Improving the Robustness of Deep Convolutional Neural Networks Through
  Feature Learning
Deep convolutional neural network (DCNN for short) models are vulnerable to
examples with small perturbations. Adversarial training (AT for short) is a
widely used approach to enhance the robustness of DCNN models by data
augmentation. In AT, the DCNN models are trained with clean examples and
adversarial examples (AE for short) which are generated using a specific attack
method, aiming to gain ability to defend themselves when facing the unseen AEs.
However, in practice, the trained DCNN models are often fooled by the AEs
generated by the novel attack methods. This naturally raises a question: can a
DCNN model learn certain features which are insensitive to small perturbations,
and further defend itself no matter what attack methods are presented. To
answer this question, this paper makes a beginning effort by proposing a
shallow binary feature module (SBFM for short), which can be integrated into
any popular backbone. The SBFM includes two types of layers, i.e., Sobel layer
and threshold layer. In Sobel layer, there are four parallel feature maps which
represent horizontal, vertical, and diagonal edge features, respectively. And
in threshold layer, it turns the edge features learnt by Sobel layer to the
binary features, which then are feeded into the fully connected layers for
classification with the features learnt by the backbone. We integrate SBFM into
VGG16 and ResNet34, respectively, and conduct experiments on multiple datasets.
Experimental results demonstrate, under FGSM attack with $\epsilon=8/255$, the
SBFM integrated models can achieve averagely 35\% higher accuracy than the
original ones, and in CIFAR-10 and TinyImageNet datasets, the SBFM integrated
models can achieve averagely 75\% classification accuracy. The work in this
paper shows it is promising to enhance the robustness of DCNN models through
feature learning.
Jin Ding, Jie-Chao Zhao, Yong-Zhi Sun, Ping Tan, Ji-En Ma, You-Tong Fang
# Improving the Robustness of Deep Convolutional Neural Networks Through Feature Learning

###### Abstract

Deep convolutional neural network (DCNN for short) models are vulnerable to examples with small perturbations. Adversarial training (AT for short) is a widely used approach to enhance the robustness of DCNN models by data augmentation. In AT, the DCNN models are trained with clean examples and adversarial examples (AE for short) which are generated using a specific attack method, aiming to gain ability to defend themselves when facing the unseen AEs. However, in practice, the trained DCNN models are often fooled by the AEs generated by the novel attack methods. This naturally raises a question: can a DCNN model learn certain features which are insensitive to small perturbations, and further defend itself no matter what attack methods are presented. To answer this question, this paper makes a beginning effort by proposing a shallow binary feature module (SBFM for short), which can be integrated into any popular backbone. The SBFM includes two types of layers, i.e., Sobel layer and threshold layer. In Sobel layer, there are four parallel feature maps which represent horizontal, vertical, and diagonal edge features, respectively. And in threshold layer, it turns the edge features learnt by Sobel layer to the binary features, which then are feceded into the fully connected layers for classification with the features learnt by the backbone. We integrate SBFM into VGG16 and ResNet34, respectively, and conduct experiments on multiple datasets. Experimental results demonstrate, under FGSM attack with \(\epsilon=8/255\), the SBFM integrated models can achieve averagely 35% higher accuracy than the original ones, and in CIFAR-10 and TinyImageNet datasets, the SBFM integrated models can achieve averagely 75% classification accuracy. The work in this paper shows it is promising to enhance the robustness of DCNN models through feature learning.

 binary features, robustness of deep convolutional neural network, Sobel layer, threshold layer

## I Introduction

It is well known that deep convolutional neural network (DCNN for short) models can be fooled by examples with small perturbations [1, 2], which results in serious consequences when they are applied into the safety-critical applications, e.g., autonomous driving, airport security, and industry automation. Therefore, it is of great significance to enhance the robustness of DCNN models.

Adversarial training (AT for short) is a widely used approach to enhance the robustness of DCNN models by data augmentation [3, 4, 5, 6]. In each training step, one specific attack method is employed to generate adversarial examples (AE for short), which together with the clean examples are input into DCNN models, expecting to make the trained DCNN models defend themselves on unseen AEs. However, the trained models can still be fooled by AEs figured out by the novel attack methods. This naturally raises a question: can a DCNN model learn certain features which are insensitive to small perturbations, and further defend itself no matter what attack methods are presented.

Fig. 1 shows a clean example and its adversarial counterpart. With the presence of small noise, the DCNN models amplify the noise through the deep structures, which is reduced into the final texture features, and probably output the wrong classification results. However, comparing Fig. 1(a) and Fig. 1(b), it is clear to see the shape of the cat is legible in both images, which prompts us the shape-like features may be helpful in making a correct decision with the presence of the small noise. In this regard, Li _et al._[7] proposed a part-based recognition model with human prior knowledge, which first segments the objects, scores the object parts, and outputs the classification class based on the scores. Sitawarin _et al._[8] also proposed a part-based classification model, which combines part segmentation with a classifier. Both works take parts of objects into consideration to enhance adversarial robustness of DCNN models. The results are outstanding, but they require the detailed segmentation annotations and cannot be integrated into popular recognition or detection architectures.

Fig. 2 shows the thresholded edge images of Fig. 1. We can see both binary images are almost the same, which indicates binary features can be taken as shape-like features to enhance the robustness of DCNN models. In this paper, a shallow binary feature module (SBFM for short) is proposed to extract

Fig. 1: **Clean example and adversarial example.**
the binary features of the input images, which stacks two types of layers-Sobel layer and threshold layer. In Sobel layer, there are four parallel feature maps which represent horizontal, vertical, and diagonal edge features respectively [9, 10]. And in threshold layer, it turns the learnt edge features from Sobel layers to the binary features, which then are feeded into the fully connected layers for classification with the features learnt by the backbones. SBFM is lightweight and can be integrated into any popular backbone, e.g., VGG [11] and ResNet [12]. We integrate SBFM into VGG16 and ResNet34, respectively. The experimental results on CIFAR-10, TinyImageNet, and Cats-and-dogs datasets show the training accuracy, test accuracy, and training time of the SBFM integrated models are on a par with those of original ones, and when attacked by FGSM [1] with \(\epsilon=8/255\), the SBFM integrated models can achieve averagely 35% higher classification accuracy than the original ones, and 75% classification accuracy in CIFAR-10 and TinyImageNet datasets. The results demonstrate the binary features learnt by SBFM can enhance the robustness of DCNN models notably.

The contributions of this paper can be summarized as follows:

1. We first raise the question "can a DCNN model learn certain features which are insensitive to small perturbations, and further defend itself no matter what attack methods are presented", and make a beginning effort on this.
2. SBFM is proposed to learn binary features through Sobel layer and threshold layer, which is lightweight and can be integrated into any popular backbone.
3. Experimental results on multiple datasets show, when attacked by FGSM with \(\epsilon=8/255\), the SBFM integrated models can achieve averagely 35% higher accuracy compared to the original ones, and 75% classification accuracy n CIFAR-10 and TinyImageNet datasets.

## II Related Work

**Adversarial Training.** AT is a widely used approach to enhance the robustness of DCNN models by generating AEs during each training step. Tsipras _et al._[13] found there exists a tradeoff between robustness and standard accuracy of the models generated by AT, due to the robust classifiers learning a different feature representation compared to the clean classifiers. Madry _et al._[14] proposed an approximated solution framework to the optimization problems of AT, and found PGD-based AT can produce models defending themselves against the first-order adversaries. Kannan _et al._[15] investigated the effectiveness of AT at the scale of ImageNet [16], and proposed a logit pairing AT training method to tackle the tradeoff between robust accuracy and clean accuracy. Wong _et al._[17] accelerated the training process using FGSM attack with random initialization instead of PGD attack [18], and reached significantly lower cost. Xu _et al._[19] proposed a novel attack method which can make a stronger perturbation to the input images, resulting in the robustness of models by AT using this attack method is improved. Li _et al._[20] revealed a link between fast growing gradient of examples and catastrophic overfitting during robust training, and proposed a subspace AT method to mitigate the overfitting and increase the robustness. Dabouei _et al._[21] found the gradient norm in AT is higher than natural training, which hinders the training convergence of outer optimization of AT. And they proposed a gradient regularization method to improve the performance of AT. AT improves the robustness of the DCNN models by generating AEs using one specific attack method. However, in practice, the models trained by AT may be still vulnerable when facing the novel attack methods.

**Part-based Model.** Li _eg al._[7] argued one reason that DCNN models are prone to be attacked is they are trained only on category labels, not on the part-based knowledge as humans do. They proposed a object recognition model, which first segments the parts of objects, scores the segmentations based on human knowledge, and final outputs the classification results based on the scores. This part-based model shows better robustness than classic recognition models across various attack settings. Sitawarin _et al._[8] also thought richer annotation information can help learn more robust features. They proposed a part segmentation model with a head classifier trained end-to-end. The model first segments objects into parts, and then makes predictions based on the parts.

In both works, the shape-like features are learnt to enhance the robustness of DCNN models remarkably. However, the proposed part-based models require the detailed segmentation annotation of objects and prior knowledge, and are hard to be combined with the existing recognition or detection architectures. In this paper, we propose a binary feature learning module which can be integrated into any popular backbone and enhance the robustness of DCNN models notably.

## III Shallow Binary Feature Module

In this section, we give a detailed description of SBFM, which is lightweight and can be integrated into any popular backbone. SBFM stacks two types of layers-Sobel layer and threshold layer. In Sobel layer, four parallel feature maps are learnt to represent horizontal, vertical, and diagonal features respectively. In threshold layer, it sets a threshold to turn the features from Sobel layers into binary features. The architecture of a SBFM integrated classification model is shown in Fig. 3.

Fig. 2: **Thresholded edge images of Fig. 1.**
**Sobel Layer.** A Sobel layer consists of four parallel feature maps, i.e., horizontal feature maps, vertical feature maps, positive diagonal feature maps, and negative diagonal feature maps. For each feature map, a constrained kernel is designed to ensure the corresponding features can be learnt. Taking kernel size of 3 by 3 for example, the four types of kernel are shown in Fig. 4.

For horizontal kernel in Fig. 4,

\[w_{ij}\left\{\begin{array}{ll}\in[0,\,1]&\text{if }i=1,\,j=1,\,2,\,3,\\ =0&\text{if }i=2,\,j=1,\,2,\,3,\\ \in[\text{-1},\,0]&\text{if }i=3,\,j=1,\,2,\,3,\end{array}\right. \tag{1}\]

For vertical kernel in Fig. 4,

\[w_{ij}\left\{\begin{array}{ll}\in[0,\,1]&\text{if }j=1,\,i=1,\,2,\,3,\\ =0&\text{if }j=2,\,i=1,\,2,\,3,\\ \in[\text{-1},\,0]&\text{if }j=3,\,i=1,\,2,\,3,\end{array}\right. \tag{2}\]

For positive diagonal kernel in Fig. 4,

\[w_{ij}\left\{\begin{array}{ll}\in[0,\,1]&\text{if }(i,j)\in\{(1,\,1), (1,\,2), (2,\,1)\,\},\\ =0&\text{if }(i,j)\in\{(1,\,3), (2,\,2), (3,\,1)\,\},\\ \in[\text{-1},\,0]&\text{if }(i,j)\in\{(2,\,3), (3,\,2), (3,\,3)\,\},\end{array}\right. \tag{3}\]

For negative diagonal kernel in Fig. 4,

\[w_{ij}\left\{\begin{array}{ll}\in[0,\,1]&\text{if }(i,j)\in\{(1,\,2), (1,\,3), (2,\,3)\,\},\\ =0&\text{if }(i,j)\in\{(1,\,1), (2,\,2), (3,\,3)\,\},\\ \in[\text{-1},\,0]&\text{if }(i,j)\in\{(2,\,1), (3,\,1), (3,\,2)\,\},\end{array}\right. \tag{4}\]

The output of a Sobel layer is the addition of the four feature maps.

**Threshold Layer.** Features computed from the last Sobel layer are feeded into threshold layer, which can be denoted as \(\textbf{x}^{in}\in R^{N\times P\times Q}\), where \(N\) is the number of channels of the feature map, and \(P\) and \(Q\) are the width and height of each channel respectively. We set a threshold for each channel, and the features output from the threshold layer, \(\textbf{x}^{out}\), can be computed using Eq. 5.

\[x^{out}_{ikj}=\left\{\begin{array}{ll}1&\text{if }x^{in}_{ikj}\geq t\text{ * }\max(\textbf{x}^{in}_{i}),\\ 0&\text{if }x^{in}_{ikj}<t\text{ * }\max(\textbf{x}^{in}_{i}),\end{array}\right. \tag{5}\]

where \(i\) = 1,2,...,\(N\), \(k\) = 1,2,...,\(P\), and \(j\) = 1,2,...,\(Q\). \(t\) \(\in\) [0, 1], and \(\max(\textbf{x}^{in}_{i})\) represents the maximum value of channel \(i\).

It is obvious to see that, the higher \(t\), the less binary features obtained; the smaller \(t\), the more binary features obtained.

## IV Experiments

In this section, we conduct experiments to examine whether the SBFM integrated VGG16 (VGG16-SBFM) and ResNet34 (ResNet34-SBFM) are more robust than the original ones on CIFAR-10 [22], TinyImageNet [23], and Cats-and-Dogs [24] datasets. Firstly, the effects of SBFM on model training are described. Secondly, the robustness of the SBFM integrated models and the original ones are compared under FGSM attack. And thirdly, the impacts of the number of Sobel layers and threshold on the robustness of the SBFM integrated models are analyzed. All experiments are coded using TensorFlow, and run on Intel i9 cpu of 3.6GHz with 64 GB RAM. One TITAN XP GPU is employed.

### _Datasets_

**CIFAR-10.** CIFAR-10 dataset includes 10 classes, each of which has 6,000 training images, and 1,000 test images. In experiments, 10% training images in each class are taken as validation images. The resolution of images is 32\(\times\) 32.

**TinyImageNet.** TinyImageNet dataset includes 200 classes, each of which has 500 training images, and 50 validation images. In experiments, validation images are taken as test images, and 10% training images in each class are taken as validation images. The resolution of images is 64\(\times\) 64.

**Cats-and-Dogs.** Cats-and-Dogs dataset includes 2 classes, each of which has 12,500 images. In experiments, 9,000, 1,000, and 2,500 images in each class are taken as training, validation, and test images, respectively. The resolution of images is resized to 224\(\times\) 224.

Fig. 4: **Four types of kernels of Sobel layer.**

Fig. 3: **The architecture of a SBFM integrated classification model.**
### _Effects of SBFM on model training_

We examine the effects of SBFM on model training by comparing three metrics between the SBFM integrated models and the original ones, i.e., training accuracy, test accuracy, and training time per epoch. In SBFM, there are generally two parameters to be set-one is the number of Sobel layers, denoted as \(l\), and the other is the proportion coefficient for threshold layer, denoted as \(t\). On CIFAR-10 dataset, \(l\) and \(t\) are set to 3 and 0.8, respectively, for both VGG16-SBFM and ResNet34-SBFM. On TinyImageNet and Cats-and-Dogs dataset, \(l\) and \(t\) are set to 2 and 0.8 for VGG16-SBFM, and 3 and 0.8 for ResNet34-SBFM, respectively. The loss function, optimizer, the batch size, and the number of epochs are set to be the same. Each model is run for five times, and the average values are recorded. Table I shows the comparison of training performance between SBFM integrated models and the original ones. From the table, it is clear to see the SBFM integrated models are on a par with the original models on three metrics, which indicates SBFM has no side effect on model training and is lightweight.

### _Performance comparison between SBFM integrated models and original models under FGSM attack_

We compare the classification accuracy between SBFM integrated models and original ones under FGSM attack, with \(\epsilon\) set to 0.1/255, 0.5/255, 1/255, 2/255, 3/255, 5/255, and 8/255. \(l\) and \(t\) of the SBFM integrated models are set to the same values in Sec. IV-B. Each model is run for five times, and the average value is recorded.

Fig. 5-Fig. 7 show the changing curves of the classification accuracy for both SBFM integrated models and the original ones with the attack intensity \(\epsilon\) increasing. From the figures, we can see that, in both CIFAR-10 and TinyImageNet datasets, the changing curves of SBFM integrated models are much more gentle compared to the original ones with the increase of \(\epsilon\), showing the robustness is enhanced greatly after integrating SBFM. In Cats-and-Dogs dataset, the changing patterns of curves for both SBFM integrated models and the original ones are nearly the same, showing no notable advantage by SBFM for robustness enhancement. Here we make a note that, when training on Cats-and-Dogs dataset, the strides and pooling coefficients for SBFM are forced to set larger than those on CIFAR-10 and TinyImageNet datasets, due to the memory limitation. This may result in the poor performance of SBFM integrated models on Cats-and-Dogs dataset.

Table II shows the classification accuracy at \(\epsilon\) = 8/255 for both SBFM integrated models and the original ones on three datasets. From the table, we can see that, on CIFAR-10, VGG16-SBFM is 47.43% higher accurate than VGG16, achieving 77.44% classification accuracy. ResNet34-SBFM is 43.46% higher accurate than ResNet34, achieving 66.41% classification accuracy. And on TinyImageNet dataset, VGG16-SBFM is 44.37% higher accurate than VGG16, achieving 72.38% classification accuracy. ResNet34-SBFM is 71.10% higher accurate than ResNet34, achieving 81.46% classification accuracy. The results demonstrate the binary

Fig. 5: **Changing curve of classification accuracy with the strengthening of the attack intensity \(\epsilon\) on CIFAR-10.**

Fig. 6: **Changing curve of classification accuracy with the strengthening of the attack intensity \(\epsilon\) on TinyImageNet.**
features learnt by SBFM can enhance the robustness of DCNN models notably.

Fig. 8-Fig. 11 show the AEs of \(\epsilon\) = 8/255 which can be classified correctly by the SBFM integrated models.
## V Discussions

The experimental results from Section IV shows SBFM has no side effect on model training, and it is lightweight and can be integrated into any backbone. Furthermore, the binary features learnt by the SBFM can enhance the robustness of DCNN models notably.

Here, we want to emphasize that, in this paper, a heuristic combination form of texture features and binary features (shown in Fig. 3) is introduced. We believe it is worthwhile to explore other effective and efficient combination forms of both features to enhance the robustness of DCNN models. Also, from the experimental results, it can be seen that, the performance of SBFM integrated models under attack changes distinctly for different parameter settings, and the generalization ability of the trained SBFM integrated models is relatively weak at certain parameter settings. It hints us that it is of great importance to design an optimization framework for

Fig. 11: **Correctly classified adversarial examples of Cats-and-Dogs by ResNet34-SBFM.**

Fig. 12: **SBFM with 1 Sobel layer, 2 Sobel layers, and 3 Sobel layers. HK stands for horizontal kernel. VK stands for vertical kernel. PDK stands for positive diagonal kernel. NDK stands for negative diagonal kernel.**
parameter searching to yield the SBFM integrated models with exceptional classification accuracy under attack and satisfying generalization ability.

## VI Conclusions

Enhancing the robustness of DCNN models is of great significance for the safety-critical applications in the real world. In this paper, we first raise the question "can a DCNN model learn certain features which are insensitive to small perturbations, and further defend itself no matter what attack methods are presented", and make a beginning effort to answer it. A shallow binary feature module is proposed, which is lightweight and can be integrated into any popular backbone. The experimental results on multiple datasets show the binary features learnt by the shallow binary feature module can enhance the robustness of DCNN models notably. In future's work, we endeavor to explore other effective and efficient combination forms of binary features and texture features, and design an optimization framework for the parameter searching to yield models with good performance under attack and generalization ability. The work in this paper shows it is promising to enhance the robustness of DCNN models through feature learning.
