Recent studies show that convolutional neural networks (CNNs) are vulnerable under various settings, including adversarial examples, backdoor attacks, and distribution shifting.   Motivated by the findings that human visual system pays more attention to global structure (e.g., shape) for recognition while CNNs are biased towards local texture features in images, we propose a unified framework EdgeGANRob based on robust edge features to improve the robustness of CNNs in general, which first explicitly extracts shape/structure features from a given image and then reconstructs a new image by refilling the texture information with a trained generative adversarial network (GAN). In addition, to reduce the sensitivity of edge detection algorithm to adversarial perturbation, we propose a robust edge detection approach Robust Canny based on the vanilla Canny algorithm. To gain more insights, we also compare EdgeGANRob with its simplified backbone procedure EdgeNetRob, which performs learning tasks directly on the extracted robust edge features. We find that EdgeNetRob can help boost model robustness significantly but at the cost of the clean model accuracy. EdgeGANRob, on the other hand, is able to improve clean model accuracy compared with EdgeNetRob and without losing the robustness benefits introduced by EdgeNetRob. Extensive experiments show that EdgeGANRob is resilient in different learning tasks under diverse settings.
 Convolutional neural networks (CNNs) have been studied extensively (Goodfellow et al., 2016) , and have achieved state-of-the-art performance in many learning tasks (He et al., 2016; . However, recent works have shown that CNNs are vulnerable to adversarial examples (Carlini and Wagner, 2017; Goodfellow et al., 2014b; Szegedy et al., 2013) , where imperceptible perturbation can be added to the test data to tamper the predictions. Different from adversarial examples where test data is manipulated, an orthogonal setting: data poisoning or backdoor attacks where training data is manipulated to reduce model's generalization accuracy and achieve targeted poisoning attack Chen et al., 2017b ). In addition, recent studies show that CNNs tend to learn surface statistical regularities instead of high level abstraction, leading it fails to generalize to the superficial pattern transformation (radial kernel, random kernel (Jo and Bengio, 2017a; Wang et al., 2019a; . We refer to this problem as model's robustness under distribution shifting. How to improve the general robustness of DNNs under these settings remains unsolved. To improve the robustness of CNNs, recent studies explore the underlying cause of their vulnerability. For example, Ilyas et al. (2019) attributes the existence of adversarial examples to the existence of non-robust but highly-predictive features. They suggest to train a classifier only on "robust features" which contain the necessary information for recognition and are insensitive to small perturbations. In addition, it is shown that human recognition relies mainly on global object shapes rather than local patterns (e.t. textures), while CNNs are more biased towards the latter (Baker et al., 2018; Geirhos et al., 2019) . For instance, Geirhos et al. (2019) creates a texture-shape cue conflict, such as a cat shape with elephant texture, and feeds it to an Imagenet trained CNN and huamn respectively. While Human can still recognize it as a cat, CNN wrongly predicts it as an elephant. Therefore, the bias toward local features potentially contributes to CNN's vulnerability to adversarial examples, distribution shifting and patterns of backdoor attacks. Particularly, previous researcher also shows Figure 1 : Structure of the proposed pipeline. EdgeNetRob feeds the output of edge detection to the classifier to produce robust predictions, while EdgeGANRob refill the edge image with texture information to reconstruct a new instance for predictions. that the shape of objects is the most important cue for human object recognition (Landau et al., 1988) . Given the above evidence, a natural question emerges: Can we improve the robustness of CNNs by making it rely more on global shape structure? To answer this question, we need to formalize the notion of global shape structure first. We propose to consider a specific type of shape representation: edges (image points that have sharp change in brightness). Using edges comes with two benefits: 1) it is an effective device for modelling shape; 2) edges are easy to be captured in images, with many sophisticated algorithms (Canny, 1986; Xie and Tu, 2015; Liu et al., 2017) available. More specifically, this paper explores a new approach EdgeGANRob to improve the robustness of the CNNs to adversarial attacks,distribution shifting and backdoor attacks by leveraging structural information in images. The unified framework is shown in Figure 1 . As illustrated, a simplified version of EdgeGANRob is a two-stage procedure named EdgeNetRob, which extracts the structural information by detecting edges and then trains the classifier on the extracted edges. As a consequence, EdgeNetRob forces the CNNs to make prediction solely based on shape information, rather than texture/color, thus eliminating the texture bias (Geirhos et al., 2019) . Our results show that EdgeNetRob can improve CNNs' robustness. However, there are still two challenges: (i) the direct differentiable edge detection algorithms are also vulnerable to attacks, which may lead to low robustness against sophisticated adaptive attackers. To handle this problem, we propose a robust edge detection algorithm, Robust Canny. Using Robust Canny is able to EdgeNetRob dramatically improve the robustness of EdgeGANRob. As a result, this combined method outperforms the adversarial retraining based defense method . (ii). Although EdgeNetRob improves the CNNs' robustness, it decreases the clean accuracy of CNNs due to the missing texture/color information. This motivates the development of EdgeGANRob, which embeds a generative model to refill the texture/colors based on the edge images before they are fed into the classifier. Please find more visualization results on the anonymous website: https://sites.google.com/view/edgenetrob. The main contributions of this paper include: (i) We propose a unified framework EdgeGANRob to improve the robustness of CNNs against multiple tasks simultaneously, which explicitly extracts edge/structure information from input images and then reconstructs the original images by refilling the textural information with GAN. (ii) To remain robust against sophisticated adaptive evasion attacks, in which attackers have access to the defense algorithm, we propose a robust edge detection approach Robust Canny based on the vanilla Canny algorithm to reduce the sensitivity of edge detector to adversarial perturbation. (iii) To further demonstrate the effectiveness of the inpainting GAN in EdgeGANRob, we also evaluate its simplified backbone procedure EdgeNetRob by performing learning tasks directly on the extracted robust edge features. To justify the above contributions, we conduct thorough evaluation on EdgeNetRob and EdgeGANRob in three tasks: adversarial attacks, distribution shifting and backdoor attacks, where significant improvements are achieved. We introduced a new method based on robust edge features for improving general model robustness. By combining a robust edge feature extractor with the generative adversarial network, our method simultaneously achieves competitive results in terms of both adversarial robustness and generalization under distribution shifting. Additionally, we show that it can also be used to improve robustness against backdoor attacks. Our results highlight the importance of using shape information in improving model robustness and we believe it is a promising direction for future work.
A unified  model  to improve model robustness against multiple tasks
{"src": "scitldr-AIC_train", "paper_id": "SJlPZlStwS"}