神經網路量化是一個常見的壓縮技術，概念是將模型權重和激活從浮點數 轉換成整數的形式。而隨著量化技術的進步，也越來越多人注重量化模型對抗 雜訊的防禦能力，在現實環境中，輸入照片可能受到光源不足、畫素過低、傳 輸過程雜訊等擾動因素的影響，這些微小的擾動都可能對模型的預測結果產生 重大影響。因此在進行量化過程時，考慮輸入擾動情況下，確保量化模型的防 禦能力非常重要。然而一般的量化模型有著比原始模型更差的穩健性，原始浮 點數模型可以精確地表示雜訊，但量化模型只能用整數型態表示，若雜訊累積 到一定的程度，就會因為進位而造成更大的錯誤，因此量化模型存在著穩健性 不足的問題，以往後量化訓練中因為基於資料的限制，無法對模型進行重新訓 練，因此沒有針對穩健性去做增強。
本研究提出了一種新的後訓練量化方法，該方法在量化過程中考慮了輸入的 擾動。依據模型各層選擇最適合的量化精度來過濾擾動，以及調整權重範圍， 從而降低誤差累積放大的問題，優化量化準確度，確保量化模型能夠具有接近 原始模型的防禦力。在實驗中測試有輸入擾動的模擬情境，結果表明我們提出 的方法在量化模型中考慮輸入擾動可以有效提高量化模型的防禦能力。與傳統 的量化方法相比，在減少預測誤差的同時，能夠更好地抵擋環境中的各種擾動 因素。

Neural network quantization is a commonly used compression technique that converts model weights and activations from floating-point to integer representa- tions. With advancements in quantization techniques, more attention is paid to the defense capabilities of quantized models against noise. In real-world scenar- ios, input images may be affected by insufficient lighting, low pixel density, and noise during transmission. These minor disruptions can significantly impact the model’s prediction accuracy. Therefore, it is crucial to consider the robustness of quantized models during the quantization process. However, conventional quan- tized models exhibit poorer robustness compared to the original models. While the original floating-point models can accurately represent noise in floating-point format, quantized models can only utilize integer representations. As noise accu- mulates to a certain degree, rounding errors can lead to more significant errors. Thus, the lack of robustness of quantized models has been a challenge in previous post-training quantization approaches, as limitations on data have hindered the ability to retrain the models and enhance their robustness.
In this thesis, we propose a novel post-training quantization method that con- siders input noise during the quantization by selecting the most appropriate quan- tization precision for each network layer to filter out noise and adjust weight ranges to mitigate the issue of error amplification and optimize quantization accuracy. En- sures that the quantized model possesses robustness close to the original model. Through experiments conducted in simulated scenarios with input noise, results demonstrate that our enhanced post-training quantization significantly improves the robustness of the quantized model. Compared to standard quantization meth- ods, our proposed approach not only reduces prediction errors but also exhibits better capability against various environmental noise.

Abstract I Abstract (Chinese) II Acknowledgements (Chinese) III Contents V List of Figures VII List of Tables IX 1 Introduction 1
2 Related Works 5
2.1 Quantization-aware training considering noise . . . . . . . . . . . . 5 2.2 Post-training quantization without considering noise . . . . . . . . . 6
3 Methods 8
3.1 Bitselection............................... 8 3.1.1 Structuralsimilarityindex(SSIM) . . . . . . . . . . . . . . 9 3.1.2 Outputfeaturemapcomparison................ 10
3.2 min-maxadjustment .......................... 13
V
4 Experimental Results 16
4.1 Dataforpost-trainingquanitzation .................. 16
4.2 Noises .................................. 16
4.3 Datasets................................. 17
4.3.1 Imagenet............................. 17
4.3.2 Corrupteddataset ....................... 18
4.4 Results.................................. 18 4.4.1 Gaussiannoise ......................... 18 4.4.2 Shot&impulsenoise...................... 19 4.4.3 Improvementofmin-maxadjustment . . . . . . . . . . . . . 20
5 Conclusion22
References 23

[1] Ron Banner, Yury Nahshan, and Daniel Soudry. Post training 4-bit quanti- zation of convolutional networks for rapid-deployment. Advances in Neural Information Processing Systems, 32, 2019.
[2] Yaohui Cai, Zhewei Yao, Zhen Dong, Amir Gholami, Michael W Mahoney, and Kurt Keutzer. Zeroq: A novel zero shot quantization framework. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13169–13178, 2020.
[3] Yoni Choukroun, Eli Kravchik, Fan Yang, and Pavel Kisilev. Low-bit quan- tization of neural networks for efficient inference. In 2019 IEEE/CVF Inter- national Conference on Computer Vision Workshop (ICCVW), pages 3009– 3018. IEEE, 2019.
[4] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Im- agenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009.
[5] Kirsty Duncan, Ekaterina Komendantskaya, Robert Stewart, and Michael Lones. Relative robustness of quantized neural networks against adversarial attacks. In 2020 International Joint Conference on Neural Networks (IJCNN), pages 1–8. IEEE, 2020.
23
[6] Kartik Gupta and Thalaiyasingam Ajanthan. Improved gradient-based adver- sarial attacks for quantized networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 6810–6818, 2022.
[7] Dan Hendrycks and Thomas G Dietterich. Benchmarking neural network robustness to common corruptions and surface variations. arXiv preprint arXiv:1807.01697, 2018.
[8] Sanghyun Hong, Michael-Andrei Panaitescu-Liess, Yigitcan Kaya, and Tudor Dumitras. Qu-anti-zation: Exploiting quantization artifacts for achieving adversarial outcomes. Advances in Neural Information Processing Systems, 34:9303–9316, 2021.
[9] Faiq Khalid, Hassan Ali, Hammad Tariq, Muhammad Abdullah Hanif, Semeen Rehman, Rehan Ahmed, and Muhammad Shafique. Qusecnets: Quantization-based defense mechanism for securing deep neural network against adversarial attacks. In 2019 IEEE 25th International Symposium on On-Line Testing and Robust System Design (IOLTS), pages 182–187. IEEE, 2019.
[10] Ji Lin, Chuang Gan, and Song Han. Defensive quantization: When efficiency meets robustness. arXiv preprint arXiv:1904.08444, 2019.
[11] Markus Nagel, Rana Ali Amjad, Mart Van Baalen, Christos Louizos, and Tijmen Blankevoort. Up or down? adaptive rounding for post-training quan- tization. In International Conference on Machine Learning, pages 7197–7206. PMLR, 2020.
[12] Adnan Siraj Rakin, Jinfeng Yi, Boqing Gong, and Deliang Fan. Defend deep neural networks against adversarial examples via fixed and dynamic quantized activation functions. arXiv preprint arXiv:1807.06714, 2018.
24

[13] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural net- works. arXiv preprint arXiv:1312.6199, 2013.
[14] Peiqi Wang, Yu Ji, Xinfeng Xie, Yongqiang Lyu, Dongsheng Wang, and Yuan Xie. Qgan: Quantize generative adversarial networks to extreme low-bits. 2019.
[15] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Im- age quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4):600–612, 2004.