Deep neural networks (DNNs) have been shown to be vulnerable to adversarial attacks -- subtle, perceptually indistinguishable perturbations of inputs that change the response of the model. In the context of vision, we hypothesize that an important contributor to the robustness of human visual perception is constant exposure to low-fidelity visual stimuli in our peripheral vision. To investigate this hypothesis, we develop \RBlur, an image transform that simulates the loss in fidelity of peripheral vision by blurring the image and reducing its color saturation based on the distance from a given fixation point. We show that compared to DNNs trained on the original images, DNNs trained on images transformed by \RBlur are substantially more robust to adversarial attacks, as well as other, non-adversarial, corruptions, achieving up to 25\% higher accuracy on perturbed data.
Paper
Similar papers
Peer review
Summary
This paper studies the effect of foveation via adaptive gaussian blurring and color modulation in training on an image. Their goal is not computer vision driven, nor ML based, but rather to shed light on the physiological nature of the retina and spatially adaptive computation in humans -- that may prove useful for machines towards achieving robustness without adversarial training.
Strengths
* This paper was very easy to read, and understand. All the figures and tables are coherent, so I applaud the efforts of presentation of the authors. * Authors co-modulate adaptive gaussian blurring with color loss and noise (however the contribution of each factor in the "foveation" is not obvious). * Authors present a solid list of experiments in o.o.d. experiments and also adversarial attacks. Their benchmarks regarding adversarial training are on spot (though which type of AT I believe is not precised). * Their claims are grounded, and not too strong, so that is good given the evidence they have presented and also works that other authors have done.
Weaknesses
I believe the strongest weakness is that it's not clear to me what the contribution is of each effect : 1) noise ; 2) adaptive gaussian blurring; 3) fixations. I wonder to what point do the extra fixations add as a proxy for data augmentation when training the model. I.e.: can a false conclusion be arrived that "foveation aids in robustness" by virtue of adding extra images. I think authors need to add 2 more controls for me to be more enthusiastic about this paper: 1) Train all non-foveated networks with additional sets of images via data augmentation procedures (like rotation, mirroring, random crop and blurring) 2) Train all foveated networks with less images to match the original dataset size of the networks that recieve non-foveated inputs. In addition it's not clear to me why authors add noise as part of the foveation. Why not just go straight towards the adaptive gaussian blurring? Is there a psychological reason to add the noise in the foveation process?
Questions
* Missing References (to add in line 32 and through-out the paper regarding links of biological vision (peripheral computation) + adversarial robustness): **“Finding Biological Plausibility for Adversarially Robust Features via Metameric Tasks”. Harrington & Deza. ICLR 2022.** * Missing Reference in Line 51: I believe Pramod et al. did in fact perform robustness tests on their foveated adaptive blur image. * Missing Reference in Line 52: Characterizing a snapshot of perceptual experience. By Cohen et al. from the Journal of Experimental Pscyhology 2021. Overall I think this paper is a good contribution to the field, it should provide further discussion at NeurIPS about foveation, which many vision scientists have been longing to see these type of augmentations be used in computer vision. It would be quite nice if authors release a R-Blur augmentatino module in pytorch.
Rating
7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
Confidence
5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.
Soundness
3 good
Presentation
4 excellent
Contribution
3 good
Limitations
See Weaknesses above.
Summary
In their paper the authors introduce R-Blur as a foveation technique for biologically inspired defense against adversarial attacks on DNNs. With their approach they try to simulate the human visual field by blurring and desaturating the image depending on the distance to a given fixation point. They continue to evaluate their approach on Ecoset and ImageNet and try to show that R-Blur can achieve results like adversarial training. Furthermore, they provide an ablation study to prove the significance of the individual components.
Strengths
- I find the idea of taking a biologically inspired approach to foveation and the attempt to recreate the human perceptive field through color and grey acuity appealing. - The results for the common non-adversarial corruption show an improvement compared to other methods indicating some significance.
Weaknesses
- In Figure 5 we only see a comparison with two baselines that feature little to no adversarial defense. Here it is clear that R-Blur achieves higher accuracies under white-box attacks. A comparison with adversarial training would be more insightful, because later only the mean value of these experiments is presented which indicates that AT outperforms R-Blur by a margin. This weakens the statement that R-Blur generalizes robustness. - The ablation study provides some insights into the importance of some components but is not explained adequately, e.g., the dynamic selection of the fixation point seems to worsen the performance. - The formatting to indicate the best and the second-best entries of Table 1 is somewhat misleading: it would be better to underline the second-best result or use colors. - Writing: Some of the figure captions are not comprehensible or not descriptive enough (e.g., Figure 2 and Figure 3). Overall: Although R-Blur is well-motivated and implemented in a reasonable way, only a small part of the experiments indicates a significant improvement (mainly the non-adversarial corruptions, Table 1.) while in general adversarial training seems to be superior. Currently I decide for a borderline reject, but if the before mentioned weaknesses are addressed and the following questions are answered, I am willing to increase the rating. Minor Detail: Some figures (e.g., Figure 7 and especially Figure 2) are too small and are sometimes missing entries (e.g., R-Blur-5FL in Figure 7(b).1 or 0 entries in Figure 5)
Questions
- The main motivation for the parameter setting for the visual acuity estimation is based on the photopic and visual acuity in human vision which should approximate the real curves (Figure 1(a)). It is not entirely clear how this estimated acuity relates to the original, because there it is measured on the x-axis through the degree in the visual field. In Figure 1 it seems to be the distance-based eccentricity although it should be zero were the original had zero degrees. How exactly does your approximation match the original and why does the transfer work? - In the related work section several other foveation-based robustness models are mentioned and only a very short comparison is given. A more detailed comparison with other foveation techniques in general would be insightful as well. It is mentioned that these techniques were not used in an adversarial context before, but how does R-Blur stand out? - For the eccentricity computation only on maximum of the Manhattan-Norm was considered. Were other quantified metrics (e.g., L2-Norm as in the actual human perceptive field) used in the experiments and how did they perform?
Rating
7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
Confidence
3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
Soundness
3 good
Presentation
3 good
Contribution
3 good
Limitations
The authors address their limitations adequately in their Limitations section. These include a significant loss of clean accuracy and the current fixpoint selection method.
Summary
The paper presents a biologically inspired approach that improves the robustness of DNNs against samples with adversarial perturbations or common corruptions. In the proposed approach the models are trained using the images transformed using the proposed R-Blur (Retina Blur) transformation. The proposed R-Blur simulates foveation by adaptively blurring the image pixels and reducing the color saturation based on the distance from the given fixation point. The effectiveness of the proposed approach is demonstrated by considering models trained on CIFAR-10, Ecoset, and ImageNet datasets, respectively.
Strengths
The proposed biologically inspired approach is a non-adversarial training approach that yields robust models. These models are robust to unseen adversarial and common corruptions. Experimental results validate the same.
Weaknesses
1. The proposed approach depends on an external model for fixation point generation. The fixation model can act as a computational and performance bottleneck. It is not clear whether the white-box evaluation considers the susceptibility of the fixation model. 2. From the ablation study, it can be seen that noise plays a critical role. The paper fails to highlight the role of noise in the proposed R-blur that simulates foveation. 3. Missing experimental details: Important experimental setup details are missing (such as architecture details, training setup, and attack setting). Furthermore, certain experiments are missing to demonstrate the effectiveness of the proposed approach (computation time, auto attack). Refer to the question section.
Questions
1. Is the proposed R-blur frame differentiable? 2. For the white box adversarial attack, was the R-blur and the fixation model considered for generating the adversarial samples? 3. Is the perturbation size ($\epsilon$) defined for 0-1 or 0-255 pixel range (L178 - L179)? 4. To further validate the adversarial robustness of the proposed approach present sanity check described in [a,b]. 5. How is the pixel wise fusion of color (HxWx3) and the grayscale (HxW) image performed? 6. Numbering for equation below L142 missing. 7. It is not clear why the subset of test images are used for Ecoset and ImageNet. Are the models trained on the entire training set or subset for these cases? 8. The data-augmentation techniques described in L164 to L167 are used only for the proposed approach or for all compared methods? Sensitivity of the proposed approach to fixation method. Training details of DeepGaze-iii are missing (i) dataset and (ii) depth of the ResNet [L192]. 9. Provide results for AutoAttack, apart from APGD attack. 10. In L202, L204, and L254: does "..ResNet.." mean WideResNet-22-4 11. Is the model robust to geometric attacks (e.g. translation, rotation, and affine)? 12. Provide comparison of the training and inference time for the methods considered. [a] Carlini et al. "On Evaluating Adversarial Robustness" arxiv 2019 [b] Athalye et al. "Obfuscated Gradients Give a False Sense of Security" ICML 2018
Rating
6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
Confidence
3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
Soundness
2 fair
Presentation
3 good
Contribution
3 good
Limitations
The main limitation of the proposed approach is dependency on the external fixation model which can act as a bottleneck in terms of computation and performance. Further, it is not straightforward to adapt the proposed approach to other computer vision tasks such as segmentation, and multi-object classification. The authors are suggested to include a discussion on the same.
Summary
This paper proposes a data augmentation technique named R-Blur to improve the robustness of vision classifiers against adversarial perturbations and other non-adversarial image corruptions. The method is inspired by human visual systems where the perceived scene consists of varying levels of fidelity. As such, the training images are modified in a way that adaptive Gaussian filtering is applied centered around the fixation point in the image. Results on CIFAR-10, Ecoset, and Imagenet demonstrate that R-Blur improves robustness to adversarial perturbations and common corruptions compared to standard trained models.
Strengths
Originality: There are only a few biologically inspired adversarial defense techniques. The proposed method mimics the peripheral vision in human visual systems and modifies the training images with an adaptive Gaussian filter. The approach is very unique and interesting. Quality: The paper is well-written. Clarity: The motivation behind the proposed method as well as the overall structure of the paper is clear. The technical details are explained clearly. Significance: The presence of adversarial examples presents a security concern for deep neural networks utilized in various applications. This paper introduces a novel approach to bolster network robustness.
Weaknesses
This paper has two main weaknesses. 1. The choice of baseline methods in evaluation. The R-Blur method, in its essence, is a Gaussian data augmentation technique, while the only non-adversarial training technique in the baseline is RandAffine. To concretely verify that the adaptive filtering from R-Blur is indeed improving the robustness of the model beyond simple Gaussian data augmentation, other baseline methods such as Gaussian augmentation (with difference variances) and l2 regularization are necessary. 2. The paper position itself as an approach to improve the adversarial robustness of deep neural networks. However, results in Sec. 3 show that the improvement in adversarial robustness towards the APGD attack is significantly lower than adversarial training. Also, the choice of $\epsilon$ in the adversarial robustness is much smaller than the standard values used in other works.
Questions
Question/clarification: Is $W_{V}$ in (1) the width of the image? Are (2), (3), and (4) from previous work ([26]?), or are they part of the novel contributions from this paper? Why are Laplace and Cauchy distributions used? Perhaps some additional discussion following the definitions can be helpful to further improve the clarity. In the evaluation of adversarial robustness, why is only APGD in Autoattack used, rather than the complete version of AutoAttack? In other adversarial training methods, we can explicitly control the trade-off between standard accuracy and robust accuracy. For instance, $\beta$ in TRADES, $\epsilon$ of the perturbation in standard adversarial training. Does such a concept exist for R-Blur? I think understanding such a mechanism can further improve the adversarial robustness of models trained with R-Blur. Suggestion: In Figure 4, it seems that the sequence of fixation points does not converge at all. Also, from Ln182, it seems that the results are based on randomly selected fixation points. One suggestion is to identify the fixation point as the pixel location with the highest saliency. Saliency-based data augmentation (i.e., Ma et al and Uddin et al) can be a good starting point. Be consistent with the use of gray or grey (grayscale or greyscale). Ma, Avery, et al. "SAGE: Saliency-Guided Mixup with Optimal Rearrangements." arXiv preprint arXiv:2211.00113 (2022). Uddin, A. F. M., et al. "Saliencymix: A saliency guided data augmentation strategy for better regularization." arXiv preprint arXiv:2006.01791 (2020).
Rating
5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
3 good
Presentation
3 good
Contribution
3 good
Limitations
Limitations including the trade-off between the robust accuracy and the standard accuracy are discussed.
Discussion
Dear Reviewers, so far, there has not been any discussion on this paper with the authors. In case you have any further questions after reading the rebuttal, please use the opportunity of the discussion phase to ask the authors! Best regards, AC
Thank you for the clarification. Most of my concerns have been addressed. I will raise my score to 5.
We are glad that we were able to fully address the reviewer's concerns and we thank the reviewer for increasing their score. Given that 5 is a borderline score, we wanted to ask if there are any lingering questions or concerns due to which the reviewer is currently unable to give a higher score to our paper? We are committed to working with the reviewer to address any issues and improve our paper.
The main reason for the score comes from the limited improvement in adversarial robustness.
We thank the reviewer for responding. We understand the reviewer's reservation that the improvement in adversarial robustness is not very large, and we respect the reviewer's decision regarding the score. We would like to point out that the adversarial robustness of R-Blur does not arise from being trained on adversarially perturbed data, so the gains in adversarial robustness are expected to be lower than adversarial training. This is because the gap between the training and testing distribution for adversarial training is much smaller than it is for R-Blur. Furthermore, unlike adversarial training, the robustness of R-Blur is not limited to norm-bounded adversarial attacks and extends to non-adversarial corruptions. On the other hand, an adversarial trained model is about as robust to non-adversarial corruptions as a vanilla resnet. Finally, the adversarial and non-adversarial robustness of R-Blur is significantly better than baseline models and contemporary biologically motivated methods.
Thank you for addressing my comments | Worth high-lighting role of Noise
Thank you for addressing my concerns. I will increase my score from 6 to 7. I think what definitely needs to be high-lighted (as another review er pointed out) is the role of noise in this framework. There is a paper I believe also cited in the submission by Dapello, Marques et al. NeurIPS 2020 (Simulating a Primary Visual Cortex at the Front of CNNs Improves Robustness to Image Perturbations) that has a similar story where most of the job is being done by the noise rather than the Gabors, so all-in-all authors should find a way to add stress this in the discussion so that future works should also analyze the co-modulation of noise with certain inductive biases and how they affect adversarial robustness in DNNs (to see what property is carrying the robustness weight).
We are glad that we were able to fully address the reviewer's concern, and we thank them for increasing their score. The reviewer's recommendation is well taken and we will definitely highlight the role of noise in the camera-ready version.
Thank you for your response. Please provide the response for the following: 1. Regarding the adaptation of the proposed method to other CV tasks: Can the authors explain how the proposed method can be used for semantic segmentation tasks? Here, the model has to predict labels for each pixel. 2. For the $l_\infty$ attacks, is the perturbation size defined for 0-1 or 0-255 pixel range (L178 - L179)? 3. Provide results for the sanity check experiments described in [a,b]. Consider the CIFAR-10 dataset and $l_\infty$ attack. (i) plot of accuracy vs. perturbation size, (ii) plot of accuracy vs. attack iterations, (iii) black-box attack, and (iv) results for FGSM and PGD attacks.
We thank the reviewer for responding and raising important questions. We have responded to each question below: **Q1** Several popular semantic segmentation, like DeepLab (Chen, et.al 2018) and FCN (Long, et.al 2015), extract intermediate feature maps from a pretrained deep CNN, which are then further processed by DNNs (usually CNNs) to predict logits for each semantic class at each spatial coordinate. The resulting logit map may be upscaled to match the spatial dimensions of the input image if any downsampling was involved in the earlier steps. In the case of DeepLabv3+, two feature maps are extracted from different layers of a ResNet-101. The map from the earlier layer represents low-level features, while the map from the later layer represents higher-level features. The high-level features are processed with dilated convolutions, while 1x1-convolutions are applied to low-level features. The processed low and high-level features are concatenated channel-wise and passed through a 3x3-conv to predict logits. The logit map is then upscaled to match the image size. If only 1 fixation is used, an R-Blur augmented ResNet can simply replace the vanilla CNN in most semantic segmentation models. For example, the pretrained vanilla ResNet-101 in DeepLabv3+ can simply be replaced with a pretrained R-Blur augmented ResNet-101 without the need for any further modifications. If multiple fixations are used then we would need to make some simple modifications. One option would be to run semantic segmentation and obtain logit maps independently for each fixation point and then average them to get the final logit map. Another option would be to extract low and high-level feature maps independently for each fixation point, then aggregate them by summing, averaging, or concatenation before passing them to the downstream DNN that computes logit maps from them. In either case, the modification is relatively simple and easy to implement. We expect the robustness of R-Blur augmented ResNets to carry over to any semantic segmentation model that uses them, however, verifying this is part of future work. Chen, Liang-Chieh, et al. "Encoder-decoder with atrous separable convolution for semantic image segmentation." Proceedings of the European conference on computer vision (ECCV). 2018. Long, Jonathan, Evan Shelhamer, and Trevor Darrell. "Fully convolutional networks for semantic segmentation." Proceedings of the IEEE conference on computer vision and pattern recognition. 2015. **Q2** It is defined in 0-1. The image pixels are also normalized by 255 to be in 0-1. **Q3** (i) This plot is presented in Figure 5 of the paper and the results are repeated in the following table as well. We see that accuracy decreases with increasing perturbation size. | $\|\|\epsilon\|\|_\infty$ | Accuracy | | ---------------------------- | ------------ | | 0 | 90.4 | | 0.002 | 84.3 | | 0.004 | 77.1 | | 0.008 | 55.4 | (ii) This plot for Imagenet is presented in Figure 1(a) of the appendix included with the supplementary material. Upon the reviewer's request we have repeated these experiments for CIFAR-10 using 100-step APGD with $\|\|\epsilon\|\|_\infty=0.008$ and the results are in the table below. We see that accuracy decreases with increasing number of steps. | Steps | Accuracy | | ------- | ------------- | | 1 | 61.7 | | 5 | 56.1 | | 10 | 55.6 | | 25 | 55.4 | | 100 | 55.4 | (iii) As requested by the reviewer, we evaluated the CIFAR-10 R-Blur model under the back-box Square attack [Andriushchenko et.al 2020] with $\|\|\epsilon\|\|_\infty=0.008$ and observed it achieved 64.9% accuracy. In comparison, the APGD attack was significantly more successful and brought the accuracy of the model down to 56.1% with only 5 iterations. We would also like to point out that a black-box attack is included in AutoAttack, for which we have presented results in Figure 1 of the global response. Andriushchenko, Maksym, et al. "Square attack: a query-efficient black-box adversarial attack via random search." European conference on computer vision. Cham: Springer International Publishing, 2020. (iv) Upon the reviewer's request, we evaluated R-Blur under FGSM attack and compared its accuracy with 100-step APGD in the table below. We see that for each perturbation size APGD is able to achieve lower accuracy than FGSM. | $\|\|\epsilon\|\|_\infty$ | FGSM | 100-step APGD| | ---------------------------- | -------- | ----------------- | | 0.002 | 85.2 | 84.3 | | 0.004 | 78.1 | 77.1 | | 0.008 | 61.5 | 55.4 | All these results indicate that R-Blur does not obfuscate gradients and does genuinely improve adversarial robustness. We hope we have addressed the reviewer's concerns. We would be happy to continue this discussion if further clarification is required. If no further concerns remain, we would like to request the reviewer to consider increasing the rating. Thank You.
Thanks for the response. The major concerns has been addressed. I have updated the score.
Thank you for the response. I was indeed referring to Figure 2 instead of Figure 1. Sorry, for the confusion. My concerns were appropriately addressed and I am raising my score to 7.
Decision
Accept (poster)