Shape Defense

1 INTRODUCTION . Deep neural networks ( LeCun et al. , 2015 ) remain the state of the art across many areas and are employed in a wide range of applications . They also provide the leading model of biological neural networks , especially in visual processing ( Kriegeskorte , 2015 ) . Despite the unprecedented success , however , they can be easily fooled by adding carefully-crafted imperceptible noise to normal inputs ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) . This poses serious threats in using them in safety- and security-critical domains . Intensive efforts are ongoing to remedy this problem . Our primary goal here is to learn robust models for visual recognition inspired by two observations . First , object shape remains largely invariant to imperceptible adversarial perturbations ( Fig . 1 ) . Shape is a sign of an object and plays a vital role in recognition ( Biederman , 1987 ) . We rely heavily on edges and object boundaries , whereas CNNs emphasize more on texture ( Geirhos et al. , 2018 ) . Second , unlike CNNs , we recognize objects one at a time through attention and background subtraction ( e.g. , Itti & Koch ( 2001 ) ) . These may explain why adversarial examples are perplexing . The convolution operation in CNNs is biased towards capturing texture since the number of pixels constituting texture far exceeds the number of pixels that fall on the object boundary . This in turn provides a big opportunity for adversarial image manipulation . Some attempts have been made to emphasize more on edges , for example by utilizing normalization layers ( e.g. , contrast and divisive normalization ( Krizhevsky et al. , 2012 ) ) . Such attempts , however , have not been fully investigated for adversarial defense . Overall , how shape and texture should be reconciled in CNNs continues to be an open question . Here we propose two solutions that can be easily implemented and integrated in existing defenses . We also investigate possible adaptive attacks against them . Extensive experiments across ten datasets , over which shape and texture have different relative importance , demonstrate the effectiveness of our solutions against strong attacks . Our first method performs adversarial training on edge-augmented inputs . The second method uses a conditional GAN ( Isola et al. , 2017 ) to translate edge maps to clean images , essentially finding a perturbation-invariant transformation . There is no need for adversarial training ( and hence less computation ) in this method . Further , and perhaps less surprising , we find that incorporating edges also makes CNNs more robust to natural images corruptions and backdoor attacks . The versatility and effectiveness of these approaches , without significant parameter tuning , is very promising . Ultimately , our study shows that shape is the key to build robust models and opens a new direction for future research in adversarial robustness . 2 RELATED WORK . Here , we provide a brief overview of the closely related research with an emphasis on adversarial defenses . For detailed comments on this topic , please refer to Akhtar & Mian ( 2018 ) . Adversarial attacks . The goal of the adversary is to craft an adversarial input x̃ ∈ Rd by adding an imperceptible perturbation to the ( legitimate ) input x ∈ Rd ( here in the range [ 0,1 ] ) , i.e. , x̃ = x + . Here , we consider two attacks based on the ` ∞-norm of , the Fast Gradient Sign Method ( FGSM ) ( Goodfellow et al. , 2015 ) , as well as the Projected Gradient Descent ( PGD ) method ( Madry et al. , 2017 ) . Both white-box and black-box attacks in the untargeted condition are considered . Deep models are also susceptible to image transformations other than adversarial attacks ( e.g. , noise , blur ) , as is shown in Hendrycks & Dietterich ( 2019 ) and Azulay & Weiss ( 2018 ) . Adversarial defenses . Recently , there has been a surge of methods to mitigate the threat from adversarial attacks either by making models robust to perturbations or by detecting and rejecting malicious inputs . A popular defense is adversarial training in which a network is trained on adversarial examples ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ) . In particular , adversarial training with a PGD adversary remains empirically robust to this day ( Athalye et al. , 2018 ) . Drawbacks of adversarial training include impacting clean performance , being computationally expensive , and overfitting to the attacks it is trained on . Some defenses , such as Feature Squeezing ( Xu et al. , 2017 ) , Feature Denoising ( Xie et al. , 2019 ) , PixelDefend ( Song et al. , 2017 ) , JPEG Compression ( Dziugaite et al. , 2016 ) and Input Transformation ( Guo et al. , 2017 ) , attempt to purify the maliciously perturbed images by transforming them back towards the distribution seen during training . MagNet ( Meng & Chen , 2017 ) trains a reformer network ( one or multiple auto-encoders ) to move the adversarial image closer to the manifold of legitimate images . Likewise , Defense-GAN ( Samangouei et al. , 2018 ) uses GANs ( Goodfellow et al. , 2014 ) to project samples onto the manifold of the generator before classifying them . A similar approach based on Variational AutoEncoders ( VAE ) is proposed in Li & Ji ( 2019 ) . Unlike these works which are based on texture ( and hence are fragile ( Athalye et al. , 2018 ) ) , our GAN-based defense is built upon edge maps . Some defenses are inspired by biology ( e.g. , Dapello et al . ( 2020 ) , Li et al . ( 2019 ) , Strisciuglio et al . ( 2020 ) , Reddy et al . ( 2020 ) ) . Shape vs. texture . Geirhos et al . ( 2018 ) discovered that CNNs routinely latch on to the object texture , whereas humans pay more attention to shape . When presented with stimuli with conflicting cues ( e.g. , a cat shape with elephant skin texture ; Appx . A ) , human subjects correctly labeled them based on their shape . In sharp contrast , predictions made by CNNs were mostly based on the texture ( See also Hermann & Kornblith ( 2019 ) ) . Similar results are also reported by Baker et al . ( 2018 ) . Hermann et al . ( 2020 ) studied the factors that produce texture bias in CNNs and learned that data augmentation plays a significant role to mitigate texture bias . Xiao et al . ( 2019 ) , in parallel to our work , have also proposed methods to utilize shape for adversarial defense . They perform classification on the edge map rather than the image itself . This is a baseline method against which we compare our algorithms . Similar to us , they also use GANs to purify the input image . Algorithm 1 Edge-guided adversarial training ( EAT ) for T epochs , perturbation budget , and loss balance ratio α , over a dataset of size M for a network fθ ( performed in minibatches in practice ) . β ∈ { edge , img , imgedge } indicates network type and redetect train means edge redetection during training . for t = 1 . . . T do for i = 1 . . .M do // launch adversarial attack ( here FGSM and PGD attacks ) x̃i = clip ( xi + sign ( ∇x ` ( fθ ( xi ) , yi ) ) ) if β == imgedge & redetect train then x̃i = detect edge ( x̃i ) // recompute and replace the edge map end if ` = α ` ( fθ ( xi ) , yi ) + ( 1− α ) ` ( fθ ( x̃i ) , yi ) // here α = 0.5 θ = θ −∇θ ` // update model weights with some optimizer , e.g. , Adam end for end for Algorithm 2 GAN-based shape defense ( GSD ) // Training 1 . Create a dataset of images X = { xi , yi } i=1···N including clean and/or perturbed images 2 . Extract edge maps ( ei ) for all images in the dataset 3 . Train a conditional GAN pg ( x|e ) to map edge image e to clean image x // here pix2pix 4 . Train a classifier pc ( y|x ) to map generated image x to class label y // Inference 1 . For input image x , clean or perturbed , first compute the edge image e 2 . Then , compute pc ( y|x′ ) where x′ is the generated image corresponding to e 3 PROPOSED METHODS . Edge-guided Adversarial Training ( EAT ) . The intuition here is that the edge map retains the structure in the image and helps disambiguate the classification ( See Fig . 1 ) . In its simplest form ( Fig . 7 ( A ) in Appx . A ; Alg . 1 ) , adversarial training is performed over the 2D ( Gray+Edge ) or 4D ( RGB+Edge ) input ( i.e. , number of channels ; denoted as Img+Edge ) . In a slightly more complicated form ( Fig . 7 ( B ) ) , first , for each input ( clean or adversarial ) , the old edge map is replaced with the newly extracted one . The edge map can be computed from the average of only image channels or all available channels ( i.e. , image plus edge ) . The latter can sometimes improve the results , since the old edge map ( although perturbed ; Fig . 10 and Appx . B ) still contains unaltered shape structures . Then , adversarial training is performed over the new input . The reason behind adversarial training with redetected edges is to expose the network to possible image structure damage . The loss for training is a weighted combination of loss over clean images and loss over adversarial images . At inference time , first , the edge map is computed and then classification is done over the edge-augmented input . As a baseline model , we also consider first detecting the input ’ s edge map and then feeding it to the model trained on the edges for classification . We refer to this model as Img2Edge . GAN-based Shape Defense ( GSD ) . Here , first , a conditional GAN is trained to map the edge image , from clean or adversarial images , to its corresponding clean image ( Alg . 2 ) . Any image translation method ( here pix2pix by Isola et al . ( 2017 ) using this code1 ) can be employed for this purpose . Next , a CNN is trained over the generated images . At inference time , first , the edge map is computed and then classification is done over the generated image for this edge image . The intuition is that the edge map remains nearly the same over small perturbation budgets ( See Appx . A ) . Notice that conditional GAN can also be trained on perturbed images ( similar to Samangouei et al . ( 2018 ) and Li & Ji ( 2019 ) or edge-augmented perturbed images ( similar to above ) . 4 EXPERIMENTS AND RESULTS . 4.1 DATASETS AND MODELS . Experiments are spread across 10 datasets covering a variety of stimulus types . Sample images from datasets are given in Fig . 2 . Models are trained with cross-entropy loss and Adam optimizer ( Kingma 1https : //github.com/mrzhu-cool/pix2pix-pytorch & Ba , 2014 ) with a batch size of 100 , for 20 epochs over MNIST and FashionMNIST , 30 over DogVsCat , and 10 over the remaining . Canny method ( Canny , 1986 ) is used for edge detection over all datasets , except DogBreeds for which Sobel is used . Edge detection parameters are separately adjusted for each dataset . We did not carry out an exhaustive hyperparameter search , since we are interested in additional benefits edges may bring rather than training the best possible models . The first two datasets include MNIST ( LeCun et al. , 1998 ) and FashionMNIST ( Xiao et al. , 2017 ) . A CNN with 2 convolution , 2 pooling , and 2 fc layers is trained . Each of these datasets contains 60K training images ( resolution 28×28 ) and 6K test images over 10 classes . The third dataset , DogVsCat2 contains 18,085 training and 8,204 test images . Images in this dataset are of varying dimensions . They are resized here to 150×150 pixels to save computation . A CNN with 4 convolution , 4 pooling , and 2 fc layers is trained from scratch . Over the remaining datasets , we finetune a pre-trained ResNet18 ( He et al. , 2016 ) , trained over ImageNet ( Deng et al. , 2009 ) , and normalize images using ImageNet mean and standard deviation . The fourth dataset , CIFAR10 ( Krizhevsky , 2009 ) , con- tains 50K training and 10K test images with a resolution of 32×32 which are resized here to 64×64 for better edge detection . The fifth dataset is DogBreeds ( see footnote ) . It contains 1,421 training and 356 test images at resolution 224×224 over 16 classes . The sixth dataset is GTSRB ( Stallkamp et al. , 2012 ) and includes 39,209 and 1,2631 training and test images , respectively , over 43 classes ( resolution 64×64 pixels ) . The seventh dataset , Icons-50 , includes 6,975 training and 3,025 test images over 50 classes ( Hendrycks & Dietterich , 2019 ) . The original image size is 120×120 which is resized to 64×64 . The eighth dataset , Sketch , contains 14K training and 6K test images over 250 classes . Images have size 1111×1111 and are resized to 64×64 in experiments ( Eitz et al. , 2012 ) . The ninth and tenth datasets are derived from ImageNet3 . The Imagenette2-160 dataset has 3,925 training and 9,469 test images ( resolution 160×160 ) over 10 classes ( tench , English springer , cassette player , chain saw , church , French horn , garbage truck , gas pump , golf ball , and parachute ) . The Tiny Imagenet dataset has 100K training images ( resolution 64× 64 ) and 10K validation images ( used here as the test set ) over 200 classes . For attacks , we use https : //github.com/Harry24k/adversarial-attacks-pytorch , except Boundary attack for which we use https : //github.com/bethgelab/foolbox .

Summary: This paper investigates incorporating shape information in deep neural networks to improve their adversarial robustness. It proposes two methods: the first one is to augment the input with the corresponding edge and then adversarially train a CNN on the augmented input. The second idea is to train a conditional GAN to reconstruct images from edge maps and use the reconstructed image as input to a standard classifier.