Tessellated Neural Networks: A Robust Defence against Adversarial Attacks
Authors: Chinmay Jain
Pabitra Mitra
Debasis Ganguly
Venue: Submitted to ICLR 2023 (2023)
Keywords: AI safety
fairness
privacy
robustness

Abstract:  Data-driven deep learning approaches for image classification are prone to adversarial attacks. An adversarial image which is sufficiently close (visually indistinguishable) from a true image of its representative class can often be misclassified to be a member of a different class. It is possible for attackers to exploit the high dimensionality of image representations, as learned by the neural models, to identify adversarial perturbations. To mitigate this problem, we propose a novel divide-and-conquer based approach of tessellating a base network architecture (e.g., a ResNet used in our experiments). The tessellated network learns the parameterized representations of each non-overlapping sub-region or tiles within an image, independently, and then learns how to combine these representations to finally estimate the class of the input image. We investigate two different modes of tessellation, namely periodic, comprised of regular square-shaped tiles, and aperiodic, comprised of rectangles of different dimensions. Experiments demonstrate that the tessellated extension of two standard deep neural models leads to a better defence against a number of standard adversarial attacks. We observed that the decrease in post-attack accuracy values relative to the accuracy of the uncompromised networks is smaller for our proposed tessellated approach. 

TESSELLATED NEURAL NETWORKS: A ROBUST DEFENCE AGAINST ADVERSARIAL ATTACKS
Anonymous authors
Paper under double-blind review
ABSTRACT
Data-driven deep learning approaches for image classification are prone to adver- sarial attacks. An adversarial image which is sufficiently close (visually indis- tinguishable) from a true image of its representative class can often be misclas- sified be member of different class. It is possible for attackers exploit the high dimensionality of image representations, as learned by the neural mod- els, identify adversarial perturbations. To mitigate this problem, we propose a novel divide-and- -ouqu-- based approach of tessellating a base network architec- ture (e.g., a ResNet used in our experiments). The tessellated network learns the parameterized representations of each non-overlapping sub-region or tiles within an image, independently, and then learns how to combine these representations to finally estimate the class of the input image. We investigate two different modes of tessellation, namely periodic, comprised of regular qquare-shaper tiles, and ape- riodic, comprised of rectangles of different dimensions. Experiments demonstrate that the tessellated extension of two standard deep neural models leads to a better defence against a number of standard adversarial attacks. We observed that the decrease in post-attack accuracy values relative to the accuracy of the uncompro- mised networks is smaller for our proposed tessellated approach.
INTRODUCTION
Deep neural networks are known to be susceptible to adversarial attacks. Image representations learned by a deep neural network differ from their visual interpretation. Attackers exploit this fact by introducing imperceptible evasive perturbation in test images such that the victim network mis- classifies them (Goodfellow et al. 2018 Machado et al. 2021). Defending neural networks against such adversarial attacks is of significant theoretical and practical importance.
Well known evasive attacks include the gradient based input perturbation strategies such as fast gra- dient sign method (FGSM) (Goodfellow et al., 2015), and the projected gradient descent (PGD) (Madry et al. 2018) methodologies. Non-gradies based attacks use norm bounded perturbations that change class membership through optimization process (Andriushchenko al. 2019). Uni- versal attacks that are image-agnostic and add the same perturbation for all input images while still modifying the class labels are also prevalent (Moosavi-Dezfooll et al.) 2017). Norm based attacks seeking to optimize the magnitude of perturbation in input images were subsequently proposed to victimize newer defence strategies (Carlini & Wagner, 2017, Croce & Hein 2019). Patch attacks, which involve perturbing image segments rather than the image pixels, have also been attempted (Sharif et al., 2016)] Yang al., 2020). More recent attacks approaches include the use of ensemble- based strategies with a capability to adapt on the defence mechanisms employed (Tramèr et al.) 2020).
As newer attacks are being proposed by researchers, developing models that are robust to adversarial attacks has attracted significant attention of the research community (Machado et al. 2021 Early defence strategies include adversarial training (Madry al.) 2018 Goodfellow et al. 2015) where classifier is trained using both legitimate and adversarial examples to improve its robustness. Adver- sarial training restricts the defence only to the specific attack strategy using which the examples were generated. Other proactive defences retrain deep networks using the smoothed output probabilities over the class labels using the principles of network distillation (Papernot et al. 2016). Both these

---

retraining methods modify the gradient of the networks as allow fewer directions (subspaces) towards which the attacker might perturb the input image.
Input transformation is another popular defence strategy. In this approach the corrupted imputs either detected and rejected before classification (Chen et al. 2017). or a preprocessing is performed to mitigate its adversarial effects. Various preprocessing strategies have been suggested towards this
end. Adding a random resizing and padding layer in early part of the architecture (Xie et al.) [017)] blockwise image transformation (AprilPyone & Kiya 2020), cropping and rescaling (Guo et al. 2018), include some of these techniques. As a different thread of work, transformation of the features the output of the convolution layers such as activation pruning (Goodfellow) (2018) and denoising (Dhilonn et al., 20188] Liao et al. (018)) are often equally effective as defence mechanism. Input dimensionality reduction approaches based on PCA (Hendryeks al., 2019), and spatial smoothing Xu et al. 2017) are also found to provide robustness against attacks.
Besides adversarial retraining and input transformation, various other techniques have also been attempted as defence strategies in deep neural networks. Ensemble of classifiers are found to be more robust towards adversarial attacks (Tramèr et al. 2017). Data augmentation using GAN, generative models, and ensembles (Wang et al.) 2021) p has been widely studied in this context. State-of-art defences as reported in the RobustBench (Croce et al. 2020) benchmark dataset include those based on data augmentation for adversarial training (Rebuffi et al. 2021a), as well as those that are based on transformation or randomization of model parameters (Gowal et al. 2021).
Different from the input feature transformation based approaches, architectural changes to net- work topology is a promising means of achieving adversarial robustness (Huang et al. 2021), For instance, Du et al. (2021) and Pang et al. (2019) generate diverse structured networks for ensur- ing robustness against adversarial threats. An alternative convolutional network (CNN) architecture which randomly masks parts of the feature maps also demonstrates adversarial robustness (Luo al. 2020). An advantage of this approach over its transformation based counterparts is that it provides an effective defense mechanism that is mostly agnostic to attack strategies.
As motivation of the work in this paper, we hypothesize that modification of the network structure leads to implicit feature transformation, cropping and masking. This, in turn, potentially results in improved robustmess against adversarial attacks. Moreover, incorporation of diversity in network topology likely disrupts the gradients, and acts as an effective defence against ensemble attacks. Consequently, reconfiguring the topology of a network may provide effective defence against adap- tive adversarial attacks. Since attackers exploit high dimensionality of image inputs to identify directions for adversarial perturbations (Machado et al. (02I), divide and conquer strategy of processing smaller blocks of an input image, which is the basis of our proposed method in this paper, potentially restricts the exploitable space of the attacker.
Our Contributions. In this paper, we propose tessellated deep neural network architecture 'split and merge' based workflow that provides an effective defence mechanism against adversarial attacks. our proposed approach, an input image partitioned into blocks (tiles) according to a tessellation (tiling) pattern. Each region of the input image makes use of separate branch in the computation graph to propagate its effects forward in the form feature representations. The individual feature representations then interact with each other for the eventual prediction of an image class (see Figure [] for a schematic representation). We investigate the use of two types of rectangular tessellation patterns, namely, regular grid tiling and tiling with non-uniform rectangles. As base networks (on which the tessellation is applied), we investigate standard deep networks for image classification, namely the ResNet50 (He al. (2016), and show that the proposed approach turns out to resist standard adversarial attacks more effectively than a number of baseline defence methodologies.
2 TESSELLATED NEURAL NETWORK
In this section, we describe our proposed method of tessellated neural architecture.
2

---

y (Image class)
Softma
Dense
Merge
(Image class)
Dense
Dense
Dense
Softmax
Flatton
Danse
ResNet50
Dense
Resizing Layer
Reeizing Layer
Resizing Leyer
Flatlen
X
ResNei50
Resizing Layer
i/p image regions (tiles)
Tiling Algorithm
x (i/p Image)
x (i/p Image)
Figure 1: Architectural overview of the proposed approach of tessellated neural network. The proposed method consists of partitioning an input image into several non-overlapping regions or tiles. We then make several copies of base network, one for each of these tiles, each involving separate set of learnable parameters. For simplicity, we illustrate our approach schematically on a resnet50 architecture (He al., (016)) the base network (as shown the left). The tessellated version of the base network is shown on the right of the figure.
2.1 ARCHITECTURE OVERVIEW
The process of tessellating acts on a base neural network with a specific architecture. We use ResNet50 base architectures and illustrate our idea schematically on it. Figure [ presents the schematic overview of a tessellated network. Our proposed approach comprises of a split phase and merge phase, which we now describe below.
Split phase. An input image first partitioned into non-overlapping rectangular tiles using a tes- sellation scheme (more details in Section 2.2). and then the spatial resolution of the image is in- creased using the up-sampling layer and resize the image to 224X224. We then pass the output to the base network, one for each partitioned region or tile within the input image. Each of these tile consists of shared learnable parameters of the base network.
Merge phase. To enable an end-to-end training for the entire image, the outputs from the base network, each corresponding to separate region the image, are then merged together and passed through a subsequent feed-forward layer.
While the split phase enables learning an abstract representation each different regions of an image dependently, the merge phase allows provision for adjustment to these individual representations as per the downstream task objective.
It might be argued that the split phase incorporates some amount of information loss due to the fact that each time the base network is trained only with partial information. Consequently, the downstream task (e.g., that of image classification) effectiveness of tessellated network is expected to slightly lower than that of the base network itself (which, in contrast, leverages information from entire image).
3

---

(a) Regular
(b) Aperiodic: Split Operation
(c) Aperiodic: Merge operation
Figure 2: (a) Regular tiling of a 9 x 9 image with nine 3 x 3 square tiles; (b) Illustration of the effect of the split operation on a tiling the yellow colored rectangle on the left part of the figure is transformed into two blue rectangles shown in the tiling shown along the right; (c) Illustration of the effect of the merge operation on tiling the yellow colored rectangle on the left part of the figure is merged with the rectangles right-adje right-adjacent to it; this operation for this example does not increase or decrease the total number of tiles (as seen on the right part of the figure);
However, this precisely the reason why such tessellated network should provide robust de- fence mechanism against adversarial attacks. This is because the gradients in the lower layers of tessellated network are associated only with partial information from the input.
2.2 TILING METHIODS
In this section, we describe two ways of partitioning an input image into non-overlapping regions. At this point, would like to emphasize that the goal of the paper is demonstrate that tessel- lated neural network potentially provides an effective defence mechanism. Investigating other more involved ways of partitioning an input image, e.g., by overlapping regions, is left future work.
2.2.1 REGULAR TESSELLATION
The simplest tessellation that we consider is the uniform one, where each tile a square (Figure 2 The parameter k for regular rectangular tessellation denotes the number of squares used to cover E Rdxd[] and a perfect square, i.e., = m² for some m E Z. To ensure regular tessellations in situations where d is not perfect square, we apply zero padding not covered by the tiles. In the general case, partitioning d x d square with k = m² tiles, leaves residual region of area 2d(d - k) (d k))2 for zero padding. For instance, the residual region of 28 x 28 image with 25 tiles is 159.
those regions of the image
2.2.2 APERIODIC TESSELLATION
In aperiodic or non-uniform tessellation, input image of size d dl is split into rectangular blocks of varying sizes, with low likelihood that any two rectangles will be congruent, i.e., of identical area.
The basic idea to obtain an aperiodic tiling is to iteratively apply two operations, namely the split and merge. While applying the split operation each time current state (set of tiles) leads to increasing the number of tiles by 1, the application of merge operation, on the other hand, mostly reduces the number of tiles by More details on the aperiodic tiling algorithm follows next.
We start with the initial state representing an entire image of size d x d. We then successively apply the split operation until the number of tiles k where k/' 2k. At this phase, we apply the merge operation successively until the number of tiles reaches from 2 to k. Both the split and the merge operations are applied on a randomly chosen rectangle from the set of tiles existing in the current state.
EEteending the argument the general case of rectangular images is straightforward.
4

---

Dataset
Images
Dimension
classes
CIFAR-10
60,000
32 x 32
10
CIFAR-100
60, 000
32 x 32
100
Plant Village
43, 447
224 x 224
38
Table 1: Summary of the datasets used in our experiments.
In general, for the split operation, given a state comprised of I'(0 < k'' S 2k) states, we first randomly select one of the k' rectangles and split it into two parts either horizontally vertically. vertical) is chosen randomly, e.g-
The position of the splitting line and its direction (horizontal the blue-shaded rectangle in Figure 2p is split into two parts by the bold-faced line. In general, rectangle of width w and height is split into a pair of rectangles dimensions w x p and w x h-pp
if the splitting direction is horizontal,
into the pair p h and p h if the direction is vertical with the condition that p. w - p p are all positive integers.
Similarly, for the merge operation, other rectangles that are adjacent to with respect to a direction (one of top, right, bottom or left). example of merging tile with the ones that are right-adjacent to it. The merge
first select rectangle at random. We then merge it with
Figure Sacureeilllstter Iillustrates operation mostly leads to decreasing the number of tiles (although in some situations, the number of tiles after the operation remains the same as, as shown in Tigure2b)
As a sanity check to ensure not too small or too large tiles (input image regions in the tessellated network). we undo a split or a merge operation if it leads to creating a rectangle whose dimension is less than 52 or higher than ())
While it is, in principle, possible generate non-uniform tessellations with other policies as well, e.g., with the use of Bayesian non-parametric space partition methods as surveyed in (Fan et al.) 2021.. we leave this as part of future work, since estimating the optimal tiling strategy for tessellated network is not the core objective of the paper.
Why should tessellated networks be robust against adversarial attacks. tessellated network dedicates separate computational branch for each of the tiles shown in Figure D which are later combined via a feed-forward layer. This offers an implicit ensemble of the features computed for each region of an input image by each computational branch. Empirically, ensemble of diverse network structures have been shown to exhibit robustness (Du et al., 2021] Pang et al.) (019). More- over, adopting non-regular (and non-congruent) image tessellation scheme leads diversity in the computational graph of the branches of tessellated network.
On the other hand, non-regular tessellation patterns with large variation in sizes of the tiles may result in very large or too small sub-rectangles. Through our experiments, we found that this de- creases the prediction effectiveness of the tessellated network on non-adversarial samples. This trade-off between performance on clean images and robustness to adversarial attacks has also been noted previous studies. Generating non-un non-uniform tessellations (those obtained with the split-merge merge operations) lead to better handling of this trade-off.
3
EXPERIMENTAL SETUP
3.1 DATASETS
Our main experiments were conducted on two standard benchmark image classification datasets. The first dataset that we use is the CIFAR-10 dataset, which consists of 60000 32 x 32 colour im- ages in 10 classes, with 60, images per class. To investigate if the defence mechanism shows consistent behaviour for more fine-grained (and thus higher number of) classes, we use the CIFAR- 100 dataset, for which there is a 10-fold decrease in the number of training instances available per class as compared to CIFAR- 10. Moreover, in order to study the effectiveness of the proposed tessel- lated architecture on larger sized images, we evaluate the proposed approach on the 'PllntVillage' dataset consisting of 43, 447 224 x 224 colour images in 38 classes. The dataset consists of im- ages of diseased leaves from multiple crops Hughes & Salathé (2015). A summary of the dataset characteristics is presented in Table In our experiment setup, we data augmentation for classi-
5

---

Table Adversarial robustness of Tessellated Resnet-50 (RN) with perturbation of 6 8/255, reported with optimal param-tr settings, namely l = 16 for regular tiling (Reg) and k = 20 for aperiodic tiling (Aprd). where k denotes the number of tiles in a tessellation. The smallest drops in accuracy and weighted accuracy values are shown bold-faced for each attack on the respective datasets.
CIFAR-IO
CIFAR-100
Attack
Metric
RN
TRN
RN
TRN
Reg
Aprd
Reg
Apri
NONE
BCC
0.9417
0,8559
0.8260
0.7741
0.5174
0,5085
800
0.9510
0.8939
0.8802
0.8186
0.6790
0.6721
FGSM
BCU
0,4586
0.3914
0.3714
0.3207
0.1297
0.1363
Aacc
0,5130
0.5427
0,5607
0.5857
0.7493
0.7320
BCCw
0,5315
0.5421
0.4974
0,4583
0.3773
0.4151
AncTe
0.441
0.3936
0.4349
0.4402
0.4443
0.3825
PGD
BCC
0.1427
0.3574
0,3694
0.2044
0.2459
0.2608
Aace
0.8485
0.5824
0,5528
0.7360
0.5247
0.4871
acCw
0.1628
0.4780
0.4630
0.2479
0.4890
0,5108
AncTe
0.8288
0.4653
0.4740
0.6971
0.2799
0,2400
APGD-CE
BCC
0.1338
0.3095
0.3142
0.2152
0.2197
0.2208
Aace
0.8579
0.6384
0.6196
0.7360
0.5754
0.5658
acCw
0.1580
0.4396
0.4089
0.2745
0.4756
0.4833
Ancow
0.8339
0.5082
0,5355
0.6647
0.2995
0,2809
APGD-T
BCC
0.3931
0.4085
0.3944
0,2618
0.2235
0.2182
Aace
0.5826
0.5227
0.5225
0.6618 18
0.5680
0.5709
aCCw
0.4985
0.5663
0.5295
0.5079
0.4827
0.4818
Ancro
0.4758
0.3665
0.3984
0.3796
0.2892
0,2832
FAB-T
BCC
0.9259
0.8389
0.8116
0.7596
0,5109
0.5001
Aace
0.0168
0.0199
0.0174
0.0187
0.0126
0.0165
BCCw
0.9376
0.8813
0.8683
0,8075
0.6746
0.6669
AncTo
0.0140
0.0141
0.0136
0.01 36
0.0065
0.0079
SQUARE
acc
0,8062
0,7443
0.7044
0.6050
0.4101
0.3847
Aacc
0.1439
0.1304
0,1472
0,2184
0.2074
0.2435
BCCw
0.8389
0.8100
0.7696
0.6961
0.6061
0,5516
AncTo
0.1178
0.0939
0.14
0. 1289
0.1074
0.17
fication like random crop, rotation, width and height shift. The clean accuracy for Resnet50 is nearly comparable some of the recently reported approaches, such as RReuufii et al.) (2021b).
3.2 ATTACKS INVESTIGATED
Our proposed tessellated mechanism can be applied to any base network. As particular choices of the base network, we experimented with the popular image classification architectures, namely the ResNet50 He al. (2016).
For our experiments, the black-box untargeted versions of the two most standard adversarial attacks FGSM (Fast Gradient Signed Method (Goodfellow al.) 2015)) and PGD (Projected Gradient Descent (Madry et al. (0188), were applied on the neural models, i.e., both on the base networks and their tessellated versions. Additionally, we conducted experiments with more recently pro- posed attacks, namely APGD-CE (Auto Projected Gradient Descent Attack with Cross Entropy Loss) (Francesco Croce 2020) and APGD-T (Targeted Auto Projected Gradient Descent Attack), FAB-T (Targeted Fast Adaptive Boundary Attack) (Croce & Hein| 2019), and Square Attack, which a query-efficient black-box adversarial attack (Andriushchenko al. 2019).
For consistency, all the adversarial examples were generated apriori, and were used across all our experiments. The FGSM examples were generated by applying loo perturbations of a = 8/255 0.03, normalized test sets, which is standard practice adopted in existing research Goodfellow et al. (2015): Madry et al. (2018). Similarly, to generate the PGD examples, we used & = 0.03, and step_siže 2.5
num__teps, where num_steps is the number of iterations of the PGD algorithm, the value which was set to 20 as per Madry et al. (2018). All the more recent attacks generated by applying fo perturbations of 8/255 0.03, on normalized test sets.

---

In all the attacks we assumee black-box scenario with the proxy victim network to be standard ResNet50.
Since the objective of our study is rather to demonstrate the robustness of the tessellated networks over equivalent non-tessellated ones, we do not study defence mechanisms based on adversarial retraining. Moreover, important point to note in our experiment setup is that investigate a black-box adversarial situation, i.e. where the adversary has no information about the model architecture, parameters the gradients. We used the adversarial attack methodologies, e.g., PGD, FAB-T etc., to perturb the CIFAR- 10/10/0000010 images using the base model (in our case, either Resnet or the WideResNett. These perturbed images are then used as the test set evaluate the defence mechanisms. This is in contrast to the experiment settings used in the RobustBenchmark framework Croce et al. (2020), where instead of leveraging information of the base network (as in our case), the attack mechanisms make direct use of information from the original models. As such, the results obtained on our proposed architecture are not directly comparable with those reported in the RobustBenchmark.
3.3 EVALUATION METRICS
The objective of the experiments to measure how effective is defence mechanism. Since dif- ferent base networks (on which tessellation is applied as a defence mechanism) when trained on unperturbed data samples will likely yield different accuracy values, for a fair comparison of the robustness measure across different attacks, one should compute the decrease in the accuracy of the attacked network (trained with adversarial samples) relative to the clean (unperturbed) case. In addition to reporting these relative accuracy values, we also report the individual accuracy values of the base and the tessellated networks prior to and post adversarial attacks, denoted respectively as ace and acc All our experiments report results with a 5-fold cross validation.
In addition to reporting the above metrics, we also evaluate the effectiveness of our proposed method with metric that incorporates the uncertainties of the predictions. The closer the softmax probabil- ity distribution is to the uniform, the higher is the uncertainty in predictions, which is not desirable criteria. We intend to capture the effectiveness and the confidence of predictions with single met- ric, which we call the weighted accuracy. More precisely, instead of simply employing the argmax on the output softmax to predict the correct class, we multiply the maximum component of the soft- max probability with the binary indicator of whether the prediction is correct. We then report the average of these values computed over all instances in the evaluation set, and denote by acc.--
A neural model that exhibits a larger absolute value of weighted accuracy (accw) after an attack would indicate more resilience against the attack. Similar to the unweighted case, we also report the relative changes in the weighted accuracy values well. We denote these relative changes in accuracy and weighted accuracy values as Aacc and Aacc respectively. and they are computed as attakkk
acCw acc attack
Aacc
Aaccw
a0c
acCw
3.4 TESSELLATION AND NETWORK PARAMETERS
We experimented with different configurations of the tessellated ResNet50. In particular, we exper- imented with different tiling schemes regular or aperiodic, and also with different number of tiles (the value of i as described in Section 2.2p. The objective of applying number of different at- tacking mechanisms (as described in Section 3.2) is to demonstrate that our proposed method, being attacker method agnostic, should provide a robust defence against each.
For regular tessellation a total of k 16 equal sized squares were used both for the CIFAR-10 and CIFAR-100 32 x 32 images. For aperiodic tessellation, we split the input images into
sub- rectangles using the split/merge generation process described in Section 2.2.2 2.2.2 Owing to the random initialization of the aperiodic spiral pattern generation process, multiple tessellations with identical values of k is likely to be generated. We report the average value of the evaluation parameters over 5 such configurations. The architectural details are provided in the appendix (Section A
We use the categorical cross-entropy the loss function. We train with SGD and Adam optimizer using a batch size of 128 and 100, respectively for ResNet and Wide-ResNet All the models were trained for 100 epochs.
7

---

044
0.2
Mumber of sub-ractangles (k)
Number of sub-recfengles (k)
FGSM Black-Bok
PCD Black-Box Box apgd-oe
apgd-
FGSM Black-Box
PGD Black-Box apgd-ce
apgd-
square
square
(a) ResNet (regular).
(b) ResNet (aperiodic).
Figure 3: Sensitivity of relative drops in accuracy values (Aacc) with variations in the number of tiles (k) for several attacks the CIFAR-10 datasct. Similar the results of Table 2 each attack used perturbation of loc, 5 = 0.08.
Table 3: Effectiveness of Wide-ResNet- 16-8 (WRN) and regular (k 16) Tessellated Wide-ResNet-Ie 16-8 (TWRN-RG) against -oo-h FGSM and PGD adversarial attacks on the PlantVillage dataset (s = 8/255).
Attack
Metric
WRN
TWRN-RG
NONE
8CC
0,9618
0,9232
BCCw
0.9745
0.9388
FGSM
8Cc
0.3459
0,5815
Aace
0.6404
0,3702
BCOw
0.5876
0,6668
Aacc, 0.3970
0.2897
PGD
acc 0.3168
0,7525
Aacc 0.6706
0,1849
acow
0.4928
0,8051
Aacc
0.4943
0.1424
4 RESULTS
Main Observations. Table 2 displays a comparison between the base network Resnet50 and its tessellated version obtained with optimal settings for the number of tiles. The following observations can be made. First, tessellated architectures when trained with clean data (i.e., attack) result a lower prediction effectiveness, e.g., compare the acc and acc,, values for ResNet (RN) and tessellated ResNet (TRN). Second, for number of different attacks, it can be seen that the post- attack accuracy tessellated networks mostly higher than its base counterpart, e.g., compare the acc value of post-PGD attack ResNet (RN) with that of tessellated one (the corresponding TRN column values in the same row).
The third, and perhaps the most important, observation is that the relative drops in accuracy and weighted accuracy values (Equation [ are lower in tessellated versions the base networks for almost all the attacks. Fourth, we observe that a Aperiodic tessellated network mostly outperforms its regular counterpart (see that most bold-faced values occur along the 'Aprd' columns).
We observe that the drops in classification accuracy (Aacc) is smaller for the tessellated ResNet network as compared to basic ResNet network. We further observed that the aperiodic tiling method seem to have lower accuracy drop than regular tessellation most cases.
Experiments on larger images. In our next experiment, we investigate the effectiveness of our proposed defence approach images much larger than the ones in CIFAR datasets. For these experiments, we focus only on the best performing model (as per the results of Table 2 namely the tessellated ResNet50. Trends similar that of Table 2 is observed in Table Table 3 It can be
8

---

seen that larger images. the tessellated network is significantly more robust compared the non-tessellated ones for both FGSM and PGD attacks.
Sensitivity analysis. Since the number of sub-rectangles (k) used in a tessellation is a hyper- parameter our model, we investigate how varying this hyper-parameter (i.e., different tessel- lation configurations) can affect the robustness against several attacks.
From Figure 3 can be seen that the resilience to attacks is lower when very small number of rectangles are used for configuring a tessellated network; note that the A A(ace) values are higher for small values of Similarly, the robustness also decreases (i.e., acc values increase) when large number of tiles is used.
CONCLUSIONS AND FUTURE WORK
We presented a novel defence mechanism that transforms any base neural model for image classi- fication tessellated network. An input image is partitioned into number of non-overlapping sub-rectangles. Each sub-rectangle is then processed by a dependent branch of base neural model (e.g., the ResNet) terminating dense layers. The output of these branches are concatenated and passed through another dense layer to obtain the final softmax classification scores. The key idea behind this approach that none of the computational branches have complete information on the overall input image, as result of which it becomes difficult for an adversary to craft adversarial examples by leverage the gradient information.
We investigated two different tiling strategies regular and aperiodic, and experimented with the base networks, namely ResNet50. We empirically demonstrate that standard non-tessellated net- works more vulnerable to adversarial attacks, whereas the tessellated ones are more robust against these attacks.
Studies other space partitioning techniques may help in devising more diverse classes of tessel- lated networks. Similarly, tessellation structures for other networks such as Efficient nets (Tan & Le 2019) and Dense nets (Huang et al. (2017) may be considered in future.
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: a query-efficient black-box adversarial attack via random search. CoRR, 2019. URL
http://arxiv. www.:vo.rrr/abss..eeeee
abs awwaaas/1111 00049
MaungMaung AprilPyone and Hitoshi Kiya. Block-wise image transformation with secret key for adversarially robust defense. CORR, 2020. URL htttppp:/aarcct.oor//ba////////a 00801
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 20/7 IEEE Symposiun Security and Privacy, pp. 39-57, 2017.
Jiefeng Chen, Zihang Meng, Changtian Sun, Wei Tang, and Yinglun Zhu. Reabsnet: Detecting and revising adversarial examples. CoRR, abs/1712.082500, 2017. URL htlp:t////a///orrgg
abs abs/1712. 08250
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. CoRR, abs/1907.02044, 2019. URL http:::/axxiv.or//aaaaa. http:////axxxv..o//////////1..
02044
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. RobustBench: a standardized adversarial robustness bench- mark. CoRR, abs/2010.09670, 2020. URL URL/attss://arxtt wwwp:iii.rrg///bss.sa 0010000000000000000
Guneet S Dhillon, Kamyar Azizzadenesheli, Zachary C Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Anima Anandkumar. Stochastic activation pruning for robust adversarial de- fense. arXiv, 2018.

---

Xuefeng Du, Jingfeng Zhang, Bo Han, Tongliang Liu, Yu Rong, Gang Niu, Junzhou Huang, and Masashi Sugiyama. Learning diverse-structuree networks for adversarial robustness. CoRR, 2021.
httt::/:: /ttp///axivvv//a org/ abs/2102. 01886
Xuhui Fan, Bin Li, Ling Luo, and Scott A. Sisson. Bayesian nonparametric space partitions: A survey, 2021.
Matthias Hein Francesco Croce. Reliable evaluation of adversarial robustmess with an ensemble of diverse parameter-free attacks. CoRR, 2020. URL httppa///arxiv..ogg///aaba
01690
Ian Goodfellow. Gradient masking causes clever overestimate adversarial perturbation size. arXiv preprint arXiv:/804.07870 2018.
Ian Goodfellow, Patrick McDaniel, and Nicolas Papernot. Making machine learning robust against
adversarial inputs. Communications of the ACM, 61(7):56-66, 2018.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial
examples. In International Conference on Learning Representations, 2015. URL http://
arxiv. Ltxiv.org/abs/190 1etp/111..6555
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples, 2021.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. In International Conference on Learning Representations, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp- 770-778, 2016.
doi: 10. 0.1109/CVPR.2016.990
Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. Proc. Intl. Conf. Machine Learning, pp. 2712-2721, 2019.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp.
2017. doi: 10. 109/CVPPR.2017.222
Hanxun Huang, Yisen Wang. Sarah Monazam Erfani, Quanquan Gu, James Bailey, and Xingjun Ma. Exploring architectural ingredients of adversarially robust deep neural networks. CoRR, abs/2110.03825, 2021.
David P. Hughes and Marcel Salathé. An open access repository of images on plant health to en- able the development of mobile disease diagnostics through machine learning and crowdsoureing. CoRR, abs/1511 1..11.8880 1.80600 2015. BtLLhttp:/// httttp://arxiv.ooot wrw.v.iiiiva.oao org. /11///11111 08060
Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition, pp. 1778-1787, 2018.
Tiange Luo, Tianle Cai, Mengxiao Zhang, Siyu Chen, and Liwei Wang. Random mask: Towards robust convolutional neural networks. arXiv, 2020.
Gabriel Resende Machado, Eugênio Silva, and Ronaldo Ribeiro Goldschmidt. Adversarial machine learning in image classification: survey toward the defender's 's perspective. ACM Comput. Sure., 55(1), nov 2021.
Aleksander Madry, Aleksandar Makeloy, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant adversarial attacks. In International Conference Learn- ing Representations. OpenReview.net, 2018. URL https: hptp////ppreeeeeeeeee/eeee. net forum?
Hd=rJzIBf7Ab
10

---

Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017.
Tianyu Pang. Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. CoRR, abs/1901 Mos//990.08846,, 2019. URL http://arxiv.org:
1tte/190..088444
Nicolas Papernot, Patrick D. McDaniel, lan J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Anan- thram Swami. Practical black-box attacks against deep learning systems using adversarial exam- ples. CoRR, 2016. URL http::/ttaxaiii// org abs/ 602. 02697.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Timothy A. Mann. Fixing data augmentation to improve adversarial robustness. CoRR, abs/2103.01946, 2021a. URL htLttt::://aret
org/ httpg//bs/2213311944
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Timothy A. Mann. Fixing data augmentation to improve adversarial robustness. CoRR, abs/2103.01946, 2021b.
Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K. Reiter. Accessorize to crime: Real and stealthy attacks on state-of-the-art face recognition. Proceedings the the ACM SIGSAC
Conference Computer and Communications Security, pp. 1528-1540. ACM, 2016.
Mingxing Tan and Quoc Le. EfficientNet: Rethinking model scaling for convolutional neural net- works. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th In- ternational Conference on Machine Learning, volume 97 Proceedings of Machine Learning Research, pp. 6105-6114, PMLR, 09-15 Jun 2019. URL. https:://ppooeee
ngs. mllr.
preas/v97/tam19t.tte
Florian Tramèr. Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv, 2017.
Florian Tramèr, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In Advances in Neural Information Processing Systems, 2020.
Haotao Wang, Chaowei Xiao, Jean Kossaifi, Zhiding Yu, Anima Anandkumar, and Zhangyang Wang. Augmax: Adversarial composition of random augmentations for robust training. In Proc. NeurIPS, 2021.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv, 2017.
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv, 2017.
Chenglin Yang, Adam Kortylewski, Cihang Xie, Yinzhi Cao, and Alan Yuille. Patchattack: black- box texture-basee attack with reinforcement learning. In European Conference Computer Vision, pp. 681-698. Springer, 2020.
A APPENDIX
In this section, we provide the architecture details of two sample configurations for tessellated ResNet-50 employed for the CIFAR-I0 and CIFAR-100 image classification (the schematic diagram shown in Figure []. This enlisted configurations use = 20 tiles for Aperiodic tessellation and k = 16 for periodic tessellation since this value yielded the optimal results (we report the sensitivity later in Figure
Aperiodic tessellated ResNet-50 (with 20 sub-rectangles): Crop-layers (all parallel custom crops); 4X4 Upsampling and Resizing Layer convert to 224#224; Pretrained ResNet50; GlobalAverage- Pooling; Flatten; Dense 256; Concat: Dense 128; Dense 10.

---

periodic tessellated ResNet-50 (with 20 sub-rectangles): Crop-layers (uniform 8*8); 4X4 Upsam- pling and Resizing Layer convert to 224#224; Pretrained ResNet50; GiobalAverageePollng:: Flatten; Dense 256; Concat; Dense 128; Dense 10.
12


Reviews:
[{"review_id": "rcCFtvcCoju", "reviewer": "Reviewer_nZEg", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work propose a training pipeline to help defend against adversarial robustness. Specifically, an input image is partitioned into a number of non-overlapping sub-rectangles. Then each sub-rectangle is process by a shared branch of base neural network and further merged together to make a prediction. They show that this new training pipeline suffers less from adversarial attacks.", "summary_of_the_review": "See above.", "strength_and_weaknesses": "Strength:\n\n1. This paper is well-written and easy to follow.\n\n2. The proposed method to tessellate neural networks is simple and clear.\n\nWeakness:\n\n1. The proposed method suffers too much from in-distribution accuracy drop. Based on the results shown in Table 2, the proposed new method significantly reduces classification accuracy on the clean images. For example, on CIFAR-100, the standard ResNet can achieve around 77% accuracy whereas the proposed method can only achieve 50%. The significant in-distribution accuracy drop makes this method less practical. In addition, the low in-distribution accuracy makes the evaluation metric: difference between clean accuracy and adversarial accuracy is less reasonable. \n\n2. The proposed method does not have inspiring motivations and lack of sufficient contributions to the robustness research community. For example, in the Section 2.2.2, the authors discussed \"Why should tessellated networks be robust against adversarial attacks\" and mentioned that \"this offers an implicit ensemble\". Since ensemble does not harm in-distribution accuracy, I am not fully convinced by using this new training pipeline instead of simple ensemble if they share similar motivations.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "CkrHsB1UEa7", "reviewer": "Reviewer_KrRX", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper provides a novel CNN architecture that process input images as non-overlapping regions or tiles. The paper claims that the partition reduces the input dimension and diversifies the model architecture, which may provide effective defense against adversarial attack.", "summary_of_the_review": "In summary, the paper propose an novel and intereting model architecture against blackbox adversarial attack. However, the experiment results are inadequate to support the claim that the proposed method is effective. Thus I would recommend rejection for now.", "strength_and_weaknesses": "## Strength\n1. The paper proposes a novel model architecture that utilize diverse partition of the input image. To my knowledge this haven't been explored in previous work\n2. The paper is overall well written and easy to follow\n3. The proposed method shows natural improvement on blackbox robustness over regular model without the need of adversarial training\n\n## Weakness\n1. The experiment provided is inadequate to fully support the claim on improved blackbox robustness. All attacks provided in the paper are generated with a regular ResNet model, which naturally will have better transferability on a regular model than the proposed model. To fully verify the robustness of the proposed architecture experiment should be conducted on transfer attack generated against an independently trained TRN model with the same partition configuration. This is also a valid threat under blackbox setting, as only model architecture is known by the attacker.\n2. The proposed method is only tested against naive model, without any other baseline blackbox robustness improvement methods\n3. The attack effectiveness in Table 2 is doubtful. Even on the regular model the attack is not effective, especially for the FAB-T and SQUARE attack, which is unexpected. More information is needed on how the attack is implemented, an how is the convergence behavior in the generation of the attacks\n4. The paper mainly uses the $\\Delta$acc as the metric, which does not make sense. Given the tradeoff between clean accuracy and robustness, we want the robust model to have a better accuracy under attack than the clean model, not just a smaller accuracy drop. Otherwise a randome guess model will always have the best $\\Delta$acc = 0 under no matter what attack", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "CitPdgSnn_a", "reviewer": "Reviewer_z2SF", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a novel divide-and-conquer based approach of tessellating a base network architecture. Each tessellated network involves a separate set of learnable parameters. Experiments show this method is more robust against black-box attacks.", "summary_of_the_review": "This work presents an architecture with simple and intuitive idea, but there are no results on white-box attacks which are generated from tessellated network. The contributions to adversarial robustness are only marginally significant.", "strength_and_weaknesses": "Strength\n\n1. The paper is clear, and I had no trouble understanding it.\n2. The idea of this paper is simple and intuitive. \n\nWeaknesses\n\n1. There are no results on white-box attacks which are generated from tessellated network. The results on black-box attacks only show that this approach reduces the transferability of black-box adversarial attacks, rather than improving the adversarial robustness. Moreover, this is not consistent with your proposal that the ensemble of diverse network structures have been shown to exhibit robustness.\n2. This paper lacks more theoretical analysis of the tessellated network.\n3. This paper lacks related work on tessellation in images and in NN.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "BL4GZJUw6yJ", "reviewer": "Reviewer_n7Ya", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper tries to improve adversarial robustness via a new perspective: tessellated 2D convolutional network as a divide and conquer defence. The input image is first divided into several non-overlapping patches (regular or irregular), sent to parallel branches, and then the features from different patches are aggregated inside the network. The underlying idea is that such a network architecture leads to implicit feature transformation, cropping, masking and thus improve model robustness. Results on Fashion-MNIST and Cifar-10 validate the effectiveness of the proposed model to some extent.", "summary_of_the_review": "In general, I think this work proposes a interesting idea, but fail to prove its effectiveness. There is still a lot to improve. Maybe this work can be published at another conference after polishing.", "strength_and_weaknesses": "Strength: The idea of design a new architecture that allows the model to do implicit feature transformation to defend against adversarial attack  is novel. \n\nWeakness: \n1. The writing is poor. There are seven paragraphs in the Introduction section that focus on the background information of adversarial attack, and only four paragraphs talking about the proposed method. Many information in the first seven paragraphs seem irrelevant to the main idea in this paper. Reading the introduction is boring and tedious. Also, I fail to find any description regarding to the evaluation behavior of tesellating input images. It seems to me the two non-uniform tessellation methods are random operations, and how to keep the model predictions deterministic during evaluation is still a mystery based on this paper. Plus, does all the patches share the same model weight? Or there is a separate branch for each one of them? In the latter case, the model's computational cost is multipled.\n2. Lack of citations. This paper makes claims without any citation. For example, the last sentence in the first paragraph 'Architectural changes in the network topology is a promising means of achieving adversarial robustness ' is one without any citation. \n3. Lack of (experimental) proofs. The motivation of this paper is a hypothesis: 'modification of the network structure leading to implicit feature transformation, cropping, masking, and distillation may result in improved robustness'. To verify this hypothesis, the authors should at least show some experiments demonstrating that explicit image-level cropping or masking or other transformations will help the model defend against adversarial attack, and embedding such a prior knowledge into the architecture design is a similar but more efficient implementation. However, I fail to see any such experiment. \n4. Poor experiment designs. This paper introduces a new metric called weighted accuracy (accw) without enough justification. This paper only experiments on very simple CNNs. The results in Table 2 show that a modern architecture like ResNet can easily beat the proposed T-2D-CNN in terms of both clean accuracy and robustness, let alone lots of more powerful networks have been developed after ResNet. Furthermore, the images in the two used datasets in this paper are of small resolutions (28 or 32). What's the effect of the proposed T-2D-CNN on larger images, like 224x224?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject