Why do deep convolutional networks generalize so poorly to small image transformations?

By Aharon Azulay, Yair Weiss. 2018

618 citations recorded by the source corpus.

Convolutional Neural Networks (CNNs) are commonly assumed to be invariant to small image transformations: either because of the convolutional architecture or because they were trained using data augmentation. Recently, several authors have shown that this is not the case: small translations or rescalings of the input image can drastically change the network's prediction. In this paper, we quantify this phenomena and ask why neither the convolutional architecture nor data augmentation are sufficient to achieve the desired invariance. Specifically, we show that the convolutional architecture does not give invariance since architectures ignore the classical sampling theorem, and data augmentation does not give invariance because the CNNs learn to be invariant to transformations only for images that are very similar to typical images from the training set. We discuss two possible solutions to this problem: (1) antialiasing the intermediate representations and (2) increasing data augmentation and show that they provide only a partial solution at best. Taken together, our results indicate that the problem of insuring invariance to small image transformations in neural networks while preserving high accuracy remains unsolved.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Shortcut learning in deep neural networks (2020, background): “he image is slightly transformed. To DNNs, in contrast, innocuous transformations can completely change predictions. This has been reported in various cases such as shifting the image by a few pixels [47], rotating the object [49], adding a bit of random noise or blur [51,50,52,53] or (as discussed ”
On Robustness and Transferability of Convolutional Neural Networks (2020, background): “Subsequent studies have investigated brittleness to similar corruptions [53, 76], as well as to impulse noise [31], photometric perturbations [62], and small shifts and other transformations [2, 17, 74].”
Do Image Classifiers Generalize Across Time? (2019, background): “Recent work has proposed less adversarial image modifications such as small rotations & translations [6, 1, 7, 17], hue and color changes [14], image stylization [9] and synthetic image corruptions such as Gaussian blur and JPEG compression [13, 10].”
Making Convolutional Networks Shift-Invariant Again (2019, methodology): “However, max-pooling does not provide the same anti-aliasing capability, and a curious, recently uncovered phenomenon emerges – small shifts in the input can drastically change the output (Engstrom et al., 2017; Azulay & Weiss, 2019).”
Benchmarking Neural Network Robustness to Common Corruptions and Perturbations (2019, background): “The human vision system is robust in ways that existing computer vision systems are not (Recht et al., 2018; Azulay & Weiss, 2018).”
Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects (2018, background): “2 (2)Note that the sensitivity of classifiers and object detectors to 2D translations has been observed in concurrent work [35, 12, 56, 6].”
CNN-Generated Images Are Surprisingly Easy to Spot… for Now (2019, background): “Azulay and Weiss [6] showed convolutional networks ignore the classical sampling theorem and that strided convolutions therefore reduce translation invariance, and Zhang [49] improved translation invariance by reducing aliasing in these layers.”
On Buggy Resizing Libraries and Surprising Subtleties in FID Calculation (2021, background): “Despite these advances, generative methods continue to be detectable [10, 74], and discriminative networks continue to be sensitive to small perturbations, such as shifts [3, 22] and JPEG compression [29].”
AugMix: A Simple Data Processing Method to Improve Robustness and Uncertainty (2019, background): “Thus these datasets enable the measurement of the “jaggedness” (Azulay & Weiss, 2018) of a network’s prediction stream.”
Toward Causal Representation Learning (2021, background): “In computer vision [76], [228], changes in the test distribution may, for instance, come from aberrations, such as camera blur, noise, or compression quality [107], [129], [170], [206], or from shifts, rotations, or viewpoints [7], [12], [64], [282].”
Towards Causal Representation Learning (2021, background): “In computer vision [75, 228], changes in the test distribution may, for instance, come from aberrations like camera blur, noise or compression quality [106, 129, 170, 206], or from shifts, rotations, or viewpoints [7, 11, 63, 282].”
Benchmarking Robustness in Object Detection: Autonomous Driving when Winter is Coming (2019, background): “Azulay and Weiss [2018] investigate the lack of invariance of several state-of-the-art CNNs to small translations.”
Using Videos to Evaluate Image Model Robustness (2019, methodology): “However, their predictions are often sensitive to small image transformations (Szegedy et al. (2013); Azulay & Weiss (2018)) that are visually imperceptible to humans.”
A Fourier Perspective on Model Robustness in Computer Vision (2019, background): “For example, it has been observed that commonly occuring image corruptions, such as random noise, contrast change, and blurring, can lead to signiﬁcant performance degradation (Dodge & Karam, 2017; Azulay However, data augmentation rarely improves robustness across all corruption types.”
Alias-Free Generative Adversarial Networks (2021, methodology): “It turns out that current networks can partially bypass the ideal hierarchical construction by drawing on unintentional positional references available to the intermediate layers through image borders [27, 34, 63], per-pixel noise inputs [32] and positional encodings, and aliasing [5, 65].”
Adversarial Examples Are a Natural Consequence of Test Error in Noise (2019, background): “…they lack robustness to different types of blur, pixelation, and changes in brightness (Hendrycks & Dietterich, 2018), lack robustness to random translations of the input (Azulay & Weiss, 2018), and even make errors when foreign objects are inserted into the ﬁeld of view (Rosenfeld et al., 2018).”
Improving Robustness Without Sacrificing Accuracy with Patch Gaussian Augmentation (2019, background): “For example, neural networks are sensitive to small translations and changes in scale [2], blurring and additive noise [10], small objects placed in images [41], and even different images from a similar distribution of the training set [40, 39].”
On the "steerability" of generative adversarial networks (2019, background): “This may result in models that misrepresent the given task – such as tendencies towards texture bias rather than shape bias on ImageNet classiﬁers (Geirhos et al., 2018) – and in turn limits their generalization performance on similar objectives (Azulay & Weiss, 2018).”
On Aliased Resizing and Surprising Subtleties in GAN Evaluation (2022, background): “Despite these advances, generative methods continue to be detectable [8, 68], and discriminative networks continue to be sensitive to small perturbations, such as shifts [2, 18] and JPEG compression [25].”
A systematic framework for natural perturbations from videos (2019, background): “Azulay and Weiss [1] only provide anecdotal evidence from a small number of videos.”