Towards Robust Image Classification Using Sequential Attention Models

By Daniel Zoran, Mike Chrzanowski, Po-Sen Huang, Sven Gowal, Alex Mott, Pushmeet Kohli. 2019

72 citations recorded by the source corpus.

In this paper we propose to augment a modern neural-network architecture with an attention model inspired by human perception. Specifically, we adversarially train and analyze a neural model incorporating a human inspired, visual attention component that is guided by a recurrent top-down sequential process. Our experimental evaluation uncovers several notable findings about the robustness and behavior of this new model. First, introducing attention to the model significantly improves adversarial robustness resulting in state-of-the-art ImageNet accuracies under a wide range of random targeted attack strengths. Second, we show that by varying the number of attention steps (glances/fixations) for which the model is unrolled, we are able to make its defense capabilities stronger, even in light of stronger attacks --- resulting in a ``computational race'' between the attacker and the defender. Finally, we show that some of the adversarial examples generated by attacking our model are quite different from conventional adversarial examples --- they contain global, salient and \emph{spatially coherent} structures coming from the target class that would be recognizable even to a human, and work by distracting the attention of the model away from the main object in the original image.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Perceiver: General Perception with Iterative Attention (2021, background): “In the Perceiver, attention to the full set of inputs can be inﬂuenced by a latent array produced by previous iterations of the model, allowing the model focus on subsets of inputs that are most promising in a soft way (Zoran et al., 2020).”
On the Binding Problem in Artificial Neural Networks (2020, methodology): “A similar self-attention mechanism was also used to support image classification (Zoran et al., 2020).”
Visual Attention Methods in Deep Learning: An In-Depth Survey (2022, methodology): “Sequential Attention Models : Inspired by the primate visual system, Zoran et al. [202] proposed soft, sequential, spatial top-down attention method (S3TA) to focus more on attended regions of an image [130] (as shown in Figure 8 (b)).”
Improving Robustness using Generated Data (2021, methodology): “It is widely regarded as one of the most successful method to train robust deep neural networks [30], and it has been augmented in different ways – with changes in the attack procedure [25], loss function [51, 83] or model architecture [77, 86].”
Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples (2020, background): “Since Madry et al. (2017), various modiﬁcations to their algorithm have been proposed (Xie et al., 2018; Pang et al., 2020b; Huang et al., 2020; Qin et al., 2019; Zoran et al., 2019; Andriushchenko & Flammarion, 2020).”
Reinforced Attention for Few-Shot Learning and Beyond (2021, methodology): “The work in [36, 69] also uses the recurrent model to learn an attention mask.”