Foveation-based Mechanisms Alleviate Adversarial Examples

By Yan Luo, Xavier Boix, Gemma Roig, Tomaso A. Poggio, Qi Zhao. 2015

179 citations recorded by the source corpus.

We show that adversarial examples, i.e., the visually imperceptible perturbations that result in Convolutional Neural Networks (CNNs) fail, can be alleviated with a mechanism based on foveations---applying the CNN in different image regions. To see this, first, we report results in ImageNet that lead to a revision of the hypothesis that adversarial perturbations are a consequence of CNNs acting as a linear classifier: CNNs act locally linearly to changes in the image regions with objects recognized by the CNN, and in other regions the CNN may act non-linearly. Then, we corroborate that when the neural responses are linear, applying the foveation mechanism to the adversarial example tends to significantly reduce the effect of the perturbation. This is because, hypothetically, the CNNs for ImageNet are robust to changes of scale and translation of the object produced by the foveation, but this property does not generalize to transformations of the perturbation. As a result, the accuracy after a foveation is almost the same as the accuracy of the CNN without the adversarial perturbation, even if the adversarial perturbation is calculated taking into account a foveation.

Subfields: Artificial Intelligence, Hardware and Architecture, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects (2018, background): “But pixel-wise changes are uncorrelated [28], so pixel-based attacks may not transfer well to the real world [24, 26] because there is an infinitesimal chance that such specifically crafted, uncorrelated pixels will be encountered in the vast physical space of camera, lighting, traffic, and weather ”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “Various defensive techniques against adversarial examples in deep neural networks have been proposed (Gu & Rigazio, 2014; Luo et al., 2015; Papernot et al., 2016c; Nayebi & Ganguli, 2017; Cisse et al., 2017) and many remain vulnerable to adaptive attackers (Carlini & Wagner, 2017a;b; Baluja &…”
Early Methods for Detecting Adversarial Images (2016, background): “Since adversarial image attacks seem not to be localized (Luo et al., 2015), the attention map for the tank’s gun turret may be scattered or uniform across the image and thus abnormal and detectable.”
Is Deep Learning Safe for Robot Vision? Adversarial Examples Against the iCub Humanoid (2017, background): “, input data that are slightly modified to mislead classification by the addition of an almost-imperceptible adversarial noise [16, 19].”
Adversarial Examples for Semantic Segmentation and Object Detection (2017, background): “, the regional proposal network (RPN) [27], but we find that when the adversarial perturbation r is added to the original image X, a different set of proposals may be generated according to the new input X+r, and the network may still be able to correctly classify these new proposals [19].”
Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics (2016, background): “More complex cancellation approaches such as foveation in [18] that utilizes cropping can achieve better results.”
Robustness of classifiers: from adversarial to random noise (2016, background): “More recently, following the recent results on the instability of deep neural networks to worst-case perturbations [17], several works have provided explanations of the phenomenon [3, 5, 14, 18], and designed more robust networks [6, 8, 20, 13, 15, 12].”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “There are also other examples in the literature where the linearity hypothesis is not directly supported [118].”
Toward an Integration of Deep Learning and Neuroscience (2016, background): “Scientiﬁcally, determining the order in which cost functions are engaged in the biological brain will inform machine ﬁxation has been tentatively connected with robustness of convolutional networks to adversarial perturbations in images (Luo et al., 2015).”
Adversarial Spheres (2018, background): “One common hypothesis is that neural network classifiers are too linear in various regions of the input space, (Goodfellow et al., 2014; Luo et al., 2015).”
Improving Transferability of Adversarial Examples With Input Diversity (2018, unknown): “We set the maximum perturbation of each pixel to be ✏ = 15, which is still imperceptible for human observers [22].”
Adversarial Examples on Object Recognition (2020, background): “[113] proposed a variant of this conjecture in which DNNs operate linearly in certain regions of the input manifold, but non-linear in others.”
Synthesizing Robust Adversarial Examples (2017, background): “However, some recent work has argued that adversarial examples are not preserved by simple transformations such as rescaling or rotation, implying that adversarial examples are not an issue in practice because many real-world systems capture inputs from multiple angles and perspectives [10, 11].”
Deflecting Adversarial Attacks with Pixel Deflection (2018, methodology): “[22] use the object coordinates to mask out the background region and show that this defends against some of the known attacks.”
Synthesizing Robust Adversarial Examples (2017, background): “…in neural networks, adversarial examples produced using standard techniques fail to fool classifiers in the physical world when the examples are captured over varying viewpoints and affected by natural phenomena such as lighting and camera noise (Luo et al., 2016; Lu et al., 2017).”
Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression (2017, unknown): “Luo et al. [15] propose to use a foveation-based mechanism that applies a DNN model on a certain region of an image and discards information from other regions.”
Enhancing robustness of machine learning systems via data transformations (2017, background): “Existing defenses for neural networks [17], [42], [55], [28], [21] make a variety of structural modiﬁcations to improve resilience to adversarial examples.”