[论文解读] Anti-aliasing Deep Image Classifiers using Novel Depth Adaptive Blurring and Activation Function

Tahmid Hossain, Shyh Wei Teng+2 more|arXiv (Cornell University)|Oct 3, 2021

Adversarial Robustness in Machine Learning参考文献 55被引用 4

一句话总结

本论文提出深度自适应模糊（DAB-pool）与一种新型抗混叠修正线性单元（AA-ReLU），以增强深度图像分类器的鲁棒性。通过学习层特定的模糊核并将低通滤波嵌入激活函数，该方法减少了下采样和非线性带来的混叠效应，在ResNet-101、VGG16和DenseNet-121上，于平移、噪声污染及对抗性攻击的鲁棒性基准测试中均达到当前最优性能。

ABSTRACT

Deep convolutional networks are vulnerable to image translation or shift, partly due to common down-sampling layers, e.g., max-pooling and strided convolution. These operations violate the Nyquist sampling rate and cause aliasing. The textbook solution is low-pass filtering (blurring) before down-sampling, which can benefit deep networks as well. Even so, non-linearity units, such as ReLU, often re-introduce the problem, suggesting that blurring alone may not suffice. In this work, first, we analyse deep features with Fourier transform and show that Depth Adaptive Blurring is more effective, as opposed to monotonic blurring. To this end, we outline how this can replace existing down-sampling methods. Second, we introduce a novel activation function -- with a built-in low pass filter, to keep the problem from reappearing. From experiments, we observe generalisation on other forms of transformations and corruptions as well, e.g., rotation, scale, and noise. We evaluate our method under three challenging settings: (1) a variety of image translations; (2) adversarial attacks -- both $\ell_{p}$ bounded and unbounded; and (3) data corruptions and perturbations. In each setting, our method achieves state-of-the-art results and improves clean accuracy on various benchmark datasets.

研究动机与目标

• 解决深度CNN对小幅度输入扰动（如图像平移、噪声和对抗性攻击）的脆弱性问题。
• 识别混叠是导致鲁棒性差的核心原因，尤其源于非均匀下采样和ReLU激活。
• 提出一种深度自适应模糊机制，通过在深层学习更强的模糊核，以保留高频内容。
• 设计一种新型激活函数（AA-ReLU），其内置低通滤波功能，防止高频混叠在非线性后重新进入特征。
• 验证该方法在多种扰动（包括平移、旋转、缩放和对抗性攻击）下的泛化能力。

提出的方法

• 提出DAB-pool，一种可学习的下采样模块，通过在深层使用更强的模糊核实现深度自适应模糊，替代最大池化或步长大卷积。
• 利用傅里叶分析表明，深层特征图包含更多高频能量，从而证明自适应模糊的必要性。
• 提出AA-ReLU，一种在ReLU中嵌入低通滤波器的改进版本，用于在激活后抑制高频分量。
• 在标准下采样和ReLU单元的位置使用DAB-pool与AA-ReLU进行网络训练，保持与现有架构的兼容性。
• 通过消融实验优化模糊核大小与可学习性，发现3×3高斯核在抑制混叠与特征保留之间达到最佳平衡。
• 将DAB-pool与AA-ReLU集成至ResNet-101、VGG16和DenseNet-121中，实现跨架构验证。

Figure 1 : Features from an original image (top), and its shifted variant (bottom). The baseline (ResNet-101) – without any low-pass filtering, and MaxBlurPool (MBP) [ 3 ] – with monotonic blurring, both experience signal degeneration due to aliasing. Our method retains bulk of the expected signal.

实验结果

研究问题

• RQ1 与固定或单调模糊相比，深度自适应模糊是否能提升深度图像分类器对小空间平移的鲁棒性？
• RQ2 是否可通过将低通滤波直接嵌入激活函数，有效防止非线性后高频混叠的重新引入？
• RQ3 DAB-pool与AA-ReLU在除简单平移外的多种数据污染和对抗性攻击下，其泛化能力达到何种程度？
• RQ4 自适应模糊与滤波激活的结合对收敛速度和干净准确率有何影响？
• RQ5 所提出的模块是否可在不修改网络架构的前提下，有效迁移至不同CNN架构？

主要发现

• DAB-pool采用3×3高斯模糊核时性能优于更大核（5×5、7×7），因为更大核在深层（空间尺寸较小）中过度模糊特征。
• DAB-pool（3×3）与AA-ReLU联合使用在ImageNet上达到81.45%的干净准确率，相比基线ResNet-101（ReLU + 最大池化）的76.37%提升5.08个百分点。
• 在对角线平移下，DAB-pool + AA-ReLU实现94.11%的平移一致性，显著高于基线（88.95%）及其他配置。
• 该方法在ImageNet-C数据污染和ImageNet-P扰动下均表现出更强鲁棒性，证明其泛化能力超越平移任务。
• 尽管训练时间更长（22.6分钟/周期），但模型收敛速度优于SABP，归因于AA-ReLU输出有界，缩小了优化搜索空间。
• 消融实验证实，即使与DAB-pool结合，AA-ReLU在平移不变性与干净准确率方面也持续优于ReLU与C-ReLU。

Figure 2 : (a) Fourier energy at different network depths (lower frequencies are in the centre). Heat maps are generated using feature maps, at different network depths, belonging to the ImageNet validation set. For all three networks, deeper feature maps have greater high frequency energy, suggesti