Geometric Robustness of Deep Networks: Analysis and Improvement

By Can Kanbak, Seyed-Mohsen Moosavi-Dezfooli, Pascal Frossard. 2017

140 citations recorded by the source corpus.

Deep convolutional neural networks have been shown to be vulnerable to arbitrary geometric transformations. However, there is no systematic method to measure the invariance properties of deep networks to such transformations. We propose ManiFool as a simple yet scalable algorithm to measure the invariance of deep networks. In particular, our algorithm measures the robustness of deep networks to geometric transformations in a worst-case regime as they can be problematic for sensitive applications. Our extensive experimental results show that ManiFool can be used to measure the invariance of fairly complex networks on high dimensional datasets and these values can be used for analyzing the reasons for it. Furthermore, we build on ManiFool to propose a new adversarial training scheme and we show its effectiveness on improving the invariance properties of deep neural networks.1

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Do Image Classifiers Generalize Across Time? (2019, background): “Recent work has proposed less adversarial image modifications such as small rotations & translations [6, 1, 7, 17], hue and color changes [14], image stylization [9] and synthetic image corruptions such as Gaussian blur and JPEG compression [13, 10].”
Do ImageNet Classifiers Generalize to ImageNet? (2019, background): “[30] Can Kanbak, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “[73] introduced ‘ManiFool’ algorithm in the wake of DeepFool method [72] to measure robustness of deep neural networks against geometrically perturbed images.”
On Translation Invariance in CNNs: Convolutional Layers Can Exploit Absolute Spatial Location (2020, methodology): “Instead of augmenting with random transformations there are geometric adverserial training methods [22, 23, 49] that intelligently add the most sensitive geometric transformations to the training data.”
Adversarial Generative Nets: Neural Network Attacks on State-of-the-Art Face Recognition (2018, methodology): “More efficient algorithms were later proposed for finding even more imperceptible adversarial examples using different notions of imperceptibility [8], [13], [20], [26], [28], [40], [42], [47], [53], [54].”
Robustness of Rotation-Equivariant Networks to Adversarial Perturbations (2018, background): “Very recently the notion of adversarial examples on images was reﬁned to account for the human perception (Luo et al., 2018), and extended to rigid geometric transformations (Fawzi & Frossard, 2015; Kanbak et al., 2017; Engstrom et al., 2017) and local geometric distortions (Xiao et al., 2018).”
Invariance-inducing regularization using worst-case transformations suffices to boost accuracy and spatial robustness (2019, background): “g.[11, 13, 34, 20, 14, 2, 10]) that worst-case prediction performance drops dramatically for neural network classifiers obtained using standard training, even for rather small transformation sets.”
Adversarial Examples on Object Recognition (2020, methodology): “ 90% on models trained with data augmentation techniques (already including aﬃne transformations). ACM Comput. Surv., Vol. 53, No. 3, Article 66. Publication date: June 2020. 66:20 A. Serban ManiFool [89] searches for the smallest, worst-case, geometrical transformation that can fool DNNs. Similar t”
Pooling is neither necessary nor sufficient for appropriate deformation stability in CNNs (2018, background): “In future work, it would be informative to explore similar questions but with the worst case deformations found via maximization of the deformation sensitivity [6, 12].”
Data Augmentation with Manifold Exploring Geometric Transformations for Increased Performance and Robustness (2019, methodology): “ManiFool [1] is an iterative algorithm that can be applied to any diﬀerentiable classiﬁer f .”
On the Suitability of Lp-Norms for Creating and Preventing Adversarial Examples (2018, background): “, [10, 26]) may be considered to replace Lp-norms.”
SSMBA: Self-Supervised Manifold Based Data Augmentation for Improving Out-of-Domain Robustness (2020, methodology): “Recent methods have used the manifold assumption to improve robustness by moving examples towards a decision boundary (Kanbak et al., 2018), generating adversarial examples (Szegedy et al., 2014; Miyato et al., 2017), interpolating between pairs of examples (Zhang et al., 2018), or finding affine…”
Achieving Robustness in the Wild via Adversarial Mixing With Disentangled Representations (2019, background): “[32] explored geometric transformations such as rotations and translation of images.”
A systematic framework for natural perturbations from videos (2019, background): “Motivated by the artificial nature of `p attacks, recent work has proposed more realistic image modifications such as small rotations & translations [2, 8, 9, 18], hue and color changes [16], and common image corruptions such as Gaussian blur and JPEG compression [11, 15].”
Geometry-aware Instance-reweighted Adversarial Training (2020, methodology): “input data to explore the DNN’s geometric properties (Fawzi et al., 2017; Kanbak et al., 2018; Fawzi et al., 2018; Qin et al., 2019; MoosaviDezfooli et al., 2019).”
Exploring the Landscape of Spatial Robustness (2017, methodology): “…shown that neural network–based vision classifiers are vulnerable to input images that have been spatially transformed through small rotations, translations, shearing, scaling, and other natural transformations (Fawzi & Frossard, 2015; Kanbak et al., 2017; Xiao et al., 2018; Tramèr & Boneh, 2017).”
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks (2021, background): “Aligning with the research direction of adversarial examples [23, 33, 52], one property of interest for the backdoor attack is also to improve the fidelity of poisoned images that are used to inject the backdoor and hence reduce the perceptual detectability by human observers.”