Shape Defense

1 INTRODUCTION . Deep neural networks ( LeCun et al. , 2015 ) remain the state of the art across many areas and are employed in a wide range of applications . They also provide the leading model of biological neural networks , especially in visual processing ( Kriegeskorte , 2015 ) . Despite the unprecedented success , however , they can be easily fooled by adding carefully-crafted imperceptible noise to normal inputs ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) . This poses serious threats in using them in safety- and security-critical domains . Intensive efforts are ongoing to remedy this problem . Our primary goal here is to learn robust models for visual recognition inspired by two observations . First , object shape remains largely invariant to imperceptible adversarial perturbations ( Fig . 1 ) . Shape is a sign of an object and plays a vital role in recognition ( Biederman , 1987 ) . We rely heavily on edges and object boundaries , whereas CNNs emphasize more on texture ( Geirhos et al. , 2018 ) . Second , unlike CNNs , we recognize objects one at a time through attention and background subtraction ( e.g. , Itti & Koch ( 2001 ) ) . These may explain why adversarial examples are perplexing . The convolution operation in CNNs is biased towards capturing texture since the number of pixels constituting texture far exceeds the number of pixels that fall on the object boundary . This in turn provides a big opportunity for adversarial image manipulation . Some attempts have been made to emphasize more on edges , for example by utilizing normalization layers ( e.g. , contrast and divisive normalization ( Krizhevsky et al. , 2012 ) ) . Such attempts , however , have not been fully investigated for adversarial defense . Overall , how shape and texture should be reconciled in CNNs continues to be an open question . Here we propose two solutions that can be easily implemented and integrated in existing defenses . We also investigate possible adaptive attacks against them . Extensive experiments across ten datasets , over which shape and texture have different relative importance , demonstrate the effectiveness of our solutions against strong attacks . Our first method performs adversarial training on edge-augmented inputs . The second method uses a conditional GAN ( Isola et al. , 2017 ) to translate edge maps to clean images , essentially finding a perturbation-invariant transformation . There is no need for adversarial training ( and hence less computation ) in this method . Further , and perhaps less surprising , we find that incorporating edges also makes CNNs more robust to natural images corruptions and backdoor attacks . The versatility and effectiveness of these approaches , without significant parameter tuning , is very promising . Ultimately , our study shows that shape is the key to build robust models and opens a new direction for future research in adversarial robustness . 2 RELATED WORK . Here , we provide a brief overview of the closely related research with an emphasis on adversarial defenses . For detailed comments on this topic , please refer to Akhtar & Mian ( 2018 ) . Adversarial attacks . The goal of the adversary is to craft an adversarial input x̃ ∈ Rd by adding an imperceptible perturbation to the ( legitimate ) input x ∈ Rd ( here in the range [ 0,1 ] ) , i.e. , x̃ = x + . Here , we consider two attacks based on the ` ∞-norm of , the Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2015 ) , as well as the Projected Gradient Descent ( PGD ) method ( Madry et al. , 2017 ) . Both white-box and black-box attacks in the untargeted condition are considered . Deep models are also susceptible to image transformations other than adversarial attacks ( e.g. , noise , blur ) , as is shown in Hendrycks & Dietterich ( 2019 ) and Azulay & Weiss ( 2018 ) . Adversarial defenses . Recently , there has been a surge of methods to mitigate the threat from adversarial attacks either by making models robust to perturbations or by detecting and rejecting malicious inputs . A popular defense is adversarial training in which a network is trained on adversarial examples ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) . In particular , adversarial training with a PGD adversary remains empirically robust to this day ( Athalye et al. , 2018 ) . Drawbacks of adversarial training include impacting clean performance , being computationally expensive , and overfitting to the attacks it is trained on . Some defenses , such as Feature Squeezing ( Xu et al. , 2017 ) , Feature Denoising ( Xie et al. , 2019 ) , PixelDefend ( Song et al. , 2017 ) , JPEG Compression ( Dziugaite et al. , 2016 ) and Input Transformation ( Guo et al. , 2017 ) , attempt to purify the maliciously perturbed images by transforming them back towards the distribution seen during training . MagNet ( Meng & Chen , 2017 ) trains a reformer network ( one or multiple auto-encoders ) to move the adversarial image closer to the manifold of legitimate images . Likewise , Defense-GAN ( Samangouei et al. , 2018 ) uses GANs ( Goodfellow et al. , 2014 ) to project samples onto the manifold of the generator before classifying them . A similar approach based on Variational AutoEncoders ( VAE ) is proposed in Li & Ji ( 2019 ) . Unlike these works which are based on texture ( and hence are fragile ( Athalye et al. , 2018 ) ) , our GAN-based defense is built upon edge maps . Some defenses are inspired by biology ( e.g. , Dapello et al . ( 2020 ) , Li et al . ( 2019 ) , Strisciuglio et al . ( 2020 ) , Reddy et al . ( 2020 ) ) . Shape vs. texture . Geirhos et al . ( 2018 ) discovered that CNNs routinely latch on to the object texture , whereas humans pay more attention to shape . When presented with stimuli with conflicting cues ( e.g. , a cat shape with elephant skin texture ; Appx . A ) , human subjects correctly labeled them based on their shape . In sharp contrast , predictions made by CNNs were mostly based on the texture ( See also Hermann & Kornblith ( 2019 ) ) . Similar results are also reported by Baker et al . ( 2018 ) . Hermann et al . ( 2020 ) studied the factors that produce texture bias in CNNs and learned that data augmentation plays a significant role to mitigate texture bias . Xiao et al . ( 2019 ) , in parallel to our work , have also proposed methods to utilize shape for adversarial defense . They perform classification on the edge map rather than the image itself . This is a baseline method against which we compare our algorithms . Similar to us , they also use GANs to purify the input image . Algorithm 1 Edge-guided adversarial training ( EAT ) for T epochs , perturbation budget , and loss balance ratio α , over a dataset of size M for a network fθ ( performed in minibatches in practice ) . β ∈ { edge , img , imgedge } indicates network type and redetect train means edge redetection during training . for t = 1 . . . T do for i = 1 . . .M do // launch adversarial attack ( here FGSM and PGD attacks ) x̃i = clip ( xi + sign ( ∇x ` ( fθ ( xi ) , yi ) ) ) if β == imgedge & redetect train then x̃i = detect edge ( x̃i ) // recompute and replace the edge map end if ` = α ` ( fθ ( xi ) , yi ) + ( 1− α ) ` ( fθ ( x̃i ) , yi ) // here α = 0.5 θ = θ −∇θ ` // update model weights with some optimizer , e.g. , Adam end for end for Algorithm 2 GAN-based shape defense ( GSD ) // Training 1 . Create a dataset of images X = { xi , yi } i=1···N including clean and/or perturbed images 2 . Extract edge maps ( ei ) for all images in the dataset 3 . Train a conditional GAN pg ( x|e ) to map edge image e to clean image x // here pix2pix 4 . Train a classifier pc ( y|x ) to map generated image x to class label y // Inference 1 . For input image x , clean or perturbed , first compute the edge image e 2 . Then , compute pc ( y|x′ ) where x′ is the generated image corresponding to e 3 PROPOSED METHODS . Edge-guided Adversarial Training ( EAT ) . The intuition here is that the edge map retains the structure in the image and helps disambiguate the classification ( See Fig . 1 ) . In its simplest form ( Fig . 7 ( A ) in Appx . A ; Alg . 1 ) , adversarial training is performed over the 2D ( Gray+Edge ) or 4D ( RGB+Edge ) input ( i.e. , number of channels ; denoted as Img+Edge ) . In a slightly more complicated form ( Fig . 7 ( B ) ) , first , for each input ( clean or adversarial ) , the old edge map is replaced with the newly extracted one . The edge map can be computed from the average of only image channels or all available channels ( i.e. , image plus edge ) . The latter can sometimes improve the results , since the old edge map ( although perturbed ; Fig . 10 and Appx . B ) still contains unaltered shape structures . Then , adversarial training is performed over the new input . The reason behind adversarial training with redetected edges is to expose the network to possible image structure damage . The loss for training is a weighted combination of loss over clean images and loss over adversarial images . At inference time , first , the edge map is computed and then classification is done over the edge-augmented input . As a baseline model , we also consider first detecting the input ’ s edge map and then feeding it to the model trained on the edges for classification . We refer to this model as Img2Edge . GAN-based Shape Defense ( GSD ) . Here , first , a conditional GAN is trained to map the edge image , from clean or adversarial images , to its corresponding clean image ( Alg . 2 ) . Any image translation method ( here pix2pix by Isola et al . ( 2017 ) using this code1 ) can be employed for this purpose . Next , a CNN is trained over the generated images . At inference time , first , the edge map is computed and then classification is done over the generated image for this edge image . The intuition is that the edge map remains nearly the same over small perturbation budgets ( See Appx . A ) . Notice that conditional GAN can also be trained on perturbed images ( similar to Samangouei et al . ( 2018 ) and Li & Ji ( 2019 ) or edge-augmented perturbed images ( similar to above ) . 4 EXPERIMENTS AND RESULTS . 4.1 DATASETS AND MODELS . Experiments are spread across 10 datasets covering a variety of stimulus types . Sample images from datasets are given in Fig . 2 . Models are trained with cross-entropy loss and Adam optimizer ( Kingma 1https : //github.com/mrzhu-cool/pix2pix-pytorch & Ba , 2014 ) with a batch size of 100 , for 20 epochs over MNIST and FashionMNIST , 30 over DogVsCat , and 10 over the remaining . Canny method ( Canny , 1986 ) is used for edge detection over all datasets , except DogBreeds for which Sobel is used . Edge detection parameters are separately adjusted for each dataset . We did not carry out an exhaustive hyperparameter search , since we are interested in additional benefits edges may bring rather than training the best possible models . The first two datasets include MNIST ( LeCun et al. , 1998 ) and FashionMNIST ( Xiao et al. , 2017 ) . A CNN with 2 convolution , 2 pooling , and 2 fc layers is trained . Each of these datasets contains 60K training images ( resolution 28×28 ) and 6K test images over 10 classes . The third dataset , DogVsCat2 contains 18,085 training and 8,204 test images . Images in this dataset are of varying dimensions . They are resized here to 150×150 pixels to save computation . A CNN with 4 convolution , 4 pooling , and 2 fc layers is trained from scratch . Over the remaining datasets , we finetune a pre-trained ResNet18 ( He et al. , 2016 ) , trained over ImageNet ( Deng et al. , 2009 ) , and normalize images using ImageNet mean and standard deviation . The fourth dataset , CIFAR10 ( Krizhevsky , 2009 ) , con- tains 50K training and 10K test images with a resolution of 32×32 which are resized here to 64×64 for better edge detection . The fifth dataset is DogBreeds ( see footnote ) . It contains 1,421 training and 356 test images at resolution 224×224 over 16 classes . The sixth dataset is GTSRB ( Stallkamp et al. , 2012 ) and includes 39,209 and 1,2631 training and test images , respectively , over 43 classes ( resolution 64×64 pixels ) . The seventh dataset , Icons-50 , includes 6,975 training and 3,025 test images over 50 classes ( Hendrycks & Dietterich , 2019 ) . The original image size is 120×120 which is resized to 64×64 . The eighth dataset , Sketch , contains 14K training and 6K test images over 250 classes . Images have size 1111×1111 and are resized to 64×64 in experiments ( Eitz et al. , 2012 ) . The ninth and tenth datasets are derived from ImageNet3 . The Imagenette2-160 dataset has 3,925 training and 9,469 test images ( resolution 160×160 ) over 10 classes ( tench , English springer , cassette player , chain saw , church , French horn , garbage truck , gas pump , golf ball , and parachute ) . The Tiny Imagenet dataset has 100K training images ( resolution 64× 64 ) and 10K validation images ( used here as the test set ) over 200 classes . For attacks , we use https : //github.com/Harry24k/adversarial-attacks-pytorch , except Boundary attack for which we use https : //github.com/bethgelab/foolbox .

Summary: This paper aims to improve adversarial robustness considering the information about the object shape details with the means of edge maps. Two different strategies are proposed to increase model robustness using the edge maps: i) conduct the adversarial training on the input images, which are concatenated with its corresponding edge map as an additional input channel to the image. Here, the edge maps are recomputed and concatenated to the adversarial inputs after their generation during adversarial training. ii) Utilize a conditional GAN to generate the images from clean data distribution that is conditioned on the edge maps and later the classifier performance is evaluated on the generated images. Here, the authors claim that these two strategies improves the classifier robustness after conducting experiments across 10 different datasets. They also studied the effectiveness of their strategy when combined with background subtraction, the defense against poisoning attacks and robustness against natural image corruptions.