{"type":"ScholarlyArticle","title":"How Does Frequency Bias Affect the Robustness of Neural Image Classifiers against Common Corruption and Adversarial Perturbations?","authors":[{"name":"Alvin Chan","slug":"alvin-chan","given":"Alvin","family":"Chan","affiliation":"Nanyang Technological University , Singapore; Agency for Science, Technology and Research , Singapore"},{"name":"Yew Soon Ong","slug":"yew-soon-ong","given":"Yew-Soon","family":"Ong","affiliation":"Agency for Science, Technology and Research , Singapore; Nanyang Technological University , Singapore"},{"name":"Clement Tan","slug":"clement-tan","given":"Clement","family":"Tan","affiliation":"Nanyang Technological University , Singapore; Agency for Science, Technology and Research , Singapore"}],"abstract":"Model robustness is vital for the reliable deployment of machine learning models in real-world applications. Recent studies have shown that data augmentation can result in model over-relying on features in the low-frequency domain, sacrificing performance against low-frequency corruptions, highlighting a connection between frequency and robustness. Here, we take one step further to more directly study the frequency bias of a model through the lens of its Jacobians and its implication to model robustness. To achieve this, we propose Jacobian frequency regularization for models' Jacobians to have a larger ratio of low-frequency components. Through experiments on four image datasets, we show that biasing classifiers towards low (high)-frequency components can bring performance gain against high (low)-frequency corruption and adversarial perturbation, albeit with a tradeoff in performance for low (high)-frequency corruption. Our approach elucidates a more direct connection between the frequency bias and robustness of deep learning models.","doi":"10.24963/ijcai.2022/93","url":"https://ijcai.org/proceedings/2022/93","pdf":"https://ijcai.org/proceedings/2022/0093.pdf","markdown":"https://ijcai.org/proceedings/2022/93.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/93","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"AI Ethics, Trust, Fairness","track":"Main Track","number":93,"pages":{"first":659,"last":665},"keywords":["Computer Vision: Adversarial learning, adversarial attack and defense methods","AI Ethics, Trust, Fairness: Safety & Robustness"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38987017","length_sec":64,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985160","length_sec":530,"provider":"slideslive"}],"references":[{"position":1,"raw":"Maksym An- driushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. arXiv preprint arXiv:2007.02617, 2020.","title":"Understanding and improving fast adversarial training","authors":"Maksym Andriushchenko, Nicolas Flammarion","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pages 39-57. IEEE, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"IEEE Symposium on Security and Privacy (SP)","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Chan et al., 2019] Alvin Chan, Yi Tay, Yew Soon Ong, and Jie Fu. Jacobian adversarially regularized networks for ro- bustness. arXiv preprint arXiv:1912.10185, 2019.","title":"Jacobian adversarially regularized networks for robustness","authors":"Alvin Chan, Yi Tay, Yew, Soon Ong, Jie Fu","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Chan et al., 2020] Alvin Chan, Yi Tay, and Yew-Soon Ong. What it thinks is important is important: Robustness transfers through input gradients. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 332-341, 2020.","title":"What it thinks is important is important: Robustness transfers through input gradients","authors":"Alvin Chan, Yi Tay, Yew-Soon Ong","year":"2020","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Croce and Hein, 2019] Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adap- tive boundary attack. arXiv preprint arXiv:1907.02044, 2019.","title":"Minimally distorted adversarial examples with a fast adaptive boundary attack","authors":"Francesco Croce, Matthias Hein","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Croce and Hein, 2020] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an en- semble of diverse parameter-free attacks. In Interna- tional conference on machine learning, pages 2206-2216.","title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","authors":"Croce, Hein, Francesco Croce, Matthias Hein","year":"2020","venue":"International conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"PMLR, 2020.","title":null,"authors":"Pmlr","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Etmann et al., 2019] Christian Etmann, Sebastian Lunz, Pe- ter Maass, and Carola-Bibiane Schönlieb. On the connec- tion between adversarial robustness and saliency map in- terpretability. arXiv preprint arXiv:1905.04172, 2019.","title":"Christian Etmann","authors":"Etmann","year":"2019","venue":"Bibiane Schönlieb. On the connection between adversarial robustness and saliency map interpretability","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Geirhos et al., 2018] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. arXiv preprint arXiv:1811.12231, 2018.","title":"Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness","authors":"Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, Wieland Brendel","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Goodfellow et al., 2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual net- works. In European conference on computer vision, pages 630-645. Springer, 2016.","title":"Identity mappings in deep residual networks","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"European conference on computer vision","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Hendrycks and Dietterich, 2019] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network ro- bustness to common corruptions and perturbations. arXiv preprint arXiv:1903.12261, 2019.","title":"Benchmarking neural network robustness to common corruptions and perturbations","authors":"Dietterich Hendrycks, Dan Hendrycks, Thomas Dietterich","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Hendrycks et al., 2021] Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, et al. The many faces of robustness: A critical anal- ysis of out-of-distribution generalization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 8340-8349, 2021.","title":"The many faces of robustness: A critical analysis of out-of-distribution generalization","authors":"Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo","year":"2021","venue":"Proceedings of the IEEE/CVF International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Ilyas et al., 2019] Andrew Ilyas, Shibani Santurkar, Dim- itris Tsipras, Logan Engstrom, Brandon Tran, and Alek- sander Madry. Adversarial examples are not bugs, they are features. arXiv preprint arXiv:1905.02175, 2019.","title":"Adversarial examples are not bugs, they are features","authors":"Ilyas","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Jakubovitz and Giryes, 2018] Daniel Jakubovitz and Raja Giryes. Improving dnn robustness to adversarial attacks using jacobian regularization. In Proceedings of the Euro- pean Conference on Computer Vision (ECCV), pages 514- 529, 2018.","title":"Improving dnn robustness to adversarial attacks using jacobian regularization","authors":"Daniel Jakubovitz, Raja Giryes","year":"2018","venue":"Proceedings of the European Conference on Computer Vision (ECCV)","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Liu et al., 2020] Chen Liu, Mathieu Salzmann, Tao Lin, Ry- ota Tomioka, and Sabine Süsstrunk. On the loss landscape of adversarial training: Identifying challenges and how to overcome them. arXiv preprint arXiv:2006.08403, 2020.","title":"On the loss landscape of adversarial training: Identifying challenges and how to overcome them","authors":"Chen Liu, Mathieu Salzmann, Tao Lin, Ryota Tomioka, Sabine Süsstrunk","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Madry et al., 2017] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Saikia et al., 2021] Tonmoy Saikia, Cordelia Schmid, and Thomas Brox. Improving robustness against common cor- ruptions with frequency biased models. arXiv preprint arXiv:2103.16241, 2021.","title":"Improving robustness against common corruptions with frequency biased models","authors":"Tonmoy Saikia, Cordelia Schmid, Thomas Brox","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Smilkov et al., 2017] Daniel Smilkov, Nikhil Thorat, Been Kim, Fernanda Viégas, and Martin Wattenberg. Smooth- grad: removing noise by adding noise. arXiv preprint arXiv:1706.03825, 2017.","title":"Smoothgrad: removing noise by adding noise","authors":"Daniel Smilkov, Nikhil Thorat, Been Kim, Fernanda Viégas, Martin Wattenberg","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Vasconcelos et al., 2020] Cristina Vasconcelos, Hugo Larochelle, Vincent Dumoulin, Nicolas Le Roux, and Ross Goroshin. An effective anti-aliasing approach for residual networks. arXiv preprint arXiv:2011.10675, 2020.","title":"An effective anti-aliasing approach for residual networks","authors":"Cristina Vasconcelos, Hugo Larochelle, Vincent Dumoulin, Nicolas Le Roux, Ross Goroshin","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Vasconcelos et al., 2021] Cristina Vasconcelos, Hugo Larochelle, Vincent Dumoulin, Rob Romijnders, Nicolas Le Roux, and Ross Goroshin. Impact of aliasing on gener- alization in deep convolutional networks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 10529-10538, 2021.","title":"Impact of aliasing on generalization in deep convolutional networks","authors":"Cristina Vasconcelos, Hugo Larochelle, Vincent Dumoulin, Rob Romijnders, Nicolas Le Roux, Ross Goroshin","year":"2021","venue":"Proceedings of the IEEE/CVF International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Wu et al., 2020] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gen- eralization. Advances in Neural Information Processing Systems, 33, 2020.","title":"Adversarial weight perturbation helps robust generalization","authors":"Wu","year":"2020","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Yin et al., 2019] Dong Yin, Raphael Gontijo Lopes, Jonathon Shlens, Ekin D Cubuk, and Justin Gilmer. A fourier perspective on model robustness in computer vision. arXiv preprint arXiv:1906.08988, 2019.","title":"A fourier perspective on model robustness in computer vision","authors":"Dong Yin, Raphael Gontijo Lopes, Jonathon Shlens, Ekin D Cubuk, Justin Gilmer","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}