Search

The attention mechanism has been proven effective on various visual tasks in recent years. In the semantic segmentation task, the attention mechanism is applied in various methods, including the case of both convolution neural networks and vision transformer as backbones. However, we observe that the attention mechanism is vulnerable to patch-based adversarial attacks. Through the analysis of the effective receptive field, we attribute it to the fact that the wide receptive field brought by global attention may lead to the spread of the adversarial patch. To address this issue, in this paper, we propose a robust attention mechanism (RAM) to improve the robustness of the semantic segmentation model, which can notably relieve the vulnerability against patch-based attacks. Compared to the vallina attention mechanism, RAM introduces two novel modules called max attention suppression and random attention dropout, both of which aim to refine the attention matrix and limit the influence of a single adversarial patch on the semantic segmentation results of other positions. Extensive experiments demonstrate the effectiveness of our RAM to improve the robustness of semantic segmentation models against various patch-based attack methods under different attack settings. [ABSTRACT FROM AUTHOR]

There has been extensive evidence demonstrating that deep neural networks are vulnerable to adversarial examples, which motivates the development of defenses against adversarial attacks. Existing adversarial defenses typically improve model robustness against individual specific perturbation types (e.g., ℓ ∞ -norm bounded adversarial examples). However, adversaries are likely to generate multiple types of perturbations in practice (e.g., ℓ 1 , ℓ 2 , and ℓ ∞ perturbations). Some recent methods improve model robustness against adversarial attacks in multiple ℓ p balls, but their performance against each perturbation type is still far from satisfactory. In this paper, we observe that different ℓ p bounded adversarial perturbations induce different statistical properties that can be separated and characterized by the statistics of Batch Normalization (BN). We thus propose Gated Batch Normalization (GBN) to adversarially train a perturbation-invariant predictor for defending multiple ℓ p bounded adversarial perturbations. GBN consists of a multi-branch BN layer and a gated sub-network. Each BN branch in GBN is in charge of one perturbation type to ensure that the normalized output is aligned towards learning perturbation-invariant representation. Meanwhile, the gated sub-network is designed to separate inputs added with different perturbation types. We perform an extensive evaluation of our approach on commonly-used dataset including MNIST, CIFAR-10, and Tiny-ImageNet, and demonstrate that GBN outperforms previous defense proposals against multiple perturbation types (i.e., ℓ 1 , ℓ 2 , and ℓ ∞ perturbations) by large margins. [ABSTRACT FROM AUTHOR]

Semantic segmentation plays a crucial role in various computer vision tasks, such as autonomous driving in urban scenes. The related researches have made significant progress. However, since most of the researches focus on how to enhance the performance of semantic segmentation models, there is a noticeable lack of attention given to the performance deterioration of these models in severe weather. To address this issue, we study the robustness of the multimodal semantic segmentation model in snowy environment, which represents a subset of severe weather conditions. The proposed method generates realistically simulated snowy environment images by combining unpaired image translation with adversarial snowflake generation, effectively misleading the segmentation model’s predictions. These generated adversarial images are then utilized for model robustness learning, enabling the model to adapt to the harshest snowy environment and enhancing its robustness to artificially adversarial perturbance to some extent. The experimental visualization results show that the proposed method can generate approximately realistic snowy environment images, and yield satisfactory visual effects for both daytime and nighttime scenes. Moreover, the experimental quantitation results generated by MFNet Dataset indicate that compared with the model without enhancement, the proposed method achieves average improvements of 4.82% and 3.95% on mAcc and mIoU, respectively. These improvements enhance the adaptability of the multimodal semantic segmentation model to snowy environments and contribute to road safety. Furthermore, the proposed method demonstrates excellent applicability, as it can be seamlessly integrated into various multimodal semantic segmentation models. [ABSTRACT FROM AUTHOR]

Flipover, an enhanced dropout technique, is introduced to improve the robustness of artificial neural networks. In contrast to dropout, which involves randomly removing certain neurons and their connections, flipover randomly selects neurons and reverts their outputs using a negative multiplier during training. This approach offers stronger regularization than conventional dropout, refining model performance by (1) mitigating overfitting, matching or even exceeding the efficacy of dropout; (2) amplifying robustness to noise; and (3) enhancing resilience against adversarial attacks. Extensive experiments across various neural networks affirm the effectiveness of flipover in deep learning. [ABSTRACT FROM AUTHOR]

Recommender systems are often susceptible to well-crafted fake profiles, leading to biased recommendations. Among existing defense methods, data-processing-based methods inevitably exclude normal samples, while model-based methods struggle to enjoy both generalization and robustness. To this end, we suggest integrating data processing and the robust model to propose a general framework, Triple Cooperative Defense (TCD), which employs three cooperative models that mutually enhance data and thereby improve recommendation robustness. Furthermore, Considering that existing attacks struggle to balance bi-level optimization and efficiency, we revisit poisoning attacks in recommender systems and introduce an efficient attack strategy, Co-training Attack (Co-Attack), which cooperatively optimizes the attack optimization and model training, considering the bi-level setting while maintaining attack efficiency. Moreover, we reveal a potential reason for the insufficient threat of existing attacks is their default assumption of optimizing attacks in undefended scenarios. This overly optimistic setting limits the potential of attacks. Consequently, we put forth a Game-based Co-training Attack (GCoAttack), which frames the proposed CoAttack and TCD as a game-theoretic process, thoroughly exploring CoAttack's attack potential in the cooperative training of attack and defense. Extensive experiments on three real datasets demonstrate TCD's superiority in enhancing model robustness. Additionally, we verify that the two proposed attack strategies significantly outperform existing attacks, with game-based GCoAttack posing a greater poisoning threat than CoAttack. [ABSTRACT FROM AUTHOR]

Batch normalization is one of the most widely used components in deep neural networks. It can accelerate training, and boost model performance on normal samples. However, batch normalization induces vulnerability to models on adversarial examples, especially in medical images, and the reason is still not clear. In this paper, we aim to explain the vulnerability aroused by batch normalization under adversarial images. Specifically, we first discover that both natural and medical images contain a large number of trivial features, whose weights will be enlarged under adversarial attacks, and batch normalization can further enlarge their weights. Additionally, we find that batch normalization will reduce the inter-class margin of high-level features, leading to less tolerance to adversarial perturbations, thereby decreasing the model robustness. Moreover, we hypothesize that the smaller inter-class margin, the more difficult to attain the optimal classification space, which means batch normalization will restrict the performance of adversarial training. This further verifies that a narrower inter-class margin induced by batch normalization reduces the model robustness. Experiments on four benchmark datasets demonstrate our discovery, interpretation and hypothesis. [ABSTRACT FROM AUTHOR]

Brain aneurysm detection in Time-Of-Flight Magnetic Resonance Angiography (TOF-MRA) has undergone drastic improvements with the advent of Deep Learning (DL). However, performances of supervised DL models heavily rely on the quantity of labeled samples, which are extremely costly to obtain. Here, we present a DL model for aneurysm detection that overcomes the issue with "weak" labels: oversized annotations which are considerably faster to create. Our weak labels resulted to be four times faster to generate than their voxel-wise counterparts. In addition, our model leverages prior anatomical knowledge by focusing only on plausible locations for aneurysm occurrence. We first train and evaluate our model through cross-validation on an in-house TOF-MRA dataset comprising 284 subjects (170 females / 127 healthy controls / 157 patients with 198 aneurysms). On this dataset, our best model achieved a sensitivity of 83%, with False Positive (FP) rate of 0.8 per patient. To assess model generalizability, we then participated in a challenge for aneurysm detection with TOF-MRA data (93 patients, 20 controls, 125 aneurysms). On the public challenge, sensitivity was 68% (FP rate = 2.5), ranking 4th/18 on the open leaderboard. We found no significant difference in sensitivity between aneurysm risk-of-rupture groups (p = 0.75), locations (p = 0.72), or sizes (p = 0.15). Data, code and model weights are released under permissive licenses. We demonstrate that weak labels and anatomical knowledge can alleviate the necessity for prohibitively expensive voxel-wise annotations. [ABSTRACT FROM AUTHOR]

We study the model robustness against adversarial examples, referred to as small perturbed input data that may however fool many state-of-the-art deep learning models. Unlike previous research, we establish a novel theory addressing the robustness issue from the perspective of stability of the loss function in the small neighborhood of natural examples. We propose to exploit an energy function to describe the total variation in a small neighborhood and prove that reducing such energy guarantees the robustness against adversarial examples. We also show that the traditional training methods including adversarial training and virtual adversarial training tend to minimize the lower bound of our proposed energy function. Importantly, we prove that minimizing the energy function can obtain a better generalization bound than traditional adversarial training approaches. Through a series of experiments, we demonstrate the superiority of our model on different datasets for defending adversarial attacks. In particular, our proposed adversarial framework achieves the best performance compared with previous adversarial training methods on benchmark datasets CIFAR-10, CIFAR-100 and SVHN and they demonstrate much better robustness against adversarial examples than all the other comparison methods. [ABSTRACT FROM AUTHOR]

Lisciandra (2017) poses a challenge for robustness analysis (RA) as applied to economic models. She argues that substituting tractability assumptions risks altering the main mathematical structure of the model, thereby preventing the possibility of meaningfully evaluating the same model under different assumptions. In such cases RA is argued to be inapplicable. However, Lisciandra is mistaken to take the goal of RA as keeping the mathematical properties of tractability assumptions intact. Instead, RA really aims to keep the modeling component while varying the corresponding mathematical formulation. Thus, her argument concerning whether the associated mathematical properties of certain assumptions can be kept intact is irrelevant to the success of RA. Furthermore, we explicate and develop Lloyd’s account of “model robustness” (Lloyd 2015) to provide solutions to Lisciandra’s challenges. Our solutions are, namely, error analysis and independent empirical support. We conclude that although complex economic models do face potential dangers, there are solutions and robustness analysis need not be given up. (157). [ABSTRACT FROM AUTHOR]

The self-exciting point process (SEPP) is a model of the spread of crime in space and time, incorporating background and triggering processes. It shows promising predictive performance and forms the basis of a popular commercial software package, however few detailed case studies describing the application of the SEPP to crime data exist in the scientific literature. Using open crime data from the City of Chicago, USA, we apply the SEPP to crime prediction of assaults and burglaries in nine distinct geographical regions of the city. The results indicate that the algorithm is not robust to certain features of the data, generating unrealistic triggering functions in various cases. A simulation study is used to demonstrate that this outcome is associated with a reduction in predictive accuracy. Analysing the second-order spatial properties of the data demonstrates that the failures in the algorithm are correlated with anisotropy. A modified version of the SEPP model is developed in which triggering is non-directional. We show that this provides improved robustness, both in terms of the triggering structure and the predictive accuracy. [ABSTRACT FROM AUTHOR]

The study is aimed to evaluate a hydrological simulation model intended for assessing climate change impact. A new test was suggested and applied to evaluate the performance of a physically based model of Selenga River runoff generation. In this test, to calibrate the model, an enhanced Nash-and-Sutcliffe efficiency (NSE) criterion was used, including trend-oriented reference (benchmark) models instead of the simple reference model used in the original NSE criterion. Next, modifications were made in the Differential Split Sample test (DSS-test) of V. Klemeš (1986), focused on differences in the model performance criteria for climatically contrasting periods, and a new statistical measure was proposed to estimate the significance of these differences. After that, model performance was evaluated for four sites within the catchment, three indicators of interest (daily, monthly, and annual discharge series), and the model ability to reproduce the observed trends in annual and seasonal discharge values was assessed. The model proved robust enough to be applied to assessing climate change impact on the annual and monthly runoff in different parts of the Selenga River basin. [ABSTRACT FROM AUTHOR]

We consider a model of gap gene expression during the early development of Drosophila embryo. Parameter values in the model have been obtained by fitting to experimental patterns under an additional condition that the solution be asymptotically stable at large times. The patterns at the beginning of gastrulation in such solutions are very close to an actual attractor in the model. It is shown that such solutions are more robust to perturbations of concentrations and parameter values in the model. [ABSTRACT FROM AUTHOR]

This study addresses the question of what diatom taxa to includein a modern calibration set based on their relative contribution in apalaeolimnological calibration model. Using a pruning algorithm for ArtificialNeural Networks (ANNs) which determines the functionality of individual taxa interms of model performance, we pruned the Surface Water Acidification Project(SWAP) pH-diatom data-set until the predictive performance of thepruned set (as assessed by a jackknifing procedure) was statistically differentfrom the initial full-set. Our results, based on the validation at each5% data-set reduction, show that (i) 85% of the taxa canbe removed without any effect on the pH model calibration performance, and (ii)that the complexity and the dimensionality reduction of the model by theremoval of these non-essential or redundant taxa greatly improve therobustness of the calibration. A comparison between the commonly used“marginal” criteria for inclusion (species tolerance andHill's N2) and our functionality criterion shows that the importance ofeach taxon in an ANN palaeolimnological model calibration does not appear todepend on these marginal characteristics. [ABSTRACT FROM AUTHOR]

Sensitivity of a posterior quantity ρ( f, P) to the choice of the sampling distribution f and prior P is considered. Sensitivity is measured by the range of ρ( f, P) when f and P vary in nonparametric classes Γ f and Γ P respectively. Direct and iterative methods are described which obtain the range of ρ( f, P) over f∈Γ f when prior P is fixed, and also the overall range over f∈Γ f and P∈Γ P. When multiple i.i.d. observations X1,..., X k are observed from f, the posterior quantity ρ( f, P) is not a ratio-linear function of f. A method of steepest descent is proposed to obtain the range of ρ( f, P). Several examples illustrate applications of these methods. [ABSTRACT FROM AUTHOR]