The AAAI-22 Workshop on Adversarial Machine Learning and Beyond · 2022

Aliasing coincides with CNNs vulnerability towards adversarial attacks

Julia Grabinski, Janis Keuper, Margret Keuper

Why this publication matters

Shrinking an image inside a neural network can introduce artifacts, much like jagged edges in a poorly resized photograph. This study connects those artifacts to sensitivity to carefully crafted image changes. It points researchers toward an everyday processing step that deserves attention when building more dependable vision systems.

Abstract

Many commonly well-performing convolutional neural network models have shown to be susceptible to input data perturbations, indicating a low model robustness. Adversarial attacks are thereby specifically optimized to reveal model weaknesses, by generating small, barely perceivable image perturbations that flip the model prediction. Robustness against attacks can be gained for example by using adversarial examples during training, which effectively reduces the measurable model attackability. In contrast, research on analyzing the source of a model’s vulnerability is scarce. In this paper, we analyze adversarially trained, robust models in the context of a specifically suspicious network operation, the downsampling layer, and provide evidence that robust models have learned to downsample more accurately and suffer significantly less from aliasing than baseline models.

Abstract source ↗

Figures

A cat image after correct downsampling, aliased downsampling, and an adversarial attack. — **Figure 1.** Illustration of down-sampling, with (top right) and without anti-aliasing filter (bottom right) as well as an adversarial example (bottom left). The top left image shows the original, on the top right, this image is correctly downsampled with an anti-aliasing filter. In the bottom right, no filter is applied, leading to aliasing. The adversarial example (bottom left) shows visually similar artifacts. In this paper, we investigate the role of aliasing for adversarial robustness. View in source ↗

**Figure 2.** Step by step computation of the aliasing free version of a feature map. The left image shows the magnitude of the Fourier representation of a feature map with the zero-frequency in the upper left corner, i.e. high frequencies are in the center. Alias-free downsampling suppresses high frequencies prior to sampling. This can be implemented efficiently in the Fourier domain by cropping and reassembling the low-frequency regions of the Fourier representations, i.e. its four corners. Aliasing would correspond to folding the deleted high frequency components into the constructed representation. View in source ↗

Cite this paper

Download .bib

@inproceedings{grabinski2022aliasingcoincideswith9,
  title = {{Aliasing coincides with CNNs vulnerability towards adversarial attacks}},
  author = {Julia Grabinski and Janis Keuper and Margret Keuper},
  booktitle = {The AAAI-22 Workshop on Adversarial Machine Learning and Beyond},
  year = {2022},
  url = {https://openreview.net/pdf?id=vKc1mLxBebP}
}

Figures and abstract are reproduced from the linked research sources. Credit remains with the authors and publishers.