\section{Introduction}
As a fundamental computer vision task, semantic segmentation aims to produce pixel-level classification of the given image. The advent of Convolutional Neural Networks (CNNs) and its subsequent advancements have significantly improved the performance of semantic segmentation models \cite{long2015fully, chen2017deeplab, zhou2016learning, chen2017rethinking}. However, the success of these models highly relies on a large training dataset with pixel-level annotations \cite{everingham2010pascal, cordts2016cityscapes}, which is expensive and time-consuming to obtain. To relieve the burden of pixel-wise labeling, weakly supervised semantic segmentation (WSSS) models have been widely studied, which are usually built upon weak annotations, including image-level labels \cite{wang2020self, fan2020learning, wei2018revisiting, ahn2018learning, huang2018weakly, araslanov2020single}, point supervisions \cite{bearman2016s}, scribble annotations \cite{vernaza2017learning, lin2016scribblesup} and bounding boxes \cite{song2019box, dai2015boxsup}. Among these weak annotations, image-level labels provide the lowest level of supervision, thus presenting the most challenging task.

\begin{figure}[htb]
    \centering
    \includegraphics[width=\columnwidth]{Figures/introduction_figure.png}
    \vspace*{-0.5cm}
    \caption{\small
    Comparison of class activation maps generated by (b) the basic CAM method \cite{zhou2016learning}, (c) SEAM \cite{wang2020self}, and (d) our proposed model.
    Our structure-aware class activation map leads to more consistently high activation within the object (row 2), and less spurious activation outside the object (row 1).
    }
    \label{fig: figure1}
\end{figure}

Most of the image-level label based WSSS models rely on a Class Activation Map (CAM) \cite{zhou2016learning} to provide initial localisation of the object. However, CAMs are incomplete,
focusing on the most discriminative area and
often revealing only a small part of the object, as shown in Fig.~\ref{fig: figure1} (b), which makes it insufficient to serve as
a pseudo label for the downstream semantic segmentation task.

Recent studies \cite{ahn2018learning, wang2020self, chang2020weakly} have resorted to a three-stage training scheme to further boost the performance of the image-level supervision based WSSS models. Firstly, a better attention map is obtained to cover a larger part of the object, \emph{e.g.}, \cite{wang2020self, chang2020weakly} achieve this by incorporating additional constraints in the learning of a classification network. Secondly, the attention map is expanded through pixel correlations to increase the coverage rate. This is mainly achieved by learning an affinity matrix through
AffinityNet \cite{ahn2018learning} to
a
perform a random walk on the obtained class activation maps. Lastly, a semantic segmentation model, \emph{e.g.} \space DeepLab \cite{chen2017deeplab}, is trained using the expanded attention maps as pseudo labels in a fully supervised manner.

The performance of the three-stage training scheme highly depends on the quality of the initial class activation map. We argue that although the discriminative area is beneficial for object classification, the lost structure information in the class activation map hinders its performance in subsequent processing, \emph{e.g.} \space semantic segmentation.
Further, due to different degrees of discrimination, regions inside the same object have different class activation scores. In this paper, we propose a smoothing branch that leverages semantic boundary information to impose structural constraints on the training of WSSS models. It forces the resulting class activation maps to pay attention to object structures.  Furthermore, we introduce a semantic boundary-guided smoothness loss that achieves a more consistent attention map within the same object area while ignoring the pixels belonging to other classes as shown in Fig.~\ref{fig: figure1}. With the proposed framework, we can achieve better CAMs with structure information, leading to relatively sharp semantic predictions as shown in Fig. \ref{fig: figure1}.

Our main contributions can be summarised as:
\begin{enumerate}
    \item We propose a smoothing branch that leverages semantic boundaries.

    for weakly supervised semantic segmentation to obtain structure preserving attention maps.
    \item We present a semantic boundary-guided smoothness loss function that enforces more consistent semantic prediction
    within the same object area.
    \item Our proposed method achieves the state-of-the-art results on the PASCAL VOC 2012 dataset.
\end{enumerate}

\section{Related Work}
\subsection{Weakly supervised semantic segmentation}
Weakly supervised semantic segmentation models aim to perform the semantic segmentation task with only coarse annotations. Successful examples have explored the potential of bounding box \cite{song2019box, dai2015boxsup}, scribble \cite{vernaza2017learning, lin2016scribblesup}, point \cite{bearman2016s} and image-level \cite{wang2020self, fan2020learning, wei2018revisiting, ahn2018learning, huang2018weakly, araslanov2020single} annotations. Among these,
image-level labels require the minimum-level of manual annotation
Further,
they present the most challenging task, providing the least supervision for training. Our work employs image-level labels as weak supervision for semantic segmentation task.

\subsection{Class Activation Maps}
Recent weakly supervised semantic segmentation works have been based on using CAMs \cite{zhou2016learning} to provide the initial localisation cues for different classes. It requires modification to the structure of CNNs trained for a classification task with image-level labels. The penultimate global average pooling (GAP) layer is removed, and the classification layer is directly applied to the high dimensional features to produce the pixel-level score maps for each class. Grad-CAM \cite{selvaraju2017grad} aims to mitigate the limitation of CAM that it is only applicable to fully convolutional neural networks and its performance is slightly reduced due to the change of network structure. It associates the importance of feature maps at the penultimate layer with the class gradients and computes the score maps with a weighted sum of those feature maps. However, these class activation maps reveal only the most discriminative parts of the objects as they are trained primarily for classification. The output pseudo segmentation maps are incomplete and require further refinement.

Some research approaches enforce the network to learn a more complete representation by erasing the most discriminative parts of the object. Wei \emph{et al.} \cite{wei2017object} proposes to \enquote{erase} the obtained high-confidence area and retrain the network for the classification task with partially erased inputs in order to enforce
the network to identify more activation areas associated with each class. However, as a result of the gradual removal of the high confidence area, the model eventually includes incorrect pixels surrounding the target object for classification. To mitigate this problem, SeeNet \cite{hou2018self} employs two additional decoder branches to confine the erasure and attention within the object. DCSP \cite{chaudhry2017discovering} applies the erasure iteratively and leverages an off-the-shelf saliency detector to confine the process, so that the attention within the object can be accumulated.

Recent works have been focusing on improving the quality of class activation maps directly. FickleNet \cite{lee2019ficklenet} forces the model to learn a more complete CAM by randomly dropping connections of units in the convolution kernel. However, it is computationally expensive, involving generating 200 localisation maps for each input image and accumulating them to produce the revised result. OAA \cite{jiang2019integral} discovers a shift and transformation of CAMs in the training of the classification task. It accumulates CAMs in different stages of training to produce a final activation map that covers a larger area. Both SSENet \cite{wang2019self} and SEAM \cite{wang2020self} adopt scale equivariant attention to achieve self supervision. \cite{chang2020weakly} proposes to perform fine-grained classification within each class, and accumulate the sub-class activation maps with the class activation maps to enlarge the activation area. \cite{fan2020learning} learns a directional vector within each class to differentiate foreground and background pixels. However, these methods focus only on increasing the overlap ratio between the recovered and ground truth segmentation maps, while ignoring the structures of the objects, resulting in incorrect segmentation results around the object boundaries.

\begin{figure*}[htb]
    \centering
    \includegraphics[width=1.90\columnwidth]{Figures/Network_Overview-Page-11.jpg}
    \vspace*{0cm}
    \caption{Our network consists of a baseline model \cite{wang2020self} and a smoothing branch. The Semantic Boundary Detection Module utilises feature maps and edge maps (\enquote{E}) obtained by applying

    the Canny Edge detector on the input image (\enquote{X}) to make semantic boundary prediction. It encodes

    boundary information into the output class activation map (\enquote{C}) by making feature maps structure-aware. The proposed semantic boundary guided smoothness loss further regulates the output CAM by enforcing consistently high activation scores within the object while creating a sharp score contrast along the semantic boundary (\enquote{S}).}
    \label{fig: Network}
\end{figure*}

\subsection{Structure-aware semantic segmentation}
Mismatch between the boundaries of CAMs and class objects is a key factor that hinders the recovery of the full segmentation mask of weakly supervised semantic segmentation. The idea of expanding the localisation cues, such as CAMs, to recover more complete representations of holistic objects was first proposed in \cite{kolesnikov2016seed}. The expansion can benefit from more accurate initial localisation \cite{li2018tell}. \cite{huang2018weakly} incorporates the seeded region growing (SDRG) algorithm into the network to expand the initial CAMs. The expansion is confined by the boundary that separates the foreground and background pixels. AffinityNet \cite{ahn2018learning} learns an affinity matrix on the initial CAMs and perform a random walk to diffuse confident labels to similar pixels. SSDD \cite{shimoda2019self} optimises the segmentation results of semantic segmentation models by learning from the dense Conditional Random Fields (dCRF) and Random Walk (RW) revised results. These works exploit pixel correlations to alleviate the mismatch between the segmentation map boundary and the class boundary, while some other works \cite{lee2019ficklenet, huang2018weakly, hou2018self, chaudhry2017discovering} directly adopt off-the-shelf saliency detection networks to localise the boundary between foreground and background pixels, which implicitly uses extra ground truth. Our work derives the semantic boundary from the semantic segmentation results of existing weakly supervised semantic segmentation model so that it does not implicitly or explicitly utilise any additional supervision. It utilises the semantic boundary to incorporate the structure information into the feature maps and make the activation score within the object more consistent, leading to improved segmentation results.

\section{Our Method}
In this section, we introduce the proposed structure-aware semantic segmentation model with image-level supervision as shown in Fig. \ref{fig: Network}.

\subsection{Smoothing Branch (SB)}
We adopt an existing WSSS model \cite{wang2020self} as our baseline model. Our proposed smoothing branch is implemented upon the baseline model by connecting to its encoder and CAM output layer without modification to its network structure. The convolutional layers producing feature maps of the same resolutions are grouped in different stages of network, and we denote the feature map produced by the last convolutional layer of each stage as $F_{m}(m = 1, \dots, n)$, where $n$ depends on the backbone used by the base model. The input image and image-level labels are denoted as $X$ and $Y$. The output CAMs from the base model are denoted as $C$. The number of classes in the dataset is defined as $k$.\\

\noindent\textbf{Semantic Boundary Detection Module (SBDM)}: The Semantic Boundary Detection Module encourages the feature maps of the baseline model to encode richer structural information. We use feature maps from different levels of the backbone network to produce semantic boundary predictions $B$ of size $(k + 1) \times W \times H$ corresponding to 20 classes in PASCAL VOC 2012 \cite{everingham2010pascal} plus the background, where $W \times H$ is the spatial size of the feature map. We define the upsampling operation for the $F_i$ as:
$F_m^{U} = U (F_m)$,
where $U$ applies a $1 \times 1$ convolution followed by
a $3 \times 3$ convolution to channel size $M=32$, followed by an bilinear interpolation operation to achieve a feature map of the image size $W \times H$. We concatenate features of $F_{m}(m = 1, \dots, n)$, and feed it to another two $3 \times 3$ convolutional layers to obtain the initial semantic boundary of $k$ channels.

To inform the model of the image structure we use handcrafted feature-based boundaries as per  \cite{takikawa2019gated,zhang2020weakly}. The computed Canny edges are expanded to $k$ channels before being interleaved between the initial semantic boundary through concatenation, Then they are fed to another $1 \times 1$ depthwise convolutional layer to obtain our final semantic boundary $B$. The whole process to obtain our final semantic boundary is shown in Eq. \ref{semantic_boundary_eq}:

\begin{equation}
\label{semantic_boundary_eq}
\begin{aligned}
B = DConv1(\amalg_C \{Conv3(Conv3(\amalg_C \{F_i^U\})), E\})
\end{aligned}
\end{equation}

\noindent
where $B$ is semantic boundary prediction, $\amalg_C{,}$ is concatenation operation, $Conv3$ is $3\times 3$ convolutional layer, $DConv1$ is $1 \times 1$ depthwise convolutional layer, and $E$ represents the output of applying the Canny edge detector on the input image. The SBDM is trained with a cross-entropy loss $\mathcal{L}_{B}$ with the preprocessed semantic boundary $S$ as supervision, which is derived from the final semantic segmentation results of our baseline \cite{wang2020self}.
\begin{equation}
    \mathcal{L}_{B} = \sum_{i=1}^{k} \sum_{u,v}^{W,H} (B_{u,v}^{i} \log (S_{u,v}^{i}) + (1 - B_{u,v}^{i}) \log (1 - S_{u,v}^{i})),
\end{equation}

\noindent\textbf{Semantic Boundary Guided Smoothness Loss:} We enforce the pixels inside the object to achieve consistently high activation scores and a sharp contrast to the pixels falling outside the boundary in terms of confidence scores. Inspired by \cite{wang2018occlusion, godard2017unsupervised}, we develop a semantic boundary guided smoothness loss to impose such a constraint. The original smoothness loss is designed to smooth the intensity while preserving structure information in the whole image. However, this is detrimental to the semantic segmentation task where structure information other than the class boundary needs to be suppressed.
Further,
this becomes even worse for WSSS with only image labels. The smoothness loss function interprets the edges as gradients of class activation scores. When there are unwanted edges present within the semantic boundary, it tends to suppress the class activation scores on either side of the gradient line, resulting in deteriorated results.

To mitigate this problem, we employ the semantic boundary in our proposed branch as a guidance for the smoothness loss. Thus, it is able to diffuse the high scores of the most discriminative area to all pixels enclosed by the semantic boundary to achieve
smoothness. We define our semantic boundary guided smoothness loss with both first-order ($\delta_{d}$) derivative and second-order ($\delta_{d}^{2}$) derivative as:
\begin{equation}
    \mathcal{L}_{S}^{1} = \sum_{i=1}^{k} Y_{i} \sum_{u,v}^{W,H} \sum_{d \in \Vec{x}, \Vec{y}} \Psi(|\delta_{d}C_{u,v}^{i}| \exp^{-\alpha |\delta_{d}S_{u,v}^{i}|}),
\end{equation}
\begin{equation}
    \mathcal{L}_{S}^{2} = \sum_{i=1}^{k} Y_{i} \sum_{u,v}^{W,H} \sum_{d \in \Vec{x}, \Vec{y}} \Psi(|\delta_{d}^{2}C_{u,v}^{i}| \exp^{-\alpha |\delta_{d}^{2}S_{u,v}^{i}|}),
\end{equation}
where $Y \in \{0, 1\}$ is the image label to filter irrelevant classes, k is the total number of classes plus one for background, $C_{u,v}^{i}$ is the classification score at pixel $(u, v)$ for class $i$, $S_{u,v}^{i} \in \{0, 1\}$ is the semantic boundary response at pixel $(u, v)$ for class $i$, $\alpha$ is a constant set to 10.
Function $\Psi$ is defined as $\Psi(s) = \sqrt{s^{2} + 1\exp^{-6}}$ to avoid calculating the square root of zero, following the settings in \cite{wang2018occlusion, godard2017unsupervised}, $d$ indicates that $\delta_{d}$ computes the partial derivatives in the $\Vec{x}$ or $\Vec{y}$ direction.
This semantic boundary guided smoothness loss enforces score consistency by penalising the gradients in class activation maps, with a boundary-aware term ($\delta S$ or $\delta^2 S$) to maintain the score contrast along the semantic boundary.

Then our semantic boundary guided smoothness loss function $\mathcal{L}_{S}$ is defined as weighted sum of $\mathcal{L}_{S}^{1}$ and $\mathcal{L}_{S}^{2}$ as:
\begin{equation}
\label{smoothness_loss}
    \mathcal{L}_{S} = \mathcal{L}_{S}^{1} + \lambda_{S}\mathcal{L}_{S}^{2}
\end{equation}
where $\lambda_{s}$ is a weight to balance the contribution of first-order and second-order derivative based smoothness loss, and empirically we set $\lambda_{s}= 10$, following
settings in \cite{wang2018occlusion, godard2017unsupervised}.

\noindent\textbf{Objective Function:} The overall loss function is composed of the baseline model loss functions, $\mathcal{L}_b$, the cross-entropy loss $\mathcal{L}_{B}$ for the training of SBDM, and the semantic boundary guided smoothness loss $\mathcal{L}_{S}$. It is defined as:
\begin{equation}
\begin{aligned}
    \mathcal{L} = &\mathcal{L}_{b}(C, Y) + \lambda_{1} \mathcal{L}_{B}(B, (S, Y)) \\
    &+ \lambda_{2} \mathcal{L}_{S}(B, (S, Y))
\end{aligned}
\end{equation}
\noindent
where $\lambda_{i}(i=1,2)$ are factors given to the semantic boundary loss and the smoothness losses. The factor of loss functions associated with the base model is kept as 1, We empirically set $\lambda_{1} = 0.05$, $\lambda_{2} = 1$. $\lambda_{1}$ is kept so that the semantic boundary loss $\mathcal{L}_{B}$ does not dominate. The choice of $\lambda_{2}$ is discussed in detail in Sec \ref{Ablation study section}.

\section{Experimental Results}
\subsection{Setup}
\noindent\textbf{Dataset} We follow the standard procedure of WSSS to evaluate our proposed smoothness branch on the PASCAL VOC 2012 segmentation dataset \cite{everingham2010pascal} which contains 20 foreground classes and 1  background class. The official split contains 1,464 images in the training set, 1449 images in the validation set and 1456 images in the testing set. Following the common protocol for semantic segmentation, we use the augmented training set, which includes 10,582 images, provided by \cite{hariharan2011semantic}. The mean Intersection-over-Union (mIoU) metric is adopted to evaluate the segmentation results. We follow the previous WSSS works \cite{wang2020self, fan2020learning, ahn2018learning} to report results on training and validation sets for stage-1 and stage-2 models and report the results on both validation and test sets for the final semantic segmentation model.

\noindent\textbf{Training Details}
We adopt SEAM \cite{wang2020self} as our baseline model which has a ResNet38 backbone. The semantic boundary is derived from final semantic segmentation results so that we do not use any additional ground truth either implicitly or explicitly. We follow the settings of SEAM by randomly rescaling the images in the range of $[448, 768]$ along the longest side and then crop the size to $448 \times 448$. The learning rate adopts the poly policy $l_{itr} = l_{init}(1 - \frac{itr}{max.itr})^{\gamma}$, where the initial learning rate is set to $l_{init} = 0.01$ and decay is set to $\gamma = 0.9$. We initialise our model with the released weights from our baseline \cite{wang2020self}. The network is trained on 4 NVIDIA RTX 2080TI GPUs.  As our work focuses primarily on improving the quality of initial class activation maps, we just use models with publicly available Pytorch codes for the remaining stages of the pipeline.

\subsection{Comparison with the Baseline}
\noindent\textbf{Quantitative Analysis of CAM:} We compare our proposed model to the baseline model and show the corresponding performance in Table \ref{Table: compare to baseline}. Note that, unless otherwise stated, the results are evaluated on the PASCAL VOC 2012 training and validation sets. Table \ref{Table: compare to baseline} shows that our model (\enquote{Ours}\footnote{Ours indicates \enquote{CAM+SEAM+1EP} with our proposed SB.}) outperforms the baseline (\enquote{CAM+SEAM}) on both training and validation sets. The improvement on the validation set is higher that on the training set, which demonstrates that our method generalises
well to unseen samples. We further prove that our performance improvement is not a result of additional training (an extra epoch of training). We train the baseline model with
one extra epoch of training and show its performance as \enquote{CAM+SEAM+1EP}. Although one extra epoch of training benefits the baseline model, the gap between \enquote{CAM+SEAM+1EP} and \enquote{Ours} further illustrates effectiveness of the proposed solution. The improvements are achieved without incurring additional computational cost during the inference where the smoothing branch is not involved.

\begin{table}[htb]\centering
\caption{Comparison of our method with the baseline.}
\ra{0.9}
\resizebox{\columnwidth}{!}{%
\begin{tabular}{p{5cm}p{2cm}p{2cm}}\toprule
\hfil \multirow{2}{*}{Method} & \multicolumn{2}{c}{mIoU(\%)} \\ \cmidrule{2-3}
& \hfil Train & \hfil Val \\ \midrule
CAM & \hfil 47.43 & \hfil 47.36\\
CAM + SEAM & \hfil 55.41 & \hfil 52.54 \\
CAM + SEAM + 1 EP & \hfil 55.69 & \hfil 53.06 \\
Ours & \hfil 57.32 & \hfil 55.24\\
\bottomrule
\end{tabular}
}
\label{Table: compare to baseline}
\end{table}

\noindent\textbf{Qualitative Analysis of CAM:} To verify the effectiveness of our proposed module and loss function, we compare the class activation maps of our method with that of the baseline in Fig \ref{fig: comparison to baseline}. As the baseline model does not include structural constraints, although its class activation maps are capable of localising the objects, they are prone to over-segmentation problem. As can be seen in the boat image, it wrongly associates some water and shore area to the boat class. Our method is able to alleviate this problem by enforcing a class score gradient at the semantic boundary so that class scores at pixels outside the object area are kept low. Another advantage of our method is that the class scores within the object area are more consistent. Our method produces larger high-score areas covering the majority of the object while that of our baseline model are more sparse.

\begin{figure}[htb]
\small
    \centering
    \includegraphics[width=\columnwidth]{Figures/comparison.png}
    \vspace*{-0.5cm}
    \caption{Visualisation of class activation maps of the baseline model and our model on the PASCAL VOC 2012 validation set. (a) Original image; (b) Segmentation ground truth; (c) Baseline \cite{wang2020self}; (d) Ours. (Red represents high scores while blue represents low scores.)}
    \label{fig: comparison to baseline}
\end{figure}

\noindent\textbf{Quantitative Analysis of the Performance after Random Walk:} We employ
AffinityNet \cite{ahn2018learning} to learn an affinity matrix in order to perform a random walk on our produced class activation maps. As AffinityNet only utilises the pixels with high class activation scores while disregarding the low-score pixels, it is important to have class activation maps obtain consistently high class activation scores within the object area and reduce the over-segmentation on irrelevant pixels. Tab \ref{Table: compare to baseline after affinitynet} demonstrates the effectiveness of our method on the downstream random walk processing, which indicates a further 3\% performance improvement on the validation set.

\begin{table}[htb!]\centering
\caption{Comparison of the segmentation maps obtained by using AffinityNet to perform a random walk on our predicted class activation maps.}
\ra{0.9}
\resizebox{0.8\columnwidth}{!}{%
\begin{tabular}{p{4cm}p{2cm}@{}p{2cm}@{}}\toprule
\hfil \multirow{2}{*}{Method} & \multicolumn{2}{c}{mIoU(\%)} \\ \cmidrule{2-3}
& \hfil Train & \hfil Val \\ \midrule
\hfil Baseline & \hfil 63.61 & \hfil 60.08 \\
\hfil Ours & \hfil 65.31 & \hfil 63.01\\
\bottomrule
\end{tabular}
}
\label{Table: compare to baseline after affinitynet}
\end{table}

\begin{table*}[htb]\centering
\caption{Class-wise performance comparison between the pseudo ground truth of our method and our baseline on the PASCAL VOC 2012 validation set using the mIoU evaluation metric.}
\Large
\ra{0.9}
\resizebox{2\columnwidth}{!}{%
\begin{tabular}{p{3cm}p{1cm}p{1cm}p{1cm}p{1cm}p{1cm}p{1.5cm}p{1cm}p{1cm}p{1cm}p{1.2cm}p{1cm}p{1cm}p{1cm}p{1.2cm}p{1cm}p{1.5cm}p{1.2cm}p{1.2cm}p{1cm}p{1cm}p{1cm}@{}p{1.5cm}@{}}\toprule
Model & \hfil bkg & \hfil aero & \hfil bike & \hfil bird & \hfil boat & \hfil bottle & \hfil bus & \hfil car & \hfil cat & \hfil chair & \hfil cow & \hfil table & \hfil dog & \hfil horse & \hfil mbk & \hfil person & \hfil plant & \hfil sheep & \hfil sofa & \hfil train & \hfil tv & \hfil mIoU\\ \midrule

Baseline \cite{wang2020self} & \hfil 85.3 & \hfil 60.2 & \hfil 30.5 & \hfil 70.2 & \hfil 34.6 & \hfil 56.3 & \hfil 70.1 & \hfil 68.0 & \hfil 76.4 & \hfil 27.6 & \hfil \textbf{71.9} & \hfil \textbf{50.5} & \hfil \textbf{78.2} & \hfil 73.8 & \hfil 69.3 & \hfil 71.9 & \hfil 32.8 & \hfil 71.2 & \hfil 55.8 & \hfil 59.8 & \hfil 47.2 & \hfil 60.1\\

\textbf{Ours} & \hfil \textbf{87.9} & \hfil \textbf{68.5} & \hfil \textbf{32.2} & \hfil \textbf{73.6} & \hfil \textbf{48.3} & \hfil \textbf{59.4} & \hfil \textbf{75.0} & \hfil \textbf{75.2} & \hfil \textbf{77.0} & \hfil \textbf{29.4} & \hfil 64.5 & \hfil 44.6 & \hfil 76.8 & \hfil \textbf{74.3} & \hfil \textbf{70.0} & \hfil \textbf{72.9} & \hfil \textbf{45.1} & \hfil \textbf{79.7} & \hfil \textbf{56.5} & \hfil \textbf{61.0} & \hfil \textbf{51.7} & \hfil \textbf{63.0}\\
\bottomrule
\end{tabular}}
\label{Table: 20class after AffinityNet}
\end{table*}

We further compare class-wise performance after the random walk in Tab \ref{Table: 20class after AffinityNet}. It shows that our method achieves consistently higher performance except on \textit{cow}, \textit{diningtable} and \textit{dog} classes. There are two main causes: (1) The initial localisation of the \textit{diningtable} class focuses primarily on the tableware rather than on the diningtable itself. Our smoothness loss cannot spread the high scores to cover the table object as shown in the first row of Fig \ref{fig: failures}; (2) \textit{Cow} and \textit{dog} classes sometimes have a single source of high-score area in the initial localisation. Its attention is placed solely on the eye and nose for the \textit{cow} and \textit{dog} class respectively. Our smoothness loss tends to find a trivial solution by creating a score contrast around these small high-score areas, leading to under-segmentation in this case. This is illustrated in the second and the third rows of Fig \ref{fig: failures}.

\begin{figure}[htb]
\small
    \centering
    \includegraphics[width=\columnwidth]{Figures/failures.png}
    \vspace*{-0.5cm}
    \caption{Visualisation of failed classes on the PASCAL VOC 2012 validation set. (a) Original image; (b) Segmentation ground truth; (c) Baseline \cite{wang2020self}; (d) Ours. (Red represents high scores while blue represents low scores.)}
    \label{fig: failures}
\end{figure}

\begin{figure}[htb]
    \centering
    \includegraphics[width=\columnwidth]{Figures/size.pdf}
    \vspace*{-0.5cm}
    \caption{Relationship between the mIoU and IOP for each class in the PASCAL VOC 2012 dataset.)}
    \label{fig: size}
\end{figure}

\begin{table}[h!]\centering
\caption{Ablation: components analysis of our framework.}
\large
\ra{0.9}
\resizebox{0.8\columnwidth}{!}{%
\begin{tabular}{p{2cm}p{1.5cm}p{2.5cm}p{2cm}@{}p{2cm}@{}}\toprule
\hfil \multirow{2}{*}{baseline} & \hfil \multirow{2}{*}{SBDM} & \hfil \multirow{2}{*}{Smoothness} & \multicolumn{2}{c}{mIoU(\%)} \\ \cmidrule{4-5}
& & & \hfil Train & \hfil Val \\ \midrule
\hfil \checkmark & & & \hfil 55.41 & \hfil 52.54 \\
\hfil \checkmark & \hfil \checkmark & & \hfil 55.87 & \hfil 53.35 \\
\hfil \checkmark & \hfil \checkmark & \hfil \checkmark & \hfil 57.32 & \hfil 55.24 \\
\bottomrule
\end{tabular}
}
\label{Table: ablation study}
\end{table}

\noindent\textbf{Accuracy vs Image Occupancy Percentage (IOP)} We have noticed that the mismatch between the class-wise IOP for ImageNet and PASCAL VOC 2012 results in reduced segmentation accuracy for classes that are too large or too small. IOPs of the 20 classes of PASCAL VOC 2012 dataset are between 5\% and 35\% as shown in Fig.~\ref{fig: size} while those in ImageNet are around 25\%. As a result, the group of classes with around 20\% IOP have the highest mIoU accuracy. Among this group, \textit{Diningtable} and \textit{Sofa} classes have lower mIoU because they are generally associated with heavy occlusion and potentially inaccurate initial localisation as manifested in Fig \ref{fig: failures}. Besides, the \textit{furniture} related images account for only 1.4\% of the total images in the ImageNet dataset, which is a much smaller proportion than those of other classes. \textit{Cat}, \textit{Car} and \textit{Bus} classes have around 30\% IOP. They usually have the under-segmentation problem, resulting in lower mIoU accuracy. The classes with IOP smaller than 11\% have the lowest segmentation accuracy. The mismatch on the IOP between two datasets leads to over-segmentation, which is detrimental to small class objects using mIoU evaluation metrics. The \textit{bird} class achieves accurate segmentation results despite its small IOP. This can be attributed to the fact that ImageNet has abundant images of different kinds of birds. In total, the birds images account for around 5.7\% of total images in ImageNet.\\

\subsection{Ablation Study} \label{Ablation study section}
The improvements in performance can be attributed to the structural constraints imposed by our proposed module and loss function. Table \ref{Table: ablation study} shows an ablation study of our SBDM and the semantic boundary guided smoothness loss function. Through the SBDM, the feature maps from multiple levels of the encoder become structure-aware, which indirectly enhances the quality of the final score map by passing structural information. The major improvements come from the semantic boundary-guided smoothness loss function. It creates a sharp contrast of class activation scores around the semantic boundary while enforcing more consistent high scores within the area enclosed by the semantic boundary.

\noindent\textbf{Semantic Boundary Detection Module:} Our SBDM uses both feature maps $F_{i}(i = 1, 3, 5, 6)$ and Canny edges to predict the semantic boundary. SDRG \cite{huang2018weakly} has also used boundary information to impose structural constraints, however, they only use it to separate the foreground and background pixels. We demonstrate that making feature maps structure-aware is beneficial to predicting class activation maps. Tab.~\ref{Table: SBDM} shows that SBDM requires both high-level features and low-level features to determine the boundary semantically and spatially. The Canny edge is demonstrated to provide extra spatial cues for the bottom-up estimation of the semantic boundary, leading to improved performance.

\begin{table}[h!]\centering
\caption{Ablation: components analysis of the semantic boundary detection module.}
\large
\ra{0.9}
\resizebox{0.8\columnwidth}{!}{%
\begin{tabular}{p{1.5cm}p{1cm}p{1cm}p{1cm}p{1cm}p{2cm}@{}p{2cm}@{}}\toprule
\hfil \multirow{2}{*}{Canny} & \hfil \multirow{2}{*}{$F_{1}$} & \hfil \multirow{2}{*}{$F_{3}$} & \hfil \multirow{2}{*}{$F_{5}$} & \hfil \multirow{2}{*}{$F_{6}$} & \multicolumn{2}{c}{mIoU(\%)} \\ \cmidrule{6-7}
& & & & & \hfil Train & \hfil Val \\ \midrule
& & & & & \hfil 55.41 & \hfil 52.54 \\
 & & & \hfil \checkmark & \hfil \checkmark &  \hfil 55.17 & \hfil 52.57 \\
 & \hfil \checkmark & \hfil \checkmark & & & \hfil 55.05 & \hfil 52.46 \\
 & \hfil \checkmark & \hfil \checkmark & \hfil \checkmark & \hfil \checkmark & \hfil 55.78 & \hfil 53.31 \\
\hfil \checkmark & \hfil \checkmark & \hfil \checkmark & \hfil \checkmark & \hfil \checkmark & \hfil 55.87 & \hfil 53.35 \\
\bottomrule
\end{tabular}
}
\label{Table: SBDM}
\end{table}

\noindent\textbf{Semantic Boundary-Guided Smoothness Loss:}
The semantic boundary is essential for the smoothness loss to be used in WSSS with only image labels. As unwanted noisy edges are not present within the semantic boundary, it can enlarge the high-score area while alleviating
over-segmentation. Tab.~\ref{Table: smoothness factor} demonstrates that the factor $\lambda_{2}$ assigned to the smoothness loss has a big impact on its performance. When the factor is too low, the smoothness loss fails to spread to high scores to surrounding pixels. On the contrary, when
the factor is
too high, it searches for a trivial solution by reducing all scores to minimal values, resulting in highly deteriorated results.

\begin{table}[h!]\centering
\caption{Analysis of the contribution of semantic boundary-guided smoothness loss to our performance.}
\ra{0.9}
\resizebox{0.8\columnwidth}{!}{%
\begin{tabular}{p{3cm}p{2cm}@{}p{2cm}@{}}\toprule
\hfil \multirow{2}{*}{$\lambda_{2}$} & \multicolumn{2}{c}{mIoU(\%)} \\ \cmidrule{2-3}
& \hfil Train & \hfil Val \\ \midrule
\hfil 0.5 & \hfil 56.75 & \hfil 54.48 \\
\hfil 0.75 & \hfil 57.25 & \hfil 54.99\\
\hfil 1.0 & \hfil 57.32 & \hfil 55.24 \\
\hfil 1.25 & \hfil 57.25 & \hfil 55.22\\
\hfil 1.5 & \hfil 56.40 & \hfil 54.52 \\
\hfil 2.0 & \hfil 34.98 & \hfil 33.36\\
\bottomrule
\end{tabular}
}
\label{Table: smoothness factor}
\end{table}

\subsection{Comparison with WSSS state-of-the-art}
Tab.~\ref{Table: deeplab with image-level labels} illustrates the results of previous WSSS methods with only image-level labels and ours and Tab.~\ref{Table: 20class} provides more detailed comparison on class-wise performance. Our method improves upon our baseline model on both validation and test sets. Furthermore, when no additional supervision is
used either implicitly or explicitly, our method achieves the state-of-the-art results on the PASCAL VOC 2012 test set. As WSSS with image-level labels does not explicitly predict the background class, many methods separate
foreground pixels from
background ones by leveraging an external saliency detector, which implicitly uses saliency ground truth as additional supervision
which includes object segmentation boundary information. Tab.~\ref{Table: deeplab with image-level labels and external saliency detector} shows previous WSSS methods equipped with an external saliency detector. It can be seen that our method can still outperform most of them without implicitly using the saliency ground truth except the ICD method \cite{fan2020learning}. We also visualise some qualitative results of our semantic segmentation model in Fig.~\ref{fig: deeplan visualisation}, which demonstrates its ability to segment objects belonging to different classes.

\begin{table}[htb!]\centering
\caption{Performance comparison of our method with previous WSSS state-of-the-art with only image-level labels on PASCAL VOC 2012 using the mIoU evaluation metric.}
\ra{0.9}
\resizebox{0.9\columnwidth}{!}{%
\begin{tabular}{p{3cm}p{2cm}p{1.5cm}@{}p{1.5cm}@{}}\toprule
\hfil \multirow{2}{*}{Methods} & \hfil \multirow{2}{*}{Backbone} & \multicolumn{2}{c}{mIoU(\%)} \\ \cmidrule{3-4}
& & \hfil Val & \hfil Test \\ \midrule
CCNN \cite{pathak2015constrained} & \hfil VGG16 & \hfil 35.3 & \hfil 35.6 \\
EM-Adapt \cite{papandreou2015weakly} & \hfil VGG16 & \hfil 38.2 & \hfil 39.6 \\
MIL \cite{pinheiro2015image} & \hfil VGG16 & \hfil 42.0 & \hfil 43.2 \\
SEC \cite{kolesnikov2016seed} & \hfil VGG16 & \hfil 50.7 & \hfil 51.1 \\
AugFeed \cite{qi2016augmented} & \hfil VGG16 & \hfil 54.3 & \hfil 55.5 \\
AdvErasing \cite{wei2017object} & \hfil VGG16 & \hfil 55.0 & \hfil 55.7 \\
AffinityNet \cite{ahn2018learning} & \hfil ResNet38 & \hfil 61.7 & \hfil 63.7 \\
SSNet \cite{araslanov2020single} & \hfil ResNet38 & \hfil 62.7 & \hfil 64.3 \\
ICD \cite{fan2020learning} & \hfil ResNet101 & \hfil 64.1 & \hfil 64.3\\
IRNet \cite{ahn2019weakly} & \hfil ResNet50 & \hfil 63.5 & \hfil 64.8 \\
SSENet \cite{wang2019self} & \hfil ResNet38 & \hfil 63.3 & \hfil 64.9 \\
SEAM \cite{wang2020self} & \hfil ResNet38 & \hfil 64.5 & \hfil 65.7\\
SC-CAM \cite{chang2020weakly} & \hfil ResNet101 & \hfil 66.1 & \hfil 65.9\\\midrule
\textbf{Ours} & \hfil ResNet101 & \hfil \textbf{66.5} & \hfil \textbf{66.7}\\
\bottomrule
\end{tabular}
}
\label{Table: deeplab with image-level labels}
\end{table}

\begin{table}[htb!]\centering
\caption{Results of previous WSSS state-of-the-art methods with image-level labels and external saliency detector on PASCAL VOC 2012 using the mIoU evaluation metric.}
\ra{0.9}
\resizebox{0.9\columnwidth}{!}{%
\begin{tabular}{p{3cm}p{2cm}p{1.5cm}@{}p{1.5cm}@{}}\toprule
\hfil \multirow{2}{*}{Methods} & \hfil \multirow{2}{*}{Backbone} & \multicolumn{2}{c}{mIoU(\%)} \\ \cmidrule{3-4}
& & \hfil Val & \hfil Test \\ \midrule
STC \cite{wei2016stc} & \hfil VGG16 & \hfil 49.8 & \hfil 51.2 \\
MDC \cite{wei2018revisiting} & \hfil VGG16 & \hfil 60.4 & \hfil 60.8 \\
MCOF \cite{wang2018weakly} & \hfil ResNet101 & \hfil 60.3 & \hfil 61.2\\
DCSP \cite{chaudhry2017discovering} & \hfil ResNet101 & \hfil 60.8 & \hfil 61.9\\
SeeNet \cite{hou2018self} & \hfil ResNet101 & \hfil 63.1 & \hfil 62.8 \\
DSRG \cite{huang2018weakly} & \hfil ResNet101 & \hfil 61.4 & \hfil 63.7 \\
FickleNet \cite{lee2019ficklenet} & \hfil ResNet101 & \hfil 64.9 & \hfil 65.3 \\
OAA \cite{jiang2019integral} & \hfil ResNet101 & \hfil 65.2 & \hfil 66.4\\
ICD \cite{fan2020learning} & \hfil ResNet101 & \hfil 67.8 & \hfil 68.0\\
\bottomrule
\end{tabular}
}
\label{Table: deeplab with image-level labels and external saliency detector}
\end{table}

\section{Conclusion} In this paper, we propose a Smoothing Branch (SB) to impose structural constraints in the training of WSSS models with image-level labels. The SB leverages the derived semantic boundary to make the feature maps structure-aware, which subsequently improves the generated class activation maps. The semantic boundary also guides the smoothness loss function to make the scores more consistent within the enclosed object area and reduce the scores at outside pixels. Comprehensive experiments are conducted to study the components of our proposed method. The generated class activation maps are thus capable of better preserving the object structure. The semantic segmentation network trained with our segmentation maps as pseudo ground truth achieves state-of-the-art performance on the PASCAL VOC 2012 dataset, demonstrating the superior performance of our method.

\begin{table*}[htb!]\centering
\caption{Class-wise performance comparison of our method with previous WSSS state-of-the-art methods on the PASCAL VOC 2012 validation set using the mIoU evaluation metric.}
\Large
\ra{0.9}
\resizebox{2\columnwidth}{!}{%
\begin{tabular}{p{3.5cm}p{1cm}p{1cm}p{1cm}p{1cm}p{1cm}p{1.5cm}p{1cm}p{1cm}p{1cm}p{1.2cm}p{1cm}p{1cm}p{1cm}p{1.2cm}p{1cm}p{1.5cm}p{1.2cm}p{1.2cm}p{1cm}p{1cm}p{1cm}@{}p{1.5cm}@{}}\toprule
Model & \hfil bkg & \hfil aero & \hfil bike & \hfil bird & \hfil boat & \hfil bottle & \hfil bus & \hfil car & \hfil cat & \hfil chair & \hfil cow & \hfil table & \hfil dog & \hfil horse & \hfil mbk & \hfil person & \hfil plant & \hfil sheep & \hfil sofa & \hfil train & \hfil tv & \hfil mIoU\\ \midrule

CCNN \cite{pathak2015constrained} & \hfil 68.5 & \hfil 25.5 & \hfil 18.0 & \hfil 25.4 & \hfil 20.2 & \hfil 36.3 & \hfil 46.8 & \hfil 47.1 & \hfil 48.0 & \hfil 15.8 & \hfil 37.9 & \hfil 21.0 & \hfil 44.5 & \hfil 34.5 & \hfil 46.2 & \hfil 40.7 & \hfil 30.4 & \hfil 36.3 & \hfil 22.2 & \hfil 38.8 & \hfil 36.9 & \hfil 35.3\\

MIL \cite{pinheiro2015image} & \hfil 79.6 & \hfil 50.2 & \hfil 21.6 & \hfil 40.9 & \hfil 34.9 & \hfil 40.5 & \hfil 45.9 & \hfil 51.5 & \hfil 60.6 & \hfil 12.6 & \hfil 51.2 & \hfil 11.6 & \hfil 56.8 & \hfil 52.9 & \hfil 44.8 & \hfil 42.7 & \hfil 31.2 & \hfil 55.4 & \hfil 21.5 & \hfil 38.8 & \hfil 36.9 & \hfil 42.0\\

SEC \cite{kolesnikov2016seed} & \hfil 82.4 & \hfil 62.9 & \hfil 26.4 & \hfil 61.6 & \hfil 27.6 & \hfil 38.1 & \hfil 66.6 & \hfil 62.7 & \hfil 75.2 & \hfil 22.1 & \hfil 53.5 & \hfil 28.3 & \hfil 65.8 & \hfil 57.8 & \hfil 62.3 & \hfil 52.5 & \hfil 32.5 & \hfil 62.6 & \hfil 32.1 & \hfil 45.4 & \hfil 45.3 & \hfil 50.7\\

AdvErasing \cite{wei2017object} & \hfil 83.4 & \hfil 71.1 & \hfil 30.5 & \hfil 72.9 & \hfil 41.6 & \hfil 55.9 & \hfil 63.1 & \hfil 60.2 & \hfil 74.0 & \hfil 18.0 & \hfil 66.5 & \hfil 32.4 & \hfil 71.7 & \hfil 62.0 & \hfil 64.8 & \hfil 52.4 & \hfil 37.4 & \hfil 69.1 & \hfil 31.4 & \hfil 58.9 & \hfil 43.9 & \hfil 55.0\\

AffinityNet \cite{ahn2018learning} & \hfil 88.2 & \hfil 68.2 & \hfil 30.6 & \hfil 81.1 & \hfil 49.6 & \hfil 61.0 & \hfil 77.8 & \hfil 66.1 & \hfil 75.1 & \hfil 29.0 & \hfil 66.0 & \hfil 40.2 & \hfil 80.4 & \hfil 62.0 & \hfil 70.4 & \hfil 73.7 & \hfil 42.5 & \hfil 70.7 & \hfil 42.6 & \hfil 68.1 & \hfil 51.6 & \hfil 61.7\\

SEAM \cite{wang2020self} & \hfil 88.8 & \hfil 68.5 & \hfil \textbf{33.3} & \hfil \textbf{85.7} & \hfil 40.4 & \hfil \textbf{67.3} & \hfil 78.9 & \hfil 76.3 & \hfil 81.9 & \hfil 29.1 & \hfil \textbf{75.5} & \hfil \textbf{48.1} & \hfil \textbf{79.9} & \hfil 73.8 & \hfil 71.4 & \hfil 75.2 & \hfil \textbf{48.9} & \hfil 79.8 & \hfil \textbf{40.9} & \hfil 58.2 & \hfil 53.0 & \hfil 64.5\\

\midrule

Ours & \hfil \textbf{89.6} & \hfil \textbf{73.0} & \hfil 33.0 & \hfil 83.5 & \hfil \textbf{54.0} & \hfil67.6 & \hfil \textbf{84.1} & \hfil \textbf{80.7} & \hfil \textbf{84.4} & \hfil \textbf{30.3} & \hfil 75.3 & \hfil 43.7 & \hfil 78.0 & \hfil \textbf{79.7} & \hfil \textbf{74.1} & \hfil \textbf{75.8} & \hfil 46.6 & \hfil \textbf{84.3} & \hfil 37.0 & \hfil \textbf{61.4} & \hfil \textbf{58.5} & \hfil \textbf{66.5}\\

\bottomrule
\end{tabular}
}
\label{Table: 20class}
\end{table*}

\begin{figure*}[htb!]
    \centering
    \includegraphics[width=1.95\columnwidth]{Figures/deeplab_visualisation.png}
    \vspace*{-0cm}
    \caption{Visualisation of semantic segmentation results on the PASCAL VOC 2012 validation set. (a) Original image; (b) Segmentation ground truth; (c) Ours.}
    \label{fig: deeplan visualisation}
\end{figure*}

\printbibliography

\end{document}


\section{Introduction}

Fake audio detection has attracted increasing attention since the organization of a series of automatic speaker verification spoofing and countermeasures challenge (ASVspoof) \cite{todisco2019asvspoof,kinnunen2017asvspoof,wu2015asvspoof}.
Plenty of approaches are proposed to alleviate the threat of voice spoofing attacks. The studies on fake audio detection are usually carried out from two aspects. The first is robust acoustic features based on signal processing methods \cite{patel2015combining, todisco2016new, das2020assessing}. The second is effective classifiers based on neural networks \cite{lavrentyeva2017audio, Lavrentyeva2019, lei2020siamese, von2020multi}.
Despite the impressive results that these methods have achieved, we can find that the performance of these models degrades when unseen spoofing attacks occur. For example, in term of the median equal error rate (EER) of the top-10 performing submitted systems in ASVspoof2019 challenge, the median EER under seen attack A16 is $0.02\%$ while it goes dramatically up to $15.93\%$ under unseen attack A17 \cite{todisco2019asvspoof}. This phenomenon reveals the weakness of current countermeasures and urges people to look for ways to improve model's the performance on unseen attacks.

Some studies pay attention to fake audio detection on unseen datasets. Monteiro et al. \cite{monteiro2020ensemble} proposed a model ensemble approach to train three models jointly, which outperforms the model trained with mixed data directly. Wang et al. \cite{wang2020dual} proposed a dual-adversarial domain adaptation framework to solve out-of-domain dataset problem.
However, these methods require both original and new data. With the growth of voice conversion and speech synthesis technologies as well as the emergence of advanced reply devices, new spoofing attacks keep emerging rapidly. It's storage-consuming to do model ensemble and time-consuming to train model with mixed data involving all the data sources. Besides, for the consideration of privacy, the access to old data may not be allowed in some special cases. Although fine-tuning the trained model is another way to improve the performance on unseen spoofing attack \cite{wang2020dual}, it will lead to a decrease on the previous spoofing knowledge.
Therefore, it's necessary to make our detection model have the ability to continually learn new knowledge over time meanwhile maintain the previously learned knowledge.

\begin{figure}[t]
\vspace{-10pt}
\centering
\includegraphics[width=0.7\linewidth]{./Figure/ewc.pdf}
\vspace{-5pt}
\caption{Difference between continual learning methods and fine-tuning.
Blue and yellow region is the parameter configuration region of source and target models correspondingly. If using the fine-tuning strategy (solid arrow), the results of parameter optimization will easily fall into the region deviation from the source, while continual learning methods (dotted arrow) can learn the parameters in the overlapping region.}
\label{ewc}
\vspace{-5pt}
\end{figure}

Continual learning becomes a hot issue in recent years \cite{kirkpatrick2017overcoming,rebuffi2017icarl,van2020brain} and has been applied in the field of computer vision \cite{castro2018end, lee2020residual} and speech recognition \cite{sadhu2020continual, houston2020continual} already. It aims to overcome the catastrophic forgetting problem existing in fine-tuning, i.e., the model forgets previously learned information after trained on new information. The difference between continual learning and fine-tuning is elaborated in Figure \ref{ewc}.

In this work, we propose a continual learning method, named detecting fake without forgetting (DFWF), to learn new spoofing attacks incrementally. It is inspired by learning without forgetting (LwF) but takes the characteristics of fake audio detection into account. When model is trained with new unseen data, genuine speech is more consistent in different scenarios while spoofing speech varies widely. Thus, we add an extra positive sample alignment (PSA) constraint on genuine speech.
DFWF can help model mitigate the forgetting of past knowledge meanwhile focus more on the invariance of genuine speech.
Our proposed method is investigated on several sequential training tasks across different spoofing types on ASVspoof2019 dataset. The results show that DFWF approach can reduce the forgetting of past knowledge and its performance is much better than fine-tuning.
To our best knowledge, this is the first study to apply continual learning to the fake audio detection task to solve the problem that current models have difficulties in distinguishing unseen spoofing audio.

The rest of this paper is organized as follows: Section 2 illustrates our proposed method DFWF from its two components: LwF and PSA. Experiments, results and discussions are reported in Section 3, 4 and 5, respectively. Finally, the paper is concluded in Section 6.

\section{Proposed methods}
\subsection{Proposed detecting fake without forgetting}

Usually, there are three major approaches for continual learning: (1) Regularization approaches \cite{li2017learning, kirkpatrick2017overcoming} add hand-craft regularization term in loss function to constrain the learning process. (2) Replay approaches \cite{rebuffi2017icarl,shin2017continual} record some examples in the buffer and replay experience when training new task. (3) Dynamic architecture approaches \cite{rusu2016progressive, parisi2017lifelong} dynamically change the structure of neural networks according to the new task. We focus on regularization approaches in the study.

Since retraining with mixed data costs a lot of time and fine-tuning leads to catastrophic forgetting, we propose DFWF method to make a trade off between time resource and performance.
It doesn't store old data but can ensure the previous information is remembered.
When training, two constrains named learning without forgetting (LwF) and positive sample alignment (PSA) are added to the original loss $\mathcal{L}_{original}$. Thus, the total loss ${\mathcal{L}_{total}}$ becomes:
\vspace{-2pt}
\begin{equation}
    {\mathcal{L}_{total}} =  \mathcal{L}_{original} + \alpha {\mathcal{L}_{LwF}} + \beta {\mathcal{L}_{PSA}}
  \label{totalloss}
\end{equation}
where $\alpha$ and $\beta$ are hyper-parameters to control the importance of respective terms.
Usually, cross entropy loss is used as $\mathcal{L}_{original}$ to train the model. The details of LwF loss ${\mathcal{L}_{LwF}}$ and PSA loss ${\mathcal{L}_{PSA}}$ are explained in the following subsections.

\subsection{Learning without forgetting}

LwF\cite{li2017learning} is introduced to DFWF method. When training new task, LwF uses knowledge distillation loss to make the output probabilities of new data on current network close to the output probabilities of the same data on original network. Thus, it can also be seen as an extension of student-teacher knowledge distillation model \cite{hinton2015distilling} which is widely adopted in speech recognition \cite{chebotar2016distilling, shi2019knowledge}. LwF is achieved by including an additional knowledge distillation loss $\mathcal{L}_{LwF}$:

\vspace{-5pt}
\begin{equation}
  \mathcal{L}_{{\rm{LwF}}} = - \sum\limits_{i = 1}^n {{y'}_{old}^{(i)}}\log {{{y'}_{new}^{(i)}}}
\end{equation}
where $n$ is the number of labels. The label includes genuine and fake in this case. $i$ means the i-th class. ${y'}_{old}^{(i)}$ and ${y'}_{new}^{(i)}$ are modified probabilities of original model's output ${y}_{old}^{(i)}$ and current model's output ${y}_{new}^{(i)}$. Specifically, they are calculated as follows:
\vspace{-5pt}
\begin{equation}
    {y'}_{old}^{(i)} = \frac{{{{(y_{old}^{(i)})}^{1/T}}}}{{\sum\nolimits_j {{{(y_{old}^{(j)})}^{1/T}}} }},
    \qquad
    {y'}_{new}^{(i)} = \frac{{{{( y_{new}^{(i)})}^{1/T}}}}{{\sum\nolimits_j {{{( y_{new}^{(j)})}^{1/T}}} }}
  \label{LwF2}
\end{equation}
where $T$ is a hyper-parameter. Setting $T > 1$ increases the weight of smaller values in logits and encourage the network to produce a relative similar contributions between the old and the new data\cite{hinton2015distilling}.

\subsection{Positive sample alignment}
In the ``genuine or fake" classification task, the feature distribution of genuine speech is more consistent compared with the feature distribution of various types of fake audio. In a new spoofing scenario, there exists a gap between previous spoofing data and new spoofing data. But the feature of genuine speech in different situations tend to be similar. When meeting new data, the model should focus more on the genuine samples to succeed more knowledge of the original model for genuine samples. Considering this characteristic of fake audio detection, PSA is proposed to constrain the feature distribution of genuine speech among different data resource.
Cosine distance is used to evaluate the similarity of positive (genuine) embeddings between the current model and the original model.
The proposed PSA loss ${\mathcal{L}_{PSA}}$ is denoted as:
\vspace{-5pt}
\begin{equation}
    {\mathcal{L}_{PSA}} = \frac{1}{{{N_P}}}\sum\limits_{k = 1}^{{N_P}} {\frac{{y_k^{+}\hat y_k^{+}}}{{\left\| {y_k^{+}} \right\| \cdot \left\| {\hat y_k^{+}} \right\|}}}
  \label{psa1}
\end{equation}
where ${N_P}$ is the number of genuine speech. ${y_k^{+}}$ and $\hat y_k^{+}$ are the embedding vectors (the outputs of the network after removing the last full connection layer) of the $k$-th genuine speech extracted by the original model and the current model, respectively. $\left\| \cdot \right\|$ means the norm of the vector. Thus, PSA loss equals to $\cos {\theta _{y_k^{+}\hat y_k^{+}}}$, the cosine distance of genuine speech embeddings between the previous and current model.

\section{Experiments}
\subsection{Dataset}
All experients are conducted on ASVspoof 2019 dataset \cite{wang2020asvspoof} which has two subset:  logical access (LA) and physical access (PA). The LA subset includes 19 types spoofing attacks made by voice conversion or speech synthesis. The PA subset contains 27 different acoustic and 9 different replay configurations. To further evaluate the performance of our proposed methods on a series of unseen spoofing attacks, we select four spoofing attacks with big difference in LA and PA subset separately. More specifically, in LA subset, type A13, A17, A10, A19 are chosen. Since only LA evaluation set contains these types, we further redivide them into training, development and evaluation sets. In PA subset, type bbbBB, cccCC, aaaAC, abcAA are chosen. Because all of these PA types occur in the training, development and evaluation sets, their partitioning scheme are according to their divisions in the PA subset. The detailed statistics of the datasets are presented in Table \ref{tab:dataset}.

\begin{table}[th]
\vspace{-5pt}
\setlength\tabcolsep{3.5pt}
  \caption{ Number of utterances in each section of the dataset}
  \vspace{-5pt}
  \label{tab:dataset}
  \centering
  \begin{tabular}{ cccc }
    \toprule
    \multirow{2}*{\textbf{Dataset}} & \multicolumn{3}{c}{\textbf{Number of utterances}} \\
    \cline{2-4}
    ~ & \textbf{Training} & \textbf{Development}  & \textbf{Evaluation}\\
    \midrule
    ASVspoof2019LA             & 25380 & 24986  & 71933    \\
    ASVspoof2019PA             & 54000  & 33534  & 153522   \\
    LA-A13                        &  2250  & 1250 & 1352     \\
    LA-A17                    & 2250 & 1250  &1321         \\
    LA-A10                 & 3414 & 1500 & 1500         \\
    LA-A19                   & 3414 & 1500 &1500         \\
    PA-bbbBB                    & 356  & 278     & 1078          \\
    PA-cccCC                    & 472  & 336     & 1380          \\
    PA-aaaAC                    & 604  & 402     & 1654          \\
    PA-abcAA                    & 352  & 276     & 916         \\
    \bottomrule
  \end{tabular}
\vspace{-10pt}
\end{table}

\subsection{Evaluation metrics}
The performance of our proposed methods is evaluated via equal error rate (EER) and average EER (AvgEER).
The lower the EER value, the higher the accuracy of the model. AvgEER is introduced when the model is evaluated in sequential trainings. It calculates the arithmetic mean of EER among all the spoofing types.
\vspace{-5pt}
\begin{equation}
    AvgEER = \frac{1}{n}\sum\limits_{i = 1}^n {{{EER}_i}}
  \label{avgeer}
\end{equation}
\vspace{-5pt}

where $n$ is the number of spoofing types in testing.${EER}_i$ is the EER of trained model tested on the $i$-th spoofing types.

\subsection{Experimental setup}
We extract 60-dimensional linear frequency cepstral coefficients (LFCC) \cite{sahidullah2015comparison} of speech as low-level input feature to the neural network. The extraction way is the same as the ASVspoof2019 offical baseline system \cite{wang2020asvspoof}. The window length is set to 25 ms. The number of FFT bins is set to 512. The number of filters is set to 20. To avoid the influence of short audio duration, we duplicate the short audio along time-axis up to 320 frames. If the audio is longer than that set length, we just randomly take a segment of the set length.

As for the network, we adopt light convolutional neural network (LCNN) which is the same architecture as Lavrentyeva et al. \cite{lavrentyeva2019stc} to generate 80-dimensional high-level embeddings. Then a fully connection layer projects the embeddings to a binary classification.

To evaluate the performance of DFWF, we compare it with two methods: fine-tuning and multi-condition (retraining) training. Fine-tuning refers to train a new model with new data by taking the weights of previous model as initialization. Multi-condition training refers to retrain the model by incorporating new date with old data.
It's worth noting that the EER of multi-condition training is considered to be the lower bound to our continual-learning-based method DFWF \cite{parisi2019continual}.
In addition, we did an ablation study to illustrate the relative contribution of LwF and PSA to the final performance of DFWF. In order to cover comprehensive cases of sequential unseen spoofing attacks, we designed the following 4 types of sequential training settings:

\begin{enumerate}
\item $PA \rightarrow LA$ : This setting is to evaluate the performance of DFWF method across the spoofing types with obvious gap.
\item $LA \rightarrow PA$: This setting is the contrast to $PA \rightarrow LA$ to evaluate the influnence of transfer order.
\item $A13\rightarrow A17\rightarrow A10\rightarrow A19$: This setting is to evaluate the performance of DFWF method across the spoofing types with relatively subtle difference. These are all LA attacks. In the order $A13\rightarrow A17\rightarrow A10\rightarrow A19$, we train the new model with new spoofing data on the basis of the model trained at the last step.
\item $bbbBB\rightarrow cccCC\rightarrow aaaAC \rightarrow abcAA$: This setting is to evaluate the performance of DFWF method across different PA attacks.
\end{enumerate}

We name the model trained at the first step as base model. Then, new model is trained with different method in the following steps. At each step, the model is trained for 100 epochs by Adam optimiser with the learning rate 0.0001. For DFWF method, hyper-parameter $T$ is experimentally set to 2. We set weighting coefficients $\alpha$ and $\beta$ ranging from $0.0$ to $2.0$ to explore the optimal parameter for each corresponding task.

\section{Results and Analysis}

\subsection{Catastrophic forgetting in fake audio detection}

We do several experiments to fine-tune the model with unseen spoofing attacks and find that there exists catastrophic forgetting phenomena. Considering the result of ``$LA \rightarrow PA$" experiment shown in the first two row of Table \ref{tab:lapa}, the EER of base model increases significantly when tested on PA. After fine-tuning on PA, the fine-tuned model can perform well on PA, but its EER under LA subset increases sharply from $4.42\%$ to $19.78\%$. This is because of the distribution mismatch between LA attacks and PA attacks. When fine-tuned with new data, the model will easily deviate from the previous optimal parameters, resulting in performance decrease on old data.
Thus, it's necessary to apply our continual learning method DFWF to unseen spoofing data scenario. Fine-tuning is used as the baseline of the following experiments.

\subsection{The effectiveness of our proposed DFWD}

We compare our proposed DFWF method with fine-tuning and multi-condition training in 4 sequential training experiments.

\begin{table}[t]
\vspace{-5pt}
\setlength\tabcolsep{3pt}
  \caption{Performance comparison: results show the of EER\% on different models for training sequence ``$LA \rightarrow PA$" and ``$PA \rightarrow LA$". Base model is trained on one dataset with random initialization. Fine-tuning (FT) model and DFWF model are trained on the other dataset on the basis of base model. Multi-condition (MC) training model is trained on the mixture of LA and PA subsets.}
  \vspace{-5pt}
  \label{tab:lapa}
  \centering
  \begin{tabular}{ cccccccc }
    \toprule
    \multirow{2}*{Model} & \multicolumn{3}{c}{{$LA \rightarrow PA$}} & \multicolumn{3}{c}{{$PA \rightarrow LA$}} \\
    \cmidrule(r){2-4}  \cmidrule(r){5-7}
    ~ & LA & PA & Avg & PA & LA & Avg \\
    \midrule
    Base     & 4.42 &  28.02  & 16.22
                        & 5.47 & 22.31 & 13.89\\
    FT  & 19.78 &  6.74 & 13.26
                         & 21.22  & 4.61 & 12.92\\
    DFWF (Ours)    & 7.74  &  10.76 & 9.25
                        & 8.85	& 12.05 &  10.45 \\
    MC     &  5.92 &  6.29 & 6.11
                                & 6.29  & 5.92  &6.11\\
    \bottomrule
  \end{tabular}
\end{table}

\begin{figure}[t]

  \centering
  \subfigure[LA attacks]{
    \label{Fig.la4}
    \includegraphics[width=0.45\linewidth]{./Figure/4typesLA.pdf}}
    \subfigure[PA attacks]{
    \label{Fig.pa4}
    \includegraphics[width=0.45\linewidth]{./Figure/4typesPA.pdf}}
  \caption{Performance comparison under incremental increase of spoofing types: results show the AvgEER\% over the sequential training of LA attacks ($A13\rightarrow A17\rightarrow A10\rightarrow A19$) and PA attacks ($bbbBB\rightarrow cccCC\rightarrow aaaAC \rightarrow abcAA$). FT means fine-tuning model. MC means multi-condition training model. AvgEER when the number of attacks equals to $i$ means the average performance on current and previous data at the $i$-th training step. }
  \label{fig:4types}
\vspace{-5pt}
\end{figure}

Table \ref{tab:lapa} illustrates the result of sequential training between LA and PA attacks. The AvgEER of DFWF achieves a relative reduction of $30.29\%$ in ``$LA \rightarrow PA$" task, and a relative reduction of $19.08\%$ in ``$PA \rightarrow LA$" task compared to fine-tuning baseline.
As this baseline does not consider the previous data in its training procedure, it has the advantage of achieving better performance on current data but damages the performance on old data.
Besides, the transfer order can influence the performance of DFWF method. The AvgEER of ``$LA \rightarrow PA$" task is better than ``$LA \rightarrow PA$" task. It can be explained by the distribution of LA attacks and PA attacks provided by the publisher of ASVspoof2019 dataset \cite{wang2020asvspoof}, different LA attacks can form relatively clear clustering while different PA attacks are completely overlapping. The model trained on LA subset can been seen as a better pre-trained model, providing a set of well-performed model parameters.

The advantage of DFWF is more pronounced in the scenarios where unseen spoofing attacks occur gradually .
Figure \ref{fig:4types} shows the results in sequential trainings of LA and PA attacks, respectively. In sequential training``$A13\rightarrow A17\rightarrow A10\rightarrow A19$", the performance of fine-tuned model becomes worse as the number of spoofing types increases. When the types increase to 4, the AvgEER of fine-tuned model goes dramatically from $0.81\%$ to $43.72\%$, while the AvgEER of DFWF model remains to $8.03\%$. That is to say, DFWF achieves a relative reduction of $81.63\%$ compared to fine-tuning in this task. In the sequential training ``$bbbBB\rightarrow cccCC\rightarrow aaaAC \rightarrow abcAA$" , DFWF model achieves a AvgEER of $6.90\%$ fairly close to the multi-condition training model ($5.67\%$) at the last step. Besides, we see a obvious fluctuation in the trend of AvgEER with fine-tuning strategy. This can be explained by the existence of similarity among different spoofing types. If the feature new spoofing is similar to some of the previous spoofing types, training with current data can help to maintain some of the previous knowledge.

\subsection{Ablation Study}
\begin{table}[t]
 \vspace{-10pt}
\setlength\tabcolsep{5.5pt}
  \caption{Comparison of AvgEER\% in different combinations of LwF and PSA in 4 sequential trainings. T1 is the training ``LA $\rightarrow$ PA". T2 is the training ``PA $\rightarrow$ LA". T3 is the training `` $A13\rightarrow A17\rightarrow A10\rightarrow A19$". T4 is the training ``$bbbBB\rightarrow cccCC\rightarrow aaaAC \rightarrow abcAA$". }
  \vspace{-5pt}
  \label{ablation study}
  \centering
  \begin{tabular}{ cccccc }
    \toprule
    + LwF & + PSA   & T1 & T2 & T3 & T4 \\
    \midrule
   \XSolidBrush  & \XSolidBrush   &13.26& 16.01 & 43.72 & 14.38\\
   \Checkmark  & \XSolidBrush   & 12.28 & 11.68  &  11.52 &  7.44   \\
     \XSolidBrush &  \Checkmark   & 9.64 & 11.79 & 12.28  & 8.48 \\
    \Checkmark  & \Checkmark  & 9.25 & 10.45 & 8.03  &  6.90 \\
    \bottomrule
  \end{tabular}
 \vspace{-5pt}
\end{table}

We carry out an ablation study to evaluate the impact of two components of our method. The first factor LwF is the constraint on the output distribution of model for all input data. The second factor PSA is the constraint on embeddings of genuine speech input. Both of them are used for preserving key parameters consistent with the original model. Table \ref{ablation study} shows the AvgEER achieved in all combinations of these two components. Training without neither LwF nor PSA equals to fine-tuning, and training with both LwF and PSA equals to DFWF.
In training, we adopt the optional hyper-parameters for each setting. The results show that both two components can improve the performance in sequential training. When applied together, DFWF obtains the best AvgEER.

\section{Discussions}

\begin{figure}[t]
\vspace{-10pt}
  \centering
  \subfigure[LCNN-BASE]{
    \label{Fig.1}
    \includegraphics[width=0.45\linewidth]{./Figure/devLAembedding2.pdf}}
    \subfigure[LCNN-FT]{
    \label{Fig.2}
    \includegraphics[width=0.45\linewidth]{./Figure/devLAftembedding2.pdf}}
    \subfigure[LCNN-DFWF (Ours)]{
    \label{Fig.3}
    \includegraphics[width=0.45\linewidth]{./Figure/devCLembedding2.pdf}}
    \subfigure[LCNN-MC]{
    \label{Fig.4}
    \includegraphics[width=0.45\linewidth]{./Figure/devLPembedding2.pdf}}
  \vspace{-10pt}
  \caption{The t-SNE visualization of all training data embeddings that are extracted by different models. LCNN-BASE is trained only on LA subset. LCNN-FT is finetuned on PA subset based on LCNN-BASE. LCNN-DFWF is trained on PA by the propoesd DFWF method based on LCNN-BASE. LCNN-MC is train on mixed data of LA and PA subsets. The color red represents genuine speech. The color blue represents spoofing speech of LA attack. The color green represents spoofing speech of PA attack.}
  \label{fig:embedding}
\vspace{-10pt}
\end{figure}

From the results, we find that our proposed DFWF doesn't outperform multi-condition training. The reason is that all the data are available to multi-condition model but the previous data is inaccessible to our DFWF systems. In theory, the results of multi-condition model is the upper limit of the performance of continual learning systems\cite{van2008visualizing}.

Besides, to better understand the mechanism of our proposed DFWF method, we plot the t-SNE figures to visualize the embeddings of genuine and spoofing speech \cite{van2008visualizing}. Figure \ref{fig:embedding} shows the embedding distribution of all training data in ``$LA \rightarrow PA$" sequential training.
LCNN-BASE can not distinguish the spoofing speech of PA attack (green dots) since there is an obvious mixture of PA spoofing speech and genuine speech (red dots). After fine-tuned on PA subset, LCNN-FT can distinguish PA attacks but the previous LA attacks (blue dots) are scattered among genuine speech. These illustrate the dilemma of fine-tuning that the fine-tuned model tends to forget the previous knowledegs.
However, after applied DFWF, LCNN-DFWF can distinguish both LA attacks and PA attacks much more better than the LCNN-FT, and the distribution of the data is very similar to that in LCNN-MC.

\section{Conclusions}
In this paper, we proposed a continual-learning-based method DFWF to solve the unseen spoofing attacks problem in fake audio detection. On the basis of LwF, PSA prevents the embedding of genuine speech from deviating from the original distribution, which further preserves the model's detection capability on previous data.
This method can not only save the time and computing resource but also mitigate the catastrophic forgetting problem. In some cases ( i.e., $bbbBB\rightarrow cccCC\rightarrow aaaAC \rightarrow abcAA$), it even performs similarly to multi-condition training but it's faster to train without the need to get access to the previous data.
Experiments conducted on 4 setting of sequential training show the effectiveness of DFWF method to learn new spoofing attacks incrementally, particularly as spoofing data becomes more and more.
More advanced continual learning methods are worth exploring in fake audio detection in the future.

\bibliographystyle{IEEEtran}