Contextual Fusion For Adversarial Robustness

1 INTRODUCTION . 1.1 BIOLOGICAL BACKGROUND . Current deep learning networks are designed to optimally solve specific learning tasks for a particular category of inputs ( e.g. , convolutional neural networks ( CNNs ) for visual pattern recognition ) , but are limited in their ability to solve tasks that require combining different feature categories ( e.g. , visual , semantic , auditory ) into one coherent representation . Some of the challenges include finding the right alignment of unimodal representations , fusion strategy , and complexity measures for determining the efficacy of fused representationsBaltrusaitis et al . ( 2017 ) . In comparison , biological systems are excellent in their ability to form unique and coherent object representations , which is usually done in the associative cortex , by linking together different object features available from different specialized cortical networks , e.g. , primary visual or auditory cortices Gisiger et al . ( 2000 ) ; Pandya & Seltzer ( 1982 ) ; Mars et al . ( 2017 ) ; Rosen et al . ( 2017 ) . This natural strategy has many advantages including better discrimination performance , stability against adversarial attacks and better scalability Gilad & Helmchen ( 2020 ) . Indeed , if a classification decision is made based on a combination of features from different sensory categories , a noise or lack of information in one category can be compensated by another to make a correct decision . Furthermore , different types of sensory information can complement each other by being available at different times within a processing window . A good example may be human driving skill which relies on a combination of visual and auditory processing that helps to avoid mistakes and greatly enhances performance over only vision-based driving . Another example is insect navigation that depends both on visual and olfactory information to minimize classification error and to identify objects more reliably across range of distancesStrube-Bloss & RÃ¶ssler ( 2018 ) . Although it seems obvious that humans and animals base their classification decisions on the complex mixture of features from different modalities using specialized classifiers in each of them , this ability is still lacking in current state of the art machine learning ( ML ) algorithms . Problems include difficulty of training because of the lack of data sets combining different types of information , and suboptimal performance of generic deep learning networks vs specialized ones . Indeed , e.g. , high performance of the CNNs designed for visual processing depends on their architecture that makes explicit assumptions that inputs are images , and the same network performs poorly for other types of data . Thus , there is a need to develop approaches that would combine strength of specialized networks with ability to integrate information across multiple streams as human and animal brain can do efficiently . 1.2 MULTI-MODAL FUSION . Multimodal fusion has been previously explored for hard classification problems . Proposed methods in literature include learning joint representations from unimodal representations that are derived using VLADGong et al . ( 2014 ) , Fisher Vector representationsDixit et al . ( 2015 ) , and deep features locally extracted from CNN ’ s with various configurationsWu et al . ( 2015 ) Yoo et al . ( 2015 ) Shen et al . ( 2019 ) . These approaches have been successfully applied for action , scene and event recognition , and object detection tasks . In Zhou et al . ( 2014 ) , the authors used features extracted from Alexnet pretrained on Places365 and Imagenet to show how internal representations of these networks perform for various scene and object centric datasets . Performance was not significantly superior to using a unimodal approach , however , some of the advantages were found to be related to reducing data bias . In Herranz et al . ( 2016 ) the authors demonstrated this by using combinations of object and scene features aggregated at different scales to build a more efficient joint representation that helped to mitigate dataset bias induced by scale . Our fusion approach aligns most closely with the methods proposed in these papers . 1.3 ADVERSARIAL ATTACKS . Image processing using deep convolutional neural nets ( CNNs ) has made historical leaps in the last decade Krizhevsky et al . ( 2012 ) ; He et al . ( 2016 ) ; Szegedy et al . ( 2015 ) . However , the same convolutional networks are susceptible to small perturbations in data , even imperceptible to humans , that can result in misclassification . There have been two main approaches for investigating ANN robustness : adversarial machine learning and training data manipulation Ford et al . ( 2019 ) . Although it has been proposed that adversarial and manipulation robustness can be increased through various mechanisms during the training phase , recent research has shown that these methods are mostly ineffective or their effectiveness is inconclusive Uesato et al . ( 2018 ) Geirhos et al . ( 2018 ) ; Athalye et al . ( 2018 ) . Fast Gradient Sign Method ( FGSM ) Goodfellow et al . ( 2014 ) is a popular one-step attack that is easier to defend compared to the iterative variants like Basic Iterative Method ( BIM ) Kurakin et al . ( 2016 ) or Projected Gradient Descent ( PGD ) . Adversarial training and its variants are defense methods commonly employed for dealing with adversarial attacks . In Tramèr et al . ( 2017 ) the authors found that adversarial training is more robust with adversarial examples generated from white box attacks ( attacks designed against the specifics of the underlying CNN architecture and weights ) but it remains vulnerable to black box transferred examples ( examples generated in architecture agnostic manner ) . To combat this , an ensemble model was proposed that combines adversarial examples created from different source models and substitute pretrained networks . In general , adversarial training on one type of attack does not generalise to other attacks and can compromise classification accuracy on clean , unperturbed data . For example , in Kurakin et al . ( 2017 ) the authors demonstrated that adversarial retraining on one step attacks do not protect against iterative attacks like PGD . Consequently , adversarial training with multi step attack is regarded as the state of the art method used for improving adversarial robustness for white box and black box attacks and was initially proposed in Madry et al . ( 2017 ) . Recently , Wong et al . ( 2020 ) showed that single-step adversarial training with an attack similar to FGSM successfully yields models robust to white-box attacks , if the stepsizes of the attack ’ s random and gradient step are appropriately tuned . Several other methods are proposed such as adversarial example detection , reconstructing adversarial inputs , network distillation etc . and are discussed in further detail in Yuan et al . ( 2018 ) . 1.4 SUMMARY OF OUR APPROACH . In this paper , we describe the fusion of two data streams , one focused on background ( context ) and another focused on the foreground ( object ) image information , and we use different types of adversarial perturbations to evaluate the efficacy of the fused representation . We explore the following main concepts : • Adversarial attacks can have divergent effects on context feature space and object feature space . • Utilizing combination of multiple modalities for the information processing can be an efficient method for combating adversarial attacks . • Context features provide additional information to object-oriented data , and can be used to improve classification , especially during adversarial attacks . 2 METHODOLOGY . 2.1 CONTEXTUAL FUSION . We developed three different image classifiers designed to extract foreground features , background features , or a fused version of both . Below we refer to these as the foreground , background , and joint classifiers , respectively . The distinction between the various classifiers is based on the underlying training data . The foreground classifier was trained on the object-centric Imagenet database , whereas the background classifier was trained on the scene-centric Places365 database similar to Zhou et al . ( 2014 ) . Each classifier was built on the Resnet18 architecture He et al . ( 2016 ) with a final fully connected layer specific to the dataset ( Figure 1 ) . Only the 512 dimensional fully connected layer was finetuned for MS COCO Lin et al . ( 2015 ) or CIFAR-10 Krizhevsky & Hinton ( 2009 ) . For the joint classifier , we adopted a late fusion strategy and concatenated features obtained from the foreground and background pre-trained networks . This 1024 dimensional representation was finetuned for the specific dataset . 2.2 DATASETS . MS COCO dataset is a large dataset with 1.6 million images that have multiple objects and multiple instances with overlapping contexts . We pruned the MS COCO dataset for images with fewer than two instances ( < =2 ) of a single object so as to minimise cases of co-occurring context . We used available bounding boxes to constrain the percentage of foreground to be less than or equal to fifty percent of the total image , where foreground was defined by the area within the bounding box . This significantly reduced the dataset size but helped create the conditions for learning a representation that had enough information for the background classifier to utilize . Our final dataset comprised of 24 classes with 7500 images . We used 75 % of the dataset for training and the rest for testing . We also used CIFAR-10 , which is a standard object recognition dataset with 10 classes . For experiments with CIFAR-10 , we used the entire dataset with 50000 images for training and tested with the remaining 10000 images . All images from have been resized and cropped to 224x224 and normalized with CIFAR-10 mean and standard deviation . 2.3 ADVERSARIAL ATTACKS . We tested the classifiers with two different types of adversarial attacks to evaluate the benefits of fusion : Gaussian blur and FGSM . Gaussian blur was applied to the test set by convolving a portion of the image within the object bounding box given in the dataset with Gaussian kernel . Differing degrees of blur were created by varying the standard deviation of the kernel . Adversarial example attacks were generated using FGSM similar to Szegedy et al . ( 2013 ) ; Goodfellow et al . ( 2014 ) . Here , small amounts of noise were added to the test images based on the gradient of the loss function with respect to the input . Following Goodfellow et al . ( 2014 ) we used the equation η = · sign ( ∇xJ ( θ , x , y ) ) where is a small real number , J is the loss as a function of the parameters ( θ ) , the input ( x ) , and the label y . 3 RESULTS . 3.1 BLUR AFFECTS FOREGROUND AND BACKGROUND CHANNELS DIFFERENTLY . The impact of adversarial attacks can vary with the CNN architecture and the underlying training data Dodge & Karam ( 2016 ) . Here , we used two distinct CNNs with the same Resnet18 architecture to serve as the background and foreground feature extractors . The background feature extractor was trained on the Places365 database Zhou et al . ( 2014 ) , a scene-centric collection of images with 365 scenes as categories ( e.g . abbey , bedroom , and library ) . The foreground feature extractor was trained on the object-centric Imagenet database with object categories ( e.g . goldfish , English setter , toaster ) . The two different feature extractors represent the same images in different ways and have a different sensitivity to the same adversarial attack . We use pretrained models readily available in Pytorch . Blur is a natural artifact common to many real-world acquired images . Therefore , it is critical for an image classifier to maintain robustness to blur . We created blurred images by convolution of the foreground of each image with a Gaussian kernel . This type of Gaussian blur is perceivable by humans , and for small standard deviations ( e.g . σ = 0.001 ) , the human visual system is able to perform a classification task with minimal mistakes . As we increase the amount of blur ( e.g . σ = 45 ) , both humans and neural networks tend towards chance level performance . In our approach , only the foreground pixels are modified leaving the context of the images intact . We first tested effect of application of the Gaussian blur on images from the MS COCO dataset . The blur was applied to the bounding box area of the image , where main object was located . Images were processed by each of the two CNNs independently and features were extracted from the batch normalization layers . To illustrate effect of blur on the high-level foreground and background features , we visualized the feature space using PCA to reduce dimensionality for few representative image classes ( see Figure 2 ) . We found that blur had differing effects between the background ( scenecentric ) and foreground ( object-centric ) features . For the foreground features , blur caused a shift of the entire statistical representation subspace , i.e. , all blurred images moved conjointly away from the non-blurred images ( compare small vs large dots in Figure 2 ) . However , for background features , blurred images were represented in the same statistical subspace as clean images . This shows , as one can expect , that blurring foreground ( object ) alone will have larger impact on the features extracted by the network focused on the foreground than on the features coming from the network that was train to recognize a background . This finding supports an idea that combined use of the foreground and background classifiers to process images in a multi-modal fashion may help to defend against adversarial attacks designed against specific image components . Specifically , if adversarial attacks affected only one channel of information ( i.e . the foreground channel ) , then multi-modal integration could overcome these attacks .

Summary: The paper tackles the adversarial example problem. The authors propose an approach that is motivated by the way biological systems employ multi-modal information to recognize category of objects. Specifically, the approach combines two pre-train models, that are excepted to focus on foreground and background, respectively. Then the foreground module is fine-tuned for downstream tasks while the background module is left unchanged. The authors demonstrate that they obtain better performance against blur and FGSM.