Fix your downsampling ASAP! Be natively more robust via Aliasing and Spectral Artifact free Pooling

Julia Grabinski,Janis Keuper,Margret Keuper
2023-07-19
Abstract:Convolutional neural networks encode images through a sequence of convolutions, normalizations and non-linearities as well as downsampling operations into potentially strong semantic embeddings. Yet, previous work showed that even slight mistakes during sampling, leading to aliasing, can be directly attributed to the networks' lack in robustness. To address such issues and facilitate simpler and faster adversarial training, [12] recently proposed FLC pooling, a method for provably alias-free downsampling - in theory. In this work, we conduct a further analysis through the lens of signal processing and find that such current pooling methods, which address aliasing in the frequency domain, are still prone to spectral leakage artifacts. Hence, we propose aliasing and spectral artifact-free pooling, short ASAP. While only introducing a few modifications to FLC pooling, networks using ASAP as downsampling method exhibit higher native robustness against common corruptions, a property that FLC pooling was missing. ASAP also increases native robustness against adversarial attacks on high and low resolution data while maintaining similar clean accuracy or even outperforming the baseline.
Computer Vision and Pattern Recognition,Image and Video Processing
What problem does this paper attempt to address?
The paper aims to address the issues of aliasing and spectral leakage caused by downsampling operations in Convolutional Neural Networks (CNNs). Specifically: 1. **Aliasing Issue**: The paper points out that even slight sampling errors can lead to aliasing, thereby affecting the robustness of the network. Previous studies have demonstrated the close relationship between aliasing and the lack of robustness in networks. 2. **Spectral Leakage Issue**: Although existing methods (such as FLC Pooling) can reduce aliasing in the frequency domain, they are still prone to spectral leakage artifacts, which manifest as ringing artifacts in the spatial domain. To address these issues, the authors propose a new downsampling method called ASAP (Aliasing and Spectral Artifact-free Pooling). This method not only eliminates aliasing but also avoids spectral leakage artifacts. Experimental validation shows that ASAP exhibits higher intrinsic robustness when dealing with common noise and adversarial attacks, and it can also prevent catastrophic overfitting when combined with simple adversarial training.