PaperlayerView exact revision on arXiv

Source-linked AI summary

On the Limitation of Convolutional Neural Networks in Recognizing Negative Images

Hossein Hosseini, Baicen Xiao, Mayoore Jaiswal, Radha Poovendran

arXiv:1703.06857v2cs.CVcs.LGstat.ML

TL;DR

The paper asks whether CNNs learn the semantics of training data, and evaluates them on negative images that retain structure and semantics. CNNs perform worse on negative than regular images, and the authors introduce semantic adversarial examples to describe such semantically equivalent but misclassified inputs.

  • Problem

    The paper asks whether CNNs learn semantic generalization, since their performance on data unlike the training distribution remains an open question.

    Source: §I · p. 1

  • Method

    The authors evaluate CNNs on negative images, which reverse brightness while preserving image structure and semantics.

    Source: §III · p. 2

  • Results

    CNNs trained on regular images significantly underperform on negative images compared with regular test images.

    Source: C. Accuracy of CNNs on Negative Images · p. 3, §VI · p. 7

  • Takeaways & Limitations

    The authors propose negative images as a semantic adversarial transformation and argue that same-distribution test accuracy may not represent model behavior in the wild.

    Source: §I · p. 2

Abstract

from arXiv · show

Convolutional Neural Networks (CNNs) have achieved state-of-the-art performance on a variety of computer vision tasks, particularly visual classification problems, where new algorithms reported to achieve or even surpass the human performance. In this paper, we examine whether CNNs are capable of learning the semantics of training data. To this end, we evaluate CNNs on negative images, since they share the same structure and semantics as regular images and humans can classify them correctly. Our experimental results indicate that when training on regular images and testing on negative images, the model accuracy is significantly lower than when it is tested on regular images. This leads us to the conjecture that current training methods do not effectively train models to generalize the concepts. We then introduce the notion of semantic adversarial examples - transformed inputs that semantically represent the same objects, but the model does not classify them correctly - and present negative images as one class of such inputs.

I. INTRODUCTION

The paper tests whether CNNs learn semantic generalization by evaluating them on negative images, which preserve image structure and semantics despite reversing brightness. CNNs perform significantly worse on negatives unless training data has significant diversity, motivating the authors’ semantic-adversarial-example framing.

I. INTRODUCTION

  • Negative images reverse brightness while preserving structure and semantics, despite producing a large pixel-wise perturbation.The paper notes that humans often recognize the complemented images.Source: §I · p. 1
  • CNNs trained on regular images significantly underperform on negative images, and accuracy on negatives is relatively good only with significant training-data diversity.The paper reports this pattern across widely used architectures and standard datasets; Figure 1 illustrates original and negative images.Source: Figure 1 · p. 1, §I · p. 1
  • The paper presents its study of negative images as a form of data augmentation as a first, to the authors’ knowledge.Source: §I · p. 1
  • The authors argue that current training methods may encourage memorization rather than learning object structure, leaving models unable to distinguish classes semantically.They call for better training methods and more meaningful performance metrics.Source: §I · pp. 1–2
  • The authors introduce semantic adversarial examples as transformed inputs that represent the same objects semantically but are misclassified by a model.Image complementing is proposed as one such transformation.Source: §I · p. 2

II. RELATED WORKS

Prior work uses image transformations for data augmentation and evaluation, but many such transformations make only slight input changes. The paper positions image complementing as a more substantial semantic-generalization check and notes that negative-image generalization was not studied in transfer learning or domain adaptation literature.

II. RELATED WORKS

  • Data augmentation commonly transforms training images through operations such as rotation, flipping, shifting, color perturbation, quantization, noise, and resizing.Image transformations are also used to evaluate deployed CNNs.Source: §II · p. 2
  • Many common transformations introduce only slight input variation, whereas image complementing preserves semantics while producing large pixel-space differences.The authors propose complementing as a check on semantic generalization.Source: §II · p. 2
  • Transfer learning and domain adaptation reuse models or features across datasets or domains, but negative-image generalization was not studied in those literatures, to the authors’ knowledge.Source: §II · p. 2

III. NEGATIVE IMAGES

The paper defines a negative image as the pixelwise complement of an original image. This brightness reversal preserves image structure and semantics and typically does not change human perception of the object.

III. NEGATIVE IMAGES

  • A negative image is formed by replacing each pixel value with its complement, 1 − X_i,n.The paper denotes the complemented image as X* and the original as a regular image.Source: §III · p. 2
  • Image complementing preserves structure, including edges, and the image’s semantics while reversing light and dark regions.Source: §III · p. 2
  • The transformation typically does not affect human perception of the depicted object.The paper illustrates original and negative examples in Figure 1.Source: §III · p. 2

IV. EXPERIMENTAL RESULTS

The experiments use LeNet-5 and modified VGG architectures on MNIST, CIFAR-10, and color and grayscale GTSRB. The reported table compares regular and negative test accuracy for classifiers trained on regular data.

IV. EXPERIMENTAL RESULTS

  • The experiments use LeNet-5 and modified VGG architectures on MNIST, CIFAR-10, and GTSRB.GTSRB is evaluated in both color and grayscale versions.Source: §IV · p. 2, A. Datasets · p. 3

A. Datasets

  • MNIST contains 50,000 training, 10,000 validation, and 10,000 test grayscale images of 28 × 28 pixels across ten digit classes.Source: A. Datasets · p. 2
  • CIFAR-10 contains 50,000 training and 10,000 test color images across ten classes, with 5,000 training images held out for validation.Its images are 32 × 32 pixels.Source: A. Datasets · p. 2

IV. EXPERIMENTAL RESULTS

  • Table II compares regular and negative test accuracy across datasets and classifiers trained on regular training data.Source: Table II · p. 3

A. Datasets

  • GTSRB has 39,209 training and 12,630 test images across 43 traffic-sign classes; images were resized to 32 × 32 pixels.Twenty percent of each class’s training images were used for validation, and a grayscale version was also generated.Source: A. Datasets · p. 3

B. CNN Architectures

The paper uses LeNet-5 on MNIST and modified VGG architectures on CIFAR-10 and GTSRB to evaluate CNNs.

B. CNN Architectures

  • LeNet-5 has three convolutional layers, two fully connected layers, and a softmax classifier, and was trained on MNIST.Source: B. CNN Architectures · p. 3
  • Modified VGG networks use 3 × 3 convolution kernels and two fully connected layers before softmax, with depth varied across architectures.Source: B. CNN Architectures · p. 3
  • The modified VGG architectures were trained on CIFAR-10 and GTSRB, with inputs resized to 32 × 32.Source: B. CNN Architectures · p. 3

C. Accuracy of CNNs on Negative Images

CNNs perform substantially worse on negative than regular test images, with generalization varying by architecture, data diversity, and training procedure. The experiments also show that conventional augmentation does not necessarily improve negative-image accuracy.

C. Accuracy of CNNs on Negative Images

Effect of feature complexity and training-data diversity

Effect of data augmentation

Effect of architecture depth

Training CNN models with negative images

D. Human Perception of Negative Images

In a closed-world classification task, people recognized negative GTSRB images with only a small accuracy reduction. The authors connect this robustness to humans' tendency to use shape rather than color.

D. Human Perception of Negative Images

V. DISCUSSION

The discussion addresses CNN fragility to transformed inputs and examines its security implications.

V. DISCUSSION

  • The discussion frames CNN fragility to transformed inputs as having security implications.Source: §V · p. 6

A. Fragility of CNNs to Transformed Inputs

CNNs may fail on transformed samples with large pixel-wise differences, even when the transformation preserves recognizable structure. Training on transformations can improve performance, but covering possible inference-time novelties is a fundamental adaptation limit; human shape recognition illustrates a different route to generalization.

A. Fragility of CNNs to Transformed Inputs

  • Because test samples usually resemble training samples, networks can associate them with nearby training examples and achieve high test accuracy.The passage says this association is likely when large datasets are available.Source: A. Fragility of CNNs to Transformed… · p. 6
  • Large pixel-wise shifts may defeat classification; training on a particular transformation can improve accuracy, but covering all inference-time novelties poses a fundamental adaptation limit.The passage notes that diverse training data can be costly in some critical applications.Source: A. Fragility of CNNs to Transformed… · p. 6
  • Humans can map the diamond, inverted-triangle, and octagon images to matching GTSRB signs by shape, despite lost color information.Those shapes uniquely identify signs in the last row of the illustrated class examples.Source: Figure 5 · p. 6
  • The authors identify learning to reason as key to semantic generalization and as a way to compensate for limited training-data diversity.Source: A. Fragility of CNNs to Transformed… · p. 6

B. Security Implication

The authors describe semantic adversarial examples as transformed inputs that preserve the object's meaning for human observers but fool a model. Unlike regular adversarial examples, these transformations may involve large perturbations.

B. Security Implication

  • Image classifiers can also be fooled by human-unrecognizable images or by slight input modifications that humans still perceive correctly.Source: B. Security Implication · p. 6
  • Semantic adversarial examples are transformed inputs that represent the same objects but are not correctly classified by the model.Source: B. Security Implication · p. 7
  • Unlike regular adversarial examples, adversarial transformations may cause large image perturbations while remaining recognizable to humans.Image complementing is presented as one such transformation; color, size, brightness, and orientation changes are also proposed as possibilities.Source: B. Security Implication · p. 7

VI. CONCLUSION

CNN accuracy is much lower on negative images than on images distributed similarly to training data. The authors conclude that raw-data training performs poorly at recognizing object semantics and introduce semantic adversarial examples.

VI. CONCLUSION

  • CNN accuracy is much lower on negative images than on images distributed similarly to training data.Source: §VI · p. 7
  • CNNs trained simply on raw data perform poorly in recognizing object semantics.Source: §VI · p. 7
  • Semantic adversarial examples are transformed inputs that appear the same to humans but are misclassified by a model.Source: §VI · p. 7
Loading 1703.06857v2…