Transactions on Machine Learning Research (TMLR) · 2023

Improving Native CNN Robustness with Filter Frequency Regularization

Jovita Lukasik, Paul Gavrikov, Janis Keuper, Margret Keuper

Why this publication matters

Building a more resilient vision model does not always require generating costly adversarial examples during training. This method instead encourages its learned filters to emphasize more stable, coarse-scale information. It offers another route to robustness by shaping what the network learns to look for.

Abstract

Neural networks tend to overfit the training distribution and perform poorly on out-ofdistribution data. A conceptually simple solution lies in adversarial training, which introduces worst-case perturbations into the training data and thus improves model generalization to some extent. However, it is only one ingredient towards generally more robust models and requires knowledge about the potential attacks or inference time data corruptions during model training. This paper focuses on the native robustness of models that can learn robust behavior directly from conventional training data without out-of-distribution examples. To this end, we study the frequencies in learned convolution filters. Clean-trained models often prioritize high-frequency information, whereas adversarial training enforces models to shift the focus to low-frequency details during training. By mimicking this behavior through frequency regularization in learned convolution weights, we achieve improved native robustness to adversarial attacks, common corruptions, and other out-of-distribution tests. Additionally, this method leads to more favorable shifts in decision-making towards low-frequency information, such as shapes, which inherently aligns more closely with human vision.

Abstract source ↗

Figures

Frequency distributions in convolution filters and the first convolutional layer. — **Figure 1.** Our proposed regularization decreases the reliance on high-frequency information of a ResNet-20 trained on CIFAR-10 (b-d) as visible in mean DCT-II coefficients magnitudes (= frequency distribution; computation shown in (a)). View in source ↗

**Figure 2.** The full DCT-II basis for different resolutions. View in source ↗

Cite this paper

Download .bib

@article{lukasik2023improvingnativecnn35,
  title = {{Improving Native CNN Robustness with Filter Frequency Regularization}},
  author = {Jovita Lukasik and Paul Gavrikov and Janis Keuper and Margret Keuper},
  journal = {Transactions on Machine Learning Research},
  year = {2023},
  url = {https://openreview.net/forum?id=2wecNCpZ7Y}
}

Figures and abstract are reproduced from the linked research sources. Credit remains with the authors and publishers.