TY - GEN
T1 - Can Shape Structure Features Improve Model Robustness under Diverse Adversarial Settings?
AU - Sun, Mingjie
AU - Li, Zichao
AU - Xiao, Chaowei
AU - Qiu, Haonan
AU - Kailkhura, Bhavya
AU - Liu, Mingyan
AU - Li, Bo
N1 - Funding Information:
This work was performed under the auspices of the U.S. Department of Energy by Lawrence Livermore National Laboratory under Contract DE-AC52-07NA27344 and LLNL LDRD Program Project No. 20-ER-014 (LLNL-CONF-825477). This work was partially supported by the NSF grant No.1910100, NSF CNS 20-46726 CAR, NSF CNS-2012001, IIS-2040800, the ARO under contract W911NF1810208, Amazon Research Award and grant from Open Philanthropy and Good Ventures Foundation. The authors thank the anonymous reviewers and ACo’x for helpful comments and thank Xinchen Yan, Jun-Yan Zhu, Zhiding Yu, De-An Huang and Zhaoheng Zheng for helpful discussions.
Publisher Copyright:
© 2021 IEEE
PY - 2021
Y1 - 2021
N2 - Recent studies show that convolutional neural networks (CNNs) are vulnerable under various settings, including adversarial attacks, common corruptions, and backdoor attacks. Motivated by the findings that human visual system pays more attention to global structure (e.g., shapes) for recognition while CNNs are biased towards local texture features in images, in this work we aim to analyze whether “edge features” could improve the recognition robustness in these scenarios, and if so, to what extent? To answer these questions and systematically evaluate the global structure features, we focus on shape features and propose two edge-enabled pipelines EdgeNetRob and EdgeGANRob, forcing the CNNs to rely more on edge features. Specifically, EdgeNetRob and EdgeGANRob first explicitly extract shape structure features from a given image via an edge detection algorithm. Then EdgeNetRob trains downstream learning tasks directly on the extracted edge features, while EdgeGANRob reconstructs a new image by refilling the texture information with a trained generative adversarial network (GANs). To reduce the sensitivity of edge detection algorithms to perturbations, we additionally propose a robust edge detection approach Robust Canny based on vanilla Canny. Based on our evaluation, we find that EdgeNetRob can help boost model robustness under different attack scenarios at the cost of the clean model accuracy. EdgeGANRob, on the other hand, is able to improve the clean model accuracy compared to EdgeNetRob while preserving the robustness. This shows that given such edge features, how to leverage them matters for robustness, and it also depends on data properties. Our systematic studies on edge structure features under different settings will shed light on future robust feature exploration and optimization.
AB - Recent studies show that convolutional neural networks (CNNs) are vulnerable under various settings, including adversarial attacks, common corruptions, and backdoor attacks. Motivated by the findings that human visual system pays more attention to global structure (e.g., shapes) for recognition while CNNs are biased towards local texture features in images, in this work we aim to analyze whether “edge features” could improve the recognition robustness in these scenarios, and if so, to what extent? To answer these questions and systematically evaluate the global structure features, we focus on shape features and propose two edge-enabled pipelines EdgeNetRob and EdgeGANRob, forcing the CNNs to rely more on edge features. Specifically, EdgeNetRob and EdgeGANRob first explicitly extract shape structure features from a given image via an edge detection algorithm. Then EdgeNetRob trains downstream learning tasks directly on the extracted edge features, while EdgeGANRob reconstructs a new image by refilling the texture information with a trained generative adversarial network (GANs). To reduce the sensitivity of edge detection algorithms to perturbations, we additionally propose a robust edge detection approach Robust Canny based on vanilla Canny. Based on our evaluation, we find that EdgeNetRob can help boost model robustness under different attack scenarios at the cost of the clean model accuracy. EdgeGANRob, on the other hand, is able to improve the clean model accuracy compared to EdgeNetRob while preserving the robustness. This shows that given such edge features, how to leverage them matters for robustness, and it also depends on data properties. Our systematic studies on edge structure features under different settings will shed light on future robust feature exploration and optimization.
UR - http://www.scopus.com/inward/record.url?scp=85122173409&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85122173409&partnerID=8YFLogxK
U2 - 10.1109/ICCV48922.2021.00743
DO - 10.1109/ICCV48922.2021.00743
M3 - Conference contribution
AN - SCOPUS:85122173409
T3 - Proceedings of the IEEE International Conference on Computer Vision
SP - 7506
EP - 7515
BT - Proceedings - 2021 IEEE/CVF International Conference on Computer Vision, ICCV 2021
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 18th IEEE/CVF International Conference on Computer Vision, ICCV 2021
Y2 - 11 October 2021 through 17 October 2021
ER -