summaries: This paper proposes a way of reconstructing a surface from sparse point clouds via a "meta learning" approach. Specifically, the authors view each shape in a collection as a "domain", and predicting the SDF values of points in R^3 to reconstruct a given shape (the reconstructed surface is the isosurface of the SDF field) as the "task" for that domain. Then, they use a network to predict a distribution over "task-specific" latent vectors that characterizes the reconstruction task for a given shape. Given a latent-vector sampled for one shape, they pass it to a decoder that predicts the SDF value at any point in R^3 for that shape.

summaries: This paper introduces a meta-learning approach for the neural implicit representation of 3D shapes. The main idea, in my understanding, is to consider the points in the input point cloud as few-shot examples of the object so that each of them can be encoded in a way to best approximate the entire object information. The experiments show that the network can reconstruct the entire shape well even with a very small number of the input points, such as 50 and 100. For better reconstruction, the authors also proposed to use some implicit function regularizations, which are introduced in a previous work (Gropp et al., 2020).

summaries: This paper tackles the task of point cloud completion, aiming to infer an implicit occupancy representation given a sparse input point cloud. Following recent practices, the approach represents the shape via a latent-variable conditioned occupancy function $f_{\phi}(x, h)$ that infers occupancy of a point $x$ given latent $h$. The central task addressed here is to be able to infer a posterior distribution over the latent variable given some observed points $D$ i.e. $p_{\theta}(h|D)$.

abstractText: Estimating the 3D shape of real-world objects is a key perceptual challenge. It requires going from partial observations, which are often too sparse and incomprehensible for the human eye, to detailed shape representations that vary significantly across categories and instances. We propose to cast shape completion as a Bayesian meta-learning problem to facilitate the transfer of knowledge learned from observing one object into estimating the shape of another object. To facilitate the learning of object shapes from sparse point clouds, we introduce an encoder that describes the posterior distribution of a latent representation conditioned on the sparse cloud. With its ability to isolate object-specific properties from object-agnostic properties, our meta-learning algorithm enables accurate shape completion of newly-encountered objects from sparse observations. We demonstrate the efficacy of our proposed method with experimental results on the standard ShapeNet and ICL-NUIM benchmarks.

authors:
Angel X Chang
Thomas Funkhouser
Leonidas Guibas
Pat Hanrahan
Qixing Huang
Zimo Li
Silvio Savarese
Manolis Savva
Shuran Song
Hao Su

title: Shapenet: An information-rich 3d model repository

venue: arXiv preprint arXiv:1512.03012,

authors:
R.Q. Charles
H. Su
M. Kaichun
L.J. Guibas

title: Pointnet: Deep learning on point sets for 3d classification and segmentation

authors:
Chris Choy
Danfei Xu
JunYoung Gwak
Kevin Chen
Silvio Savarese

title: 3d-r2n2: A unified approach for single and multi-view 3d object reconstruction

authors:
Brian Curless
Marc Levoy

title: A volumetric method for building complex models from range images

venue: In Proceedings of the 23rd Annual Conference on Computer Graphics and Interactive Techniques,

authors:
Angela Dai
Charles Ruizhongtai Qi
Matthias Nießner

title: Shape completion using 3d-encoderpredictor cnns and shape synthesis

venue: In Proc. Computer Vision and Pattern Recognition (CVPR),

authors:
Harrison Edwards
Amos Storkey

title: Towards a neural statistician

venue: In ICLR,

authors:
SM Ali Eslami
Danilo Jimenez Rezende
Frederic Besse
Fabio Viola
Ari S Morcos
Marta Garnelo
Avraham Ruderman
Andrei A Rusu
Ivo Danihelka
Karol Gregor

title: Neural scene representation and rendering

authors:
H. Fan
H. Su
L. Guibas

title: A point set generation network for 3d object reconstruction from a single image

authors:
Chelsea Finn
Pieter Abbeel
Sergey Levine

title: Model-agnostic meta-learning for fast adaptation of deep networks

venue: In Proceedings of the 34th International Conference on Machine Learning-Volume

authors:
Silvio Giancola
Jesus Zarzar
Bernard Ghanem

title: Leveraging shape completion for 3d siamese tracking

venue: In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR),

authors:
Amos Gropp
Lior Yariv
Niv Haim
Matan Atzmon
Yaron Lipman

title: Implicit geometric regularization for learning shapes

venue: arXiv preprint arXiv:2002.10099,

authors:
Thibault Groueix
Matthew Fisher
Vladimir G. Kim
Bryan Russell
Mathieu Aubry

title: AtlasNet: A Papier-Mâché Approach to Learning 3D Surface Generation

venue: In Proceedings IEEE Conf. on Computer Vision and Pattern Recognition

authors:
Kan Guo
Dongqing Zou
Xiaowu Chen

title: 3d mesh labeling via deep convolutional neural networks

venue: ACM Transactions on Graphics, 35:1–12,

authors:
A. Handa
T. Whelan
J.B. McDonald
A.J. Davison

title: A benchmark for RGB-D visual odometry, 3D reconstruction and SLAM

venue: In IEEE Intl. Conf. on Robotics and Automation,

authors:
C. Häne
S. Tulsiani
J. Malik

title: Hierarchical surface prediction for 3d object reconstruction

venue: In 2017 International Conference on 3D Vision (3DV),

authors:
Angjoo Kanazawa
Michael J. Black
David W. Jacobs
Jitendra Malik

title: End-to-end recovery of human shape and pose

venue: In Computer Vision and Pattern Regognition (CVPR),

authors:
Diederik P Kingma
Max Welling

title: Auto-encoding variational bayes

venue: In Proceedings of the 2nd International Conference on Learning Representations,

authors:
Yiyi Liao
Simon Donné
Andreas Geiger

title: Deep marching cubes: Learning explicit surface representations

venue: In Conference on Computer Vision and Pattern Recognition

authors:
William E Lorensen
Harvey E Cline

title: Marching cubes: A high resolution 3d surface construction algorithm

venue: ACM siggraph computer graphics,

authors:
Shin-ichi Maeda
Toshiki Nakanishi
Masanori Koyama

title: Meta learning as Bayes risk

venue: minimization. arXiv:2006.01488,

authors:
Lars Mescheder
Michael Oechsle
Michael Niemeyer
Sebastian Nowozin
Andreas Geiger

title: Occupancy networks: Learning 3d reconstruction in function space

venue: In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition,

authors:
Jeong Joon Park
Peter Florence
Julian Straub
Richard Newcombe
Steven Lovegrove

title: Deepsdf: Learning continuous signed distance functions for shape representation

authors:
Adam Paszke
Sam Gross
Soumith Chintala
Gregory Chanan
Edward Yang
Zachary DeVito
Zeming Lin
Alban Desmaison
Luca Antiga
Adam Lerer

title: Automatic differentiation in pytorch

venue: NIPS-W,

authors:
Charles R. Qi
Li Yi
Hao Su
Leonidas J. Guibas

title: Pointnet++: Deep hierarchical feature learning on point sets in a metric space

venue: In Proceedings of the 31st International Conference on Neural Information Processing Systems,

authors:
Rajesh Ranganath
Sean Gerrish
David Blei

title: Black box variational inference

venue: In Artificial Intelligence and Statistics,

authors:
David Stutz
Andreas Geiger

title: Learning 3d shape completion from laser scan data with weak supervision

venue: In IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE Computer Society,

authors:
Jacob Varley
Chad DeChant
Adam Richardson
Joaquín Ruales
Peter Allen

title: Shape completion enabled robotic grasping

venue: IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS),

authors:
Nanyang Wang
Yinda Zhang
Zhuwen Li
Yanwei Fu
Wei Liu
Yu-Gang Jiang

title: Pixel2mesh: Generating 3d mesh models from single rgb images

authors:
Yaoqing Yang
Chen Feng
Yiru Shen
Dong Tian

title: Foldingnet: Interpretable unsupervised learning on 3d point

venue: clouds. ArXiv,

authors:
Wentao Yuan
Tejas Khot
David Held
Christoph Mertz
Martial Hebert

title: Pcn: Point completion network

venue: In 2018 International Conference on 3D Vision (3DV),

authors:
Qian-Yi Zhou
Jaesik Park
Vladlen Koltun

title: Open3d: A modern library for 3d data processing

venue: arXiv preprint arXiv:1801.09847,

heading: 1 INTRODUCTION

text:
The task of estimating 3D geometry from sparse observations, commonly referred to as shape completion, is a key perceptual challenge and an integral part of many mission-critical problems, including robotics (Varley et al., 2017) and autonomous driving (Giancola et al., 2019; Stutz & Geiger, 2018). Recently, a series of methods (Mescheder et al., 2019; Park et al., 2019) have achieved great success by using the observations to infer the parameters of an implicit 3D geometric representation of the targets object. However, with some notable exceptions (Yuan et al., 2018), such methods require relatively dense observations to achieve high accuracy, which is usually impractical in real situations. In this paper we introduce a novel methodology that enables state-of-the-art shape completion of previously unseen objects from highly sparse observations.
Our insight comes from the following simple intuition: "Can we leverage the geometric information available in one object to improve shape completion results on another target object?" Meta-learning is an emerging field of study in machine learning that serves this very purpose. By training a model on multiple inter-related tasks, it learns how to learn new tasks efficiently from a small amount of observations. Recently proposed meta-learning methods often achieve this by parameterizing the input-output relationship with task-specific latent variables and training a separate, task-agnostic model/mechanism that can infer these task-specific variables from sparse observations of the target task (Chang et al., 2015; Finn et al., 2017; Garnelo et al., 2018). We can cast the shape completion problem as a Bayesian meta-learning problem by treating each object as a task and its sparse observations as the corresponding contextual dataset.
In popular Bayesian variants of meta-learning (Edwards & Storkey, 2017; Eslami et al., 2018; Garnelo et al., 2018), the task-specific latent variables are treated as random variables, and the aforementioned task-agnostic model (i.e. the encoder) is represented as a posterior distribution of the latent variables conditioned on sparse observations. In this study, we combine probabilistic meta-learning with recent shape completion methods that represent the geometry of a given object with implicit parameters, such as the parameters of a signed distance function (SDF). By training an encoder that computes the posterior distribution of these implicit parameters conditioned against sparse observations, we develop a framework that enables the few-shot learning of implicit geometric functions. Under appropriate regularity conditions, the computation of correct posterior distribution leads to optimal prediction in the sense of Bayes Risk (Maeda et al., 2020). Our proposed approach is a natural extension of many
implicit approaches, in the sense that it introduces an additional encoder function that represents the posterior distribution of the geometry-describing implicit parameters.
More specifically, we build upon the Bayesian approach of (Maeda et al., 2020) whose posterior estimate behaves asymptotically well with respect to the size of contextual dataset, and combine their method with Implicit Geometrical Regularization (IGR) (Gropp et al., 2020). We use IGR as the baseline, and demonstrate its efficacy on two benchmark datasets (ShapeNet and ICL-NUIM), especially when the observations are very sparse.

heading: 2 RELATED WORK

heading: 2.1 3D DECODING REPRESENTATIONS

text:
Unlike images, that contain a clear pixel-based structural pattern, there is no unified representation for 3D object reconstruction that is both computationally and memory efficient. In terms of used 3D representations, existing methods can be broadly divided into the following categories:
Voxel-based methods are a generalization of 2D pixels into 3D space, and thus constitute a natural extension for classical image-based methods. Early works focused on 3D convolutions operating on dense grids (Choy et al., 2016) to generate an occupancy function that determines whether each cell is inside an object or not, however these were limited to relatively small resolutions. To address the high memory requirements of dense voxel grids, various works have proposed 3D reconstruction in a multi-resolution fashion (Häne et al., 2017), with the added complexity of requiring multiple passes to generate the final output. More recently, OccNet (Mescheder et al., 2019) proposes encoding a 3D description of the output at infinite resolution, and shows that this representation can be learned from different sensor modalities.
Signed Distance methods are an alternative to occupancy functions, where instead of the occupancy state we learn a function describing the signed distance to the object surface (Dai et al., 2017; Stutz & Geiger, 2018). This approach builds upon earlier fusion methods that utilize a truncated signed distance function (SDF) introduced in (Curless & Levoy, 1996). DeepSDF (Park et al., 2019) represents 3D space as a continuous volumetric field, and requires at training time the ground-truth SDF calculated from dense input data using numerical methods. Implicit Geometric Reconstruction (IGR) (Gropp et al., 2020) is a SDF variant that uses Eikonal regularization, thus enforcing that the output of the decoder will be the SDF of "some" surface. This is an effective way of mitigating the impact of outliers in the final generated surface, and is used as the starting point for our proposed meta-learning approach to shape completion.
Point-based methods directly output points located on the object surface, thus eliminating the need for a dense representation of the 3D space. Earlier works such as PointNet (Charles et al., 2017; Qi et al., 2017) combined fully connected networks with a symmetric aggregation function, thus achieving permutation invariance and robustness to perturbations. (Fan et al., 2017b) introduced point clouds as a viable output representation for 3D reconstruction, and (Yang et al., 2017) proposed a decoder design that approximates a 3D surface as the deformation of a 2D plane. Point Completion Network (PCN) (Yuan et al., 2018) is a recent architecture that enables the generation of coarse-tofine shapes while maintaining a small number of parameters. However, a common limitation of all these methods is that they do not describe topology, and thus are not suitable for the generation of watertight surfaces. Also, to change the number of output points, methods like PCN have to re-train their networks entirely, while SDF-based methods learn the geometry in an implicit form and thus can generate any amount of points.
Mesh-based methods choose to represent classes of similarly shaped objects in terms of a predetermined set of template meshes. First attempts focused on graph convolutions alongside the mesh’s vertices and edges (Guo et al., 2015), and more recently as a direct output representation for 3D reconstruction (Kanazawa et al., 2018). These methods, however, are only able to generate meshes with simple topologies (Wang et al., 2018), require a reference template from the same object class (Kanazawa et al., 2018) and cannot guarantee water-tight closed surfaces (Groueix et al., 2018). A learnable extension to the Marching Cubes algorithm (Lorensen & Cline, 1987) has been proposed in (Liao et al., 2018), however this approach is limited by the memory requirements of the underlying 3D voxel grid.

heading: 2.2 ENCODING AND DECODING MECHANISM

text:
In shape completion methods, one must construct a geometry of object from point clouds of varying size that are scattered over various regions. Thus, all methods use some mechanism to encode the sparse point clouds to a tensor of fixed size, and decode this tensor to produce the final output. Existing methods also differ by the design of these decoding and encoding mechanisms.
Methods like DeepSDF and IGR train an auto-decoder, and do not train separate encoder functions at all. To find the geometry-describing implicit parameters for each object, these methods apply likelihood-based gradient descent on randomly initialized latent variables, using just sparse observations from the target object. Thus, these methods by design do not use observations from multiple objects to train an object-agnostic mechanism that can efficiently learn the latent variables. Meanwhile, PCN and OccNet both train a complex encoder function that maps sparse observations to latent variables. Although their decoders differ entirely (PCN directly outputs 3D points, while OccNet outputs binary values), they both use an encoder that aims to capture the hierarchical structure of the object’s geometry. More specifically, PCN’s encoder is equipped with a mechanism to extract information from sparse observations in two steps, one aimed at extracting global information and another at extracting local information. On the other hand, OccNet’s encoder is a version of PointNet (Charles et al., 2017) that uses max pooling with respect to the sparse observation set.
Our method also uses an encoder function, however it differs from those mentioned above in the sense that it represents a posterior distribution, rather than a deterministic function. Under an appropriate set of regularity conditions , inference made from the predictions of posterior distribution is optimal in terms of the Bayes risk (Maeda et al., 2020). Furthermore, because our encoder is probabilistic, it is capable of outputting multiple candidate shapes for a given sparse observation.

heading: 3 META-SHAPE COMPLETION

heading: 3.1 PROBLEM SETTING

text: Let Dk = {x(k)n ∈ R3|n = 1, · · · , Nk} be an arbitrary set of points located on the surface of a 3D object k. The goal of shape completion for object k is to use Dk to infer its surface. There are various approaches to this problem: if the surface is closed, one can use an occupancy function Focc(x) that tells whether a point x is inside or outside the surface. One may also use a signed distance function Fsdf (x) that evaluates how far point x is to the surface, with positive values indicating that it’s outside and negative values indicating that it’s side. In both approaches, the transcribed goal is to use Dk to find the object-k-specific function Fk that best describes its geometry. Our proposed method focuses on the latter approach, and in the following sections we show how Bayesian meta-learning can be used to learn a probabilistic SDF for shape completion.

heading: 3.2 META-LEARNING FOR SHAPE COMPLETION

text:
Meta-learning exploits underlying similarities among tasks to enable the transfer of knowledge between tasks, so that information gained from solving one problem can improve performance on another. Traditional meta-learning methods work by parameterizing their models with two types of parameters: task-specific and task-agnostic. Following this basic philosophy, we represent the signed distance function (SDF) of all observed objects using object-specific parameters hk and object-agnostic parameters θ. More specifically, we write our SDF for object k as SDFθ(x;hk), and determine hk using the θ-parameterized function that encodes Dk. The function that maps Dk to hk is often referred to as encoder in the meta-learning literature. The SDF, on the other hand, plays the role of decoder. In a probabilistic setting, we consider a probabilistic SDF of form N (s|SDFθ(x;hk), σ2θ). Now, if we interpret this estimation problem as a case of minimizing the Bayes risk (Maeda et al., 2020), we can show that the optimal solution is given by the predictive distribution pθ(s|x;Dk) computed using the posterior distribution p(h|Dk):
p(s|x,Dk) = ∫ p(s|x, hk)p(hk|Dk)dhk. (1)
The estimation of the posterior p(hk|Dk) is a challenging task: for the approximation to be valid, it must be able to accept unordered sets Dk of various lengths, while satisfying all other properties of a posterior distribution. For example, its variance must approach zero as we take the number of observed points to infinity. According to the theory of (Maeda et al., 2020), we can construct an approximation that satisfies all these requirements using a Gaussian distribution pθ(hk|Dk) =∏d i=1N (hk,i|µi,θ(Dk), σ2i,θ(Dk)) with mean and variance as follows (we use hk,i to denote the i-th element of hk):
µi,θ(Dk) = σ 2 i,θ(Dk) Nk∑ n=1 fi,n g2i,n , σ2i,θ(Dk) = ( Nk∑ n=1 ( 1 g2i,n − 1 g2i,0 ) + 1 g2i,0 )−1 . (2)
In the above, fi,n = fi,θ(x (k) n , y (k) n ) and gi,n = gi,θ(x (k) n , y (k) n ) are neural networks parameterized by θ. When making a probabilistic inference, we sample from this Gaussian posterior approximation and feed it to the decoder SDF. A schematic diagram of our proposed meta-learning shape completion method can be found in Figure 1.
The training proceeds by making predictions about target points using contextual information from various datasets. To prepare the mock-target points at training time, we decompose Dk into Dctxtk and Dtargk for each task k and use the following classic ELBO (Ranganath et al., 2014; Kingma & Welling, 2014) to optimize the predictive distribution given Dk:
Lk(θ) :=− ∫ pθ(hk|Dk) ( Nk∑ n=1 log pθ(s (k) n |x(k)n , hk) + log pθ(hk|Dctxtk ) ) dhk −H(pθ(hk|Dk)).
(3)
Here s(k)n is the true signed distance from point x (k) n to the surface of object k. In our problem setting, s (k) n is 0 for all (n, k) because all the observed points are on the surface of the objects. Figure 1 contains a diaram of our proposed algorithm. To test the sheer efficacy of our meta-approach, we only use MLP for encoder in this study, and do not explore the specific architecture that is suited for the shape-completion problem.

heading: 3.3 EIKONAL REGULARIZATION

text:
The datasets Dk considered in shape completion tasks usually only contains points on the object surface. However, it is difficult to enforce the learned function to be a signed distance function (SDF) just by enforcing that is value should be close to 0 at observed points. Implicit Geometric Regularization (IGR) (Gropp et al., 2020) is a regularization based on the theory of Eikonal partial differential equations, which states that any function F satisfying
F (x) = 0 ∀x ∈ B, ‖∇F (x)‖ = 1 ∀x ∈ R3 (4)
is a signed distance function for the surface B. To better encourage our decoder to describe a valid SDF, we therefore augment our loss function by an extra term Leik = E[|‖∇SDFθ(x;hk)‖ − 1|]. We estimate this expectation by sampling x in the soft neighordhood of the object surface. For more details, we refer the reader to Section 4.

heading: 3.4 NORMAL VECTOR REGULARIZATION

text: If the training dataset contains ground-truth surface normal vectors, we can also add a regularization term to encourage the gradient of the estimated SDF at observed points to agree with the true normal vectors. This is a regularization used in the original IGR (Gropp et al., 2020) implementation as well.

heading: 3.5 LOSS FUNCTION AND POST-ENCODER LATENT OPTIMIZATION

text:
The loss function we minimize at training time for object k is given by
L = Lk(θ) + λLeik, (5)
where λ is an empirically chosen regularization parameter. At inference time, we can also further fine-tune the encoder output by optimizing the likelihood of the sparse observation. That is, if µk0 is the the mean of the encoder conditioned against Dk (i.e. E[h|Dk]), we additionally apply the following iterative updates on the encoder’s mean:
µkt ←− µkt−1 + ∑
(xkn,s k n)∈Dk
∇h log p(skn|xkn, h) ∣∣∣∣∣ µkt−1 . (6)
At inference time, we feed µ̄kT to the decoder instead of µ k 0 . When we apply this post-encoder latent optimization, our method becomes a version of IGR that is additionally equipped with an encoder.

heading: 4 EXPERIMENTS

text: We conducted a series of experiments to evaluate the efficacy of our proposed Meta-Shape Completion (MSC) method, relative to other well-known published methods. Particularly, we focus on very sparse scenarios, and show that the introduction of Bayesian meta-learning enables the generation of state-of-the-art shape predictions from a very small number of observed samples. Similarly, we show that our proposed method generalizes better to novel and unseen objects.

heading: 4.1 DATASETS

text:
ShapeNet (Chang et al., 2015). We used the Synthetic ShapeNet CAD models as the primary source of evaluation for this paper. Following the procedure described in (Park et al., 2019), we first applied an affine transformation to each object, so the center of mass is located at the origin, and rescaled all points so that the maximum distance from vertex to origin is 1. To exclusively sample points on the object-surfaces, we first generated 100 view-points uniformly around each object, and used OpenGL to obtain images from these view-points. We then identified the set of points that are observable from these 100 view points as surface points, and took samples from these points. This modified dataset is henceforth referred to as Disemboweled ShapeNet. For IGR and MSC, we used the above procedure to generate 200k pairs of coordinate and normal vectors on each object surface. For DeepSDF, we followed the original procedure and computed the ground-truth SDF at randomly generated 500k points in addition to the 200k surface points. For OccNet, we randomly sampled 100k points from those used in DeepSDF, and annotated whether they are inside or outside the object. For PCN, we sampled 16384 surface points as ground-truth.
ICL-NUIM (Handa et al., 2014). This is a dataset consisting of RGB-D images from two different scenes: living rooms and office rooms. The task on this dataset is to reconstruct 3D shapes from depth images. As pre-processing, we normalized location and scale of each scene using the same procedure described above for ShapeNet, and used Open3D (Zhou et al., 2018) to obtain normal vectors. Because Open3D sometimes produces normal vectors with inconsistent orientations, we conducted an extra step of inconsistency correction in which we made their inner products with the camera vector to be all positive.

heading: 4.2 EVALUATION

text:
As our evaluation metric for each method, we calculated the Chamfer distance (Fan et al., 2017a) between ground-truth and generated point clouds. If P1 and P2 are two point clouds in 3D space, the
Chamfer distance between them is given by: d(P1,P2) = ∑ i∈P1 min j∈P2 |xi − xj |22/|P1|+ ∑ j∈P2 min i∈P1 |xi − xj |22/|P2| (7)
Let Pgtk be the ground-truth point cloud of the object k, and P̂Mk be the point cloud of object k generated by method M. To evaluate the performance of method M, we computed dMk := d(Pgtk , P̂Mk ) for each k and used it to calculate the following values:
d̄Mave = 1
K K∑ k=1 dMk , d̄ M norm = 1 K K∑ k=1 (dMk /d M0 k ) (8)
whereM0 is our proposed method, so that d̄Mnorm is a measure of method M ’s performance relative to our own performance. We refer to the former value as average chamfer distance, and the latter as normalized chamfer distance. For the ICL-NUIM experiments we used an assymetric variation of the Chamfer Distance, where only the first sum term in Equation 7 is used. This is because the ground-truth point clouds for this dataset are very sparse and lack many portions of the scene to be reconstructed.
To generate ground-truth point clouds, we randomly sampled 30k points from the raw meshes in our Disemboweled Shapenet dataset. Each point on the object surface was sampled in two steps: first, we selected a triangle on the polygonal mesh with probability proportional to the area of the triangle. Then, we sampled a point from the uniform distribution over the selected triangle. DeepSDF, IGR and OccNet use implicit functions to represent the geometry of each object, so their decoders do not directly output a point cloud. For these methods, we used Marching Cubes (Lorensen & Cline, 1987) to generate a point cloud of size 30k. PCN, on the other hand, directly outputs 3D points from each set of sparse observations. Following the original implementation, we used those to generate a point cloud of size 16384.

heading: 4.3 SHAPE COMPLETION ON SHAPENET

text:
To verify the ability of our proposed method to complete the shape of unseen categories, we split the object-categories of Disembowled ShapeNet into two groups: one to be used to train the model (training), and one to be used as newly-encountered object type (novel). For the exact splits, please refer to the Appendix. In the first set of experiments, we trained the model on the training dataset of training categories, and evaluated the model on the test set of the training categories. Results for this first set of experiments can be found on Table 1. In the second set of experiments, we trained each model on the training set of training categories and evaluated on the model on the test set of novel categories. Results for this second set of experiments can be found on Table 2. In both cases, our proposed method (MSC) was evaluated with and without post-encoder latent optimization.
As we can see in both tables, our proposed method consistently outperforms all the other methods for both novel and training categories when the number of observation points is 100 or less, while achieving competitive results when higher densities are available. In particular, when the number of observations is 50, our method greatly outperforms PCN, the current SOTA in these tasks.
The strength of our method can be verified qualitatively as well. Figures 2 and 3 are examples of completed shapes obtained by different methods for various ShapeNet categories. As shown, our method tends to output smooth surface predictions regardless of the number of observations. This is most likely because our encoder is learning a task-agnostic property of smoothness, that can be transferred across different objects. Meanwhile, the performance of IGR differs drastically across trained and novel categories, both in terms of Chamfer distance and output appearance. DeepSDF performs poorly on all categories, most likely because it is not allowed to use ground-truth SDF at test-time. When the number of observations is small, DeepSDF tends to output a complex nonsensical surface that looks like a combination of all the training objects. It also tends to produce disconnected artifacts that are located far away from the real surface. OccNet also tends to produce many artifacts when the number of observations is small. We hypothesize that these methods are failing to isolate category-agnostic properties from category-specific properties. As a general remark, all methods struggle with reproducing detailed topology even with a large number of observations, particularly in the case of holes and large gaps, possibly due to model limitations. For a detailed analysis of the category-wise performance of various methods, please refer to the Appendix.

heading: 4.4 SCENE COMPLETION OF ICL-NUIM DATASET

text:
Table 3 summarizes the performance of various methods on ICL-NUIM, for the task of scene completion. Similarly to ShapeNet, MSC significantly outperforms all others when the number of observations is 300 or less, while still achieving competitive results when a higher density of observations is available. Figures 4 and 5 contain examples of scene completion results produced by different methods. DeepSDF and OccNet both tend to produce very complex shapes with many disconnected artifacts, and DeepSDF in particular seems to not converge as we increase the number of observations. PCN performs poorly when compared to the shape completion task on ShapeNet, mostly densifying observed areas rather than extrapolating this information to other portions of the scene. Our method, on the other hand, succeeds in correctly recognizing the boundary of objects even when large areas, such as walls and the floor, are missing in the ground-truth.
Input Points ( PCN OccNet DeepSDF IGR MSC (w/o opt) MSC (w opt) Ground Truth
Input Points ( PCN OccNet DeepSDF IGR MSC (w/o opt) MSC (w opt) Ground Truth

heading: 5 CONCLUSION

text: In this paper we introduce the concept of meta-learning to the task of shape completion using implicit representations of 3D surfaces. Our proposed encoder mechanism allows the learning of object-agnostic properties separately from object-specific properties, thus succeeding in training a model that can consistently produce smooth predictions from highly sparse observations, achieving state-of-the-art under these conditions. Although we have used IGR, an SDF-based method, as the basis for our implementation, our proposed meta-shape completion algorithm (MSC) can be equally applied to different implicit surface representations by simply changing the decoder. Furthermore, in this paper we have used a simple MLP-based encoder to learn task-specific parameters, while other methods like PCN use hierarchical models to capture both global and local geometric properties of objects. We believe that using these more complex models will lead to substantial improvements to our proposed method, however this is left for future work. In conclusion, there seems to be a lot of room left for the application of meta-learning to scene completion tasks, and further studies in this direction may allow us to develop models that can be used in a wide range of applications.

heading: A APPENDIX

text:
A.1 IMPLEMENTATION DETAILS
DeepSDF (Park et al., 2019) and IGR (Gropp et al., 2020). We implemented both methods using Pytorch (Paszke et al., 2017), matching their model architectures, initialization procedures and published results. As done in the original study of (Park et al., 2019), however, we used ReLu in place of softplus for the Deep SDF decoder. To create the mesh with which the Chamfer distance is calculated, we used the Marching Cubes algorithm (Lorensen & Cline, 1987) with 2563 resolution to convert SDF to mesh. To find the optimal z with respect to the likelihood, we applied gradient descent from a random initial value z0 sampled from N(0, 0.012). For the stepsize, we chose lr ∗ error0, where error0 is the error computed with z0. We used the Adam optimizer, with batch size b = 32, alpha α = 3.2× 10−4, and learning rates lr = 1.0× 10−3 for DeepSDF and lr = 1.0× 10−4 for IGR. We trained for 5000 epochs, halving the learning rate at every 500 epochs. We used 16384 surface points to compute the loss for each object. To generate points for the evaluation of the Eikonal term, we randomly selected 5k points from the 16384 on the surface, and sampled one point each from a Gaussian distribution centered around it, with variance of 4.0 × 10−2 and λ = 1.0 as the Eikonal regularization parameter. We trained our IGR model with the version of the algorithm in (Gropp et al., 2020) that uses the surface normal vectors.
OccNet (Mescheder et al., 2019). We used the authors’ official Pytorch implementation1 and trained under the same conditions as described in the original paper. For the encoder architecture (Figure 6), we used the ResNetPointNet class, and for the decoder architecture we used the DecoderBatchNorm class. We trained the decoder over 5k epochs with batch size b = 64 and learning rate lr = 1.0×10−4. For each object, we used 300 surface points to the encoder, and produced 2048 binary points from the decoder. To stabilize training, we followed the same procedure described in the original paper and added a Gaussian noise with standard deviation σ = 5.0× 10−3 to the encoder input. PCN (Yuan et al., 2018). We implemented PCN using PyTorch based on the authors’ official Tensorflow implementation2, matching their model architectures, initialization procedures and published results. To train, we followed the same procedure as the original paper, feeding k surface points to the encoder. We used batch size b = 32. Starting from the initial value of 0.0001, we reduced the learning rate by a factor of 0.7 at every 50k iterations and trained the model for a total of 5k epochs.
MSC (Ours). Figure 1 of the main paper illustrates our proposed encoder network. The dimension of h (i.e., the output of the encoder) is set to 1024 for ShapeNet40 and 512 for the ICL-NUIM dataset. We used the same decoder as IGR. At training time, we set the number of contextual surface points to be 16384 and evaluated the loss using target sample points of size ranging from 1 ∼ 5000, chosen at random at each iteration. We trained our model for 5k epochs with batch size b = 32 and learning rate lr = 10−4, using the same Eikonal regularization term as IGR. For the ShapeNet experiment, training the model required 16 days with 16 GPUs (NVIDIA V100). The encoding of 1000 contextual points took 0.003 seconds on average, and 22.660 seconds to create the mesh surface using the Marching
1https://github.com/autonomousvision/occupancy_networks 2https://github.com/wentaoyuan/pcn
Cubes algorithm (which requires evaluation at multiple points). For the ICL-NUIM experiment, it took 30 hours with 32 GPUs to train the entire model.
A.2 RESULTS ON SHAPENET
Tables 4 are 5 contain more detailed shape completion results for each ShapeNet training category, and Table 6 contains similar results for each ShapeNet novel category. Qualitative results for selected objects can be found in Figures 2-12. Generally speaking, performance of all methods vary greatly across categories, and as expected, all methods perform better on trained than novel categories. Some objects were particularly difficult for all methods, such as headphones, for which it is difficult to determine whether the target object is ring-shaped or not until there is a large amount of contextual points. Following the same logic, all methods also performed poorly on objects with intricate details, such as motorcycles and keyboards.
As described in the main paper, PCN tends to outperform MSC when there is a large number of observations. However, in many of theses cases simple Gaussian densification also yields good results. In fact, Gauss densification outperforms all methods on most categories when the number of observations is as large as 1000. This suggests that the representation power of these methods is still not sufficient. Meanwhile, MSC outperforms all methods on most of both novel and training categories when the number of observations is small. Particularly, when the number of observations is 50, our method with post-encoder optimization outperforms all methods on all novel categories. When the number of observations is 100, MSC with post-encoder optimization outperforms other methods in 10 out of 15 categories. However, we note that the categories where MSC is outperformed (pistol, motorcycle, guitar, earphone, microphone) correspond to objects with fine details, and in 2 of them the best performing method is Gauss densification.
IGR, which represents a version of our method without the encoder, sometimes produced nonsensical outputs even with a large number of observations, apparently switching between different objects. Similarly, DeepSDF has a tendency of producing outputs that look like a combination of many objects. It is possible that, because IGR and DeepSDF are not equipped with an encoder, they are indeliberately mixing object-specific with object-agnostic features by encoding some object-specific properties into their decoder model. DeepSDF also produced disconnected artifacts in many cases, mostly because we only allow the use of contextual observations at test time (e.g. information like ground truth sdf values at points not on the surface and ground truth normal vectors are inaccessible at test time with sparse observations). OccNet also produced such artifacts when the number of observations is very small. Our proposed MSC method, on the other hand, makes relatively conservative smooth prediction when the observations are too sparse, and incrementally increases the complexity of the output shapes as more points become available.
A.3 RESULTS ON ICL-NUIM
Figures 13-15 are selected scene completion results obtained on the ICL-NUIM dataset. Although both the ground-truth and contextual point-cloud have missing large portions because of data collection procedure (collected from a single view), our MSC is able to generate smooth surfaces that cover the unobserved areas of the environment. Interestingly, in this case IGR also does a good job producing smooth surfaces, most likely because all rooms are somewhat familiar to each other (i.e. object-specific properties can be shared between classes without significant detrimental effects). DeepSDF again produces disonnected artifacts on this dataset as well, Failures cases for DeepSDF indicates that the Eikonal term plays an important role in producing smooth surfaces, especially when the model is not allowed to use normal vectors. Finally, PCN fails to reconstruct unobserved areas of the environment, producing instead what looks like a densified version of observed points.


summaries: This paper studies the use of channel suppression in improving robustness to adversarial examples. The authors make a convincing illustration in section 3 on how adversarial examples tend to activate more channels compared to natural examples, and adversarial training is not effective in reducing them. This provides a convincing motivation to their design of the Channel-wise Activation Suppression (CAS) module. Their CAS module is also effective in improving adversarial robustness when used in conjunction with different adversarial defense methods, including adversarial training, TRADES, and MART.

summaries: This paper investigates the adversarial robustness from the activation perspective. Specifically, the authors analyzed the difference in the magnitude and distribution of activation between adversarial examples and clean examples: the activation magnitudes of adversarial examples are higher and the activation channels are more uniform by adversarial examples. Based on the above interesting findings, the authors claim that different channels of intermediate layers contribute differently to the class prediction and propose a Channel-wise Activation Suppressing (CAS) method to suppress redundant activations, which can improve the DNN robustness.

summaries: The authors studied the behavior of adversarial examples from the channel view of activations, which is very novel. They focused on the magnitude and frequency of activations and found that state-of-the-art adversarial defense (adversarial training) only addressed the magnitude issue but the frequency distribution issue remains. This provided a novel perspective for us to understand why state-of-the-art adversarial training method works to a certain extent but not so good. Then, the authors proposed a Channel-wise Activation Suppressing (CAS) to address the frequency distribution to further improve the adversarial robustness. CAS is generic, effective, and can be easily incorporated into many existing defense methods.

abstractText: The study of adversarial examples and their activation has attracted significant attention for secure and robust learning with deep neural networks (DNNs). Different from existing works, in this paper, we highlight two new characteristics of adversarial examples from the channel-wise activation perspective: 1) the activation magnitudes of adversarial examples are higher than that of natural examples; and 2) the channels are activated more uniformly by adversarial examples than natural examples. We find that the state-of-the-art defense adversarial training has addressed the first issue of high activation magnitudes via training on adversarial examples, while the second issue of uniform activation remains. This motivates us to suppress redundant activation from being activated by adversarial perturbations via a Channel-wise Activation Suppressing (CAS) strategy. We show that CAS can train a model that inherently suppresses adversarial activation, and can be easily applied to existing defense methods to further improve their robustness. Our work provides a simple but generic training strategy for robustifying the intermediate layer activation of DNNs. Code is available at https://github.com/bymavis/CAS_ICLR2021.

authors:
Anish Athalye
Nicholas Carlini
David Wagner

title: Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

authors:
Yang Bai
Yan Feng
Yisen Wang
Tao Dai
Shu-Tao Xia
Yong Jiang

title: Hilbert-based generative defense for adversarial examples

authors:
Nicholas Carlini
David Wagner

title: Towards evaluating the robustness of neural networks

venue: In S&P,

authors:
Francesco Croce
Matthias Hein

title: Minimally distorted adversarial examples with a fast adaptive boundary attack

title: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

authors:
Nilaksh Das
Madhuri Shanbhogue
Shang-Tse Chen
Fred Hohman
Siwei Li
Li Chen
Michael E Kounavis
Duen Horng Chau

title: Compression to the rescue: Defending from adversarial attacks across modalities

authors:
Jacob Devlin
Ming-Wei Chang
Kenton Lee
Kristina Toutanova. Bert

title: Pre-training of deep bidirectional transformers for language understanding

venue: In NAACL,

authors:
Guneet S Dhillon
Kamyar Azizzadenesheli
Zachary C Lipton
Jeremy Bernstein
Jean Kossaifi
Aran Khanna
Anima Anandkumar

title: Stochastic activation pruning for robust adversarial defense

authors:
Ranjie Duan
Xingjun Ma
Yisen Wang
James Bailey
A Kai Qin
Yun Yang

title: Adversarial camouflage: Hiding physical-world attacks with natural styles

authors:
Kevin Eykholt
Ivan Evtimov
Earlence Fernandes
Bo Li
Amir Rahmati
Chaowei Xiao
Atul Prakash
Tadayoshi Kohno
Dawn Song

title: Robust physical-world attacks on deep learning visual classification

authors:
Chris Finlay
Adam Oberman
Bilal Abbasi

title: Improved robustness to adversarial examples using lipschitz regularization of the loss

venue: arXiv preprint arXiv:1810.00953,

authors:
Angus Galloway
Anna Golubeva
Thomas Tanay
Medhat Moussa
Graham W Taylor

title: Batch normalization is a cause of adversarial vulnerability

venue: ICML Workshop,

authors:
Ian J Goodfellow
Jonathon Shlens
Christian Szegedy

title: Explaining and harnessing adversarial examples

venue: In ICLR,

authors:
Shixiang Gu
Luca Rigazio

title: Towards deep neural network architectures robust to adversarial examples

venue: Computer Science,

authors:
Kaiming He
Xiangyu Zhang
Shaoqing Ren
Jian Sun

title: Deep residual learning for image recognition

authors:
Andrew Ilyas
Shibani Santurkar
Dimitris Tsipras
Logan Engstrom
Brandon Tran
Aleksander Madry

title: Adversarial examples are not bugs, they are features

venue: NeurIPS,

authors:
Linxi Jiang
Xingjun Ma
Zejia Weng
James Bailey
Yu-Gang Jiang

title: Imbalanced gradients: A new cause of overestimated adversarial robustness

venue: arXiv preprint arXiv:2006.13726,

authors:
Alex Krizhevsky
Geoffrey Hinton

title: Learning multiple layers of features from tiny images

authors:
Alexey Kurakin
Ian Goodfellow
Samy Bengio

title: Adversarial examples in the physical world, 2016

authors:
Yandong Li
Lijun Li
Liqiang Wang
Tong Zhang
Boqing Gong

title: Nattack: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks

authors:
Fangzhou Liao
Ming Liang
Yinpeng Dong
Tianyu Pang
Xiaolin Hu
Jun Zhu

title: Defense against adversarial attacks using high-level representation guided denoiser

authors:
Yanpei Liu
Xinyun Chen
Chang Liu
Dawn Song

title: Delving into transferable adversarial examples and black-box attacks

authors:
Xingjun Ma
Bo Li
Yisen Wang
Sarah M Erfani
Sudanthi Wijewickrema
Grant Schoenebeck
Dawn Song
Michael E Houle
James Bailey

title: Characterizing adversarial subspaces using local intrinsic dimensionality

authors:
Xingjun Ma
Yuhao Niu
Lin Gu
Yisen Wang
Yitian Zhao
James Bailey
Feng Lu

title: Understanding adversarial attacks on deep learning based medical image analysis systems

venue: Pattern Recognition,

authors:
Laurens van der Maaten
Geoffrey Hinton

title: Visualizing data using t-sne

venue: Journal of Machine Learning Research,

authors:
Divyam Madaan
Sung Ju Hwang

title: Adversarial neural pruning with latent vulnerability suppression

authors:
Aleksander Madry
Aleksandar Makelov
Ludwig Schmidt
Dimitris Tsipras
Adrian Vladu

title: Towards deep learning models resistant to adversarial attacks

authors:
Aamir Mustafa
Salman Khan
Munawar Hayat
Roland Goecke
Jianbing Shen
Ling Shao

title: Adversarial defense by restricting the hidden space of deep neural networks

authors:
Yuval Netzer
Tao Wang
Adam Coates
Alessandro Bissacco
Bo Wu
Andrew Y Ng

title: Reading digits in natural images with unsupervised feature learning

authors:
Nicolas Papernot
Patrick McDaniel
Xi Wu
Somesh Jha
Ananthram Swami

title: Distillation as a defense to adversarial perturbations against deep neural networks

authors:
Adnan Siraj Rakin
Jinfeng Yi
Boqing Gong
Deliang Fan

title: Defend deep neural networks against adversarial examples via fixed anddynamic quantized activation functions

venue: arXiv preprint arXiv:1807.06714,

authors:
Leslie Rice
Eric Wong
J Zico Kolter

title: Overfitting in adversarially robust deep learning

authors:
Karen Simonyan
Andrew Zisserman

title: Very deep convolutional networks for large-scale image recognition

authors:
Abhishek Sinha
Vineeth N Balasubramanian
Harshitha Machiraju

title: Harnessing the vulnerability of latent layers in adversarially trained models

authors:
Christian Szegedy
Wojciech Zaremba
Ilya Sutskever
Joan Bruna
Dumitru Erhan
Ian Goodfellow
Rob Fergus

title: Intriguing properties of neural networks

authors:
Florian Tramer
Nicholas Carlini
Wieland Brendel
Aleksander Madry

title: On adaptive attacks to adversarial example defenses

venue: arXiv preprint arXiv:2002.08347,

authors:
Bao Wang
Alex T Lin
Zuoqiang Shi
Wei Zhu
Penghang Yin
Andrea L Bertozzi
Stanley J Osher

title: Adversarial defense via data dependent activation function and total variation minimization

venue: Inverse Problems and Imaging,

authors:
Haotao Wang
Tianlong Chen
Shupeng Gui
Ting-Kuei Hu
Ji Liu
Zhangyang Wang

title: Once-forall adversarial training: In-situ tradeoff between robustness and accuracy for free

venue: arXiv preprint arXiv:2010.11828,

authors:
Xin Wang
Jie Ren
Shuyun Lin
Xiangming Zhu
Yisen Wang
Quanshi Zhang

title: A unified approach to interpreting and boosting adversarial transferability

authors:
Yisen Wang
Xuejiao Deng
Songbai Pu
Zhiheng Huang

title: Residual convolutional ctc networks for automatic speech recognition

venue: arXiv preprint arXiv:1702.07793,

authors:
Yisen Wang
Xingjun Ma
James Bailey
Jinfeng Yi
Bowen Zhou
Quanquan Gu

title: On the convergence and robustness of adversarial training

authors:
Yisen Wang
Difan Zou
Jinfeng Yi
James Bailey
Xingjun Ma
Quanquan Gu

title: Improving adversarial robustness requires revisiting misclassified examples

authors:
Yandong Wen
Kaipeng Zhang
Zhifeng Li
Yu Qiao

title: A discriminative feature learning approach for deep face recognition

venue: In ECCV,

authors:
Dongxian Wu
Yisen Wang
Shu-Tao Xia
James Bailey
Xingjun Ma

title: Skip connections matter: On the transferability of adversarial examples generated with resnets

authors:
Dongxian Wu
Shu-Tao Xia
Yisen Wang

title: Adversarial weight perturbation helps robust generalization

authors:
Chang Xiao
Peilin Zhong
Changxi Zheng

title: Resisting adversarial attacks by k-winners-take-all

venue: ICLR,

authors:
Cihang Xie
Yuxin Wu
Laurens van der Maaten
Alan L Yuille
Kaiming He

title: Feature denoising for improving adversarial robustness

authors:
Kaidi Xu
Sijia Liu
Gaoyuan Zhang
Mengshu Sun
Pu Zhao
Quanfu Fan
Chuang Gan
Xue Lin

title: Interpreting adversarial examples by activation promotion and suppression

authors:
Hongyang Zhang
Yaodong Yu
Jiantao Jiao
Eric P Xing
Laurent El Ghaoui
Michael I Jordan

title: Theoretically principled trade-off between robustness and accuracy

authors:
Huan Zhang
Tsui-Wei Weng
Pin-Yu Chen
Cho-Jui Hsieh
Luca Daniel

title: Efficient neural network robustness certification with general activation functions

heading: 1 INTRODUCTION

text:
Deep neural networks (DNNs) have become standard models for solving real-world complex problems, such as image classification (He et al., 2016), speech recognition (Wang et al., 2017), and natural language processing (Devlin et al., 2019). DNNs can approximate extremely complex functions through a series of linear (e.g. convolution) and non-linear (e.g. ReLU activation) operations. Despite their superb learning capabilities, DNNs have been found to be vulnerable to adversarial examples (or attacks) (Szegedy et al., 2014; Goodfellow et al., 2015), where small perturbations on the input can easily subvert the model’s prediction. Adversarial examples can transfer across different models (Liu et al., 2017; Wu et al., 2020a; Wang et al., 2021) and remain destructive even in the physical world (Kurakin et al., 2016; Duan et al., 2020), raising safety concerns in autonomous driving (Eykholt et al., 2018) and medical diagnosis (Ma et al., 2021).
Existing defense methods against adversarial examples include input denoising (Liao et al., 2018; Bai et al., 2019), defensive distillation (Papernot et al., 2016), gradient regularization (Gu & Rigazio, 2014), model compression (Das et al., 2018) and adversarial training (Goodfellow et al., 2015; Madry et al., 2018; Wang et al., 2019), amongst which adversarial training has demonstrated the most reliable robustness (Athalye et al., 2019; Croce & Hein, 2020b). Adversarial training is a data augmentation technique that trains DNNs on adversarial rather than natural examples. In adversarial training, natural examples are augmented (or perturbed) with the worst-case perturbations found within a small Lp-norm ball around them. This augmentation has been shown to effectively smooth out the loss landscape around the natural examples, and force the network to focus more on the pixels that are most relevant to the class. Apart from these interpretations, it is still not well understood,
*Equal contribution. †Correspondence to: Yisen Wang (yisen.wang@pku.edu.cn), Shu-Tao Xia (xiast@sz.tsinghua.edu.cn).
ar X
iv :2
10 3.
08 30
7v 1
[ cs
.L G
] 1
1 M
ar 2
02 1
from the activation perspective, how small input perturbations accumulate across intermediate layers to subvert the final output, and how adversarial training can help mitigate such an accumulation. The study of intermediate layer activation has thus become crucial for developing more in-depth understanding and robust DNNs.
In this paper, we show that, if studied from a channel-wise perspective, strong connections between certain characteristics of intermediate activation and adversarial robustness can be established. Our channel-wise analysis is motivated by the fact that different convolution filters (or channels) learn different patterns, which when combined together, describe a specific type of object. Here, adversarial examples are investigated from a new perspective of channels in activation. Different from the existing activation works assuming different channels are of equal importance, we focus on the relationship between channels. Intuitively, different channels of an intermediate layer contribute differently to the class prediction, thus have different levels of vulnerabilities (or robustness) to adversarial perturbations. Given an intermediate DNN layer, we first apply global average pooling (GAP) to obtain the channel-wise activation, based on which, we show that the activation magnitudes of adversarial examples are higher than that of natural examples. This means that adversarial perturbations generally have the signal-boosting effect on channels. We also find that the channels are activated more uniformly by adversarial examples than that by natural examples. In other words, some redundant (or low contributing) channels that are not activated by natural examples, yet are activated by adversarial examples. We show that adversarial training can effectively address the high magnitude problem, yet fails to address the uniform channel activation problem, that is, some redundant and low contributing channels are still activated. This to some extent explains why adversarial training works but its performance is not satisfactory.
Therefore, we propose a new training strategy named Channel-wise Activation Suppressing (CAS), which adaptively learns (with an auxiliary classifier) the importance of different channels to class prediction, and leverages the learned channel importance to adjust the channels dynamically. The robustness of existing state-of-the-art adversarial training methods can be consistently improved if applied with our CAS training strategy. Our key contributions are summarized as follows:
• We identify, from a channel-wise activation perspective, two connections between DNN activation and adversarial robustness: 1) the activation of adversarial examples are of higher magnitudes than that of natural examples; and 2) the channels are activated more uniformly by adversarial examples than that by natural examples. Adversarial training only addresses the first issue of high activation magnitudes, yet fails to address the second issue of uniform channel activation.
• We propose a novel training strategy to train robust DNN intermediate layers via Channelwise Activation Suppressing (CAS). In the training phase, CAS suppresses redundant channels dynamically by reweighting the channels based on their contributions to the class prediction. CAS is a generic intermediate-layer robustification technique that can be applied to any DNNs along with existing defense methods.
• We empirically show that our CAS training strategy can consistently improve the robustness of current state-of-the-art adversarial training methods. It is generic, effective, and can be easily incorporated into many existing defense methods. We also provide a complete analysis on the benefit of channel-wise activation suppressing to adversarial robustness.

heading: 2 RELATED WORK

text:
Adversarial Defense. Many adversarial defense techniques have been proposed since the discovery of adversarial examples. Among them, many were found to have caused obfuscated gradients and can be circumvented by Back Pass Differentiable Approximation (BPDA), Expectation over Transformation (EOT) or Reparameterization (Athalye et al., 2019). Adversarial training (AT) has been demonstrated to be the most effective defense (Madry et al., 2018; Wang et al., 2019; 2020b), which solves the following min-max optimization problem:
min θ max x′∈B (x)
L(F(x′, θ), y), (1)
where, F is a DNN model with parameters θ, x is a natural example with class label y, x′ is the adversarial example within the Lp-norm ball B (x) = {x′ :‖ x′ − x ‖p≤ } centered at x,
F(x′, θ) is the output of the network, and L is the classification loss (e.g. the cross-entropy loss). The inner maximization problem is dependent on the adversarial examples x′ generated within the -ball, while the outer minimization problem optimizes model parameters under the worst-case perturbations found by the inner maximization. There are other variants of adversarial training with some new objective function or regularization. For example, TRADES (Zhang et al., 2019) optimized a trade-off objective of adversarial robustness and accuracy. MART (Wang et al., 2020c) applied a distinctive emphasis on misclassified versus correctly classified examples. AWP (Wu et al., 2020b) incorporated the regularization on the weight loss landscape. However, apart from these improvements, it is still not well understood how adversarial training can help produce stateof-the-art robustness from the activation perspective.
Activation Perspective of Adversarial Robustness. Some previous works have investigated the adversarial robustness from the architecture perspective, such as skip connection (Wu et al., 2020a) and batch normalization (Galloway et al., 2019). As for intermediate activation, Ma et al. (2018) characterized that adversarial activation forms an adversarial subspace that has much higher intrinsic dimensionality. Zhang et al. (2018) certified the robustness of neural networks with different activation functions. Xu et al. (2019) explored the influence of adversarial perturbations on activation from suppression, promotion and balance perspectives. Other works developed new activation operations with the manifold-interpolating data-dependent function (Wang et al., 2020a) and adaptive quantization techniques (Rakin et al., 2018). While these works directly modify the activation functions, there are also works focusing on the activation outputs. For instance, k-Winner-Takes-All (kWTA) (Xiao et al., 2020) taked the largest k feature values in each activation layer to enhance adversarial robustness. However, this has recently been shown not robust against adaptive attacks (Tramer et al., 2020). Stochastic Activation Pruning (SAP) (Dhillon et al., 2018) taked the randomness and the value of features into consideration. Each activation is chosen with a probability proportional to its absolute value. Adversarial Neural Pruning (ANP) (Madaan & Hwang, 2020) pruned out the features that are vulnerable to adversarial inputs using Bayesian method. Prototype Conformity Loss (PCL) (Mustafa et al., 2019) was proposed to cluster class-wise features and push class centers away from each other. Feature Denoising (FD) (Xie et al., 2019) added denoising layers to the network for sample-wise denoising on feature maps. However, these methods were developed based on observations on the full output (e.g. the entire feature or activation map that does not distinguish different channels) of DNN intermediate layers. In contrast, our CAS explores both channel importance and channel correlations, and the suppressing is done with the guidance of the labels.

heading: 3 CHANNEL-WISE ACTIVATION AND ADVERSARIAL ROBUSTNESS

text:
In this part, we investigate two characteristics of DNN intermediate activation from a channel-wise perspective, and show two empirical connections between channel-wise activation and adversarial robustness. Specifically, we train ResNet-18 (He et al., 2016) and VGG16 (Simonyan & Zisserman, 2014) on CIFAR-10 (Krizhevsky et al., 2009) using both standard training and adversarial training under typical settings. We then apply global average pooling to extract the channel-wise activation from the penultimate layer. We investigate the extracted channel-wise activation of both natural and adversarial examples from two perspectives: 1) the magnitude of the activation, and 2) the activation frequency of the channels.
Channel-wise Activation Magnitude. Figure 1 illustrates the averaged activation magnitudes for both natural test examples and the corresponding adversarial examples crafted by PGD-20 attack (Madry et al., 2018). For standard models (trained on natural examples), the activation magnitudes of adversarial examples are generally higher than that of natural examples as shown in Figure 1(a)/1(c). Adversarial perturbation exhibits a clear signal-boosting effect on the channels, which leads to the accumulation of adversarial distortions from the input to the output layer of the network. As shown in Figure 1(b)/1(d), adversarial training can effectively narrow the magnitude gaps between natural and adversarial examples, interestingly by decreasing the activation magnitudes of adversarial examples. This is because adversarial training can restrict the Lipschiz constant of the model at deeper layers (i.e. layers close to the output), which reduces the magnitude gaps caused by adversarial perturbations (Finlay et al., 2018; Sinha et al., 2019). Note that network architecture also influences activation magnitudes. Figure 1 show that magnitudes in VGG have much more zero values than those in ResNet, i.e. VGG produces more sparse channels than ResNet.
Channel-wise Activation Frequency. Given a specific class, different convolution filters learn different patterns associated with the class. Similar to the robust vs. non-robust feature differentiation in adversarial training (Ilyas et al., 2019), the intermediate filters (or channels) can also be robust or non-robust. Intuitively, for natural examples in the same class, robust channels produce more generic patterns and should be activated more frequently, yet the non-robust ones should be activated less frequently. As such, non-robust channels can cause more variations to the next layer if activated by adversarial perturbations, increasing the vulnerability to adversarial examples. To investigate this, we visualize the activation frequency of the channel-wise activation in Figure 2. Here, we take one specific class (e.g. class 0) of CIFAR-10 as an example. A channel is determined as activated if its activation value is larger than a threshold (e.g. 1% of the maximum activation value over all 512 channels). We count the activation frequency for each channel by natural examples and their PGD adversarial examples separately on standard or adversarially trained ResNet-18 models, and sort the channels in a descending order according to the activation frequency by natural examples. As can be observed in Figure 2(a), adversarial examples activate the channels more uniformly, and they tend to frequently activate those that are rarely activated by natural examples (e.g. the right region in Figure 2(a)). This observation is consistent across different classes. The low frequency channels are non-robust channels, and correspond to those redundant activation that are less important for the class prediction. It can also be observed that adversarial perturbations also inhibit those high frequency channels of natural examples (the left region of Figure 2(a)). Figure 2(b) shows that, by training on adversarial examples, adversarial training can force the channels to be activated in a similar frequency by both natural and adversarial examples. However, there are still a certain proportion of the redundant channels (e.g. channels #350 - #500) that are activated by adversarial examples. This motivates us to propose a Channel-wise Activation Suppressing (CAS) training strategy to avoid those redundant channels from being activated by adversarial examples. Figure 2(c) shows the effectiveness of our CAS strategy applied with adversarial training, that is, our CAS can suppress all channels, especially those low frequency ones on natural examples. More visualizations of channel-wise activation frequency can be found in Appendix C.

heading: 4 PROPOSED CHANNEL-WISE ACTIVATION SUPPRESSING

text:
In this section, we introduce our Channel-wise Activation Suppressing (CAS) training strategy, which dynamically learns and incorporates the channel importance (to the class prediction) into the training phase to train a DNN model that inherently suppresses those less important channels.
Overview. Figure 3 illustrates our CAS training strategy. The CAS module consists of a global average pooling operation (i.e. GAP in the CAS module) to obtain the channel-wise activation, and an auxiliary classifier (i.e. FC in the CAS module) to learn the channel importance. The learned channel importance is then multiplied back to the original activation for adjustment, and the adjusted activation are then passed into the next layer for model training. The entire network and the auxiliary classifier are trained simultaneously using a combination of the CAS loss and the CE loss. The CAS module can be attached to any intermediate layer of a DNN.

heading: 4.1 CAS MODULE

text:
Denote the l-th activation layer output of network F as f l ∈ RH×W×K , where H,W,K represent the height, width, channel of the activation map, respectively. In CAS module, we first apply the GAP operation on the raw activation f l to obtain the channel-wise activation f̂ l ∈ RK . Formally, for the k-th channel,
f̂ lk = 1
H ×W H∑ i=1 W∑ j=1 f lk(i, j). (2)
The channel-wise activation f̂ l is then passed into the auxiliary classifier to perform multi-class classification with a fully-connected (FC) layer. For C classes, the parameters of the auxiliary classifier can be written as M l = [M l1,M l 2, ..,M l C ] ∈ RK×C , which can identify the importance of each channel to a specific class, and will be applied to reweight the original activation f l in a channel-wise manner. In the training phase, the ground-truth label y is utilized as the index to determine the channel importance, i.e. M ly ∈ RK . While in the test phase, since the ground-truth label is not available, we simply take the weight component M lŷl ∈ R
K that is associated to the predicted class ŷl as the channel importance (detailed analysis can be found in Section 5.1). The computed channel importance is then applied to reweight the original activation map f l as follows:
f̃ l = { f l ⊗M ly, (training phase) f l ⊗M lŷl , (test phase) , (3)
where ⊗ represents the channel-wise multiplication. The adjusted f̃ l will be passed into the next layer via forward propagation. Note that, so far, neither the auxiliary nor the network is trained, just computing the channel importance and adjusting the activation in a channel-wise manner.

heading: 4.2 MODEL TRAINING

text:
We can insert S Channel-wise Activation Suppressing (CAS) modules into S different intermediate layers of DNNs. The CAS modules can be considered as auxiliary components of the network, and can be trained using standard training or different types of adversarial training. Here, we take the
original adversarial training (Madry et al., 2018) as an example, and define the loss functions to simultaneously train the network and our CAS modules. Each of our CAS modules has a FC layer. Taking one inserted CAS module after the l-th activation layer of network F for examples, the CAS loss function can then be defined as,
LCAS(p̂l(x′, θ,M), y) = − C∑ c=1 1{c = y} · log p̂lc(x′), (4)
whereC is the number of classes, p̂l = softmax(f̂ lM l) ∈ RC is the prediction score of the classifier in CAS module, and x′ is the adversarial example used for training. Note that LCAS is the cross entropy loss defined on the auxiliary classifier. Similarly, it can also be extended to multiple CAS modules. The overall objective function for adversarial training with our CAS strategy is:
L(x′, y; θ,M) = LCE(p(x′, θ), y) + β S · S∑ s=1 LsCAS(p̂s(x′, θ,M), y) (5)
where β is a tunable parameter balancing the strength of CAS. Besides the original adversarial training (AT) (Madry et al., 2018), we can also combine CAS with other defense techniques such as TRADES (Zhang et al., 2019) and MART (Wang et al., 2020c). In Appendix B, we summarize the loss functions of the original AT, TRADES, MART, and their combined versions with our CAS. The complete training procedure of our CAS is described in Algorithm 1 in Appendix A.

heading: 5 EXPERIMENTS

text: In this section, we first provide a comprehensive understanding of our CAS training strategy, then evaluate its robustness on benchmark datasets against various white-box and black-box attacks.

heading: 5.1 EMPIRICAL UNDERSTANDING OF CAS

text:
In this part, we first show the channel-suppressing effect and robustness of our CAS, then analyze the effectiveness of our CAS when applied at different layers of DNN. The parameter analysis of CAS can be found in Appendix D. In Appendix E, we show that CAS can also help representation learning and natural training.
Experimental Settings. We adversarially train ResNet-18 for 200 epochs on CIFAR-10 using SGD with momentum 0.9, weight decay 2e-4, and initial learning rate 0.1 which is divided by 10 at 75-th and 90-th epoch. We use PGD-10 ( = 8/255 and step size 2/255) with random start for training. The robustness (accuracy on adversarial examples) is evaluated under attacks: FGSM (Goodfellow et al., 2015), PGD-20 (Madry et al., 2018), and CW∞ (Carlini & Wagner, 2017) optimized by PGD.
Channel Suppressing Effect. We compare CAS with three activation- or feature-based defense methods: kWTA (Xiao et al., 2020), SAP (Dhillon et al., 2018) and PCL (Mustafa et al., 2019). Here, we train kWTA with 20% sparse largest values in each activation layer, SAP with typical random pruning and PCL with warm-up training by CE loss and then fine-tuning with the added PCL loss. Figure 4 shows the activation frequencies at the penultimate layer of ResNet-18 trained by different methods. While kWTA, SAP and PCL demonstrate a certain level of channel suppressing, their effects are not as significant as our CAS training. kWTA and SAP hardly have the channel suppressing effect (e.g. channel #350 - #500 in Figure 4(a) and channel #380 - #500 in Figure
4(b)), for the reason that they improve robustness mainly by introducing certain randomness into the activation, and thus can be easily attacked by some adaptive attacks (Tramer et al., 2020; Athalye et al., 2019). PCL still frequently activates many redundant channels (e.g. channel #150 - #250 in Figure 4(c)). This is because PCL does not directly enforce channel suppression. Different from these methods, our CAS demonstrates the most effective channel suppression. As a side note, due to the dynamic thresholding, the frequency distributions should be compared within the same model between natural and adversarial examples not across different models. Within the same model, the closer the frequency distribution of the adversarial examples is to that of the natural examples, the better the adversarial robustness (i.e. the adversarial accuracy is closer to the natural accuracy).
From this point of view, our CAS can effectively reduce the activation frequency gaps between natural and adversarial examples, producing superior robustness. The natural accuracy and robustness of these methods are reported in Table 1. Due to the randomness introduced in kWTA and SAP, they are not robust against average PGD (Avg-PGD) using margin loss (Tramer et al., 2020) or Expectation Over Transformation (EOT) (Athalye et al., 2019) attacks. Our CAS training strategy does not rely on randomness, thus is robust even against Avg-PGD or EOT attacks.
We next verify that explicit Channel Suppressing (CS) is indeed essential to the improved robustness of CAS. Specifically, we remove CS defined in Equation 3 from CAS, then retrain ResNet-18 using adversarial training with the CAS loss defined in Equation 5. Table 2 shows that the robustness can not be improved without explicit channel suppressing.
CAS at Different Layers. We insert the CAS module into different blocks of ResNet-18, and show the different robustness improvements in Table 3. Intuitively, deeper layer activation are more correlated to the class prediction, thus should benefit more from our CAS training. Shallow layers, however, may suffer from inaccurate channel importance estimations. As demonstrated in Table 3, it is indeed the case: the largest improvement is obtained when applying CAS at Block4 (e.g. after the ReLU output of Block4). The robustness can also be improved when inserting CAS into Block3 or both the Block3 and Block4 (‘Block3+4’), though notably less significant than that at Block4.
Robustness of the CAS Module. Since our CAS module suppresses channel-wise activation according to the label (during training) or the prediction (during testing), it might raise the concerns of
whether the CAS module itself is robust or how the misclassification in CAS module would affect the final results. One observation is that, when the CAS module is inserted to deep layers that are close to the final layer of the network, it can learn to make very similar predictions with the final layer. For an empirical analysis, we test the robustness of the CAS module against different attacks in Table 4. The results indicate that our CAS module is robust by itself, leading to both higher natural accuracy and adversarial robustness. More evaluations can be found in Appendix F.5.

heading: 5.2 ROBUSTNESS EVALUATION

text:
In this section, we evaluate our CAS on CIFAR-10 (Krizhevsky et al., 2009) and SVHN (Netzer et al., 2011) datasets with ResNet-18 (He et al., 2016). We apply our CAS training strategy to several state-of-the-art adversarial training approaches: 1) AT (Adversarial Training) (Madry et al., 2018), 2) TRADES (Zhang et al., 2019), and 3) MART (Wang et al., 2020c). We follow the default settings as stated in their papers. More results on WideResNet-34-10 (Zagoruyko & Komodakis, 2016) and VGG16 (Simonyan & Zisserman, 2014) can be found in Appendix F.1 and F.2.
Experimental Settings. The training settings for CIFAR-10 are the same as Section 5.1. For SVHN, we adversarially train ResNet-18 using SGD with momentum 0.9, weight decay 5e-4, initial learning rate 0.01 which is divided by 10 at 75-th and 90-th epoch, and training attack PGD-10 ( = 8/255 and step size 1/255) with random start.
White-box Robustness. We evaluate the robustness of all defense models against three types of white-box attacks: FGSM, PGD-20 (step size /10) and CW∞ (optimized by PGD). To fairly compare our method with baselines, we use adaptive white-box attack for our CAS models, i.e. the attacks are performed on the joint loss of CE and CAS. Here, we report the robustness of the models obtained at the last training epoch in Table 5. As shown in Table 5, our CAS can improve both the natural accuracy and the robustness of all baseline methods, resulting in noticeably better robustness. The improvement against CW∞ attack is more significant than against FGSM or PGD-20 attacks. This is because the prediction margins are enlarged by our CAS training with the channel suppression. As shown in Figure 9 (Appendix E), the deep representations learned by CAS-trained models are more compact within each class, while are more separated across different classes. This makes margin-based attacks like CW∞ more difficult to success.
Robustness results obtained at the best checkpoint throughout the entire training process and the learning curves are provided in Appendix F.3. Our CAS can also improve the robustness of the best checkpoint model for each baseline defense. Thus the improvement of our CAS is reliable and consistent, and is not caused by the effect of overfitting (Rice et al., 2020). We have also evaluated our CAS training strategy under AutoAttack (Croce & Hein, 2020b) and different attack perturbation budget in Appendix F.4 and F.5.
Black-box Robustness. We evaluate the black-box robustness of CAS and the baseline methods against both transfer and query-based attacks. For transfer attack, the adversarial examples are generated on CIFAR-10/SVHN test images by applying PGD-20 and CW∞ attacks on a naturally trained ResNet-50. For query-based attack, we adopt NAttack (Li et al., 2019). Since NAttack requires a lot of queries, we randomly sample 1,000 images from CIFAR-10/SVHN test set and limit the maximum query to 20,000. We test both black-box attacks on the models obtained at the last training epoch. The results are reported in Table 6. For both transfer and query-based attacks, our CAS can improve the robustness of all defense models by a considerable margin. Especially against the NAttack, our CAS training strategy can improve AT, TRADES and MART by ∼ 30% - 40%. One reason why our CAS is particularly more effective against NAttack is that NAttack
utilizes a similar margin objective function as CW∞, which can be effectively blocked by channel suppressing.

heading: 6 CONCLUSION

text: In this paper, we investigated intermediate activation of deep neural networks (DNNs) from a novel channel-wise perspective, in the context of adversarial robustness and adversarial training. We highlight two new characteristics of the channels of adversarial activation: 1) higher magnitude, and 2) more uniform activation frequency. We find that standard adversarial training improves robustness by addressing the first issue of the higher magnitude, however, it fails to address the second issue of the more uniform activation frequency. To overcome this, we proposed the Channel-wise Activation Suppressing (CAS), which dynamically learns the channel importance and leverages the learned channel importance to suppress the channel activation in the training phase. When combined with adversarial training, we show that, CAS can train DNNs that inherently suppress redundant channels from being activated by adversarial examples. Our CAS is a simple but generic training strategy that can be easily plugged into different defense methods to further improve their robustness, and can be readily applied to robustify the intermediate layers of DNNs.

heading: ACKNOWLEDGEMENT

text: Yisen Wang is partially supported by the National Natural Science Foundation of China under Grant 62006153, and CCF-Baidu Open Fund (OF2020002). Shu-Tao Xia is partially supported by the National Key Research and Development Program of China under Grant 2018YFB1800204, the National Natural Science Foundation of China under Grant 61771273, the R&D Program of Shenzhen under Grant JCYJ20180508152204044.

heading: A ALGORITHM OF CAS TRAINING

text:
Algorithm 1 Robust Training with CAS. Input: Training data {xi, yi}i=1,2,...,n, DNN F(θ), CAS modules with parameters M , maximum
training epochs T Output: Robust Network F
1: for t in [1, 2, · · · , T ] do 2: for minibatch {x1, · · · ,xb} do 3: Generate adversarial examples using PGD attack on Equation 5 4: Compute the CAS loss in Equation 4 using the channel-wise activation f̂ l
5: Reweight the original features f̃ l = f l ⊗M ly using the parameters M ly in CAS 6: Forward with the adjusted f̃ l and compute the CE loss at the output layer 7: end for 8: Optimize all parameters (θ,M ) by Equation 5 using gradient descent 9: end for

heading: B A SUMMARY OF THE ADVERSARIAL LOSS FUNCTIONS USED WITH CAS

text: When combined with our CAS, the training loss is a combination of the original adversarial loss and our CAS loss. Table 7 defines the exact loss functions used for AT (Madry et al., 2018), TRADES (Zhang et al., 2019), MART (Wang et al., 2020c) and their CAS enhanced versions. Here, we assume the CAS module is attached to S number of layers of the network. p̂s and Ms denote the prediction score and weights of the auxiliary classifier in the s-th CAS module, respectively.

heading: C CHANNEL-WISE ACTIVATION SUPPRESSING ON MORE DATASETS AND DEFENSE MODELS

text:
Here, we visualize the channel suppressing effect of our CAS training strategy on more defense models: TRADES (Zhang et al., 2019) and MART (Wang et al., 2020c). We train ResNet-18 (He et al., 2016) on CIFAR-10 (Krizhevsky et al., 2009). The CAS modules are attached to the final block of ResNet-18.
Figure 5 illustrates the channel activation frequencies of the original defense models and their improved versions with our CAS. As can be observed, our CAS can suppress the redundant channels consistently in both defense models. This restricts the channel-wise activation to be more classcorrelated. More importantly, the channel activation are suppressed to a similar frequency distribution between the natural and the adversarial examples.
We further compare the channel-wise activation of natural versus adversarial examples on SVHN and ImageNet in Figure 6 and Figure 7. For SVHN, we choose examples of class 0 and construct the adversarial examples by PGD-20 with = 8/255. We count the channel activation frequency of naturally trained, adversarially trained and CAS trained models. As shown in Figure 6, neurons #200 - #500 in Figure 6(a) and neurons #250 - #400 in Figure 6(b), are frequently activated by adversarial examples while in Figure 6(c), our CAS can effectively suppress these redundant activation.
For ImageNet, as it is extremely time consuming to perform adversarial training, we adopt the standard pre-trained ResNet-152 from torchvision.models * and an adversarially trained ResNet-152 from the Github repository†. We select 5,900 dog images from the validation set of ImageNet (class #151-#269) and generate the adversarial examples using PGD-30 ( =16/255, α=1/255). We count the channel activation at the penultimate layer of ResNet-152. It can be observed in Figure 7(a) that adversarial examples activate more uniformly than natural examples. While in Figure 7(b), adversarially trained models can align the activation distribution of the natural examples with that of the adversarial examples to some extent, however, the activation frequencies of the adversarial examples are still higher than that of the natural examples. This indicates that there are still redundant channels and non-robust features in this adversarially trained ResNet-152 model.
*https://pytorch.org/docs/stable/torchvision/models.html †https://github.com/facebookresearch/ImageNet-Adversarial-Training
D SENSITIVITY OF CAS TO PARAMETER β
As mentioned in Section 4, the parameter β on the CAS loss controls the suppressing strength. To test the sensitivity of CAS training under different β, we insert a CAS module to Block4 of ResNet18, and train the network on CIFAR-10 using AT+CAS under β ∈ [0, 0.5, 1, 2, 5, 10, 20]. Note that β = 0 indicates the standard adversarial training (AT). We test the robustness of the models in a white-box setting against FGSM, PGD-20 and CW∞. As shown in Figure 8, the models trained with larger β are generally more robust, especially against the CW∞ attack. This is because larger β increases the strength of channel suppressing, leading to larger inter-class margins. As we further show in Figure 9, the representations learned with CAS are more separated between different classes, and are more compact within the same class. This tends to increase the difficulty of margin-based attacks like white-box CW∞ attack and black-box N attack.

heading: E CAS IMPROVES REPRESENTATION LEARNING

text: The representations learned by natural or adversarial training with or without our CAS strategy are illustrated in Figure 9. The t-SNE (Maaten & Hinton, 2008) 2D embeddings are computed on deep features extracted at the penultimate layer of ResNet-18 on CIFAR-10. As can be observed, our CAS training improves representation learning for both natural training and adversarial training. This is largely attributed to the strong channel suppressing capability of our CAS training. Channel suppressing helps learn high-quality representations with high inter-class separation and intra-class compactness. Interestingly, our CAS training can even improve the performance of natural training from 92.75% to 94.56%. This implies that our CAS is a generic training strategy that can benefit both model training and representation learning. Although CAS is not a direct regularization technique, it can achieve a similar representation regularization effect as existing representation enhancing techniques like the center loss (Wen et al., 2016).

heading: F MORE EXPERIMENTAL RESULTS

text:
F.1 WIDERESNET RESULTS ON CIFAR-10
The white-box robustness of WideResNet-34-10 (Zagoruyko & Komodakis, 2016) models trained using AT, AT+CAS, TRADES, TRADES+CAS, MART and MART+CAS are reported in Table 8. We attach the CAS module to the last two convolution layers of the network, and set β = 2. The training settings are the same as used for ResNet-18, except that, here we use weight decay 5e-4. The ‘best’ and ‘last’ results indicate the best and last checkpoints, respectively. For our CAS, we generate the attacks using the same adaptive white-box attacks as used in Section 5.2. The robustness of AT, TRADES and MART can be consistently improved by our CAS training. The most improvements are achieved on AT. These results confirm that our CAS training can lead to consistent improvements to different adversarial training methods on more complex models.
F.2 VGG16 RESULTS ON CIFAR-10
Similar to the above WideResNet experiments, here we report the results of VGG16 (Simonyan & Zisserman, 2014) on CIFAR-10 in Table 9. For VGG16, we attach the CAS module to its last three convolution layers, and set β = 3. We can see that our CAS training can enhance the robustness of ‘best’ models by a remarkable margin of 7%-10%. Note that the accuracy of natural training is also improved by a considerable margin. Compared with complex models like WideResNet, our CAS training is even more beneficial for small capacity models (e.g. VGG16).
F.3 ROBUSTNESS RESULTS AT THE BEST CHECKPOINT
We report the white-box robustness of the ‘best’ (i.e. the best checkpoint) models of ResNet-18 on SVHN and CIFAR-10 in Table 10, as a supplementary to the ‘last’ (i.e. the last checkpoint) results in Table 5. Again, our CAS can also improve the robustness of the ‘best’ checkpoint models consistently. This proves that our CAS can improve both the robustness and the natural accuracy throughout the entire training process.
F.4 ROBUSTNESS AGAINST AUTOATTACK
We report the white-box AutoAttack (Croce & Hein, 2020b) evaluation results of ResNet-18 on CIFAR-10 in Table 11. AutoAttack is an ensemble of two proposed Auto-PGD attacks and the other two complementary attacks (Croce & Hein, 2020a). AutoAttack has been shown can produce more accurate robustness evaluations on a wide range of adversarial training defenses. As shown in Table 11, although less significant than against regular attacks like PGD and CW, CAS with proper training can still improve the robustness of AT, TRADES and MART by a noticeable margin. This confirms that the improvements brought by our CAS training is ‘real’ and substantial, rather than obfuscated gradients nor improper evaluation.
F.5 MORE ROBUSTNESS EVALUATIONS OF CAS
The robustness of the CAS module is further evaluated in this section. By producing large margins, the CAS module and the channel suppression operation can make more boundary adversarial examples be correctly classified than that in the baseline models. However, this may also increase the risk of causing imbalanced margin and imbalanced gradients. To test this, we evaluate CAS against a recent Margin Decomposition (MD) attack (Jiang et al., 2020). We use the default setting of MD attack as stated in the original paper. The results are reported in Table 12, where it shows our CAS is robust against the MD attack. We also test our CAS against PGD-20 with step size /10 and various attack strengths. This result is presented in Table 13. The robustness of CAS decreases with the increase of , which proves that the robustness of CAS is not a result of obfuscated gradients.
F.6 CHANNEL ACTIVATION FREQUENCY UNDER DIFFERENT THRESHOLDS
In Figure 2, we have shown the activation frequency of standard training (STD), adversarial training (AT) and CAS-based adversarial training (AT+CAS) on a ResNet-18 model with the threshold of 1%. That is, a channel is determined as activated if its activation count is larger that 1% of the maximum activation count over all 512 channels. In Figure 10, we show the distribution of activation frequency under different thresholds (e.g. 0.5%, 1%, 5%). Larger threshold will truncate more low-count activation. The plots show that different thresholds will introduce some noise to the distributions but the general patterns do not change.

title: CHANNEL-WISE ACTIVATION SUPPRESSING