[Paper Review] Anti-aliasing Deep Image Classifiers using Novel Depth Adaptive Blurring and Activation Function

Tahmid Hossain, Shyh Wei Teng+2 more|arXiv (Cornell University)|Oct 3, 2021

Adversarial Robustness in Machine Learning55 references4 citations

TL;DR

This paper proposes Depth Adaptive Blurring (DAB-pool) and a novel anti-aliasing ReLU (AA-ReLU) to enhance robustness in deep image classifiers. By learning layer-specific blur kernels and embedding low-pass filtering into the activation function, the method reduces aliasing from down-sampling and non-linearities, achieving state-of-the-art performance on shift, corruption, and adversarial robustness benchmarks across ResNet-101, VGG16, and DenseNet-121.

ABSTRACT

Deep convolutional networks are vulnerable to image translation or shift, partly due to common down-sampling layers, e.g., max-pooling and strided convolution. These operations violate the Nyquist sampling rate and cause aliasing. The textbook solution is low-pass filtering (blurring) before down-sampling, which can benefit deep networks as well. Even so, non-linearity units, such as ReLU, often re-introduce the problem, suggesting that blurring alone may not suffice. In this work, first, we analyse deep features with Fourier transform and show that Depth Adaptive Blurring is more effective, as opposed to monotonic blurring. To this end, we outline how this can replace existing down-sampling methods. Second, we introduce a novel activation function -- with a built-in low pass filter, to keep the problem from reappearing. From experiments, we observe generalisation on other forms of transformations and corruptions as well, e.g., rotation, scale, and noise. We evaluate our method under three challenging settings: (1) a variety of image translations; (2) adversarial attacks -- both $\ell_{p}$ bounded and unbounded; and (3) data corruptions and perturbations. In each setting, our method achieves state-of-the-art results and improves clean accuracy on various benchmark datasets.

Motivation & Objective

• Address the vulnerability of deep CNNs to small input perturbations such as image shifts, noise, and adversarial attacks.
• Identify aliasing as a core cause of poor robustness, especially due to non-uniform down-sampling and ReLU activation.
• Propose a depth-adaptive blurring mechanism that learns stronger blur kernels in deeper layers to preserve high-frequency content.
• Design a novel activation function (AA-ReLU) with built-in low-pass filtering to prevent high-frequency aliasing from re-entering features.
• Demonstrate generalization of the method across diverse perturbations, including translation, rotation, scaling, and adversarial attacks.

Proposed method

• Propose DAB-pool, a learnable down-sampling module that applies depth-adaptive blur kernels—stronger in deeper layers—replacing max-pooling or strided convolutions.
• Use Fourier analysis to show that deeper feature maps contain more high-frequency energy, justifying the need for adaptive blurring.
• Introduce AA-ReLU, a modified ReLU with an embedded low-pass filter that suppresses high-frequency components post-activation.
• Train the network with DAB-pool and AA-ReLU in place of standard down-sampling and ReLU units, maintaining compatibility with existing architectures.
• Optimize the blur kernel size and learnability via ablation, finding a 3×3 Gaussian kernel optimal for trade-off between suppression and feature retention.
• Integrate DAB-pool and AA-ReLU into ResNet-101, VGG16, and DenseNet-121 for cross-architecture validation.

Figure 1 : Features from an original image (top), and its shifted variant (bottom). The baseline (ResNet-101) – without any low-pass filtering, and MaxBlurPool (MBP) [ 3 ] – with monotonic blurring, both experience signal degeneration due to aliasing. Our method retains bulk of the expected signal.

Experimental results

Research questions

• RQ1 Can depth-adaptive blurring improve robustness to small spatial shifts in deep image classifiers compared to fixed or monotonic blurring?
• RQ2 Does embedding low-pass filtering directly into the activation function prevent re-introduction of high-frequency aliasing after non-linearity?
• RQ3 To what extent do DAB-pool and AA-ReLU improve generalization under diverse corruptions and adversarial attacks beyond simple translation?
• RQ4 How does the combination of adaptive blurring and filtered activation affect convergence speed and clean accuracy?
• RQ5 Can the proposed modules be effectively transferred across different CNN architectures without architectural modification?

Key findings

• DAB-pool with a 3×3 Gaussian blur kernel outperforms larger kernels (5×5, 7×7), as larger kernels excessively blur features, especially in deeper layers with small spatial dimensions.
• The combination of DAB-pool (3×3) and AA-ReLU achieves 81.45% clean accuracy on ImageNet, outperforming the baseline ResNet-101 with ReLU and max-pooling (76.37%) by 5.08 percentage points.
• Under diagonal shift, DAB-pool + AA-ReLU achieves 94.11% shift consistency, significantly higher than the baseline (88.95%) and other configurations.
• The method improves robustness to data corruptions (ImageNet-C) and perturbations (ImageNet-P), demonstrating generalization beyond translation.
• Despite higher training time (22.6 min/epoch), the model converges faster than SABP due to the bounded output of AA-ReLU, reducing the search space for optimization.
• The ablation study confirms that AA-ReLU consistently improves shift invariance and clean accuracy over ReLU and C-ReLU, even when combined with DAB-pool.

Figure 2 : (a) Fourier energy at different network depths (lower frequencies are in the centre). Heat maps are generated using feature maps, at different network depths, belonging to the ImageNet validation set. For all three networks, deeper feature maps have greater high frequency energy, suggesti