Robustness Of Convolutional Neural Networks Research Articles

Exploring adversarial examples and adversarial robustness of convolutional neural networks by mutual information

Exploring adversarial examples and adversarial robustness of convolutional neural networks by mutual information

A Vision Enhancement and Feature Fusion Multiscale Detection Network

In the field of object detection, there is often a high level of occlusion in real scenes, which can very easily interfere with the accuracy of the detector. Currently, most detectors use a convolutional neural network (CNN) as a backbone network, but the robustness of CNNs for detection under cover is poor, and the absence of object pixels makes conventional convolution ineffective in extracting features, leading to a decrease in detection accuracy. To address these two problems, we propose VFN (A Vision Enhancement and Feature Fusion Multiscale Detection Network), which first builds a multiscale backbone network using different stages of the Swin Transformer, and then utilizes a vision enhancement module using dilated convolution to enhance the vision of feature points at different scales and address the problem of missing pixels. Finally, the feature guidance module enables features at each scale to be enhanced by fusing with each other. The total accuracy demonstrated by VFN on both the PASCAL VOC dataset and the CrowdHuman dataset is better than that of other methods, and its ability to find occluded objects is also better, demonstrating the effectiveness of our method.The code is available at https://github.com/qcw666/vfn.

Face Emotion Recognition (FER) Using Convolutional Neural Network (CNN) in Machine Learning

Abstract: Facial Emotion Recognition (FER) is a burgeoning field within the realm of machine learning, central to computer vision and artificial intelligence. This paper offers a detailed examination of the role of Convolutional Neural Networks (CNNs) in advancing FER methodologies. Focusing on the utilization of facial images as a primary information source, the review delves into traditional FER approaches, categorizing and summarizing foundational systems and algorithms. In response to the evolving landscape, this study specifically explores the integration of CNNs in FER strategies. CNNs have emerged as pivotal tools for capturing intricate spatial features inherent in facial expressions, demonstrating their effectiveness in enhancing the nuanced interpretation of emotional states. The discussion emphasizes the adaptability and robustness of CNNs in addressing the complexities of facial emotion recognition. This paper provides insights into publicly accessible evaluation metrics and benchmark results, establishing a standardized framework for the quantitative assessment of FER research employing CNNs. Aimed at both newcomers and seasoned researchers in the FER domain, this review serves as a comprehensive guide, imparting foundational knowledge and steering future investigations. The ultimate goal is to contribute to a deeper understanding of the latest state-of-the-art studies in facial emotion recognition, particularly within the context of CNNs in machine learning.

A Statistical Physics Perspective: Understanding the Causality Behind Convolutional Neural Network Adversarial Vulnerability.

The adversarial vulnerability of convolutional neural networks (CNNs) refers to the performance degradation of CNNs under adversarial attacks, leading to incorrect decisions. However, the causes of adversarial vulnerability in CNNs remain unknown. To address this issue, we propose a unique cross-scale analytical approach from a statistical physics perspective. It reveals that the huge amount of nonlinear effects inherent in CNNs is the fundamental cause for the formation and evolution of system vulnerability. Vulnerability is spontaneously formed on the macroscopic level after the symmetry of the system is broken through the nonlinear interaction between microscopic state order parameters. We develop a cascade failure algorithm, visualizing how micro perturbations on neurons' activation can cascade and influence macro decision paths. Our empirical results demonstrate the interplay between microlevel activation maps and macrolevel decision-making and provide a statistical physics perspective to understand the causality behind CNN vulnerability. Our work will help subsequent research to improve the adversarial robustness of CNNs.

LAFIT: Efficient and Reliable Evaluation of Adversarial Defenses With Latent Features.

Deep convolutional neural networks (CNNs) can be easily tricked to give incorrect outputs by adding tiny perturbations to the input that are imperceptible to humans. This makes them susceptible to adversarial attacks, and poses significant security risks to deep learning systems, and presents a great challenge in making CNNs robust against such attacks. An influx of defense strategies have thus been proposed to improve the robustness of CNNs. Current attack methods, however, may fail to accurately or efficiently evaluate the robustness of defending models. In this paper, we thus propose a unified lp white-box attack strategy, LAFIT, to harness the defender's latent features in its gradient descent steps, and further employ a new loss function to normalize logits to overcome floating-point-based gradient masking. We show that not only is it more efficient, but it is also a stronger adversary than the current state-of-the-art when examined across a wide range of defense mechanisms. This suggests that adversarial attacks/defenses could be contingent on the effective use of the defender's hidden components, and robustness evaluation should no longer view models holistically.

Consistency of convolutional neural networks in dermoscopic melanoma recognition: A prospective real-world study about the pitfalls of augmented intelligence.

Deep-learning convolutional neural networks (CNNs) have outperformed even experienced dermatologists in dermoscopic melanoma detection under controlled conditions. It remains unexplored how real-world dermoscopic image transformations affect CNN robustness. To investigate the consistency of melanoma risk assessment by two commercially available CNNs to help formulate recommendations for current clinical use. A comparative cohort study was conducted from January to July 2022 at the Department of Dermatology, University Hospital Basel. Five dermoscopic images of 116 different lesions on the torso of 66 patients were captured consecutively by the same operator without deliberate rotation. Classification was performed by two CNNs (CNN-1/CNN-2). Lesions were divided into four subgroups based on their initial risk scoring and clinical dignity assessment. Reliability was assessed by variation and intraclass correlation coefficients. Excisions were performed for melanoma suspicion or two consecutively elevated CNN risk scores, and benign lesions were confirmed by expert consensus (n = 3). 117 repeated image series of 116 melanocytic lesions (2 melanomas, 16 dysplastic naevi, 29 naevi, 1 solar lentigo, 1 suspicious and 67 benign) were classified. CNN-1 demonstrated superior measurement repeatability for clinically benign lesions with an initial malignant risk score (mean variation coefficient (mvc): CNN-1: 49.5(±34.3)%; CNN-2: 71.4(±22.5)%; p = 0.03), while CNN-2 outperformed for clinically benign lesions with benign scoring (mvc: CNN-1: 49.7(±22.7)%; CNN-2: 23.8(±29.3)%; p = 0.002). Both systems exhibited lowest score consistency for lesions with an initial malignant risk score and benign assessment. In this context, averaging three initial risk scores achieved highest sensitivity of dignity assessment (CNN-1: 94%; CNN-2: 89%). Intraclass correlation coefficients indicated 'moderate'-to-'good' reliability for both systems (CNN-1: 0.80, 95% CI:0.71-0.87, p < 0.001; CNN-2: 0.67, 95% CI:0.55-0.77, p < 0.001). Potential user-induced image changes can significantly influence CNN classification. For clinical application, we recommend using the average of three initial risk scores. Furthermore, we advocate for CNN robustness optimization by cross-validation with repeated image sets. ClinicalTrials.gov (NCT04605822).

Visual Analytics of Neuron Vulnerability to Adversarial Attacks on Convolutional Neural Networks

Adversarial attacks on a convolutional neural network (CNN)—injecting human-imperceptible perturbations into an input image—could fool a high-performance CNN into making incorrect predictions. The success of adversarial attacks raises serious concerns about the robustness of CNNs, and prevents them from being used in safety-critical applications, such as medical diagnosis and autonomous driving. Our work introduces a visual analytics approach to understanding adversarial attacks by answering two questions: (1) Which neurons are more vulnerable to attacks? and (2) Which image features do these vulnerable neurons capture during the prediction? For the first question, we introduce multiple perturbation-based measures to break down the attacking magnitude into individual CNN neurons and rank the neurons by their vulnerability levels. For the second, we identify image features (e.g., cat ears) that highly stimulate a user-selected neuron to augment and validate the neuron’s responsibility. Furthermore, we support an interactive exploration of a large number of neurons by aiding with hierarchical clustering based on the neurons’ roles in the prediction. To this end, a visual analytics system is designed to incorporate visual reasoning for interpreting adversarial attacks. We validate the effectiveness of our system through multiple case studies as well as feedback from domain experts.

Improving robustness for model discerning synthesis process of uranium oxide with unsupervised domain adaptation

The quantitative characterization of surface structures captured in scanning electron microscopy (SEM) images has proven to be effective for discerning provenance of an unknown nuclear material. Recently, many works have taken advantage of the powerful performance of convolutional neural networks (CNNs) to provide faster and more consistent characterization of surface structures. However, one inherent limitation of CNNs is their degradation in performance when encountering discrepancy between training and test datasets, which limits their use widely. The common discrepancy in an SEM image dataset occurs at low-level image information due to user-bias in selecting acquisition parameters and microscopes from different manufacturers. Therefore, in this study, we present a domain adaptation framework to improve robustness of CNNs against the discrepancy in low-level image information. Furthermore, our proposed approach makes use of only unlabeled test samples to adapt a pretrained model, which is more suitable for nuclear forensics application for which obtaining both training and test datasets simultaneously is a challenge due to data sensitivity. Through extensive experiments, we demonstrate that our proposed approach effectively improves the performance of a model by at least 18% when encountering domain discrepancy, and can be deployed in many CNN architectures.

Robustness assessment of hyperspectral image CNNs using metamorphic testing

Remote sensing has proven its utility in many critical domains, such as medicine, military, and ecology. Recently, we have been witnessing a surge in the adoption of deep learning (DL) techniques by the remote sensing community. DL-based classifiers, such as convolutional neural networks (CNNs), have been reported to achieve impressive predictive performances reaching 99% of accuracy when applied to hyperspectral images (HSIs), a high-dimensional type of remote sensing data. However, these deep learners are known to be highly sensitive to even slight perturbations of their high-dimensional raw inputs. In real-world contexts, concerns can be raised about how robust they really are against corner-case scenarios. When HSI classifiers are applied in safety-critical applications, ensuring an adequate level of robustness is crucial to prevent unexpected system behaviors. Yet, there are few studies dealing with their robustness, nor are RGB-testing methods able to cover the HSI-specific challenges. This led us to propose a systematic testing method to assess the robustness of the CNNs trained to classify HSIs. First, we elaborate domain-specific metamorphic transformations that simulate naturally-occurring distortions of remote sensing HSIs. Then, we leverage metaheuristic search algorithms to optimize the fitness of synthetically-distorted inputs to stress the weaknesses of the on-testing CNN, while remaining in compliance with domain expert requirements, in order to preserve the semantic of the generated inputs. Relying on our metamorphic testing method, we assess the robustness of established and novel CNNs for HSI classification, and demonstrate their failure, on average, in 25% of the produced test cases. Furthermore, we fine-tuned the tested CNNs on training data augmented with these failure-revealing metamorphic transformations. Results show that the fined-tuning successfully fixed at least 90% of the CNN weaknesses, with less than 1% of degradation in the original predictive performance, outperforming the common iterative gradient-based adversarial attack, namely, Projected Gradient Descent (PGD).

SCADefender: An Autoencoder-Based Defense for CNN-Based Image Classifiers

Convolutional neural networks (CNNs) have been enormously successful in a variety of image recognition tasks. Robustness is an important metric to evaluate the quality of CNNs. However, recent research shows that CNNs are particularly vulnerable to adversarial attacks. This paper proposes an adversarial defense method to increase the robustness of CNNs, namely, SCADefender. The proposed method trains a reformer on adversarial examples and the training set of a target classifier. The architecture of the reformer is stacked convolutional autoencoder. The adversarial examples are generated by using various adversarial attacks such as untargeted FGSM, untargeted CW [Formula: see text] and untargeted BIS. Given an input image, the trained reformer could remove the adversarial perturbations with a low computational cost. To demonstrate the effectiveness, the proposed method is compared with PuVAE, MagNet, and adversarial training on three well-known datasets including MNIST, Fashion-MNIST, and CIFAR-10. In terms of the average detection rate, the proposed method outperforms other methods. While the proposed method achieves an average detection rate of 97.78% for MNIST, 90.43% for Fashion-MNIST, and 80.64% for CIFAR-10, the comparable methods achieve only 23.69- 86.18% for MNIST, 63.90-79.70% for Fashion-MNIST, and 25.55-77.36% for CIFAR-10.

Data augmentation and data mining towards microstructure and property relationship for composites

PurposeIn recent years, the convolutional neural network (CNN) based deep learning approach has succeeded in data-mining the relationship between microstructures and macroscopic properties of materials. However, such CNN models usually rely heavily on a large set of labeled images to ensure the accuracy and generalization ability of the predictive models. Unfortunately, in many fields, acquiring image data is expensive and inconvenient. This study aims to propose a data augmentation technique to enhance the performance of the CNN models for linking microstructural images to the macroscopic properties of composites.Design/methodology/approachMicrostructures of composites are synthesized using discrete element simulations and Potts kinetic Monte Carlo simulations. Macroscopic properties such as the elastic modulus, Poisson's ratio, shear modulus, coefficient of thermal expansion, and triple-phase boundary length density are extracted on representative volume elements. The CNN model is trained using the 3D microstructural images as inputs and corresponding macroscopic properties as the labels. The comparison of the predictive performance of the CNN models with and without data augmentation treatment are compared.FindingsThe comparison between the prediction performance of CNN models with and without data augmentation showed that the former reduced the weighted mean absolute percentage error (WMAPE) for the prediction from 5.1627% to 1.7014%. This significant reduction signifies that the proposed data augmentation method can effectively enhance the generalization ability and robustness of CNN models.Originality/valueThis study demonstrates that data augmentation is beneficial for solving the problems of model overfitting, data scarcity, and sample imbalance for CNN-based deep learning tasks at a low cost. By developing more and advanced data augmentation techniques, deep learning accelerated homogenization will boost the multi-scale computational mechanics and materials.

Exploring the differences in adversarial robustness between ViT- and CNN-based models using novel metrics

Deep-learning models have demonstrated remarkable performance in a variety of fields, owing to advancements in computational power and the availability of extensive datasets for training large-scale models. Nonetheless, these models inherently possess a vulnerability wherein even small alterations to the input can lead to substantially different outputs. Consequently, it is imperative to assess the robustness of deep-learning models prior to relying on their decision-making capabilities. In this study, we investigate the adversarial robustness of convolutional neural networks (CNNs), vision transformers (ViTs), and hybrid CNNs ＋ViTs, which represent prevalent architectures in computer vision. Our evaluation is grounded on four novel model-sensitivity metrics that we introduce. These metrics are evaluated in the context of random noise and gradient-based adversarial perturbations. To ensure a fair comparison, we employ models with comparable capacities within each group and conduct experiments separately, utilizing ImageNet-1K and ImageNet-21K as pretraining data. Our fair experimental results provide empirical evidence that ViT-based models exhibit higher adversarial robustness than CNN-based counterparts, helping to dispel doubts about the findings of prior studies. Additionally, we introduce novel metrics that contribute new insights into the previously unconfirmed characteristics of these models.

Improving robustness of convolutional neural networks using element-wise activation scaling

Recent works reveal that re-calibrating intermediate activation of adversarial examples can improve the adversarial robustness of CNN models. The state of the arts exploit this feature at the channel level to help CNN models defend adversarial attacks, where each intermediate activation is uniformly scaled by a factor. However, we conduct a more fine-grained analysis on intermediate activation and observe that adversarial examples only change a portion of elements within an activation. This observation motivates us to investigate a new method to re-calibrate intermediate activation of CNNs to improve robustness. Instead of uniformly scaling each activation, we individually adjust each element within an activation and thus propose Element-Wise Activation Scaling, dubbed EWAS, to improve CNNs’ adversarial robustness. EWAS is a simple yet very effective method in enhancing robustness. Experimental results on ResNet-18 and WideResNet with CIFAR10 and SVHN show that EWAS significantly improves the robustness accuracy. Especially for ResNet18 on CIFAR10, EWAS increases the adversarial accuracy by 37.65% to 82.35% against C&W attack. The code and trained models are available at https://github.com/ieslab-ynu/EWAS.

CNN stability training improves robustness to scanner and IHC-based image variability for epithelium segmentation in cervical histology.

In digital pathology, image properties such as color, brightness, contrast and blurriness may vary based on the scanner and sample preparation. Convolutional Neural Networks (CNNs) are sensitive to these variations and may underperform on images from a different domain than the one used for training. Robustness to these image property variations is required to enable the use of deep learning in clinical practice and large scale clinical research. CNN Stability Training (CST) is proposed and evaluated as a method to increase CNN robustness to scanner and Immunohistochemistry (IHC)-based image variability. CST was applied to segment epithelium in immunohistological cervical Whole Slide Images (WSIs). CST randomly distorts input tiles and factors the difference between the CNN prediction for the original and distorted inputs within the loss function. CNNs were trained using 114 p16-stained WSIs from the same scanner, and evaluated on 6 WSI test sets, each with 23 to 24 WSIs of the same tissue but different scanner/IHC combinations. Relative robustness (rAUC) was measured as the difference between the AUC on the training domain test set (i.e., baseline test set) and the remaining test sets. Across all test sets, The AUC of CST models outperformed "No CST" models (AUC: 0.940-0.989 vs. 0.905-0.986, p < 1e - 8), and obtained an improved robustness (rAUC: [-0.038, -0.003] vs. [-0.081, -0.002]). At a WSI level, CST models showed an increase in performance in 124 of the 142 WSIs. CST models also outperformed models trained with random on-the-fly data augmentation (DA) in all test sets ([0.002, 0.021], p < 1e-6). CST offers a path to improve CNN performance without the need for more data and allows customizing distortions to specific use cases. A python implementation of CST is publicly available at https://github.com/TIGACenter/CST_v1.

Uncovering Hidden Vulnerabilities in Convolutional Neural Networks through Graph-based Adversarial Robustness Evaluation

Convolutional neural networks (CNNs) are widely used for image classification, but their vulnerability to adversarial attacks poses challenges to their reliability and security. However, current adversarial robustness (AR) measures lack a theoretical foundation, limiting the insight into the decision process. To address this issue, we propose a new AR evaluation framework based on Graph of Patterns (GoPs) models and graph distance algorithms. Our approach provides a fine-grained analysis of AR from three perspectives, providing targeted insight into the vulnerability of CNNs. Compared to current standards, our approach is theoretically grounded and allows fine-tuning of model components without repeated attempts and validation. Our experimental results demonstrate its effectiveness in uncovering hidden vulnerabilities in CNNs and providing actionable approaches to improve their AR. Our GoPs modeling approach and graph distance algorithms can be extended to apply to other graph machine learning tasks such as Metric Learning on multi-relational graphs. Overall, our framework represents significant progress in AR evaluation, providing a more interpretable, targeted, and efficient approach to assess CNN robustness in complex graph-based systems.

Sparse adversarial image generation using dictionary learning

Adversarial examples are used to evaluate the robustness of convolutional neural networks (CNNs) to input perturbations. Researchers have proposed different types of adversarial examples that attack CNNs to fool them. These attacks pose a serious threat to applications that use deep neural networks. Existing methods for adversarial image generation struggle in maintaining a balance between attack success rate and imperceptibility (measured in terms of ℓ2-norm) of the generated adversarial examples. Recent sparse methods for this problem focus on limiting the number of pixels in an image but do not cater to the overall imperceptibility of the adversarial images. To address these problems, we introduce adversarial attacks based on K-singular value decomposition sparse dictionary learning. The dictionary is learned using feature maps of the targeted images from the first layer of CNN. The proposed method is evaluated in terms of attack success rate and ℓ2-norm. The extensive experimentation shows our attack achieves a high success rate while maintaining a low imperceptibility score compared to state-of-the-art methods.

AI-Assisted QT Measurements for Highly Automated Drug Safety Studies.

Rate-corrected QT interval (QTc) prolongation has been suggested as a biomarker for the risk of drug-induced torsades de pointes, and is therefore monitored during clinical trials for the assessment of drug safety. Manual QT measurements by expert ECG analysts are expensive, laborious and prone to errors. Wavelet-based delineators and other automatic methods do not generalize well to different T wave morphologies and may require laborious tuning. Our study investigates the robustness of convolutional neural networks (CNNs) for QT measurement. We trained 3 CNN-based deep learning models on a private ECG database with human expert-annotated QT intervals. Among these models, we propose a U-Net model, which is widely used for segmentation tasks, to build a novel clinically useful QT estimator that includes QT delineation for better interpretability. We tested the 3 models on four external databases, amongst which a clinical trial investigating four drugs. Our results show that the deep learning models are in stronger agreement with the experts than the state-of-the-art wavelet-based algorithm. Indeed, the deep learning models yielded up to 71% of accurate QT measurements (absolute difference between manual and automatic QT below 15 ms) whereas the wavelet-based algorithm only allowed 52% of QT accuracy. For the 2 studies of drugs with small to no QT prolonging effect, a mean absolute difference of 6 ms (std = 5 ms) was obtained between the manual and deep learning methods. For the other 2 drugs with more significant effect on the volunteers, a mean difference of up to 17 ms (std = 17 ms) was obtained. The proposed models are therefore promising for automated QT measurements during clinical trials. They can analyze various ECG morphologies from a diversity of individuals although some QT-prolonged ECGs can be challenging. The U-Net model is particularly interesting for our application as it facilitates expert review of automatic QT intervals, which is still required by regulatory bodies, by providing QRS onset and T offset positions that are consistent with the estimated QT intervals.

Automatic detection surface defects based on convolutional neural networks and deflectometry

AbstractSurface defects in industrial refrigerator manufacturing processes can cause significant production losses and compromise product quality. This area is underexplored and currently, visual quality inspection is a subjective process that requires expert intervention, which limits process efficiency and can lead to errors in defect detection. This paper presents a novel approach for automatic surface defect detection using a combination of convolutional neural networks (CNN) and deflectometry. The proposed method takes advantage of the high accuracy and robustness of CNNs in image classification tasks and the sensitivity of deflectometry to detect subtle surface variations. First, a prototype was built to get the images from the refrigerator. Second, using video recordings, we captured surface topographic data using deflectometry, which we then use to generate surface images. Next, we train a CNN to classify the surface images as defective or normal. The proposed method offers a promising solution for automatic detection and quality control of surface defects in refrigerator manufacturing processes. However, this method could also improve the production of vehicles, household appliances in general, and any product that can suffer scratches and dents.

Interpretable convolutional neural network with multilayer wavelet for Noise-Robust Machinery fault diagnosis

Convolutional neural networks (CNNs) are being utilized for mechanical fault diagnosis, due to its excellent automatic discriminative feature learning ability. However, the poor interpretability and noise robustness of CNNs have plagued both academia and industry. Since traditional signal analysis technology has a sound theoretical basis and physical meaning, it motivates us to use signal processing theory to improve the interpretability and performance of the CNN algorithm. To this end, this paper proposes a multilayer wavelet attention convolutional neural network (MWA-CNN) for noise-robust machinery fault diagnosis. This framework aims to learn discriminative fault features from the wavelet domain, which allows the model to obtain better interpretability and superior performance than conventional time-domain-based CNNs. The proposed Discrete Wavelet Attention Layer (DWA-Layer) is used to map time domain signals to wavelet space, and obtain valuable information through the learnable convolutional layer. By alternately using DWA-Layer and convolutional layer for signal decomposition and feature learning, the proposed framework actually embeds a similar multi-resolution analysis algorithm in CNN. This helps integrate physics-based knowledge into the CNN. Finally, the frequency attention mechanism is proposed to enhance the ability of MWA-CNN to obtain fault-related features from different frequency components. Experiments on high-speed aeronautical bearing and motor bearing datasets prove that the proposed method has excellent fault diagnosis ability and noise robustness. The visual analysis of the attention mechanism contributes to the interpretability of CNN in the field of fault diagnosis.

Improving person re-identification based on two-stage training of convolutional neural networks and augmentation

Objectives. The main goal is to improve person re-identification accuracy in distributed video surveillance systems.Methods. Machine learning methods are applied.Result. A technology for two-stage training of convolutional neural networks (CNN) is presented, characterized by the use of image augmentation for the preliminary stage and fine tuning of weight coefficients based on the original images set for training. At the first stage, training is carried out on augmented data, at the second stage, fine tuning of the CNN is performed on the original images, which allows minimizing the losses and increasing model efficiency. The use of different data at different training stages does not allow the CNN to remember training examples, thereby preventing overfitting.Proposed method as expanding the training sample differs as it combines an image pixels cyclic shift, color exclusion and fragment replacement with a reduced copy of another image. This augmentation method allows to get a wide variety of training data, which increases the CNN robustness to occlusions, illumination, low image resolution, dependence on the location of features.Conclusion. The use of two-stage learning technology and the proposed data augmentation method made it possible to increase the person re-identification accuracy for different CNNs and datasets: in the Rank1 metric by 4–21 %; in the mAP by 10–31 %; in the mINP by 39–60 %.