Adversarial Feature Augmentation and Normalization for Visual Recognition
arXiv:2103.12171
Abstract
Recent advances in computer vision take advantage of adversarial data augmentation to ameliorate the generalization ability of classification models. Here, we present an effective and efficient alternative that advocates adversarial augmentation on intermediate feature embeddings, instead of relying on computationally-expensive pixel-level perturbations. We propose Adversarial Feature Augmentation and Normalization (A-FAN), which (i) first augments visual recognition models with adversarial features that integrate flexible scales of perturbation strengths, (ii) then extracts adversarial feature statistics from batch normalization, and re-injects them into clean features through feature normalization. We validate the proposed approach across diverse visual recognition tasks with representative backbone networks, including ResNets and EfficientNets for classification, Faster-RCNN for detection, and Deeplab V3+ for segmentation. Extensive experiments show that A-FAN yields consistent generalization improvement over strong baselines across various datasets for classification, detection and segmentation tasks, such as CIFAR-10, CIFAR-100, ImageNet, Pascal VOC2007, Pascal VOC2012, COCO2017, and Cityspaces. Comprehensive ablation studies and detailed analyses also demonstrate that adding perturbations to specific modules and layers of classification/detection/segmentation backbones yields optimal performance. Codes and pre-trained models will be made available at: https://github.com/VITA-Group/CV_A-FAN.
References in corpus (25)
- mixup: Beyond Empirical Risk Minimization
- R-FCN: Object Detection via Region-based Fully Convolutional Networks
- Instance Normalization: The Missing Ingredient for Fast Stylization
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- Theoretically Principled Trade-off between Robustness and Accuracy
- AutoAugment: Learning Augmentation Policies from Data
- Certified Adversarial Robustness via Randomized Smoothing
- Countering Adversarial Images using Input Transformations
- FreeLB: Enhanced Adversarial Training for Natural Language Understanding
- Large-Scale Adversarial Training for Vision-and-Language Representation Learning
- A study of the effect of JPG compression on adversarial images
- Stochastic Activation Pruning for Robust Adversarial Defense
- Semidefinite relaxations for certifying robustness to adversarial examples
- Adversarial Training Can Hurt Generalization
- Adversarial Examples that Fool Detectors
- Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
- Robust Adversarial Perturbation on Deep Proposal-based Models
- Adversarial Robustness May Be at Odds With Simplicity
- Improving Neural Language Modeling via Adversarial Training
- Triple Wins: Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inference
- On Feature Normalization and Data Augmentation
- Improved Sample Complexities for Deep Networks and Robust Classification via an All-Layer Margin
- Exploring the Vulnerability of Single Shot Module in Object Detectors via Imperceptible Background Patches
- Towards Understanding Adversarial Examples Systematically: Exploring Data Size, Task and Model Factors
- AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation