Deep learning algorithms have been known to be vulnerable to adversarial perturbations in various tasks such as image classification. This problem was addressed by employing several defense methods for detection and rejection of particular types of attacks. However, training and manipulating networks according to particular defense schemes increases computational complexity of the learning algorithms. In this work, we propose a simple yet effective method to improve robustness of convolutional neural networks (CNNs) to adversarial attacks by using data dependent adaptive convolution kernels. To this end, we propose a new type of HyperNetwork in order to employ statistical properties of input data and features for computation of statistical adaptive maps. Then, we filter convolution weights of CNNs with the learned statistical maps to compute dynamic kernels. Thereby, weights and kernels are collectively optimized for learning of image classification models robust to
adversarial attacks without employment of additional target detection and rejection algorithms.
 We empirically demonstrate that the proposed method enables CNNs to spontaneously defend against different types of attacks, e.g. attacks generated by Gaussian noise, fast gradient sign methods (Goodfellow et al., 2014) and a black-box attack (Narodytska & Kasiviswanathan, 2016). Deep convolutional neural networks are powerful and popular algorithms that achieve state-of-the-art performance in various computer vision tasks, such as object recognition. Despite the advances made by the recent architectures BID7 BID16 BID18 BID5 , they are discovered to be fragile to small but carefully directed perturbations of images BID17 , such that the targeted images can be classified to incorrect categories with high confidence, while humans are still able to correctly classify the attacked images, being undisturbed or even unaware of the perturbations. The vulnerability of these networks to these, so called adversarial examples, may lead to undesirable consequences in safety-and security-critical applications. provide an example of misclassification of traffic signs which could be a significant threat for autonomous driving systems that employ deep learning algorithms. Various adversarial attack methods for neural networks have been studied in numerous works. The majority of attack methods can be catalogued in three groups.1. Methods which use unspecific statistical noise: In this group, input images are perturbed using unspecific statistical noise, e.g. Gaussian noise, salt and pepper noise and blurring. Since shape and parameters of distribution functions that are used to generate noise are not determined, it is usually not easy to obtain a highly confident misclassification results with imperceptible perturbations BID17 . 2. Gradient based attack methods: They are used to generate high confidence imperceptible adversarial examples within few steps or one-shot gradient based noise. Some examples of the methods considered in this group are (Iterative) Fast Gradient Sign Method BID3 BID8 , L-BFGS BID19 , Jacobian-based Saliency Map BID12 and DeepFool . These methods require a white-box environment in order to make attacks. In other words, the full network architecture and weights are required to be accessible in order to obtain gradients towards input images.3. Black-box attack methods. These methods assume that only the output of the networks can be accessed. Substitute networks and greedy search of noisy pixels BID11 are considered in this group. It is worth mentioning that, methods such as transferring adversarial examples from another network, which is optimized with a sufficient part or the whole training datasets, are not considered as a genuine black-box method. In this work, inspired by the recent works BID0 BID4 that construct neural networks with data dependent weights, we propose a simple yet effective method to train CNNs by improving their robustness to adversarial perturbations. Our main idea is to adaptively filter convolution weights of CNNs by using statistical properties of input data and features. Concretely, we propose a HyperNetwork to compute statistical adaptive maps using these statistical properties (mean and variance) of input data and features for each input channel. Then, we obtain data dependent kernels for convolution operations by computing Hadamard (element-wise) product of computed maps and convolution weights. Our main contributions can be summarized as follows:1. We propose a new type of CNN architecture that employ HyperNetworks to dynamically generate data dependent convolution kernels with statistical properties of input data and features. 2. We empirically verify the robustness of our proposed models using large scale vision dataset, and demonstrate that their robustness is improved without using additional aforementioned computationally complex defense methods or spending effort to generate adversarial examples for training. Several defense methods have been proposed in the last decade, e.g. evolving uncertainty during training BID13 , training with adversarial examples BID6 BID21 BID20 , and training a smarter conjugate network for detecting adversarial perturbations BID9 .The most intuitive approach is to employ adversarial examples during training phase. BID3 propose to augment the training set with adversarial examples. That is, they simultaneously minimize the loss for original examples and the adversarial ones that are generated according to the aforementioned fast gradient sign method based on current weights. BID20 further ensemble the training data with adversarial examples produced from pre-trained models. They suggest that training with adversarial examples produced from the model being trained will lead to a degenerate minima, where the model is still undefended, except that its gradient points into a non-adversarial direction. BID21 propose to append a stability term to the objective function, which regularize the model to produce similar outputs for original examples and their perturbed versions, without considering the classification loss of perturbed examples. This approach is experimentally shown to be able to maintain or improve state-of-the-art performance on the original task. BID13 propose an approach based on defensively distilling knowledge from a conjugate network that shares the same structure. Precisely, the conjugate network is trained first with hard (binary) labels to prepare soft (0 − 1 probability) labels, a temperature T is further employed to control the uncertainty during the distillation. Although facing the risk of degraded performance, this type of defense is able to prohibit gradient based attacks by shrinking the magnitude of gradients with respect to the input image. BID9 propose a method to augment deep neural networks with a conjugate network which is trained on the binary classification task of distinguishing genuine data from data containing adversarial perturbations. They show empirically that adversarial perturbations can be detected surprisingly well even though they are quasi-imperceptible to humans. However these methods are usually cumbersome to carry out, either require more resources such as memories for the conjugate network, or longer training period due to the harder convergence properties caused by adversarial examples BID20 . In addition, their performance for clean examples may decrease. Moreover, these defense methods are not proposed to be cross-domain in general, and most of them are designed using prior information on incoming attacks, and have less or none robustness toward other types of attacks. Recently De BID0 propose a type of neural network using weights generated dynamically conditioned on an input (Dynamic Filter) with a small network. This type of architecture is able to increase flexibility of neural network without an excessive increase in the number of model parameters. They have empirically verified that a wide variety of filtering operations, such as local spatial transformations, as well as selective (de)blurring or adaptive feature extraction can be learned in this way. BID4 further generalize the architecture with HyperNetworks, and propose the static HyperNetworks as a weights factorization approach for deep convolutional networks. Although proved to be powerful, this architecture has not been used in large scale vision tasks due to the high dimension of weights in the recent state-of-the-art convolutional neural network architectures. We define adversarial examples as follows. Suppose that we are given a deep convolutional neural network optimized for standard object classification tasks p I = F W (I), where p ∈ R C is a vector of probability values, and W is the set of weights used at all layers of the network. Then the prediction of the network can be expressed as y p = arg max c (p I ), where p is the predicted probability for each class c ∈ C. The ground truth label of I is denoted by y. An adversarial example is denoted by I adv , whose prediction label is y p = y, while it is kept relatively close to the original example I, D(I, I adv ) < , where D is a chosen measure such as the l 2 distance. The desired output either can be trivial that only makes the network mis-classify I adv , or can be targeted to a special class y t such that y p = y t with a high confidence. An L layer convolutional neural network F W can be expressed as a series transformations each of which applies a spatial convolution operation DISPLAYFORM0 at the l th layer, where σ is a functional module such as activation, normalization or soft-max, and X 0 = I, X l+1 = Y l . We use W l to denote the corresponding weights that are employed at each layer, and DISPLAYFORM1 is the set of weights used in the network. In the later discussions, we omit the superscripts of the layer index l for simplicity. Vanilla CNNs carry out convolution between feature maps (or an input image) and stationary kernels by G(W, X) = W ⊗ X, where W ∈ R C×D×S×S , X ∈ R D×H×W , C is the number of output channels, D is the number of input channels, and S is the size of kernels. Our main idea is to adaptively filter convolution weights of CNNs using a HyperNetwork BID4 ) T θ that is parameterized by θ. For this purpose, the network T θ receives the channel-wise mean and standard deviation of input X as its input, and outputs a map M ∈ R S×S , which can be computed by M = T θ (µ X , σ X ), where µ X , σ X ∈ R D . Then, we compute Hadamard (element-wise) product ( ) over each S × S sub-kernels of the convolution weight W , and compute the map H C,D = W C,D M . Finally, we employ the obtained adaptive convolution kernels to perform the convolution operation, by G(H, X) = H ⊗ X. FIG0 provides an overview of this procedure. We choose the network T θ to be an ordinary two-layer neural network which employs l 2 regularization, and which has D/2 neurons in the hidden layer. ReLU is used as the activation function at the hidden layer, while the output layer employs sigmoid such that the elements of M take values in (0, 1). We use DISPLAYFORM2 to denote the set of T θ employed at each layer, and F W,T to denote the convolutional neural network equipped with SHC.The parameters θ computed at each layer are updated simultaneously with W using SGD with momentum after receiving the gradient DISPLAYFORM3 It is worthy mentioning that, HyperNetworks also back-propagate errors (or gradients) from upper to bottom layers by DISPLAYFORM4 We call this back-propagation route the HyperNetwork route, and the ordinary back-propagation route passing through the convolution operation the Convolution route. The total back-propagated error can be computed as the summation of errors propagating from both routes at each layer. Gaussian Noise Gaussian noise is the most commonly used attack type. In this paper, we employ a truncated version of Gaussian noise that restricts change of pixels within [− , ] by DISPLAYFORM0 Fast Gradient Sign Goodfellow et al. FORMULA5 proposed a white-box method to find perturbations by DISPLAYFORM1 where J(I, y) is a loss function such as y p for the trivial case (y p = y), or standard categorical crossentropy (CCE) loss with the targeted class CCE(y t , p I ). In this paper, we employ y t = arg min c (p I ) as the targeted class. This method can be extended to an iterative style BID8 , where a smaller bound α < is used for each step, and the output of the previous iteration will be clipped to apply changes in DISPLAYFORM2 Tramèr et al. FORMULA5 proposed a simple yet powerful novel attack that first applies a small random perturbation to an input, before finding the optimal perturbation under a first-order approximation, which can be formulated by DISPLAYFORM3 LocSerachAdv BID11 proposed an iterative approach that can efficiently locate a small set of pixels, without using any gradient information, which leads to misclassification by a deep neural network when it is perturbed. The algorithm targets to push the true label y below the k th variable of the probability vector p I . Briefly, it takes the output from the previous step (which is a clean image for the first step), and generates different perturbed versions, using a semi-random method according to the location of perturbed pixels in the previous step. Then, it performs a greedy search to select the pixels that fool the network most, and construct a new (perturbed) image. Although it has a chance of failure, this type of attack is still indefensible by far, since the applied perturbations do not depend on the architecture of the target network nor how the network is optimized. In the experimental evaluation of the method, we introduce a new method, called Relative Confidence Diminution (RCD) score, to measure its robustness to attacks in addition to classification accuracy. More precisely, RCD score is used to compute the difference between the Relative Confidence (RC), which can be formulated as the log ratio of confidence for the correct label and the variance of the noisy labels by Figure 2: An example of the RCD score obtained using different levels of Gaussian noise attacks. where SD stands for Standard Deviation. Intuitively, RCD score can be considered as a difference in "signal noise ratio" between predictions, and provide an intuition on how much the model is affected, when the adversarial perturbation is not strong enough to lead a misclassification. An adversarial perturbation that increases the confidence of an incorrect label will result a higher SD[p I,k ] k =y , thus we will obtain a larger RCD score. Figure 2 shows an example of RCD score obtained by employment of Gaussian noises with different σ. DISPLAYFORM0 In this section, we employ three sets of different models for evaluation: ResNet-18, ResNest-18-SHC; ResNet-50, ResNet-50-SHC (the SHC is only employed in convolution layers with 3 × 3 kernel size) BID5 ; a smaller prototype 10-layer plain network (denoted as Plain-10 and Plain-10-SHC). The Plain-10 network has the same number of channels for output feature maps as ResNet, but only has one convolution block (two 3 × 3 convolution layers) at each resolution. These models are optimized by classifying 1000 classes of ILSVRC-2012 dataset BID15 , using the same learning scheme provided in BID5 . The training and validation images are re-scaled within range [0, 1], all the hyper-parameters of the attacks follow this range. During testing, the validation images are first re-sized to 299 × 299, then the single center crop of 256 × 256 is fed into the networks. We employ 3 types of aforementioned attacks to generate adversarial examples. In this work, we put stress on the robustness of the networks other than the perceivability of perturbations. Therefore, beside generating imperceptible perturbations, we also introduce sets of parameters that are able to create heavier perturbations on the images, which may be able to be perceived by human in some cases. Gaussian noise In this test, we evaluate the robustness of network towards random Gaussian noise on the whole validation set of ILSVRC-2012, and the noisy examples are generated using (1). We perform the tests using three different standard deviation (σ) of noise and the results are reported in TAB1 . It can be seen that the performance of networks equipped with SHC is boosted in all the cases, and their robustness toward Gaussian noise is kept the same with the Plain-10 network, and it is improved by ∼ 2% for ResNet-18 and ResNet-50. In this test, we evaluate the robustness of network to Fast Gradient Sign Method and it's variants. For each comparison pair, we select 5,000 validation images that are correctly classified by both reference networks and SHC networks with high confidence (> 0.9), and create adversarial examples according to the equations FORMULA6 , FORMULA7 and (4). For the original FGSM, we employ the parameter = 0.02, and then we further employ another = 0.1 (denoted by FSGM- Table 3 : Model robustness against LSA attack. We select 500 images that are initially correctly classified with high confidence (> 0.9), and we apply the LSA algorithm to search the corresponding adversarial examples for 150 steps. We report the averaged RCD over attack steps. Step FORMULA7 Step 60Step 90 Step 120Step 150Acc. RCD Acc. RCD Acc. RCD Acc. RCD Acc. RCD TAB2 . Obviously, even without utilizing any type of defensive techniques during training, the proposed SHC networks obtain robustness to the gradient based attacks regardless of the methods and their strength. Meanwhile, it can be seen from the RCD scores that the gradient based attacks are better at confusing the networks than pure noise, and the effectiveness of different methods is different for different models. For instance, the RAND+FGSM is more effective in attacking ResNet-50 than I-FGSM for similar RCD scores but at a lower accuracy, while its effectiveness is on par with I-FGSM for ResNet-50-SHC. Moreover, for vanilla CNNs, the robustness is highly related with the depth (or training difficulty) of architectures, which suggests that the robustness is related to the back-propagation of attack gradients. On the other hand, the SHC based ResNet-50 performs worse than ResNet-18 in 3 of 4 situations, and we will further discuss on this observation in Section 4.2.LocSearchAdv The LocSearchAdv algorithm is employed for examining the robustness of proposed method to black-box attacks. We use most of the configurations proposed in the original paper, with an increased number of pixels perturbed at each step. That is, 10 pixels are selected to be perturbed for a non-stop 150 steps, thus a total of 1,500 pixels are selected and perturbed. The target of perturbations is set to decrease the confidence of the correct class regardless of the fact that the current image has been mis-classified already. We select 500 images that are correctly classified with high confidence for both networks, and record the change of average accuracy and RCD at different steps, these results are provided in Table 3 . Obviously, the proposed method performs better within the first dozens of steps of the LSA attack. It usually takes about 60 more steps for SHC models to obtain similar RCD scores as the reference model obtains. An example of how the image changes together with its confidence and RCD is shown in FIG2 . It is worth noticing that, given enough attempts, the method is able to successfully generate adversarial examples for most images though, it usually takes more attempts to fool the proposed method. The change of confidence of correct class and RCD scores along with attack steps are depicted by brown and blue curves, respectively. The images with "best" perturbations are shown at the top of the figure. We mark the images that are correctly classified with green frames, and the images that are mis-classified with red frames. We also provide the obtained M at the last convolution layer of ResNet-50-SHC. In this case, the confidence for vanilla ResNet-50 drops fast at the beginning of the attack, and results in a failure in defence of the attack. The proposed method maintains a high confidence until step 90, and correctly classified the adversarial examples at step 150. Considering a binary image classification problem, a class decision boundary of a deep neural network (DNN) can be defined as a hypersurface that partitions the input space into two target classes. Once the optimization of the DNN is finished, the decision boundary is computed, and the robustness of the DNN is determined by the properties of the decision boundary . In this section, we employ the concept of the quasi decision boundary to examine the observed robustness of an SHC network, when a network is attacked by a black-box greedy search algorithm such as LocSearchAdv. Given an SHC network F W,T and an input image I, we define a neighbourhood of an input as the set of images that differ from the input by small perturbations by DISPLAYFORM0 while the change of the output of the HyperNetwork with respect to the perturbations can be ignored. We assume that, the perturbed images from LSA at each step are in the neighbourhood of the current input, since the perturbation of several pixels can barely result in changes of statistics. FIG2 (b) provides an example of the change of M due to perturbations at every 30 steps. Now we state that a quasi decision boundary, is the decision boundary of a sub-network F H , where H = {H} L l=1 is the set of convolution kernels that are computed by the HyperNetwork with respect to an input image I and its neighbourhood. When the problem is restricted to classification of the given image and the images belonging to its neighbourhood, this type of quasi decision boundary can be considered as a good approximation of the true decision boundary. However, it will be broken once the target is out from the neighbourhood. We could consider the greedy search algorithm of LSA as follows: at each step, a set of random perturbed inputs {Î} ⊂ B I is used to estimate the strength of perturbations. Then, the best perturbations are accumulated to generate the adversarial image I . However as the progress goes on, the strength of perturbations estimated in former steps will become untrustworthy, since the image I is more likely to have left the neighbourhood of former inputs as a consequence of the accumulated perturbations. Thus the attack progress will be halted or even reversed due to the unreliability until it finds the perturbations that breaks the true decision boundary of F W,T . The results in TAB2 appears that the ResNet-50-SHC performs worse towards most gradient base methods, compared to ResNet-18-SHC , regardless of the better accuracy it obtained using clean images and the images perturbed by Gaussian noise. Meanwhile we notice that, for vanilla CNN models, the robustness is related to the training difficulty and the gradient propagation of architectures. Thus in order to analyze the robustness of SHC model, we further carry out a set of experiments to separately attack the sub-network F H and HyperNetworks T θ , respectively. More precisely, we block the gradients that pass through T θ (the HyperNetworks route) when attacking F H , and vice versa. Note that these procedures are only employed in generating adversarial examples with respect to the partially back-propagated attack gradients, while the generated examples are still fed into the whole SHC-network for evaluation. FIG3 shows an example of the gradients ∇ I J obtained from different routes. We employ the RAND-FGSM attack and report the results in TAB4 . It can be observed that the proposed method is as easy to be fooled as a vanilla CNN, if we only consider the gradients passing through its sub-network F H (SHC-W, which can be treated as a vanilla CNN regarding a single input).On the other hand, most of the examples, which only receive the adversarial attack gradients that are obtained from the HyperNetworks (SHC-T), can be still correctly classified with small decrease in confidence. This observation suggests that employment of the HyperNetworks together with the statistical properties of input data and features is helpful for weakening (dispersing) the adversarial attack gradients. In this work, we propose a simple yet effective method to improve robustness of convolutional neural networks (CNNs) to adversarial attacks by training CNNs using data dependent adaptive convolution kernels. To this end, we employ HyperNetworks to dynamically generate data dependent convolution kernels with statistical properties of input data and features. The robustness of our proposed method is verified using 3 different types of attack with state-of-the-art CNN models trained on the ILSVRC-2012 dataset. Moreover, the robustness is obtained spontaneously during a normal training progress without losing any performance in the original tasks. This shed light on building practical deep learning systems that focus on the target without a concern of attacker. On the other hand, there still exists uncertainty on the mechanism of the robustness remains to be solved in the future works. Furthermore, designing of network architectures that employ more powerful HyperNetworks with better adversarial robustness is still an open problem.
We modified the CNN using HyperNetworks and observed better robustness against adversarial examples. Improving the robustness and reliability of deep convolution neural networks by using data-dependent convolution kernels