Title: SMOOTH KERNELS IMPROVE ADVERSARIAL ROBUST-NESS AND PERCEPTUALLY-ALIGNED GRADIENTS

Abstract: Recent research has shown that CNNs are often overly sensitive to high-frequency textural patterns. Inspired by the intuition that humans tend to be more sensitive to lower-frequency (larger-scale) patterns, we design a regularization scheme that penalizes large differences between adjacent components within each convolutional kernel. We apply our regularization onto several popular training methods, demonstrating that the models with the proposed smooth kernels enjoy improved adversarial robustness. Further, building on recent work establishing connections between adversarial robustness and interpretability, we show that our method appears to give more perceptually-aligned gradients.

1. INTRODUCTION:

In recent years, deep learning models have demonstrated remarkable capabilities for predictive modeling in computer vision, leading some to liken their abilities on perception tasks to those of humans (e.g., Weyand et al., 2016) . However, under closer inspection, the limits of such claims to the narrow scope of i.i.d. data become clear. For example, when faced with adversarial examples (Szegedy et al., 2013; Goodfellow et al., 2015) or even in non-adversarial domain-agnostic cross-domain evaluations (Wang et al., 2019a; b; Carlucci et al., 2019) , performance collapses, dispelling claims of human-like perceptive capabilities and calling into doubt more ambitious applications of this technology in the wild.

A long line of recent research has investigated the robustness of neural networks, including investigations of the high-dimension nature of models (Fawzi et al., 2018) , enlarging the gaps between decision boundaries (Zhang et al., 2019a) , training the models with augmented examples through attack methods (Madry et al., 2018) , and even guaranteeing the robustness of models within given radii of perturbation (Wong & Kolter, 2018; Cohen et al., 2019) . Compared to earlier methods, these recent works enjoy stronger robustness both as assessed via theoretical guarantees and empirically via quantitative performance against strong attacks. However, despite the success of these techniques, vulnerabilities to new varieties of attacks are frequently discovered (Zhang et al., 2019b) .

In this paper, we aim to lessen the dependency of neural networks on high-frequency patterns in images, regularizing CNNs to focus on the low-frequency components. Therefore, the main argument of this paper is that: by regularizing the CNN to be most sensitive to the low-frequency components of an image, we can improve the robustness of models. Interestingly, this also appears to lead to more perceptually-aligned gradients. Further, as Wang et al. (2019c) explicitly defined the low (or high)-frequency components as images reconstructed from the low (or high)-end of the image frequency domain (as is frequently discussed in neuroscience literature addressing human recognition of shape (Bar, 2004) or face (Awasthi et al., 2011 )), we continue with this definition and demonstrate that a smooth kernel can filter out the high-frequency components and improve the models' robustness.

We test our ideas and show the empirical improvement over popular adversarial robust methods with standard evaluations and further use model interpretation methods to understand how the models make decisions and demonstrate that the regularization helps the model to generate more perceptually-aligned gradients.

3. SMOOTH KERNEL REGULARIZATION:

Intuition. High-frequency components of images are those reconstructed from the high-end of the image frequency-domain through inverse Fourier transform. This definition was also verified previously by neuroscientists who demonstrated that humans tend to rely on the low-frequency component of images to recognize shapes (Bar, 2004) and faces (Awasthi et al., 2011) . Therefore, we argue that the smooth kernel regularization is effective because it helps to produce models less sensitive to high-frequency patterns in images. We define a smooth kernel as a convolutional kernel whose weight at each position does not differ much from those of its neighbors, i.e., (w i,j -w h,k∈N (i,j) ) 2 is a small number, where w denotes the convolutional kernel weight, i, j denote the indices of the convolutional kernel w, and N (i, j) denotes the set of the spatial neighbors of i, j.

We note two points that support our intuition.

1. The frequency domain of a smooth kernel has only negligible high-frequency components.

This argument can be shown with Theorem 1 in (Platonov, 2005) . Roughly, the idea is to view the weight matrix w as a function that maps the index of weights to the weights: w(i, j) → w i,j , then a smooth kernel can be seen as a Lipschitz function with constant α.

As pointed out by Platonov (2005) , Titchmarsh (1948) showed that when 0 < α < 1, in the frequency domain, the sum of all the high frequency components with a radius greater than r will converge to a small number, suggesting that the high-frequency components (when r is large) are negligible.

2. The kernel with negligible high-frequency components will weigh the high-frequency components of input images accordingly. This argument can be shown through Convolution Theorem (Bracewell, 1986) , which states w x = F -1 (F(w) F(x)), where F(•) stands for Fourier transform, stands for convolution operation, and stands for point-wise multiplication. As the theorem states, the convolution operation of images is equivalent to the element-wise multiplication of image frequency domain. Therefore, roughly, if w has negligible high-frequency components in the frequency domain, it will weigh the high-frequency components of x accordingly with negligible weights. Naturally, this argument only pertains to a single convolution, and we rely on our intuition that repeated applications of these smooth kernels across multiple convolution layers in a nonlinear deep network will have some cumulative benefit.

Formally, we calculate our regularization term R 0 (w) as follows:

R 0 (w) = i,j h,k∈N (i,j) (w i,j -w h,k ) 2 ,

We also aim to improve this regularization by trying a few additional heuristics:

• First, we notice that directly appending R 0 (w) will sometimes lead to models that achieve the a small value of R 0 (w) by directly scaling down the every coefficient of w proportionally, without changing the fluctuation pattern of the weights. To fix this problem, we directly subtract the scale of w (i.e., i,j w 2 i,j ) after R 0 (w).

• Another heuristic to fix this same problem is to directly divide R 0 (w) by the scale of w.

Empirically, we do not observe significant differences between these two heuristics. We settle with the first heuristic because of the difficulty in calculating gradient when a matrix is the denominator.

• Finally, we empirically observe that the regularization above will play a significant role during the early stage of training, but may damage the overall performances later when the regularization pulls towards smoothness too much. To mitigate this problem, we use an exponential function to strengthen the effects of the regularization when the value is big and to weaken it when the value is small.

Overall, our final regularization is:

R(w) = exp   i,j h,k∈N (i,j) (w i,j -w h,k ) 2 - i,j w 2 i,j  

In practice, the convolutional kernel is usually a 4-dimensional tensor, while our method only encourages smoothness over the two spatial dimensions corresponding to the 2D images. Thus, we only regularize through these two dimensions broadcasting the operation through the channels.

Because a repeated calculation of each kernel component's distance with its neighbors will double count some pairs, our implementation instead enumerates over all pairs of neighbors, counting each squared difference only once towards the total penalty.

We can directly append the regularization λR(w) to most loss functions, where λ is a tuning hyperparameter. In the following experiments, we append λR(w) to the vanilla loss function (crossentropy loss), Trades loss (Zhang et al., 2019a) , adversarial training loss (Madry et al., 2018) , and a variation of logit pairing loss (Kannan et al., 2018) , as introduced in the following paragraphs. which is related to logit pairing. However, to make the comparison consistent, we use a variation of logit pairing, penalizing the KL divergence of softmax (rather than 2 distance over logits), following the Trades loss, which also uses KL divergence over softmax as the distance metric.

To be specific, with the standard notations such as X, Y denoting a data set, x, y denoting a sample, the logit pairing loss is formalized as:

min E x,y ∼ X,Y l(f (x ; θ); y) + γk(f l (x ; θ), f l (x; θ))

where Intuitively, our usage of KL divergence in logit pairing loss is argued to be advantageous because Pinsker's inequality suggests that KL divergence upper-bounds the total variation (TV) distance (e.g., Csiszar & Körner, 2011) , the usage of KL divergence can be seen as a regularization that limits the hypothesis space to the parameters that yield small TV distance over perturbations of samples, which is linked to the robustness of an estimator, a topic that has been studied by the statistics community for over decades (e.g., see (Diakonikolas et al., 2019) and references within).

4. EXPERIMENTS:

To empirically validate our methods, we first consider a simple synthetic experiment to demonstrate the effectiveness of our proposed solutions. Then, with standard data sets such as MNIST (LeCun, 1998) , FashionMNIST (Xiao et al., 2017) , CIFAR10 (Krizhevsky & Hinton, 2009) and Restricted ImageNet (Tsipras et al., 2019) , we evaluate our methods with well-established criteria, such as ∞ bounded accuracy. We also leverage saliency-based visualization methods to understand how the model understands each class. Most experiments are conducted with a simple basic convolutional neural network with two convolution layers and two fully connected layers, while the CIFAR10 experiment is conducted with ResNet18 and Restricted ImageNet experiment is conducted with ResNet50 (more details of the models are in the Appendix). As we mentioned previously, we apply the new regularization to four different losses: the vanilla loss (denoted as V), Trades loss (denoted as T) (Zhang et al., 2019a) , adversarial training (denoted as A) (Madry et al., 2018) , and our variation of logit pairing (denoted as L). T, A, L all adopt ∞ norm bounded PGD as the threat model. We use VR, TR, AR, LR to denote the methods after our regularization is plugged in. We evaluate our methods against a wide range of adversarial attack methods, including FGSM (Goodfellow et al., 2015) , PGD (Madry et al., 2018) , C&W (Carlini & Wagner, 2017) , DeepFool (both 2 and ∞ ) (Moosavi-Dezfooli et al., 2016) , ADef, a method that iteratively applies small deformations to the image (Alaifari et al., 2019) and Salt&Pepper, a black-box method that adds noise to the image. For these attack methods, we use the default parameters in Foolbox (Rauber et al., 2017) , and our experiments suggest that these default parameters are effective enough in most cases. For every data set, we first tune the ∞ norm perturbation bound of adversarial training method and then use the same setting for Trades loss and variation of logit pairing. We tune γ within {0.1, 1.0, 10.0} and tune λ within {0.01, 0.1, 1.0, 10.0, 100.0}.

4.1. SYNTHETIC EXPERIMENTS FOR SANITY CHECKING:

We first use a basic data set of four shapes1 to test whether our proposed method helps regularize the model to behave as we desire. Each image in this data set has a white background and a black foreground depicting one of the four shapes: circle, star, square, and triangle. Our goal is to train a convolutional neural network to classify the images into one of these four shapes.

We compare the models trained the four basic losses V, T, A, L and these models with our regularization, denoted as VR, TR, AR, and LR, when λ = 100.0. To further test our idea, we also test the regularization with the hyperparameter set to a negative value λ = -100.0 to inspect the consequences when we regularize the model towards high-frequency kernels. Resulting models are denoted as VH, TH, AH, LH respectively according to the basic losses.

We report our inspections in Figure 1 : Figure 1 (a) shows that our regularization guides the model towards a smooth kernel, across all the basic losses. Also, if we apply our regularization with a negative parameter, then the weights of the resulting kernel tend to fluctuate more dramatically. Figure 1 (b) validates our argument that a smooth kernel only has negligible high-frequency components. As we can see, the frequency domain corresponding to the kernels when our regularization is applied shows significant differences in low-frequency components (center of the visualization) and high-frequency components (periphery of the visualization). internal representations summarized by kernels from basic losses, those influenced by our regularization are more sensitive to the low-frequency signal (e.g. the shape of the input), and the internal representation with our regularization when the parameter is negative tends to focus more on the high-frequency signals.

Further, we check the mechanism of our model by inspecting how adversarial examples deceive the models. Figure 2 shows the four on-average most deceptive adversarial examples (the models predict incorrectly with the highest confidence) generated by FGSM. Notations follow the same convention as the previous case, and O denotes the original image.

While many images have to be perturbed with a human perceivable amount to deceive the model, we can notice that the adversarial examples for models with our regularization ( R) tend to behave in way that can be understood by a human. The most convincing examples are at the first row for A and AR, where we can clearly see that the adversarial examples alter the decisions from star to circle.

Other adversarial examples for R models also introduce large areas that shall be interpreted as the shape. In contrast, adversarial examples for other models tend to introduce scattered patches, which will probably not be considered as the shape for most people. Also, if we apply our regularization with a negative parameter ( H), the patches tend to behave in a more shattered manner.

4.2. STANDARD NUMERICAL EVALUATION:

In Table 1 , we report the prediction accuracy over the generated adversarial examples across the attack methods. For MNIST and FashionMNIST, we do not limit the of adversarial examples. In principle, when there is no constraint, one should always be able to find the adversarial example for any sample, however, in practice, many search attempts fail when the attack methods are set with the default hyperparameters in Foolbox. We consider these failures of searches (under default parameters) also a measure of the robustness of models. For CIFAR10 and Restricted ImageNet, we set the to be 0.1 and 0.05, respectively (the maximum pixel value is 1.0).

Overall, across most of the settings, our regularization helps achieve numerically the best adversarially robust models. Impressively, for MNIST and FashionMNIST, for some attack methods (e.g., both versions of DeepFool), our regularization can improve the robustness significantly even when only applied to the vanilla training loss, suggesting the importance of the smooth regularization. Also, for these two datasets, the improvements of our regularization are mostly significant over the non-regularized counterparts. For CIFAR10 and Restricted ImageNet, the performance gains are less significant but still observable. In the Appendix, we report the accuracy and curves over 0 , 2 , and ∞ distances, for more thorough comparisons. In general, the performances evaluated by the curves are consistent with results in Table 1 .

4.3. INSPECTING MODEL'S PERCEPTION OF CLASS:

We also leverage one of the most classic model-interpretation methods, activation maximization (Erhan et al., 2009) , to further demonstrate the strength of our regularization. Concretely, we follow (Simonyan et al., 2013; Engstrom et al., 2019) to maximize the logit of a certain class so that the most representative features of that class can be exaggerated in the input image. Specifically, with an input image of Gaussian noise, we apply projected gradient descent 10000 iterations with learning rate 0.001 to update the input image. Notice that the interpretation is sample-independent.

Figure 3 depicts what the models consider to be the digits. While V and T can barely be interpreted to human, when our regularization is plugged in, the patterns appear to be observable, with impressive examples such as Digit 0, 2, 3. A can also deliver interpretable decisions (e.g., Digit 3 and 5), and our regularization significantly helps in other cases, such as Digit 0, 1, 2, 4, and 8. Figure 4 shows a similar story for FashionMNIST dataset: while A might have the cleanest interpretation for the "sneaker" case, our regularization (especially AR) probably has the best interpretation in all other cases, with good examples such as "Trouser," "Dress," and "Boot." Interestingly, AR is the only method that interprets "Bag" with a strap, and the average image of all training "Bag" samples in FashionMNIST is a bag with a strap. Figure 5 shows the visualization of models trained on CIFAR10. While A seems to have the best interpretation in "horse" case, AR and LR have equal or better interpretation in comparison with A in other cases. Impressively, only AR and LR understand "bird," and only AR understands "deer". Figure 6 (results of simpler models are not shown because they cannot be interpreted). AR is the only method that can describe the outline of the "bird" and "crab" classes, while these models seem to remain more or less the similar interpretation power for other labels.

Other results, such as visualization of targeted attack through saliency-based methods and selective visualization of adversarial examples generated along with the experiments, are shown in the Appendix. Overall, the empirical evidence supports our intuition in Section 3: the regularization helps push the model to focus on the low-frequency components of the image and thus leads to more perceptually-aligned gradients.

5. CONCLUSION:

Inspired by neuroscience literature emphasizing the connection between low-frequency components and shape recognition (Bar, 2004; Awasthi et al., 2011) , we proposed a smooth kernel regularization that forces the CNN to learn smooth convolutional kernels (kernels with small differences among adjacent weights) during training. As the relation between smoothness and low-frequency can be argued intuitively and supported by some known results in proved theorems (Titchmarsh, 1948; Bracewell, 1986; Platonov, 2005) , our regularization should help the model to depend more on the low-frequency components of images. To verify the effectiveness of the regularization, we plug in the idea onto multiple training losses, including the vanilla loss, Trades loss (Zhang et al., 2019a) , the adversarial training loss (Madry et al., 2018) , as well as a variation of Logit Pairing loss (Kannan et al., 2018) . With seven different attack methods, we demonstrate the empirical strength of our regularization with standard numerical evaluations. Further, we also leverage the standard model interpretation methods to explain the decision of models, showing that our technique, like those demonstrated by Santurkar et al. (2019) , tends to result in more perceptually-aligned gradients.

A MODEL AND HYPERPARAMETER CHOICES:

For MNIST and FashionMNIST data set, the model is a simple two-layer architecture with two convolutional layers and two fully connected layers. The ∞ perturbation bound of PGD is set to 0.3/1.0 for MNIST and 0.1/1.0 for FashionMNIST. For CIFAR10, the model is a ResNet18, and the ∞ perturbation bound of PGD is set to 0.03/1.0 (roughly 8/255). For Restricted ImageNet, the model is a ResNet50, and the ∞ perturbation bound of PGD is set to 0.005/1.0, then along the processing process, the pixel values of the images are divided by the standard deviation (0.2575), so is the perturbation bound. Also, for Restricted ImageNet, we continue with either the standard ImageNet-pretrained ResNet50 (for V and T losses) or the adversarially trained ResNet50 on Restricted ImageNet (Santurkar et al., 2019) (for A and L losses). With our hardware settings (NVIDIA 1080Ti), we cannot effectively train Trades loss over ResNet50.

B ACCURACY-EPSILON CURVES:

The accuracy-epsilon curves are shown for 0 , 2 and ∞ bounds are shown in Figure 7 , Figure 8 , and Figure 9 . 

:

https://www.kaggle.com/smeschke/four-shapes

Figures and Tables:

x = arg max d(x ,x)≤ l(f (x ; θ); y) where d(•, •) and k(•, •) are distance functions, f l (•; •) denotes the model f (•; •) but outputs the softmax instead of a prediction, l(•, •) is a cost function, γ is a tuning hyperparameter, and is the upper bound of perturbation. In our following experiments, we consider d(•, •) as ∞ norm following popular adversarial training set-up and k(•, •) as KL divergence following standard Trades loss.

Figure 1(a) visualizes of the convolution kernel (due to the limitation of space, we only visualize the first four convolutional kernels); Figure 1(b) visualizes the corresponding frequency domain in absolute values; Figure 1(c) visualizes the internal representation after an image depicting star is passed through the kernels.

Figure1(a) shows that our regularization guides the model towards a smooth kernel, across all the basic losses. Also, if we apply our regularization with a negative parameter, then the weights of the resulting kernel tend to fluctuate more dramatically. Figure1(b) validates our argument that a smooth kernel only has negligible high-frequency components. As we can see, the frequency domain corresponding to the kernels when our regularization is applied shows significant differences in low-frequency components (center of the visualization) and high-frequency components (periphery of the visualization). Figure1(c) further validates our intuition, showing that in comparison to

Figure 3: Sample-independent interpretation of models trained over MNIST. I stands for the input.

Figure3depicts what the models consider to be the digits. While V and T can barely be interpreted to human, when our regularization is plugged in, the patterns appear to be observable, with impressive examples such as Digit 0, 2, 3. A can also deliver interpretable decisions (e.g., Digit 3 and 5), and our regularization significantly helps in other cases, such as Digit 0, 1, 2, 4, and 8. Figure4shows a similar story for FashionMNIST dataset: while A might have the cleanest interpretation for the "sneaker" case, our regularization (especially AR) probably has the best interpretation in all other cases, with good examples such as "Trouser," "Dress," and "Boot." Interestingly, AR is the only method that interprets "Bag" with a strap, and the average image of all training "Bag" samples in FashionMNIST is a bag with a strap. Figure5shows the visualization of models trained on CIFAR10. While A seems to have the best interpretation in "horse" case, AR and LR have equal or better interpretation in comparison with A in other cases. Impressively, only AR and LR understand "bird," and only AR understands "deer". Figure6shows the visualization for Restricted ImageNet

Figure 7: Accuracy over 0 bound across different attack methods with models trained with the three data sets. Novel methods are denoted with solid lines.

Figure 11: targeted attack visualization for VR trained with MNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 12: targeted attack visualization for T trained with MNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 13: targeted attack visualization for TR trained with MNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 14: targeted attack visualization for A trained with MNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 15: targeted attack visualization for AR trained with MNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 16: targeted attack visualization for L trained with MNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 17: targeted attack visualization for LR trained with MNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 18: targeted attack visualization for V trained with FashionMNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 19: targeted attack visualization for VR trained with FashionMNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 20: targeted attack visualization for T trained with FashionMNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 21: targeted attack visualization for TR trained with FashionMNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 22: targeted attack visualization for A trained with FashionMNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 23: targeted attack visualization for AR trained with FashionMNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 24: targeted attack visualization for L trained with FashionMNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 25: targeted attack visualization for LR trained with FashionMNIST. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 26: targeted attack visualization for V trained with CIFAR10. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 27: targeted attack visualization for VR trained with CIFAR10. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 29: targeted attack visualization for TR trained with CIFAR10. The titles of the columns describe the original class, and the titles of the rows describe the target classes.

Figure 38: Adversarial Images generated by Adef attack

Prediction accuracy over adversarial examples. For MNIST and FashionMNIST, we do not limit the of adversrial examples. For CIFAR10 and Restricted ImageNet, we limit the to be 0.1 and 0.05 respectively ( ∞ difference, the maximum is 1.0). Best performance for each data set for each attack method is highlighted (except when the best performance is below random guess).

Table content: <table><tr><td/><td colspan="9">Model clean FGSM PGD DF( 2 ) DF( ∞ ) C&amp;W ADef S&amp;P</td></tr><tr><td/><td>V</td><td colspan="2">0.989 0.013</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td/><td>VR</td><td>0.986</td><td>0.05</td><td>0</td><td>0.969</td><td>0.821</td><td>0</td><td>0.01</td><td>0</td></tr><tr><td/><td>T</td><td>0.989</td><td>0.01</td><td colspan="2">0.039 0.404</td><td>0.344</td><td colspan="3">0.033 0.131 0.001</td></tr><tr><td>MNIST</td><td>TR A</td><td colspan="4">0.983 0.138 0.989 0.075 0.021 0.349 0.53 0.547</td><td>0.465 0.094</td><td colspan="3">0.162 0.772 0.109 0.129 0.071 0</td></tr><tr><td/><td>AR</td><td colspan="4">0.988 0.223 0.017 0.314</td><td>0.088</td><td colspan="2">0.163 0.044</td><td>0</td></tr><tr><td/><td>L</td><td colspan="4">0.951 0.136 0.022 0.466</td><td>0.072</td><td>0.094</td><td colspan="2">0.12 0.001</td></tr><tr><td/><td>LR</td><td colspan="4">0.952 0.292 0.012 0.934</td><td>0.662</td><td colspan="3">0.295 0.204 0.001</td></tr><tr><td/><td>V</td><td colspan="4">0.908 0.012 0.001 0.001</td><td>0.001</td><td>0</td><td>0</td><td>0</td></tr><tr><td/><td>VR</td><td colspan="4">0.885 0.009 0.075 0.758</td><td>0.635</td><td colspan="3">0.005 0.413 0.002</td></tr><tr><td/><td>T</td><td>0.918</td><td>0.04</td><td colspan="2">0.151 0.275</td><td>0.271</td><td colspan="3">0.014 0.157 0.003</td></tr><tr><td>Fashion</td><td>TR</td><td colspan="4">0.873 0.055 0.166 0.785</td><td>0.741</td><td colspan="3">0.086 0.554 0.003</td></tr><tr><td>MNIST</td><td>A</td><td colspan="4">0.869 0.065 0.038 0.141</td><td>0.101</td><td colspan="3">0.015 0.081 0.035</td></tr><tr><td/><td>AR</td><td>0.747</td><td>0.06</td><td colspan="2">0.072 0.231</td><td>0.225</td><td colspan="3">0.121 0.218 0.002</td></tr><tr><td/><td>L</td><td>0.86</td><td colspan="3">0.082 0.034 0.216</td><td>0.044</td><td colspan="3">0.031 0.089 0.034</td></tr><tr><td/><td>LR</td><td colspan="4">0.752 0.176 0.103 0.573</td><td>0.448</td><td colspan="3">0.354 0.335 0.012</td></tr><tr><td/><td>V</td><td>0.85</td><td>0.02</td><td>0.02</td><td>0.02</td><td>0</td><td>0</td><td>0.64</td><td>0.85</td></tr><tr><td/><td>VR</td><td>0.82</td><td>0.03</td><td>0.02</td><td>0.02</td><td>0</td><td>0.01</td><td>0.64</td><td>0.82</td></tr><tr><td/><td>T</td><td>0.78</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0</td><td>0</td><td>0.62</td><td>0.77</td></tr><tr><td>CIFAR10</td><td>TR</td><td>0.81</td><td>0.03</td><td>0.03</td><td>0.03</td><td>0.01</td><td>0</td><td>0.74</td><td>0.81</td></tr><tr><td>( = 0.1)</td><td>A</td><td>0.72</td><td>0.07</td><td>0.55</td><td>0.55</td><td>0.48</td><td>0.03</td><td>0.68</td><td>0.72</td></tr><tr><td/><td>AR</td><td>0.72</td><td>0.09</td><td>0.58</td><td>0.58</td><td>0.57</td><td>0.02</td><td>0.72</td><td>0.72</td></tr><tr><td/><td>L</td><td>0.66</td><td>0.12</td><td>0.56</td><td>0.56</td><td>0.55</td><td>0.03</td><td>0.65</td><td>0.66</td></tr><tr><td/><td>LR</td><td>0.68</td><td>0.11</td><td>0.57</td><td>0.57</td><td>0.54</td><td>0.03</td><td>0.62</td><td>0.68</td></tr><tr><td/><td>V</td><td colspan="2">0.851 0.063</td><td>0</td><td>0.017</td><td>0</td><td colspan="3">0.004 0.851 0.851</td></tr><tr><td>Restricted ImageNet ( = 0.05)</td><td>VR A AR L</td><td colspan="4">0.855 0.047 0.001 0.025 0.404 0.081 0.022 0.33 0.637 0.078 0.021 0.476 0.587 0.11 0.021 0.477</td><td>0.001 0.03 0.023 0.034</td><td colspan="3">0.006 0.855 0.855 0.189 0.404 0.404 0.239 0.637 0.637 0.257 0.587 0.587</td></tr><tr><td/><td>LR</td><td colspan="2">0.591 0.096</td><td>0.02</td><td>0.468</td><td>0.036</td><td colspan="3">0.254 0.591 0.591</td></tr></table>

Peer review (iclr2020):
Paper summary: This paper argues that reducing the reliance of neural networks on high-frequency components of images could help robustness against adversarial examples. To attain this goal, the authors propose a new regularization scheme that encourages convolutional kernels to be smoother. The authors augment standard loss functions with the proposed regularization scheme and study the effect on adversarial robustness, as well as perceptual-alignment of model gradients. Comments: I will first discuss some high-level concerns I have with the paper, followed by more specific comments. Motivation and general idea: The idea of improving model robustness by eliminating high-frequency components in the data is not new. This has in fact been the motivation behind several (later shown to be unsuccessful) defenses such as JPEG compression. In recent work, Yin et al. explore this phenomenon in depth, and importantly discuss how adversarial examples are by no means entirely a high-frequency phenomenon. Specifically, they show that while adversarial examples for natural models do tend to be biased towards higher-frequency components, this is not true for robust models. They argue that it is in general always possible to find adversarial examples in the lower end of the frequency spectrum (for instance, transfer attacks from robust models). Thus, based on evidence from prior work, it is unlikely that a defense based entirely on removing high-frequency components from the input data can be successful. Empirical evaluation: There are significant issues with the empirical evaluation of the proposed defense. In particular, in Table 1 (also Figures 7-9 in the Appendix): 1. The numbers suggest that FGSM is more successful as an attack than PGD. The later is a multi-step version of the former, and hence should be strictly better (more successful in lowering model accuracy). This clearly highlights that the PGD attack is not being used correctly/not run with enough steps, and thus the numbers are not an accurate reflection of model robustness. 2. At a higher-level, the numbers that the authors highlight in the table are the best performance over attacks. This is not the correct way to evaluate robustness, which must always be reported as the *worst-case performance* of the model and hence the lowest accuracy over attacks. If one takes this into consideration, it is clear that the proposed regularization does not really improve robustness. 3. Furthermore, the authors state they use default parameters from Foolbox to evaluate their models. The issue with this is evident in the MNIST/FashionMNIST results where even with arbitrary eps, strong attacks like PGD are not able to break the model. This does not mean that the model is robust, it just means that the default hyperparameters from Foolbox cannot break the model. The authors need to re-run the attacks with different steps sizes/step counts for various attacks. The goal in evaluating model robustness should not be finding one attack (or one set of hyperparameters) which is not able to fool the model, but to show that *no attack* (for the given perturbation set) can lower model accuracy. 4. The eps that are used for the CIFAR-10 and ImageNet experiments are extremely large, and not standard in the literature. In fact, based on my experience, it is probably not possible to be (too) robust to eps as large as 0.1 on CIFAR as this is large enough to visibly change the class even for a human (cf. Tsipras et al.). Thus, I think the robustness evaluation in Table 1 is incorrect and violates some basic sanity checks (such as PGD being stronger than FGSM), and thus does not accurately reflect the model’s true performance. Other comments: i. It is unclear why the sensitivity of the proposed regularization scheme to the scale of w can be fixed by subtracting the norm of w (the exp loss will just be raised to the power alpha if you scale weights by alpha). Dividing by the norm would be the more correct way to fix the scale invariance and the authors should include results with this regularization, at least in the Appendix. ii. In Figure 1, the kernels and activations that are visualized are after the first convolutional layer. The authors should perform a similar visualization after the second layer (or later layers in general) because it is somewhat obvious that you will get these properties at the first layer with the proposed regularization scheme (if the lambda is correctly tuned). The part that is unclear is how effective the regularization is over repeated applications of convolution coupled with non-linearities such as ReLU/pooling. iii. While the visualizations in Figures 2-6 are interesting, it seems that many of the cases in which +R looks semantically meaningful, it also looks meaningful with the base loss itself. It thus is unclear whether the perceptual alignment is coming from the base loss, or from the added regularization. Moreover, the perceptual alignment of models should improve when their dependance on “human-meaningless” features reduces. Since high-frequency components are likely “human-meaningless” features, it is plausible that the proposed regularization scheme makes activation maximization/gradients more perceptually alignment. However, I think this is somewhat orthogonal to (and is not enough to tell us anything about) the robustness of the model itself, which is affected by its reliance on many kinds of “non-robust” features (Ilyas et al., 2019) of which high-frequency components might just be one example. iv. In recent work by Wang et al., the authors conduct an interesting experiment to see how dependent the prediction of a given classifier is to high-frequency components in the data (vs low frequency components) (cf. Figure 1 in their paper). It would be interesting to see this experiment replicated with the proposed regularization scheme. Overall, I think there are significant issues with the paper, especially in the empirical evaluation section. The authors need to re-evaluate their models with the strongest possible form of the attack and demonstrate an improvement in worst-case performance to actually establish the merits of the proposed regularization scheme. Thus, I recommend rejection. References: Yin, Dong, et al. *A fourier perspective on model robustness in computer vision.* arXiv preprint arXiv:1906.08988 (2019). Tsipras, Dimitris, et al. *Robustness may be at odds with accuracy.* arXiv preprint arXiv:1805.12152 (2018). Ilyas, Andrew, et al. *Adversarial examples are not bugs, they are features.* arXiv preprint arXiv:1905.02175 (2019). Wang, Haohan, et al. *High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks.* arXiv preprint arXiv:1905.13545 (2019).