Extreme Values are Accurate and Robust in Deep Networks
Authors: Jianguo Li
Mingjie Sun
Changshui Zhang
Venue:  (2020)
Keywords: Biological inspired CNN architecture design
Adversarial Robustness Architecture

Abstract: Recent evidence shows that convolutional neural networks (CNNs) are biased towards textures so that CNNs are non-robust to adversarial perturbations over textures, while traditional robust visual features like SIFT (scale-invariant feature transforms) are designed to be robust across a substantial range of affine distortion, addition of noise, etc with the mimic of human perception nature. This paper aims to leverage good properties of SIFT to renovate CNN architectures towards better accuracy and robustness. We borrow the scale-space extreme value idea from SIFT, and propose EVPNet (extreme value preserving network) which contains three novel components to model the extreme values: (1) parametric differences of Gaussian (DoG) to extract extrema, (2) truncated ReLU to suppress non-stable extrema and (3) projected normalization layer (PNL) to mimic PCA-SIFT like feature normalization. Experiments demonstrate that EVPNets can achieve similar or better accuracy than conventional CNNs, while achieving much better robustness on a set of adversarial attacks (FGSM,PGD,etc) even without adversarial training.

Under review as a conference paper at ICLR 2020
EXTREME VALUES ARE ACCURATE AND ROBUST IN DEEP NETWORKS
Anonymous authors Paper under double-blind review
ABSTRACT
Recent evidence shows that convolutional neural networks (CNNs) biased towards textures so that CNNs are non-robust to adversarial perturbations over textures, while traditional robust visual features like SIFT (scale-invariant feature transforms) are designed to be robust across a substantial range of affine distortion, addition of noise, etc with the mimic of human perception nature. This paper aims to leverage good properties of SIFT to renovate CNN architectures towards better accuracy and robustness. We borrow the scale-space extreme value idea from SIFT, and propose EVPNet (extreme value preserving network) which contains three novel components to model the extreme values: (1) parametric differences of Gaussian (DoG) to extract extrema, (2) truncated ReLU to suppress non-stable extrema and (3) projected normalization layer (PNL) to mimic PCA-SIFT like feature normalization. Experiments demonstrate that EVPNets or better accuracy than conventional CNNs, while achieving much better robustness set of adversarial attacks (FGSM,PGD,etc) even without adversarial training.
achieve similar
INTRODUCTION
Convolutional neural networks (CNNs) evolve very fast ever since AlexNet (Krizhevsky & Hinton
2012) makes a great breakthrough on ImageNet image classification challenge (Deng et al. (2009) in
2012. Various network architectures have been proposed further boost classification performance
since then, including VGGNet (Simonyan & Zisserman, 2015), GoogleNet (Szegedy et al. 2015)).
ResNet (He al. 2016)) DenseNet (Huang al.] 2017] and SENet (Hu al. [2018), etc. Recently, people even introduce network architecture search to automatically learn better network architectures
(Zoph & Le
2017 Liu et al. 2018).
However, state-of-the-art CNNs are challenged by their robustness, especially vulnerability to adversarial attacks based on small, human- cimeeniippereepibblee modifications of the input (Szegedy et al.,
Goodfellow et al.) 2015). Su et al. (2018) thoroughly study the robustness of 18 well-known ImageNet models using multiple metrics, and reveals that adversarial examples are widely existent.
Many methods are proposed to improve network robustness, which can be roughly categorized into
three perspectives: (1) modifying input or intermediate features by transformation (Guo et al.) 2018))
denoising (Liao al. 2018 Jia al. 2019), generative models (Samangouei et al. 2018 Song et al.
2018); (2) modifying training by changing loss functions [Wong 2011)) Elsayed et al. 2018] 2019)), network distillation (Papernot et al., 2016). or adversarial training (Goodfellow
Zhang al.
ct al.
2015
Tramer et al. 2018) (3) designing robust network architectures (Xie et al. (
al.
2019 Nayebi Ganguli 2017) and possible combinations of these basic categories. For more
details of current status, please refer to a recent survey (Akhtar & Mian 2018).
Although it is known that adversarial examples are widely existent (Su et al. 2018). some fundamental questions are still far from being well studied like what causes it, and how the factor impacts the performance, etc. One of the interesting findings in (Su et al., 2018)) is that model architecture is more critical factor to network robustness than model size (e.g. number of layers). Some recent works start to explore much deeper nature. For instance, both (Geirhos et al. 2019: Baker et al.. 2018) show that CNNs are trained to be strongly biased towards textures so that CNNs do not distinguish objects contours from other local or even noise edges, thus perform poorly on shape dominating object instances. On the contrary, there no statistical difference for human behaviors on both texture rich objects and global shape dominating objects in psychophysical trials. Iyas et al. (2019) further analyze and show that deep convolutional features can be categorized into robust and

---

Under review as a conference paper at ICLR 2020
Figure I: Left: Input image; Middle: response after ReLU of first conv-layer ResNet-50; Right: response of first EVPConv-layer in EVPNet-50 (by replacing all x & conv-layers in ResNet-50). Note multi-channel feature maps merged into one channel with per-pixel max-out operations for easy illustration. Clearly, ResNet-50 has more noise responses, while EVPNet-50 gives
responses object boundary.
non-robust features, while non-robust features may even account for good generalization. However, non-robust features are not expected to have good model interpretability. It is thus an interesting topic to disentangle robust and non-robust features with certain kinds of human priors in the network designing or training process.
In fact, human priors have been extensively used in handcraft designed robust visual features like SIFT (Lowe) 2004). SIFT detects scale-space (Lindeberg] 1994) extrema from input images, and selects stable extrema to build robust descriptors with refined location and orientation, which achieves great success for many matching and recognition based vision tasks before CNN being reborn in 2012 (Krizhevsky& Hinton 2012). The scale-space extrema are efficiently implemented by using a difference-of GGaussian (DoG) function to search over all scales and image locations, while the DoG operator is believed to biologically mimic the neural processing in the retina of the eye (Young) 1987). Unfortunately, there is (at least explicitly) no such scale-space extrema operations in all existing CNNs. Our motivation is to study the possibility leveraging good properties SIFT to renovate CNN networks architectures towards better accuracy and robustness.
In this paper, we borrow the scale-space extrema idea from SIFT, and propose extreme value preserving networks (EVPNet) to separate robust features from non-robust ones, with three novel architecture components to model the extreme values: (1) parametric DoG (pDoG) to extract extreme values in scale-space for deep networks, (2) truncated ReLU (tReLU) suppress noise or non-stable extrema and (3) projected normalization layer (PNL) to mimic PCA-SIFT (Ke et al. (004) like feature normalization. PDoG and IReLU are combined into one block named EVPCony, which could be used to replace all & x & (k > 1) conv-layers in existing CNNs. We conduct comprehensive experiments and ablation studies to verify the effectiveness of each component and the proposed EVPNet, Figure I illustrates comparison of responses for standard convolution + ReLU and EVPCoпv in ResNet-50 trained on ImageNet, and shows that the proposed EVPConv produces less noises and more responses around object boundary than standard convolution + ReLUU, which demonstrates the capability of EVPConv to separate robust features from non-robust ones. Our major contribution are:
To the best of our knowledge, are the first to explicitly separate robust features from non-robust ones in deep neural networks from an architecture design perspective.
We propose three novel network architecture components to model extreme values in deep networks, including parametric DoG, truncated ReLU, and projected normalization layer, and verify their effectiveness through comprehensive ablation studies.
We propose extreme value preserving networks (EVPNets) to combine those three novel com- ponents, which are demonstrated to be not only more accurate, but also more robust to a set of adversarial attacks (FGSM, PGD, etc) even for clean model without adversarial training.
RELATED WORK
Robust visual features. Most traditional robust visual feature algorithms like SIFT (Lowe 2004) and SURF (Bay et al., 2006) are based on the space theory (Lindeberg 1994). while there is close link between scale-space theory and biological vision (Lowe 2004), since many scale- space operations show a high degree similarity with receptive field profiles recorded from the mammalian retina and the first stages in the visual cortex. For instance, DoG computes the difference of two Gaussian blurred images and is believed to mimic the neural processing in the retina (Young) 1987). SIFT is one such kind of typical robust visual features, which consists of 4 major stages: (1) scale-space extrema detection with DoG operations; (2) Keypoints localization by their stability; (3) Orientation and scale assignment based on primary local gradient direction; (4) Histogram based
2

---

Under review as a conference paper at ICLR 2020
keypoint description. We borrow the scale-space extrema idea from SIFT, and propose three novel and robust architecture components to mimic key stages of SIFT.
Robust Network Architectures. Many research efforts have been devoted to network robustness especially on defending against adversarial attacks as summarized in Akkhtar & Mian (2018). However, there very limited works that tackle this problem from network architecture design perspective. major category of methods (Liao et al. 2018 Xie et al. 2019) focus on designing new layers to perform denoising operations on the input image or the intermediate feature maps. Most of them are shown effective on black-box attacks, while are still vulnerable to white-box attacks. Non-local denoising layer proposed in Xie al. (2019) is shown to improve robustness white-box attack to an extent with adversarial training (Madry et al. 2018). Peer sample information is introduced in Svoboda et al. (2019) with a graph convolution layer improve network robustness. Biologically inspired protection (Nayebi & Ganguli 2017) introduces highly non-linear saturated activation layer to replace ReLÜ layer, and demonstrates good robustness to adversarial attacks, while similar higher-order principal is also used in Krotov & Hopfield (2018). However, these methods still lack systematic architecture design guidance, and many (Svoboda et al. 2019 Nayebi & Ganguli 2017) not robust to iterative attack methods like PGD under clean model setting. In this work, inspired by robust visual feature SIFT, we are able to design a series of innovative architecture components systematically for improving both model accuracy and robustness.
We should stress that extreme value theory is a different concept to scale-space extremes, which tries to model the extreme in data distribution, and is used to design attack-independent metric to measure robustness of DNNs (Weng et al. 2018) by exploring input data distribution.
PRELIMINARY
Differeecee-f-Gauusii Given an input image / and Gaussian kernel G(r,, y, or) as below
G(H,V,))
-x=2 -62++v3)/20
2no²
where a denotes the variance. Also, difference of Gaussian (DoG) is defined as
D(x v) = G(æ, y, 0) @ I G( () @ lo.
(2)
where @ is the convolution operation, and 4 G(z, y, o) @ Io- Scale-space DoG repeatedly convolves input images with the same Gaussian kernels, and produces difference-of-Gaussse by subtracting adjacent image scales. Scale-space extrema (maxima and minima) are detected in
images
DoG images by comparing a pixel to its 26 neighbors in 3x3 grids at current and two adjacent scales
(Lwwe 2004).
Adversarial Attacks. We use h(.)) to denote the softmax output of classification networks, and (-)))) to denote the prediction probability of class e. Then given a classifier 1(x) = y. the goal of adversarial attack is to find x such that the output of classifier deviates from the true label y: max, h' (xx"d)) # y while closing to the original input: ||x - x I e. Here || refers to a norm operator, i.e. L2 Loc.
Attack Method. The most simple adversarial attack method is Fast Gradient Sign Method (FGSM) (Goodfellow al.) 2015), a single-step method which takes the sign of the gradient on the input as the direction of the perturbation. L(.,)) denotes the loss function defined by cross entropy. Specifically, the formation is follows:
adv = x sign( V Lh(xx, v)),
(3)
where x is the clean input, y is the label. e is the norm bound (|x x S e, i.. e-ball) of the adversarial perturbation. Projected gradient descent (PGD) iteratively applies FGSM with small step size a; (Kurakin et al. 2017aa] Madry et al., 2018) with formulation as below:
Proj(x - sign( V (b(xx()))
(4)
where i is the iteration number, a = s/T with T being the number of iterations. 'Proj' is the function to project the image back to e-ball every step. Some advanced and complex attacks further introduced in DecpFool (Moosavi-Deziooll et al.) 2016). CW (Carlini & Wagner (017). MI-FGSM (Dong et al. 2018).
3

---

Under review as a conference paper at ICLR 2020
Conv
DoG
y
Cone
[|8]
ihaLu
12 Nom
DW Cony
param
tww-Cam
(b) IReLU Figure 2: Novel components in EVPNet (a) Overall architecture of EVPConv; (b) plot of truncated ReLU (URe function; (c) projected normalization layer (PNL.. Here || l| means Ep norm.
(a) EVPConv
(c) PNI.
Adversarial Training aims to inject adversarial examples into training procedure so that the trained networks can learn classify adversarial examples correctly. Specifically, adversarial training solves the following empirical risk minimization problem:
arg min E(x.)) pl max L(h(x"). bEH
(5)
xxEA(x))
where A(x) denotes the area around x bounded by Lx//22 norm e, and H is the hypothesis space. In this work, we employ both FGSM and PGD generate adversarial examples for adversarial training.
4 METHOD
Inspired by traditional robust visual feature SIFT, this paper aims to improve model accuracy and robustness by introducing three novel network architecture components to mimic some key compo- nents in SIFT: parametric DoG (pDoG), truncated ReLU (IReLUU, and projected normalization layer (PNL). Combining pDoG and tReLU constructs the so-called extreme value preserving convolution (EVPConv) block as shown in Figure 2(a)] which can be used to replace all & x (I: > 1) conv-layers in existing CNNs. PNL is layer as shown in Figure 2(c) A network with all the three components is named as extreme value preserving network (EVPNet). In the following,
and robust layer plugged in replace global average pooling (GAP)
will describe these three components in details separately, and elaborate on how they are used to construct the EVPConv block and EVPNet.
4.1 THREE BASIC COMPONENTS TO MIMIC SIFT
Parametric DoG (pDoG) is a network component we design mimic DoG operation. Recall DoG in Equation 2. it repeatedly convolves input images with the same Gaussian kernel in which kernel size a is designable, and then computes the differences for adjacent Gaussian blurred images. For CNNs, we mimic DoG with two considerations. First, we replace the Gaussian kernel with learnable convolutional filter. Specifically, we treat each channel of feature map separately as one image. and convolve it with learnable k x k kernel to mimic Gaussian convolution. Note that the learnable convolution kernel is not required to be symmetric since some recent evidence shows that non-symmetric DoG may perform Applying the procedure to all the feature-map channels is equal to a depth-wise (DW) convolution (Howard al. 2017). Second, we enforce successive depth-wise convolutions in the same block with shared weights since traditional DoG operation uses the same Gaussian kernel. As CNNs produce full scale information at different stages with series convolution and downsampling layers, each PDoG block just focuses producing extrema for current scale, while not requiring to produce full octave extrema like SIFT. The shared DW convolution introduces minimum parameter overhead, and avoid "extrema drift" in the pDoG space so that it may help finding accurate local extrema. Formally, given input feature map fo, a minimum of two successive wepth-wise convolution is applied as
better (Einevoll & Plesser 2012) Winnemöller (001))
DW (fo: w):
f2 = DW(f;; w).
(6)
where DW(3 (:) is depth- wise convolutionn with w as the shared weights. pDoG is thus computed as do = fi - fo; d, f - f, = DW w) (f: w).
is worth noting that the successive minus operations make the minus sign not able to be absorbed into for replacing minus into addition operation. To the best of our knowledge, this is the first time, minus component has been introduced into deep neural networks, which brings totally new element for architecture design/search.
Following SIFT, we compute local extrema (maxima and minimal) across the pDoG images using maxout operations (Goodfellow al. 2013):
Zg max(do, d1): 2 min(do, d;) max(-do, dd)-
(8)
4

---

Under review as a conference paper at ICLR 2020
Note we do not compute local extrema in 3 3 spatial grids in SIFT since we do not require keypoint localization in CNNs. Finally, to keep the module compatible to existing networks, we need ensure the output feature map to be of the same size (number of channels and resolution). Therefore, a maxout operation is taken over to merge two feature maps and obtain the final output of this block:
(9) Truncated ReLU (tReLU). The pDoG block keeps all the local extrema in the DoG space, while many local extrema are unstable because of small noise and even contrast changes. SIFT adopts local structure fitting procedure to reject those unstable local extrema. To realize similar effect, we propose truncated ReLU (tReLU) to suppress non-robust local extrema. The basic idea is to truncate small extrema which correspond to noise and non-stable extrema in the pDoG space. This can be implemented by modifying the commonly used ReLU function as
max Zo, z1).
|x]]
if ac 2 8
(10)
if
[ 6,
where 0 is learnable truncated parameter. Note that this function is discontinued at x 0 and
x 0. We make a small modification to obtain a continuous version for easy training as below
{
|=|
120 0, <.
y (x)
(11)
Figure plots the tReLU function. Different from the original ReLU, tReLU introduces a threshold parameter O and keeps elements with higher magnitude. O can be either a block-level parameter (each block has one global threshold) or a channel-level parameter (each channel holds a separate threshold). By default, take 0 as block-level parameter.
UReLU is combined with PDoG not only to suppress non-robust extrema, but also to simplify the operations. When combining Equation
combining Equation and Eqquaiio ttgeether, there is nested maxout operation which satisfies commutative law, so that we could rewrite Zo and 31 as
Z max(do: do) =doll:
Z1 max(d), -d1) [d1),
(12)
where is wisse absolute operation. With tReLU to suppress non non-robust features, we have
(do): z1 (....U
(13)
Hence, in practice, we use Egquatio instead of Equatiin 8 to compute zu and Z1. Note that tReLU does improve robustness and accuracy for pDoG feature maps, while providing no benefits when replacing ReLU in standard CNNs according to our experiments (see Table T).
Projected Normalization Layer (PNL). SIFT (Lowe, 2004) computes gradient orientation his- togram followed by L2 normalization to obtain final feature representation. This process does not take gradient pixel relationship into account. PCA-SIFT (Ke al.) 2004) handles this issue by projecting each local gradient patch into a pre-computed eigen-space using PCA. We borrow the idea from PCA-SIFT build projected normalization layer (PNL) to replace global average pooling (GAP) based feature generation in existing CNNs. Suppose the feature-mat map data matrix before GAP X' E dR,xe where d w x h corresponds to feature map resolution, and the number of channels, we obtain column vectors (x, E Re)d 2=-1 from A' to represent the i-th pixel values from all channels. The PNL contains three steps:
(1) We add a 1 x 1 conv-layer, which can be viewed as a PCA with learnable projection matrix W E Rexp, The output is u, = W x,, where u, E RP further forms a data matrix 24 E Rd
(2) We compute L2 norm for row vectors {ū, E R of, to obtain a vector v = (V1, 10,,,,,00 up)
with 8y = || [
(3) To eliminate contrast or scale impact, we normalize v to obtain v = v/llvlp, while || llp means the l, norm. the normalized vector V is fed into classification layer for prediction purpose.
It is interesting to note that PNL actually computes a second order pooling similar as (Gao et al. 2019 Yu & Salzmann 2018). Suppose wj RC is the j-th row of W. Uj step-2 can be rewritten as
M/ = V=VV== where A Ed x is an correooarlltionn matrix. Figure 2 illustrates the PNL layer. Theoreti- cally, GAP produces a hyper-cube, while PNL produces a hyper-ball This is beneficial for robustness since hyper-ball is more smooth, and a smoothed surface is proven more robust (Cohen et al., 2019). Our experiments also verify this point (see Table 1).
(w/ x.)
w X.xX w
x:x?) Jw, w/ Aw
(14)
5

---

Under review as a conference paper at ICLR 2020
Network
+pDoG
+RRLLU +PNI. Clean
FGSM
PGD-10-1
PGD-10-2
DeepFool
CW
91.68
24.23
3.03
0.00
20.19
0.57
92.55
31.14
29.33
0.60
91.38
25.37
2.79
0.00
23.41
0.23
90.92
40.66
13.16
1.66
31.86
1.02
SB-ResNet-20
91.98
37.46
4.64
0.01
36.54
0.98
92.62
60.12
28.03
6.37
39.28
4.56
92.85
66.21
41.06
12.19
40.28
6.78
Table 1: Ablation study results on CIFAR- 10, attack with e Here 'PGD-N-s' denotes PGD attack with N iterations of step size pixels.
4.2 EVPCONV AND EVPNET
With these three novel components. we can derive novel convolution block named EVPConv, and the corresponding networks EVPNet. In details, EVPConv starts from the pDoG component, and replaces(Equation replaces Equation with tReLU as in Eqqutioo 13 In SIFT, the contribution of each pixel is weighted by the gradient magnitude. This idea can be extended to calibrate contributions from each feature-mag map channel. Fortunately, Squeeze-and- anxxxiaainnn (SE) module proposed in (Hu et al. 2018) provides the desired capability. We thus insert the SE block after tReLU, and compute the output of EVPConv as:
(Su, $1)
SE(concat( (Zo, z1)),
o
max(So, 51),
(15)
where concat(-) means concatenating Za and z together for unified and unbiased calibration, SE()) is the SE module, Su and $1 are the calibration results corresponding to Zo and Z1, and max denotes an element- wise maximum operation. Figure 2(a) illustrates the overall structure EVPConv.
EVPConv can be plugged to replace any k x k (k >>) conv-layers in existing CNNs, while the PNL layer can be plugged to replace the GAP layer for feature abstraction. The network consisting of both EVPConv block and the PNL. layer is named as EVPNet. The EVPConv block introduces very few additional parameters: w for shared desth-wise convolution, for tReLU and parameters for SE module. Note that we allow each EVPConv block having its own and 0. EVPConv brings relatively fewer additional parameters, which is about 7~20% (see Apppendix A) (smaller models more relative increasing). It also increases theoretic computing cost 3~~00% for a bunch of parameter- free operations like DoG and maxout. However, the added computing cost is non non-negligible in practice (2x slower according our training experiments) due to more memory cost for additional copy of feature-maps. Near memory computing architecture (Singh et al. 2019) may provide efficient support for this new computing paradigm.
5 EXPERIMENTS
Experimental Setup. We evaluate the proposed network components and EVPNet on CIFARIO and SVHN datasets. CIFAR-10 is widely used image classification dataset containing 60. 000 images of size 32x32 with 50, 000 for training and 10,000 for testing. SVHN (Netzer et al. 201 I a digit recognition dataset containing 73,257 training images, 26,032 test images, all with size 32x32.
We introduce our novel components into the well-known and widely used ResNet, and compare to the basic model on both clean accuracy and adversarial robustness. As the EVPConv block contains a SE module, to make a fair comparison, we set SE-ResNet as our comparison target. In details, replace the input conv-layer and the first 3 x 3 conv-layer in the residual block with EVPCome and replace the GAP layer with the proposed PNL layer. Following (He et al. 2016)] Huang et al.) 2017). for CIFAR-IO. all the networks are trained with SGD using momentum 0.9, 160 epochs in total. The initial learning rate is 0. divided by 10 at 80 and 120 epochs. For SVHN, we use the same network architecture as CIFAR--O. The models are trained for 80 epochs, with initial learning rate 0,1, divided by 10 at 40 and 60 epochs. For tReLU, the channel-level parameter O is initialized by uniformly sampling from [0, 1).
In this work, we consider adversarial perturbations constrained under L.0 norm. The allowed pertur- bation norm e is pixels (Madry et al. 2018). We evaluate non-targeted attack adversarial robustness in three settings: normal training, FGSM M adversarial training (Goodfellow et al., 2015 Tramer et al.) 2018) and PGD adversarial training (Madry et al., 2018). During adversarial training, we use the predicted label to generate adversarial examples to prevent label leaking effect (Kurakin et al. 2017b). To avoid gradient masking (Tramer et al., 2018), we use R-FGSM for FGSM adversarial training. which basically starts from random point in the ball. Following Madry et al. (2018). during training, PGD attacks generate adversarial examples by 7 PGD iterations with 2-pixel step size starting from random points in the allowed ball. We report accuracy both whitebox and blackbox

---

Under review as a conference paper at ICLR 2020
Network
Training Method
Model
Clean
FGSM
PGD-10
PGD-40
DeepPool
CW
Blackbox
Baseline
91.68
24.23
0.00
0.00
20.19
0.57
78.32
Normal
EVPNet
92.85
66.21
12.19
6,84
40.28
6.78
79.31
SE-ResNet-20
FGSM
Baseline
84.84
62.17
29,41
27.74
60.88
25.54
81.81
EVPNet
84.94
64.90
34,10
31,75
62.74
29.87
82.50
Baseline
84.02
64.39
36.23
34.84
63.01
32.59
82.71
PGD
EVPNet
84.30
65.90
36,94
64,23
34.14
83.83
Baseline
94,20
37.18
0.00
0.00
24.33
0.97
83,42
Normal
EVPNet
93.80
74.05
29.39
7.43
44.59
8.33
84.04
SF. Se
FGSM
Baseline
87.50
67.88
33.87
62.34
34.54
86.17
EVPNet
89.61
69.93
41.79
35.63
63.45
35.42
87.57
Baseline
86.86
69.45
39,90
39,90
64.22
38.90
87.33
PGD
EVPNet
90.13
71.33
40.81
40.80
66.11
39.10
89.00
Table 2: Comparison results on CIFAR- 10 at different training settings and different networks, attack with 8.
Network
Triiing Method
Model
Clean
FGSM
PGD-T0
PGD-40
DeepFool
CW
Blackbox
Buseline
95,76
70.44
50.18
0.13
32.19
0.22
90.27
Normal
EVPNet
96.55
80.89
66.71
4.71
43.17
7.78
90.49
Buseline
95.79
66.53
5,83
1.44
56.33
4.94
90.56
SE. ResNet-20
FGSM
EVPNet
96.44
90.80
43.17
20.71
58.22
18.23
90.78
PGD
Baseline
92.47
74.72
6.25
1.33
57.36
6.36
91.03
EVPNet
96.06
80.45
31.30
8.69
60.02
12.43
92.40
Baseline
96.48
75. 14
1.19
0.05
34,92
0.43
90,53
Normal
EVPNet
96.68
84.60
41.94
14.30
46.46
9,94
90.94
Ne-
FGSM
Baseline
96.60
76.03
3.67
0.001
57.32
6.78
91.03
EVPNet 97.09
81.53
33,83
18,34
59.54
20.34
91.70
PGD
Baseline
56.50
69.92
12.95
39.21
7.83
91.43
EVPNet
96.39
77.82
20.96
7.21
60.34
13.10
92.06
Table 3: Comparison results on SVHN at different training settings and different networks, attack with c = 8.
attack. We evaluate set of well-known whitebox attacks, including FGSM, PGD, DeepFool, CW. We use 'PGD-N' to denote attack with N PGD iterations of step size 2 pixels by default. Specifically, we compare results for PGD-10 and PGD-40. For blackbox attack, we choose VGG-16 as the source model which is found by [Su et al. (018) to exhibit high adversarial transferability, and choose FGSM as the method to generate adversarial examples from VGG-16 as it is shown to lead to better transferability Su et al. (2018).
Ablation Study. This part conducts a thorough ablation study to show the effectiveness of each novel architecture component and how they interact to provide strong adversarial robustness. We conduct experiments
CIFAR-10 10 with SE-ResNet-22, which contains one input conv-layer, three residual stage each with two bottleneck residual blocks, and GAP layer followed by a classification layer. We evaluate the accuracy and robustness for all the possible combinations of the proposed three components under the normal training setting. For PGD attack, we use two step sizes: pixel as in Xie et al. (219) and 2 pixels in Madry et al. (2018). Table T lists full evaluation results of each tested model. Several observations can be made from the table:
(1) Solely adding pDoG or PNL. layer leads to significant robustness improvement. pDoG even yields clean accuracy improvement, while PNL yields slightly clean accuracy drops.
(2) tReI.U does not bring benefit for standard convolution, while yields notable improvement on both clean accuracy and adversarial accuracy, when combining with pDoG. That verifies our previous claim that tReLU is suitable to work for the DoG space.
(3) Combining all the three components together obtains the best adversarial robustness, while still achieve 1.2% clean accuracy improvement over the model without these three components.
Based on these observations, we incorporate all the three components into the CNNs to obtain the so-called EVPNet for the following experiments if not explicitly specified. As 2-pixels PGD attack is much stronger than l-pixel PGD attack, we use it as default in the following studies.
Benchmark Results. We conduct extensive experiments on CIFAR-10 and SVHN to compare the proposed EVPNet with the source networks. The two sources networks are ResNet-20 and ResNet-56. For fair comparison, we use the SE extended ResNet as our baseline. Table 2 lists comprehensive comparison results on CIFAR-10. We list 7 different kinds of accuracies: clean model accuracy, whilebox attack accuracies by DUSS///DD10//GID--- DODDC/IDDDDDDDDDPFF////CCCCC and blackbox attack accuracy with adversarial examples generated by FGSM on the VGG-16 16 model. We can see that under normal training case, EVPNet outperforms bascline by a large margin in terms of robustness with FGSM, PGD, DeepFool, and CW attacks. Even under the strongest PGD-40 white box attack, our EVPNet still has non-zero accuracy without any adversarial training. For those cases with adversarial training, EVPNet consistently beats baseline networks with noticeable margin.
Table 3 further lists comparison results on SVHN. Similarly, our EVPNet consistently outperforms baseline models all the three training settings. It is interesting to note that PGD adversarial
7

---

Under review as a conference paper at ICLR 2020
SF- 3F- CIFAB-10
SF- Yise-e- (IFAB-1
(F-8eelive-00 on SUHN
SF- SF-Reiiee-55 on
DvPRi
Text Aauracy (N)
Tee Scurary 1%)
Boad es
Ter: Kourrby (%)
Test Pccesoy (%)
APGO Iteracions
4PGD Rerations
(PCD harations
sPGD furatiora
(a)
(b)
(c)
(d)
Figure 3: Test accuracy vs the number PGD iterations for both networks on two datasets.
SE-ResNee-20 CIFAR-10
SE-ReeNee-S0 CIFAR-10
SC- REC-ResNee-B0 20 SVIIN
SC-Res SVHN
EVPhur-FGp-a
Purfic 5:00-00
EVPRaHPGGD-0
4.2
suptum Podh-co
Nor Norrellood distarcs
Nor motoooodd cistt TC0
Rosoline
Nox mold dioteroe
Dessira
Man modked clodannce
Raselie
10lock Index
oo index
BBlock Indox
#Blokk Index
(a)
(b)
(c)
(d)
Figure 4: Normalized adversarial- distance for feature responses between adversarial and benign examples
at different res-block output. Networks are trained without adversarial training.
training performs worse on PGD-10/PGD-BE attacks than FGSM adversarial training, and even much worse than normal training on this dataset. This may be due to the fact that SVHN is shape/edge dominating digit recognition dataset, which may generate a lot of difficult adversarial samples with broken edges. And it also coincides with the finding by |Baker et al. (2018). Our EVPNet shows better robustness on this dataset without adversarial training than CIFAR-10, 10, which may suggest that EVPNet is more robust on shape/edge dominating object instances. All these evidences prove that the proposed EVPNet is a robust network architecture.
Analysis. We make some further analysis compare EVPNet to baseline networks. First, we plot the test error at different PGD iterations for different evaluated networks under normal training case on both CIFAR-10 and SVHN datasets as shown in Figure 3 can be seen that EVPNet consistently performs significantly better than the corresponding baseline networks under all PGD iterations. Some may concern that the accuracy of EVPNet on the strongest PGD-40 attack is not satisfied (~ 10%). We argue that from three aspects: (1) The adversarial result is remarkable as it is by the clean model without using any other tricks like adversarial training, adversarial loss, etc. (2) The proposed components also brings consistent clean accuracy improvement even on large-scale dataset (see Apppendix A). (3) More importantly, the methodology we developed may shed some light on future studies in network robustness and network architecture design/search.
Second, we further investigate the error amplification effect as Liao et al. (2018). Specifically, we feed both benign examples and adversarial examples into the evaluated networks, and compute the normalized L2 distance for each res-block outputs as 7 = ||x x / ||x|| where x is the response vector of benign example, and x' is the response vector for the adversarial example. We randomly sample 64 images from the test set to generate adversarial examples using PGD-400 The models evaluated are trained without adversarial training. Figure 4 illustrates the results. As we can see, EVPNet has much lower average normalized distance than the baseline models almost on all the blocks, is interesting see that the baseline models have a big jump for the normalized distance at the end of the networks on all the 4 sub-figures, This urges the adversarial learning researchers to make further investigation on the robustness especially for latter layers around GAP. Nevertheless, this analysis demonstrates that EVPNet significantly reduces the error amplification effect.
Third, we compare the differences on feature responses between regular convolution + ReL.U and EVPConv. This comparison is made on large-scale and relative high resolution (224 x 224) ImageNet dataset for better illustration. We train ResNet-50 and EVPNet-50 on ImageNet, and visualize their prediction responses for the first corresponding convolution block in Figure I It clearly shows that ResNet-50 has more noise responses, while EVPNet-50 gives more responses on object boundary. This demonstrates the capability of EVPConv to separate robust features from non-robust ones. Full benchmark results on ImageNet are also very promising, see Appendix A for more details.
8

---

Under review as a conference paper at ICLR 2020
CONCLUSION
This paper mimics good properties of robust visual feature SIFT renovate CNN architectures with some novel architecture components, and proposes the extreme value preserving networks (EVPNet). Experiments demonstrate that EVPNets can achieve similar or better accuracy over conventional CNNs, while achieving much better robustness set of adversarial attacks (FGSM, PGD, etc) even for clean model without any other tricks like adversarial training.
REFERENCES
Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey, IEEE Access, 6:14410-14430, 2018.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses adversarial examples. In JCML, 2018
Nicholas Baker, Hongjing Lu, Gennady Erlikhman, and Philip Kellman. Deep convolutional networks do not classify based on global object shape. PLoS computational biology, 14(12), 2018.
Herbert Bay, Tinne Tuytelaars, and Luc Van Gool. SURF: Speeded robust features. In ECCV, 2006.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. IEEE Symposium on Security and Privacy (SP), 2017.
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. In ICML, 2017.
Jeremy Cohen, Flan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In ICML, 2019.
Deng, Dong, al. ImageNet: Large-Scale Hierarchical Image Database. CVPR, 2009.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR, 2018.
Gaute T Einevoll and Hans E Plesser. Extended Snferrence-o-Gaassiin model incorporating cortical feedback relay cells the lateral geniculate nucleus of cat. Cognitive neurodynamics, 6(4), 2012.
Gamaleldin Elsayed, Dilip Krishnan, Hossein Mobahi, Kevin Regan, and Samy Bengio. Large margin deep networks classification. In NIPS, pp. 842-852, 2018.
Zilin Gao, Jiangtao Xie, Qilong Wang. et al. Global second-order pooling convolutional networks. In CVPR. 2019.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, et al. ImageNet-trained CNNs biased towards texture; increasing shape bias improves accuracy and robustness. In ICLR, 2019.
Ian Goodfellow, David Warde-Farley, Mehdi Mirza, al. Maxout networks. In ICML, 2013.
Ian Goodfellow, Shlens Jonathan, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Chuan Guo, Mayank Rana, Moustapha Cisse, et al. Countering adversarial images using input transformations. In ICLR, 2018
K. He, X. Zhang, et al. Deep residual learning for image recognition. In CVPR, 2016.
Tong He, Zhi Zhang, Hang Zhang, et al. Bag of tricks for image classification with convolutional neural networks. In CVPR, 2019.
Andrew Howard, Menglong Zhu, Bo Chen, et al. MobileNets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint 17X.v:1704.0486) 2017.
Jie Hu, Shen, and Gang Sun. Squeeze-and-
networks. In CVPR, 2018.
Gao Huang, Zhuang Liu, Kilian Weinberger, al. Densely connected convolutional networks, In CVPR, 2017.
Andrew Tlyas, Shihani Santrrkrr, Dimitris Tsipras, et al. Adversarial Examples Are Not Bugs, They Are Features. aiXiv preprint arXiv: :xt5:/955.02755 2019.

---

Under review as a conference paper at ICLR 2020
Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Foroosh Hassan Foroosh. ComDefend: An efficient image compression model to defend adversarial examples. In CVPR, 2019.
Yan Ke, Rahul Sukthankar, et al. PCA-SIFT: A more distinctive representation for local image descriptors. CVPR, 2004.
A. Krizhevsky and G. Hinton. ImageNet classification with deep convolutional neural networks. In NIPS, 2012.
Dmitry Krotov and John Hopficld. Dense associative memory is robust to adversarial inputs. Neural computation, 30(12):31513111 2018.
Alexey Kurakin, lan Goodfellow, and Samy Bengio. Adversarial examples in the physical world. ICLR, 2017a.
Alexey Kurakin, lan Goodfellow, and Samy Bengio. Adversarial machine learning at scale, ICLR, 2017b.
Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In CVPR, 2018.
Tony Lindeberg. Scale-space theory: A basic tool for analyzing structures at different scales. Journal of applied statistics, 21(1-2):225 270, 1994.
C. Liu, B. Zoph, et al. Progressive neural architecture search. In ECCV, 2018.
David Lowe. Distinctive image features from scale-invariant keypoints. IJCV, 60(2):91-100, 2004.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. ICLR, 2018.
Scyed-Mohsen Moosavi-Deziie
Alhussein Fawzi, and Pascal Frossard. DeepFool: simple and accurate method to fool deep neural networks. In CVPR, 2016.
Aran Nayebi and Surya Ganguli. Biologically inspired protection of deep networks from adversarial attacks. arXiv preprint arXiv:1703 017777039222... 2017.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissaccol, Bo Wu, and Andrew Ng. Reading digits in natural images with unsupervised feature learning. In NIPS workshop, 2011.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In S&P. IEEE, 2016.
Pouya Samangouci, Maya Kabkab, and Rama Chellappa. Defense-GAN: Protecting classifiers against adversarial attacks using generative models. In ICLR, 2018
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks large-scale image recognition. In ICLR, 2015.
Gagandeep Singh, Lorenzo Chelini. Stefano Corda, et al. Near Sear-memory computing: Past, present, and future. Microprocessors and Microsystems, 71:102868, 2019.
Yang Song. Tacsup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. PixeIDefend: Leveraging generative models understand and defend against adversarial examples. /CLR, 2018.
Dong Su, Huan Zhang. Hongge Chen, Jinfeng Yi, et al. Is robustness the cost of accuracy? comprehensive study on the robustness of 18 deep image classification models. ECCV, 2018.
Jan Svoboda, Jonathan Masci, Federico Monti, Michael M. Bronstein, and Leonidas Guibas. PeerNets: Exploit- ing peer wisdom against adversarial attacks. In ICLR, 2019.
Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Christian Szegedy, Wei Liu, Yangqing Jia, et al. Going deeper with convolutions. In CVPR, 2015.
Florian Tramer, Alexey Kurakin, et al. Ensemble adversarial training: attacks and defenses. ICLR, 2018.
Tsui-Wei Weng, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho-Jui Hsich, and Luca Daniel. Evaluating the robustness of neural networks: An extreme value theory approach. ICLR, 2018.
Holger Winnemöller. XDoG: advanced image stylization with extended Difference-of--Gaussiin In SIGGRAPH Symposium on Con-Pootocicalistc Animation and Rendering, pp. 147-156, 201
10

---

Under review as a conference paper at ICLR 2020
Eric Wong and J Zico Kolter. Provable defenses against adversarial examples via the convex outer ad adversarial polytope. ICML, 2018.
Cihang Xie, Yuxin Wu, Laurens der Maaten, Alan Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In CVPR, 2019.
Richard Young. The Gaussian derivative model for spatial vision. I- retinal mechanisms. Spatial vision, 2(4): 273 293, 1987.
Kaicheng Yu and Mathieu Salzmann. ceeesticallymooivattee second-order pooling. In ECCV, 2018.
Sergey Zagoruyko and Komodakis komodakis. Wide residual networks. In BMVC, 2017.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, ct al. Theoretically principled trade-off between robustness and accuracy. arXiv preprint 1rX1v:1901.08553, 2019.
B. Zoph and Quoe Le.. Neural architecture search with reinforcement learning. In ICI,R 2017.

---

Under review as a conference paper at ICLR 2020
A EXPERIMENTS ON IMAGENET
We further make experiments on large-scale ImageNet classification dataset. We propose to replace the widely used ResNet architecture with the proposes components, and obtain the derived network named EVP-ResNet. We did experiments ResNer26A/26B are two variants of ResNet 8, both having the same number of residual blocks (ResBlock) as ResNet18, 88 but replacing standard ResBlock with bottleneck ResBlock. ResNer26A has the same filter width in each stage as ResNet18 (i.e. [64, 64, 128, 256, 512]). Due to the bottleneck structure, ResNet26A has just about 1/8 parameters of ResNet18. ResNet26B has the same filter width in each stage as ResNet50 (i.e., [64, 256, 512. 1024, 2048)), which yields just slightly higher parameter size than ResNet18, but much lower than ResNet50. Note there are two small modifications. First, we move the SE module in SE-ResNet after the last conv-layer in the bottleneck ResBlock to after the 2nd conv-layer, which is consistent with our EVPConv block for fair comparison. Second, for ResNet, we implement the stride = 2 convolution in downsampling ResBlock as ResNet-B structure in He et al. (2019).
three ResNet architectures: ResNet26A/266 and ResNet50.
Besides ResNet, we also try to extend our framework MobileNet-vl (Howard et al. 2017). which is a plane network structure without residual connections. We take standard MobileNet-V (1.0x in channel width) baseline, and provide experiments comparison the SENet extension and the EVPNet extension, For our EVPNet extension, we add EVPConv module after each 3 x 3 depth-wise convolution, and replace the GAP layer with our PNL layer. For the SENet extension, we add SE module after each 3 x 3 depth-wise convolution for consistency with the EVPNet extension.
For fair comparison, We trained all the models (ResNet and extensions, MobileNet and extensions) by ourselves on the same GPU server with NVidia 2080TI GPUs with the same training configurations: (I) the same data augmentation (baseline one used by He al. (2019))(2) Nesterov Accelerated Gradient (NAG) descent as the optimizer; (3) training 90 epochs with batchsize 256; (4) the learning
rate is initialized to 0.1 and divided by 10 at the 30th, 60th, and 80th epochs. We evaluated model performance on the validation set with just single center-crop test, without using any data augmentation this procedure. Besides clean model accuracy, we also evaluate the adversarial attacks by FGSM and PGD-10 with maximum perturbation for each pixel e 8 under Isc norm.
Table 4 lists the full comparison results as well as model information like parameter size and computing cost. It shows that EVP-ResNet gives consistent accuracy improvement over ResNet and SE-Res in all the three tested network architectures. EVP-ResNe126A improves ResNet26A and SE-ResNe126A by 6.09% and 3.61 % respectively in absolute accuracy. EVP-ResNe150 improves ResNet50 and SE- ResNet50 by 1.97% and 0.83% respectively in absolute accuracy.
Network
Model
Clean
FOSM
PGD-10
#Params(M)
FLOPs(G)
Baseline
57.63
21.45
0.10
1.33
0.261
ResNet26A
SE-ResNet
60.11
26.98
0.45
1.35
0.262
EVP-ResNet
63.72
30.23
6.78
1.65
0.290
Baseline
72.39
28.31
0.10
15.24
2.34
ResNer26B
SF-ResNet
74.14
32.19
1.02
15.58
2.36
EVP-ResNet
75.38
38.12
9.45
17.01
2.41
Baseline
75.04
29.13
0.23
24.36
4.10
ResNet50
SE-ResNet
76.18
33.45
1.20
24.97
4.11
EVP-ResNet
77.01
40.12
8.30
26.75
4.18
Bascline
70.07
18.45
0.09
4.04
0.557
MobileNet-vi
SE-MobileNet
71.51
30,92
0.87
4.70
0.560
EVP-MobileNet 72.63
37.54
6.99
5,48
0.623
Table 4: Top-1 accuracy by Resner26A/B, Resnet50, and MobileNet on ImageNet under normal training. The last two columns list the model parameter size and model computing FLOPs.
In terms of parameter size, EVP-ResNet brings 7~20% additional parameters to the ResNet coun- terparts (smaller models more relative increasing). In terms of computing FLOPs, EVP-ResNet increases 3~10% for bunch of parameter-fres freee operations like DoG and maxout. However, the added computing cost is non- -eglligiee in practice (2x slower in our training experiments) due to more memory cost for additional copy of feature-maps.
In the adversarial attack evaluation, EVP-ResNet still consistently outperforms the counterparts of ResNet, Set-Reseet For the strongest PGD-10 attacks, all ResNet and SE-ResNet models drop
12

---

Under review as a conference paper at ICLR 2020
top-1 aceuracy to near zero, while the EVP-ResNG variants keep 6~10% top-1 accuracy. The gap in FGSM attacks is even larger. This improvement is remarkable considering that it is by clean model without adversarial training.
For the MobileNet case, we also observe notable accuracy and robustness improvement. Please refer to Toaae 4 for more details. In summary, solid results and attempts may inspire future ways for robust network architecture design or even automatic search.
B WIDE-RESNET EXPERIMENTS ON CIFAR-10 10
In the main paper, we demonstrate the great robustness of the proposed components on ResNet with bottleneck residual blocks. Here, extend the proposed components other state-of-the-ar network architectures, and choose Wide-ResNet (Zagoruyko & komodakis 2017) as an example since it is mostly studied on other adversarial training works (Madry et al., 2018 Cisse et al. 2017 Athalye et al. 2018). Wide-ResNet (WRN) has two successive wide-channel 3 3 conv-layers in residual block instead of the three loyer bottleneck structure based residual block. We use WRN-22-8 as the baseline network with depth 22 and widening factor 8. It is obvious that WRN-22-8 has much better clean accuracy than ResNet-20 and ResNet-56 used in the main paper. For EVPNet, We replace input conv-layer and the first 3 3 conv-layer in each wide residual block with EVPConv, and replace GAP layer with our PNL layer. Table shows the comparison on normal training case. We can that EVPNet achieves similar clean accuracy, while performing significantly better on adversarial attacks with (GSM/PGD-LO/GGD
Note that under PGD-10 and PGD-40 attacks, the baseline model drops accuracy near while the EVPNet remains much higher accuracy, considering that no adversarial training utilized in this study. This demonstrates the strong robustness of the proposed EVPNet.
Network
Training Method
Model
Clean
FGSM
PGD-10
PGD-40
Blackbox
Baseline
95.84
49.34
0.01
0.00
83.45
SE-WRN-22-8
Normal
EVPNet
95.90
79.48
43.07
22.14
84.51
Table 5; Results SE WRN-
WRN-22--8
CIFAR 10, attack with 8.
13


Reviews:
[{"review_id": "rklYN27c9H", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a network model named EVPNet, inspired by the idea scale-space extreme value from SIFT, to improve network robustness to adversarial pertubations over textures. To achieve better robustness, EVPNet separates outliers (non-robust) from robust examples by extenting DoG to parametric DoG, utilising truncated ReLU, and then applying a projected normalisation layer to mimic PCA-SIFT like feature normalisation, which are the three novelties that the authors claim in this paper. In the experiments, FGSM and PGD are used to provide adversarial attacks, and experiments conducted on CIFAR-10 and SVHN reveal that EVPNet enhances network robustness.\nOverall, this paper contributes to network robustness from an architecture perspective; in the contrast, most prior works focus more on robust feature extraction and loss function design. The ablation study of EVPNet demonstrates the effectiveness of its each novel component. A further investigation presents that EVPNet reduces the error ampplification effects. The example that the authors show in this paper demonstrates the improvement of EVPNet to image textures.\n\nThe reviewer has some main concerns regarding the claimed novelty:\n1. pDoG computes the difference between outputs of two depth-convolution layers, but there is no evidence that the distribution of feature maps is gaussian or gaussian-like. There is no clarification for this point.\n\n2. Truncated ReLU is a modified ReLU. Does the learnable truncated parameter \\theta limit its applicability to different datasets?\n\n3. The Projected Normalisation Layer (PNL) seems a reasonable implementation, but essentially it is not very different from batch normalisation. The authors state only its difference to global average pooling but not to batch normalisation which should be a better comparison.\n\nFor the experiments, the following should be addressed:\n\n4. Experiments were conducted only for the SE-ResNet architecture via replacing its CNN kernel by the proposed EVPNet. Although SE-ResNet shows good performance on some common data, but the squeeze-excitation block might bring in non-robustness. Hence, the reviewer thinks that it is risky to claim: the replacement of EVPNet in CNN layers is robust to adverserial attacks based only on this implementation. Try EVPNet for a more basic network architecture (VGG) would be suggested.\n\n5. The \\epsilon, which represents the adversarial attack tolerance, is always 8. There is no explaination in this paper, why not other values.\n\nMinor comments:\n6. The authors did not clarify why the first novel component is called \"parametric\" DoG. There is a more \"non-parametric\" block.\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}, {"review_id": "r1lcfqfsYS", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, a new network architecture called EVPNet was proposed to improve robustness of CNNs to adversarial perturbations. To this end, EVPNet employs three methods to leverage scale invariant properties of SIFT features in CNNs.\n\nThe proposed network and the methods are interesting, and provide promising results in the experiments. However, there are several issues with the paper:\n\n- The authors claim that Gaussian kernels are replaced by convolution kernels to mimic DoGs. However, it is not clear (1) how this replacement, or employment of convolution kernels can mimic DoGs, or (2) more precisely, how the corresponding learned convolution kernels approximate Gaussian kernels. In order to verify and justify this claim, please provide detailed theoretical and experimental analyses.\n\n- It is also claimed that “a 1 × 1 conv-layer, can be viewed as a PCA with learnable projection matrix”. However, this statements is not clear. How do you assure that a 1x1 conv layer  employs a PCA operation or the corresponding projection?\n\n- What does \\| \\|_p denote? Does it denote \\ell_p norm?\n\n- What does x denote in d = w x h? Previously, it was used to denote matrix size.\n\n- Why do you compute \\ell_2 norm for row vectors instead of column vectors? How do the results change when they are calculated for column vectors?\n\n- According to the notation, s_0 and s_1 are vectors. Then, what does max denote in (14)? That is, how do you compute max(s_0, s_1), more precisely?\n\n- In the statement “PNL produces a hyper-ball in the manifold space”, what do you mean by the “manifold space”? What are the structures (e.g. geometry, metrics etc.) and members of this space?\n\n- Please conceptually and theoretically compare the proposed method with state-of-the-art methods following similar motivation, such as the following:\n\nWeng et al., Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach, ICLR 2018.\n", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}, {"review_id": "Sylz5pxycr", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper presents a SIFT-feature inspired modification to the standard convolutional neural network (CNN). Specifically the authors propose three innovations: (1) a differences of Gaussians (DoG) convolutional filter; (2) a symmetric ReLU activation function (referred to as a truncated ReLU; and (3) a projected normalization layer. The paper makes the claim that the proposed CNN variant (referred to as the EVPNet) demonstrates superior performance as well as improved robustness to adversarial attacks.\n\nClarity: Overall, the paper is not particularly well written. There are multiple missing articles and other grammatical errors that make it a bit arduous to read, though I do not believe they have obstructed my ability to understand the contributions. The section describing the projected normalization layer (second half of page 5) is a bit confusing. Figure 2(c) is not helpful in shedding light on the details, though I think a more detailed figure could be quite helpful. Beyond these issues, the paper is relatively clear in the presentation of the material. \n\nNovelty: Over the last few years there have been many, many proposals for how to vary the basic CNN architecture to improve performance. Some of these have lead to genuine performance gains and have become part of the standard CNN specification. ReLUs, ResNets and Batch Normalization are particularly prominent examples of contributions that have been shown to lead to improvements in performance. Yet the vast majority of these sorts of proposals ultimately make little or no impact on the field. In light of this, I would rate the novelty of the basic goal of this paper as relatively low, though the specific proposal is novel to me and seems reasonable. \n\nImpact: The impact potential for this paper lies with the performance offered by the proposed innovations. With respect to overall performance improvement the proposed method has not been shown to perform quite at a state-of-the-art level, as given by these resource:\nSVHN: https://paperswithcode.com/sota/image-classification-on-svhn\nCIFAR-10: https://paperswithcode.com/sota/image-classification-on-cifar-10\n\nThe authors compare the performance of their proposed EVPNet against a fair baseline - a squeeze-and-excite ResNet model. These sorts of controlled experiments are useful, but the actual reported performance for both models are somewhat off of the state-of-the-art and it's not clear that the relatively small benefit the authors show over their baselines are maintained for higher performing architectural configurations. Can this architecture be competitive with the state-of-the-art? The current paper in it's current \n\nMost of the results relate to the claim that the proposed model is robust to adversarial examples. Unfortunately, this is not a particular area of expertise for me, so it's difficult for me to provide a confident assessment of the contribution here, though I will say two things: (i) the method seems to provide a significant increase in adversarial robustness across the\nbaseline architectures investigated. (ii) the authors demonstrate that the benefit provided by the proposed architecture seems to persist even when training for adversarial defence is introduced. \n\nI would have liked to see more datasets explored in Experiments section. I  especially would have liked to see results on ImageNet. \n\nMy current rating is weak reject based on the weakness of the writing and the lack of strong empirical evidence in support of the effectiveness of the proposed contributions.", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This manuscript proposed biologically-inspired modifications to convolutional neural networks including differences of Gaussians convolutional filter, a truncated ReLU, and a modified projected normalization layer. The authors' results indicate that the modifications improve performance as well as improved robustness to adversarial attacks.

The reviewers and AC agree that the problem studied is timely and interesting, and closely related to a variety of recent work on robust model architectures. However, this manuscript also received quite divergent reviews, resulting from differences in opinion about the novelty and importance of the results. In reviews and discussion, the reviewers noted issues with clarity of the presentation and sufficient justification of the approach and results. In the opinion of the AC,  the manuscript in its current state is borderline and could be improved with more convincing empirical justification.
Decision: Reject