Adversarial Robustness through the Lens of Convolutional Filters

Abstract

Deep learning models are intrinsically sensitive to distribution shifts in the input data. In particular, small, barely perceivable perturbations to the input data can force models to make wrong predictions with high confidence. An common defense mechanism is regularization through adversarial training which injects worst-case perturbations back into training to strengthen the decision boundaries, and to reduce overfitting. In this context, we perform an investigation of 3x3 convolution filters that form in adversarially-trained models. Filters are extracted from 71 public models of the linf-RobustBench CIFAR-10/100 and ImageNet1k leaderboard and compared to filters extracted from models built on the same architectures but trained without robust regularization. We observe that adversarially-robust models appear to form more diverse, less sparse, and more orthogonal convolution filters than their normal counterparts. The largest differences between robust and normal models are found in the deepest layers, and the very first convolution layer, which consistently and predominantly forms filters that can partially eliminate perturbations, irrespective of the architecture. Data & Project website: https://github.com/paulgavrikov/cvpr22w_RobustnessThroughTheLens

arXiv commentAccepted at the CVPR 2022 "The Art of Robustness" Workshop

References in corpus (23)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• The Lottery Ticket Hypothesis: Finding Sparse, Trainable Neural Networks
• Theoretically Principled Trade-off between Robustness and Accuracy
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systems
• Fast is better than free: Revisiting adversarial training
• Using Pre-Training Can Improve Model Robustness and Uncertainty
• Neural Photo Editing with Introspective Adversarial Networks
• Adversarial Weight Perturbation Helps Robust Generalization
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack
• Fixing Data Augmentation to Improve Adversarial Robustness
• MMA Training: Direct Input Space Margin Maximization through Adversarial Training
• Self-Adaptive Training: beyond Empirical Risk Minimization
• Boosting Adversarial Training with Hypersphere Embedding
• Improving Adversarial Robustness via Channel-wise Activation Suppressing
• Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks
• CNN Filter DB: An Empirical Investigation of Trained Convolutional Filters
• SAT: Improving Adversarial Training via Curriculum-Based Loss Smoothing
• Adversarially-Trained Deep Nets Transfer Better: Illustration on Image Classification
• LTD: Low Temperature Distillation for Gradient Masking-free Adversarial Training
• Is RobustBench/AutoAttack a suitable Benchmark for Adversarial Robustness?