penalty that is
independent of the classifier $f^{a}$ and is only related to the closeness of
the augmented data distribution and corrupted data distribution. The closeness
is defined in terms of Wasserstein distance $W(\cdot,\cdot)$ (see Definition 2
in Appendix G).

######  Theorem 3 (Average OOD-Shift Bound).

For any CARD-Deck, the average OOD-shift (i.e.,
$\text{ADS}=\sum_{a,c}{w_{c}^{a}\|Rob(\mathcal{D}_{c},f^{a})-Rob(\mathcal{D}_{a},f^{a})\|}$)
can be bounded as follows
$ADS\leq\sum_{a=1}^{|A|}\sum_{c=1}^{|C|}{w_{c}^{a}\times
W(\mathcal{D}_{c},\mathcal{D}_{a})}$.

###### Proof.

This result can be proved by applying Theorem 1 in [45] to ADS. ∎

Key insights. Theorem 3 provides some key insights into the OOD robustness of
classifiers trained on augmented datasets. First, unlike the generalization
gap, the OOD-shift does not converge to zero with more augmentation data. This
imposes a fundamental limit on the OOD robustness in terms of the distance
between augmented train data distribution and corrupted test data
distribution. Second, having diverse augmentations is critical to improving
the OOD robustness. Also, it highlights that existing solutions trained with a
single augmentation scheme might just be getting lucky or overfitting to the
corrupted test data. Finally, the domain-adaptive CARD-Deck with a suitable
gating function is provably better than using a single classifier because it
can achieve the minimum conditional Wasserstein distance (or best achievable
OOD robustness) over given augmentation-corruption pairs.

##  5 Limitations and future directions

In this paper, we showed that model compression and high robustness (and
accuracy) are not necessarily conflicting objectives. We found that
compression, if done properly (e.g., using “lottery ticket-style” objectives),
can improve the OOD robustness compared to a non-compressed model. Leveraging
this finding, we proposed a simple domain-adaptive ensemble of CARDs that
outperformed existing SOTA in terms of the clean accuracy and the OOD
robustness (at a fraction of the original memory usage). Our results are
consistent with past results in that we also show that the use of test
accuracy alone to evaluate the quality/deployability of a compressed model in
the wild is not sufficient—one needs to adopt harder metrics such as OOD
robustness. However, as opposed to the existing works in this direction, we
present a construction that satisfies these “harder” requirements.

There are still many interesting questions that remain to be explored. First,
while we were able to produce CARDs it remains unclear (i) why only certain
pruning strategies were able to produce them and (ii) why introducing
compression can improve “effective robustness” [49] (e.g. Conv and VGG19 BP
and EP models in Figure 1). Second, the spectral relationship of train and
test data (as considered in this work) is not the only interaction determining
the performance of a compressed model. It will be worthwhile to take a more
holistic approach that also takes spectral behavior of the compressed model
(e.g., using intermediate features) into account, which could possibly benefit
from using CARDs compressed via different strategies when building a “winning
hand”. Third, we only derived an upper bound on the amount of
overparameterization needed to approximate a target dense network in our
theoretical analysis; it will also be interesting to explore a lower bound (a
necessary condition) on the same which may indicate scenarios where the
proposed approach will not work (e.g., underparameterized NNs). Fourth,
“lottery ticket-style” models in theory can be found more efficiently, which
was not our focus but is a valuable future direction. Finally, achieving the
theoretical memory savings obtained from CARDs (reported in this paper) would
require their implementation on specialized hardware. We hope that our results
will help researchers better understand the limits of compressed neural nets,
and motivate future work on CARDs and their applications to areas where DL
struggles currently due to its parameter-inefficiency and OOD brittleness.

## Acknowledgements

We would like to thank the reviewers for their valuable discussion during the
rebuttal period that resulted in improved clarity and presentation of our
research. This work was performed under the auspices of the U.S. Department of
Energy by the Lawrence Livermore National Laboratory under Contract No. DE-
AC52-07NA27344 and LLNL LDRD Program Project No. 20-ER-014 (LLNL-CONF-823802).

## References

  * Ahmad and Scheinkman [2019] Subutai Ahmad and Luiz Scheinkman.  How can we be so dense? the benefits of using highly sparse representations.  _arXiv preprint arXiv:1903.11257_ , 2019.
  * Baykal et al. [2019] Cenk Baykal, Lucas Liebenwein, Igor Gilitschenski, Dan Feldman, and Daniela Rus.  Sipping neural networks: Sensitivity-informed provable pruning of neural networks.  _arXiv preprint arXiv:1910.05422_ , 2019.
  * Bhardwaj and Gokhale [2021] Kshitij Bhardwaj and Maya Gokhale.  Semi-supervised on-device neural network adaptation for remote and portable laser-induced breakdown spectroscopy.  _arXiv preprint arXiv:2104.03439_ , 2021.
  * Brown et al. [2020] Tom B Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al.  Language models are few-shot learners.  _arXiv preprint arXiv:2005.14165_ , 2020.
  * Bulusu et al. [2020] Saikiran Bulusu, Bhavya Kailkhura, Bo Li, Pramod K Varshney, and Dawn Song.  Anomalous example detection in deep learning: A survey.  _IEEE Access_ , 8:132330–132347, 2020.
  * Calian et al. [2021] Dan A Calian, Florian Stimberg, Olivia Wiles, Sylvestre-Alvise Rebuffi, Andras Gyorgy, Timothy Mann, and Sven Gowal.  Defending against image corruptions through adversarial augmentations.  _arXiv preprint arXiv:2104.01086_ , 2021.
  * Courbariaux et al. [2015] Matthieu Courbariaux, Yoshua Bengio, and Jean-Pierre David.  Binaryconnect: Training deep neural networks with binary weights during propagations.  In _Advances in neural information processing systems_ , pages 3123–3131, 2015.
  * Croce et al. [2020] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein.  Robustbench: a standardized adversarial robustness benchmark.  _arXiv preprint arXiv:2010.09670_ , 2020.
  * Diffenderfer and Kailkhura [2021] James Diffenderfer and Bhavya Kailkhura.  Multi-prize lottery ticket hypothesis: Finding accurate binary neural networks by pruning a randomly weighted network.  _International Conference on Learning Representations_ , 2021.
  * Foret et al. [2020] Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur.  Sharpness-aware minimization for efficiently improving generalization.  _arXiv preprint arXiv:2010.01412_ , 2020.
  * Frankle [2020] Jonathan Frankle.  Openlth: A framework for lottery tickets and beyond, 2020.  URL https://github.com/facebookresearch/open_lth.
  * Frankle and Carbin [2018] Jonathan Frankle and Michael Carbin.  The lottery ticket hypothesis: Finding sparse, trainable neural networks.  _arXiv preprint arXiv:1803.03635_ , 2018.
  * Frankle et al. [2020] Jonathan Frankle, Gintare Karolina Dziugaite, Daniel Roy, and Michael Carbin.  Linear mode connectivity and the lottery ticket hypothesis.  In _International Conference on Machine Learning_ , pages 3259–3269. PMLR, 2020.
  * Gale et al. [2019] Trevor Gale, Erich Elsen, and Sara Hooker.  The state of sparsity in deep neural networks.  _arXiv preprint arXiv:1902.09574_ , 2019.
  * Goodfellow et al. [2016] Ian Goodfellow, Yoshua Bengio, Aaron Courville, and Yoshua Bengio.  _Deep learning_ , volume 1.  MIT press Cambridge, 2016.
  * Gowal et al. [2020] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli.  Uncovering the limits of adversarial training against norm-bounded adversarial examples.  _arXiv preprint arXiv:2010.03593_ , 2020.
  * Han et al. [2015a] Song Han, Huizi Mao, and William J Dally.  Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding.  _arXiv preprint arXiv:1510.00149_ , 2015a.
  * Han et al. [2015b] Song Han, Jeff Pool, John Tran, and William J Dally.  Learning both weights and connections for efficient neural networks.  _arXiv preprint arXiv:1506.02626_ , 2015b.
  * He et al. [2015] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition, 2015.
  * He et al. [2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Identity mappings in deep residual networks, 2016.
  * He et al. [2017] Yihui He, Xiangyu Zhang, and Jian Sun.  Channel pruning for accelerating very deep neural networks.  In _Proceedings of the IEEE International Conference on Computer Vision_ , pages 1389–1397, 2017.
  * He et al. [2018] Yihui He, Ji Lin, Zhijian Liu, Hanrui Wang, Li-Jia Li, and Song Han.  Amc: Automl for model compression and acceleration on mobile devices.  In _Proceedings of the European Conference on Computer Vision (ECCV)_ , pages 784–800, 2018.
  * Hendrycks and Dietterich [2019] Dan Hendrycks and Thomas Dietterich.  Benchmarking neural network robustness to common corruptions and perturbations.  _arXiv preprint arXiv:1903.12261_ , 2019.
  * Hendrycks et al. [2019] Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan.  Augmix: A simple data processing method to improve robustness and uncertainty.  _arXiv preprint arXiv:1912.02781_ , 2019.
  * Hendrycks et al. [2020] Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, et al.  The many faces of robustness: A critical analysis of out-of-distribution generalization.  _arXiv preprint arXiv:2006.16241_ , 2020.
  * Hooker et al. [2019] Sara Hooker, Aaron Courville, Gregory Clark, Yann Dauphin, and Andrea Frome.  What do compressed deep neural networks forget?  _arXiv preprint arXiv:1911.05248_ , 2019.
  * Kireev et al. [2021] Klim Kireev, Maksym Andriushchenko, and Nicolas Flammarion.  On the effectiveness of adversarial training against common corruptions.  _arXiv preprint arXiv:2103.02325_ , 2021.
  * Krizhevsky et al. [2009] Alex Krizhevsky, Geoffrey Hinton, et al.  Learning multiple layers of features from tiny images.  2009\.
  * Krizhevsky et al. [2012] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton.  Imagenet classification with deep convolutional neural networks.  _Advances in neural information processing systems_ , 25:1097–1105, 2012.
  * LeCun et al. [1990] Yann LeCun, John S Denker, and Sara A Solla.  Optimal brain damage.  In _Advances in neural information processing systems_ , pages 598–605, 1990.
  * Li et al. [2016] Hao Li, Asim Kadav, Igor Durdanovic, Hanan Samet, and Hans Peter Graf.  Pruning filters for efficient convnets.  _arXiv preprint arXiv:1608.08710_ , 2016.
  * Liebenwein et al. [2021] Lucas Liebenwein, Cenk Baykal, Brandon Carter, David Gifford, and Daniela Rus.  Lost in pruning: The effects of pruning neural networks beyond test accuracy.  _arXiv preprint arXiv:2103.03014_ , 2021.
  * Lin et al. [2017] Xiaofan Lin, Cong Zhao, and Wei Pan.  Towards accurate binary convolutional neural network.  In _Advances in Neural Information Processing Systems_ , pages 345–353, 2017.
  * Liu et al. [2018] Zhuang Liu, Mingjie Sun, Tinghui Zhou, Gao Huang, and Trevor Darrell.  Rethinking the value of network pruning.  _arXiv preprint arXiv:1810.05270_ , 2018.
  * Louizos et al. [2017] Christos Louizos, Max Welling, and Diederik P Kingma.  Learning sparse neural networks through $l\\_0$ regularization.  _arXiv preprint arXiv:1712.01312_ , 2017.
  * Molchanov et al. [2017] Dmitry Molchanov, Arsenii Ashukha, and Dmitry Vetrov.  Variational dropout sparsifies deep neural networks.  In _International Conference on Machine Learning_ , pages 2498–2507. PMLR, 2017.
  * Narang et al. [2017] Sharan Narang, Erich Elsen, Gregory Diamos, and Shubho Sengupta.  Exploring sparsity in recurrent neural networks.  _arXiv preprint arXiv:1704.05119_ , 2017.
  * Orseau et al. [2020] Laurent Orseau, Marcus Hutter, and Omar Rivasplata.  Logarithmic pruning is all you need.  In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin, editors, _Advances in Neural Information Processing Systems_ , volume 33, pages 2925–2934. Curran Associates, Inc., 2020.
  * Pensia et al. [2021] Ankit Pensia, Shashank Rajput, Alliot Nagle, Harit Vishwakarma, and Dimitris Papailiopoulos.  Optimal lottery tickets via subsetsum: Logarithmic over-parameterization is sufficient, 2021.
  * Polikar [2012] Robi Polikar.  Ensemble learning.  In _Ensemble machine learning_ , pages 1–34. Springer, 2012.
  * Ramanujan et al. [2020] Vivek Ramanujan, Mitchell Wortsman, Aniruddha Kembhavi, Ali Farhadi, and Mohammad Rastegari.  What’s hidden in a randomly weighted neural network?  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 11893–11902, 2020.
  * Rastegari et al. [2016] Mohammad Rastegari, Vicente Ordonez, Joseph Redmon, and Ali Farhadi.  Xnor-net: Imagenet classification using binary convolutional neural networks.  In _European conference on computer vision_ , pages 525–542. Springer, 2016.
  * Renda et al. [2020] Alex Renda, Jonathan Frankle, and Michael Carbin.  Comparing rewinding and fine-tuning in neural network pruning, 2020.
  * Russakovsky et al. [2015] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al.  Imagenet large scale visual recognition challenge.  _International journal of computer vision_ , 115(3):211–252, 2015.
  * Sehwag et al. [2021] Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, and Prateek Mittal.  Improving adversarial robustness using proxy distributions.  _arXiv preprint arXiv:2104.09425_ , 2021.
  * Simonyan and Zisserman [2014] Karen Simonyan and Andrew Zisserman.  Very deep convolutional networks for large-scale image recognition.  _arXiv 1409.1556_ , 09 2014.
  * Sreenivasan et al. [2021] Kartik Sreenivasan, Shashank Rajput, Jy yong Sohn, and Dimitris Papailiopoulos.  Finding everything within random binary networks, 2021.
  * Tan and Le [2021] Mingxing Tan and Quoc V Le.  Efficientnetv2: Smaller models and faster training.  _arXiv preprint arXiv:2104.00298_ , 2021.
  * Taori et al. [2019] Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt.  When robustness doesn’t promote robustness: Synthetic vs. natural distribution shifts on imagenet.  2019\.
  * Venkatesh et al. [2020] Bindya Venkatesh, Jayaraman J Thiagarajan, Kowshik Thopalli, and Prasanna Sattigeri.  Calibrate and prune: Improving reliability of lottery tickets through prediction calibration.  _arXiv preprint arXiv:2002.03875_ , 2020.
  * Wang et al. [2021] Huan Wang, Can Qin, Yulun Zhang, and Yun Fu.  Emerging paradigms of neural network pruning.  _arXiv preprint arXiv:2103.06460_ , 2021.
  * Wang et al. [2020] Shufan Wang, Ningyi Liao, Liyao Xiang, Nanyang Ye, and Quanshi Zhang.  Achieving adversarial robustness via sparsity.  _arXiv preprint arXiv:2009.05423_ , 2020.
  * Wen et al. [2016] Wei Wen, Chunpeng Wu, Yandan Wang, Yiran Chen, and Hai Li.  Learning structured sparsity in deep neural networks.  _arXiv preprint arXiv:1608.03665_ , 2016.
  * Xu et al. [2019] Yinghao Xu, Xin Dong, Yudian Li, and Hao Su.  A main/subsidiary network framework for simplifying binary neural networks.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 7154–7162, 2019.
  * Yin et al. [2019] Dong Yin, Raphael Gontijo Lopes, Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer.  A fourier perspective on model robustness in computer vision.  In _Advances in Neural Information Processing Systems_ , volume 32, 2019.
  * Zhang et al. [2016] Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals.  Understanding deep learning requires rethinking generalization.  _arXiv preprint arXiv:1611.03530_ , 2016.
  * Zhang et al. [2021] Dinghuai Zhang, Kartik Ahuja, Yilun Xu, Yisen Wang, and Aaron Courville.  Can subnetwork structure be the key to out-of-distribution generalization?  _arXiv preprint arXiv:2106.02890_ , 2021.
  * Zhou et al. [2017] Aojun Zhou, Anbang Yao, Yiwen Guo, Lin Xu, and Yurong Chen.  Incremental network quantization: Towards lossless cnns with low-precision weights.  _arXiv preprint arXiv:1702.03044_ , 2017.
  * Zhou et al. [2016] Shuchang Zhou, Yuxin Wu, Zekun Ni, Xinyu Zhou, He Wen, and Yuheng Zou.  Dorefa-net: Training low bitwidth convolutional neural networks with low bitwidth gradients.  _arXiv preprint arXiv:1606.06160_ , 2016.
  * Zhu and Gupta [2017] Michael Zhu and Suyog Gupta.  To prune, or not to prune: exploring the efficacy of pruning for model compression, 2017.

The Tri

Here we provide a brief outline of the appendices. In Appendix A, we provide
details on relevant past works. In Appendix B, we discuss our experimental
setting and relevant hyperparameters. In Appendix C, we provide additional
experiments with initialization methods and, in part, show that the robustness
of the EP method is not only due to binarization but also due to the specific
pruning strategy. In Appendix D, we provide Fourier heatmaps for additional
pruning rates and architectures. In Appendix E, we provide additional Fourier
heatmap results on comparing the rewinding-based schemes with the traditional
pruning schemes. In Appendix F, we provide extensive tables for CARD and CARD-
Deck experiments performed in Section 3. In Appendix G, we provide remaining
proof details for our theoretical justification of our CARD-Deck approach. We
show the universal approximation power of CARD-Decks and prove that CARD-Deck
with a suitable gating function is provably better than using a single
classifier.

##  Appendix A Background

###  A.1 Accuracy preserving model compression

Two popular approaches for model compression are: pruning and quantization.
Here, we discuss these approaches and their effects on accuracy.

Pruning. Neural network pruning removes weights [30] or larger structures like
filters [31] from neural networks to reduce their computational burden [18,
21] and potentially improve their generalization [53, 35]. As the performance
of DNNs has continued to improve with increasing levels of
overparameterization [56], production DNNs have grown larger [29, 4], and the
need to broadly deploy such models has amplified the importance of compression
methods like pruning [18, 17].

In modern networks, pruning the smallest magnitude weights after training then
fine-tuning (FT) to recover accuracy lost from the pruning event is
surprisingly effective; when the pruning is done iteratively rather than all
at once, this approach enables a 9x compression ratio without loss of accuracy
[18]. Gradual magnitude pruning (GMP) performs such iterative pruning
throughout training rather than after training [37, 60], recovering accuracy
lost from pruning events as training proceeds, and matches or exceeds the
performance of more complex methods [14].

Another form of magnitude pruning stems from work on the lottery ticket
hypothesis (LTH), which posits that the final, sparse subnetwork discovered by
training then pruning can be rewound to its state at initialization [12] or
early in training [13], then trained in isolation to be comparably accurate to
the trained dense network. The associated pruning approach that iteratively
trains the network, rewinds the weights (and learning rate schedule) to their
values early in training, then trains the subnetwork is referred to here as
LTH. A simpler version of this algorithm, learning rate rewinding (LRR) [43],
only rewinds the learning rate schedule (not the weights) and achieves a
state-of-the-art accuracy-efficiency frontier while being less complex than
other competitive approaches [60, 36, 12, 22]. LRR has been shown to offer
small improvements to accuracy with not-too-high compression ratio [43]. The
authors in [50] proposed calibration mechanisms to find more effective lottery
tickets.

Building on the lottery ticket hypothesis, the edgepopup (EP) algorithm
introduced a way to find sparse subnetworks at initialization that achieve
good performance without any further training [41]. Diffenderfer and Kailkhura
[9] introduced a similar pruning approach, biprop (BP), which also performs
weight binarization.

Binarization. Typical post-training schemes have not been successful in
binarizing pretrained models with or without retraining to achieve reasonable
accuracy. Most existing post-training works [17, 58] are limited to ternary
weight quantization. To overcome this limitation, there have been several
efforts to improve the performance of binary neural network (BNN) training.
This is challenging due to the discontinuities introduced by the binarization,
which makes back-propogation difficult. Binaryconnect [7] first showed how to
train networks with binary weights within the familiar back-propagation
paradigm. Unfortunately, this early scheme resulted in a significant drop in
accuracy compared to its full precision counterparts. To improve performance,
XNOR-Net [42] proposed adding a real-valued channel-wise scaling factor to
improve capacity. Dorefa-Net [59] extended XNOR-Net to accelerate the training
process via quantized gradients. ABC-Net [33] improved performance by using
more weight bases and activation bases at the cost of increased memory.

Notably, one can exploit the complementary nature of pruning and binarization
to combine their strengths. For example, Diffenderfer and Kailkhura [9]
produced an algorithm for finding multi-prize lottery tickets (MPTs): sparse,
binary subnetworks present at initialization that don’t require training.

#### Pruning algorithm framework.

The following pruning algorithm framework, inspired by those in [43, 51],
covers traditional-through-emerging pruning methodologies. Specifically, we
define the trained subnetwork created by one pruning-retraining cycle (i.e.,
one pruning iteration) as:

$W_{\text{sparse}}=F_{1}(W_{k_{1}};\mathcal{D})\odot
F_{2}(W_{i};\mathcal{D},\mathcal{M},k_{2}),$ (3)

where $\mathcal{D}$ denotes the training dataset, $W_{i}$ denotes the weight
vector at the start of training iteration $i$,444During training, $i<T$ for
most pruning approaches, where $T$ is the default number of training
iterations. However, fine-tuning trains for an additional set of iterations
after pruning takes place at iteration $T$. Additionally, rewinding-based
lottery ticket approaches (when accounting for training done by $F_{2}$) use
$(n+1)T-nr$ training iterations, where $n$ is the number of pruning iterations
or “shots” in an n-shot pruning procedure, and $r$ is the iteration rewound to
after each pruning iteration (note that when $r=0$, the network is rewound to
its state from initialization after each pruning iteration and $(n+1)T$ total
iterations are required by this approach). $F_{1}$ represents the function
that finds and returns the weight-masking vector $\mathcal{M}$, $F_{2}$
represents the function that retrains the weights after $\mathcal{M}$ is
found, $k_{i}$ is the earliest training iteration that $F_{i}$ requires
information from (e.g., weight-vector or learning-rate values), $F_{1}$ and
$F_{2}$ are each applied at the beginning of iteration $k_{1}$, and $\odot$ is
the Hadamard (element-wise) product. Using this, the pruning paradigms and
representative techniques from these categories considered in this paper are
as follows:

  * •

Traditional $k_{1}=k_{2}$ and $F_{2}\neq I$ (identity function). Particular
techniques:

    * –

Fine-Tuning (FT) [18]:
$W_{\text{sparse}}=F_{1}(W_{T})\odot F_{2}(W_{T};\mathcal{D},\mathcal{M},T)$

    * –

Gradual Magnitude Pruning (GMP) [60]:
$W_{\text{sparse}}=F_{1}(W_{t})\odot F_{2}(W_{t};\mathcal{D},\mathcal{M},t)$,
where $t\in[t_{1},t_{2},...,t_{n}]$ and $t_{n}<T$

  * •

Rewinding-based Lottery Ticket $k_{1}=aT-(a-1)r$ and $k_{2}=r$, where $a\in[1\
..\ n]$ and $r\ll T$. Particular techniques:

    * –

Weight Rewinding (LTH) [12, 13]:
$W_{\text{sparse}}=F_{1}(W_{aT-(a-1)r})\odot
F_{2}(W_{r};\mathcal{D},\mathcal{M},r)$

    * –

Learning Rate Rewinding (LRR) [43]:
$W_{\text{sparse}}=F_{1}(W_{aT-(a-1)r})\odot
F_{2}(W_{aT-(a-1)r};\mathcal{D},\mathcal{M},r)$

  * •

Initialization-based (Strong) Lottery Ticket $k_{1}=k_{2}=0$ and $F_{2}=I$.
Particular techniques:

    * –

Edgepopup (EP) [41]:
$W_{\text{sparse}}=F_{1}(W_{0,\;\text{binary}};\mathcal{D})\odot
I(W_{0,\;\text{binary}})$

    * –

Biprop (BP) [9]:
$W_{\text{sparse}}=F_{1}(W_{0};\mathcal{D})\odot I(W_{0,\;\text{binarized by
biprop}})$

Note that GMP, LTH, and LRR are all iterative. Further, since rewinding
schemes apply $F_{1}$ and $F_{2}$ at the beginning of iterations
$k_{1}=aT-(a-1)r$, $a\in[1\ ..\ n]$, it’s true that $k_{1}>k_{2}=r$, so
$F_{2}$ needs to store information from iteration $k_{2}=r$ in order to (at
$k_{1}$) perform the training iterations that determine $W_{i},\ i\geq T$. As
opposed to traditional and rewinding schemes, strong lottery ticket [41]
schemes do not require any weight training before or after pruning—a
performant network is found at initialization via $F_{1}$. In other words,
learning occurs simply by pruning a randomly initialized neural network.
Furthermore, by design BP performs binarization of the weights to reduce the
memory footprint. We note that the precision of the weights in networks
trained using EP maintain the same precision as the randomly initialized
weights. Hence, EP can also be used to identify binarized networks by randomly
initializing the weights to binary values. To take advantage of additional
compression, in our experiments with EP the mask $\mathcal{M}$ is learned from
a binary-initialized weight vector $W_{0,\;\text{binary}}$. As BP performs
binarization during pruning, a full-precision weight vector $W_{0}$ is used
when finding $\mathcal{M}$. In all of these methods, we make use of global
unstructured pruning which allows for different pruning percentages at each
layer of the network.

###  A.2 Accuracy preserving robust training

While DNN models show impressive generalization in I.I.D. data scenarios [48,
10], the robustness of such models on OOD data (e.g., common corruptions –
blurring from camera movement, or noise from low-lighting conditions) is
critical to the successful deployment of DL in the wild. To evaluate
performance in the presence of such common corruptions, Hendrycks and
Dietterich [23] introduced the CIFAR-10-C dataset, which comprises validation
images from CIFAR-10 [28] that were exposed to $15$ diverse corruption types
applied at $5$ severity levels.

To achieve high OOD robustness and accuracy, AugMix [24] creates data
augmentations at training time by composing randomly-selected augmentation
operations from a diverse set, which notably excludes augmentations
overlapping with those used to create CIFAR-10-C. Additionally, AugMix
utilizes a Jensen-Shannon Divergence consistency loss term to match the
predictions between different augmentations of a given image. This approach is
expanded on by DeepAugment [25], which inputs clean images to a pretrained
image-to-image model, corrupts this model’s weights and activations with
various operations that distort the typical forward pass, then uses the output
images as augmented data. AdversarialAugment (AdA) builds on DeepAugment by
generating the weight perturbations performed on the image-to-image models via
adversarial training [6]. Also, when used with an appropriately selected
perturbation radius and distance metric, adversarial training can serve as a
strong baseline against common corruptions [16, 27].

Notably, the state-of-the-art in OOD robustness has historically evolved by
leveraging more advanced data augmentation schemes and larger models than
prior works [8].

###  A.3 Methods to design compact-accurate-robust models

Despite its critical need, efforts towards achieving model compactness, high
accuracy, and OOD (natural corruption) robustness simultaneously have mostly
been unsuccessful, to the best of our knowledge. Note that some recent works
have shown successful attempts for different use cases, e.g., adversarial
example robustness [52], additive white noise robustness [1], and domain
generalization [57].

Hooker et al. [26] analyzed traditional compression techniques [60] and showed
that pruned and quantized models have comparable accuracy to the original
dense network but are far more brittle than non-compressed models in response
to small distributional changes that humans are robust to. It is well known
that even non-compressed models are very brittle to the OOD shifts. The
authors in [26] showed that this brittleness is amplified at higher levels of
compression.

Liebenwein et al. [32] corroborated that a pruned [43, 2] model can have
similar predictive power to the original one when it comes to test accuracy,
while being more brittle when faced with out of distribution data points. They
further showed that this phenomenon holds even when considering robust
training objectives (e.g., data augmentation). Their results suggest that
robustness advances discussed in Sec. A.2 may be suboptimal with model
compression approaches unless OOD shifts are known at train time.

Notably, the aforementioned papers only analyze a limited class of pruning
approaches. Our findings with traditional pruning approaches are consistent
with the findings of [26], which involved a traditional pruning approach.
Additionally, when Liebenwein et al. [32] employ a lottery ticket-style
pruning approach, they find pruning harms robustness more when using smaller
networks, which is consistent with our CARD hypothesis that states that the
starting network must be sufficiently overparameterized.

##  Appendix B Experiment settings

All codes were written in Python using Pytorch and were run on IBM Power9 CPU
with 256 GB of RAM and one to two NVIDIA V100 GPUs. Publicly available code
was used as the base for each pruning method for models pruned with FT and
GMP555https://github.com/RAIVNLab/STR, LTH and
LRR666https://github.com/facebookresearch/open_lth,
EP777https://github.com/allenai/hidden-networks and
BP888https://github.com/chrundle/biprop. We added functionality for global
pruning in FT, GMP, EP and BP as it was not implemented in existing
repositories.

ResNet-18 results for rewinding strategies, LRR and LTH, make use of regular
ResNet-18 [19] models while all other methods, including dense, make use of
PreAct ResNet-18 [20] as it provided improved performance in terms of accuracy
and robustness.

A breakdown of hyperparameters by model and pruning method is provided in
Table 1. As mentioned in Section 2, for each pruning method we used
hyperparameters tuned specifically for that method. The dense Conv2/4/6/8
models used a batch size of 60, as specified in Figure 2 of the original
Lottery Ticket Hypothesis paper [12]. All pruned models and the remaining
dense models were trained using a batch size of 128. In the LR schedule
column, _Cosine_ denotes cosine decay while _LR160_ denotes a schedule that
sets the learning rate to 0.01 at epoch 80 and 0.001 at epoch 120. All models
trained using SGD use a momentum of 0.9.

| Learning Rate | LR Schedule | Optimizer | Weight Decay | Epochs | Pruning Details
---|---|---|---|---|---|---
|  Conv2 |  Conv4/6/8 |  Rest |  Conv2/4/6/8 |  Rest |  Conv2/4/6/8 |  Rest |  Conv2/4/6/8 |  Rest |  Conv2/4/6/8 |  Rest |  Conv2/4/6/8 |  Rest
Dense | 2e-4 | 3e-4 | 0.1 | None | LR160 | Adam | SGD | 0 | 1e-4 | 100 | 160 | N/A | N/A
FT |  $\leftarrow$ 0.01 $\rightarrow$ | 0.1 | Cosine | LR160 |  $\leftarrow$ SGD $\rightarrow$ |  $\leftarrow$ 1e-4 $\rightarrow$ |  $\leftarrow$ 200 $\rightarrow$ |  $\longleftarrow$ Prune at epoch 160 then fine tune 40 epochs $\longrightarrow$
GMP |  $\leftarrow$ 0.01 $\rightarrow$ | 0.1 | Cosine | LR160 |  $\leftarrow$ SGD $\rightarrow$ |  $\leftarrow$ 1e-4 $\rightarrow$ |  $\leftarrow$ 160 $\rightarrow$ | $\longleftarrow(s_{i},t,n,\Delta t)=(0,5,105,1)\longrightarrow$
LTH | 5e-3 | 1e-2 | 0.1 |  $\leftarrow$ LR160 $\rightarrow$ |  $\leftarrow$ SGD $\rightarrow$ |  $\leftarrow$ 1e-4 $\rightarrow$ |  $\leftarrow$ 160 $\rightarrow$ | rewind it.: 1000, rate: 20% | rewind it.: 5000, rate: 20%
LRR | 5e-3 | 1e-2 | 0.1 |  $\leftarrow$ LR160 $\rightarrow$ |  $\leftarrow$ SGD $\rightarrow$ |  $\leftarrow$ 1e-4 $\rightarrow$ |  $\leftarrow$ 160 $\rightarrow$ | rewind it.: 1000, rate: 20% | rewind it.: 5000, rate: 20%
BP |  $\longleftarrow$ 0.1 $\longrightarrow$ |  $\leftarrow$ Cosine $\rightarrow$ |  $\leftarrow$ SGD $\rightarrow$ |  $\leftarrow$ 1e-4 $\rightarrow$ |  $\leftarrow$ 250 $\rightarrow$ |  $\longleftarrow$ All Epochs $\longrightarrow$
EP |  $\longleftarrow$ 0.1 $\longrightarrow$ |  $\leftarrow$ Cosine $\rightarrow$ |  $\leftarrow$ SGD $\rightarrow$ |  $\leftarrow$ 1e-4 $\rightarrow$ |  $\leftarrow$ 250 $\rightarrow$ |  $\longleftarrow$ All Epochs $\longrightarrow$
Table 1: Hyperparameters used when training dense baselines and each pruning
method by model. Note that “Rest” refers to all other models trained in our
experiments, such as VGG and ResNet.

We first note details of experiments using traditional pruning methods, fine-
tuning (FT) and gradual magnitude pruning (GMP). For FT models, unpruned
training takes place for 160 epochs at which point pruning to the full
sparsity level takes place using global magnitude pruning. After pruning,
fine-tuning of the pruned network takes place over 40 epochs where the
learning rate is kept at the final value after pruning at epoch 160 [34, 43].
For GMP models, the sparsity level gradually increases over the course of the
training process. In our experiments, the sparsity level at training step $t$
increases in accordance with equation (1) from [60] which we include here to
interpret the GMP pruning details from Table 1:

$\displaystyle s_{t}=s_{f}+(s_{i}-s_{f})\left(1-\frac{t-t_{0}}{n\Delta
t}\right)^{3},\ \text{for}\ t\in\\{t_{0}+k\Delta t\\}_{k=0}^{n}.$ (4)

Here, $s_{i}$ denotes the initial sparsity level, $s_{f}$ denotes the final
sparsity level, $n$ denotes the number of pruning steps, $t_{0}$ denotes the
first training step where pruning is performed, and $s_{t}$ denotes the
sparsity level at the current training step. Note that the values for $s_{i}$,
$t_{0}$, $n$, and $\Delta t$ are provided in Table 1.

For rewinding methods, LTH and LRR, hyperparameters were chosen based on
details from [12, 13, 11, 43]. Notably, our rewinding-iteration choices
stemmed from the hyperparameter study shown in Figure 7 of [13], and the fact
that the small Conv models performed well when rewound to iteration 0 in [12].
All LTH/LRR runs were implemented using a modified version of the OpenLTH
repository [11].

For initialization methods, edgepopup (EP) and biprop (BP), pruning is
achieved by learning a pruning mask that is applied to the randomly
initialized networks weights and, in the case of BP, binarization is applied
to the weights of the resulting pruned network. For EP networks, weights were
initialized using the signed constant initialization from [41] which offered
the best performance. As an added benefit for compactness, this initialization
also yields a binary weight network. For BP networks, weights were initialized
using the kaiming normal initialization as in [9] and the biprop algorithm
performs binarization during training resulting in a binary-weight network.
Due to the binary weights in both the EP and BP CARDs we trained, these CARDs
provided further reductions in on-device memory consumption over rewinding
based pruning strategies. For both EP and BP, we used the same number of
epochs for training as in [9].

##  Appendix C Additional Experiments

###  C.1 Effect of global vs. layerwise pruning in lottery ticket
initialization methods.

The lottery ticket initialization methods analyzed in the Section 2 were
originally developed to prune a percentage of weights uniformly across all
layers of the network. In contrast, global pruning methods are considered to
be more flexible as they can prune some layers more heavily than others while
still meeting a user-specified sparsity level for the entire network. By
analyzing these initialization methods using both layerwise and global
pruning, we notice certain peculiar patterns. Figure 5 provides the accuracy
and robustness of models trained with BP and EP using global and layerwise
pruning. For each model, the maximum CIFAR-10 accuracy was achieved by a
layerwise pruned model at one of the six sparsity levels. However, the
globally-pruned models consistently outperform the layerwise pruned models on
robustness at nearly every sparsity level. Furthermore, the globally-pruned
models typically achieve higher or comparable accuracy at higher sparsity
levels, indicating that initialization methods utilizing global pruning are
more suitable when a high-level of sparsity is desired.

Figure 5: Global pruning in lottery ticket Initialization methods provides
greater robustness gains: While layerwise pruning is able to achieve the
highest accuracy across all sparsity levels in initialization methods, global
pruning provides more significant robustness gains at all sparsity levels.

###  C.2 Comparison of full-precision-weight Edgepopup pruning with binary-
weight Edgepopup pruning

The models pruned using EP in our experiments are pruned using weights
initialized from a scaled binary initialization, as specified in [41].
Additionally, models pruned with BP contain binary weights regardless of the
initialization used. To demonstrate that the robustness gains afforded are a
feature of initialization based pruning methods and not binarization, we
provide some results for full-precision initialization based pruning models.
In particular, by using the kaiming normal initialization with EP the
resulting network has full-precision weights. In Figure 6, we visualize the
accuracy of these models on CIFAR-10 and CIFAR-10-C. These experiments
demonstrate the the robustness of the initialization based CARDs is not
exclusive to binary weight networks as the full-precision weight networks can
achieve comparable accuracy to the binary weight networks at some prune
percentages.

Figure 6: Using Full Precision weights in lottery ticket Initialization still
provides robustness gains: While initialization pruning methods with binary
weights yield the greatest robustness gains over the baseline, randomly
initialized networks with full-precision weights pruned using Edgepopup are
capable of providing improved robustness over the dense baseline.

##  Appendix D Additional heatmaps

Here we provide additional heatmaps (varying sparsity levels) for Conv8 (see
Figures 7 and 8) and for ResNet18 models (see Figures 9, 10 and 11). By
comparing the heatmaps of rewinding and initialization based pruning methods
to baselines, we find that these models are more resilient to perturbations of
varying severity.

###  D.1 Additional Conv8 heatmaps

In the Conv8 models, differences in the heatmaps of initialization methods and
the baseline model persist up to the highest sparsity level of 95%, as seen in
Figure 8. The top three rows in each figure provide the Fourier heatmaps for
each model while the bottom three rows provide the difference to the dense
baseline. In the difference heatmaps, blue pixels are where the compressed
model has an error rate lower than the dense model and red pixels are where
the compressed model has an error rate higher than the dense model.

---
Figure 7: Visualizing the response of compressed models to perturbations at
different frequencies: The top three rows are Fourier heatmaps for error rate
of Conv8 models trained on CIFAR-10 with 90% of weights pruned. The bottom
three rows are difference to the baseline with blue regions indicating lower
error rate than baseline.
---
Figure 8: Visualizing the response of compressed models to perturbations at
different frequencies: The top three rows are Fourier heatmaps for error rate
of Conv8 models trained on CIFAR-10 with 95% of weights pruned. The bottom
three rows are difference to the baseline with blue regions indicating lower
error rate than baseline.

###  D.2 ResNet-18 heatmaps

Here we provide Fourier error rate heatmaps for the ResNet-18 architecture
trained using different pruning methods. As in the Conv8 heatmap figures, we
include heatmaps for a trained dense ResNet-18 model for reference and the
difference heatmaps clearly conveying the difference of each compression
method to the baseline.

---
Figure 9: Visualizing the response of compressed models to perturbations at
different frequencies: The top three rows are Fourier heatmaps for error rate
of ResNet-18 models trained on CIFAR-10 with 80% of weights pruned. The bottom
three rows are difference to the baseline with blue regions indicating lower
error rate than baseline.
---
Figure 10: Visualizing the response of compressed models to perturbations at
different frequencies: The top three rows are Fourier heatmaps for error rate
of ResNet-18 models trained on CIFAR-10 with 90% of weights pruned. The bottom
three rows are difference to the baseline with blue regions indicating lower
error rate than baseline.
---
Figure 11: Visualizing the response of compressed models to perturbations at
different frequencies: The top three rows are Fourier heatmaps for error rate
of ResNet-18 models trained on CIFAR-10 with 95% of weights pruned. The bottom
three rows are difference to the baseline with blue regions indicating lower
error rate than baseline.

##  Appendix E Constructing iterative pruning with rewinding from fine-tuning

While LTH [12] and LRR [43] offer unsurpassed performance, such approaches
also greatly extend the training duration, pruning just 20% of the remaining
weights every $T-r$ epochs, where $T$ is the initial training duration and $r$
is the epoch the weights/learning-rate are rewound to after each pruning event
(here, $r=12$ and $T=160$). This raises the question: Is longer training and
the multi-shot pruning procedure critical to the robustness improvements
LTH/LRR offer relative to FT/GMP?

To test this, we gradually construct the LTH/LRR pruning approaches used in
this paper by starting from a fine-tuning approach and adding modifications
until we produce the LTH/LRR method that prunes the network 13 times to reach
95% sparsity. The phases of this construction for LRR are illustrated in
Figure 12, wherein we plot a column of Fourier heatmaps for each phase.
Specifically, the first column is our FT approach, the second column extends
the fine-tuning duration, the third column adds learning-rate rewinding to
this fine-tuning period, the fourth column decreases the iterative prune rate
to achieve 95% sparsity in 4 shots rather than 1, and subsequent columns
continue to increase the number of pruning shots. In this construction
process, we find a notable benefit of adding learning-rate rewinding (70.9% to
72.6% CIFAR-10-C accuracy moving from column 2 to column 3), but the biggest
benefits of LTH/LRR come from combining this rewinding with multiple
iterations (i.e., all columns from 4 onward display at least 75% robust
accuracy). Interestingly, our results also indicate that it may be possible to
achieve the robustness benefits of LTH/LRR with a higher iterative pruning
rate and thus fewer pruning shots/iterations than what is standard in the
literature [12, 43].

Figure 12: Comparing the resiliencies of Rewinding and Traditional methods to
perturbations at different frequencies: Fourier heatmaps for error rate of
ResNet18 models trained on CIFAR-10 in which 95% of the weights are pruned.

We now repeat this experiment using 90% sparsity (Figure 14), using LTH
instead of LRR at 95% sparsity (Figure 13), and using LTH and 90% sparsity
(Figure 15).

At 95% sparsity, we observe the same pattern: adding multiple shots of pruning
is critical to improving the LTH heatmaps and robustnesses of the rewinding-
based methods (Figure 13). That is to say, adding rewinding and a longer post-
pruning fine-tuning duration to our FT method is not sufficient to obtain the
results achievable with LTH/LRR—multiple iterations are needed. Interestingly,
as especially visible at epsilon 6.0 in the Fourier heatmaps, LRR (Figure 12)
is clearly more resilient to perturbations than LTH, which is consistent with
the improved performance of LRR relative to LTH.

Figure 13: Comparing the resiliencies of Rewinding and Traditional methods to
perturbations at different frequencies: Fourier heatmaps for error rate of
ResNet18 models trained on CIFAR-10 in which 95% of the weights are pruned via
LTH.

At 90% sparsity, for both LTH (Figure 15) and LRR (Figure 14), the Fourier
heatmaps reflect benefits of multiple shots and rewinding (particularly near
the centers of the images for all epsilons). For LRR, there is greater
similarity among the Rewinding and Initialization Fourier heatmaps at 90%
sparsity than at 95% sparsity, and this is reflected in their robustnesses in
the captions, which are less separated in the 90% sparsity case. Notably,
however, all these robustness figures are consistent with the aforementioned
heatmap improvements in that they show the benefits of combining rewinding
with multiple pruning shots. Note that 10-shot pruning corresponds to the
scheme / iterative pruning rate (20%) we use to reach 90% sparsity in other
sections (e.g., Figure 10).

Figure 14: Comparing the resiliencies of Rewinding and Traditional methods to
perturbations at different frequencies: Fourier heatmaps for error rate of
ResNet18 models trained on CIFAR-10 in which 90% of the weights are pruned via
LRR.  Figure 15: Comparing the resiliencies of Rewinding and Traditional
methods to perturbations at different frequencies: Fourier heatmaps for error
rate of ResNet18 models trained on CIFAR-10 in which 90% of the weights are
pruned via LTH.

##  Appendix F Additional results with CARDS and CARD-Deck

In this section, we provide tables for all experimental results from Section
3. This includes tables for individual CARDs on CIFAR-10 for ResNet-18 (Table
2), ResNeXt-29 (Table 13), ResNet-50 (Table 14), and WideResNet-18-2 (Table
15). Additionally, we provide tables for CIFAR-10 CARD-Decks using ResNet-18
(Table 3), WideResNet-18-2 (Table 4), and CIFAR-100 CARD-Decks using
WideResNet-18-2 (Table 5). Breakdowns for the performance of CIFAR-10
ResNet-18 CARDs and CARD-Decks on each of the 15 corruption types in
CIFAR-10-C are provided in Tables 6 – Tables 11. As a reference, tables for
individual CARDs provide results for dense baseline models. Due to the
structure of the table these results are intentionally repeated at each
sparsity level (the dense baselines are not pruned so their performance
remains constant).

###  F.1 Tables of CARD and CARD-Decks results for ResNet-18 and WideResNet-18

The clean and robust accuracies (averaged across three realizations) of CARDs
for each pruning scheme are provided in Table 2. We find that CARDs perform
comparably to (and in some cases better than) their dense counterparts in
terms of accuracy and robustness but have a significantly smaller memory
footprint.

|  | Baseline | CARD
---|---|---|---
|  | Dense | Edgepopup | LRR | LTH | Biprop
|  | - | Layerwise | Global | Global | Global | Layerwise | Global
|  |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gaussian |  Augmix |  Clean |  Gauss.
80% | Clean Acc. | 95.5 | 95.1 | 93.9 | 94.3 | 93.7 | 92.4 | 94.9 | 94.4 | 93 | 96.1 | 95.6 | 93.8 | 95.6 | 94.9 | 93.5 | 93.9 | 93.7 | 92.4 | 94.5 | 94.1 | 93.2
Robust Acc. | 89.2 | 73.7 | 85.6 | 87.8 | 76.7 | 85.1 | 88.4 | 74.4 | 85.7 | 89.8 | 75.7 | 86.4 | 89.4 | 74.4 | 85.8 | 87.5 | 76.1 | 85.1 | 87.8 | 74.3 | 85.3
Memory (Mbit) | 358 | 358 | 358 | 2.23 | 2.23 | 2.23 | 2.23 | 2.23 | 2.23 | 71.5 | 71.5 | 71.5 | 71.5 | 71.5 | 71.5 | 2.23 | 2.23 | 2.23 | 2.23 | 2.23 | 2.23
90% | Clean Acc. | 95.5 | 95.1 | 93.9 | 94.4 | 93.9 | 92.9 | 94.4 | 94.1 | 92.8 | 96.3 | 95.6 | 93.9 | 95.7 | 95.2 | 93.6 | 94.4 | 94.1 | 92.7 | 93.7 | 93.6 | 93
Robust Acc. | 89.2 | 73.7 | 85.6 | 88 | 75.6 | 85.2 | 87.9 | 76 | 85.4 | 89.8 | 76.1 | 86.3 | 89.7 | 74.3 | 86 | 87.8 | 75.1 | 85 | 87.1 | 74.6 | 84.2
Memory (Mbit) | 358 | 358 | 358 | 1.12 | 1.12 | 1.12 | 1.12 | 1.12 | 1.12 | 35.8 | 35.8 | 35.8 | 35.8 | 35.8 | 35.8 | 1.12 | 1.12 | 1.12 | 1.12 | 1.12 | 1.12
95% | Clean Acc. | 95.5 | 95.1 | 93.9 | 94.5 | 94 | 92.6 | 93.2 | 92.7 | 91.2 | 96.1 | 95.7 | 93.9 | 95.8 | 95.1 | 93.8 | 94.2 | 93.8 | 92.5 | 92.5 | 92.1 | 91.4
Robust Acc. | 89.2 | 73.7 | 85.6 | 87.8 | 73.1 | 84.3 | 85.7 | 73.4 | 83.9 | 89.6 | 75.6 | 86.3 | 89.7 | 74.3 | 86 | 87.5 | 73.8 | 84.4 | 84.7 | 73.4 | 83.1
Memory (Mbit) | 358 | 358 | 358 | 0.56 | 0.56 | 0.56 | 0.56 | 0.56 | 0.56 | 17.9 | 17.9 | 17.9 | 17.9 | 17.9 | 17.9 | 0.56 | 0.56 | 0.56 | 0.56 | 0.56 | 0.56
Table 2: Performance comparison between dense baselines and CARDs using ResNet-18 architecture. Clean and Robust Acc. refer to accuracy on CIFAR-10 and CIFAR-10-C, respectively. The best performance for each method is shown in bold.  |  |  CARD-Deck (Agnostic/Adaptive)
---|---|---
|  | Edgepopup (Global) | LRR | LTH | Biprop (Global)
|  | 2 | 4 | 6 | 2 | 4 | 6 | 2 | 4 | 6 | 2 | 4 | 6
80% | Clean Acc. | 92.1/94.1 | 94/94.5 | 94.2/94.8 | 96/96 | 96.3/96.4 | 96.4/96.6 | 95.5/95.5 | 96/96.1 | 96.1/96.1 | 93.8/93.8 | 94.3/94.3 | 94.3/94.4
Robust Acc. | 85/88.9 | 88.4/89.8 | 88.9/90 | 89.7/90.9 | 91.7/91.8 | 91.9/92 | 89.4/90.4 | 91/91.2 | 91.2/91.4 | 87.5/88.6 | 88.8/89.3 | 89/89.6
Memory (Mbit) | 4.47 | 8.94 | 13.4 | 143 | 286 | 429 | 143 | 286 | 429 | 4.47 | 8.94 | 13.4
90% | Clean Acc. | 92.9/94.4 | 94.6/94.8 | 94.7/94.8 | 96.3/96.3 | 96.4/96.4 |  96.4/96.6 | 95.7/95.7 | 95.9/95.7 |  96.2/96.2 | 94/94 | 94.6/94.4 | 94.5/94.6
Robust Acc. | 85.2/89.2 | 88.6/90.1 |  89.3/90.4 | 89.8/91.1 | 91.7/91.8 |  92/92.1 | 89.4/90.5 | 91/91.3 |  91.3/91.5 | 87.4/88.6 | 89.2/89.5 |  89.4/89.9
Memory (Mbit) | 2.23 | 4.47 | 6.70 | 71.5 | 143 | 215 | 71.5 | 143 | 215 | 2.23 | 4.47 | 6.70
95% | Clean Acc. | 92.6/94.5 | 94.2/94.8 |  94.5/95.1 | 96.1/96.1 | 96.3/96.4 | 96.3/96.5 | 95.8/95.8 | 96/96.1 | 96.1/96.2 | 94/94 | 94.7/94.5 |  94.7/94.6
Robust Acc. | 84.3/88.6 | 87.7/89.5 | 88.4/89.9 | 89.6/91 | 91.6/91.8 | 91.9/92 | 89/90.3 | 90.8/91.1 | 91.1/91.4 | 87.2/88.5 | 88.9/89.4 | 89.2/89.7
Memory (Mbit) | 1.12 | 2.23 | 3.35 | 35.8 | 71.5 | 107 | 35.8 | 71.5 | 107 | 1.12 | 2.23 | 3.35
Table 3: Performance of domain-agnostic and domain-adaptive ResNet-18 CARD-Decks. Clean and Robust Acc. refer CIFAR-10 and CIFAR-10-C accuracy, respectively.  |  |  CARD-Deck (Agnostic/Adaptive)
---|---|---
|  | Edgepopup (Global) | LRR | LTH | Biprop (Global)
|  | 2 | 4 | 6 | 2 | 4 | 6 | 2 | 4 | 6 | 2 | 4 | 6
90% | Clean Acc. | 92.4/ 92.9 | 94.0/ 94.8 | 94.8/ 95.1 | 96.3/ 96.3 | 96.7/ 96.7 | 96.7/ 96.8 | 96.1/ 96.1 | 96.5/ 96.4 | 96.6/ 96.6 | 92.4/ 93.1 | 94.3/ 94.5 | 94.9/ 95.0
Robust Acc. | 85.1/ 86.2 | 88.6/ 90.0 | 90.1/ 90.6 | 90.6/ 91.7 | 92.3/ 92.3 | 92.5/ 92.6 | 90.1/ 91.2 | 91.6/ 91.8 | 91.9/ 92.1 | 85.3/ 86.2 | 88.7/ 89.8 | 89.9/ 90.5
Memory (Mbit) | 8.93 | 17.86 | 26.79 | 285.8 | 571.6 | 857.5 | 285.8 | 571.6 | 857.5 | 8.93 | 17.86 | 26.79
95% | Clean Acc. | 92.8/ 93.4 | 94.6/ 94.9 |  95.1/ 95.3 | 96.3/ 96.3 | 96.8/ 96.8 |  96.6/96.8 | 96.1/ 96.1 | 96.5/ 96.4 |  96.6/ 96.7 | 92.3/ 92.8 | 94.2/ 94.5 |  95.0/ 95.2
Robust Acc. | 85.2/ 86.1 | 88.6/ 89.9 |  90.0/ 90.6 | 90.8/ 91.8 | 92.4/ 92.5 |  92.7/92.75 | 89.9/ 91.4 | 91.6/ 91.9 |  91.9/ 92.2 | 84.9/ 86.0 | 88.4/ 89.5 |  90.0/ 90.5
Memory (Mbit) | 4.46 | 8.93 | 13.39 | 142.9 | 285.8 | 428.7 | 142.9 | 285.8 | 428.7 | 4.46 | 8.93 | 13.39
Table 4: Performance of domain-agnostic and domain-adaptive WideResNet-18 CARD-Decks. Clean and Robust Acc. refer to CIFAR-10 and CIFAR-10-C accuracy, respectively. The best performance for each method is shown in bold. For reference, dense WideResNet-18 (AugMix) model achieves (Clean Acc., Robust Acc., Memory) = (95.6%, 89.3%, 1429 Mbit). |  |  CARD-Deck (Agnostic/Adaptive)
---|---|---
|  | Edgepopup (Global) | LRR | LTH | Biprop (Global)
|  | 2 | 4 | 6 | 2 | 4 | 6 | 2 | 4 | 6 | 2 | 4 | 6
90% | Clean Acc. | 77.1/77.1 | 78.5/78.4 | 78.6/78.7 | 78.3/78.3 | 79.6/79.7 | 79.6/80.2 | 78.2/78.2 | 79.6/79.7 | 79.9/80.3 | 76.9/76.9 | 77.8/78.1 |  78.0/78.3
Robust Acc. | 66.3/67.8 | 69.5/69.6 |  69.9/70.3 | 66.9/68.8 | 70.5/70.7 | 71.0/71.2 | 66.2/68.6 | 69.8/70.4 | 70.6/71.0 | 65.8/67.3 | 68.7/69.0 |  69.1/69.6
Memory (Mbit) | 8.95 | 17.90 | 26.85 | 286.5 | 572.9 | 859.3 | 286.5 | 572.9 | 859.3 | 8.95 | 17.90 | 26.85
95% | Clean Acc. | 77.1/77.1 | 78.5/78.5 |  78.7/79.1 | 78.7/78.7 | 79.9/80.2 |  80.1/80.6 | 78.2/78.2 | 79.7/80.0 |  79.8/80.4 | 76.0/76.0 | 77.4/77.1 | 77.9/77.8
Robust Acc. | 65.6/67.1 | 68.9/69.0 | 69.4/69.7 | 67.1/68.8 | 70.6/70.7 |  71.1/71.3 | 66.5/68.6 | 70.1/70.3 |  70.7/71.0 | 64.8/66.5 | 67.9/68.1 | 68.4/68.7
Memory (Mbit) | 4.48 | 8.95 | 13.43 | 143.2 | 286.5 | 429.7 | 143.2 | 286.5 | 429.7 | 4.48 | 8.95 | 13.43
Table 5: Performance of domain-agnostic and domain-adaptive WideResNet-18
CARD-Decks. Clean and Robust Acc. refer to CIFAR-100 and CIFAR-100-C accuracy,
respectively. The best performance for each method is shown in bold. For
reference, dense WideResNet-18 (AugMix) model achieves (Clean Acc., Robust
Acc., Memory) = (77.5%, 66.1%, 1433 Mbit).

###  F.2 Additional results for CARDs and CARD-Decks with ResNet-18

In this section, we provide a breakdown of the accuracy of ResNet-18 CARDs and
CARD-Decks by CIFAR-10-C corruption types. In particular, Tables 6 \- 8
contain the performance of CARDs trained on clean, Augmix, and Gaussian
augmentations when tested on CIFAR-10-C corruption types. Tables 9 to 11
contain the performance of LTH, LRR, EP, and BP CARD-Decks on individual
CIFAR-10-C corruptions.

As a note of interest, we found that the best performance on different
CIFAR-10-C corruptions changes for individual CARDs as the sparsity level
increases. At 80% sparsity, a Gaussian CARD yields the highest accuracy on
impulse noise but at 90% and 95% sparsity levels Augmix CARDs deliver the
highest accuracy on impulse noise. Further, at 95% sparsity the margin of
difference in accuracy on impulse noise provided by the Augmix CARD over the
Gaussian CARD is more significant.

While pruning using FT and GMP were unable to yield CARDs, note that we
include the accuracy and robustness of ResNet-18 models pruned using FT and
GMP with the same augmentation schemes in Table 12 for comparison against the
performance of ResNet-18 CARDs in Table 2.

###  F.3 Achieving state-of-the-art performance on CIFAR-10-C using larger
models

We report these results in Tables 13, 14 and 15. To summarize, our results
highlight the fact that the accuracy/robustness gains due to the model
compression (and ensembling) are compatible with the gains from the existing
strategies, i.e., data augmentation and the use of larger models. By combining
these strategies with the scheme proposed in this paper, we achieve even
larger gains in terms of robustness and accuracy, in turn, establishing a new
SOTA. Note that we include performance of WideResNet-18 CARD-Decks composed of
layerwise pruned BP and EP models in Table 16.

###  F.4 Note on gating function performance

In Table 17, we provide a break down of the performance of the spectral-
similarity based gating function by CIFAR-10-C corruption type. For each
augmentation scheme and corruption type, the corresponding number indicates
the percetage of data from that corruption selected by the gating function
averaged across the 5 severity levels in CIFAR-10-C. Based on the performance
of Augmix and Gaussian CARDs by CIFAR-10-C corruption type in Tables 6 – 8,
entries in the table are marked in bold whenever a model pruned to sparsity
80%, 90%, or 95% trained using that data augmentation scheme achieved the
highest accuracy averaged over all severity levels of that corruption type.
Bolding these entries in Table 17 indicates that the gating function typically
selects the best performing augmentation scheme, and thereby the CARDs in the
deck trained on data most similar to the incoming test data, for the domian-
adaptive CARD-Decks. Improvements could be made by determining a gating
function that is more accurate on the frost and jpeg corruptions. As noted in
Section F.2, the augmentation scheme yielding the best performing models on
impulse and glass corruptions varies with the sparsity level of the pruned
network. This observation indicates that an alternative similarity metric that
takes into account features of the trained CARDs, such as sparsity level,
could provide a gating function that offers improved performance on CIFAR-10-C
corruptions.

|  |  |  |  | Noise | Blur | Weather | Digital
---|---|---|---|---|---|---|---|---
| Model |  Clean |  Avg. Robust |  Memory (Mbit) |  gaussian |  shot |  impulse |  defocus |  glass |  motion |  zoom |  snow |  frost |  fog |  brightness |  contrast |  elastic |  pixelate |  jpeg
Baseline | Dense (Augmix) | 95.5 | 89.2 | 358 | 81.7 | 85.9 | 86.7 | 94.3 | 80.8 | 92.4 | 93.2 | 90.0 | 89.7 | 92.2 | 94.7 | 91.0 | 90.5 | 88.7 | 87.7
Dense (Gaussian) | 93.9 | 85.6 | 358 | 91.3 | 91.8 | 88.3 | 85.8 | 81.0 | 80.9 | 84.9 | 86.4 | 88.3 | 81.9 | 92.3 | 70.6 | 86.6 | 88.1 | 89.9
Dense (Clean) | 95.1 | 73.7 | 358 | 46.5 | 59.1 | 54.0 | 81.8 | 55.1 | 78.1 | 76.4 | 82.4 | 78.2 | 88.2 | 93.5 | 78.2 | 84.0 | 76.1 | 79.3
CARDs | LRR (Augmix) | 96.1 | 89.8 | 71.5 | 78.5 | 85.0 | 88.6 | 95.1 | 81.3 | 93.6 | 94.2 | 91.4 | 90.8 | 93.2 | 95.2 | 92.1 | 91.7 | 89.4 | 88.7
LTH (Augmix) | 95.6 | 89.4 | 71.5 | 80.5 | 86.0 | 85.3 | 94.6 | 80.9 | 93.1 | 93.6 | 90.5 | 90.3 | 92.5 | 94.8 | 91.4 | 91.2 | 89.5 | 88.3
EP (Layerwise Augmix) | 94.9 | 88.4 | 2.23 | 83.4 | 87.3 | 84.3 | 93.6 | 77.8 | 91.6 | 92.3 | 88.3 | 88.2 | 90.8 | 93.9 | 89.5 | 90.0 | 88.9 | 88.5
BP (Layerwise Augmix) | 94.5 | 87.8 | 2.23 | 82.3 | 86.3 | 82.6 | 93.0 | 77.4 | 90.9 | 91.9 | 87.6 | 87.4 | 90.5 | 93.5 | 89.1 | 89.7 | 87.8 | 88.1
EP (Global Augmix) | 94.3 | 87.8 | 2.23 | 83.5 | 87.1 | 82.8 | 92.9 | 78.1 | 90.9 | 91.7 | 87.4 | 87.2 | 89.7 | 93.0 | 87.4 | 89.6 | 88.6 | 88.3
BP (Global Augmix) | 93.9 | 87.5 | 2.23 | 82.9 | 86.6 | 83.3 | 92.4 | 77.8 | 90.3 | 91.2 | 87.0 | 87.1 | 89.4 | 92.7 | 86.8 | 89.1 | 88.4 | 87.9
LRR (Gaussian) | 93.8 | 86.4 | 71.5 | 91.7 | 92.2 | 89.1 | 87.9 | 81.8 | 83.2 | 86.7 | 87.5 | 88.8 | 79.8 | 92.4 | 68.8 | 87.5 | 89.4 | 90.9
LTH (Gaussian) | 93.5 | 85.8 | 71.5 | 91.6 | 92.0 | 88.5 | 87.0 | 79.0 | 82.5 | 86.0 | 86.7 | 87.9 | 80.9 | 92.1 | 69.5 | 87.2 | 88.4 | 90.4
EP (Layerwise Gaussian) | 93.0 | 85.7 | 2.23 | 91.0 | 91.4 | 88.5 | 86.6 | 81.6 | 81.6 | 85.7 | 86.2 | 88.2 | 80.8 | 91.0 | 71.1 | 85.9 | 88.7 | 89.8
BP (Layerwise Gaussian) | 93.2 | 85.3 | 2.23 | 90.7 | 91.1 | 88.2 | 86.0 | 80.6 | 79.9 | 84.9 | 86.2 | 87.6 | 82.1 | 91.5 | 71.3 | 85.7 | 87.4 | 89.5
BP (Global Gaussian) | 92.4 | 85.1 | 2.23 | 90.3 | 90.8 | 88.6 | 85.8 | 80.3 | 80.6 | 84.5 | 85.2 | 86.8 | 81.8 | 90.0 | 70.3 | 85.5 | 87.5 | 89.2
EP (Global Gaussian) | 92.4 | 85.1 | 2.23 | 90.4 | 90.9 | 88.6 | 86.2 | 81.4 | 81.0 | 85.2 | 85.1 | 87.2 | 80.4 | 90.2 | 68.9 | 85.5 | 88.4 | 89.4
EP (Global Clean) | 93.7 | 76.7 | 2.23 | 64.4 | 71.6 | 64.4 | 82.8 | 56.8 | 77.7 | 78.2 | 80.4 | 78.8 | 87.6 | 92.0 | 77.1 | 84.8 | 77.6 | 83.9
LRR (Clean) | 95.6 | 76.3 | 71.5 | 48.2 | 61.0 | 55.7 | 85.2 | 58.5 | 81.9 | 81.5 | 84.5 | 80.5 | 89.6 | 94.2 | 79.8 | 86.6 | 78.9 | 81.5
BP (Global Clean) | 93.7 | 76.1 | 2.23 | 61.2 | 70.1 | 62.9 | 82.6 | 56.6 | 78.2 | 79.3 | 80.5 | 78.6 | 87.3 | 91.7 | 75.7 | 84.4 | 76.6 | 82.6
LTH (Clean) | 94.9 | 74.4 | 71.5 | 46.2 | 59.3 | 51.8 | 82.9 | 55.9 | 78.8 | 78.9 | 83.2 | 79.7 | 88.8 | 93.5 | 78.7 | 85.7 | 77.9 | 80.7
EP (Layerwise Clean) | 94.4 | 74.4 | 2.23 | 50.6 | 62.0 | 55.7 | 82.8 | 51.1 | 78.0 | 78.1 | 80.9 | 77.3 | 88.3 | 92.9 | 81.2 | 84.2 | 76.6 | 81.9
BP (Layerwise Clean) | 94.1 | 74.3 | 2.23 | 53.0 | 64.1 | 56.2 | 82.8 | 50.8 | 77.4 | 78.5 | 80.1 | 76.7 | 87.9 | 92.5 | 78.2 | 83.9 | 75.6 | 81.2

Table 6: Performance when using ResNet-18 architecture with 80% of weights
pruned evaluated on CIFAR-10 and CIFAR-10-C. Note: LTH and LRR model prune
rates are 79%.

|  |  |  |  | Noise | Blur | Weather | Digital
---|---|---|---|---|---|---|---|---
| Model |  Clean |  Avg. Robust |  Memory (Mbit) |  gaussian |  shot |  impulse |  defocus |  glass |  motion |  zoom |  snow |  frost |  fog |  brightness |  contrast |  elastic |  pixelate |  jpeg
Baseline | Dense (Augmix) | 95.5 | 89.2 | 358 | 81.7 | 85.9 | 86.7 | 94.3 | 80.8 | 92.4 | 93.2 | 90.0 | 89.7 | 92.2 | 94.7 | 91.0 | 90.5 | 88.7 | 87.7
Dense (Gaussian) | 93.9 | 85.6 | 358 | 91.3 | 91.8 | 88.3 | 85.8 | 81.0 | 80.9 | 84.9 | 86.4 | 88.3 | 81.9 | 92.3 | 70.6 | 86.6 | 88.1 | 89.9
Dense (Clean) | 95.1 | 73.7 | 358 | 46.5 | 59.1 | 54.0 | 81.8 | 55.1 | 78.1 | 76.4 | 82.4 | 78.2 | 88.2 | 93.5 | 78.2 | 84.0 | 76.1 | 79.3
CARDs | LRR (Augmix) | 96.3 | 90.1 | 35.8 | 79.2 | 85.4 | 89.3 | 95.3 | 81.6 | 93.8 | 94.4 | 91.5 | 91.3 | 93.3 | 95.5 | 92.5 | 91.8 | 89.8 | 88.7
LTH (Augmix) | 95.7 | 89.4 | 35.8 | 79.9 | 85.5 | 86.5 | 94.8 | 81.1 | 93.2 | 93.9 | 91.0 | 90.6 | 92.8 | 94.9 | 91.7 | 91.4 | 89.9 | 88.6
EP (Global Augmix) | 94.4 | 88.0 | 1.12 | 83.2 | 87.1 | 82.9 | 93.0 | 77.6 | 91.0 | 92.0 | 87.7 | 88.0 | 90.4 | 93.4 | 88.8 | 89.6 | 88.9 | 88.2
EP (Layerwise Augmix) | 94.4 | 87.9 | 1.12 | 83.1 | 86.5 | 84.5 | 93.0 | 77.6 | 90.9 | 91.9 | 87.7 | 87.5 | 90.1 | 93.3 | 88.5 | 89.5 | 88.1 | 88.1
BP (Global Augmix) | 94.4 | 87.8 | 1.12 | 83.0 | 86.9 | 83.8 | 92.9 | 76.6 | 90.5 | 91.6 | 87.6 | 87.5 | 89.9 | 93.2 | 88.7 | 89.5 | 88.1 | 87.8
BP (Layerwise Augmix) | 93.7 | 87.1 | 1.12 | 81.9 | 85.8 | 82.3 | 92.2 | 76.8 | 90.0 | 91.0 | 87.0 | 86.5 | 89.5 | 92.5 | 86.9 | 89.0 | 87.2 | 87.8
LRR (Gaussian) | 94.0 | 86.4 | 35.8 | 91.9 | 92.5 | 89.1 | 88.0 | 81.3 | 82.9 | 86.7 | 87.8 | 88.7 | 80.9 | 92.3 | 69.0 | 87.6 | 89.6 | 91.0
LTH (Gaussian) | 93.8 | 86.0 | 35.8 | 91.8 | 92.2 | 88.5 | 87.4 | 79.2 | 82.8 | 86.6 | 87.0 | 88.4 | 81.8 | 92.4 | 70.0 | 87.4 | 88.4 | 90.3
EP (Layerwise Gaussian) | 92.8 | 85.4 | 1.12 | 90.6 | 91.1 | 88.3 | 86.2 | 81.0 | 80.9 | 85.2 | 85.6 | 87.4 | 80.9 | 90.7 | 71.2 | 85.6 | 87.7 | 89.6
EP (Global Gaussian) | 92.9 | 85.2 | 1.12 | 90.8 | 91.1 | 88.7 | 86.4 | 80.5 | 80.8 | 85.2 | 85.4 | 87.0 | 80.9 | 90.8 | 69.8 | 85.8 | 87.4 | 89.4
BP (Global Gaussian) | 92.7 | 85.0 | 1.12 | 90.4 | 90.9 | 88.5 | 85.1 | 80.2 | 79.8 | 83.9 | 85.5 | 87.4 | 81.5 | 90.4 | 71.1 | 85.2 | 86.6 | 89.2
BP (Layerwise Gaussian) | 93.0 | 84.2 | 1.12 | 89.9 | 90.4 | 87.0 | 85.2 | 79.5 | 79.5 | 83.8 | 84.6 | 87.5 | 80.9 | 91.1 | 69.3 | 84.5 | 86.6 | 88.9
LRR (Clean) | 95.6 | 76.6 | 35.8 | 47.6 | 60.5 | 55.2 | 85.1 | 61.1 | 82.0 | 81.4 | 84.9 | 81.2 | 90.3 | 94.3 | 81.4 | 86.4 | 79.7 | 81.3
EP (Layerwise Clean) | 94.1 | 76.0 | 1.12 | 60.7 | 69.3 | 62.5 | 83.5 | 52.7 | 77.9 | 79.1 | 79.8 | 78.1 | 87.5 | 92.3 | 78.0 | 84.2 | 75.7 | 82.1
EP (Global Clean) | 93.9 | 75.6 | 1.12 | 55.5 | 66.1 | 59.9 | 84.2 | 52.3 | 78.6 | 80.4 | 81.1 | 77.9 | 88.4 | 92.4 | 79.1 | 84.1 | 76.7 | 82.3
BP (Global Clean) | 94.1 | 75.1 | 1.12 | 56.9 | 66.8 | 62.0 | 82.6 | 54.3 | 77.2 | 77.9 | 80.6 | 78.5 | 87.9 | 92.2 | 76.9 | 83.4 | 74.9 | 81.3
BP (Layerwise Clean) | 93.6 | 74.6 | 1.12 | 54.2 | 64.7 | 59.3 | 83.0 | 50.8 | 77.0 | 78.2 | 79.5 | 76.6 | 87.5 | 91.9 | 77.0 | 83.5 | 75.0 | 81.8
LTH (Clean) | 95.2 | 74.5 | 35.8 | 45.5 | 58.4 | 53.2 | 83.5 | 56.1 | 79.6 | 79.9 | 83.3 | 79.4 | 89.1 | 93.9 | 78.6 | 85.6 | 77.6 | 80.4

Table 7:  Performance when using ResNet-18 architecture with 90% of weights
pruned evaluated on CIFAR-10 and CIFAR-10-C. Note: LTH and LRR model prune
rates are 89%.

|  |  |  |  | Noise | Blur | Weather | Digital
---|---|---|---|---|---|---|---|---
| Model |  Clean |  Avg. Robust |  Memory (Mbit) |  gaussian |  shot |  impulse |  defocus |  glass |  motion |  zoom |  snow |  frost |  fog |  brightness |  contrast |  elastic |  pixelate |  jpeg
Baseline | Dense (Augmix) | 95.5 | 89.2 | 358 | 81.7 | 85.9 | 86.7 | 94.3 | 80.8 | 92.4 | 93.2 | 90.0 | 89.7 | 92.2 | 94.7 | 91.0 | 90.5 | 88.7 | 87.7
Dense (Gaussian) | 93.9 | 85.6 | 358 | 91.3 | 91.8 | 88.3 | 85.8 | 81.0 | 80.9 | 84.9 | 86.4 | 88.3 | 81.9 | 92.3 | 70.6 | 86.6 | 88.1 | 89.9
Dense (Clean) | 95.1 | 73.7 | 358 | 46.5 | 59.1 | 54.0 | 81.8 | 55.1 | 78.1 | 76.4 | 82.4 | 78.2 | 88.2 | 93.5 | 78.2 | 84.0 | 76.1 | 79.3
CARDs | LRR (Augmix) | 96.1 | 90.1 | 17.9 | 79.2 | 85.3 | 89.6 | 95.2 | 81.5 | 93.8 | 94.3 | 91.6 | 91.4 | 93.3 | 95.4 | 92.4 | 91.8 | 89.7 | 88.8
LTH (Augmix) | 95.9 | 89.5 | 17.9 | 78.0 | 84.5 | 87.0 | 94.7 | 81.1 | 93.1 | 93.8 | 90.9 | 90.5 | 92.8 | 94.9 | 91.5 | 91.6 | 89.3 | 88.4
EP (Global Augmix) | 94.5 | 87.8 | 0.56 | 82.1 | 86.5 | 83.1 | 93.2 | 77.1 | 90.9 | 92.0 | 87.8 | 87.7 | 90.3 | 93.3 | 88.5 | 89.5 | 88.1 | 87.5
BP (Global Augmix) | 94.2 | 87.5 | 0.56 | 82.0 | 86.1 | 83.4 | 92.8 | 76.5 | 90.2 | 91.5 | 87.2 | 87.4 | 89.8 | 93.0 | 87.9 | 89.2 | 87.5 | 87.4
LRR (Gaussian) | 94.0 | 86.5 | 17.9 | 91.9 | 92.3 | 88.9 | 87.7 | 80.4 | 83.3 | 86.7 | 87.7 | 88.8 | 81.1 | 92.6 | 70.2 | 87.8 | 89.2 | 90.7
LTH (Gaussian) | 93.8 | 86.0 | 17.9 | 91.7 | 92.1 | 88.4 | 87.5 | 77.6 | 82.9 | 86.5 | 86.7 | 87.8 | 82.2 | 92.3 | 70.5 | 87.5 | 87.6 | 90.3
EP (Layerwise Augmix) | 93.2 | 85.7 | 0.56 | 81.7 | 85.1 | 82.9 | 91.3 | 73.5 | 88.2 | 89.8 | 85.6 | 85.4 | 88.4 | 91.8 | 85.5 | 87.7 | 85.4 | 86.9
BP (Layerwise Augmix) | 92.5 | 84.7 | 0.56 | 80.6 | 84.2 | 81.3 | 90.7 | 73.0 | 87.4 | 89.0 | 84.1 | 83.6 | 87.2 | 90.9 | 83.6 | 86.9 | 85.4 | 86.8
BP (Global Gaussian) | 92.5 | 84.4 | 0.56 | 90.1 | 90.7 | 88.2 | 85.2 | 78.8 | 79.0 | 84.0 | 85.0 | 86.5 | 80.7 | 90.2 | 69.1 | 84.9 | 85.6 | 89.0
EP (Global Gaussian) | 92.6 | 84.3 | 0.56 | 90.3 | 90.7 | 88.2 | 85.3 | 78.6 | 78.9 | 84.2 | 85.1 | 86.6 | 79.8 | 90.2 | 68.0 | 84.8 | 85.7 | 89.0
EP (Layerwise Gaussian) | 91.2 | 83.9 | 0.56 | 88.8 | 89.6 | 86.5 | 85.6 | 79.5 | 79.6 | 84.5 | 84.2 | 85.7 | 79.0 | 89.2 | 67.9 | 84.4 | 85.8 | 88.2
BP (Layerwise Gaussian) | 91.4 | 83.1 | 0.56 | 88.6 | 89.2 | 85.8 | 84.8 | 78.5 | 79.0 | 83.4 | 83.8 | 85.3 | 80.9 | 89.7 | 67.3 | 83.6 | 85.5 | 87.9
LRR (Clean) | 95.7 | 75.8 | 17.9 | 46.1 | 59.4 | 56.4 | 85.0 | 58.9 | 81.1 | 81.0 | 84.5 | 80.3 | 89.5 | 94.4 | 80.9 | 86.3 | 79.5 | 80.7
LTH (Clean) | 95.2 | 75.1 | 17.9 | 48.0 | 60.8 | 53.7 | 83.2 | 56.0 | 78.0 | 78.7 | 83.4 | 79.8 | 88.9 | 93.9 | 79.1 | 85.3 | 78.3 | 80.9
BP (Global Clean) | 93.8 | 73.8 | 0.56 | 49.9 | 61.8 | 57.2 | 82.2 | 51.1 | 77.0 | 78.1 | 79.7 | 76.8 | 87.6 | 92.1 | 78.4 | 82.9 | 74.9 | 80.7
EP (Layerwise Clean) | 92.7 | 73.4 | 0.56 | 56.1 | 64.9 | 63.3 | 82.1 | 48.6 | 76.9 | 77.2 | 78.1 | 73.5 | 86.3 | 90.9 | 77.2 | 82.4 | 73.8 | 81.4
BP (Layerwise Clean) | 92.1 | 73.4 | 0.56 | 61.4 | 69.3 | 64.1 | 80.0 | 51.5 | 74.6 | 74.0 | 77.8 | 74.5 | 85.6 | 90.1 | 72.7 | 81.5 | 72.2 | 81.5
EP (Global Clean) | 94.0 | 73.1 | 0.56 | 49.3 | 60.2 | 57.6 | 82.0 | 52.5 | 75.7 | 77.6 | 79.2 | 75.9 | 87.0 | 92.1 | 74.8 | 82.9 | 74.3 | 80.6

Table 8:  Performance when using ResNet-18 architecture with 95% of weights
pruned evaluated on CIFAR-10 and CIFAR-10-C.

|  |  |  |  | Noise | Blur | Weather | Digital
---|---|---|---|---|---|---|---|---
| Model |  Clean |  Avg. Robust |  Memory (Mbit) |  gaussian |  shot |  impulse |  defocus |  glass |  motion |  zoom |  snow |  frost |  fog |  brightness |  contrast |  elastic |  pixelate |  jpeg
Baseline | Dense (Augmix) | 95.5 | 89.2 | 358 | 81.7 | 85.9 | 86.7 | 94.3 | 80.8 | 92.4 | 93.2 | 90.0 | 89.7 | 92.2 | 94.7 | 91.0 | 90.5 | 88.7 | 87.7
Dense (Gaussian) | 93.9 | 85.6 | 358 | 91.3 | 91.8 | 88.3 | 85.8 | 81.0 | 80.9 | 84.9 | 86.4 | 88.3 | 81.9 | 92.3 | 70.6 | 86.6 | 88.1 | 89.9
Dense (Clean) | 95.1 | 73.7 | 358 | 46.5 | 59.1 | 54.0 | 81.8 | 55.1 | 78.1 | 76.4 | 82.4 | 78.2 | 88.2 | 93.5 | 78.2 | 84.0 | 76.1 | 79.3
CARD-Deck (Agnostic) | LRR (6) | 96.4 | 91.9 | 429 | 88.8 | 91.5 | 91.6 | 95.1 | 84.7 | 93.3 | 94.3 | 92.2 | 92.3 | 92.3 | 95.5 | 90.5 | 92.6 | 91.6 | 92.1
LRR (4) | 96.3 | 91.7 | 286 | 87.1 | 90.5 | 91.0 | 95.1 | 84.6 | 93.4 | 94.4 | 92.2 | 92.3 | 92.6 | 95.5 | 91.1 | 92.5 | 91.2 | 91.7
LTH (6) | 96.1 | 91.2 | 429 | 88.8 | 91.5 | 89.8 | 94.4 | 83.6 | 92.5 | 93.6 | 91.4 | 91.6 | 91.6 | 95.1 | 89.6 | 92.1 | 90.9 | 91.6
LTH (4) | 96.0 | 91.0 | 286 | 87.7 | 90.6 | 88.9 | 94.5 | 83.4 | 92.7 | 93.8 | 91.4 | 91.5 | 91.9 | 95.0 | 90.3 | 92.0 | 90.7 | 91.1
LRR (2) | 96.0 | 89.7 | 143 | 77.9 | 84.3 | 87.1 | 95.1 | 81.3 | 93.6 | 94.1 | 91.4 | 90.8 | 93.1 | 95.2 | 91.9 | 91.5 | 89.2 | 88.7
LTH (2) | 95.5 | 89.4 | 143 | 80.5 | 86.0 | 84.9 | 94.6 | 80.9 | 93.0 | 93.6 | 90.5 | 90.2 | 92.4 | 94.8 | 91.4 | 91.1 | 89.5 | 87.9
BP (6) | 94.3 | 89.0 | 13.4 | 89.7 | 91.2 | 88.9 | 91.9 | 82.2 | 89.1 | 90.6 | 88.3 | 89.2 | 88.2 | 93.0 | 83.1 | 89.8 | 89.4 | 90.4
BP (4) | 94.3 | 88.8 | 8.94 | 88.9 | 90.6 | 88.1 | 92.0 | 81.4 | 89.4 | 90.8 | 88.1 | 88.9 | 88.4 | 92.9 | 83.9 | 89.7 | 88.9 | 90.1
BP (2) | 93.8 | 87.5 | 4.47 | 82.9 | 86.6 | 83.3 | 92.4 | 77.8 | 90.3 | 91.2 | 87.0 | 87.1 | 89.1 | 92.7 | 86.8 | 89.1 | 87.7 | 87.9

Table 9: Performance of data-agnostic CARD-Deck ensembles composed of 80%
sparse ResNet-18 CARDs on individual CIFAR-10-C corruptions. For each
corruption, entry is average over severity levels 1 through 5.

|  |  |  |  | Noise | Blur | Weather | Digital
---|---|---|---|---|---|---|---|---
| Model |  Clean |  Avg. Robust |  Memory (Mbit) |  gaussian |  shot |  impulse |  defocus |  glass |  motion |  zoom |  snow |  frost |  fog |  brightness |  contrast |  elastic |  pixelate |  jpeg
Baseline | Dense (Augmix) | 95.5 | 89.2 | 358 | 81.7 | 85.9 | 86.7 | 94.3 | 80.8 | 92.4 | 93.2 | 90.0 | 89.7 | 92.2 | 94.7 | 91.0 | 90.5 | 88.7 | 87.7
Dense (Gaussian) | 93.9 | 85.6 | 358 | 91.3 | 91.8 | 88.3 | 85.8 | 81.0 | 80.9 | 84.9 | 86.4 | 88.3 | 81.9 | 92.3 | 70.6 | 86.6 | 88.1 | 89.9
Dense (Clean) | 95.1 | 73.7 | 358 | 46.5 | 59.1 | 54.0 | 81.8 | 55.1 | 78.1 | 76.4 | 82.4 | 78.2 | 88.2 | 93.5 | 78.2 | 84.0 | 76.1 | 79.3
CARD-Deck (Agnostic) | LRR (6) | 96.4 | 92.0 | 215 | 89.4 | 91.9 | 91.9 | 95.0 | 85.0 | 93.3 | 94.2 | 92.2 | 92.4 | 92.2 | 95.6 | 90.5 | 92.6 | 91.5 | 92.1
LRR (4) | 96.4 | 91.7 | 143 | 87.6 | 90.8 | 91.2 | 95.1 | 84.4 | 93.5 | 94.3 | 92.1 | 92.1 | 92.6 | 95.5 | 91.1 | 92.3 | 91.1 | 91.6
LTH (6) | 96.2 | 91.3 | 215 | 88.9 | 91.6 | 89.8 | 94.4 | 83.7 | 92.5 | 93.7 | 91.6 | 91.8 | 91.7 | 95.2 | 89.8 | 92.1 | 91.0 | 91.7
LTH (4) | 95.9 | 91.0 | 143 | 87.4 | 90.5 | 88.3 | 94.5 | 83.1 | 92.9 | 93.8 | 91.6 | 91.6 | 92.1 | 95.2 | 90.4 | 92.0 | 90.7 | 91.1
LRR (2) | 96.3 | 89.8 | 71.5 | 77.7 | 84.3 | 87.2 | 95.3 | 81.4 | 93.8 | 94.4 | 91.4 | 91.0 | 93.1 | 95.5 | 91.9 | 91.7 | 89.8 | 88.7
LTH (2) | 95.7 | 89.4 | 71.5 | 79.9 | 85.5 | 83.2 | 94.7 | 81.1 | 93.2 | 93.9 | 90.8 | 90.6 | 92.5 | 94.9 | 91.7 | 91.2 | 89.9 | 87.8
BP (6) | 94.5 | 89.4 | 6.70 | 89.9 | 91.5 | 89.1 | 92.1 | 81.9 | 89.3 | 91.1 | 89.0 | 89.7 | 88.8 | 93.5 | 85.1 | 90.0 | 89.5 | 90.7
BP (4) | 94.6 | 89.2 | 4.47 | 88.8 | 90.7 | 88.2 | 92.3 | 81.0 | 89.7 | 91.2 | 88.7 | 89.4 | 89.2 | 93.4 | 85.7 | 90.0 | 89.3 | 90.2
BP (2) | 94.0 | 87.4 | 2.23 | 82.0 | 86.3 | 82.7 | 92.5 | 76.5 | 90.3 | 91.5 | 87.3 | 86.8 | 89.7 | 92.8 | 87.8 | 89.5 | 88.1 | 87.6

Table 10: Accuracy of data-agnostic CARD-Deck ensembles composed of 90% sparse
ResNet-18 CARDs on individual CIFAR-10-C corruptions. For each corruption,
entry is average over severity levels 1 through 5.

|  |  |  |  | Noise | Blur | Weather | Digital
---|---|---|---|---|---|---|---|---
| Model |  Clean |  Avg. Robust |  Memory (Mbit) |  gaussian |  shot |  impulse |  defocus |  glass |  motion |  zoom |  snow |  frost |  fog |  brightness |  contrast |  elastic |  pixelate |  jpeg
Baseline | Dense (Augmix) | 95.5 | 89.2 | 358 | 81.7 | 85.9 | 86.7 | 94.3 | 80.8 | 92.4 | 93.2 | 90.0 | 89.7 | 92.2 | 94.7 | 91.0 | 90.5 | 88.7 | 87.7
Dense (Gaussian) | 93.9 | 85.6 | 358 | 91.3 | 91.8 | 88.3 | 85.8 | 81.0 | 80.9 | 84.9 | 86.4 | 88.3 | 81.9 | 92.3 | 70.6 | 86.6 | 88.1 | 89.9
Dense (Clean) | 95.1 | 73.7 | 358 | 46.5 | 59.1 | 54.0 | 81.8 | 55.1 | 78.1 | 76.4 | 82.4 | 78.2 | 88.2 | 93.5 | 78.2 | 84.0 | 76.1 | 79.3
CARD-Deck (Agnostic) | LRR (6) | 96.3 | 91.9 | 107 | 89.3 | 91.6 | 91.9 | 94.9 | 84.5 | 93.2 | 94.1 | 92.2 | 92.2 | 92.1 | 95.6 | 90.3 | 92.4 | 91.5 | 92.0
LRR (4) | 96.3 | 91.6 | 71.5 | 87.0 | 90.3 | 91.3 | 95.0 | 84.0 | 93.4 | 94.2 | 92.2 | 92.2 | 92.6 | 95.5 | 90.8 | 92.4 | 91.4 | 91.6
LTH (6) | 96.1 | 91.1 | 107 | 89.0 | 91.6 | 90.1 | 94.3 | 83.2 | 92.3 | 93.6 | 91.5 | 91.4 | 91.7 | 95.1 | 89.4 | 92.0 | 90.5 | 91.4
LTH (4) | 96.0 | 90.8 | 71.5 | 87.3 | 90.6 | 88.8 | 94.5 | 82.8 | 92.7 | 93.6 | 91.3 | 91.3 | 91.9 | 95.0 | 90.1 | 92.0 | 90.0 | 90.8
LRR (2) | 96.1 | 89.6 | 35.8 | 75.8 | 83.4 | 86.8 | 95.2 | 80.9 | 93.8 | 94.3 | 91.5 | 90.9 | 93.3 | 95.4 | 91.9 | 91.8 | 89.7 | 88.7
BP (6) | 94.7 | 89.2 | 3.35 | 89.5 | 91.2 | 88.7 | 92.4 | 81.0 | 89.2 | 91.3 | 88.7 | 89.5 | 88.7 | 93.5 | 84.8 | 89.9 | 88.8 | 90.6
LTH (2) | 95.8 | 89.0 | 35.8 | 77.8 | 84.5 | 83.6 | 94.6 | 80.5 | 93.1 | 93.6 | 90.9 | 90.2 | 92.5 | 94.8 | 91.2 | 91.2 | 89.3 | 87.7
BP (4) | 94.7 | 88.9 | 2.23 | 88.3 | 90.5 | 87.8 | 92.4 | 80.3 | 89.3 | 91.2 | 88.4 | 89.1 | 88.9 | 93.3 | 85.4 | 89.7 | 88.5 | 90.1
BP (2) | 94.0 | 87.2 | 1.12 | 81.2 | 85.7 | 82.5 | 92.5 | 76.0 | 89.9 | 91.5 | 87.0 | 87.1 | 89.7 | 92.8 | 87.6 | 88.9 | 87.4 | 87.4

Table 11: Accuracy of data-agnostic CARD-Deck ensembles composed of 95% sparse ResNet-18 CARDs on individual CIFAR-10-C corruptions. For each corruption, entry is average over severity levels 1 through 5. |  | Baseline | ResNet-18
---|---|---|---
|  | Dense | FT | GMP
|  | - | Global | Global
|  |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss.
80% | Clean Acc. | 95.5 | 95.1 | 93.9 | 95.6 | 94.6 | 94.1 | 95.1 | 94.3 | 93.4
Robust Acc. | 89.2 | 73.7 | 85.6 | 88.7 | 73.6 | 84.5 | 88.2 | 73 | 84.5
Memory (Mbit) | 358 | 358 | 358 | 143 | 286 | 429 | 143 | 286 | 429
90% | Clean Acc. | 95.5 | 95.1 | 93.9 | 94.7 | 94.1 | 93.1 | 94.8 | 94 | 93.4
Robust Acc. | 89.2 | 73.7 | 85.6 | 87.2 | 71.5 | 83.5 | 87.7 | 72.9 | 83.7
Memory (Mbit) | 358 | 358 | 358 | 71.5 | 143 | 215 | 71.5 | 143 | 215
95% | Clean Acc. | 95.5 | 95.1 | 93.9 | 93.8 | 93.4 | 92.2 | 94.6 | 93.9 | 92.9
Robust Acc. | 89.2 | 73.7 | 85.6 | 85.4 | 68 | 81.1 | 87.2 | 73 | 83.7
Memory (Mbit) | 358 | 358 | 358 | 35.8 | 71.5 | 107 | 35.8 | 71.5 | 107
Table 12: Performance comparison between dense baselines and ResNet-18 models pruned using fine-tuning (FT) and gradual magnitude pruning (GMP). Clean and Robust Acc. refer to accuracy on CIFAR-10 and CIFAR-10-C, respectively.  |  | Baseline | CARD
---|---|---|---
|  | Dense | Edgepopup | LRR | LTH | Biprop
|  | - | Layerwise | Global | Global | Global | Layerwise | Global
|  |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gaussian |  Augmix |  Clean |  Gauss.
90% | Clean Acc. | 95.9 | 95.4 | 93.8 | 94.2 | 94.2 | 93 | 94.4 | 94 | 92.9 | 96.4 | 95.8 | 94.1 | 96.2 | 95.3 | 93.9 | 94.2 | 94 | 92.8 | 93.7 | 93.6 | 92.4
Robust Acc. | 88.2 | 71.2 | 84.3 | 86.5 | 72 | 83 | 86.7 | 72.1 | 83 | 89.1 | 72.4 | 85.2 | 88.8 | 71.5 | 84.2 | 86.2 | 71.5 | 83.1 | 86 | 71.5 | 82.7
Memory (Mbit) | 153 | 153 | 153 | 0.48 | 0.48 | 0.48 | 0.48 | 0.48 | 0.48 | 15.28 | 15.28 | 15.28 | 15.28 | 15.28 | 15.28 | 0.48 | 0.48 | 0.48 | 0.48 | 0.48 | 0.48
95% | Clean Acc. | 95.9 | 95.4 | 93.8 | 93.7 | 93.7 | 93 | 91.7 | 91.5 | 90.4 | 96.2 | 95.6 | 94.1 | 96.1 | 95.1 | 93.8 | 93.6 | 93.5 | 92.4 | 90.9 | 91.2 | 90.2
Robust Acc. | 88.2 | 71.2 | 84.3 | 85.8 | 69.9 | 82.3 | 82.8 | 69 | 80.3 | 89.3 | 72.1 | 85.2 | 88.4 | 71.1 | 84.3 | 85.1 | 70.3 | 81.8 | 82.4 | 70.4 | 80.2
Memory (Mbit) | 153 | 153 | 153 | 0.24 | 0.24 | 0.24 | 0.24 | 0.24 | 0.24 | 7.64 | 7.64 | 7.64 | 7.64 | 7.64 | 7.64 | 0.24 | 0.24 | 0.24 | 0.24 | 0.24 | 0.24
Table 13: Performance comparison between dense baselines and CARDs for ResNeXt-29. Clean and Robust Acc. refer to accuracy on CIFAR-10 and CIFAR-10-C, respectively. |  | Baseline | CARD
---|---|---|---
|  | Dense | Edgepopup | LRR | LTH | Biprop
|  | - | Layerwise | Global | Global | Global | Layerwise | Global
|  |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gaussian |  Augmix |  Clean |  Gauss.
90% | Clean Acc. | 95.9 | 95.1 | 93.6 | 94.8 | 94.4 | 93.3 | 95.4 | 95 | 94 | 96.4 | 95.9 | 94.7 | 95.8 | 95.4 | 94.2 | 94.7 | 94.4 | 93 | 94.9 | 94.7 | 93.2
Robust Acc. | 88.9 | 74.4 | 85.2 | 88 | 75.8 | 84.8 | 89.1 | 76.6 | 86.3 | 90.3 | 76.1 | 86.9 | 89.8 | 75.6 | 86 | 87.9 | 74.6 | 85.1 | 88.6 | 75.6 | 85.6
Memory (Mbit) | 753 | 753 | 753 | 2.35 | 2.35 | 2.35 | 2.35 | 2.35 | 2.35 | 75.27 | 75.27 | 75.27 | 75.27 | 75.27 | 75.27 | 2.35 | 2.35 | 2.35 | 2.35 | 2.35 | 2.35
95% | Clean Acc. | 95.9 | 95.1 | 93.6 | 92.4 | 93.6 | 92.2 | 95 | 94.8 | 93.4 | 96.4 | 95.8 | 94.7 | 95.8 | 95.4 | 94.2 | 94.6 | 94.6 | 93.2 | 94.4 | 93.9 | 92.6
Robust Acc. | 88.9 | 74.4 | 85.2 | 79.2 | 70.9 | 82.6 | 88.9 | 76.6 | 85.9 | 90.4 | 75.7 | 86.8 | 89.6 | 75.3 | 86 | 87.4 | 73.9 | 84.8 | 87.6 | 74.4 | 84.6
Memory (Mbit) | 753 | 753 | 753 | 1.18 | 1.18 | 1.18 | 1.18 | 1.18 | 1.18 | 37.63 | 37.63 | 37.63 | 37.63 | 37.63 | 37.63 | 1.18 | 1.18 | 1.18 | 1.18 | 1.18 | 1.18
Table 14: Performance comparison between dense baselines and CARDs for ResNet-50. Clean and Robust Acc. refer to accuracy on CIFAR-10 and CIFAR-10-C, respectively. |  | Baseline | CARD
---|---|---|---
|  | Dense | Edgepopup | LRR | LTH | Biprop
|  | - | Layerwise | Global | Global | Global | Layerwise | Global
|  |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gauss. |  Augmix |  Clean |  Gaussian |  Augmix |  Clean |  Gauss.
90% | Clean Acc. | 95.6 | 95.2 | 93.3 | 94.8 | 94.2 | 92.4 | 95.0 | 94.7 | 92.8 | 96.4 | 95.9 | 94 | 96.1 | 95.6 | 94.2 | 94.5 | 94.4 | 92.7 | 94.6 | 94.1 | 92.6
Robust Acc. | 89.3 | 74.6 | 85.7 | 88.6 | 78.2 | 85.5 | 88.8 | 76.5 | 85.7 | 90.5 | 76.8 | 86.6 | 89.8 | 75.5 | 86.5 | 88.4 | 77.4 | 85.6 | 88.3 | 75.7 | 85.3
Memory (Mbit) | 1429 | 1429 | 1429 | 4.47 | 4.47 | 4.47 | 4.47 | 4.47 | 4.47 | 142.9 | 142.9 | 142.9 | 142.9 | 142.9 | 142.9 | 4.47 | 4.47 | 4.47 | 4.47 | 4.47 | 4.47
95% | Clean Acc. | 95.6 | 95.2 | 93.3 | 94.9 | 94.4 | 92.8 | 94.2 | 93.8 | 92.1 | 96.5 | 95.8 | 94.2 | 96.1 | 95.8 | 94.3 | 94.7 | 94.3 | 92.7 | 93.6 | 93.3 | 91.5
Robust Acc. | 89.3 | 74.6 | 85.7 | 88.7 | 75.6 | 85.2 | 87.6 | 75.9 | 85.0 | 90.8 | 77.1 | 87.0 | 90.0 | 76.2 | 86.6 | 88.6 | 76.1 | 84.9 | 87.3 | 76.0 | 84.6
Memory (Mbit) | 1429 | 1429 | 1429 | 2.23 | 2.23 | 2.23 | 2.23 | 2.23 | 2.23 | 71.46 | 71.46 | 71.46 | 71.46 | 71.46 | 71.46 | 2.23 | 2.23 | 2.23 | 2.23 | 2.23 | 2.23
Table 15: Performance comparison between dense baselines and CARDs for WideResNet-18 (2x). Clean and Robust Acc. refer to accuracy on CIFAR-10 and CIFAR-10-C, respectively. |  |  CARD-Deck (Agnostic/Adaptive)
---|---|---
|  | Biprop (Layerwise) | Edgepopup (Layerwise)
|  | 2 | 4 | 6 | 2 | 4 | 6
90% | Clean Acc. | 92.3/ 93.0 | 94.0/ 94.5 |  94.8/95.1 | 92.6/ 93.3 | 94.3/ 95.0 |  95.2/95.4
Robust Acc. | 85.2/ 86.2 | 88.4/ 89.8 |  89.9/90.5 | 85.3/ 86.6 | 89.0/ 90.4 |  90.6/91.0
Memory (Mbit) | 8.93 | 17.86 | 26.79 | 8.93 | 17.86 | 26.79
95% | Clean Acc. | 91.4/ 92.0 | 93.3/ 93.6 | 94.0/ 94.1 | 92.1/ 92.2 | 93.8/ 94.1 | 94.7/94.8
Robust Acc. | 84.6/ 85.2 | 87.4/ 88.7 | 88.8/ 89.3 | 85.0/ 85.9 | 88.1/ 89.3 | 89.7/90.0
Memory (Mbit) | 4.46 | 8.93 | 13.39 | 4.46 | 8.93 | 13.39
Table 16: Performance of additional domain-agnostic and domain-adaptive CARD-Decks containing CARDs using WideResNet-18 architecture. | Noise | Blur | Weather | Digital
---|---|---|---|---
Augmentation |  gaussian |  shot |  impulse |  defocus |  glass |  motion |  zoom |  snow |  frost |  fog |  brightness |  contrast |  elastic |  pixelate |  jpeg
Augmix | 0 | 3.2 | 0 | 89 | 0 | 100 | 96.2 | 100 | 38.6 | 100 | 99.8 | 100 | 98.2 | 99.6 | 100
Gaussian | 100 | 96.8 | 100 | 11 | 100 | 0 | 3.8 | 0 | 61.4 | 0 | 0.2 | 0 | 1.8 | 0.4 | 0
Table 17: Gating Function Selection by Corruption Type on CIFAR-10-C: The
CARD-Decks make use of models trained on Augmix and Gaussian augmented
datasets. Here we provide the percentage of CIFAR-10-C test data that was
gated to the Augmix and Gaussian models in the CARD-Deck based on the type of
corruption. For each corruption type, the bold number indicates which CARD
achieves higher performance (on average) on that corruption. This highlights
that our spectral similarity based gating function typically selects the best
performing model. Note that for impulse and glass corruptions, the best
performing models vary between those trained on Augmix and Gaussian
corruptions based on the sparsity level of the model. For each corruption
type, the percentage in the table gated to each augmentation method is an
average over the gating percentages on CIFAR-10-C corruption severity levels 1
through 5.

##  Appendix G Theory

###  G.1 Proof of Corollary 2

Using the triangle inequality, we have that

$\displaystyle\Big{\|}\sum_{k=1}^{n}\lambda_{i}f_{k}(x)-\sum_{k=1}^{n}\lambda_{i}F_{k}(\ell,\bm{w})(x)\Big{\|}$
$\displaystyle\leq\sum_{k=1}^{n}\lambda_{i}\|f_{k}(x)-F_{k}(\ell,\bm{w})(x)\|,$
(5)

for any $x\in\mathcal{X}$. Hence, if

$\displaystyle\sup_{x\in\mathcal{X}}\|f_{k}(x)-F_{k}(\ell,\bm{w})(x)\|\leq\varepsilon$
(6)

for each $1\leq k\leq n$, then it immediately follows that

$\displaystyle\Big{\|}\sum_{k=1}^{n}\lambda_{i}f_{k}(x)-\sum_{k=1}^{n}\lambda_{i}F_{k}(\ell,\bm{w})(x)\Big{\|}$
$\displaystyle\leq\sum_{k=1}^{n}\lambda_{i}\varepsilon=\varepsilon,$ (7)

for all $x\in\mathcal{X}$. Under the hypotheses of Theorem 3 in [38] (Theorem
2 in [9]), for each $k\in\\{1,\ldots,n\\}$ we have that with probability
$(1-\delta)$ there exists a full-precision (binary-weight) CARD satisfying
(6). Thus, with probability $(1-\delta)^{n}$ there exists a collection of
full-precision (binary-weight) networks $\\{f_{k}\\}$ satisfying (1).

###  G.2 OOD Robustness analysis

To understand the average OOD robustness better, we derive the following
decomposition:

$\displaystyle Rob(\mathcal{D}_{c},f^{a})$ $\displaystyle=$ $\displaystyle
Rob(\hat{S_{a}},f^{a})$ $\displaystyle+$
$\displaystyle[Rob(\mathcal{D}_{a},f^{a})-Rob(\hat{S_{a}},f^{a})]$
$\displaystyle+$
$\displaystyle[Rob(\mathcal{D}_{c},f^{a})-Rob(\mathcal{D}_{a},f^{a})].$

Next, using the triangle inequality $a+(b-a)\geq a-\|b-a\|$ which is true
because $\|b-a\|\geq a-b$ for $a,b\geq 0$, we have

$\displaystyle Rob(\mathcal{D}_{c},f^{a})$ $\displaystyle\geq$ $\displaystyle
Rob(\hat{S_{a}},f^{a})$ $\displaystyle-$
$\displaystyle\|Rob(\mathcal{D}_{a},f^{a})-Rob(\hat{S_{a}},f^{a})\|$
$\displaystyle-$
$\displaystyle\|Rob(\mathcal{D}_{c},f^{a})-Rob(\mathcal{D}_{a},f^{a})\|.$

By linearity of expectation, we can bound (2) from below

$\displaystyle Rob(\mathcal{D}^{C},f^{Deck})$ $\displaystyle\geq$
$\displaystyle\sum_{a=1}^{|A|}\sum_{c=1}^{|C|}w_{c}^{a}Rob(\hat{S_{a}},f^{a})$
(8) $\displaystyle-$
$\displaystyle\sum_{a=1}^{|A|}\sum_{c=1}^{|C|}w_{c}^{a}\|Rob(\mathcal{D}_{a},f^{a})-Rob(\hat{S_{a}},f^{a})\|$
(9) $\displaystyle-$
$\displaystyle\sum_{a=1}^{|A|}\sum_{c=1}^{|C|}w_{c}^{a}\|Rob(\mathcal{D}_{c},f^{a})-Rob(\mathcal{D}_{a},f^{a})\|.$
(10)

Note that we have bounded (2) in terms of the following three error terms for
a classifier-corruption pair weighted by their gating (or selection)
probabilities: 1) empirical robustness (8), 2) generalization gap (9), and 3)
OOD-shift (10).

Next, we aim to provide a bound on the OOD-shift that is independent of the
classifiers in hand and is only related to the properties of the
distributions. To facilitate this, we define a notion of distance between two
distributions.

######  Definition 2 ( (Conditional Wasserstein distance).

For two labeled distributions $\mathcal{D}$ and $\mathcal{D}^{\prime}$ with
supports on $X\times Y$, we define conditional Wasserstein distance according
to a distance metric $d$ as follows:

$\text{W}(\mathcal{D},\mathcal{D}^{\prime})=\operatorname*{\mathbb{E}}_{(.,y)\sim\mathcal{D}}\left[\underset{J\in\mathcal{J}(\mathcal{D}|y,\mathcal{D}^{\prime}|y)}{\inf}\operatorname*{\mathbb{E}}_{(x,x^{\prime})\sim
J}d(x,x^{\prime})\right],$ (11)

where $\mathcal{J}(\mathcal{D},\mathcal{D}^{\prime})$ is the set of joint
distributions whose marginals are identical to $\mathcal{D}$ and
$\mathcal{D}^{\prime}$.

Conditional Wasserstein distance between the two distributions is simply the
expectation of Wasserstein distance between conditional distributions for each
class.