Original: Shape Defense
Revised: Shape Defense

Original: Abstract
Revised: Abstract

Original: Humans rely heavily on shape information to recognize objects.
Revised: Humans rely heavily on shape information to recognize objects.

Original: Conversely, convolutional neural networks (CNNs) are biased more towards texture.
Revised: Conversely, convolutional neural networks (CNNs) are biased more towards texture.

Original: This fact is perhaps the main reason why CNNs are susceptible to adversarial examples.
Revised: This fact is perhaps the main reason why CNNs are susceptible to adversarial examples.

Original: Here, we explore how shape bias can be incorporated into CNNs to improve their robustness.
Revised: Here, we explore how shape bias can be incorporated into CNNs to improve their robustness.

Original: Two algorithms are proposed, based on the observation that edges are invariant to moderate imperceptible perturbations.
Revised: Two algorithms are proposed, based on the observation that edges are invariant to moderate imperceptible perturbations.

Original: In the ﬁrst one, a classiﬁer is adversarially trained on images with the edge map as an additional channel.
Revised: In the ﬁrst one, a classiﬁer is adversarially trained on images with the edge map as an additional channel.

Original: At inference time, the edge map is recomputed and concatenated to the image.
Revised: At inference time, the edge map is recomputed and concatenated to the image.

Original: In the second algorithm, a conditional GAN is trained to translate the edge maps, from clean and/or perturbed images, into clean images.
Revised: In the second algorithm, a conditional GAN is trained to translate the edge maps, from clean and/or perturbed images, into clean images.

Original: The inference is done over the generated image corresponding to the input’s edge map.
Revised: The inference is done over the generated image corresponding to the input’s edge map.

Original: A large number of experiments with more than 10 data sets demonstrate the effectiveness of the proposed algorithms.
Revised: A large number of experiments with more than 10 data sets demonstrate the effectiveness of the proposed algorithms.

Original: From a broader perspective, our study suggests that CNNs do not adequately account for image structures and operations that are crucial for robustness.
Revised: From a broader perspective, our study suggests that CNNs do not adequately account for image structures and operations that are crucial for robustness.

Original: The code is available at: https://github.com/[masked].
Revised: The code is available at: https://github.com/[masked].

Original:  Introduction
Revised:  Introduction

Original: Our primary goal here is to learn robust models for visual recognition inspired by the observation that object shape remains largely invariant to imperceptible adversarial perturbations (Fig. 1).
Revised: Our primary goal here is to learn robust models for visual recognition inspired by the observation that object shape remains largely invariant to imperceptible adversarial perturbations (Fig. 1).

Original: Shape is the signature of an object and plays a vital role in recognition [1].
Revised: Shape is the signature of an object and plays a vital role in recognition [1].

Original: Humans rely heavily on edges and object boundaries whereas CNNs emphasize more on texture [7, 10].
Revised: Humans rely heavily on edges and object boundaries, whereas CNNs emphasize more on texture [8, 11].

Original: This may explain why adversarial examples are perplexing.
Revised: This may explain why adversarial examples are perplexing.

Original: The convolution operation in CNNs is biased towards capturing texture since the number of pixels constituting texture far exceeds the number of pixels that fall on the object boundary.
Revised: The convolution operation in CNNs is biased towards capturing texture since the number of pixels constituting texture far exceeds the number of pixels that fall on the object boundary.

Original: This in turn provides a big opportunity for adversarial image manipulation.
Revised: This in turn provides a big opportunity for adversarial image manipulation.

Original: Some attempts have been made to emphasize more on edges, for example by utilizing normalization layers (e.g., contrast and divisive normalization [13]).
Revised: Some attempts have been made to emphasize more on edges, for example by utilizing normalization layers (e.g., contrast and divisive normalization [14]).

Original: Such attempts, however, have not been fully investigated for adversarial defense.
Revised: Such attempts, however, have not been fully investigated for adversarial defense.

Original: Overall, how shape and texture should be reconciled in CNNs continues to be an open question.
Revised: Overall, how shape and texture should be reconciled in CNNs continues to be an open question.

Original: Here we propose two solutions that can be easily implemented and integrated in existing defenses.
Revised: Here we propose two solutions that can be easily implemented and integrated in existing defenses.

Original: We also investigate possible adaptive attacks against them.
Revised: We also investigate possible adaptive attacks against them.

Original: Extensive experiments across ten datasets, over which shape and texture have different relative importance, demonstrate the effectiveness of our solutions against strong attacks.
Revised: Extensive experiments across ten datasets, over which shape and texture have different relative importance, demonstrate the effectiveness of our solutions against strong attacks.

Original: Experiments on more than 10 data sets demonstrate the effectiveness of the proposed algorithms against FGSM, (cid:96) ∞
Revised: Experiments on more than 10 data sets demonstrate the effectiveness of the proposed algorithms against FGSM, (cid:96) ∞

Original: PGD, substitute, Carlini-Wagner, Boundary, and adaptive attacks (the latter are shown in appendices B, C, D, and E in order).
Revised: PGD, substitute, Carlini-Wagner, Boundary, and adaptive attacks (the latter are shown in appendices B, C, D, and E in order).

Original:  Proposed methods
Revised:  Proposed methods

Original: Edge-guided Adversarial Training (EAT).
Revised: Edge-guided Adversarial Training (EAT).

Original: In this approach, we perform adversarial training over the 2D (Gray+Edge) or 4D (RGB+Edge) input (i.e., number of channels; denoted as Img+Edge).
Revised: In this approach, we perform adversarial training over the 2D (Gray+Edge) or 4D (RGB+Edge) input (i.e., number of channels; denoted as Img+Edge).

Original: Please see Appx A for illustration of this algorithm (Alg. 1).
Revised: Please see Appx A for illustration of this algorithm (Alg. 1).

Original: In another version of the algorithm, ﬁrst, for each input (clean or adversarial), the old edge map is replaced with the newly extracted one.
Revised: In another version of the algorithm, ﬁrst, for each input (clean or adversarial), the old edge map is replaced with the newly extracted one.

Original: The edge map can be computed from the average of only image channels or all available channels(i.e., image plus edge).
Revised: The edge map can be computed from the average of only image channels or all available channels

Original: The latter can sometimes improve the results, since the old edge map, although perturbed, still contains unaltered shape structures.

Original: Then, adversarial training is performed over the It’s Not 
Revised: I (Still) Can’t Believe It’s Not Better Workshop at NeurIPS 2021.

Original: [Figure]
Revised: [Figure]

Original: for t = 1 . . .
Revised: for t = 1 . . .

Original: T do for i = 1 . . .
Revised: T do for i = 1 . . .

Original: M do // launch adversarial attack (here FGSM and PGD attacks)
Revised: M do // launch adversarial attack (here FGSM and PGD attacks)

Original: ˜ x
Revised: ˜ x

Original: i = clip ( x i + (cid:15) sign ( ∇ x (cid:96) ( f θ ( x i ) , y i )))
Revised: i = clip ( x i + (cid:15) sign ( ∇ x (cid:96) ( f θ ( x i ) , y i )))

Original: if β == imgedge & redetect_train then ˜ x i = detect_edge (˜ x i ) // recompute and replace the edge map end if (cid:96) =
Revised: if β == imgedge & redetect_train then ˜ x i = detect_edge (˜ x i ) // recompute and replace the edge map end if (cid:96) =

Original: α (cid:96) ( f θ ( x i ) , y i ) + (1 − α ) (cid:96) ( f θ (˜ x i ) , y i ) //
Revised: α (cid:96) ( f θ ( x i ) , y i ) + (1 − α ) (cid:96) ( f θ (˜ x i ) , y i ) //

Original: here α = 0 .θ
Revised: here α = 0 .θ

Original: = θ − ∇ θ (cid:96) // update model weights with some optimizer, e.g., Adam end for end for  new input.
Revised: = θ − ∇ θ (cid:96) // update model weights with some optimizer, e.g., Adam end for end for (i.e., image plus edge). The latter can sometimes improve the results, since the old edge map, although perturbed, still contains unaltered shape structures. Then, adversarial training is performed over the new input.

Original: The reason behind adversarial training with redetected edges is to expose the network to possible image structure damage.
Revised: The reason behind adversarial training with redetected edges is to expose the network to possible image structure damage.

Original: The loss for training is a weighted combination of loss over clean images and loss over adversarial images.
Revised: The loss for training is a weighted combination of loss over clean images and loss over adversarial images.

Original: At inference time, ﬁrst, the edge map is computed and then classiﬁcation is done over the edge-augmented input.
Revised: At inference time, ﬁrst, the edge map is computed and then classiﬁcation is done over the edge-augmented input.

Original: As a baseline model, we also consider ﬁrst detecting the input’s edge map and then feeding it to the model trained on the edges for classiﬁcation.
Revised: As a baseline model, we also consider ﬁrst detecting the input’s edge map and then feeding it to the model trained on the edges for classiﬁcation.

Original: We refer to this model as Img2Edge.
Revised: We refer to this model as Img2Edge.

Original: GAN-based Shape Defense (GSD).
Revised: GAN-based Shape Defense (GSD).

Original: Here, ﬁrst, a conditional GAN is trained to map the edge image, from clean or adversarial images, to its corresponding clean image (Alg. 2).
Revised: Here, ﬁrst, a conditional GAN is trained to map the edge image, from clean or adversarial images, to its corresponding clean image (Alg. 2).

Original: Any image translation method (here pix2pix by [11] using code at https://github.com/mrzhu-cool/ pix2pix-pytorch ) can be employed for this purpose.
Revised: Any image translation method (here pix2pix by [12] using code at https://github.com/mrzhu-cool/ pix2pix-pytorch ) can be employed for this purpose.

Original: Next, a CNN is trained over the generated images.
Revised: Next, a CNN is trained over the generated images.

Original: At inference time, ﬁrst, the edge map is computed and then classiﬁcation is done over the generated image for this edge image.
Revised: At inference time, ﬁrst, the edge map is computed and then classiﬁcation is done over the generated image for this edge image.

Original: The intuition is that the edge map remains nearly the same over small perturbation budgets (See Appx A).
Revised: The intuition is that the edge map remains nearly the same over small perturbation budgets (See Appx A).

Original: Notice that conditional GAN can also be trained on perturbed images (similar to [18] and [14] or edge-augmented perturbed images (similar to above).
Revised: Notice that conditional GAN can also be trained on perturbed images (similar to [19] and [15] or edge-augmented perturbed images (similar to above).

Original:  Experiments and results 3.1 Datasets and Models
Revised:  Experiments and results 3.1 Datasets and Models

Original: Experiments are spread across 10 datasets covering a variety of stimulus types.
Revised: Experiments are spread across 10 datasets covering a variety of stimulus types.

Original: Sample images from datasets are given in Fig.
Revised: Sample images from datasets are given in Fig.

Original: Models are trained with cross-entropy loss and Adam optimizer [12] with a batch size of 100, for 20 epochs over MNIST and FashionMNIST, 30 over DogVsCat, andover the remaining.
Revised: Models are trained with cross-entropy loss and Adam optimizer [13] with a batch size of 100, for 20 epochs over MNIST and FashionMNIST, 30 over DogVsCat, andover the remaining.

Original: Canny method [3] is used for edge detection over all datasets, except DogBreeds for which Sobel edge detection is used.
Revised: Canny method [3] is used for edge detection over all datasets, except DogBreeds for which Sobel edge detection is used.

Original: Edge detection parameters are separately adjusted for each dataset.
Revised: Edge detection parameters are separately adjusted for each dataset.

Original: We did not carry out an exhaustive hyperparameter search, since we are interested in additional beneﬁts edges may bring rather than training the best possible models.
Revised: We did not carry out an exhaustive hyperparameter search, since we are interested in additional beneﬁts edges may bring rather than training the best possible models.

Original: For attacks, we usepytorch , except Boundary attack for which
Revised: For attacks, we use

Original: // Training
Revised: // Training

Original: Create a dataset of images X
Revised: Create a dataset of images X

Original: = { x i , y i } i =1 ··· N including clean and/or perturbed
Revised: = { x i , y i } i =1 ··· N including clean and/or perturbed

Original: Extract edge maps ( e i ) for all images in the dataset 3.
Revised: Extract edge maps ( e i ) for all images in the dataset 3.

Original: Train a conditional GAN p g ( x | e ) to map edge image e to clean image x // here pix2pix 4.
Revised: Train a conditional GAN p g ( x | e ) to map edge image e to clean image x // here pix2pix 4.

Original: Train a classiﬁer p c ( y | x ) to map generated image x to class label y
Revised: Train a classiﬁer p c ( y | x ) to map generated image x to class label y

Original: // Inference
Revised: // Inference

Original: For input image x , clean or perturbed, ﬁrst compute the edge image e 2.
Revised: For input image x , clean or perturbed, ﬁrst compute the edge image e 2.

Original: Then, compute p c ( y | x (cid:48) )
Revised: Then, compute p c ( y | x (cid:48) )

Original: where x (cid:48) is the generated image corresponding to e 
Revised: where x (cid:48) is the generated image corresponding to e https://github.com/Harry24k/adversarial-attacks-pytorch , except Boundary attack for which we use https://github.com/bethgelab/foolbox

Original:  3.2.1 Edge-guided Adversarial Training
Revised: 3.2 Results 3.2.1 Edge-guided Adversarial Training

Original: [Figure]
Revised: [Figure]

Original: Results over MNIST and
Revised: Results over MNIST and

Original: CIFAR-10 are shown in
Revised: CIFAR-10 are shown in

Original: Tables 1 and 2, respectively (please see Appx
Revised: Tables 2 and 3, respectively (please see Appx

Original: A).
Revised: A).

Original: In these experiments, edge maps are computed only from the gray-level image (in turn computed from the image channels).
Revised: In these experiments, edge maps are computed only from the gray-level image (in turn computed from the image channels).

Original: Over MNIST and FashionMNIST, robust models trained using edges outperform models trained on gray-level images (the last column).
Revised: Over MNIST and FashionMNIST, robust models trained using edges outperform models trained on gray-level images (the last column).

Original: The naturally trained models, however, perform better using gray-level images than edge maps (Orig. model column).
Revised: The naturally trained models, however, perform better using gray-level images than edge maps (Orig. model column).

Original: Adversarial training with augmented inputs improves the robustness signiﬁcantly over both datasets, except the FGSM attack on FashionMNIST.
Revised: Adversarial training with augmented inputs improves the robustness signiﬁcantly over both datasets, except the FGSM attack on FashionMNIST.

Original: Over CIFAR-10, incorporating the edges improves the robustness by a large margin against the PGD-40 attack.
Revised: Over CIFAR-10, incorporating the edges improves the robustness by a large margin against the PGD-40 attack.

Original: At (cid:15) = 32 / 255 , the performance of the robust model over clean and perturbed images is raised from (0.316, 0.056) to (0.776, 0.392).
Revised: At (cid:15) = 32 / 255 , the performance of the robust model over clean and perturbed images is raised from (0.316, 0.056) to (0.776, 0.392).

Original: On average, the robust model shows 64% improvement over the
Revised: On average, the robust model shows 64% improvement over the

Original: RGB model (last column in Table 2).
Revised: RGB model (last column in Table 3).

Original: Over the TinyImageNet dataset, as in CIFAR-10, classiﬁcation using edge maps is poor perhaps due to the background clutter.
Revised: Over the TinyImageNet dataset, as in CIFAR-10, classiﬁcation using edge maps is poor perhaps due to the background clutter.

Original: Nevertheless, incorporating edges improves the results.
Revised: Nevertheless, incorporating edges improves the results.

Original: We expect even better results with more accurate edge detection algorithms (e.g., supervised deep edge detectors).
Revised: We expect even better results with more accurate edge detection algorithms (e.g., supervised deep edge detectors).

Original: Over these 4 datasets, the ﬁnal model (i.e., adversarial training using image + redetected edge, and edge redetection at inference time) leads to the best accuracy.
Revised: Over these 4 datasets, the ﬁnal model (i.e., adversarial training using image + redetected edge, and edge redetection at inference time) leads to the best accuracy.

Original: The improvement over the image is more pronounced at larger perturbations, in particular against the
Revised: The improvement over the image is more pronounced at larger perturbations, in particular against the

Original: PGD-40 attack (as expected; please see Fig. 1).
Revised: PGD-40 attack (as expected; please see Fig. 1).

Original: Over the DogVsCat dataset, as in FashionMNIST, the model trained on the edge map is much more robust than the image-only model (Table 6 in Appx A).
Revised: Over the DogVsCat dataset, as in FashionMNIST, the model trained on the edge map is much more robust than the image-only model (Table 7 in Appx. A).

Original: Over the DogBreeds dataset, utilizing edges does not improve the results signiﬁcantly (compared to the image model).
Revised: Over the DogBreeds dataset, utilizing edges does not improve the results signiﬁcantly (compared to the image model).

Original: The reason could be that texture is more important than shape in this ﬁne-grained recognition task (Table 7 Appx A).
Revised: The reason could be that texture is more important than shape in this ﬁne-grained recognition task (Table 8 Appx. A).

Original: Over
Revised: Over

Original: GTSRB, Icons-50, and Sketch datasets, image+edge model results in higher robustness than the image-only model, but leads to relatively less improvement compared to the edge-only model.
Revised: GTSRB, Icons-50, and Sketch datasets, image+edge model results in higher robustness than the image-only model, but leads to relatively less improvement compared to the edge-only model.

Original: Please see Tables 8, 10, and 12.
Revised: Please see Tables 9, 11, and 13.

Original: Over the Imagenette2-160 dataset (Table 14), classiﬁcation using images does better than edges since the texture is very important on this dataset.
Revised: Over the Imagenette2-160 dataset (Table 15), classiﬁcation using images does better than edges since the texture is very important on this dataset.

Original: Average results over 10 datasets is presented in Fig.
Revised: Average results over 10 datasets is presented in Fig.

Original: 3 (left panel).
Revised: 4 (left panel).

Original: Combining shape and texture (full model) leads to a substantial improvement in robustness over the texture alone (5.24% improvement against FGSM and 28.76% imp.
Revised: Combining shape and texture (full model) leads to a substantial improvement in robustness over the texture alone (5.24% improvement against FGSM and 28.76% imp.

Original: against PGD-40).
Revised: against PGD-40).

Original: Also, image+edge model is slightly more robust than the image-only model.
Revised: Also, image+edge model is slightly more robust than the image-only model.

Original: Computing the edge map from all image channels improves the results on some datasets (e.g., GTSRB and Sketch) but hurts on some others (e.g., CIFAR-10) as shown in Appx A.
Revised: Computing the edge map from all image channels improves the results on some datasets (e.g., GTSRB and Sketch) but hurts on some others (e.g., CIFAR-10) as shown in Appx. A.

Original: The right two panels in Fig.
Revised: The right two panels in Fig.

Original: 3 show a comparison of natural (Orig. model column in tables; solid lines) vs. adversarial training.
Revised: 4 show a comparison of natural (Orig. model column in tables; solid lines) vs. adversarial training.

Original: Natural training with image+edge and redetection at  inference time leads to enhanced robustness with little to no harm to standard accuracy.
Revised: Natural training with image+edge and redetection at [Figure] inference time leads to enhanced robustness with little to no harm to standard accuracy.

Original: Despite the
Revised: Despite the

Original: Edge model only being trained on edges from clean images, the Img2Edge model does better than other naturally-trained models against attacks.
Revised: Edge model only being trained on edges from clean images, the Img2Edge model does better than other naturally-trained models against attacks.

Original: The best performance, however, belongs to models 
Revised: The best performance, however, belongs to models trained adversarially.

Original: [Figure]

Original: trained adversarially. Notice that our results set a new record on adversarial robustness on some of these datasets even without exhaustive parameter search 1 . 
Revised: Notice that our results set a new record on adversarial robustness on some of these datasets even without exhaustive parameter search 1 . Robustness against Carlini-Wagner (CW) and Boundary attacks. Performance of our method against l 2 CW attack on MNIST dataset is shown in Appx.

Revised: C. To make experiments tractable, we set the number of attack iterations to 10.

Revised: With even 10 iterations, the original Edge and Img models are severely degraded.

Original: 3.2.2 GAN-based Shape defense
Revised: Img2Edge and Img+(Edge Redetect) models, however, remain robust. Adversarial training with CW attack results in robust models in all cases. Results against the decision-based Boundary attack [2] are shown in Appx. D over MNIST and

Revised: Fashion MNIST datasets.

Revised: Edge, Img, and Img+Edge models perform close to zero over adversarial images.

Revised: Img+(Edge Redetect) model remains robust since the Canny edge map does not change much after the attack, as is illustrated in Fig.

Revised: Robustness against substitute model attacks.

Revised: Following [18], we trained substitute models to mimic the robust models (with the same architecture but with RGB channels) using the cross-entropy loss over the logits of the two networks, for 5 epochs.

Revised: The adversarial examples crafted for the substitute networks were then fed to the robust networks.

Revised: Results are shown in italics in Tables 2, 3,and 5 (performed only against the edge-redetect models).

Revised: We ﬁnd that this attack is not able to knock off the robust models.

Revised: Surprisingly, it even improves the accuracy in some cases.

Revised: Please refer to

Revised: Appx.

Revised: B for more details.

Revised: Robustness against adaptive attacks.

Revised: So far we have been using the Canny edge detector which is non-differentiable.

Revised: What if the adversary builds a differentiable edge detector to approximate

Revised: the

Revised: Canny edge detector and then utilizes it to craft adversarial examples?

Revised: To study this, we run two experiments.

Revised: In the ﬁrst one, we build the following pipeline using the HED deep edge detector [24]:

Revised: Img −→ HED −→ Classiﬁer HED .

Revised: A CNN classiﬁer (as above) is trained over the HED edges on the

Revised: Imagenette2-160 dataset (See Appx.

Revised: E).

Revised: Attacking this classiﬁer with FGSM and PGD-5 ( (cid:15) = 8 / 255 ) completely fools the network.

Revised: The original classiﬁer (Img2Edge here) trained on Canny edges, however, is still largely robust to the attacks (i.e., Img adv − HED −→ Canny −→ Classiﬁer Canny ) as shown in Table 20.

Revised: Notice that the HED edge maps are continuous in the range [0,1], whereas Canny edge maps are binary, which may explain why it is easy to fool the HED classiﬁer (See Fig.

Revised: Above, we used an off the shelf deep edge detector trained on natural scenes.

Revised: As can be seen in Appx.

Revised: E, its generated edge maps differ signiﬁcantly from Canny edges.

Revised: What if the adversary trains a model with the ( input, output ) pair as ( input image, Canny edge map ) to better approximate the Canny edge detector?

Revised: In experiment two, we investigate this possibility.

Revised: We build a pipeline consisting of a convolutional autoencoder followed by a CNN on MNIST.

Revised: Details regarding architecture and training procedure are given in Appx.

Revised: E.

Revised: As results in Fig.

Revised: 11 reveal, FGSM and PGD-40 attacks against the pipeline are very effective.

Revised: Passing the adversarial images through Canny and then a trained (naturally or adversarially) classiﬁer on Canny edges (i.e., Img2Edge), still leads to high accuracy, which means that transfer was not successful.

Revised: We attribute this feat to the binary output of Canny.

Revised: Two important point deserve attention.

Revised: First, here we used the Img2Edge model, which as shown above, is less robust compared to the full model (i.e., img+edge and redetection).

Revised: Thus, adaptive attacks may be even less effective against the full model.

Revised: Second, proposed methods perform better

Revised: [Figure]

Revised: when edge map is less disturbed.

Revised: For example, as shown in Fig.

Revised: 11 (bottom), the PGD-40 adaptive attack is less effective against the shape defense since edges are preserved better.

Revised: Analysis of parameter α .

Revised: By setting α = 0 , the network will be exposed only to adversarial examples (Alg. 1), which is computationally more efﬁcient.

Revised: However, it results in lower accuracy and robustness compared to when α = 0 .

Revised: 5 , which means exposing the network to both clean and adversarial images is important (See Table 23; Appx.

Revised: H).

Revised: Nevertheless, here again incorporating edges improves the robustness signiﬁcantly compared to the image-only case.

Revised: Speculation behind effectiveness of this method.

Revised: The main reason is that the edge map acts as a checksum, and the network learns (through adversarial training) to rely more on the redetected edges when other channels are misleading.

Revised: This aligns with prior observations such as shortcut learning in CNNs [7].

Revised: Also, our approach resembles adversarial patch or backdoor/trojan attacks where the goal is to fool a classiﬁer by forcing it to rely on irrelevant cues.

Revised: Conversely, here we use this trick to make a model more robust.

Revised: Also, the Img2Edge model can purify the input before classifying it.

Revised: Any adaptive attack against the EAT defense has to alter the edges which most likely will result in perceptible structural damages.

Original: We trained the pix2pix model for 10 epochs over MNIST and FashionMNIST datasets, and forepochs over Icons-50 dataset.
Revised: We trained the pix2pix model for 10 epochs over MNIST and FashionMNIST datasets, and forepochs over Icons-50 dataset.

Original: Sample generated images are shown in Fig.
Revised: Sample generated images are shown in Fig.

Original: 10 (Appx. F).
Revised: 12 (Appx. F).

Original: A CNN (same architecture as before) was trained for 10 epochs to classify the generated images.
Revised: A CNN (same architecture as before) was trained for 10 epochs to classify the generated images.

Original: Results are shown in Fig.
Revised: Results are shown in Fig.

Original: The model trained over the images generated by pix2pix (solid lines in the ﬁgure) is compared to the model trained over the original clean training set (denoted by the dashed lines).
Revised: The model trained over the images generated by pix2pix (solid lines in the ﬁgure) is compared to the model trained over the original clean training set (denoted by the dashed lines).

Original: Both models are tested over the clean and perturbed versions of the original test sets of the four datasets.
Revised: Both models are tested over the clean and perturbed versions of the original test sets of the four datasets.

Original: Over MNIST and FashionMNIST datasets, GSD performs on par with the original model on clean test images.
Revised: Over MNIST and FashionMNIST datasets, GSD performs on par with the original model on clean test images.

Original: It is, however, much more robust than the original model against the attacks.
Revised: It is, however, much more robust than the original model against the attacks.

Original: When we trained the pix2pix over the edge maps from the perturbed images, the new CNN models became even more robust (stars in Fig. 4; top panels).
Revised: When we trained the pix2pix over the edge maps from the perturbed images, the new CNN models became even more robust (stars in Fig. 5; top panels).

Original: We expect even better results with training over edge maps from both intact and perturbed images 2 .
Revised: We expect even better results with training over edge maps from both intact and perturbed images 2 .

Original: Over Icons-50 dataset, generated images are poor.
Revised: Over Icons-50 dataset, generated images are poor.

Original: Consequently, GSD underperforms the original model on clean images.
Revised: Consequently, GSD underperforms the original model on clean images.

Original: Over the adversarial inputs, however, GSD wins, especially at high perturbation budgets and against the PGDattack.
Revised: Over the adversarial inputs, however, GSD wins, especially at high perturbation budgets and against the PGDattack.

Original: With better edge detection and image generation methods (e.g., using perceptual loss), better results are expected. 
Revised: With better edge detection and image generation methods (e.g., using perceptual loss), better results are expected. Speculation behind effectiveness of this method.

Revised: The main reason is that cGAN learns a function f that is invariant to adversarial perturbations.

Revised: Since the edge map is not completely invariant to (especially large) perturbations, one has to train the cGAN on the augmented dataset composed of clean and perturbed images.

Revised: One advantage of this approach is it computational efﬁciency since there is no need for adversarial training.

Revised: [Table]

Original: Limitations and future work
Revised: Any adaptive attack against this defense has to fool the cGAN which is perhaps not feasible since it will be noticed from the generated images (i.e., cGAN will fail to generate decent images).  Fast & free adversarial training with shape defense Here, we examine whether incorporating shape bias can empower other defenses, in particular, a) fast adversarial training by [22], dubbed FastAT , and free adversarial training by [20], dubbed FreeAT . Wong et al.

Revised: trained robust models using a much weaker and cheaper adversary to lower the cost of adversarial training.

Revised: They showed that adversarial training with the FGSM adversary is as effective as PGD-based training.

Revised: The key idea in Shafahi et al.

Revised: ’s

Revised: work is to simultaneously update both the model parameters and image perturbations in one backward pass, rather than using separate gradient computations at each update step.

Revised: Please see also Appx.

Revised: G.

Revised: The same CNN architectures as in Wong et al.

Revised: are employed here.

Revised: For FastAT, we trained three models over MNIST (for 10 epochs), FashionMNIST (for 3 epochs), and CIFAR-10 (for 10 epochs & early-stopping ) datasets.

Revised: For FreeAT, we trained models only over CIFAR-10 for 10 epochs.

Revised: Results are shown in Table 1.

Revised: Using shape-based FastAT and over MNIST, robust accuracy against

Revised: PGD-50 grows from 95.5% (image-only model) to 98.4% (our full model) at (cid:15)

Revised: = 0 .

Revised: 1 and from 87.7% to 98.6% at (cid:15) = 0 . 3 , which are even higher than what is reported by Wong et al.

Revised: (97.5% at (cid:15) = 0 .

Revised: 1 and 88.8% at (cid:15) = 0 . 3 ).

Revised: Over FashionMNIST, the improvement is even more pronounced (from 69.6% to 85.5% at (cid:15) = 0 .

Revised: 1 and from 0% to 82.3% at (cid:15) = 0 . 3 ).

Revised: Over clean images, our full model outperforms other models in most of the cases.

Revised: Over the CIFAR-10 dataset, the shape-based extension of the defenses results in high accuracy over both clean and perturbed images (using

Revised: PGD-10 attack), compared to the image-only model.

Revised: We expect similar improvements with the classic PGD adversarial training.

Revised: Overall, our analyses in this section suggest that exploiting edges is not speciﬁc to the particular way we perform adversarial training (Algorithms 1&2), and be extended to other defense methods (e.g., TRADES algorithm by [25]).

Original: Two algorithms are proposed to use shape bias and background subtraction to strengthen CNNs and defend against adversarial attacks and backdoor attacks.
Revised: Two algorithms are proposed to use shape bias and background subtraction to strengthen CNNs and defend against adversarial attacks and backdoor attacks.

Original: To fool these defenses, one has to perturb the image such that the new edge map is signiﬁcantly different from the old one while preserving image shape and geometry, which does not seem to be trivial at low perturbation budgets.
Revised: To fool these defenses, one has to perturb the image such that the new edge map is signiﬁcantly different from the old one while preserving image shape and geometry, which does not seem to be trivial at low perturbation budgets.

Original: Our results without exhaustive parameter search (model architecture, epochs, edge detection, cGAN training, etc.) are very promising.
Revised: Our results without exhaustive parameter search (model architecture, epochs, edge detection, cGAN training, etc.) are very promising.

Original: However, comparison with other more complicated defenses, which often use a lot of tricks, bells and whistles, needs to be investigated.
Revised: However, comparison with other more complicated defenses, which often use a lot of tricks, bells and whistles, needs to be investigated.

Original: Our additional investigations, not shown here, reveal that combination of shape defense with background subtraction can help defend against backdoor attacks.
Revised: Our additional investigations, not shown here, reveal that combination of shape defense with background subtraction can help defend against backdoor attacks.

Original: Also, our results show that shape defense strengthens other adversarial defenses such as fast adversarial training [21] and free adversarial training [19].
Revised: Also, our results show that shape defense strengthens other adversarial defenses such as fast adversarial training [22] and free adversarial training [20].

Original: Future work should test the proposed ideas against adversarial attacks such as gradient-free attacks, decision-based attacks, sparse attacks (e.g., the one pixel attack [20]), attacks that perturb only the edge pixels, attacks that manipulate the image structure [22], ad-hoc adaptive attacks, and backdoor [6]), other (cid:96) p norms, and datasets.
Revised: Future work should test the proposed ideas against adversarial attacks such as gradient-free attacks, decision-based attacks, sparse attacks (e.g., the one pixel attack [21]), attacks that perturb only the edge pixels, attacks that manipulate the image structure [23], ad-hoc adaptive attacks, and backdoor [6]), other (cid:96) p norms, and datasets.

Original: There might be also other ways to incorporate shape-bias in CNNs, such as 1) augmenting a dataset with edge maps or negative images, 2) overlaying texture from some objects onto some others as in [7], and 3) designing normalization layers [4].
Revised: There might be also other ways to incorporate shape-bias in CNNs, such as 1) augmenting a dataset with edge maps or negative images, 2) overlaying texture from some objects onto some others as in [8], and 3) designing normalization layers [4].

Original: B Robustness against substitute model attacks
Revised: B Robustness against substitute model attacks

Original: Following [17]
Revised: Following [18]

Original: [Table]
Revised: [Table]

Original: we trained substitute models to mimic the robust models (with the same architecture but with RGB channels) using the cross-entropy loss over the logits of the two networks, for 5 epochs.
Revised: we trained substitute models to mimic the robust models (with the same architecture but with RGB channels) using the cross-entropy loss over the logits of the two networks, for 5 epochs.

Original: The adversarial examples crafted for the substitute networks were then fed to the robust networks.
Revised: The adversarial examples crafted for the substitute networks were then fed to the robust networks.

Original: Results are shown in italics in Tables1, 2, 3 and 4  (performed only against the edge-redetect models).
Revised: Results are shown in italics in Tables 2, 3, 4 and 5 (performed only against the edge-redetect models).

Original: We ﬁnd that this attack is not able to knock off the robust models.
Revised: We ﬁnd that this attack is not able to knock off the robust models.

Original: Surprisingly, it even improves the accuracy in some cases.
Revised: Surprisingly, it even improves the accuracy in some cases.

Original: [Table]
Revised: [Table]

Original: C Robustness against Carlini-Wagner (CW) and Boundary attacks
Revised: C Robustness against Carlini-Wagner (CW) and Boundary attacks

Original: Performance of our method against l 2 CW attack [5] on MNIST dataset is shown in Table 16.
Revised: Performance of our method against l 2 CW attack [5] on MNIST dataset is shown in Table 17.

Original: To make experiments tractable, we set the number of attack iterations to 10.
Revised: To make experiments tractable, we set the number of attack iterations to 10.

Original: With even 10 iterations, the original Edge and Img models are severely degraded.
Revised: With even 10 iterations, the original Edge and Img models are severely degraded.

Original: Img2Edge and Img+(Edge Redetect) models, however, remain robust.
Revised: Img2Edge and Img+(Edge Redetect) models, however, remain robust.

Original: Adversarial training with CW attack results in robust models in all cases.
Revised: Adversarial training with CW attack results in robust models in all cases.

Original: Performance of the the EAT defense against the l 2 Carlini-Wagner attack [5] with the following parameters: attack = CW(net, targeted=
Revised: Performance of the the EAT defense against the l 2 Carlini-Wagner attack [5] with the following parameters: attack = CW(net, targeted=

Original: False, c=1e-4, kappa=0, iters=10, lr=0.001)
Revised: False, c=1e-4, kappa=0, iters=10, lr=0.001)

Original: [Table]
Revised: [Table]

Original: D Robustness against Boundary attack
Revised: D Robustness against Boundary attack

Original: Results against the decision-based Boundary attack [2] over MNIST and Fashion MNIST datasets are shown below.
Revised: Results against the decision-based Boundary attack [2] over MNIST and Fashion MNIST datasets are shown below.

Original: Edge, Img
Revised: Edge, Img

Original: [Table]
Revised: [Table]

Original: and Img+Edge models perform close to zero over adversarial images.
Revised: and Img+Edge models perform close to zero over adversarial images.

Original: Img+(Edge Redetect) model remains robust since the Canny edge map does not change much after the attack, as is illustrated in Fig.
Revised: Img+(Edge Redetect) model remains robust since the Canny edge map does not change much after the attack, as is illustrated in Fig.

Original: Performance of the the edge augmented model against the Boundary attack [2] with the following parameters:
Revised: Performance of the the edge augmented model against the Boundary attack [2] with the following parameters:

Original: BoundaryAttack(init_attack=
Revised: BoundaryAttack(init_attack=

Original: None, steps=25000, spherical_step=0.01, source_step=0.01, source_step_convergance=1e-07, [Table] _adaptation=1.5, tensorboard=
Revised: None, steps=25000, spherical_step=0.01, source_step=0.01, source_step_convergance=1e-07, step_adaptation=1.5, tensorboard=

Original: False,
Revised: False,

Original: [Table]
Revised: [Table]

Original: _stats_every
Revised: _stats_every_k=10)

Original: [Table]
Revised: [Table]

Original: k=10)

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: A d v .
Revised: A d v .

Original: I m g
Revised: I m g

Original: E
Revised: E

Original: d g e f r o m
Revised: d g e f r o m

Original: A d v .
Revised: A d v .

Original: I m g
Revised: I m g

Original: MNIST
Revised: MNIST

Original: [Table]
Revised: [Table]

Original: E Robustness against adaptive attacks 
Revised: E Robustness against adaptive attacks E.1 Robustness against adaptive attacks over Imagenette2-160 dataset

Original: Here, we attempt to explicitly approximate the Canny edge detector using a differentiable convolutional autoencoder.
Revised: We use the PyTorch implementation 3 of the HED edge detector proposed by [24]. Here, a classiﬁer is ﬁrst trained on top of the edge maps from the HED. Then, the entire pipeline (Img −→ HED −→ Classiﬁer HED ) is attacked to generate an adversarial image. The performance of this classiﬁer is measured on both clean and adversarial images.

Original: In our pipeline, a classiﬁer (CNN) is stacked after the convolutional autoencoder (with sigmoid output neurons).
Revised: The adversarial image is also fed to the classiﬁer trained on Canny edge maps (i.e., Img adv − HED −→ Canny −→ Classiﬁer Canny ). Results are shown in Table below. As it can be seen, adversarial examples crafted for HED fail to completely fool the model trained on Canny edges (i.e., they do not transfer).

Revised: [Table]

Revised: [Figure]

Original:  We ﬁrst freeze the classiﬁer and train the autoencoder using the MSE loss with (input, output) pair being (image, canny edge map).
Revised: Here, we attempt to explicitly approximate the Canny edge detector using a differentiable convolutional autoencoder. In our pipeline, a classiﬁer (CNN) is stacked after the convolutional autoencoder (with sigmoid output neurons). We ﬁrst freeze the classiﬁer and train the autoencoder using the MSE loss with (input, output) pair being (image, canny edge map).

Original: We then freeze the autoencoder and train the classiﬁer using Cross Entropy loss.
Revised: We then freeze the autoencoder and train the classiﬁer using Cross Entropy loss.

Original: After training the network, we then craft adversarial examples for it and feed them to a classiﬁer trained on Canny edges (original models or robust models as was mentioned in the main text).
Revised: After training the network, we then craft adversarial examples for it and feed them to a classiﬁer trained on Canny edges (original models or robust models as was mentioned in the main text).

Original: Fig.
Revised: Fig.

Original: 7 shows the pipeline and some sample approximated edge maps.
Revised: 9 shows the pipeline and some sample approximated edge maps.

Original: Fig.
Revised: Fig.

Original: 8 shows the architecture details in PyTorch.
Revised: 10 shows the architecture details in PyTorch.

Original: The top panel in Fig.
Revised: The top panel in Fig.

Original: 9 shows results using the FGSM and PGD-40 attacks against the pipeline itself, and also against the Img2Edge model (trained over clean edges or adversarial ones 3 ).
Revised: 11 shows results using the FGSM and PGD-40 attacks against the pipeline itself, and also against the Img2Edge model (trained over clean edges or adversarial ones 4 ).

Original: As can be seen, both attacks are very successful against the pipeline but they do not perform well against the Canny edge map classiﬁer (i.e., crafted adversarial examples for the pipeline do not transfer well to the Imge2Edge trained over Canny
Revised: As can be seen, both attacks are very successful against the pipeline but they do not perform well against the Canny edge map classiﬁer (i.e., crafted adversarial examples for the pipeline do not transfer well to the Imge2Edge trained over Canny

Original: Edge map; img −→ Canny −→ class label).
Revised: Edge map; img −→ Canny −→ class label).

Original: Notice, that here we only used the model trained on edge maps.
Revised: Notice, that here we only used the model trained on edge maps.

Original: It is likely to gain even better robustness against the adaptive attacks in using the img+edge+redetect.
Revised: It is likely to gain even better robustness against the adaptive attacks in using the img+edge+redetect.

Original: The bottom panel in Fig.
Revised: The bottom panel in Fig.

Original: 9 shows sample adversarial digits (constructed using the adaptive attack) and their edge maps under the FGSM and PGD-40 attacks.
Revised: 11 shows sample adversarial digits (constructed using the adaptive attack) and their edge maps under the FGSM and PGD-40 attacks.

Original: Notice how PGD-40 attack preserves the edges (compered to
Revised: Notice how PGD-40 attack preserves the edges (compered to

Original: FGSM).
Revised: FGSM).

Original: This is because it needs less perturbation to fool the classiﬁer.
Revised: This is because it needs less perturbation to fool the classiﬁer.

Original: Also, notice that the perturbations shown are perceptible which results in edges maps having noise.
Revised: Also, notice that the perturbations shown are perceptible which results in edges maps having noise.

Original: If we limit ourselves to imperceptible perturbations, then edge maps will not change much compared to the original edge maps on clean images.[Figure] [Table] [Table]
Revised: If we limit ourselves to imperceptible perturbations, then edge maps will not change much compared to the original edge maps on clean images.

Original: (requires

Original: [Table]

Original: [Figure]
Revised: [Figure]

Original: e p s =/
Revised: e p s =/

Original: e p s = 64 /
Revised: e p s = 64 /

Original: FGSM

Original: PGD

Original: [Figure]
Revised: [Figure]

Original: F
Revised: F

Original: (GSD)
Revised: by the

Revised: in GAN- Defense (GSD)

Revised: G Shape-based extensions of vanilla PGD adversarial training, free adversarial training (FreeAT), and fast adversarial training (FastAT)

Revised: algorithms

Revised: for t = 1 . . .

Revised: T do for i = 1 . . .

Revised: M do // Perform PGD adversarial attack δ = 0 // or randomly initialized for j = 1 . . .

Revised: N do δ

Revised: =

Revised: δ + α · sign( ∇ δ (cid:96) ( f θ ( x i + δ ) , y i ))

Revised: δ = max(min( δ, (cid:15) ) , − (cid:15) ) end for ˜ x

Revised: i = x

Revised: i + δ if redetect_train & β == imgedge then ˜ x i =

Revised: detect_edge

Revised: (˜ x i ) //

Revised: recompute and replace the edge map end if θ = θ − ∇ θ (cid:96) ( f θ (˜ x i ) , y i ) //

Revised: Update model weights with some optimizer, end for end for δ =//

Revised: Iterate T/N times to account for minibatch replays and run for T for t = 1 . . .

Revised: T/N do for i = 1 . . .

Revised: M do // Perform simultaneous FGSM adversarial attack and model weight updates T times for j = 1 . . .

Revised: N do ˜ x

Revised: i = x

Revised: i + δ if redetect_train & β == imgedge then ˜ x i =

Revised: detect_edge

Revised: (˜ x i ) //

Revised: recompute and replace the edge map end if //

Revised: Compute gradients for perturbation and model weights simultaneously

Revised: [Equation]

Revised: δ

Revised: [Equation]

Revised: [Equation]

Revised: ( δ

Revised: [Equation]

Revised: (cid:15)

Revised: [Equation]

Revised: (cid:15) )

Revised: θ =

Revised: θ − ∇ θ // Update model weights with some optimizer, e.g. SGD end for end for end for

Revised: Algorithm 5 Shape-based FGSM adversarial training for T epochs, given some radius (cid:15) , N PGD steps, step size α , and a dataset of size M for a network f θ .

Revised: β ∈ { edge, img, imgedge } indicates the net_type and redetect_train mean edge redetection during training.

Revised: for t = 1 . .

Revised: T do for i = 1 . . .

Revised: M do // Perform FGSM adversarial attack δ = Uniform ( − (cid:15), (cid:15) )

Revised: δ = δ + α · sign( ∇ δ (cid:96) ( f θ ( x i + δ ) , y i ))

Revised: δ = max(min( δ, (cid:15) ) , − (cid:15) )

Revised: ˜ x

Revised: i = x

Revised: i + δ if redetect_train & β == imgedge then ˜ x i =

Revised: detect_edge

Revised: (˜ x i ) //

Revised: recompute and replace the edge map end if θ = θ − ∇ θ (cid:96) ( f θ (˜ x i ) , y i ) //

Revised: Update model weights with some optimizer, e.g. SGD end for end for

Revised: [Table]

Revised: Redetect

Revised: [Table]

Revised: +

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: H Analysis of parameter α in Alg. 1 (EAT defense)

Revised: [Table]

Revised: [Table]

Revised: [Table]