Training-Free Robust Multimodal Learning via Sample-Wise Jacobian Regularization

1 INTRODUCTION . Deep fusion models have recently drawn great attention of researchers in the context of multimodal learning ( Vielzeuf et al. , 2018 ; Baltrušaitis et al. , 2018 ; Pérez-Rúa et al. , 2019 ; Wang et al. , 2020 ; Xue et al. , 2021 ) as it provides an easy way to increase model accuracy and robustness . For instance , RGB cameras and LiDARs are usually deployed simultaneously on an autonomous vehicle , and the resulting RGB images and point clouds are referred to as two modalities , respectively . When RGB images are blurry at night , point clouds could provide complementary information and help to make decisions in vision tasks ( Kim & Ghosh , 2019 ) . Over the past few years , numerous multimodal fusion methods have been proposed at different levels : early- , middle- , and late-fusion ( Chen et al. , 2021 ) . In early-fusion , input feature vectors from different modalities are concatenated and fed into one single deep neural network ( DNN ) , while in middle-fusion , they go into DNNs independently and exchange information in feature space . Unlike the previous two cases , late-fusion is realized by merging distinct DNNs at their output layers via concatenation , element-wise summation , etc . These three levels of fusion possess different pros and cons . For instance , late-fusion , the primary concern of our paper , is ( i ) privacy-friendly and ( ii ) convenient to deploy . Specifically , assume that a hospital wants to have an AI agent to judge whether a patient has a certain disease or not ( Sun et al. , 2020 ) . It has to divide the complete training feature ( e.g. , medical records , X-ray images ) of every patient and deliver them to different AI companies , otherwise , the patients ’ identities will be exposed and their privacy are unprotected . This , in turn , directly rules out the possibility of applying early- or middle-fusion methods . On the other hand , the hospital could still exploit latefusion technique to generate the ultimate AI agent after several unimodal DNNs are trained by AI companies . Moreover , unlike early- or middle-fusion , many late-fusion methods could tolerate missing modality information ( i.e. , no need for paired data ) and thus are convenient to deploy . Although late-fusion is a mature topic in the literature , its performance under adversarial attacks ( Madry et al. , 2018 ; Tsipras et al. , 2019 ) and random corruptions ( Zheng et al. , 2016 ; Kim & Ghosh , 2019 ) is rather under-explored . In this paper , we address the problem of robust late-fusion by utilizing Jacobian regularization ( Varga et al. , 2017 ; Jakubovitz & Giryes , 2018 ; Hoffman et al. , 2019 ; Chan et al. , 2019 ) and conditional independence assumption ( Sun et al. , 2020 ) . The key is to minimize the Frobenius norm of a Jacobian matrix so that the multimodal prediction is stabilized ( see Figure 1 ) . Our main contributions are as follows : • To the best of our knowledge , we are the first to propose a training-free robust late-fusion method . The involving optimization problem is relaxed to a Sylvester equation ( Jameson , 1968 ) , and the solution is obtained with only a little computational overhead . • We provide a theoretical error bound of our proposed robust late-fusion method and an illustrative explanation about the function of the extra modality via the TwoMoon example . • Thorough numerical experiments demonstrate that our method outperforms other latefusion methods and is capable to handle both adversarial attacks and random corruptions . 2 PRELIMINARY . Network Robustness To verify the network robustness , two major kinds of perturbations are used , which in our paper we referred to as ( i ) adversarial attacks such as FGSM , PGD , or CW attack ( Goodfellow et al. , 2014 ; Madry et al. , 2018 ; Carlini & Wagner , 2017 ) and ( ii ) random corruptions such as Gaussian noise , missing entries or illumination change ( Zheng et al. , 2016 ; Kim & Ghosh , 2019 ) . Correspondingly , many methods have been proposed to offset the negative effects of such perturbations . Adversarial training based on projected gradient descent ( Madry et al. , 2018 ) is one strong mechanism to defend against adversarial attacks , and the recent Free-m method ( Shafahi et al. , 2019 ) is proposed as its fast variant . Besides adversarial training , several regularization techniques are also proven to have such capability , such as Mixup ( Zhang et al. , 2020 ) , Jacobian regularization ( Jakubovitz & Giryes , 2018 ) . Alternatively , with regard to random corruptions , Mixup and Jacobian regularization are also effective in this case ( Zhang et al. , 2018 ; Hoffman et al. , 2019 ) . Another powerful approach is stability training ( Zheng et al. , 2016 ) , where it introduces an additional KL divergence term into the conventional classification loss so that the trained DNNs are stabilized . Multimodal Learning DNNs trained by fusing data from different modalities have outperformed their unimodal counterparts in various applications , such as object detection ( Chen et al. , 2021 ; Kim & Ghosh , 2019 ) , semantic segmentation ( Chen et al. , 2020b ; Feng et al. , 2020 ) , audio recognition ( Gemmeke et al. , 2017 ; Chen et al. , 2020a ) . Based on where the information is exchanged between different modalities , multimodal fusion methods could be classified into three kinds : ( i ) early-fusion ( Wagner et al. , 2016 ; Chen et al. , 2021 ) , ( ii ) middle-fusion ( Kim & Ghosh , 2019 ; Wang et al. , 2020 ) , and ( iii ) late-fusion ( Chen et al. , 2021 ; Liu et al. , 2021 ) . For instance , if the information is fused at the end of DNNs ( e.g. , Figure 1 ) , such a method belongs to the late-fusion category . Although vast efforts have been put into exploiting multimodal fusion methods to improve DNNs ’ accuracy on specific learning tasks , few works have explored network robustness in the multimodal context . Specifically , Mees et al . ( 2016 ) , Valada et al . ( 2017 ) , and Kim et al . ( 2018 ) exploited gating networks to deal with random corruptions , adverse or changing environments . Afterwards , Kim & Ghosh ( 2019 ) proposed a surrogate minimization scheme and a latent ensemble layer to handle single-source corruptions . However , all the aforementioned methods belong to middle-fusion and only random corruptions are considered . On the other hand , we focus on another important scenario : late-fusion , and besides corruptions , we further take adversarial attacks into account . To the best of our knowledge , robust late-fusion is un-explored in the previous literature . 3 JACOBIAN REGULARIZATION IN TEST TIME . Consider a supervised K-class classification problem in the multimodal context . Suppose that features from two distinct modalities A ( e.g. , audio ) and B ( e.g. , video ) are provided in the form of DA = { ( xiA , yi ) } Ni=1 and DB = { ( xiB , yi ) } Ni=1 , where { xA , xB } represents input features and y represents the true label . We train two unimodal networks separately , each corresponding to one modality . Given a specific input feature xA , the first unimodal network calculate the class prediction pA ∈ RK by : pA = σ1 ( zA ) = σ1 ( WAhA + bA ) = σ1 ( WAfA ( xA ) + bA ) ( 1 ) where σ1 ( · ) represents the Softmax function , zA ∈ RK represents the raw logit , and hA = fA ( xA ) ∈ RH represents the feature being fed into the last layer 1 . Here WA ∈ RK×H and bA ∈ RK are the learnable weight and bias of the last linear layer , respectively . Similarly , the second unimodal network provides the class prediction pB = σ1 ( zB ) = σ1 ( WBhB + bB ) = σ1 ( WBfB ( xB ) + bB ) . Based on the conditional independence assumption ( Kong & Schoenebeck , 2018 ) , the basic statistical late-fusion method generates the final class prediction as ( Chen et al. , 2021 ) : p = σ2 ( pA pB freq ) = σ2 ( σ1 ( zA ) σ1 ( zB ) freq ) ( 2 ) where the division is performed in an element-wise manner , represents the element-wise product , and σ2 ( · ) represents a linear normalization enforcing the summation of elements equal to one . Here freq ∈ RK contains the occurring frequencies of each class , calculated from the training dataset . Our proposed approach builds upon ( 2 ) . Specifically , we consider adding twoK×K weight matrices { Wa , Wb } ahead of { zA , zB } , respectively , right before they get activated . Consequently , the final multimodal prediction is re-calibrated as : p′ = σ2 ( σ1 ( z ′ A ) σ1 ( z′B ) freq ) = σ2 ( σ1 ( WazA ) σ1 ( WbzB ) freq ) ( 3 ) Suppose that the data provided from modality A are perturbed at the input or feature level , while the data from modality B are clean . For matrix Wb , we could simply set it to an identity matrix , implying that we didn ’ t invoke the robust add-on for the second modality . To determine the value of Wa , we first calculate the derivative of p′ with respect to hA ( see Appendix A.1 ) : ∂p′ ∂hA = J′WaWA = [ p ′p′ , T − Diag ( p′ ) ] WaWA ( 4 ) Then we minimize the following regularized Jacobian loss with respect to Wa : min Wa L = min Wa ( 1− γ ) ||J′WaWA||2F + γ||Wa − I||2F ( 5 ) where 0 < γ < 1 is a tunable hyper-parameter . Minimizing the first term in the loss could make the change of p′ limited to some extent when hA is perturbed , while the second term in the loss guarantees numerical stability and the prediction in the perturbed case won ’ t get too far from that of the clean case . For a specific multimodal input { xA , xB } , once Wa is determined , so are p′ and J′ via ( 3 ) and ( 4 ) , respectively . Thus , ( 5 ) is well-determined and non-linear with respect to Wa . We propose a heuristic iterative method making the above optimization problem tractable in Algorithm 1 . Our key is to decouple J′ from Wa . Namely , in step 5 of Algorithm 1 , all terms are known except Wa , and thus the relaxed loss is convex . After writing out all terms of ∂L ( t ) /∂Wa , we observe that it is a Sylvester equation ( Jameson , 1968 ) . It has a unique solution and the run time is as large as inverting a K ×K matrix and hence affordable . See Appendix A.2 for details . Remarks First , in our implementation we find that one iteration could already yield a sufficiently accurate result , thus all our numerical results are reported with tmax = 1 ( i.e. , p′ = p ( 1 ) ) . Second , if we know data from modality B are also perturbed , we could solve Wb in a similar manner . Third , 1 ( 1 ) holds because the last layer is usually implemented as a fully connected ( FC ) layer with Softmax activation in classification tasks . Algorithm 1 Iteratively solving regularized Jacobian loss 1 : Given one specific input { xA , xB } . Initialize iteration index t = 0 . 2 : Perform one forward pass , yielding the initial class prediction p ( 0 ) . 3 : while t < tmax do 4 : Calculate J ( t ) = p ( t ) p ( t ) , T − Diag ( p ( t ) ) . 5 : Minimize L ( t ) = ( 1− γ ) ||J ( t ) WaWA||2F + γ||Wa − I||2F with respect to Wa . 6 : Calculate p ( t+1 ) based on Eq ( 3 ) with the optimal Wa . 7 : Update t = t+ 1 . 8 : end while 9 : Return p′ = p ( t ) . notice that our approach is invoked merely during inference ( i.e. , test time ) , but not the train time . Furthermore , we demonstrate our approach in the context of two modalities , while obviously , it could be equally applied to many modalities . Finally , with a moderate assumption , we can further prove that when the input is perturbed , the change of final prediction enhanced by our method is limited to a certain amount . This has been summarized in Theorem 1 ( see Appendix A.3 ) . Some immediate corollary include : ( i ) when ∼ N ( 0 , Σ ) , the bound is simplified toE [ ||p′ , noise−p′|| ] ≤ l ( γK2 ( 1−γ ) ) 1/2 Tr [ Σ ] , ( ii ) when the L2 norm of is constrained smaller than δ ( usually assumed in adversarial attacks ) , the bound is simplified to ||p′ , noise − p′|| ≤ l δ ( γK2 ( 1−γ ) ) 1/2 . Theorem 1 If fA is l-Lipschitz continuous and xA is perturbed by : xnoiseA = xA + , then the Euclidean norm of our final prediction ( i.e. , ||p′ , noise − p′|| ) at most changes l √ γK 2 ( 1−γ ) || || .

Summary: The paper proposed a training-free robust multimodal learning late-fusion methods via sample-wise Jacobian regularization. The key idea of the work is to minimize the Frobenius norm of a Jacobian matrix, so that the multimodal prediction is stabilized. The paper demonstrate the good efficacy on both adversarial attacks and random corruptions setting on multimoda datasets such as AV-MNIST/VGGSound/RAVDESS.