Tessellated 2D Convolution Networks: A Robust Defence against Adversarial Attacks

1 INTRODUCTION . Deep neural networks are known to be susceptible to adversarial attacks . Image representations learned by a deep neural network differ from their visual interpretation . Attackers exploit this fact by introducing imperceptible evasive perturbation in a set of test images such that the victim network misclassifies them ( Joseph et al. , 2019 ) . Defending neural networks against such adversarial attacks is of significant theoretical and practical importance . Major approaches to defence against such adversarial threats include adversarial training ( Madry et al. , 2018 ) , network distillation ( Papernot et al. , 2016 ) , input randomization ( Xie et al. , 2018 ) , activation pruning ( Dhillon et al. , 2018 ) , gradient masking ( Goodfellow , 2018 ) , input transformation ( AprilPyone & Kiya , 2020 ) , and ensemble methods ( Tramèr et al. , 2017 ) to name a few . Architectural changes in the network topology is a promising means of achieving adversarial robustness . Well known evasive attacks include the gradient based input perturbation strategies such as fast gradient sign method ( FGSM ) ( Goodfellow et al. , 2015 ) , and the projected gradient descent ( PGD ) ( Madry et al. , 2018 ) methodologies . Universal attacks that are image-agnostic and add the same perturbation for all input images while still modifying the class labels are also prevalent ( MoosaviDezfooli et al. , 2017 ) . Norm based attacks seeking to optimize the perturbation were subsequently proposed to victimize newer defence strategies ( Carlini & Wagner , 2017 ; Croce & Hein , 2019 ) . Patch attacks , which involve perturbing image segments rather than the image pixels , have also been attempted Sharif et al . ( 2016 ) . More recent attacking approaches include the use of ensemblingbased strategies with a capability to adapt on the defence mechanisms employed ( Tramèr et al. , 2020 ) . Depending on the amount of information exposed to an attacker , an attack corresponds to one of the two types , namely i ) black-box attack , those with little or no knowledge about the target model , and ii ) white-box attack , where additional information about the network is available ( e.g. , in the form of architecture , optimization function used , model parameters etc. ) . A black-box attack often involves substituting the victim network by a proxy network , constructed with the help of a small number of interactions with an oracle ( Papernot et al. , 2016 ) . In between the two extremes of the black-box and white-box variants lies the gray-box attack , where the parameter values of a trained model are not available to an attacker ; however , other information about the model ( e.g. , architecture details and optimization/activation functions ) are available ( Vivek et al. , 2018 ) . It has been reported that attacks methods can usually be effectively transferred to similar networks in a gray-box threat scenario . Numerous other threat scenarios like transfer-based , score-based , and decision-based black-box attacks are known in the literature ( Ren et al. , 2020 ; Dong et al. , 2020 ) . As newer attacks are being developed , designing networks that are robust to adversarial attacks has been an ongoing game . Among the most popular defence mechanisms are the ones that are based on adversarial training using the samples generated by attacks such as FGSM Goodfellow et al . ( 2015 ) and PGD Madry et al . ( 2018 ) or their ensemble ( Tramèr et al. , 2017 ) . State-of-the-art defences as reported in the RobustBench ( Croce et al. , 2020 ) benchmark dataset include those based on data augmentation for adversarial training ( Rebuffi et al. , 2021 ) , as well as those that are based on transformation or randomization of model parameters ( Gowal et al. , 2021 ) . Various randomized image transformation schemes such as cropping , padding , compression , block segmentation , noise addition to convolution layer features demonstrate adversarial robustness ( Xie et al. , 2017 ; Liu et al. , 2018 ; AprilPyone & Kiya , 2020 ) . Input rectification schemes attempts to remove adversarial perturbations by denoising , image blurring and depth reduction Xu et al . ( 2017 ) . Transformation of the features at the output of the convolution layers like activation pruning ( Goodfellow , 2018 ) , denoising , are often equally effective Dhillon et al . ( 2018 ) ; Liao et al . ( 2018 ) . Regularization and dropout are recently being used for achieving adversarial robustness ( Wang et al. , 2018 ; B.S . & Babu , 2020 ; Jordão & Pedrini , 2021 ) . A study on the effect of regularization and sparsity with respect to the adversarial robustness of a network can be found in ( Schwartz et al. , 2020 ; Pang et al. , 2020 ) . Generating diverse structured networks as a tool for robustness has been proposed in ( Du et al. , 2021 ; Pang et al. , 2019 ) . An alternative convolutional network ( CNN ) architecture which randomly masks parts of the feature maps also demonstrates adversarial robustness ( Luo et al. , 2020 ) . Architectural robustness provides an attractive defense mechanism that is agnostic to attack strategies . As a motivation of the work in this paper , we hypothesize that modification of the network structure leading to implicit feature transformation , cropping , masking , and distillation may result in improved robustness against adversarial attacks in an attacking method agnostic manner . Incorporation of diversity in network topology may also act as an effective defence against ensemble attacks . Consequently , reconfiguring the topology of a network may provide effective defence against adaptive adversarial attacks . In this paper , we propose two dimensional tessellated convolutional networks ( TCNN ) that incorporates the effects of cropping , masking and feature transformation within a single framework . In our approach , an input image is partitioned into blocks ( tiles ) according to a tessellation ( tiling ) pattern . Each region of the input image makes use of a separate branch in the computation graph to propagate its effects forward in the form of feature representations . The individual feature representations then interact with each other for the eventual prediction of an image class ( see Figure 1 for a schematic representation ) . We investigate the use of three types of rectangular tessellation patterns , namely , regular grid tiling , tiling with non-uniform rectangles , and Mondrian partitioning ( Roy et al. , 2008 ) with a set of additional constraints on the rectangles . Existing research has applied Mondrian kernels for generating features Balog et al . ( 2016 ) , and has also generalized Mondrian partitions for higher than 2 dimensions LeFevre et al . ( 2006 ) . Specifically , constraints in Mondrian tiling correspond to the following . • The rectangular tiles are pairwise non-congruent , i.e. , each rectangle must have a different dimension ( widths and height values ) , e.g. , a 2x8 rectangle can only be used only once . Note that this constraint does not prevent the use of another rectangle with a different dimension but identical , e.g. , a 4x4 rectangle can be used in combination with a 2x8 one . • The difference in the area of the largest and the smallest tiles is to be minimized . This difference is known as the score of the tiling . While the first constraint ensures that there exist no parts in the overall computational graph with duplicate dimensions , the second one prevents solutions that employ too large or too small image regions . The implication of the former is that it is difficult for an adversarial attack to expose a vulnerable sub-network more than once ( thus increasing the overall vulnerability ) , while the implication of the latter is that the individual feature representations of the tiles adequately represent meaningful parts of the overall image . In our experiments , we find that 2D tessellated convolutional networks ( 2D-TCNNs ) are more robust to well known attacks as compared to standard networks . Moreover , among the three different tiling approaches explored , a Mondrian tiling based 2D-TCNN leads to more robust results against adversarial attacks . 2 TESSELLATED CONVOLUTIONAL NETWORK . In this section , we describe our proposed method of Tessellated Convolutional Network ( TCNN ) . We specifically focus on the 2D convolutional networks . Figure 1 presents the idea of a TCNN . An input image is first partitioned into non-overlapping rectangular tiles using a tessellation scheme . Parallel branches of convolution and pooling layers of the tiled CNN then process each input segment . The convolution and pooling layers in each branch terminates in a dense layer of parameters leading to a feature representation of a part of the overall image corresponding to that tile . The output from these dense layers , each representing an abstract representation of a rectangular region of an image , are then concatenated in the merge layer and processed through yet another dense layer . The output layer is a softmax that is finally used to predict the discrete class label . We use three tessellation schemes , namely , regular ( or uniform ) , non-regular ( or non-uniform ) , and Mondrian . Details of these partitions are presented next . The main focus of our paper is investigate if the divide-and-conquer based approach of a tessellated network can lead to more robust defences against adversarial threats . For simplicity , we thus restrict our investigation to simple 2D convolution networks , instead of experimenting with more complex ( in terms of depth and width ) networks , e.g . ImageNet ( Szegedy et al. , 2015 ) or networks that use more involved connections between layers , e.g . the ResNet ( He et al. , 2016 ) . However , our proposed divide-and-conquer based approach is generic enough to be applied on more complex computation graphs such as those of ImageNet or ResNet , which we leave as future work . 2.1 TESSELLATION METHODS . A tessellation of an d× d square image is a complete tiling of the image with non-overlapping tiles . Although the concept of tessellation can , in general , involve ( even non-convex ) polygons , the tiles , with which we cover an input image always refers to rectangles in the context of our problem . A parameter to the tessellation process is the number of mutually disjoint rectangles used . Formally , each input x ∈ Rd×d is partitioned into k sub-instances xi such that ∪ixi = x . To uniquely specify a tessellation of an input instance x ∈ Rd×d , each tile xi ∈ Rhi×wi of width wi and height hi is associated with a location , as specified by the row and column index of its top-left location , i.e. , p ( xi ) = ( ri , ci ) such that 1 ≤ ri ≤ d− hi and 1 ≤ ci ≤ d− wi . Each tiling method , that we investigate , generates a list of such rectangular tiles . 2.1.1 REGULAR TESSELLATION . The simplest tessellation that we investigate is the uniform one , where each tile is a square . The parameter k for regular rectangular tessellation controls the number of squares used to cover x ∈ Rd×d , and is a perfect square , i.e. , k = m2 for some m ∈ Z . 2.1.2 APERIODIC TESSELLATION . In non-uniform tessellation , an input image of size d× d is split into rectangular blocks of arbitrary sizes with a low likelihood that any two rectangles will be of equal area . We employ a recursive split and merge approach to generate a non-uniform tessellation . At each step we employ either a split or a merge operation depending on whether m ( the present number of tiles ) is higher than or lower than k ( the desired number of tiles ) . If m < l , we randomly select a rectangle and split it into two parts . The position of the splitting line and its direction ( horizontal or vertical ) is chosen randomly . The split operation always leads to increasing the total number of tiles by 1 ( see Figure 2b for an illustrative example ) . Otherwise , if m > l , we merge a rectangle with other rectangles that are adjacent to it with respect to a direction ( one of top , right , bottom or left ) . Figure 2c illustrates an example of merging a tile with the ones that are right-adjacent to it . The merge operation mostly leads to increasing the number of tiles . We carry out a sequence of random split and merge operations on randomly selected tiles ( sampled with uniform probability ) unless the desired number of tiles ( the parameter k ) is reached . After every split or merge operation , we employ a post-hoc step which checks if any of the tiles is too small or too large ( specifically , area less than 52 or greater than ( 3/4d ) 2 ) . If the split or merge operation generates a rectangle whose area is either less than or higher than the two thresholds , then the step is undone . It is also possible to generate non-uniform tessellations with other policies as well , e.g. , with the use of Bayesian non-parametric space partition methods as surveyed in ( Fan et al. , 2021 ) .

Summary: This paper studies defense against adversarial attacks. In particular, the proposal is to partition the image into non-overlapping sub-rectangles, run a separate CNN on each, and finally merge to generate the prediction. The defense effectiveness is evaluated on MNIST and CIFAR-10.