Plug-In Inversion: Model-Agnostic Inversion for Vision with Data Augmentations

1 INTRODUCTION . Model inversion is an important tool for visualizing and interpreting behaviors inside neural architectures , understanding what models have learned , and explaining model behaviors . In general , model inversion seeks inputs that either activate a feature in the network ( feature visualization ) or yield a high output response for a particular class ( class inversion ) ( Olah et al. , 2017 ) . Model inversion and visualization has been a cornerstone of conceptual studies that reveal how networks decompose images into semantic information ( Zeiler & Fergus , 2014 ; Dosovitskiy & Brox , 2016 ) . Over time , inversion methods have shifted from solving conceptual problems to solving practical ones . Saliency maps , for example , are image-specific model visualizations that reveal the inputs that most strong influence a model ’ s decisions ( Simonyan et al. , 2014 ) . Recent advances in network architecture have posed major challenges for existing model inversion schemes . Convolutional Neural Networks ( CNN ) have long been the de-facto approach for computer vision tasks , and are the focus of nearly all research in the model inversion field . Recently , other architectures have emerged that achieve results competitive with CNNs . These include Vision Transformers ( ViTs ; Dosovitskiy et al. , 2021 ) , which are based on self-attention layers , and MLPMixer ( Tolstikhin et al. , 2021 ) and ResMLP ( Touvron et al. , 2021a ) , which are based on Multi Layer Perceptron layers . Unfortunately , most existing model inversion methods either can not be applied to these architectures , or are known to fail . For example , the feature regularizer used in DeepInversion ( Yin et al. , 2020 ) can not be applied to ViTs or MLP-based models because they do not include Batch Normalization layers ( Ioffe & Szegedy , 2015 ) . In this work , we focus on class inversion , the goal of which is to find interpretable images that maximize the score a classification model assigns to a chosen label without knowledge about the model ’ s training data . Class inversion has been used for a variety of tasks including model interpretation ( Mordvintsev et al. , 2015 ) , image synthesis ( Santurkar et al. , 2019 ) , and data-free knowledge transfer ( Yin et al. , 2020 ) . However , current inversion methods have several key drawbacks . The quality of generated images is often highly sensitive to the weights assigned to regularization terms , so these hyper-parameters need to be carefully calibrated for each individual network . In addition , methods requiring batch norm parameters are not applicable to emerging architectures . To overcome these limitations , we present Plug-In Inversion ( PII ) , an augmentation-based approach to class inversion . PII does not require any explicit regularization , which eliminates the need to tune regularizer-specific hyper-parameters for each model or image instance . We show that PII is able to invert CNNs , ViTs , and MLP networks using the same architecture-agnostic method , and with the same architecture-agnostic hyper-parameters . 1.1 CONTRIBUTIONS . We summarize our contributions as follows : • We provide a detailed analysis of various augmentations and how they affect the quality of images produced via class inversion . • We introduce Plug-In Inversion ( PII ) , a new class inversion technique based on these augmentations , and compare it to existing techniques . • We apply PII to dozens of different pre-trained models of varying architecture , justifying our claim that it can be ‘ plugged in ’ to most networks without modification . • In particular , we show that PII succeeds in inverting ViTs and large MLP-based architectures , which to our knowledge has not previously been accomplished . • Finally , we explore the potential for combining PII with prior methods . In section 2 , we review existing techniques for class inversion and outline the types of architectures we consider . In section 3 , we explore individually the different augmentations that we use , and then describe the full PII algorithm . The remainder is devoted to results and analysis . 2 BACKGROUND . 2.1 CLASS INVERSION . In the basic procedure for class inversion , we begin with a pre-trained model f and chosen target class y . We randomly initialize ( and optionally pre-process ) an image x in the input space of f . We then perform gradient descent to solve the following optimization problem for a chosen objective function L , x̂ = argmin x L ( f ( x ) , y ) , and the result is class image x̂ . For very shallow networks and small datasets , letting L be crossentropy or even the negative confidence assigned to the true class can produce recognizable images with minimal pre-processing ( Fredrikson et al. , 2015 ) . Modern deep neural networks , however , can not be inverted as easily . 2.2 REGULARIZATION . Most prior work on class inversion for deep networks has focused on carefully designing the objective function to produce quality images . This entails combining a divergence term ( e.g . crossentropy ) with one or more regularization terms ( image priors ) meant to guide the optimization towards an image with ‘ natural ’ characteristics . DeepDream ( Mordvintsev et al. , 2015 ) , following work on feature inversion ( Mahendran & Vedaldi , 2015 ) , uses two such terms : R ` 2 ( x ) = kxk22 , which penalizes the magnitude of the image vector , and total variation , defined as1 RTV ( x ) = 0 @ X i , j ( xi+1 , j xi , j ) 2 1 A 1 2 + 0 @ X i , j ( xi , j+1 xi , j ) 2 1 A 1 2 + 0 @ X i , j ( xi+1 , j+1 xi , j ) 2 1 A 1 2 + 0 @ X i , j ( xi+1 , j xi , j+1 ) 2 1 A 1 2 , which penalizes sharp changes over small distances . DeepInversion ( Yin et al. , 2020 ) uses both of these regularizers , along with the feature regularizer Rfeat ( x ) = X k kµk ( x ) µ̂kk2 + k 2k ( x ) ̂2kk2 , where µk , 2k are the batch mean and variance of the features output by the k-th convolutional layer , and µ̂k , ̂2k are corresponding Batch Normalization statistics stored in the model ( Ioffe & Szegedy , 2015 ) . Naturally , this method is only applicable to models that use Batch Normalization , which leaves out ViTs , MLPs , and even some CNNs . Furthermore , the optimal weights for each regularizer in the objective function vary wildly depending on architecture and training set , which presents a barrier to easily applying such methods to a wide array of networks . 2.3 ARCHITECTURES FOR VISION . We now present a brief overview of the three basic types of vision architectures that we will consider . Convolutional Neural Networks ( CNNs ) have long been the standard in deep learning for computer vision ( LeCun et al. , 1989 ; Krizhevsky et al. , 2012 ) . Convolutional layers encourage a model to learn properties desirable for vision tasks , such as translation invariance . Numerous CNN models exist , mainly differing in the number , size , and arrangement of convolutional blocks and whether they include residual connections , Batch Normalization , or other modifications ( He et al. , 2016 ; Zagoruyko & Komodakis , 2016 ; Simonyan & Zisserman , 2014 ) . Dosovitskiy et al . ( 2021 ) recently introduced Vision Transformers ( ViTs ) , adapting the transformer architectures commonly used in Natural Language Processing ( Vaswani et al. , 2017 ) . These models break input images into patches , combine them with positional embeddings , and use these as input tokens to self-attention modules . Others have proposed variants which require less training data ( Touvron et al. , 2021c ) , have convolutional inductive biases ( d ’ Ascoli et al. , 2021 ) , or make other modifications to the attention modules ( Chu et al. , 2021 ; Liu et al. , 2021b ; Xu et al. , 2021 ) . Subsequently , a number of authors have proposed vision models which are based solely on MultiLayer Perceptrons ( MLPs ) , using insights from ViTs ( Tolstikhin et al. , 2021 ; Touvron et al. , 2021a ; Liu et al. , 2021a ) . Generally , these models use patch embeddings similar to ViTs and alternate channel-wise and patch-wise linear embeddings , along with non-linearities and normalization . We emphasize that as the latter two architecture types are recent developments , our work is the first to study them in the context of model inversion . 3 PLUG-IN INVERSION . Prior work on class inversion uses augmentations like jitter , which randomly shifts an image horizontally and vertically , and horizontal flips to improve the quality of inverted images ( Mordvintsev et al. , 2015 ; Yin et al. , 2020 ) . The hypothesis behind their use is that different views of the same image should result in similar scores for the target class . These augmentations are applied to the input before feeding it to the network , and different augmentations are used for each gradient step 1This is the formulation used by ( Yin et al. , 2020 ) ; others are also common , such as the simpler version in ( Mahendran & Vedaldi , 2015 ) . used to reconstruct x . In this section , we explore additional augmentations that benefit inversion before describing how we combine them to form the PII algorithm . As robust models are typically easier to invert than naturally trained models ( Santurkar et al. , 2019 ; Mejia et al. , 2019 ) , we use a robust ResNet-50 ( He et al. , 2016 ) model trained on the ImageNet ( Deng et al. , 2009 ) dataset throughout this section as a toy example to examine how different augmentations impact inversion . Note , we perform the demonstrations in this section under slightly different conditions and with different models than those ultimately used for PII in order to highlight the effects of the augmentations as clearly as possible . The reader may find thorough experimental details in the appendix , section D . 3.1 RESTRICTING SEARCH SPACE . In this section , we consider two augmentations to improve the spatial qualities of inverted images : Centering and Zoom . These are designed based on our hypothesis that restricting the input optimization space encourages better placement of recognizable features . Both methods start with small input patches , and each gradually increases this space in different ways to reach the intended input size . In doing so , they force the inversion algorithm to place important semantic content in the center of the image . Centering Let x be the input image being optimized . At first , we only optimize a patch at the center of x . After a fixed number of iterations , we increase the patch size outward by padding with random noise , repeating this until the patch reaches the full input size . Figure 2 shows the state of the image prior at each stage of this process , as well as an image produced without centering . Without centering , the shift invariance of the networks allows most semantic content to scatter to the image edges . With centering , results remain coherent . Zoom For zoom , we begin with an image x of lower resolution than the desired result . In each step , we optimize this image for a fixed number of iterations and then up-sample the result , repeating until we reach the full resolution . Figure 3 shows the state of an image at each step of the zoom procedure , along with an image produced without zoom . The latter image splits the object of interest at its edges . By contrast , zoom appears to find a meaningful structure for the image in the early steps and refines details like texture as the resolution increases . We note that zoom is not an entirely novel idea in inversion . Yin et al . ( 2020 ) use a similar technique as ‘ warm-up ’ for better performance and speed-up . However , we observe that continuing zoom throughout optimization contributes to the overall success of PII . Zoom + Centering Unsurprisingly , we have found that applying zoom and centering simultaneously yields even better results than applying either individually , since each one provides a different benefit . Centering places detailed and important features ( e.g . the dog ’ s eye in Figure 2 ) near the center and builds the rest of the image around the existing patch . Zoom helps enforce a sound large-scale structure for the image and fills in details later . The combined Zoom and Centering process proceeds in ‘ stages ’ , each at a higher resolution than the last . Each stage begins with an image patch generated by the previous stage , which approximately minimizes the inversion loss . The patch is then up-sampled to a resolution halfway between the previous stage and current stage resolution , allowing it to fill the center of the image , leaving a border which is padded with random noise . Then next round of optimization then begins starting from this newly processed image .

Summary: This paper proposes a method to perform class inversion on image data, called Plug-In Inversion. This method consists of a sequence of augmentations on image data and is designed to be applicable to a variety of architectures. This method is evaluated on ImageNet trained models and is compared with other techniques used for the same goal.