Source-linked AI summary
Why do deep convolutional networks generalize so poorly to small image transformations?
Aharon Azulay, Yair Weiss
TL;DR
The paper asks why CNN architecture and data augmentation do not provide reliable invariance to small image transformations. It systematically measures sensitivity across architectures and protocols, then analyzes sampling and training-distribution effects. The results show that aliasing and limited similarity to training images undermine invariance, while proposed remedies provide only partial solutions.
Problem
CNNs are commonly expected to be invariant to small image translations and rescalings, but small transformations can drastically change their predictions.
Method
The paper quantifies sensitivity across six CNNs and four one-pixel perturbation protocols, then separately analyzes convolutional architecture and data augmentation.
Results
A single-pixel translation can change a CNN’s output with probability as high as 30%, while data augmentation mainly supports invariance for images similar to training examples.
Takeaways & Limitations
Antialiasing internal representations and increasing data augmentation provide only partial solutions to achieving transformation invariance.
Takeaways & Limitations
Guaranteeing invariance for any input pattern may hurt performance on datasets containing substantial photographer’s bias.
Abstract
from arXiv · showhide
Convolutional Neural Networks (CNNs) are commonly assumed to be invariant to small image transformations: either because of the convolutional architecture or because they were trained using data augmentation. Recently, several authors have shown that this is not the case: small translations or rescalings of the input image can drastically change the network's prediction. In this paper, we quantify this phenomena and ask why neither the convolutional architecture nor data augmentation are sufficient to achieve the desired invariance. Specifically, we show that the convolutional architecture does not give invariance since architectures ignore the classical sampling theorem, and data augmentation does not give invariance because the CNNs learn to be invariant to transformations only for images that are very similar to typical images from the training set. We discuss two possible solutions to this problem: (1) antialiasing the intermediate representations and (2) increasing data augmentation and show that they provide only a partial solution at best. Taken together, our results indicate that the problem of insuring invariance to small image transformations in neural networks while preserving high accuracy remains unsolved.
1. Introduction
CNNs are motivated by invariance to small translations, rescalings, and deformations, yet modern networks can change predictions dramatically under imperceptible transformations. The paper systematically investigates why convolution and data augmentation fail to ensure this invariance.
- CNN convolution and pooling are motivated by invariance to translations, scalings, and other small deformations.
- Modern CNNs can change their outputs dramatically after a one-pixel shift, one-pixel rescaling, or imperceptible posture change.
- The paper quantifies sensitivity across architectures and transformation algorithms, finding that a single-pixel translation can change predictions with probability as high as 30%.It separately analyzes convolutional architecture and data augmentation, then evaluates antialiasing and increased augmentation as possible solutions.
- The convolutional architecture fails to ensure invariance because it ignores the classical sampling theorem and therefore permits aliasing effects.
- Data augmentation teaches invariance mainly for images very similar to training examples, leaving invariance deficient on images outside the training distribution’s bias.
2. Quantifying the lack of invariance in modern CNNs
The study measures CNN sensitivity to imperceptible one-pixel perturbations across six networks and four protocols. These perturbations can change predictions frequently, although the objects remain visually recognizable to humans.
- Six CNNs from Keras and PyTorch were evaluated on 1000 images using four one-pixel perturbation protocols.
- Sensitivity was measured using P(Top-1 change) and mean absolute change, capturing prediction changes and probability shifts respectively.The second measure also helps rule out changes caused only by small gaps between the two most likely classes.
- The crop, embedding, and inpainting protocols create image pairs differing by a single-pixel translation while varying how borders and image information are handled.Cropping may remove discriminative information; embedding preserves the original information but can create atypical borders.
- The perturbations are imperceptible to humans, and object identity remains recognizable to the same degree as in the original images.
- Prediction changes can occur with probability as high as 30%, showing that prior reports of CNN non-invariance are frequent rather than isolated.Similar failures occur across packages and architectures, and a fixed imperceptible perturbation can fool networks 30% of the time.
- Modern CNNs are not fully translation invariant and can produce different outputs for a pattern and its one-pixel translation.
3. Ignoring the Sampling Theorem
Convolution alone can support translation invariance, but subsampling and nonlinearities make deep CNN representations non-shiftable when they violate sampling requirements. As depth increases, this loss of shiftability makes one-pixel translations increasingly likely to alter predictions.
- Architectural source of failure: Subsampling, or stride, breaks the intuition that translating an input simply translates every deeper feature map.Exact translation invariance in a subsampled system generally holds only when the translation is a multiple of every subsampling factor; InceptionResNetV2 has factor 60.
- Architectural source of failure: If a response is convolutional, global pooling of that response is translation invariant, even for patterns unlike those seen during training.This guarantee applies when the network uses stride one and extends to subsampling when representations remain shiftable.
- Shiftability and sampling: A subsampled feature map is shiftable when its values at arbitrary locations can be reconstructed by linear interpolation from the sampling grid.The sampling theorem requires the sampling frequency to be at least twice the representation’s highest frequency.
- Shiftability and sampling: Sharp, localized part detectors generate high frequencies and cannot be safely subsampled, whereas broader spatial tuning can preserve shiftability and pooled activity across translations.The same distinction extends to piecewise constant transformations when receptive fields remain within corresponding image subregions.
- Empirical depth effect: Deeper CNN layers become less shiftable: early-layer readouts change under a one-pixel shift in fewer than 5% of cases, while deeper readouts lose invariance.Subsampling operations and nonlinearities progressively make representations non-shiftable; Figure 3 likewise reports less shiftable feature maps at greater depth.
- Implications: Antialiasing must control frequencies before stride, but nonlinearities can introduce new high frequencies after input blurring.Thus input filtering alone cannot guarantee shiftability throughout a deep CNN.
4. Why don’t modern CNNs learn to be invariant from data augmentation?
Data augmentation teaches CNNs partial transformation invariance, but this learned invariance is largely limited to images resembling the biased training distribution. As image typicality decreases, sensitivity to small transformations rises substantially.
- Training-distribution bias: CNNs may learn invariance only to translations within the narrow range of object sizes represented during training.ImageNet contains strong biases in object location and scale, including for Tibetan terriers.
- Training-distribution bias: Embedding images at sizes unlike the network’s expected input size produces examples less similar to training images and increases observed failures.The experiments vary embedded image size to separate training-image similarity from an intrinsic effect of the embedding protocol.
- Observed sensitivity: For embedded sizes near 220, one-pixel shifts or scalings changed predictions about 10% of the time, versus approximately 30% near size 100.These figures are reported for the modern networks in the embedding experiments.
- Observed sensitivity: Typicality is measured by perceptual similarity to the 10 nearest training-set neighbors using normalized penultimate-layer ResNet50 feature correlations.This measure directly tests whether sensitivity depends on similarity to images seen during training.
- Observed sensitivity: When test images have high perceptual similarity to training images, sensitivity approaches zero; for atypical images, average top-1 change approaches 0.3.This pattern persists despite using the crop protocol employed during data augmentation, and similar failure probabilities occur across three networks.
5. Possible Solutions
The paper examines antialiasing, increased data augmentation, and avoiding subsampling as possible solutions to CNN sensitivity, finding that the first two are incomplete while the third works for small images.
- 5.1 Antialiasing: Antialiasing produces only modest improvements and does not make CNNs fully translation invariant.With embedding tests, one-pixel shifts still changed predictions about 15% of the time; atypical images showed sensitivity up to 20%.
- 5.1 Antialiasing: Nonlinearities can reintroduce aliasing despite blurring before subsampling.The paper reports that a bin5 filter with subsampling remains shiftable in a linear system but not when a ReLU nonlinearity is added.
- 5.2 Increased Data Augmentation: Increased data augmentation mainly improves invariance for images generated by the same augmentation protocol used during training.The experiments found no evidence that augmented training generalizes to the broader notion of translation invariance.
- 5.3 Reducing subsampling: Avoiding subsampling yields a CNN that is truly translation invariant on CIFAR-10 while retaining high accuracy.This held even for rescaled and black-embedded images whose size was not seen during training, although the computational cost makes the approach less feasible for large images.
6. Discussion
The discussion concludes that stride violates the sampling-theorem conditions needed for translation invariance, while data augmentation generalizes only to visually typical images. It also notes that stronger invariance mechanisms may trade off performance under photographer’s bias.
- 6. Discussion: Antialiasing remains only a partial solution, with jagged predictions and limited sensitivity reduction in the tested networks.The figure compares antialiased and non-antialiased models across transformation protocols.
- 6. Discussion: A subsampling-free CNN can achieve similar accuracy of about 0.8 while becoming perfectly translation invariant.Figure 11 compares AlexNet-style CNNs with and without subsampling on CIFAR-10.
- 6. Discussion: CNN convolution and pooling do not provide translation invariance once subsampling, or stride, is used.The paper attributes this failure to modern architectures ignoring the classic sampling theorem.
- 6. Discussion: Increased data augmentation teaches invariance mainly for images visually similar to typical training examples.The paper characterizes these images as obeying the photographer’s bias.
- 6. Discussion: The sampling theorem suggests blurring representations or using architectures with explicitly enforced invariance, but guaranteeing invariance for any input pattern may hurt performance on biased datasets.The paper presents this as a remaining trade-off rather than a resolved design principle.
A.1 Pipeline for producing the bottom row of figure 1
The pipeline downloads a video, crops frames to a square while keeping the object visible, resizes them to 299 by 299, applies standard Keras preprocessing, and obtains InceptionResNetV2 predictions.
- A.1 Pipeline for producing the bottom row of figure 1: Video frames are cropped to a 1x1 aspect ratio while keeping the object visible throughout.The processed frames are then resized to 299 by 299 before standard Keras preprocessing and model prediction.
A.2 The network architectures used in figure 2
The cited passage identifies Table 3 as listing the networks used in the experiments, with the architectures taken from the Keras applications collection.
- A.2 The network architectures used in figure 2: Table 3 lists the networks used, drawn from the Keras applications collection.
A.3 ReLU causes aliasing even with ideal low pass filter
A ReLU can destroy shiftability even when signals are blurred with an ideal low-pass filter before subsampling.
- A ReLU with bias between 0.6336 and 1 preserves one subsampled signal but eliminates the shifted signal everywhere.The unshifted signal remains a delta function, whereas the shifted signal becomes zero after thresholding.
- The example shows that nonlinearity can destroy shiftability despite preceding blurring.
A.4 CNN confidence can predict sensitivity
Similarity to the ten most similar training examples predicts sensitivity to one-pixel perturbations across different CNNs. Network confidence is also predictive, but less strongly.
- Similarity to the 10 most similar training examples predicts CNN sensitivity to one-pixel perturbations.
- CNN confidence can predict sensitivity, but its effect is weaker than similarity to the most similar training examples.
A.5 More examples of failure of antialiased networks
The paper presents additional evidence that CNN sensitivity relates to confidence and that antialiased networks can still fail under small image changes.
- Figure 12 examines CNN sensitivity to one-pixel perturbations as a function of network confidence.
- The confidence analysis uses 1000 randomly chosen, center-cropped images and reports standard-error-of-the-mean error bars.
- Figure 13 provides additional examples of failures in antialiased networks.