Measuring the tendency of CNNs to Learn Surface Statistical Regularities

Abstract

Deep CNNs are known to exhibit the following peculiarity: on the one hand they generalize extremely well to a test set, while on the other hand they are extremely sensitive to so-called adversarial perturbations. The extreme sensitivity of high performance CNNs to adversarial examples casts serious doubt that these networks are learning high level abstractions in the dataset. We are concerned with the following question: How can a deep CNN that does not learn any high level semantics of the dataset manage to generalize so well? The goal of this article is to measure the tendency of CNNs to learn surface statistical regularities of the dataset. To this end, we use Fourier filtering to construct datasets which share the exact same high level abstractions but exhibit qualitatively different surface statistical regularities. For the SVHN and CIFAR-10 datasets, we present two Fourier filtered variants: a low frequency variant and a randomly filtered variant. Each of the Fourier filtering schemes is tuned to preserve the recognizability of the objects. Our main finding is that CNNs exhibit a tendency to latch onto the Fourier image statistics of the training dataset, sometimes exhibiting up to a 28% generalization gap across the various test sets. Moreover, we observe that significantly increasing the depth of a network has a very marginal impact on closing the aforementioned generalization gap. Thus we provide quantitative evidence supporting the hypothesis that deep CNNs tend to learn surface statistical regularities in the dataset rather than higher-level abstract concepts.

arXiv commentSubmitted

References in corpus (9)

• Intriguing properties of neural networks
• Wide Residual Networks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Adversarial Machine Learning at Scale
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Parseval Networks: Improving Robustness to Adversarial Examples
• The Consciousness Prior
• Discovering objects and their relations from entangled scene representations
• Independently Controllable Factors

Cited by in corpus (79)

• Shortcut Learning in Deep Neural Networks
• Neural network models and deep learning - a primer for biologists
• Learning Robust Global Representations by Penalizing Local Predictive Power
• Learning the Difference that Makes a Difference with Counterfactually-Augmented Data
• Why do deep convolutional networks generalize so poorly to small image transformations?
• PanNuke Dataset Extension, Insights and Baselines
• Motivating the Rules of the Game for Adversarial Example Research
• Adversarial Training and Robustness for Multiple Perturbations
• Controversial stimuli: pitting neural networks against each other as models of human recognition
• The Pitfalls of Simplicity Bias in Neural Networks
• A Fourier Perspective on Model Robustness in Computer Vision
• On the limits of cross-domain generalization in automated X-ray prediction
• Partial success in closing the gap between human and machine vision
• Excessive Invariance Causes Adversarial Vulnerability
• Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
• Frustratingly Simple Domain Generalization via Image Stylization
• Adversarial Examples in Modern Machine Learning: A Review
• On the Binding Problem in Artificial Neural Networks
• A neural network walks into a lab: towards using deep nets as models for human behavior
• High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks
• Gradient Starvation: A Learning Proclivity in Neural Networks
• The worst of both worlds: A comparative analysis of errors in learning from data in psychology and machine learning
• Probing Neural Network Comprehension of Natural Language Arguments
• Image classification using quantum inference on the D-Wave 2X
• Discrete and continuous representations and processing in deep learning: Looking forward
• The Threat of Adversarial Attacks on Machine Learning in Network Security -- A Survey
• High Dimensional Spaces, Deep Learning and Adversarial Examples
• Adversarial Training Versus Weight Decay
• Predicting Acute Kidney Injury at Hospital Re-entry Using High-dimensional Electronic Health Record Data
• An Explicit Local and Global Representation Disentanglement Framework with Applications in Deep Clustering and Unsupervised Object Detection
• Does enhanced shape bias improve neural network robustness to common corruptions?
• Saliency is a Possible Red Herring When Diagnosing Poor Generalization
• Rethinking Architecture Design for Tackling Data Heterogeneity in Federated Learning
• Test time Adaptation through Perturbation Robustness
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Towards Interpreting and Mitigating Shortcut Learning Behavior of NLU Models
• On the Measure of Intelligence
• Split Batch Normalization: Improving Semi-Supervised Learning under Domain Shift
• Dynamic Inference with Neural Interpreters
• Latent Adversarial Debiasing: Mitigating Collider Bias in Deep Neural Networks
• Evaluating Robustness to Context-Sensitive Feature Perturbations of Different Granularities
• PointMask: Towards Interpretable and Bias-Resilient Point Cloud Processing
• Explaining The Efficacy of Counterfactually Augmented Data
• ToyArchitecture: Unsupervised Learning of Interpretable Models of the World
• Emergence of functional information from multivariate correlations
• Built-in Vulnerabilities to Imperceptible Adversarial Perturbations
• Robust neural circuit reconstruction from serial electron microscopy with convolutional recurrent networks
• There is no Artificial General Intelligence
• Toward Learning Human-aligned Cross-domain Robust Models by Countering Misaligned Features
• The Domain Shift Problem of Medical Image Segmentation and Vendor-Adaptation by Unet-GAN
• Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective
• Deep learning for pedestrians: backpropagation in CNNs
• Leveraging Systematic Knowledge of 2D Transformations
• Predicting Adversarial Examples with High Confidence
• Predicting with High Correlation Features
• Deep Layered Learning in MIR
• Assessment of the Reliablity of a Model's Decision by Generalizing Attribution to the Wavelet Domain
• Meta Adversarial Training against Universal Patches
• Disrupting Model Training with Adversarial Shortcuts
• A Singular Value Perspective on Model Robustness
• Data augmentation and image understanding
• Robustness via Cross-Domain Ensembles
• Revisiting Edge Detection in Convolutional Neural Networks
• Robust GANs against Dishonest Adversaries
• Detecting Spurious Correlations with Sanity Tests for Artificial Intelligence Guided Radiology Systems
• Natural Adversarial Objects
• Bridging the visual gap in VLN via semantically richer instructions
• Metamorphic Testing of a Deep Learning based Forecaster
• Deep Repulsive Prototypes for Adversarial Robustness
• Multimodal Scale Consistency and Awareness for Monocular Self-Supervised Depth Estimation
• On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions
• Exploring the Efficacy of Automatically Generated Counterfactuals for Sentiment Analysis
• Unsupervised Difficulty Estimation with Action Scores
• Characterizing and Improving the Robustness of Self-Supervised Learning through Background Augmentations
• Absum: Simple Regularization Method for Reducing Structural Sensitivity of Convolutional Neural Networks
• Counterfactual Maximum Likelihood Estimation for Training Deep Networks
• Understanding the robustness of deep neural network classifiers for breast cancer screening
• Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?
• Robust Learning with Frequency Domain Regularization