title: Shape Defense
abstract: Humans rely heavily on shape information to recognize objects. Conversely, convolutional
  neural networks (CNNs) are biased more towards texture. This fact
  is perhaps the main reason why CNNs are susceptible to adversarial examples.
  Here, we explore how shape bias can be incorporated into CNNs to improve their
  robustness. Two algorithms are proposed, based on the observation that edges are
  invariant to moderate imperceptible perturbations. In the first one, a classifier is
  adversarially trained on images with the edge map as an additional channel. At
  inference time, the edge map is recomputed and concatenated to the image. In the
  second algorithm, a conditional GAN is trained to translate the edge maps, from
  clean and/or perturbed images, into clean images. The inference is done over the
  generated image corresponding to the input’s edge map. A large number of experiments
  with more than 10 data sets have proved the effectiveness of the proposed
  algorithms against FGSM and `1 PGD-40 attacks. against FGSM and `$\ell_\infty$ PGD-40 attacks. 
  Further, we show that edge information can a) benefit other adversarial training methods, b) be even more effective
  in conjunction with background subtraction, c) be used to defend against poisoning
  attacks, and d) make CNNs more robust against natural image corruptions
  such as motion blur, impulse noise, and JPEG compression, than CNNs trained
  solely on RGB images. From a broader perspective, our study suggests that CNNs
  do not adequately account for image structures and operations that are crucial for
  robustness. The code is available at: https://github.com/[masked].
authors: ali borji
hIndex: ali borji 46