Manitest: Are classifiers really invariant?

By Alhussein Fawzi, Pascal Frossard. 2015

120 citations recorded by the source corpus.

Invariance to geometric transformations is a highly desirable property of automatic classifiers in many image recognition tasks. Nevertheless, it is unclear to which extent state-of-the-art classifiers are invariant to basic transformations such as rotations and translations. This is mainly due to the lack of general methods that properly measure such an invariance. In this paper, we propose a rigorous and systematic approach for quantifying the invariance to geometric transformations of any classifier. Our key idea is to cast the problem of assessing a classifier's invariance as the computation of geodesics along the manifold of transformed images. We propose the Manitest method, built on the efficient Fast Marching algorithm to compute the invariance of classifiers. Our new method quantifies in particular the importance of data augmentation for learning invariance from data, and the increased invariance of convolutional neural networks with depth. We foresee that the proposed generic tool for measuring invariance to a large class of geometric transformations and arbitrary classifiers will have many applications for evaluating and comparing classifiers based on their invariance, and help improving the invariance of existing classifiers.

Subfields: Biophysics, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Biophysics

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Measuring Robustness to Natural Distribution Shifts in Image Classification (2020, background): “[29] Fawzi, A.”
Do Image Classifiers Generalize Across Time? (2019, background): “In the machine learning community, model robustness has typically been analyzed on images perturbed by an adversary [11, 2], or by hand-designed strategies, such as rotations or blurs [7, 6, 14, 13].”
Making Convolutional Networks Shift-Invariant Again (2019, background): “…manually generated perturbations to the input, such as image transformations (Goodfellow et al., 2009; Lenc & Vedaldi, 2015; Azulay & Weiss, 2019), geometric transforms (Fawzi & Frossard, 2015; Ruderman et al., 2018), and CG renderings with various shape, poses, and colors (Aubry & Russell, 2015).”
Why do deep convolutional networks generalize so poorly to small image transformations? (2018, methodology): “method to probe the invariances measures the linearity of the learned representations under natural transformations to the input image [28, 22, 16, 9].”
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks (2015, methodology): “Similarly to the binary case, we first present the proposed approach for the linear case and then we generalize it to other classifiers.”
Robustness May Be at Odds with Accuracy (2018, background): “These include rotations and translations (Fawzi & Frossard, 2015; Engstrom et al., 2017), and smooth spatial deformations (Xiao et al., 2018a).”
Robustness of classifiers: from adversarial to random noise (2016, background): “In [4], state-of-the-art classifiers are shown to be vulnerable to geometrically constrained adversarial examples.”
Building a Regular Decision Boundary with Deep Networks (2017, background): “Deep networks have been shown to be covariant to such actions [1, 16], to linearize them [24, 22, 30] and combing those strategies permit building invariants to them [3, 20, 9].”
RobustBench: a standardized adversarial robustness benchmark (2020, background): “It is an active area of research to develop threat models which are more aligned with the human perception such as spatial perturbations (Fawzi and Frossard, 2015; Engstrom et al., 2019b), Wasserstein-bounded perturbations (Wong et al.”
Invariance-inducing regularization using worst-case transformations suffices to boost accuracy and spatial robustness (2019, background): “g.[11, 13, 34, 20, 14, 2, 10]) that worst-case prediction performance drops dramatically for neural network classifiers obtained using standard training, even for rather small transformation sets.”
Pooling is neither necessary nor sufficient for appropriate deformation stability in CNNs (2018, background): “In future work, it would be informative to explore similar questions but with the worst case deformations found via maximization of the deformation sensitivity [6, 12].”
The Origins and Prevalence of Texture Bias in Convolutional Neural Networks (2019, background): “Although their performance in several of these tasks approaches that of humans, recent findings show that CNNs differ in intriguing ways from human vision, indicating fundamental deficiencies in our understanding of these models [87, 70, 32, 23, 76, 37, 3, 44, 46, 1, 48].”
There Is No Free Lunch In Adversarial Robustness (But There Are Unexpected Benefits) (2018, background): “These include rotations and translations [13, 10], and smooth spatial deformations [44].”
On Translation Invariance in CNNs: Convolutional Layers Can Exploit Absolute Spatial Location (2020, methodology): “Instead of augmenting with random transformations there are geometric adverserial training methods [22, 23, 49] that intelligently add the most sensitive geometric transformations to the training data.”