Robustness Of Deep Learning Models Research Articles

Exploring the Potential of Pretrained CNNs and Time-Frequency Methods for Accurate Epileptic EEG Classification: A Comparative Study.

Prompt diagnosis of epilepsy relies on accurate classification of automated electroencephalogram (EEG) signals. Several approaches have been developed to characterize epileptic EEG data; however, none of them have exploited time-frequency data to evaluate the effect of tweaking parameters in pretrained frameworks for EEG data classification. This study compares the performance of several pretrained convolutional neural networks (CNNs) namely, AlexNet, GoogLeNet, MobileNetV2, ResNet-18 and SqueezeNet for the localization of epilepsy EEG data using various time-frequency data representation algorithms. Continuous wavelet transform (CWT), empirical Fourier decomposition (EFD), empirical mode decomposition (EMD), empirical wavelet transform (EWT), and variational mode decomposition (VMD) were exploited for the acquisition of 2D scalograms from 1D data. The research evaluates the effect of multiple factors, including noisy versus denoised scalograms, different optimizers, learning rates, single versus dual channels, model size, and computational time consumption. The benchmark Bern Barcelona EEG dataset is used for testing purpose. Results obtained show that the combination of MobileNetV2, Continuous Wavelet Transform (CWT) and Adam optimizer at a learning rate of 10^-4, coupled with dual-data channels, provides the best performance metrics. Specifically, these parameters result in optimal sensitivity, specificity, f1-score, and classification accuracy, with respective values of 96.06%, 96.15%, 96.08%, and 96.10%. To further corroborate the efficacy of opted pretrained models on exploited Signal Decomposition (SD) algorithms, the classifiers are also being simulated on Temple University database at pinnacle modeling composition. A similar pattern in the outcome readily validate the findings of our study and robustness of deep learning models on epilepsy EEG scalograms.The conclusions drawn emphasize the potential of pretrained CNN-based models to create a robust, automated system for diagnosing epileptiform. Furthermore, the study offers insights into the effectiveness of varying time-frequency techniques and classifier parameters for classifying epileptic EEG data.

Robustness and Security in Deep Learning: Adversarial Attacks and Countermeasures

Deep learning models have demonstrated remarkable performance across various domains, yet their susceptibility to adversarial attacks remains a significant concern. In this study, we investigate the effectiveness of three defense mechanisms—Baseline (No Defense), Adversarial Training, and Input Preprocessing—in enhancing the robustness of deep learning models against adversarial attacks. The baseline model serves as a reference point, highlighting the vulnerability of deep learning systems to adversarial perturbations. Adversarial Training, involving the augmentation of training data with adversarial examples, significantly improves model resilience, demonstrating higher accuracy under both Fast Gradient Sign Method (FGSM) and Iterative Gradient Sign Method (IGSM) attacks. Similarly, Input Preprocessing techniques mitigate the impact of adversarial perturbations on model predictions by modifying input data before inference. However, each defense mechanism presents trade-offs in terms of computational complexity and performance. Adversarial Training requires additional computational resources and longer training times, while Input Preprocessing techniques may introduce distortions affecting model generalization. Future research directions may focus on developing more sophisticated defense mechanisms, including ensemble methods, gradient masking, and certified defense strategies, to provide robust and reliable deep learning systems in real-world scenarios. This study contributes to a deeper understanding of defense mechanisms against adversarial attacks in deep learning, highlighting the importance of implementing robust strategies to enhance model resilience.

Brain-inspired semantic data augmentation for multi-style images.

Data augmentation is an effective technique for automatically expanding training data in deep learning. Brain-inspired methods are approaches that draw inspiration from the functionality and structure of the human brain and apply these mechanisms and principles to artificial intelligence and computer science. When there is a large style difference between training data and testing data, common data augmentation methods cannot effectively enhance the generalization performance of the deep model. To solve this problem, we improve modeling Domain Shifts with Uncertainty (DSU) and propose a new brain-inspired computer vision image data augmentation method which consists of two key components, namely, using Robust statistics and controlling the Coefficient of variance for DSU (RCDSU) and Feature Data Augmentation (FeatureDA). RCDSU calculates feature statistics (mean and standard deviation) with robust statistics to weaken the influence of outliers, making the statistics close to the real values and improving the robustness of deep learning models. By controlling the coefficient of variance, RCDSU makes the feature statistics shift with semantic preservation and increases shift range. FeatureDA controls the coefficient of variance similarly to generate the augmented features with semantics unchanged and increase the coverage of augmented features. RCDSU and FeatureDA are proposed to perform style transfer and content transfer in the feature space, and improve the generalization ability of the model at the style and content level respectively. On Photo, Art Painting, Cartoon, and Sketch (PACS) multi-style classification task, RCDSU plus FeatureDA achieves competitive accuracy. After adding Gaussian noise to PACS dataset, RCDSU plus FeatureDA shows strong robustness against outliers. FeatureDA achieves excellent results on CIFAR-100 image classification task. RCDSU plus FeatureDA can be applied as a novel brain-inspired semantic data augmentation method with implicit robot automation which is suitable for datasets with large style differences between training and testing data.

Bibimbap : Pre-trained models ensemble for Domain Generalization

This paper addresses a machine learning problem often challenged by differences in the distributions of training and real-world data. We propose a framework that addresses the problem of underfitting in the ensembling method using pre-trained models and improves the performance and robustness of deep learning models through ensemble diversity. For the naive weight ensembling framework, we discovered that the ensembled models could not lie in the same loss basin under extreme domain shift conditions, suggesting that a loss barrier may exist. We used a fine-tuning step after the weighted ensemble to address the underfitting problem caused by the loss barrier and stabilize the batch normalization running parameters. We also inferred through qualitative analysis that the diversity of ensemble models affects domain generalization. We validate our method on a large-scale image dataset (ImageNet-1K) and chemical molecule data, which is suitable for testing with domain shift problems due to its data-splitting method.

Deforestation detection using deep learning-based semantic segmentation techniques: a systematic review

Deforestation poses a critical global threat to Earth’s ecosystem and biodiversity, necessitating effective monitoring and mitigation strategies. The integration of deep learning with remote sensing offers a promising solution for precise deforestation segmentation and detection. This paper provides a comprehensive review of deep learning methodologies applied to deforestation analysis through satellite imagery. In the face of deforestation’s ecological repercussions, the need for advanced monitoring and surveillance tools becomes evident. Remote sensing, with its capacity to capture extensive spatial data, combined with deep learning’s prowess in recognizing complex patterns to enable precise deforestation assessment. Integration of these technologies through state-of-the-art models, including U-Net, DeepLab V3, ResNet, SegNet, and FCN, has enhanced the accuracy and efficiency in detecting deforestation patterns. The review underscores the pivotal role of satellite imagery in capturing spatial information and highlights the strengths of various deep learning architectures in deforestation analysis. Multiscale feature learning and fusion emerge as critical strategies enabling deep networks to comprehend contextual nuances across various scales. Additionally, attention mechanisms combat overfitting, while group and shuffle convolutions further enhance accuracy by reducing dominant filters’ contribution. These strategies collectively fortify the robustness of deep learning models in deforestation analysis. The integration of deep learning techniques into remote sensing applications serves as an excellent tool for deforestation identification and monitoring. The synergy between these fields, exemplified by the reviewed models, presents hope for preserving invaluable forests. As technology advances, insights from this review will drive the development of more accurate, efficient, and accessible deforestation detection methods, contributing to the sustainable management of the planet’s vital resources.

Evaluating the Robustness of Deep Learning Models against Adversarial Attacks: An Analysis with FGSM, PGD and CW

This study evaluated the generation of adversarial examples and the subsequent robustness of an image classification model. The attacks were performed using the Fast Gradient Sign method, the Projected Gradient Descent method, and the Carlini and Wagner attack to perturb the original images and analyze their impact on the model’s classification accuracy. Additionally, image manipulation techniques were investigated as defensive measures against adversarial attacks. The results highlighted the model’s vulnerability to conflicting examples: the Fast Gradient Signed Method effectively altered the original classifications, while the Carlini and Wagner method proved less effective. Promising approaches such as noise reduction, image compression, and Gaussian blurring were presented as effective countermeasures. These findings underscore the importance of addressing the vulnerability of machine learning models and the need to develop robust defenses against adversarial examples. This article emphasizes the urgency of addressing the threat posed by harmful standards in machine learning models, highlighting the relevance of implementing effective countermeasures and image manipulation techniques to mitigate the effects of adversarial attacks. These efforts are crucial to safeguarding model integrity and trust in an environment marked by constantly evolving hostile threats. An average 25% decrease in accuracy was observed for the VGG16 model when exposed to the Fast Gradient Signed Method and Projected Gradient Descent attacks, and an even more significant 35% decrease with the Carlini and Wagner method.

Increasing the Robustness of Deep Learning Models for Object Segmentation: A Framework for Blending Automatically Annotated Real and Synthetic Data.

Recent problems in robotics can sometimes only be tackled using machine learning technologies, particularly those that utilize deep learning (DL) with transfer learning. Transfer learning takes advantage of pretrained models, which are later fine-tuned using smaller task-specific datasets. The fine-tuned models must be robust against changes in environmental factors such as illumination since, often, there is no guarantee for them to be constant. Although synthetic data for pretraining has been shown to enhance DL model generalization, there is limited research on its application for fine-tuning. One limiting factor is that the generation and annotation of synthetic datasets can be cumbersome and impractical for the purpose of fine-tuning. To address this issue, we propose two methods for automatically generating annotated image datasets for object segmentation, one for real-world and another for synthetic images. We also introduce a novel domain adaptation approach called filling the reality gap (FTRG), which can blend elements from real-world and synthetic scenes in a single image to achieve domain adaptation. We demonstrate through experimentation on a representative robot application that FTRG outperforms other domain adaptation techniques, such as domain randomization or photorealistic synthetic images, in creating robust models. Furthermore, we evaluate the benefits of using synthetic data for fine-tuning in transfer learning and continual learning with experience replay using our proposed methods and FTRG. Our findings indicate that fine-tuning with synthetic data can produce superior results compared to solely using real-world data.

Robust-EQA: Robust Learning for Embodied Question Answering With Noisy Labels.

Embodied question answering (EQA) is a recently emerged research field in which an agent is asked to answer the user's questions by exploring the environment and collecting visual information. Plenty of researchers turn their attention to the EQA field due to its broad potential application areas, such as in-home robots, self-driven mobile, and personal assistants. High-level visual tasks, such as EQA, are susceptible to noisy inputs, because they have complex reasoning processes. Before the profits of the EQA field can be applied to practical applications, good robustness against label noise needs to be equipped. To tackle this problem, we propose a novel label noise-robust learning algorithm for the EQA task. First, a joint training co-regularization noise-robust learning method is proposed for noisy filtering of the visual question answering (VQA) module, which trains two parallel network branches by one loss function. Then, a two-stage hierarchical robust learning algorithm is proposed to filter out noisy navigation labels in both trajectory level and action level. Finally, by taking purified labels as inputs, a joint robust learning mechanism is given to coordinate the work of the whole EQA system. Empirical results demonstrate that, under extremely noisy environments (45% of noisy labels) and low-level noisy environments (20% of noisy labels), the robustness of deep learning models trained by our algorithm is superior to the existing EQA models in noisy environments.

Are transformer-based models more robust than CNN-based models?

As the deployment of artificial intelligence (AI) models in real-world settings grows, their open-environment robustness becomes increasingly critical. This study aims to dissect the robustness of deep learning models, particularly comparing transformer-based models against CNN-based models. We focus on unraveling the sources of robustness from two key perspectives: structural and process robustness. Our findings suggest that transformer-based models generally outperform convolution-based models in robustness across multiple metrics. However, we contend that these metrics may not wholly represent true model robustness, such as the mean of corruption error. To better understand the underpinnings of this robustness advantage, we analyze models through the lens of Fourier transform and game interaction. From our insights, we propose a calibrated evaluation metric for robustness against real-world data, and a blur-based method to enhance robustness performance. Our approach achieves state-of-the-art results, with mCE scores of 2.1% on CIFAR-10-C, 12.4% on CIFAR-100-C, and 24.9% on TinyImageNet-C.

Frequency-based methods for improving the imperceptibility and transferability of adversarial examples

The adversarial attack is a popular technology to evaluate the robustness of deep learning models. However, adversarial examples crafted by current methods often have poor imperceptibility and low transferability, hindering the utility of attacks in practice. In this paper, we creatively leverage the frequency information to promote the imperceptibility and adversarial transferability in the white-box scenario and black-box scenario, respectively. Specifically, in the white-box scenario, we adopt the low-frequency constraint and normal projection to improve the imperceptibility of the adversarial example without reducing the attack performance. In the black-box scenario, we propose an effective Frequency Spectrum Diversity Transformation (FSDT) to address the issue of overfitting to the substitute model. FSDT enriches the input with a diverse set of unfamiliar information, significantly improving the transferability of adversarial attacks. Towards those defended target models in the black-box scenario, we also design a gradient refinement technology named Frequency Dropout (FD) to discard some useless components of gradients in the frequency domain, which can further mitigate the protective effect of defense mechanisms. Plentiful experiments forcefully validate the superiority of our proposed methods. Furthermore, we apply the proposed method to evaluate the robustness of real-world online models and discover their vulnerability. Finally, we analyze why imperceptibility and adversarial transferability are hard to improve concurrently from the view of frequency. Our codes are available at https://github.com/RYC-98/FSD-MIM-and-NPGA.

End-to-end deep learning pipeline for on-board extraterrestrial rock segmentation

Bringing autonomy on board edge devices is inevitable to accelerate the process of space exploration. Although there are various tasks that can be executed autonomously by such vehicles, detecting and segmenting rocks in on-board images of extraterrestrial landscapes is a critical step in the processing chain, as it can allow to navigate safely while avoiding collisions. We tackle this issue and introduce an end-to-end pipeline for building and validating resource-frugal machine learning techniques for this task, offering a high level of flexibility. Deploying such models on board edge devices poses numerous practical challenges, spanning across ensuring their memory and computational efficiency, and understanding their robustness against varying quality of acquired images. These aspects are often overlooked while building deep learning-powered on-board systems—we show that they can (and ultimately should) be a part of the deployment chain. Our extensive experimental study performed over several benchmark data sets shed more light on functional and non-functional capabilities of the investigated models, both in full-precision and compressed by quantisation, the latter delivering statistically same segmentation accuracy while being approximately 11× smaller. Additionally, we show that synthesised images can be utilised to quantify the robustness of deep learning models against on-board acquisition conditions which directly affect the quality of captured images—such simulations mimicking real-world acquisition settings could have a negative impact on the capabilities of the models trained over clean and high-quality image data. To ensure full reproducibility of this study, we made our implementation publicly available at https://github.com/danielmarek22/onboard-rock-segmentation.

COVID-19 CHEST CT IMAGE SEGMENTATION NETWORK BY MULTI SCALE FUSION AND ENHANCEMENT OPERATIONS

ABSTRACT-A deep learning research is the availability of training data sets. With a limited number of publicly available COVID-19 chest X-ray images, the generalization and robustness of deep learning models to detect COVID-19 cases developed based on these images are questionable. Segmentation of pneumonia lesions from Lung CT images has become vital for diagnosing the disease and evaluating the severity of the patients during the COVID-19 pandemic. Several Deep Learning based systems have been proposed for this task. However, some low-contrast abnormal zones in CT images make the task challenging. which will be used as the testing data set. We used a deep learning model based on the convolutional neural network architecture, which was pre trained to recognize objects from a million of images and then retrained to detect abnormality in chest X-ray images. Keywords—Deep Learning, COVID-19, pneumonia prediction, Evolution, Intelligent System.

Adversarial Robustness in Graph-Based Neural Architecture Search for Edge AI Transportation Systems

Edge AI technologies have been used for many Intelligent Transportation Systems, such as road traffic monitor systems. Neural Architecture Search (NAS) is a typcial way to search high-performance models for edge devices with limited computing resources. However, NAS is also vulnerable to adversarial attacks. In this paper, A One-Shot NAS is employed to realize derivative models with different scales. In order to study the relation between adversarial robustness and model scales, a graph-based method is designed to select best sub models generated from One-Shot NAS. Besides, an evaluation method is proposed to assess robustness of deep learning models under various scales of models. Experimental results shows an interesting phenomenon about the correlations between network sizes and model robustness, reducing model parameters will increase model robustness under maximum adversarial attacks, while, increasing model paremters will increase model robustness under minimum adversarial attacks. The phenomenon is analyzed, that is able to help understand the adversarial robustness of models with different scales for edge AI transportation systems.

Holistic Adversarial Robustness of Deep Learning Models

Adversarial robustness studies the worst-case performance of a machine learning model to ensure safety and reliability. With the proliferation of deep-learning-based technology, the potential risks associated with model development and deployment can be amplified and become dreadful vulnerabilities. This paper provides a comprehensive overview of research topics and foundational principles of research methods for adversarial robustness of deep learning models, including attacks, defenses, verification, and novel applications.

A multi-objective memetic algorithm for automatic adversarial attack optimization design

The phenomenon of adversarial examples has been revealed in variant scenarios. Recent studies show that well-designed adversarial defense strategies can improve the robustness of deep learning models against adversarial examples. However, with the rapid development of defense technologies, it also tends to be more difficult to evaluate the robustness of the defensed model due to the weak performance of existing manually designed adversarial attacks. To address the challenge, given the defensed model, the efficient adversarial attack with less computational burden and lower robust accuracy is needed to be further exploited. Therefore, we propose a multi-objective memetic algorithm for auto adversarial attack optimization design, which realizes the automatic search for the near-optimal adversarial attack towards defensed models. Firstly, the more general mathematical model of auto adversarial attack optimization design is constructed, where the search space includes not only the attacker operations, magnitude, iteration number, and loss functions but also the connection ways of multiple adversarial attacks. In addition, we develop a multi-objective memetic algorithm combining NSGA-II and local search to solve the optimization problem. Finally, to decrease the evaluation cost during the search, we propose a representative data selection strategy based on sorting cross entropy loss values of images output by models. Experiments on CIFAR10, CIFAR100, and ImageNet datasets show that our method can efficiently find near-optimal adversarial attacks with lower robust accuracy and less time cost, which can provide more reliable and efficient robustness evaluation for defensed models.

Robustness of Deep Learning Models for Vision Tasks

In recent years, artificial intelligence technologies in vision tasks have gradually begun to be applied to the physical world, proving they are vulnerable to adversarial attacks. Thus, the importance of improving robustness against adversarial attacks has emerged as an urgent issue in vision tasks. This article aims to provide a historical summary of the evolution of adversarial attacks and defense methods on CNN-based models and also introduces studies focusing on brain-inspired models that mimic the visual cortex, which is resistant to adversarial attacks. As the origination of CNN models was in the application of physiological findings related to the visual cortex of the time, new physiological studies related to the visual cortex provide an opportunity to create more robust models against adversarial attacks. The authors hope this review will promote interest and progress in artificially intelligent security by improving the robustness of deep learning models for vision tasks.

GLH: From Global to Local Gradient Attacks with High-Frequency Momentum Guidance for Object Detection.

The adversarial attack is crucial to improving the robustness of deep learning models; they help improve the interpretability of deep learning and also increase the security of the models in real-world applications. However, existing attack algorithms mainly focus on image classification tasks, and they lack research targeting object detection. Adversarial attacks against image classification are global-based with no focus on the intrinsic features of the image. In other words, they generate perturbations that cover the whole image, and each added perturbation is quantitative and undifferentiated. In contrast, we propose a global-to-local adversarial attack based on object detection, which destroys important perceptual features of the object. More specifically, we differentially extract gradient features as a proportion of perturbation additions to generate adversarial samples, as the magnitude of the gradient is highly correlated with the model's point of interest. In addition, we reduce unnecessary perturbations by dynamically suppressing excessive perturbations to generate high-quality adversarial samples. After that, we improve the effectiveness of the attack using the high-frequency feature gradient as a motivation to guide the next gradient attack. Numerous experiments and evaluations have demonstrated the effectiveness and superior performance of our from global to Local gradient attacks with high-frequency momentum guidance (GLH), which is more effective than previous attacks. Our generated adversarial samples also have excellent black-box attack ability.

The Art of Defense: Letting Networks Fool the Attacker

3D perception of objects is critical for many real-world applications, such as autonomous cars and robots. Among them, most state-of-the-art (SOTA) 3D perception systems are based on deep learning models. Recently, the research community found that 3D object classifiers on point cloud based on deep learning are easily fooled by adversarial point cloud craft by attackers. To overcome this, adversarial defenses are considered the most effective ways to improve the robustness of deep learning models, and most adversarial defenses on point cloud are focused on input transformation. However, all previous defense methods decrease the natural accuracy, and the nature of the point cloud classifiers itself has been overlooked. To this end, in this paper, we propose a novel adversarial defense for 3D point cloud classifiers that makes full use of the nature of the point cloud classifiers. Due to the disorder of point cloud, all point cloud classifiers have the property of permutation invariant to the input point cloud. Based on this nature, we design invariant transformations defense (IT-Defense). We show that, even after accounting for obfuscated gradients, our IT-Defense is a resilient defense against SOTA 3D attacks. Moreover, IT-Defense does not hurt clean accuracy compared to previous SOTA 3D defenses. Our code will be available at: https://github.com/cuge1995/IT-Defense.

Decentralized collaborative multi-institutional PET attenuation and scatter correction using federated deep learning

PurposeAttenuation correction and scatter compensation (AC/SC) are two main steps toward quantitative PET imaging, which remain challenging in PET-only and PET/MRI systems. These can be effectively tackled via deep learning (DL) methods. However, trustworthy, and generalizable DL models commonly require well-curated, heterogeneous, and large datasets from multiple clinical centers. At the same time, owing to legal/ethical issues and privacy concerns, forming a large collective, centralized dataset poses significant challenges. In this work, we aimed to develop a DL-based model in a multicenter setting without direct sharing of data using federated learning (FL) for AC/SC of PET images.MethodsNon-attenuation/scatter corrected and CT-based attenuation/scatter corrected (CT-ASC) 18F-FDG PET images of 300 patients were enrolled in this study. The dataset consisted of 6 different centers, each with 50 patients, with scanner, image acquisition, and reconstruction protocols varying across the centers. CT-based ASC PET images served as the standard reference. All images were reviewed to include high-quality and artifact-free PET images. Both corrected and uncorrected PET images were converted to standardized uptake values (SUVs). We used a modified nested U-Net utilizing residual U-block in a U-shape architecture. We evaluated two FL models, namely sequential (FL-SQ) and parallel (FL-PL) and compared their performance with the baseline centralized (CZ) learning model wherein the data were pooled to one server, as well as center-based (CB) models where for each center the model was built and evaluated separately. Data from each center were divided to contribute to training (30 patients), validation (10 patients), and test sets (10 patients). Final evaluations and reports were performed on 60 patients (10 patients from each center).ResultsIn terms of percent SUV absolute relative error (ARE%), both FL-SQ (CI:12.21–14.81%) and FL-PL (CI:11.82–13.84%) models demonstrated excellent agreement with the centralized framework (CI:10.32–12.00%), while FL-based algorithms improved model performance by over 11% compared to CB training strategy (CI: 22.34–26.10%). Furthermore, the Mann–Whitney test between different strategies revealed no significant differences between CZ and FL-based algorithms (p-value > 0.05) in center-categorized mode. At the same time, a significant difference was observed between the different training approaches on the overall dataset (p-value < 0.05). In addition, voxel-wise comparison, with respect to reference CT-ASC, exhibited similar performance for images predicted by CZ (R2 = 0.94), FL-SQ (R2 = 0.93), and FL-PL (R2 = 0.92), while CB model achieved a far lower coefficient of determination (R2 = 0.74). Despite the strong correlations between CZ and FL-based methods compared to reference CT-ASC, a slight underestimation of predicted voxel values was observed.ConclusionDeep learning-based models provide promising results toward quantitative PET image reconstruction. Specifically, we developed two FL models and compared their performance with center-based and centralized models. The proposed FL-based models achieved higher performance compared to center-based models, comparable with centralized models. Our work provided strong empirical evidence that the FL framework can fully benefit from the generalizability and robustness of DL models used for AC/SC in PET, while obviating the need for the direct sharing of datasets between clinical imaging centers.

Interpreting mental state decoding with deep learning models.

In mental state decoding, researchers aim to identify the set of mental states (e.g., experiencing happiness or fear) that can be reliably identified from the activity patterns of a brain region (or network). Deep learning (DL) models are highly promising for mental state decoding because of their unmatched ability to learn versatile representations of complex data. However, their widespread application in mental state decoding is hindered by their lack of interpretability, difficulties in applying them to small datasets, and in ensuring their reproducibility and robustness. We recommend approaching these challenges by leveraging recent advances in explainable artificial intelligence (XAI) and transfer learning, and also provide recommendations on how to improve the reproducibility and robustness of DL models in mental state decoding.