Paper:
The linear and non-flexible nature of deep convolutional models makes them vulnerable to carefully crafted adversarial perturbations. To tackle this problem, in this paper, we propose a nonlinear radial basis convolutional feature transformation by learning the Mahalanobis distance function that maps the input convolutional features from the same class into tight clusters. In such a space, the clusters become compact and well-separated, which prevent small adversarial perturbations from forcing a sample to cross the decision boundary. We test the proposed method on three publicly available image classification and segmentation data-sets namely, MNIST, ISBI ISIC skin lesion, and NIH ChestX-ray14. We evaluate the robustness of our method to different gradient (targeted and untargeted) and nongradient based attacks and compare it to several non-gradient masking defense strategies. Our results demonstrate that the proposed method can boost the performance of deep convolutional neural networks against adversarial perturbations without accuracy drop on clean data.

Review:
The authors propose a new defense against adversarial examples based on radial basis features. Prior work has suggested that the linearity of standard convolutional networks may be a factor contributing to their vulnerability against adversarial examples, and that radial basis functions may help alleviate this weakness. The current paper builds on this idea and proposes a concrete way to add radial basis features to existing convnet architectures.
In the proposed approach, each layer of the network is augmented with a radial basis feature transform of the features in this layer. The output of this feature transform is then concatenated with the features in this layer. The centers of the radial basis features, the bandwidth, and the distance matrix are trained with the other network parameters. The distance matrix in the feature transform is used to compute the Mahalanobis distance between the features and centers in the radial basis functions.
The authors evaluate their defense experimentally on the standard MNIST dataset and two medical image datasets: X-chest14 for classification and a 2D RGB skin lesion dataset from the 2017 IEEE ISBI International Skin Imaging Collaboration (ISIC) Challenge for image segmentation. The experiments show that their method improves over an undefended network on MNIST. On X-chest14, their method improves over features squeezing (input quantization) and Gaussian data augmentation. On the image segmentation dataset, the method improves over these baselines as well as adversarial training.
While I find the overall idea interesting, I have some doubts about the experimental evaluation. For instance, the authors do not compare their MNIST numbers to the robust optimization results reported in Madry et al. (cited in the paper). Robust optimization achieves higher adversarial accuracy than the numbers reported in Table 1.
More importantly, it is unclear to what extent unmodified first-order methods are effective for the proposed defense. While the authors investigate whether their networks exhibit gradient masking / obfuscation, the left plot in Figure 3 still leaves some questions. Based on the curves for FGSM and BIM, the proposed defense would still achieve a high accuracy even against attacks with eps = 0.5. However, this would be a clear failure of the first order attacks (but not a sign of true robustness) because an adversary with eps = 0.5 can trivially defend any network by setting every input pixel to 0.5. Hence the authors should investigate what happens in the regime between eps = 0.4 and eps = 0.5.
While I support the use of non-standard datasets for evaluation, it would still strengthen the paper if the author also reported accuracy numbers on CIFAR-10. The X-chest14 and the segmentation dataset have not been frequently used in the adversarial robustness literature to the best of my knowledge. Hence it is less clear how well the proposed methods perform on these datasets.
While I find the overall idea interesting, with the current experimental evaluation I unfortunately cannot recommend accepting the paper.
Further comments:
- The distinction between "data-level" and "algorithmic-level" approaches in the introduction is unclear to me. Adversarial training can also be seen as robust optimization, which is arguably an algorithmic approach.
- At the beginning of Section 2, it would be helpful if the authors first introduced the meaning of the variables n, m, and k before using them. In general, it would be helpful if the authors described in more detail how the radial basis features are incorporated into the network.
- How is the adversarial training baseline in Section 4.2 implemented? The choice of adversary in adversarial training / robust optimization can be crucial for the robustness of the resulting model.
- Since the authors refer to the linearity of existing model as a potential weakness: there are also alternative explanations, e.g., see https://arxiv.org/abs/1801.02774 and https://arxiv.org/abs/1804.11285 .
- The test sets used in the evaluation are fairly small (150 and 200 data points). In this regime, 95% confidence intervals can be as large as +/- 8%. Hence I would recommend increasing the size of the test sets to at least 1,000.