Training-Free Robust Multimodal Learning via Sample-Wise Jacobian Regularization

1 INTRODUCTION . Deep fusion models have recently drawn great attention of researchers in the context of multimodal learning ( Vielzeuf et al. , 2018 ; Baltrušaitis et al. , 2018 ; Pérez-Rúa et al. , 2019 ; Wang et al. , 2020 ; Xue et al. , 2021 ) as it provides an easy way to increase model accuracy and robustness . For instance , RGB cameras and LiDARs are usually deployed simultaneously on an autonomous vehicle , and the resulting RGB images and point clouds are referred to as two modalities , respectively . When RGB images are blurry at night , point clouds could provide complementary information and help to make decisions in vision tasks ( Kim & Ghosh , 2019 ) . Over the past few years , numerous multimodal fusion methods have been proposed at different levels : early- , middle- , and late-fusion ( Chen et al. , 2021 ) . In early-fusion , input feature vectors from different modalities are concatenated and fed into one single deep neural network ( DNN ) , while in middle-fusion , they go into DNNs independently and exchange information in feature space . Unlike the previous two cases , late-fusion is realized by merging distinct DNNs at their output layers via concatenation , element-wise summation , etc . These three levels of fusion possess different pros and cons . For instance , late-fusion , the primary concern of our paper , is ( i ) privacy-friendly and ( ii ) convenient to deploy . Specifically , assume that a hospital wants to have an AI agent to judge whether a patient has a certain disease or not ( Sun et al. , 2020 ) . It has to divide the complete training feature ( e.g. , medical records , X-ray images ) of every patient and deliver them to different AI companies , otherwise , the patients ’ identities will be exposed and their privacy are unprotected . This , in turn , directly rules out the possibility of applying early- or middle-fusion methods . On the other hand , the hospital could still exploit latefusion technique to generate the ultimate AI agent after several unimodal DNNs are trained by AI companies . Moreover , unlike early- or middle-fusion , many late-fusion methods could tolerate missing modality information ( i.e. , no need for paired data ) and thus are convenient to deploy . Although late-fusion is a mature topic in the literature , its performance under adversarial attacks ( Madry et al. , 2018 ; Tsipras et al. , 2019 ) and random corruptions ( Zheng et al. , 2016 ; Kim & Ghosh , 2019 ) is rather under-explored . In this paper , we address the problem of robust late-fusion by utilizing Jacobian regularization ( Varga et al. , 2017 ; Jakubovitz & Giryes , 2018 ; Hoffman et al. , 2019 ; Chan et al. , 2019 ) and conditional independence assumption ( Sun et al. , 2020 ) . The key is to minimize the Frobenius norm of a Jacobian matrix so that the multimodal prediction is stabilized ( see Figure 1 ) . Our main contributions are as follows : • To the best of our knowledge , we are the first to propose a training-free robust late-fusion method . The involving optimization problem is relaxed to a Sylvester equation ( Jameson , 1968 ) , and the solution is obtained with only a little computational overhead . • We provide a theoretical error bound of our proposed robust late-fusion method and an illustrative explanation about the function of the extra modality via the TwoMoon example . • Thorough numerical experiments demonstrate that our method outperforms other latefusion methods and is capable to handle both adversarial attacks and random corruptions . 2 PRELIMINARY . Network Robustness To verify the network robustness , two major kinds of perturbations are used , which in our paper we referred to as ( i ) adversarial attacks such as FGSM , PGD , or CW attack ( Goodfellow et al. , 2014 ; Madry et al. , 2018 ; Carlini & Wagner , 2017 ) and ( ii ) random corruptions such as Gaussian noise , missing entries or illumination change ( Zheng et al. , 2016 ; Kim & Ghosh , 2019 ) . Correspondingly , many methods have been proposed to offset the negative effects of such perturbations . Adversarial training based on projected gradient descent ( Madry et al. , 2018 ) is one strong mechanism to defend against adversarial attacks , and the recent Free-m method ( Shafahi et al. , 2019 ) is proposed as its fast variant . Besides adversarial training , several regularization techniques are also proven to have such capability , such as Mixup ( Zhang et al. , 2020 ) , Jacobian regularization ( Jakubovitz & Giryes , 2018 ) . Alternatively , with regard to random corruptions , Mixup and Jacobian regularization are also effective in this case ( Zhang et al. , 2018 ; Hoffman et al. , 2019 ) . Another powerful approach is stability training ( Zheng et al. , 2016 ) , where it introduces an additional KL divergence term into the conventional classification loss so that the trained DNNs are stabilized . Multimodal Learning DNNs trained by fusing data from different modalities have outperformed their unimodal counterparts in various applications , such as object detection ( Chen et al. , 2021 ; Kim & Ghosh , 2019 ) , semantic segmentation ( Chen et al. , 2020b ; Feng et al. , 2020 ) , audio recognition ( Gemmeke et al. , 2017 ; Chen et al. , 2020a ) . Based on where the information is exchanged between different modalities , multimodal fusion methods could be classified into three kinds : ( i ) early-fusion ( Wagner et al. , 2016 ; Chen et al. , 2021 ) , ( ii ) middle-fusion ( Kim & Ghosh , 2019 ; Wang et al. , 2020 ) , and ( iii ) late-fusion ( Chen et al. , 2021 ; Liu et al. , 2021 ) . For instance , if the information is fused at the end of DNNs ( e.g. , Figure 1 ) , such a method belongs to the late-fusion category . Although vast efforts have been put into exploiting multimodal fusion methods to improve DNNs ’ accuracy on specific learning tasks , few works have explored network robustness in the multimodal context . Specifically , Mees et al . ( 2016 ) , Valada et al . ( 2017 ) , and Kim et al . ( 2018 ) exploited gating networks to deal with random corruptions , adverse or changing environments . Afterwards , Kim & Ghosh ( 2019 ) proposed a surrogate minimization scheme and a latent ensemble layer to handle single-source corruptions . However , all the aforementioned methods belong to middle-fusion and only random corruptions are considered . On the other hand , we focus on another important scenario : late-fusion , and besides corruptions , we further take adversarial attacks into account . To the best of our knowledge , robust late-fusion is un-explored in the previous literature . 3 JACOBIAN REGULARIZATION IN TEST TIME . Consider a supervised K-class classification problem in the multimodal context . Suppose that features from two distinct modalities A ( e.g. , audio ) and B ( e.g. , video ) are provided in the form of DA = { ( xiA , yi ) } Ni=1 and DB = { ( xiB , yi ) } Ni=1 , where { xA , xB } represents input features and y represents the true label . We train two unimodal networks separately , each corresponding to one modality . Given a specific input feature xA , the first unimodal network calculate the class prediction pA ∈ RK by : pA = σ1 ( zA ) = σ1 ( WAhA + bA ) = σ1 ( WAfA ( xA ) + bA ) ( 1 ) where σ1 ( · ) represents the Softmax function , zA ∈ RK represents the raw logit , and hA = fA ( xA ) ∈ RH represents the feature being fed into the last layer 1 . Here WA ∈ RK×H and bA ∈ RK are the learnable weight and bias of the last linear layer , respectively . Similarly , the second unimodal network provides the class prediction pB = σ1 ( zB ) = σ1 ( WBhB + bB ) = σ1 ( WBfB ( xB ) + bB ) . Based on the conditional independence assumption ( Kong & Schoenebeck , 2018 ) , the basic statistical late-fusion method generates the final class prediction as ( Chen et al. , 2021 ) : p = σ2 ( pA pB freq ) = σ2 ( σ1 ( zA ) σ1 ( zB ) freq ) ( 2 ) where the division is performed in an element-wise manner , represents the element-wise product , and σ2 ( · ) represents a linear normalization enforcing the summation of elements equal to one . Here freq ∈ RK contains the occurring frequencies of each class , calculated from the training dataset . Our proposed approach builds upon ( 2 ) . Specifically , we consider adding twoK×K weight matrices { Wa , Wb } ahead of { zA , zB } , respectively , right before they get activated . Consequently , the final multimodal prediction is re-calibrated as : p′ = σ2 ( σ1 ( z ′ A ) σ1 ( z′B ) freq ) = σ2 ( σ1 ( WazA ) σ1 ( WbzB ) freq ) ( 3 ) Suppose that the data provided from modality A are perturbed at the input or feature level , while the data from modality B are clean . For matrix Wb , we could simply set it to an identity matrix , implying that we didn ’ t invoke the robust add-on for the second modality . To determine the value of Wa , we first calculate the derivative of p′ with respect to hA ( see Appendix A.1 ) : ∂p′ ∂hA = J′WaWA = [ p ′p′ , T − Diag ( p′ ) ] WaWA ( 4 ) Then we minimize the following regularized Jacobian loss with respect to Wa : min Wa L = min Wa ( 1− γ ) ||J′WaWA||2F + γ||Wa − I||2F ( 5 ) where 0 < γ < 1 is a tunable hyper-parameter . Minimizing the first term in the loss could make the change of p′ limited to some extent when hA is perturbed , while the second term in the loss guarantees numerical stability and the prediction in the perturbed case won ’ t get too far from that of the clean case . For a specific multimodal input { xA , xB } , once Wa is determined , so are p′ and J′ via ( 3 ) and ( 4 ) , respectively . Thus , ( 5 ) is well-determined and non-linear with respect to Wa . We propose a heuristic iterative method making the above optimization problem tractable in Algorithm 1 . Our key is to decouple J′ from Wa . Namely , in step 5 of Algorithm 1 , all terms are known except Wa , and thus the relaxed loss is convex . After writing out all terms of ∂L ( t ) /∂Wa , we observe that it is a Sylvester equation ( Jameson , 1968 ) . It has a unique solution and the run time is as large as inverting a K ×K matrix and hence affordable . See Appendix A.2 for details . Remarks First , in our implementation we find that one iteration could already yield a sufficiently accurate result , thus all our numerical results are reported with tmax = 1 ( i.e. , p′ = p ( 1 ) ) . Second , if we know data from modality B are also perturbed , we could solve Wb in a similar manner . Third , 1 ( 1 ) holds because the last layer is usually implemented as a fully connected ( FC ) layer with Softmax activation in classification tasks . Algorithm 1 Iteratively solving regularized Jacobian loss 1 : Given one specific input { xA , xB } . Initialize iteration index t = 0 . 2 : Perform one forward pass , yielding the initial class prediction p ( 0 ) . 3 : while t < tmax do 4 : Calculate J ( t ) = p ( t ) p ( t ) , T − Diag ( p ( t ) ) . 5 : Minimize L ( t ) = ( 1− γ ) ||J ( t ) WaWA||2F + γ||Wa − I||2F with respect to Wa . 6 : Calculate p ( t+1 ) based on Eq ( 3 ) with the optimal Wa . 7 : Update t = t+ 1 . 8 : end while 9 : Return p′ = p ( t ) . notice that our approach is invoked merely during inference ( i.e. , test time ) , but not the train time . Furthermore , we demonstrate our approach in the context of two modalities , while obviously , it could be equally applied to many modalities . Finally , with a moderate assumption , we can further prove that when the input is perturbed , the change of final prediction enhanced by our method is limited to a certain amount . This has been summarized in Theorem 1 ( see Appendix A.3 ) . Some immediate corollary include : ( i ) when ∼ N ( 0 , Σ ) , the bound is simplified toE [ ||p′ , noise−p′|| ] ≤ l ( γK2 ( 1−γ ) ) 1/2 Tr [ Σ ] , ( ii ) when the L2 norm of is constrained smaller than δ ( usually assumed in adversarial attacks ) , the bound is simplified to ||p′ , noise − p′|| ≤ l δ ( γK2 ( 1−γ ) ) 1/2 . Theorem 1 If fA is l-Lipschitz continuous and xA is perturbed by : xnoiseA = xA + , then the Euclidean norm of our final prediction ( i.e. , ||p′ , noise − p′|| ) at most changes l √ γK 2 ( 1−γ ) || || .

Summary: In this paper, the authors proposed a training-free late-fusion method for robust multimodal learning. They specifically considering its performance under adversarial attacks and random corruptions which usually confuse the model by introducing noise to the input data. To promote the multimodal prediction robust to attacks, they propose to minimize the Frobenius norm of Jacobian matrix so that the prediction becomes stable to the perturbation of inputs. They also provide a theoretical error bound of their method. The experimental results outperfom other late-fusion methods.