Source-linked AI summary
Geometric robustness of deep networks: analysis and improvement
Can Kanbak, Seyed-Mohsen Moosavi-Dezfooli, Pascal Frossard
TL;DR
Deep networks can be vulnerable to geometric transformations, and the paper addresses the lack of a systematic way to measure their invariance. It proposes ManiFool to find worst-case transformations and measure robustness, then reports that ManiFool-based adversarial training improves invariance against worst-case and random transformations.
Problem
The paper addresses the lack of a systematic method for measuring deep networks’ invariance to geometric transformations, a robustness concern for sensitive applications.
Source: §1 · p. 1Method
ManiFool searches for small worst-case geometric transformations that change classifier decisions, and its examples are used for adversarial training.
Source: §1 · p. 1Results
ManiFool-based fine-tuning reduced random-transformation misclassification by more than 20% at ˜d(e, τl) = 2.5, with a 0.6% test-set accuracy reduction; the paper reports improved robustness in both worst-case and random regimes.
Source: §5.3 · p. 8, §6 · p. 8Takeaways & Limitations
The method provides a way to measure and compare network invariance and the paper reports that worst-case geometric examples can be used in training to improve invariance.
Source: §1 · p. 1, §6 · p. 8ManiFool’s complexity depends heavily on the number of classes and increases linearly with the maximum iteration limit, which must be chosen carefully.
Source: §4.2 · p. 5
Abstract
from arXiv · showhide
Deep convolutional neural networks have been shown to be vulnerable to arbitrary geometric transformations. However, there is no systematic method to measure the invariance properties of deep networks to such transformations. We propose ManiFool as a simple yet scalable algorithm to measure the invariance of deep networks. In particular, our algorithm measures the robustness of deep networks to geometric transformations in a worst-case regime as they can be problematic for sensitive applications. Our extensive experimental results show that ManiFool can be used to measure the invariance of fairly complex networks on high dimensional datasets and these values can be used for analyzing the reasons for it. Furthermore, we build on Manifool to propose a new adversarial training scheme and we show its effectiveness on improving the invariance properties of deep neural networks.
1. Introduction
Geometric transformations can change deep networks’ predictions, yet prior approaches did not provide a way to measure classification architectures’ invariance. The paper proposes ManiFool to measure worst-case geometric robustness and uses its fooling examples for adversarial training.
1. Introduction
- ManiFool is a scalable algorithm for finding small worst-case transformations and comparing network invariance.It searches for transformations that change a classifier’s decision.Source: §1 · p. 1
- The authors report the first quantitative study of geometric robustness for deep networks trained on ImageNet, finding susceptibility to small, sometimes imperceptible transformations.The paper motivates geometric invariance as important for practical vision systems and focuses on worst-case transformations relevant to sensitive applications.Source: §1 · p. 1
- Adversarial training with ManiFool’s geometric transformations improves deep networks’ invariance properties.This extends a line of adversarial training work previously described for additive perturbations [25] [10].Source: §1 · pp. 1–2
- The paper identifies a measurement gap: existing practical methods for improving invariance did not measure classification architectures’ invariance properties.Prior measurement approaches included neuron firing rates for one-dimensional transformations, probabilistic sampling, and geodesic distances on transformed-image manifolds.Source: §1 · p. 2
2. Preliminaries
The preliminaries represent geometric transformations as actions on images and use the resulting image appearance manifold to define a geometry-aware distance. This distance supports comparing the effect of transformations across images.
2. Preliminaries
- A geometric transformation τ acts on an image I by mapping image points, and transformations can be parameterized by a vector of parameters.Examples of transformation groups include rotations and projective transformations.Source: §2 · p. 2
- The image appearance manifold M(I) consists of transformed versions of an image and inherits a Riemannian metric from image space.Geodesic distance on this manifold captures the intrinsic geometric structure of transformed images, unlike a simple parameter-vector or image L2 distance.Source: §2 · p. 2
- The transformation distance is based on geodesic length and is normalized by the image norm to compare transformation effects across images.The distance from the identity transformation is used to measure the action of a transformation.Source: §2 · p. 2
3. Robustness to geometric transformations
The paper defines worst-case invariance by the smallest normalized geometric transformation that changes a classifier’s decision. It also describes global and random-transformation scores and how they are estimated from image samples.
3. Robustness to geometric transformations
- A classifier’s invariance for an image is the minimum normalized distance from the identity to a transformation that causes misclassification.The global score applies this worst-case geometric measure over a probability distribution of images.Source: §3 · p. 3
- The global invariance score is estimated by averaging estimated per-image invariance over sampled images.In practice, the ManiFool algorithm finds a small fooling transformation, whose geodesic distance estimates each image’s invariance.Source: §3 · p. 3
- Random-transformation invariance is measured by misclassification probability at given geodesic distances, with 0.5 used as a threshold in the stated definition.The threshold may be changed; estimates are obtained by sampling transformations and measuring misclassification rates at increasing distances.Source: §3 · p. 3
4. ManiFool
ManiFool iteratively searches for small geometric transformations that cross a classifier’s decision boundary while remaining on the image appearance manifold. It extends this search to multiclass classifiers and estimates transformation robustness using a sampled direct-path geodesic distance.
4. ManiFool
- ManiFool measures worst-case geometric robustness by iteratively moving an image toward the decision boundary while staying on its transformation manifold.Each iteration chooses a movement direction and maps it back onto the manifold.Source: §4 · p. 3, Figure 2 · p. 3
4.1. ManiFool for binary classifiers
- For binary classifiers, ManiFool projects the negative classifier gradient onto the image-manifold tangent space, then maps the direction back onto the manifold to continue toward the boundary.The mapping uses an exponential map when available and computationally suitable; otherwise, the method uses a retraction, with projective transformations as one example.Source: §4.1 · pp. 3–4
4.2. ManiFool for multiclass classifiers
- For multiclass classifiers, ManiFool runs binary searches against alternative classes and returns the fooling transformation with the smallest geodesic score.To reduce complexity, it searches only the highest-scoring candidate classes, excluding the original label; complexity also grows linearly with the maximum iteration count.Source: §4.2 · pp. 4–5
4.3. Measuring robustness to geometric transformations
- To estimate geodesic distance, the method assumes a direct path, maps the target into the start point’s tangent space, divides the vector into steps, and sums sampled L2 distances.This is proposed as an alternative to Fast Marching, whose complexity increases exponentially with manifold dimension.Source: §4.3 · p. 5, Figure 3 · p. 5
5. Experimental Results
The experiments compare ManiFool with Manitest, measure invariance across ImageNet architectures, and test ManiFool-generated adversarial fine-tuning on CIFAR10. Fine-tuning with worst-case geometric examples improves invariance in both worst-case and random-transformation regimes, with a small test-accuracy penalty.
5. Experimental Results
- Random-transformation evaluation samples transformations at a specified geodesic distance and measures misclassification across distances; transformed images use bilinear interpolation and zero-padding when needed.The experiments also compute minimal-transformation invariance by averaging geodesic distances of ManiFool-generated fooling transformations.Source: §5 · pp. 5–6
5.1. Performance of ManiFool
- Manitest was more accurate in finding minimal transformations, while ManiFool was less complex as transformation-manifold dimensionality increased and could scale to complex networks.The comparison used 1,000 MNIST training images and a two-convolution-layer CNN; Table 1 reports invariance scores and average runtime per sample.Source: §5.1 · p. 6, Table 1 · p. 6
5.3. Adversarial Training using ManiFool
- The CIFAR10 fine-tuning experiment used ResNet-18 and compared extra epochs on ManiFool-generated minimal examples, random transformations, or the original training data.Fine-tuning used five additional epochs at a 50% lower learning rate; invariance was evaluated on 5,000 test images.Source: §5.3 · pp. 7–8, Table 2 · p. 7
5.2. Invariance score of different architectures
- Invariance generally increased with depth within VGG and ResNet families, but depth and parameter count alone did not determine rankings; ResNet-34 and ResNet-50 did better than VGGs on random transformations.ResNet-18 was less invariant than VGG-16 despite being deeper, while VGG-16 had more parameters than ResNet-50 but was less invariant.Source: §5.2 · p. 7, Figure 7 · p. 8
- Misclassification rates under random transformations and invariance scores against minimal transformations were correlated, but their network rankings were not identical.The architecture study used 5,000 ILSVRC2012 validation images, including 10 random transformations per image for random-transformation evaluation.Source: §5.2 · pp. 6–7, Figure 6 · p. 7, Figure 7 · p. 8
5.3. Adversarial Training using ManiFool
- More than 20% lower misclassification at geodesic distance 2.5 followed worst-case fine-tuning, with a 0.6% test-accuracy reduction.Worst-case fine-tuning also improved invariance against minimal transformations and outperformed fine-tuning on randomly transformed images.Source: Figure 8 · p. 8, §5.3 · p. 8
6. Conclusion
The conclusion presents ManiFool as a constructive framework for scoring geometric invariance and reports that its adversarial training improves robustness to both worst-case and random transformations.
6. Conclusion
- ManiFool computes invariance scores by moving toward the class decision boundary with gradient descent while remaining on the geometric-transformation manifold.The method generates small fooling transformations.Source: §6 · p. 8
- On ImageNet-trained networks, the study evaluates robustness against both worst-case and random geometric transformations.Source: §6 · p. 8
- Adversarial training with ManiFool improves robustness to both worst-case and random transformations, producing more invariant networks.Source: §6 · p. 8
- The authors suggest ManiFool could support empirical analysis of geometric invariance and generate adversarial examples from a wider range of natural transformations.Source: §6 · p. 8