Leveraging Adversarial Examples to Obtain Robust Second-Order Representations

1 INTRODUCTION . In recent years , artificial intelligence systems achieved state-of-the-art performances in image classification tasks ( Russakovsky et al. , 2015 ) ( Krizhevsky et al. , 2012 ) ( He et al. , 2016 ) . Specifically , classification algorithms surpassed top-5 human error rate of 5.1 % on ImageNet ( Russakovsky et al. , 2015 ) . Even though these advancements are promising , images in these datasets do not cover diverse real-world scenarios . For instance , ImageNet consists of photographs parsed from Flickr , a popular image hosting service . The images on Flickr are generally high quality since users tend not to share distorted photographs . Distortions may include perceptually unpleasant camera related issues like blur , motion blur , overexposure , underexposure , and noise . Moreover , environmental conditions such as rain , snow , and frost can affect the field of view . These non-ideal conditions impact the performance of artificial intelligence ( AI ) algorithms ( Dodge & Karam , 2017 ) ( Hendrycks & Dietterich , 2019 ) . These AI algorithms are primarily driven by deep neural nets that learn non-linear transformations to obtain discriminate representation spaces . Deep neural networks are trained to transform a data point into a representation space where linear classifiers can discriminate between classes ( Goodfellow et al. , 2016 ) ( Krizhevsky et al. , 2012 ) ( He et al. , 2016 ) . All the hidden layers are supervised to maximize the interclass distance while minimizing the intraclass distance to obtain linearly separable representations in the last layer . We formulate the inherent mechanisms behind the classification process as follows : Let f be an L layered neural network trained to distinguish between N classes . If x is any input to the network , the output for a classification application is given by f ( x ) = y where y is a ( N × 1 ) vector . The class of x is the index of the maxima of y . Consider only the final fully connected layer fL parameterized by weights ( WL ) and bias ( bL ) . We obtain y as , y =WTL fL−1 ( x ) + bL , ∀y ∈ < N×1 , WL ∈ < dL−1×N , fL−1 ( x ) ∈ < dL−1×1 , bL ∈ < N×1 , ( 1 ) where fL−1 is the flattened output of the network just before the final fully connected layer . All the data points that span fL−1 representation space should be linearly separable for a well trained fL . Note that Eq . 1 is a filtering operation between the weight vectors and the representation . Hence , the final fully connected layer in a network can be considered as a linear filter set with N filters onto which the representations ( fL−1 ) are linearly projected ( Wang et al. , 2019 ) . Projection refers to a dot product between the data point and the filters . The filter W iL , ∀i ∈ [ 1 , N ] that has the largest projection or is maximally correlated with the data point represents the corresponding class . In the above setting , the original data point x is represented by its projection intensity fL−1 ( x ) . This representation can be analyzed as a first-order point process ( Dorai-Raj et al. , 2001 ) . As an example , consider cities in the USA . All cities can be located on a map using their latitudes and longitudes as shown in Fig.1a . This is an instance of directly using the intensity - in this case the latitude and longitude - to represent a data point - in this case a city . The first-order representation is widely used for its intuitive nature , interpretability and ease of mathematical operation . However , under distortions and perturbations , this representation is not stable ( Azulay & Weiss , 2018 ) ( Goodfellow et al. , 2014 ) . The authors in Goodfellow et al . ( 2014 ) show the instability of such systems with adversarial images . In Azulay & Weiss ( 2018 ) , the authors demonstrate that when images are translated by a few pixels , the network output and the hidden layer representations change drastically . We show that this change holds for distortions as well in Fig.2 . Consider an image taken from MNIST ( LeCun et al. , 1998 ) dataset . The image is subjected to five levels of progressive blurring all of which are visualized in Fig.2a . Fig.2b shows the t-SNE ( Maaten & Hinton , 2008 ) feature visualization of first order point representations of corresponding fL−1 ( xBlurLvl ) for 10000 images in MNIST test set . The individual shapes and absolute locations of each cluster get progressively distorted with increasing levels of blur . Hence , it is natural that a network trained on original data performs poorly on distorted data . An alternative to representing a point by its intensity is by representing its influence on every other point in the subspace ( Dorai-Raj et al. , 2001 ) . This is the second-order property of data points . Consider the same example as before from Fig.1a . However , instead of latitudes and longitudes , the pairwise distance between all cities is provided . A Multi-Dimensional Scaling ( MDS ) algorithm is used to obtain the relative positioning of the cities with respect to each other as shown in Fig.1b . MDS algorithms ( Mead , 1992 ) are a class of algorithms that use second-order point representations to translate pairwise distances of N objects into an abstract cartesian space . In Sections 2 and 3 , we provide an intuitive methodology to extract the second-order representation of any data point . In Section 4 , we categorize the existing literature for classification under distortion and organize them into frameworks based on data dependency . We describe the experimental setup and discuss the results in Section 5 and conclude our work in Section 6 . 2 SECOND ORDER POINT REPRESENTATIONS . Second-order point representations have been utilized in popular ML algorithms like k-Nearest Neighbor ( kNN ) classification . kNN classifies a data point based on the classes of k of its nearest neighbors , nearest being determined by a predefined distance metric . However , these algorithms are computationally expensive . Similarly , classical MDS algorithms ( Hout et al. , 2013 ) ( Mead , 1992 ) on M datapoints , require formation of a pairwise distance matrix of size M ×M , which is not feasible for large-scale datasets . In this paper , we propose a proxy method for representing a data point using its second-order property . Instead of representing a data point as pairwise distance against other points , we represent it as a cumulative distance to all decision boundaries . We use adversarial image generation along with gradients of the final fully connected layer to obtain this cumulative distance . Consider Fig . 3a where the data point is projected onto a filter from the final fully connected layer , W iL , ∀i ∈ [ 1 , N ] . This provides a projection Pi , ∀i ∈ [ 1 , N ] . During backpropagation , if i is the given class for data point x , the filter moves in a direction that maximizes x ’ s new projection P ′i . The movement of the filter is controlled by gradients . Hence , gradients provide the negative direction of a data point to a filter W iL . Our goal is to not just get the direction to the maximum projection class but to all the classes . Hence , by backpropagating over all i ∈ [ 1 , N ] for a datapoint , we obtain the direction of that data point to every filter W iL . However , one iteration of backpropagation is not sufficient to obtain the distance between a datapoint to the decision boundary of a filter W iL . Hence , we generate a targeted adversarial image with class i , ∀i ∈ [ 1 , N ] for the datapoint x and absolute sum the gradients over the required iterations . This cumulative gradient provides the distance from a datapoint to a decision boundary . Creating adversarial images for every class i ∈ [ 1 , N ] provides multidirectional features . This concept is shown in Fig 3b . We create N adversarial images for every datapoint and track their individual movement until they hit a decision boundary . These features form a proxy second-order representation for a datapoint . The benefits of this representation are illustrated in the t-SNE maps for the MNIST testset in Fig . 2c . The relative shapes of the class clusters are preserved for the proposed representation in Fig . 2c compared to first-order representations in Fig . 2b . Further stability results are discussed in Appendix A.1 3 MULTI-DIRECTIONAL FEATURE GENERATION . Continuing the notations established in Secs . 1 and 2 , a L layered network f is trained to distinguish between N classes using original distortion free images . For every image x in the distortion free dataset , targeted Fast Gradient Sign Method ( Goodfellow et al. , 2014 ) ( FGSM ) is applied to create N adversarial images to obtain x ’ s distance to decision boundaries . For a target i ∈ [ 1 , N ] , an adversarial noise sign ( ∇xJ ( W , x , i ) ) is added to the image x. J ( W , x , i ) refers to the cost function used to train the network with parameters W . ∇x is the gradient of the cost function w.r.t . the input x. of 0.1 is used in this work . Adversarial noise is added to the input over k iterations until the classification changes to i , i.e f ( xk−1 + sign ( ∇xJ ( W , xk , i ) ) ) = i . The absolute value of the gradient of the cost function with respect to filter W iL is summed up over k iterations , i.e ri = ∑k−1 j=0 abs ( ∇W iLJ ( W , xj , i ) ) where ri is the feature for i th class . i is then iterated over all N classes to obtain multi-directional features of x to all decision boundaries . All corresponding ri are concatenated to obtain the final feature rx = [ r1r2 . . . rN ] . Hence the final multi-directional feature is given by , rx = [ k−1∑ j=0 abs ( ∇W 1LJ ( W , xj , 1 ) ) k−1∑ j=0 abs ( ∇W 2LJ ( W , xj , 2 ) ) · · · k−1∑ j=0 abs ( ∇WNL J ( W , xj , N ) ) ] ( 2 ) rx is the proposed proxy second-order representation of x . Note that if the dimensionality of the ( L−1 ) th layer from Eq.1 is dL−1×1 , then the dimensionality of every subfeature ri is also dL−1×1 . The concatenated final feature has a dimensionality ( N ∗ dL−1 ) × 1 . For reference , if the network fL is VGG-16 trained on CIFAR-10 , dL−1 is 512× 1 and rx is 5120× 1 . This representation can get prohibitive with increased number of classes . Simple methods to offset this increase and speed up rx generation are discussed in Sec . 5.3 . The multi-directional features rx are as analogous to fl−1 ( x ) as pairwise distances are to longitudes and latitudes in Fig . 1 . Hence , rx is used in the same way as fL−1 ( x ) . However because of change in values and dimensionality , the same final fully connected layer fL can not be used to discriminate rx . Instead we train a new classifier gL on top of rx . gL is a new network whose parameter dimensions depend on inputs . For instance , in Sec . 5.1 , gL is a 3 layer fully connected network separated by ReLU non-linearity for ResNet-18 whose rx dimensions are 640× 1 . For ResNet-101 in Sec . 5.2 , whose rx dimensions are 2560× 1 , gL is a 5 layered fully connected network . On a NVIDIA 1080TI GPU , gL for ResNet-101 trains within 320 secs . The second-order representation of any data point is obtained from Eq.2 . Note that the generation of gradients is a deterministic procedure and does not change over repeated experiments for the same network . However , the generation procedure is tied to a specific network and hence the representation of the same x differs for different networks . In Section 5 , we implement 5 networks and show that the proposed second order representation is robust compared to its first order counterpart in all of them . Moreover , the cost function J ( W , x , i ) used to obtain gradients , impacts the value of said gradients and creates differences in rx . In our experiments , we use MSE loss function to define J . Results comparing multiple loss functions on distorted CIFAR dataset is shown in Appendix A.2 .

Summary: This paper presents a method to represent input points by their relative positions to decisions boundaries using an adversarial attack instead of the more usual output of a deep model (before the last linear classification layer). The motivation of the method is to obtain representations that are more robust to input distortions such as blur, noise, over-exposure, etc. More specifically, the representation obtained by a deep model before the last linear classification layer (f_L) is replaced by a concatenation of the perturbation needed for that representation to be misclassified by f_L. Using this new representation, they are able to obtain more robust classifiers against input perturbations.