pwc-archive/papers-with-abstracts huggingface dataset:
Detect, consolidate, delineate: scalable mapping of field boundaries using satellite images
Authors: François Waldner, Foivos I. Diakogiannis, Kathryn Batchelor, Michael Ciccotosto-Camp, Elizabeth Cooper-Williams, Chris Herrmann, Gonzalo Mata, Andrew Toovey 7
Date: 2021-06-04 00:00:00
Proceeding: article belongs to the Special Issue Applications of Deep Learning in Smart Agriculture 2021 6
Tasks: Instance Segmentation, Semantic Segmentation

Digital agriculture services can greatly assist growers to monitor their fields and optimize their use throughout the growing season. Thus, knowing the exact location of fields and their boundaries is a prerequisite. Unlike property boundaries, which are recorded in local council or title records, field boundaries are not historically recorded. As a result, digital services currently ask their users to manually draw their field, which is time-consuming and creates disincentives. Here, we present a generalized method, hereafter referred to as DECODE (DEtect, COnsolidate, and DElinetate), that automatically extracts accurate field boundary data from satellite imagery using deep learning based on spatial, spectral, and temporal cues. We introduce a new convolutional neural network (FracTAL ResUNet) as well as two uncertainty metrics to characterize the confidence of the field detection and field delineation processes. We finally propose a new methodology to compare and summarize field-based accuracy metrics. To demonstrate the performance and scalability of our method, we extracted fields across the Australian grains zone with a pixel-based accuracy of 0.87 and a field-based accuracy of up to 0.88 depending on the metric. We also trained a model on data from South Africa instead of Australia and found it transferred well to unseen Australian landscapes. We conclude that the accuracy, scalability and transferability of DECODE shows that large-scale field boundary extraction based on deep learning has reached operational maturity. This opens the door to new agricultural services that provide routine, near-real time field-based analytics.
Keywords: agriculture; deep learning; Sentinel-2; semantic segmentation; instance segmentation
Rectifying the Data Bias in Knowledge Distillation
Authors: Boxiao Liu, Shenghan Zhang, Guanglu Song, Haihang You, Yu Liu
Date: 2021-10-11 00:00:00
Proceeding: ICCV 2021 10
Tasks: Face Recognition, Face Verification, Knowledge Distillation, Model Compression, Person Re-Identification

Knowledge distillation is a representative technique for
model compression and acceleration, which is important for
deploying neural networks on resource limited devices. The
knowledge transferred from teacher to student is the mapping of teacher model, or represented by all the input-output
pairs. However, in practice the student model only learns
from data pairs of the dataset that may be biased, and we
think this limits the performance of knowledge distillation.
In this paper, we first quantitatively define the uniformity
of the sampled data for training, providing a unified view
for methods that learn from biased data. Then we evaluate
the uniformity on real world dataset and show that existing methods actually improve the uniformity of data. We
further introduce two uniformity-oriented methods for rectifying the bias of data for knowledge distillation. Extensive experiments conducted on Face Recognition and Person Re-identification have shown the effectiveness of our
method. Moreover, we analyze the sampled data on Face
Recognition and show that better balance is achieved between races and between easy and hard samples. And this
effect can be also confirmed in training the student model
from scratch, resulting in a comparable performance with
standard knowledge distillation.
BiGrad: Differentiating through Bilevel Optimization Programming
Authors: Francesco Alesiani
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2
Tasks: BIG-bench Machine Learning, Bilevel Optimization, Combinatorial Optimization

Integrating mathematical programming, and in particular Bilevel Optimization Programming, within deep learning architectures has vast applications in various domains from machine learning to engineering. 
Bilevel programming is able to capture complex interactions when two actors have conflicting objectives. 
Previous approaches only consider single-level programming. In this paper, we thus propose Differentiating through Bilevel Optimization Programming (BiGrad) as approach for end-to-end learning of models that use Bilevel Programming as a layer. 
BiGrad has wide applicability and it can be used in modern machine learning frameworks. We focus on two classes of Bilevel Programming: continuous and combinatorial optimization problems. The framework extends existing approaches of single level optimization programming. We describe a class of gradient estimators for the combinatorial case which reduces the requirements in term of computation complexity; for the continuous variables case the gradient computation takes advantage of push-back approach (i.e. vector-jacobian product) for an efficient implementation. Experiments suggest that the proposed approach successfully extends existing single level approaches to Bilevel Programming.
A Practical and Stealthy Adversarial Attack for Cyber-Physical Applications
Authors: YiFu Wu, Jin Wei-Kocsis
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2
Tasks: Adversarial Attack

Adversarial perturbations on misleading a well-trained machine learning (ML) model have been studied in computer vision (CV) and other related application areas. However, there is very limited focus on studying the impact of adversarial perturbations on ML models used in data-driven cyber-physical systems (CPSs) that normally have complex physical and mechanical constraints. Because of the complex physical and mechanical constraints, called domain-knowledge constraints in our paper, established gradient-based adversarial attack methods are not always practical in CPS applications. In this paper, we propose an innovative CPS-specific adversarial attack method that is able to practically compromise the ML-based decision makings of CPSs while maintaining stealthy by meeting the complex domain-knowledge constraints. In the section of performance evaluations, different scenarios are considered to illustrate the effectiveness of the proposed adversarial attack method in achieving a high success rate as well as sufficient stealthiness in CPS applications.
Aliasing coincides with CNNs vulnerability towards adversarial attacks
Authors: Julia Grabinski, Janis Keuper, Margret Keuper
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2

Many commonly well-performing convolutional neural network models have shown to be susceptible to input data perturbations, indicating a low model robustness. Adversarial attacks are thereby specifically optimized to reveal model weaknesses, by generating small, barely perceivable image perturbations that flip the model prediction. Robustness against attacks can be gained for example by using adversarial examples during training, which effectively reduces the measurable model attackability. In contrast, research on analyzing the source of a model’s vulnerability is scarce. In this paper, we analyze adversarially trained, robust models in the context of a specifically suspicious network operation, the downsampling layer, and provide evidence that robust models have learned to downsample more accurately and suffer significantly less from aliasing than baseline models.
Traversing the Local Polytopes of ReLU Neural Networks
Authors: Shaojie Xu, Joel Vaughan, Jie Chen, Aijun Zhang, Agus Sudjianto
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2

Although neural networks (NNs) with ReLU activation functions have found success in a wide range of applications, their adoption in risk-sensitive settings has been limited by the concerns on robustness and interpretability. Previous works to examine robustness and to improve interpretability partially exploited the piecewise linear function form of ReLU NNs. In this paper, we explore the unique topological structure that ReLU NNs create in the input space, identifying the adjacency among the partitioned local polytopes and developing a traversing algorithm based on this adjacency. Our polytope traversing algorithm can be adapted to a wide range of applications related to robustness and interpretability. As the traversing algorithm explicitly visits all local polytopes, it returns a clear and full picture of the network behavior within the traversed region. The time and space complexity of the traversing algorithm is determined by the number of a ReLU NN's partitioning hyperplanes passing through the traversing region.
Broad Adversarial Training with Data Augmentation in the Output Space
Authors: Nils Worzyk, Stella Yu
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2
Tasks: Data Augmentation, image-classification, Image Classification, Self-Supervised Learning

In image classification, data augmentation and the usage of additional data has been shown to increase the efficiency of clean training and the accuracy of the resulting model. However, this does not prevent models from being fooled by adversarial manipulations. To increase the robustness, Adversarial Training (AT) is an easy, yet effective and widely used method to harden neural networks against adversarial inputs. Still, AT is computationally expensive and only creates one adversarial input per sample of the current batch. We propose Broad Adversarial Training (B-AT), which combines adversarial training and data augmentation in the decision space, i.e., on the models output vector. By adding random noise to the original adversarial output vector, we create multiple pseudo adversarial instances, thus increasing the data pool for adversarial training. We show that this general idea is applicable to two different learning paradigms, i.e., supervised and self-supervised learning. Using B-AT instead of AT for supervised learning, we can increase the robustness by 0.56\% for small seen attacks. For medium and larger seen attacks, the robustness increases by 4.57\% and 1.11\%, respectively. On large unseen attack, we can also report an increase in the robustness by 1.11\% and 0.29\%. When combining a larger corpus of input data with our proposed method, we report a slight increase of the clean accuracy and increased robustness against all observed attacks, compared to AT. In self-supervised training, we monitor a similar increase in robust accuracy for seen attacks and large unseen attacks, when it comes to the downstream task of image classification. In addition, for both observed self-supervised models, the clean accuracy also increases by up to 1.37\% using our method.
Heterogeneous Architecture Search Approach within Adversarial Dynamic Defense Framework
Authors: Qi Peng, Ruoxi Qin, Wenlin Liu, Libin Hou, Bin Yan, Linyuan Wang
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2
Tasks: Adversarial Attack, Adversarial Robustness, Diversity

Recent advances in adversarial attacks uncover the intrinsic vulnerability of modern deep neural networks (DNNs). To address this issue, various methods have been proposed to design network architectures that are robust to one particular type of adversarial attack. Recent research leverages the concept of dynamic defense framework (DDF) based on stochastic ensemble model for boosting the robustness of a DNN ensemble against such adversarial attacks. There is a need to enhance the diversity and gradient variations of the ensemble but stuck with the lack of efficient networks. In this paper, we propose a heterogeneous architecture searching method based on NAS. Our method encourages heterogeneous networks, such that networks further improve diversity for ensemble, and thus, boost the adversarial robustness of DDF. Experimental results suggest that the diversity existing among the family of heterogeneous networks does restrain the transferability of the adversarial sample, and achieve superior performance when evaluating the robustness on the ASR-vs-distortion benchmark in different attack environments.
Revisiting Adversarial Robustness of Classifiers With a Reject Option
Authors: Jiefeng Chen, Jayaram Raghuram, Jihye Choi, Xi Wu, YIngyu Liang, Somesh Jha
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2
Tasks: Adversarial Robustness, image-classification, Image Classification

Adversarial training of deep neural networks (DNNs) is an important defense mechanism that allows a DNN to be robust to input perturbations, that can otherwise result in predictions errors. Recently, there is a growing interest in learning a classifier with a reject (abstain) option that can be more robust to adversarial perturbations by choosing to not return a prediction on inputs where the classifier may be incorrect. A challenge faced with robust learning of a classifier with reject option is that existing works do not have a mechanism to ensure that (very) small perturbations of the input are \textit{not} rejected, when they can in fact be accepted and correctly classified. We first propose a novel metric -- \textit{robust error with rejection} -- that extends the standard definition of robust error to include the rejection of small perturbations. The proposed metric has natural connections to the standard robust error (without rejection), as well as the robust error with rejection proposed in a recent work. Motivated by this metric, we propose novel loss functions and a robust training method -- \textit{stratified adversarial training with rejection} (SATR) -- for a classifier with reject option, where the goal is to accept and correctly-classify small input perturbations, while allowing the rejection of larger input perturbations that cannot be correctly classified. Experiments on well-known image classification DNNs using strong adaptive attack methods validate that SATR can significantly improve the robustness of a classifier with rejection compared to standard adversarial training (with confidence-based rejection) as well as a recently-proposed baseline.
The Diversity Metrics of Sub-models based on SVD of Jacobians for Ensembles Adversarial Robustness
Authors: Ruoxi Qin, Linyuan Wang, Xuehui Du, Bin Yan, Xingyuan Chen
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2
Tasks: Adversarial Robustness, Attribute, Attribute Extraction, Dimensionality Reduction, Diversity

Transferability of adversarial samples under different CNN models is not only one of the metrics indicators for evaluating the performance of adversarial examples, but also an important research direction in the defense of adversarial examples. Diversified models prevent black-box attacks relying on a specific alternative model. Meanwhile, recent research has revealed that adversarial transferability across sub-models may be used to abstractly express the diversity needs of sub-models under ensemble robustness. Because there was no mathematical description for this diversity in earlier studies, the difference in model architecture or model output was employed as an empirical standard in the assessment, with the model loss as the optimization aim. This paper proposes corresponding assessment criteria and provides a more accurate mathematical explanation of the transferability of adversarial samples between models based on the singular value decomposition (SVD) of data-dependent Jacobians. A new constraints norm is proposed in model training based on these criteria to isolate adversarial transferability without any prior knowledge of adversarial samples. Under the novel condition of high-dimensional inputs in training process, the model attribute extraction from dimensionality reduction of Jacobians makes evaluation metric and training norm more effective. Experiments have proved that the proposed metric is highly correlated with the actual robustness of transferability between sub-models and the model trained based on this constraint norm improve the adversarial robustness of ensemble.
Patch Vestiges in the Adversarial Examples Against Vision Transformer Can Be Leveraged for Adversarial Detection
Authors: Juzheng Li
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2

Vision Transformer (ViT), a Transformer-based architecture that divides images into patches, can catch up with or surpass convolution-based networks in multiple Computer Vision tasks. However, ViT is also vulnerable in the face of adversarial examples (AEs). Thus the topic around the attack and defense of ViT becomes very rewarding. Recent studies have found that the AEs against ViT seem to have grid-like textures that coincide with the patches. In this paper we confirm such sensation is true. We show that these grid-like textures are the remained vestiges due to the patch division from ViT. We name them as Patch Vestiges. We propose statistics to measure the sizes of Patch Vestiges in the images or AEs quantitatively. We also build a linear regression classifier to detect the AEs against ViT practically via the proposed statistics. The experiments show that the performance of the simple classifier can even match some recent adversarial detection methods, suggesting that when trying to attack ViT or detect the AEs against ViT, Patch Vestiges are worth considering about as a critical factor.
Improving Perceptual Quality of Adversarial Images Using Perceptual Distance Minimization and Normalized Variance Weighting
Authors: Berat Tuna Karli, Deniz Sen, Alptekin Temizel
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2
Tasks: Perceptual Distance

Neural networks are known to be vulnerable to adversarial examples, which are obtained by adding intentionally crafted perturbations to original images. However, these perturbations degrade their perceptual quality and make them more difficult to perceive by humans. In this paper, we propose two separate attack agnostic methods to increase the perceptual quality, measured in terms of perceptual distance metric LPIPS, while preserving the target fooling rate. The first method intensifies the perturbations in the high variance areas in the images. This method could be used in both white-box and black-box settings for any type of adversarial examples with only the computational cost of calculating the pixel based image variance. The second method aims to minimize the perturbations of already generated adversarial examples independent of the attack type. In this method, the distance between benign and adversarial examples are reduced until adversarial examples reach the decision boundaries of the true class. We show that these methods could also be used in conjunction to improve the perceptual quality of adversarial examples and demonstrate the quantitative improvements on CIFAR-10 and NIPS2017 Adversarial Learning Challenge datasets.
Optimal Robust Classification Trees
Authors: Nathan Justin, Sina Aghaei, Andres Gomez, Phebe Vayanos
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2
Tasks: Classification, Robust classification

In many high-stakes domains, the data used to drive machine learning algorithms is noisy (due to e.g., the sensitive nature of the data being collected, limited resources available to validate the data, etc). This may cause a distribution shift to occur, where the distribution of the training data does not match the distribution of the testing data. In the presence of distribution shifts, any trained model can perform poorly in the testing phase. In this paper, motivated by the need for interpretability and robustness, we propose a mixed-integer optimization formulation and a tailored solution algorithm for learning optimal classification trees that are robust to adversarial perturbations in the data features. We evaluate the performance of our approach on numerous publicly available datasets, and compare the performance to a regularized, non-robust optimal tree. We show an increase of up to 14.16 percent in worst-case accuracy and increase of up to 4.72 percent in average-case accuracy across several data sets and distribution shifts from using our robust solution in comparison to the non-robust solution.
Provable Defense Against Clustering Attacks on 3D Point Clouds
Authors: Dishanika Dewani Denipitiyage, Thalaiyasingam Ajanthan, Parameswaran Kamalaruban, Adrian Weller
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2
Tasks: Adversarial Robustness, Clustering

Lately, the literature on adversarial robustness spans from images to other domains such as point clouds. In this work, we consider clustering attacks on 3D point clouds and devise a provable defense mechanism to counter them. Specifically, we adopt a randomized smoothing strategy for 3D point clouds and derive a robustness certificate based on the cluster radius rather than the number of adversarial points. Our experiments on ModelNet40 and ScanObjectNN datasets using the PointNet classifier demonstrate the effectiveness of our defense mechanism against targeted and untargeted clustering attacks with a large number of adversarial points.
Training Universal Adversarial Perturbations with Alternating Loss Functions
Authors: Deniz Sen, Berat Tuna Karli, Alptekin Temizel
Date: 2021-11-22 00:00:00
Proceeding: AAAI Workshop AdvML 2022 2

Despite being very successful, deep learning models were shown to be vulnerable to crafted perturbations. Furthermore, changing the prediction of a network over any image by learning a single universal adversarial perturbation (UAP) was shown to be possible. In this work, we propose 3 different ways of training UAPs that can attain a predefined fooling rate, while, in association, optimizing $L_2$ or $L_\infty$ norms. To stabilize around a predefined fooling rate, we have integrated an alternating loss function scheme that changes the current loss function based on a given condition. In particular, the loss functions we propose are: Batch Alternating Loss, Epoch-Batch Alternating Loss and Progressive Alternating Loss. In addition, we empirically observed that UAPs that were learned by minimization attacks contain strong image-like features around the edges, hence we propose integrating a circular masking operation to the training to further alleviate visible perturbations. The proposed $L_2$ Progressive Alternating Loss method outperforms the popular attacks by providing a higher fooling rate at equal $L_2$ norms. Furthermore Filtered Progressive Alternating Loss can further reduce the $L_2$ norm by 33.3% at the same fooling rate. When optimized with regards to $L_\infty$, Progressive Alternating Loss manages to stabilize on the desired fooling rate of 95% with only 1 percentage point of deviation, despite $L_\infty$ norm being particularly sensitive to small updates.