Tessellated 2D Convolution Networks: A Robust Defence against Adversarial Attacks

1 INTRODUCTION . Deep neural networks are known to be susceptible to adversarial attacks . Image representations learned by a deep neural network differ from their visual interpretation . Attackers exploit this fact by introducing imperceptible evasive perturbation in a set of test images such that the victim network misclassifies them ( Joseph et al. , 2019 ) . Defending neural networks against such adversarial attacks is of significant theoretical and practical importance . Major approaches to defence against such adversarial threats include adversarial training ( Madry et al. , 2018 ) , network distillation ( Papernot et al. , 2016 ) , input randomization ( Xie et al. , 2018 ) , activation pruning ( Dhillon et al. , 2018 ) , gradient masking ( Goodfellow , 2018 ) , input transformation ( AprilPyone & Kiya , 2020 ) , and ensemble methods ( Tramèr et al. , 2017 ) to name a few . Architectural changes in the network topology is a promising means of achieving adversarial robustness . Well known evasive attacks include the gradient based input perturbation strategies such as fast gradient sign method ( FGSM ) ( Goodfellow et al. , 2015 ) , and the projected gradient descent ( PGD ) ( Madry et al. , 2018 ) methodologies . Universal attacks that are image-agnostic and add the same perturbation for all input images while still modifying the class labels are also prevalent ( MoosaviDezfooli et al. , 2017 ) . Norm based attacks seeking to optimize the perturbation were subsequently proposed to victimize newer defence strategies ( Carlini & Wagner , 2017 ; Croce & Hein , 2019 ) . Patch attacks , which involve perturbing image segments rather than the image pixels , have also been attempted Sharif et al . ( 2016 ) . More recent attacking approaches include the use of ensemblingbased strategies with a capability to adapt on the defence mechanisms employed ( Tramèr et al. , 2020 ) . Depending on the amount of information exposed to an attacker , an attack corresponds to one of the two types , namely i ) black-box attack , those with little or no knowledge about the target model , and ii ) white-box attack , where additional information about the network is available ( e.g. , in the form of architecture , optimization function used , model parameters etc. ) . A black-box attack often involves substituting the victim network by a proxy network , constructed with the help of a small number of interactions with an oracle ( Papernot et al. , 2016 ) . In between the two extremes of the black-box and white-box variants lies the gray-box attack , where the parameter values of a trained model are not available to an attacker ; however , other information about the model ( e.g. , architecture details and optimization/activation functions ) are available ( Vivek et al. , 2018 ) . It has been reported that attacks methods can usually be effectively transferred to similar networks in a gray-box threat scenario . Numerous other threat scenarios like transfer-based , score-based , and decision-based black-box attacks are known in the literature ( Ren et al. , 2020 ; Dong et al. , 2020 ) . As newer attacks are being developed , designing networks that are robust to adversarial attacks has been an ongoing game . Among the most popular defence mechanisms are the ones that are based on adversarial training using the samples generated by attacks such as FGSM Goodfellow et al . ( 2015 ) and PGD Madry et al . ( 2018 ) or their ensemble ( Tramèr et al. , 2017 ) . State-of-the-art defences as reported in the RobustBench ( Croce et al. , 2020 ) benchmark dataset include those based on data augmentation for adversarial training ( Rebuffi et al. , 2021 ) , as well as those that are based on transformation or randomization of model parameters ( Gowal et al. , 2021 ) . Various randomized image transformation schemes such as cropping , padding , compression , block segmentation , noise addition to convolution layer features demonstrate adversarial robustness ( Xie et al. , 2017 ; Liu et al. , 2018 ; AprilPyone & Kiya , 2020 ) . Input rectification schemes attempts to remove adversarial perturbations by denoising , image blurring and depth reduction Xu et al . ( 2017 ) . Transformation of the features at the output of the convolution layers like activation pruning ( Goodfellow , 2018 ) , denoising , are often equally effective Dhillon et al . ( 2018 ) ; Liao et al . ( 2018 ) . Regularization and dropout are recently being used for achieving adversarial robustness ( Wang et al. , 2018 ; B.S . & Babu , 2020 ; Jordão & Pedrini , 2021 ) . A study on the effect of regularization and sparsity with respect to the adversarial robustness of a network can be found in ( Schwartz et al. , 2020 ; Pang et al. , 2020 ) . Generating diverse structured networks as a tool for robustness has been proposed in ( Du et al. , 2021 ; Pang et al. , 2019 ) . An alternative convolutional network ( CNN ) architecture which randomly masks parts of the feature maps also demonstrates adversarial robustness ( Luo et al. , 2020 ) . Architectural robustness provides an attractive defense mechanism that is agnostic to attack strategies . As a motivation of the work in this paper , we hypothesize that modification of the network structure leading to implicit feature transformation , cropping , masking , and distillation may result in improved robustness against adversarial attacks in an attacking method agnostic manner . Incorporation of diversity in network topology may also act as an effective defence against ensemble attacks . Consequently , reconfiguring the topology of a network may provide effective defence against adaptive adversarial attacks . In this paper , we propose two dimensional tessellated convolutional networks ( TCNN ) that incorporates the effects of cropping , masking and feature transformation within a single framework . In our approach , an input image is partitioned into blocks ( tiles ) according to a tessellation ( tiling ) pattern . Each region of the input image makes use of a separate branch in the computation graph to propagate its effects forward in the form of feature representations . The individual feature representations then interact with each other for the eventual prediction of an image class ( see Figure 1 for a schematic representation ) . We investigate the use of three types of rectangular tessellation patterns , namely , regular grid tiling , tiling with non-uniform rectangles , and Mondrian partitioning ( Roy et al. , 2008 ) with a set of additional constraints on the rectangles . Existing research has applied Mondrian kernels for generating features Balog et al . ( 2016 ) , and has also generalized Mondrian partitions for higher than 2 dimensions LeFevre et al . ( 2006 ) . Specifically , constraints in Mondrian tiling correspond to the following . • The rectangular tiles are pairwise non-congruent , i.e. , each rectangle must have a different dimension ( widths and height values ) , e.g. , a 2x8 rectangle can only be used only once . Note that this constraint does not prevent the use of another rectangle with a different dimension but identical , e.g. , a 4x4 rectangle can be used in combination with a 2x8 one . • The difference in the area of the largest and the smallest tiles is to be minimized . This difference is known as the score of the tiling . While the first constraint ensures that there exist no parts in the overall computational graph with duplicate dimensions , the second one prevents solutions that employ too large or too small image regions . The implication of the former is that it is difficult for an adversarial attack to expose a vulnerable sub-network more than once ( thus increasing the overall vulnerability ) , while the implication of the latter is that the individual feature representations of the tiles adequately represent meaningful parts of the overall image . In our experiments , we find that 2D tessellated convolutional networks ( 2D-TCNNs ) are more robust to well known attacks as compared to standard networks . Moreover , among the three different tiling approaches explored , a Mondrian tiling based 2D-TCNN leads to more robust results against adversarial attacks . 2 TESSELLATED CONVOLUTIONAL NETWORK . In this section , we describe our proposed method of Tessellated Convolutional Network ( TCNN ) . We specifically focus on the 2D convolutional networks . Figure 1 presents the idea of a TCNN . An input image is first partitioned into non-overlapping rectangular tiles using a tessellation scheme . Parallel branches of convolution and pooling layers of the tiled CNN then process each input segment . The convolution and pooling layers in each branch terminates in a dense layer of parameters leading to a feature representation of a part of the overall image corresponding to that tile . The output from these dense layers , each representing an abstract representation of a rectangular region of an image , are then concatenated in the merge layer and processed through yet another dense layer . The output layer is a softmax that is finally used to predict the discrete class label . We use three tessellation schemes , namely , regular ( or uniform ) , non-regular ( or non-uniform ) , and Mondrian . Details of these partitions are presented next . The main focus of our paper is investigate if the divide-and-conquer based approach of a tessellated network can lead to more robust defences against adversarial threats . For simplicity , we thus restrict our investigation to simple 2D convolution networks , instead of experimenting with more complex ( in terms of depth and width ) networks , e.g . ImageNet ( Szegedy et al. , 2015 ) or networks that use more involved connections between layers , e.g . the ResNet ( He et al. , 2016 ) . However , our proposed divide-and-conquer based approach is generic enough to be applied on more complex computation graphs such as those of ImageNet or ResNet , which we leave as future work . 2.1 TESSELLATION METHODS . A tessellation of an d× d square image is a complete tiling of the image with non-overlapping tiles . Although the concept of tessellation can , in general , involve ( even non-convex ) polygons , the tiles , with which we cover an input image always refers to rectangles in the context of our problem . A parameter to the tessellation process is the number of mutually disjoint rectangles used . Formally , each input x ∈ Rd×d is partitioned into k sub-instances xi such that ∪ixi = x . To uniquely specify a tessellation of an input instance x ∈ Rd×d , each tile xi ∈ Rhi×wi of width wi and height hi is associated with a location , as specified by the row and column index of its top-left location , i.e. , p ( xi ) = ( ri , ci ) such that 1 ≤ ri ≤ d− hi and 1 ≤ ci ≤ d− wi . Each tiling method , that we investigate , generates a list of such rectangular tiles . 2.1.1 REGULAR TESSELLATION . The simplest tessellation that we investigate is the uniform one , where each tile is a square . The parameter k for regular rectangular tessellation controls the number of squares used to cover x ∈ Rd×d , and is a perfect square , i.e. , k = m2 for some m ∈ Z . 2.1.2 APERIODIC TESSELLATION . In non-uniform tessellation , an input image of size d× d is split into rectangular blocks of arbitrary sizes with a low likelihood that any two rectangles will be of equal area . We employ a recursive split and merge approach to generate a non-uniform tessellation . At each step we employ either a split or a merge operation depending on whether m ( the present number of tiles ) is higher than or lower than k ( the desired number of tiles ) . If m < l , we randomly select a rectangle and split it into two parts . The position of the splitting line and its direction ( horizontal or vertical ) is chosen randomly . The split operation always leads to increasing the total number of tiles by 1 ( see Figure 2b for an illustrative example ) . Otherwise , if m > l , we merge a rectangle with other rectangles that are adjacent to it with respect to a direction ( one of top , right , bottom or left ) . Figure 2c illustrates an example of merging a tile with the ones that are right-adjacent to it . The merge operation mostly leads to increasing the number of tiles . We carry out a sequence of random split and merge operations on randomly selected tiles ( sampled with uniform probability ) unless the desired number of tiles ( the parameter k ) is reached . After every split or merge operation , we employ a post-hoc step which checks if any of the tiles is too small or too large ( specifically , area less than 52 or greater than ( 3/4d ) 2 ) . If the split or merge operation generates a rectangle whose area is either less than or higher than the two thresholds , then the step is undone . It is also possible to generate non-uniform tessellations with other policies as well , e.g. , with the use of Bayesian non-parametric space partition methods as surveyed in ( Fan et al. , 2021 ) .

Summary: This paper presents a tessellated convolution network that is more robust to adversarial attacks. In the paper, authors proposed three different ways of tiling. Experiments show this method is more robust to FGSM and PGD for classification tasks on fashion MNIST and CIFAR10.