Tessellated 2D Convolution Networks: A Robust Defence against Adversarial Attacks
Authors: Swarnava Das
Pabitra Mitra
Debasis Ganguly
Venue: ICLR 2022 Submitted (2022)

Abstract: Data-driven (deep) learning approaches for image classification are prone to adversarial attacks. This means that an adversarial crafted image which is sufficiently close (visually indistinguishable) to its representative class can often be misclassified to be a member of a different class. A reason why deep neural approaches exhibits such vulnerability towards adversarial threats is mainly because the abstract representations learned in a data-driven manner often do not correlate well with human perceived features. To mitigate this problem, we propose the tessellated 2d convolution network, a novel divide-and-conquer based approach, which first independently learns the abstract representations of non-overlapping regions within an image, and then learns how to combine these representations to infer its class. It turns out that a non-uniform tiling of an image which ensures that the difference between the maximum and the minimum region sizes is not too large is the most robust way to construct such a tessellated 2d convolution network. This criterion can be achieved, among other schemes, by using a Mondrian tessellation of the input image. Our experiments demonstrate that our tessellated networks provides a more robust defence mechanism against gradient-based adversarial attacks in comparison to conventional deep neural models.

Under review as a conference paper at ICLR 2022
TESSELLATED 2D CONVOLUTION NETWORKS: A Ro- BUST DEFENCE AGAINST ADVERSARIAL ATTACKS
Anonymous authors Paper under double-blind review
ABSTRACT
Data-driven (deep) learning approaches for image classification are prone to ad- versarial attacks. This means that an adversarial image which is sufficiently close (visually indistinguishable) from true image of its representative class can often be misclassified be a member of different class. A reason why deep neural ap- proaches exhibits such vulnerability towards adversarial threats is mainly because the fact that the abstract representations learned in data-driven manner often do not correlate well with human perceived features. To mitigate this problem, we propose the tessellated 2d convolution network, a novel divide-anddconquee based approach, which as first step, independently learns the abstract representations of non-overlapping regions within an image, and then learns how to combine these representations to infer its class. It turns that non-uniform tessellation of an image which seeks to minimize the difference between the maximum and the minimum tessellated areas the most robust way to construct such tessellated 2d convolution network. This criterion can be achieved, among other schemes, by using a Mondrian tessellation of the input image. Experiments demonstrate that our proposed method of tessellated network provides more robust defence mechanism against gradient- adversarial attacks comparison to conven- tional deep neural models.
INTRODUCTION
Deep neural networks are known to be susceptible to adversarial attacks. Image representations learned by a deep neural network differ from their visual interpretation. Attackers exploit this fact by introducing imperceptible evasive perturbation in set of test images such that the victim net- work misclassifies them (Joseph et al. 2019). Defending neural networks against such adversarial attacks is of significant theoretical and practical importance. Major approaches to defence against such adversarial threats include adversarial training (Madry et al. 2018), network distillation (Pa- pernot al. 2016), input randomization (Xie et 2018)), activation pruning (Dhillon al. (0188), gradient masking (Goodfellow (018)) input transformation (AprilPyone & Kiyal (2020), and ensem- ble methods (Tramer et al. (017) name few. Architectural changes in the network topology is promising means of achieving ad versariaal robustness.
Well known evasive attacks include the gradient based input perturbation strategies such as fast gradient sign method (FGSM) (Goodfellow et al. 2015), and the projected gradient descent (PGD) (Madry al. 2018) methodologies. Universal attacks that are image-agnostic and add the same perturbation for all input images while still modifying the class labels are also prevalent (Moosavi- Dezfooli et al. 2017). Norm based attacks seeking optimize the perturbation were subsequently proposed to victimize newer defence strategies (Carlini & Wagner 2017: Croce & Hein 2019). Patch attacks, which involve perturbing image segments rather than the image pixels, have also been attempted (Sharif al. (2016). More recent attacking approaches include the of ensembling- based strategics with a capability to adapt on the defence mechanisms employed (Tramèr et al. 2020).
Depending on the amount of information exposed to an attacker, an attack corresponds to one of the two types, namely i) black-box attack, those with little knowledge about the target model, and ii) woite-box attack, where additional information about the network available (c.g.. in the form of architecture, optimization function used, model parameters etc.). A black-box attack often

---

Under review as a conference paper at ICLR 2022
involves substituting the victim network by a proxy network, constructed with the help of small p number of interactions with an oracle (Papernot et al., 2016). In between the two extremes of the black-box and white-box variants lies the gray-box attack, where the parameter values of trained model are not available to an attacker; however, other information about the model (e.g. architecture details and optimization/activtioon functions) are available (Vivek al.] 2018). It has been reported that attacks methods can usually be effectively transferred to similar networks in a gray-box threat scenario. Numerous other threat scenarios like transf,r-based, score-based, and decision-based black-box attacks are known in the literature (Ren et al. 2020 Dong et al. (020).
As newer attacks are being developed, designing networks that are robust adversarial attacks has been an ongoing game. Among the most popular defence mechanisms are the ones that are based on adversarial training using the samples generated by attacks such as FGSM [Goodfellow et al. 2015) and PGD Madry et al. (2018) or their ensemble (Tramèr et al. (017). State-of-the-ar defences as reported in the RobustBench (Croce et al. 2020) benehmark dataset include those based on data augmentation for adversarial training (Rebuffi et al., (222)) well as those that are based on transformation or randomization of model parameters (Gowal et al. 202T).
Various randomized image transformation schemes such as cropping, padding, compression, block segmentation, noise addition to convolution layer features demonstrate adversarial robustness (Xie) eet al. 2017 Liu et al., 2018; AprilPyone & Kiyal 2020) Input rectification schemes attempts to remove adversarial perturbations by denoising. image blurring and depth reduction Xu et al. (017). Transformation of the features at the output of the convolution layers like activation pruning Goodfellow 2018), denoising, are often equally effective Dhillon et al. (2018): Liao et al. (0018).
Regularization and dropout are recently being used for achieving adversarial robustness (Wang et al. 2018 B.S. & Babu 22200 Jordão & Pedrini 2021). A study on the effect of regularization and sparsity with respect to the adversarial robustness of network can be found in (Schwartz et al. 2020 Pang et al. 22020). Generating diverse structured networks as a tool for robustness has been proposed in (Du et al. [22T]] Pang et al., 2019). An alternative convolutional network (CNN) archi- tecture which randomly masks parts of the feature maps also demonstrates adversarial robustness
(Luo et al. 2020).
Architectural robustness provides an attractive defense mechanism that is agnostic to attack strate- gies. As a motivation of the work in this paper, we hypothesize that modification of the network structure leading to implicit feature transformation, cropping, masking, and distillation may result in improved robustness against adversarial attacks in an attacking method agnostic manner. Incorpo- ration of diversity in network topology may also act as effective defence against ensemble attacks. Consequently, reconfiguring the topology of a network may provide effective defence against adap- tive adversarial attacks.
In this paper, we propose two dimensional tessellated convolutional networks (TCNN) that incorpo- rates the effects of cropping, masking and feature transformation within single framework. In our approach, an input image is partitioned into blocks (tiles) according to a tessellation (tiling) pattern. Each region of the input image makes use of a separate branch in the computation graph to propagate its effects forward in the form of feature representations. The individual feature representations then interact with each other for the eventual prediction of an image class (see Figure I for a schematic representation).
We investigate the use of three types of rectangular tessellation patterns, namely, regular grid tiling, tiling with non-uniform rectangles, and Mondrian partitioning (Roy et al. (2008) with set of addi- tional constraints on the rectangles. Existing research has applied Mondrian kernels for generating features Balog et al. (2016), and has also generalized Mondrian partitions for higher than 2 dimen- sions LeFevre et al. (2006).
Specifically, constraints in Mondrian tiling correspond to the following.
The rectangular tiles are pairwise non-congruent, i.e., each rectangle must have a different dimension (widths and height values), e.g., a 2x8 rectangle can only be used only once. Note that this constraint does not prevent the use of another rectangle with different dimension but identical, e.g., a 4x4 rectangle can be used combination with a 2x8 one.
The difference in the area of the largest and the smallest tiles is to be minimized. This difference is known the score of the tiling.
2

---

Under review as a conference paper at ICLR 2022
y (Image class)
Softmax
Dense
Merge
y (Image class]
Dense
Dense
Dense
Softmmax
Max- Pooling
Max Mao-Pnnling
Max Maoling
Dense
2D convolution
2D convolution
2D convolution
f
Max Pooling
Max Max-Pooling
Max- Pooling
Max-Pooling
convolution
convolution
20 convolution
20 convolution
X1
Mox-Pooling
2D convolution
l/p image regions (tiles)
Tiling Algorithm
(i/p Image)
(Vp Image)
Figure 1: Architectural overview of the proposed approach of Tessellated 2D convolutional neural networks for defence against adversarial attacks image classification networks. The left part of the figure depicts a standard layered 2D convolutional neural network for image classification. The right part of the figure shows our proposed method - 2D Tessellated ConvNet (TCNN), where, first, the input x E Rddd is partitioned into io-instaances (non-overlapping image regions) x, such that UXx;
While the first constraint ensures that there exist no parts in the overall computational graph with duplicate dimensions, the second one prevents solutions that employ too large or small image regions. The implication of the former is that it is difficult for an adversarial attack to expose vuinerable sub-network more than once (thus increasing the overall vulnerability), while the im- plication of the latter is that the individual feature representations of the tiles adequately represent meaningful parts the overall image.
In our experiments, we find that 2D tessellated convolutional networks (2D-TCNNs) more robust to well known attacks as compared to standard networks. Morcover, among the three different tiling approaches explored, Mondrian tiling based 2D-TCNN leads more robust results against adversarial attacks.
2 TESSELLATED CONVOLUTIONAL NETWORK
In this section, we describe our proposed method of Tessellated Convolutional Network (TCNN). We specifically focus on the 2D convolutional networks.
Figure [ presents the idea of TCNN. An input image is first partitioned into non-overlapping rectangular tiles using a tessellation scheme. Parallel branches of convolution and pooling layers of the tiled CNN then process each input segment. The convolution and pooling layers in each branch terminates in dense layer of parameters leading to feature representation of part of the overall image corresponding to that tile. The output from these dense layers, each representing an abstract representation of rectangular region of an image, then concatenated in the merge layer and processed through yet another dense layer. The output layer is a softmax that is finally used to predict the discrete class label.
We use three tessellation schemes, namely, regular (or uniform), non-regular (or non non-uniform), and Mondrian. Details of these partitions are presented next. The main focus of our paper is investigate
3

---

Under review as a conference paper at ICLR 2022
if the seride-and-conquee based approach of a tessellated network can lead to more robust defences against adversarial threats. For simplicity, we thus restrict our investigation to simple 2D convolution networks, instead of experimenting with more complex (in terms of depth and width) networks, e.g. ImageNet (Szegedy et al. 2013) or networks that use more involved connections between layers, proposed divide-and-conquer based approach is generic enough to be applied on more complex computation graphs such as those of ImageNet or ResNet, which we leave future work.
e.g. the ResNet (He al. 20T6). However,
2.1 TESSELLATION METHOSS
A tessellation of an d x d square image is complete tiling of the image with non-overlapping tiles. Although the concept of tessellation can, in general, involve (even non-convex) polygons, the tiles, with which cover input image always refers to rectangles in the context of our problem.
parameter to the tessellation process the number of mutually disjoint rectangles used. Formally, each input Rdxd is partitioned into & sub-instances x; such that U,X;
To uniquely specify a tessellation of an input instance x E Rdxd each tile x; E R. of width w; and height h; is associated with a location, as specified by the row and column index of its top-left location, i.e., p(x,) = (ri, ()) such that S r; I - h4 and 1 S & S d - w;. Each tiling method, that we investigate, generates list of such rectangular tiles.
2.1.1 REGULAR TESSELLATION
The simplest tessellation that investigate is the uniform one, where each tile is square. The parameter k for regular rectangular tessellation controls the number squares used to cover x Rdxd and is perfect square, i.e., h = m2 for some m Z.
2.1.2 APERIODIC TESSELLATION
In non- unn-uniform tessellation, an input image of size d x d is split into rectangular blocks of arbitrary sizes with low likelihood that any two rectangles will of equal area. We employ a recursive split and merge approach to generate a non-uniform tessellation. At each step we employ either split or a merge operation depending on whether m (the present number of tiles) is higher than or lower than & (the desired number of tiles).
m < L, we randomly select a rectangle and split it into two parts. The position of the splitting line and its direction (horizontal or vertical) is chosen randomly. The split operation always leads to increasing the total number of tiles by (see Figure 2b for an illustrative example). Otherwise, merge rectangle with other rectangles that are adjacent to it with respect (one of top, right, bottom or left). Figure 2c illustrates an example of merging a tile with the ones that are right-adjacent to it. The merge operation mostly leads to increasing the number of tiles.
direction
We carry out a sequence of random split and merge operations on randomly selected tiles (sampled with uniform probability) unless the desired number of tiles (the parameter k) reached. After every split or merge operation, we employ a post-hoc step which checks if any of the tiles is too small or too large (specifically, area less than 52 or greater than (3/4d)².. If the split or merge operation generates rectangle whose area is either less than or higher than the two thresholds, then the step undone.
It is also possible to generate non-uninee non-uniform tessellations with other policies as well, e.g., with the use of Bayesian non-parametric space partition methods as surveyed (Fan et al. 2021
2.2 MONDRIAN TESSELLATION
The Mondrian tessellation is non-uniform tessellation which is obtained by solving a constrained optimization problem. The objective to minimize the difference between the area of the largest and the of the smallest rectangle with the constraint that the rectangles are non-congruent to
4

---

Under review as a conference paper at ICLR 2022
(a) Regular tiling
(b) Split operation
66
Sx
(c) Merge operation
(d) Mondrian Tiling
Figure 2: (a) Regular tiling of 9 x 9 image with 3 x 3 square tiles (d - 9, = 9); (b) Illustration of the effect the split operation on a tiling the yellow colored rectangle on the left part of the figure is transformed into two blue rectangles shown in the tiling shown along the right; (c) Illustration of the effect of the merge operation on a tiling the yellow colored rectangle on the left part of the figure is merged with the rectangles night-adjacen to it; this operation for this example does not increase or decrease the total number of tiles (as seen on the right part of the figure); (d) A Mondrian tiling for 14 x 14 square grid, note that the tiles mutually non-congruent, the Mondrian score for this tiling is optimal, the value being 6 6 3 10 6.
each other. Formally speaking, for square grid
Minimizes max w. min wyhy, s.t. fi,j whh, = wyh h A (w; wy)(w; h2) (1)
isisk. k. 13 S k, Vil I w; S d. A1 s h4 S d.
where w; and h; denote the width and the height of the 7th rectangle, and k: the number of tiles in the current solution. The con-congreence constraint requires that if rectangle with dimensions x has already been used in the tiling, then another rectangle dimension or b a cannot be used.
The constrained optimization problem is solved with the following steps first by enumerating all possible partitions of the number d² (the total area of the grid) by dynamic programming, second, by generating all possible factors of each element of the partition, and third, by generating the tiling by the Exact-Cover algorithm (Junttila & Kaski 2010);
(Bassen 2016) for more details.
For our problem, since images are of fixed size we did not require to find the optimal solution to the Mondrian problem for unknown values of grid sizes. Instead, CIPHAR-10 images (of size 28x28 and 32x32, respectively), we used the known configuration of optimal Mondrian tiling as reported in (Bassen 2016). In fact, found that instead of using the solution for 28 and 32, splitting the original images into blocks of 14x 14 and 16x 16 and employing four copies of optimal Mondrian tilings for 14x 14 and 16x 16 sizes yielded better results. Figure 2d shows the solution for the 14x14 block. Note that employing copies of Mondrian solution for d/2 x d/2 grid eventually relaxes the global constraint of con-congree of the tiles because in this case we allow duplicate tiles across the different d/2 x d/2 blocks.
work with the FMNIST and
Reason why tessellated network should work well against ad adversarial attacks. The tessellated 2D convolution network dedicates separate branch for each of the tiles shown in [

---

Under review as a conference paper at ICLR 2022
later combined in dense layer. This offers implicit ensemble of the features computed be each branch. Empirically, ensemble of diverse network structures have been shown to have robustness Du et al. (202T): Pang al. (019). Adopting non-regular (and non-congruent) image tessellation scheme leads to diversity in the computational graph of the branches of tessellated CNN.
However, generation of non-regular tessellation patterns with large variation in sizes of the tiles may result in very large or too small sub-rectangles. Empirically we find that this harms the accuracy of the tessellated network on non-adversarial samples. Optimal and near optimal Mondrian patterns having low Mondrian scores (the value of in Equation D avoids such skew while using diverse shaped non-congruent sub-rectangles. This trade-off between performance on clean images and robustness to ad adversarial attacks has also been noted in previous studies. Both methods of generating non-uniform tessellations (Mondrian and those obtained with the split-merge operations) lead to better handling of this trade-off.
3
EXPERIMENTAL SETUP
In this section we present details of our experimental setting.
3.1 DATASETS
Two benchmark image classification datasets were used in experiments experiments. Fashion- MNIST, variant of the standard MNIST dataset, which consists 10 classes each belonging to certain fashion category used. Each image of the dataset is 28 28 sized grayscale image. The training set consists of 60000 examples and a test set of 10000 examples. For a color image dataset, where adversarial perturbations are less perceptible, the CIFARI 10 dataset was used. The CIFAR-I0 dataset consists of 60000 32 x 32 colour images in 10 classes, with 6000 images per class. There are 50000 training images and 10000 test images.
3.1.1 ADVERSARIAL ATTACKS
Black-box untargeted versions of the two most standard adversarial attacks: FGSM (Fast Gradient Signed Method (Goodfellow al. 2015)) and PGD (Projected Gradient Descent (Madry et al, 2018) attacks were performed the models for the purpose of the experiment.
For consistency, all the adversarial examples were generated apriori, and the same ones were used across every experiment. The FGSM examples were generated by applying fxc perturbations of E = 8/255 = 0.03 on normalized test sets. For the PGD examples as well, we used & = 0.03, num stem_steps 20, and step_size 2.5 num_steps, where num_steps is the number of iterations of the PGD algorithm. In both the attacks we assume the victim network to be a standard 2D-CNN.
3.2 EVALUATION METRICS
To gauge the robustness of aforementioned models, it was necessary to compute and compare certain performance metrics, prior to and following the adversarial attacks.
Besides comparing classification accuracy (acc), a custom metric called weighted accuracy (accw) was defined to represent the misprediction well the confidence of misprediction with a single numeric value. It is defined as
acCw = - mp confmp:
where, mp denotes the mispredictions rate (i.e., 1 acc), and confmp denotes the average prediction confidence for misclassified examples. The confidence is measured in terms of normalized softmax output values. A low value of difference the metrics for clean and adversarially perturbed input examples (Aacc, Aaco,) denotes better robustness.
3.3 TESSELLATION AND NETWORK PARAMETERS
In the proposed tessellated 2D convolution network, several experiments were performed over differ- ent tiling schemes, varying number of crops, different attacks, etc, to identify the most adversarially

---

Under review as a conference paper at ICLR 2022
resistant settings. For the fashion MNIST 28 x 28 images optimal Mondrian tessellation for n = 28 was used with a total of k = 24 non-congreent sub-rectangles. The Mondrian score for this pattern is 9. The CIFARIO 32 x 32 images were similarly split into four 16 x 16 blocks, for which known optimal Mondrian patterns are used consisting of a total k = 20 non-congruent rectangles. The Mondrian score for this solution is 9. We do not use Mondrian solutions for high values of to avoid large Mondrian score solutions even though they are optimal. In this process we sacrifice non-congruence in favor of lower Mondrian score. For regular lessellations we split the image into (k = 4 x 4 16) equal sized square blocks for all the experiments in both datasets. For aperiodic tessellation we split the input images into 22 rectangesss for fashion MNIST, and sub-rectangles for CIFAR 10 using the spiral pattern generation process described in Section 2.1.2 Note that, owing to the random initialization of the aperiodic spiral pattern generation process, mul- tiple tessellations with identical values of k may be generated. We report the average value of the evaluation parameters over all such configurations in Section
20
The network layer structures for each of the CNN and the tessellated CNNs (Figure considered in our experiments for the fashion MNIST dataset are mentioned below:
1. Basic CNN: 28 3x3 Conv; Pool 2x2; 56 3x3 Conv; Pool 2x2; 56 3x3 Conv; Flatten & Concat; Dense 512; Dense 128; Dense 10.
2. Regular tessellated CNN (with 4 x = 16 sub-rectangles): Crop-layers (16 parallel); 28
3x3 Conv; Pool 2x2; 56 3x3 Conv; Pool 2x2; 56 3x3 Conv; Flatten & Concat; Dense 512; Dense 128; Dense 10.
3. Aperiodic tessellated CNN (with 22 sub-rectangles): Crop-layers (all parallel custom crops); 28 3x3 Conv; Pool 2x2/2x1/1x2/Ix1 56 3x3 Conv; Pool 2x2/2x1/1x2/1x1; 56 3x3 Conv; Flatten & Concat; Dense 512; Dense 128; Dense 10.
4. Mondrian tessellated CNN (with 24 sub-rectangles); Crop-layers (all parallel custom crops); 28 3x3 Conv: Pool 2x2/2x1/1x2/xx1 56 3x3 Conv; Pool 2x2/2x1/1x2/1x1 56
3x3 Conv; Flatten& & Concat: Dense 512; Dense 128; Dense 10.
For the aperiodic and Mondrian tessellations, in the custom maxpooling layers with window sizes 2 x 2, 2 x I, 1 x or x 1 options are used, (instead of the usual 2 x 2) to avoid pooling across a dimension of tile, if that dimension size is too small.
The categorical cross-entropy is used as the loss function, and the Adam optimizer is used for train- ing with batch size of 32. All models were trained for 10 epochs.
4 RESULTS
Results from the experiments performed under different settings defence for too perturbation of E = 8/255 0.03 FGSM (Goodfellow et al. 2015) and PGD (Madry et al. 2018) black-box attacks is reported in Table 1 The goal of these experiments is to study if a partitioning method applied on a specific network structure offers a significant improvement over the "non- porttttattiioeed" counterpart. It was observed that the drops in classification accuracy as well in riightdd-acuuraye both in the cases of FGSM and PGD attacks, happens to significantly reduce for the tessellated convolutional network as compared vanilla 2D Convolution Network. We further observed that the aperiodic and Mondrian methods seem to have lower accuracy drop than regular tessellation in most cases.
The number of sub-rectangles k used in a tessellation is a hyperparameter of our model. We show a plot of the variation in classification accuracy for clean and FGSM attacked test samples for the fashion MNIST dataset in Figure 3 a) for regular, aperiodic, and Mondrian tessellations. The drop in accuracy is also plotted in Figure 3 b). A higher for perturbation of = 0.04 was considered to study the effect of hyperparameter variation. We study the effect of variation in hyperparameter à only for the regular and aperiodic tessellations; since, the number of rectangles are fixed in Mondrian patterns. The accuracy and drop in accuracy values for the Mondrian tessellations (k = 24) are shown as a baseline in the figure. It is seen that the drop of accuracy has a valley when around 22 number of sub-rectangles are used in aperiodic tiling, and 16 sub-rectangles for regular tiling. The robust accuracy for attacked samples is less when very low number of rectangles are used. On the other hand the drop in accuracy increases when a very large number of rectangles are used due to increase in skewness. Similar trends were observed for other datasets and attacks.
7

---

Under review as a conference paper at ICLR 2022
Table 1: Performance of Tessellated 2D convolutional neural networks against lxc. 8/255 FGSM and PGD adversarial attacks. Hyperparameter values of the number of sub-rectangles in the tessellation for the FMNIST dataset are: regular (A: 16), aperiodic (A: 22). Mondrian
24). Values for the CIFARIO 10 dataset are: regular (A 16), aperiodic (k 20). Mondrian (k 20). Bold typeset values denote the best performance across networks for each metric and each attack type. Bold underlined values shows the best Aace and Aace, metrics for the PGD attack for each dataset.
FMNIST
CIFAR-10
Network
Tessellation
Attack
Aace
Aaccw
Aace
Aacc.
2D-CNN
None
0.9136
0,9360
0.7337
0.8281
2D-CNN
FGSM
0.7864
0.1272
0,8350
0.1010
0.3989
0.3348
0,5794
0.2487
2D-CNN
PGD
0.7552
0.1584
0,8057
0.1303
0.3291
0.4046
0,5241
0.3040
2D-TCNN
Regular
None
0.9080
0.9279
0.6527
0.7810
2D-TCNN
Regular
FGSM
0.8617
0.0463
0.8908
0.0371
0.51
0.1408
0.6834
0.0976
2D-TCNN
Regular
PGD
0.8549
0.0531
0.8851
0.0428
0,5006
0.1521
0.6694
0.1116
2D-TCNN
Aperiodic
None
0.9104
0,9320
0.6487
0.7868
2D-TCNN
Aperiodic
FGSM
0.8585
0.0519
0.8909
0.0411
0.5166
0.1321
0.6951
0.0917
2D-TCNN
Aperiodic
PGD
0.8503
0.0601
0.8841
0.0480
0.5011
0.1476
0.6788
0.1080
2D-TCNN
Mondrian
None
0,9029
0,9242
0. 0.6409
0.7797
2D-TCNN
Mondrian
FGSM
0.8543
0.0486
0.8834
0.0408
0.5080
0.1329
0.6880
0.0917
2D-TCNN
Mondrian
PGD
0.8469
0.0560
0.8768
0.0474
0.5017
0.1392
0.6789
0.1008
0.12
Regular
Aporlods 5.00
Mondtar
0.9
Accunayy (005)
0.09
0.88
0.84
0.07
0.08
0.8
ReguAtr 300
Rogu of Altock 300.
woz
0.04 10
20
Number of sub roctangies (K)
Number of sub rectangles (4)
(a)
(b)
Figure 3: Variation of (a) Classification accuracy (acc) on clean, and FGSM attacked (f = 0.04) test examples, and (b) drop in accuracy (Aace), with the number of sub-rectangles (hyperparameter k) in for the fashion MNIST dataset. The circled points in (b) correspond to smallest Aace for regular and aperiodic tessellations. Since, l 24 is fixed in Mondrian tessellation show it baseline in the plots.
We compare the performance of the proposed tessellated convolution network (T-CNN) with some of the well known defence strategies for the gradient based black-box untargeted attacks FGSM and PGD. We report results for the CIFAR10 dataset. The following methods were compared:
2D-CNN
Regular tessellated 2D-CNN (T-2D-CNN)
Aperiodic tessellated 2D-CNN (T-2D-CNN)
Mondrian tessellated 2D-CNN (T-2D-CNN)
Adversarial trained (A-T) ResNet using FGSM samples (Goodfellow et al. 2015
Adversarial trained (A-T) ResNet using PGD samples (Madry et al. 2018
8

---

Under review as a conference paper at ICLR 2022
Table 2: Accuracy (acc), and drop accuracy (Aacc) of compared models for FGSM and PGD
adversarial attacks for CIFARIO dataset. Bold typeset values indicate best Aace for an attack.
Network
None (acc)
FGSM (acc)
FGSM (Aacc)
PGD (acc)
PGD (Aacc)
2D-CNN
0.7337
0.3989
0.3348
0.3291
0.4046
Regular (k: 16) C2D-CNN
0.6527
0.5119
0.1408
0,5006
0.1521
Aperiodic (k: 20) T-2D-CNN
0.6487
0.5166
0.1321
0,5011
0.1476
Mondrian 20) T-2D-CNN
0.6409
0,5080
0.1329
0,5017
0.1392
A-T FGSM ResNet
0.8740
0.9090
-0.0350
0.2105
0.6635
PGD ResNet
0.7940
0.5170
0.2770
0.4370
0,3570
PixelDefend ResNet
0.7900
0.3985
0.3915
0.2989
0.4911
I-T ResNet
0.7214
0.6665
0.0549
0,4030
0.3184
PixelDefend generative model based training data augmentation for ResNet (Song al., 2018), and
Input transformed (I-T) (cropping, quilting, total variance maximization) test examples and ResNet (Guo et al. 2018).
Even though the clean and robust accuracy of the ResNet based models are higher compared to CNN based ones due to their higher capacity, we observe lesser drop in accuracy after attack (Aacc) in the proposed tessellated CNN models.
The classification accuracy are shown in Table 2
CONCLUSIONS AND FUTURE WORK
We present tessellated 2D convolutional network divide and conquer defence against adver- sarial attacks for image classification. The network first partitions the input image into a number of non-overlapping sub-rectangles. Each sub-rectangle is then processed by parallel branch of the CNN terminating in dense layers. The output of these branches are concatenated and passed through another dense layer to obtain the final softmax classification scores. Three input image partitioning strategies namely, regular, aperiodic, and Mondrian is considered. We achieve good degree of robustness in this approach as compared to non-tessellated networks. The implicit parallelization of the computation graphs into diverse branches while maintaining balanced sized partitions produces feature transformations that leads to high classification accuracy on clean data while providing ad- versarial robustness.
Studies on other space partitioning techniques may help in devising more diverse classes of tes- sellated networks. Similarly, tessellation structures for other networks like residual nets and wide residual nets may be considered future.
REFERENCES
MaungMaung AprilPyone and Hitoshi Kiya. Block-wise image transformation with secret key for adversarially robust defense. CoRR, 2020. URL htttttttt////rtete http://wwwwwvooog//////a////////
00801
Matej Balog, Balaji Lakshminarayanan, Zoubin Ghahramani, Daniel M. Roy, and Yee Whye Teh. The Mondrian kernel. In Proceedings the Conference Uncertainty in Artificial Intelligence, pp. 32-41, 2016.
Hannes Bassen. Further insight into the mondrian art problem, 2016. mathpickle www.coom/ooo..m mondr iian art pest-puzzles-see soletesssoliiino
URL
https:/
Vivek B.S. and R. Venkatesh Babu. Single-step adversarial training with dropout scheduling.
IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 947-956. 2020.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017
IEEE Symposium Security and Privacy, pp. 39-57, 2017.

---

Under review as a conference paper at ICLR 2022
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. CoRR, abs/1907.02044, 2019. URL http:://axxv.orr//abss..
02044
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. RobustBench: a standardized adversarial robustness bench- mark. CoRR, abs/2010.09670. 2020. URL/atts:///axxv wttp://////bb......../// 09670
Guneet S Dhillon, Kamyar Azizzadenesheli, Zachary C Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Anima Anandkumar. Stochastic activation pruning for robust adversarial de- fense, arXiv, 2018.
Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu. Benchmark- ing adversarial robustness image classification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 321-331, 2020.
Xuefeng Du, Jingfeng Zhang, Bo Han, Tongliang Liu, Yu Rong, Gang Niu, Junzhou Huang, and Masashi Sugiyama. Learning diverse-structured networks for adversarial robustness. CoRR, 2021.
URL https: /aee::/axxxii aaaaiiiiivo.. org/ abs/2/0.. 01886
Xuhui Fan, Bin Li, Ling Luo, and Scott A. Sisson. Bayesian nonparametric space partitions: A
survey, 2021.
Goodfellow. Gradient masking causes clever to overestimate adversarial perturbation size. arXiv preprint arXiv: arXiv:1804.077 07870, 2018
lan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015. URL http://
arxiv. www.oo/aassss.. abs /1412.11122.66 6572
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the
limits of adversarial training against norm- com-bounded adversarial examples, 2021.
Chuan Guo, Mayank Rana, Moustapha Cissé, and Laurens van der Maaten. Countering adversarial
images using input transformations. In International Conference on Learning Representations, 2018. URL
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp- 770-778, 2016. doi: 10.1109/CVRR.206.9900
Artur Jordão and Hélio Pedrini. On the effect of pruning on adversarial robustness. CoRR, 2021.
URL httph:htt///aatt /ttpiv/aaxvvvv/a org/ abs/ 2200.111111. 04890
Anthony D. Joseph, Blaine Nelson, Benjamin I. P. Rubinstein, and J. D. Tygar. Adversarial Machine Learning. Cambridge University Press, USA, 2019. ISBN 1107043468.
Tommi Junttila and Petteri Kaski. Exact cover via satisfiability: An empirical study, In David Cohen (ed.), Principles and Practice Constraint Programming- CP 2010, pp. 297-304, Berlin, Heidelberg, 2010. Springer Berlin Heidelberg. ISBN 978-3-642-15396-9)
K. LeFevre, D.J. DeWitt, and R. Ramakrishnan. Mondrian multidimensional k-anonymity. In Inter- national Conference on Data Engineering (ICDE'06) pp. 25-25, 2006.
Fangzhou Liao, Ming Liang, Yinpeng Dong. Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1778-1787, 2018.
Xuanqing Liu, Minhao Cheng, Huan Zhang, and Cho-Jui Hsieh. Towards robust neural networks via random self-ensemble. In Proceedings of the European Conference Computer Vision, pp. 369-385, 2018
Tiange Luo. Tianle Cai, Mengxiao Zhang, Siyu Chen, and Liwei Wang. Random mask: Towards robust convolutional neural networks. arXiv, 2020.
10

---

Under review as a conference paper at ICLR 2022
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In International Conference on Learn ing Representations. OpenReview.net, 2018. URL
nwt/ forum?
id=rJzIBf2an
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017.
Tianyu Pang. Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. CoRR,
2019. URL http://arxiv..t
abs/1901.0882 08846
Tianyu Pang. Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In International Conference on Learning Representations, 2020.
Nicolas Papernot, Patrick D. McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Anan- thram Swami. Practical black-box attacks against deep learning systems using adversarial exam- ples. CoRR, 2016. URL http://t//// /ttp///axvvvvv//a wwwp:wwwwww.w//w.o//o.. 602. 02697
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A. Calian, Florian Stimberg, Olivia Wiles, and Timothy A. Mann. Fixing data augmentation improve adversarial robustness. CoRR, abs/2103.01946, 2021.
URL http:tpps///.x.voooooroaa///////
01946
Kui Ren, Tianhang Zheng, Zhan Qin, and Xue Liu, Adversarial attacks and defenses in deep learn- ing. Engineering, 603):46-360,, 2020.
Daniel M Roy, Yee Whye Teh, et al. The Mondrian process. In NIPS, pp. 1377-1384, 2008.
Daniel Schwartz, Yigit Alparslan, and Edward Kim. Regularization and sparsity for adversarial robustness and stable attribution. In Advances in Visual Computing International Symposium, ISVC, volume 12509 of Lecture Notes in Computer Science, pp. 3-14. Springer, 2020.
Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K. Reiter. Accessorize crime: Real and stealthy attacks on state-of-the-are face recognition. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, pp. 1528-1540. ACM, 2016.
Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. PixelDefend: Leveraging generative models to understand and defend against adversarial examples. In Inter- national Conference on Learning Representations, 2018.
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Du- mitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In 2015 IEEE Conference Computer Vision and Pattern Recognition (CVPR), pp. 1-9, 2015. doi: 10.110900 (099C/VR..21...7999999999999
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv, 2017.
Florian Tramèr, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In Advances in Neural Information Processing Systems, 2020.
B. S. Vivek, Konda Reddy Mopuri, and Venkatesh Babu. Gray-box adversarial training. In Vittorio Ferrari, Martial Hebert, Cristian Sminchisescu, and Yair Weiss (eds.), Computer Vision ECCV European Conference, Proceedings, Part XV, volume 11219 of Lecture Notes Computer Science, pp. 213-228. Springer, 2018.
Siyue Wang, Xiao Wang, Pu Zhao, Wujie Wen, David Kaeli, Peter Chin, and Xue Lin. Defensive dropout for hardening deep neural networks under adversarial attacks. In Proceedings of the International Conference on Computer-Aided Design, pp. 1-8, 2018
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv, 2017.
11

---

Under review as a conference paper at ICLR 2022
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. In International Conference on Learning Representations, 2018.
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv, 2017.
12


Reviews:
[{"review_id": "tC1vkrY-fL", "reviewer": "Reviewer_Znf4", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "### Strengths\nIt is interesting that this paper proposes to make the computation of each subnetwork heterogeneous by splitting the input into tiles. The reviewer believes that this approach may be novel in this regard.\n\n### Weaknesses\n* This paper did not provide sufficient justification for the choice of tiling methods.\n\t* The paper did not provide insights into why different tiling schemes could bring different robustness impacts.\n\t* Specifically, it is perceivable that tiling with different random seeds with the same number of tiles would incur a high degree of variance in the evaluated accuracies. It is important to repeat the experiments and report the mean and variance of the results. This is especially problematic for the Mondrian tiling as it appears that the results only used one such possible tiling for Figure 3a and b, and for Table 2.\n* The choices of the adversarial attacks are also problematic as recent strong attacks are excluded from the empirical results. Please consider using [1-4] for more accurate evaluation of robustness. FGSM is simply too weak, and PGD is slow to converge and both could provide a false sense of robustness, especially only 20 iterations were used for each image.\n* In Section 2.2 the authors provided “reasons why tessellated network should work well against adversarial attacks”. It mentions that “ensemble of diverse network structures have been shown to have robustness”, citing [5]. Unfortunately, it was recently shown in [6] that the method proposed in [5] is not robust under attacks (accuracy can reach 0% under $\\ell_\\infty$-bounded with perturbation $\\epsilon = 0.01$).\n\n### Minor issues\n* It is not clear if the models are obtained after adversarial training or not. The reviewer was unable to find explanation for this in the paper.\n\n### References\n```\n[1]: Croce et al., Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. ICML 2020. http://proceedings.mlr.press/v119/croce20b.html\n[2]: Yu et al., LAFEAT: Piercing Through Adversarial Defenses with Latent Features. CVPR 2021. https://openaccess.thecvf.com/content/CVPR2021/papers/Yu_LAFEAT_Piercing_Through_Adversarial_Defenses_With_Latent_Features_CVPR_2021_paper.pdf\n[3]: Tashiro et al., Diversity Can Be Transferred: Output Diversification for White- and Black-box Attacks. NeurIPS 2020. https://arxiv.org/abs/2003.06878\n[4]: Brendel et al., Accurate, reliable and fast robustness evaluation. NeurIPS 2019. https://proceedings.neurips.cc/paper/2019/file/885fe656777008c335ac96072a45be15-Paper.pdf\n[5]: Pang et al., Improving Adversarial Robustness via Promoting Ensemble Diversity. ICML 2019. https://arxiv.org/abs/1901.08846\n[6]: Tramer et al., On Adaptive Attacks to Adversarial Example Defenses, NeurIPS 2020. https://proceedings.neurips.cc/paper/2020/file/11f38f8ecd71867b42433548d1078e38-Paper.pdf\n```", "summary_of_the_paper": "This paper proposes to split the input image into tiles that are fed into separate subnetworks for feature extraction, and to form an implicit ensemble by combining the results from the subnetworks for a final prediction. The paper claims that such ensemble can improve adversarial robustness of the model.\n", "summary_of_the_review": "While the idea of tessellation for heterogenous subnetworks is interesting, the paper is lacking in thorough empirical evidence to back up the claims of robustness.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "OjSpNvja8vH", "reviewer": "Reviewer_m2PC", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper presents a novel architecture for image classification using image tessellation. This architecture is interesting, and warrants more investigation, but the central claim of the paper, namely that this architecture results in better adversarial robustness, is not sufficiently supported by the experimental results. \n\nCrucially, the authors do not show white box results, and do not specify on which architecture the black box attacks were derived. If the black box attacks were generated from a standard neural net, as opposed to a tessellated one, then the central claim of \"improved adversarial robustness\" should be reduced to \"reduced transferability of standard conv net adversarial attacks\". It is well established in the literature that changes to the network architecture result in less black box transferability, and so although this architecture is novel, this result is not.  If it is instead the case that the authors derived the black box attacks from similarly tessellated neural networks than the central claim should be one of black box transferability within network architectures. This is interesting but warrants more work to understand why tesselation reduces black box transferability. Either Way the claim of a \"robust defence mechanism against gradient-based adversarial attacks\" is unfounded. \n", "summary_of_the_paper": "This paper presents a new architecture for image classification neural networks based on various forms of image tessellation. They split the input image up into numerous patches, feed each patch through the 2d convolutional network and then combine the representations of each patch before a final dense classification layer.  They show that this architecture results in better 'black box' adversarial robustness.  ", "summary_of_the_review": "This work presents an interesting architecture, but does not support the central claim of adversarial robustness because they do not present white box results, and do not specify on which architecture the black box attacks were derived. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Inh6GdcVXWd", "reviewer": "Reviewer_HrGf", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The idea of this paper is simple and intuitive. The paper is well organized and easy to follow.\n\nThe result seems quite effective as shown in the experiment. The intuition of why it works makes sense to me.\n\nHowever, there are two major concerns of the method that makes me uncertain of this method.\n\nThe first concern is whether this method is still effective for a high-resolution image. Whether the performance gain is still significant. For a higher resolution image, there are usually more margins outside the object; the object is not as tightly cropped, and the object size (proportional to the image) varies a lot. This is quite different from fashion MNIST and CIFAR10. In this scenario, the requirement of tiles number might need to increase or harder to find a good strategy for tiling if the object size varies too much. The overhead will also be an issue if the number of tiles needs to be significantly increased in that situation.\n\nThe second concern is the tiling will lose important spatial information, which might make tasks that depend on the spatial relationship suffer. For example, human action classification will require the spatial relationship between body parts.\n\nI am also curious about whether this method is effective for the more localized attacks, like patch-attack. In that situation, the attacked region might happen within the same tile.", "summary_of_the_paper": "This paper presents a tessellated convolution network that is more robust to adversarial attacks. In the paper, authors proposed three different ways of tiling. Experiments show this method is more robust to FGSM and PGD for classification tasks on fashion MNIST and CIFAR10.\n", "summary_of_the_review": "The idea is interesting, simple, and intuitive. Experiments show that it is effective for the classification task.\nHowever, the two major concerns make me uncertain about the effectiveness of this method.\nI believe this idea has good potential. More experiments and discussions can make the argument much stronger. If these two concerns can be properly addressed, this will be quite impactful work.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "H0JrfuuklW", "reviewer": "Reviewer_CSai", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n- The paper is clearly written.\n- The proposed method is quite simple, straightforward, and looks to be effective. I wish the authors explain more about the rationale behind this partitioning idea. My personal hypothesis is: the smaller the patch, the less \"space\" the attacker has to mess up the prediction. However, the smaller the patch, the vanilla network also has less context to generate a accurate prediction. So there should be a sweet spot. This paper basically shows that the sweet spot is not the original image size: rather it's k ~ 20.\n\nWeaknesses:\n- My #1 concern is that the method is not validated on larger datasets such as ImageNet. The stories for 32x32 images may or may not hold for 224x224 images. I encourage the authors to compare against works such as [1].\n- My #2 concern is that the method is not validated on larger capacity networks, such as ResNet variants listed in Table 2. For example, A-T FGSM ResNet significantly outperforms all tessellated variants, whether it's clean accuracy or accuracy after FGSM attack. A 2D CNN that achieves 0.7337 accuracy on CIFAR-10 is not really competitive. Public implementations go well above 0.9, and the state-of-the-art is easily above 0.95. \n- There are a couple of places throughout the paper with \"FMNIST\" and \"CIPHAR-10\". Are these typos of \"MNIST\" and \"CIFAR-10\"?\n\n\n[1] Xie, Cihang, et al. \"Feature denoising for improving adversarial robustness.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2019.", "summary_of_the_paper": "This paper studies defense against adversarial attacks. In particular, the proposal is to partition the image into non-overlapping sub-rectangles, run a separate CNN on each, and finally merge to generate the prediction. The defense effectiveness is evaluated on MNIST and CIFAR-10.", "summary_of_the_review": "I really enjoy the idea of the paper. It provides evidence that the hypothesis I gave in the Main Review above may be true, which can inspire more research in adversarial defense. However, though the current experimental results on MNIST and CIFAR-10 are encouraging, I have two major concerns regarding the data and the network capacity, respectively. On the bright side, if the authors can show that the story holds for larger images and stronger networks, then the paper is much stronger and more generally impactful. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes an image tesselation scheme to improve the robustness of image classifiers.  The reviewers agree that the method is simple and intuitive, and view this as a positive attribute.  At the same time, the reviewers want to see if the method works on higher resolution images.  It was also not clear to reviewers how the attacks on the method were constructed, whether they were white box, and whether they were adaptive.  Without a rebuttal, these questions remain unanswered.
Decision: Reject