Leveraging Adversarial Examples to Obtain Robust Second-Order Representations
Deep neural networks represent data as projections on trained weights in a high dimensional manifold. This is a first-order based absolute representation that is widely used due to its interpretable nature and simple mathematical functionality. However, in the application of visual recognition, first-order representations trained on pristine images have shown a vulnerability to distortions. Visual distortions including imaging acquisition errors and challenging environmental conditions like blur, exposure, snow and frost cause incorrect classification in first-order neural nets. To eliminate vulnerabilities under such distortions, we propose representing data points by their relative positioning in a high dimensional manifold instead of their absolute positions. Such a positioning scheme is based on a data point’s second-order property. We obtain a data point’s second-order representation by creating adversarial examples to all possible decision boundaries and tracking the movement of corresponding boundaries. We compare our representation against first-order methods and show that there is an increase of more than 14% under severe distortions for ResNet-18. We test the generalizability of the proposed representation on larger networks and on 19 complex and real-world distortions from CIFAR-10-C. Furthermore, we show how our proposed representation can be used as a plug-in approach on top of any network. We also provide methodologies to scale our proposed representation to larger datasets.
This paper presents a method to represent input points by their relative positions to decisions boundaries using an adversarial attack instead of the more usual output of a deep model (before the last linear classification layer). The motivation of the method is to obtain representations that are more robust to input distortions such as blur, noise, over-exposure, etc. More specifically, the representation obtained by a deep model before the last linear classification layer (f_L) is replaced by a concatenation of the perturbation needed for that representation to be misclassified by f_L. Using this new representation, they are able to obtain more robust classifiers against input perturbations. This paper should be rejected for several reasons. First, the motivation of the paper is unclear; while being more robust to input perturbations is a desirable property of ML models, the reason to use these second-order representations is not justified. Second, the paper contains several imprecisions about the methodology, which make it complicated to follow. Finally, the presented results are not very convincing; it seems that most of the improvement obtained comes from deriving a larger representation of each sample and using a MLP to classify it instead of a simple linear layer. Detailed arguments: It is not clear how r_i is obtained in section 3. This becomes even more confusing in section 5.3, when the features are instead generated as the gradient of the loss with respect to f_{L-1}. To the best of my understanding, r_i is supposed to be the distance between a point (before the final layer) to the decision boundary for class i. If we have x_k, the input which yields the closest point to the decision boundary of class i (as depicted in Fig 3.(b)), then we should have . However, r_i is defined as . In this formula, the absolute value clearly changes the direction of the gradient. It would be appreciated to have a clear explanation for the reason of the absolute value. The paper contains incorrect statements about standard adversarial attacks. FGSM is a one-step attack, and it does not make sense to do several iterations of it. A more powerful multi-step attack that can be considered is PGD. A lot of emphasis is put on the fact that the obtained representations might be too large to scale well to datasets where there are more classes than the ones considered in the article. However, there are no experiments to support this - the experiments in the paper do not go beyond 10 classes. Additional comments: Some citations need to be fixed, removed or changed: Second paragraph of the introduction: “[...] can discriminate between classes (Goodfellow et al., 2016)(Krizhevsky et al., 2012)(He et al., 2016).” Deep neural nets were not initially proposed in these papers, so it is somehow inappropriate to cite these papers here (except, maybe, Krizhevsky*12). Third paragraph of the introduction: “[...] the representations (fL?1) are linearly projected (Wang et al., 2019).” Same here. The main figures to explain the idea are not really helping the argument: Figure 1. (b) is simply Fig 1. (a) rotated 180 degrees and re-scaled, but the information is essentially the same; maybe not the best example. Figure 2: the provided t-SNE projections do not show a clear advantage of the proposed method. A quantitative analysis would better support the argument. The time measurement given in section 3 is not indicative: what are the 320s? An indication in terms of epochs or training iterations would be better. It would be appreciated to have measures of standard deviations for the results especially in tables 1 and 2 since some results are very close and might depend mostly on random perturbations. Moreover, it is not mentioned for which datasets these tables are for.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Leveraging Adversarial Examples to Obtain Robust Second-Order Representations
Deep neural networks represent data as projections on trained weights in a high dimensional manifold. This is a first-order based absolute representation that is widely used due to its interpretable nature and simple mathematical functionality. However, in the application of visual recognition, first-order representations trained on pristine images have shown a vulnerability to distortions. Visual distortions including imaging acquisition errors and challenging environmental conditions like blur, exposure, snow and frost cause incorrect classification in first-order neural nets. To eliminate vulnerabilities under such distortions, we propose representing data points by their relative positioning in a high dimensional manifold instead of their absolute positions. Such a positioning scheme is based on a data point’s second-order property. We obtain a data point’s second-order representation by creating adversarial examples to all possible decision boundaries and tracking the movement of corresponding boundaries. We compare our representation against first-order methods and show that there is an increase of more than 14% under severe distortions for ResNet-18. We test the generalizability of the proposed representation on larger networks and on 19 complex and real-world distortions from CIFAR-10-C. Furthermore, we show how our proposed representation can be used as a plug-in approach on top of any network. We also provide methodologies to scale our proposed representation to larger datasets.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



This paper presents a method to represent input points by their relative positions to decisions boundaries using an adversarial attack instead of the more usual output of a deep model (before the last linear classification layer). The motivation of the method is to obtain representations that are more robust to input distortions such as blur, noise, over-exposure, etc. More specifically, the representation obtained by a deep model before the last linear classification layer (f_L) is replaced by a concatenation of the perturbation needed for that representation to be misclassified by f_L. Using this new representation, they are able to obtain more robust classifiers against input perturbations. This paper should be rejected for several reasons. First, the motivation of the paper is unclear; while being more robust to input perturbations is a desirable property of ML models, the reason to use these second-order representations is not justified. Second, the paper contains several imprecisions about the methodology, which make it complicated to follow. Finally, the presented results are not very convincing; it seems that most of the improvement obtained comes from deriving a larger representation of each sample and using a MLP to classify it instead of a simple linear layer. Detailed arguments: It is not clear how r_i is obtained in section 3. This becomes even more confusing in section 5.3, when the features are instead generated as the gradient of the loss with respect to f_{L-1}. To the best of my understanding, r_i is supposed to be the distance between a point (before the final layer) to the decision boundary for class i. If we have x_k, the input which yields the closest point to the decision boundary of class i (as depicted in Fig 3.(b)), then we should have . However, r_i is defined as . In this formula, the absolute value clearly changes the direction of the gradient. It would be appreciated to have a clear explanation for the reason of the absolute value. The paper contains incorrect statements about standard adversarial attacks. FGSM is a one-step attack, and it does not make sense to do several iterations of it. A more powerful multi-step attack that can be considered is PGD. A lot of emphasis is put on the fact that the obtained representations might be too large to scale well to datasets where there are more classes than the ones considered in the article. However, there are no experiments to support this - the experiments in the paper do not go beyond 10 classes. Additional comments: Some citations need to be fixed, removed or changed: Second paragraph of the introduction: “[...] can discriminate between classes (Goodfellow et al., 2016)(Krizhevsky et al., 2012)(He et al., 2016).” Deep neural nets were not initially proposed in these papers, so it is somehow inappropriate to cite these papers here (except, maybe, Krizhevsky*12). Third paragraph of the introduction: “[...] the representations (fL?1) are linearly projected (Wang et al., 2019).” Same here. The main figures to explain the idea are not really helping the argument: Figure 1. (b) is simply Fig 1. (a) rotated 180 degrees and re-scaled, but the information is essentially the same; maybe not the best example. Figure 2: the provided t-SNE projections do not show a clear advantage of the proposed method. A quantitative analysis would better support the argument. The time measurement given in section 3 is not indicative: what are the 320s? An indication in terms of epochs or training iterations would be better. It would be appreciated to have measures of standard deviations for the results especially in tables 1 and 2 since some results are very close and might depend mostly on random perturbations. Moreover, it is not mentioned for which datasets these tables are for.
assistant
This paper presents a method to represent input points by their relative positions to decisions boundaries using an adversarial attack instead of the more usual output of a deep model (before the last linear classification layer). The motivation of the method is to obtain representations that are more robust to input distortions such as blur, noise, over-exposure, etc. More specifically, the representation obtained by a deep model before the last linear classification layer (f_L) is replaced by a concatenation of the perturbation needed for that representation to be misclassified by f_L. Using this new representation, they are able to obtain more robust classifiers against input perturbations. This paper should be rejected for several reasons. First, the motivation of the paper is unclear; while being more robust to input perturbations is a desirable property of ML models, the reason to use these second-order representations is not justified. Second, the paper contains several imprecisions about the methodology, which make it complicated to follow. Finally, the presented results are not very convincing; it seems that most of the improvement obtained comes from deriving a larger representation of each sample and using a MLP to classify it instead of a simple linear layer. Detailed arguments: It is not clear how r_i is obtained in section 3. This becomes even more confusing in section 5.3, when the features are instead generated as the gradient of the loss with respect to f_{L-1}. To the best of my understanding, r_i is supposed to be the distance between a point (before the final layer) to the decision boundary for class i. If we have x_k, the input which yields the closest point to the decision boundary of class i (as depicted in Fig 3. (b)), then we should have . However, r_i is defined as . In this formula, the absolute value clearly changes the direction of the gradient. It would be appreciated to have a clear explanation for the reason of the absolute value. The paper contains incorrect statements about standard adversarial attacks. FGSM is a one-step attack, and it does not make sense to do several iterations of it. A more powerful multi-step attack that can be considered is PGD. A lot of emphasis is put on the fact that the obtained representations might be too large to scale well to datasets where there are more classes than the ones considered in the article. However, there are no experiments to support this - the experiments in the paper do not go beyond 10 classes. Additional comments: Some citations need to be fixed, removed or changed: Second paragraph of the introduction: “[...] can discriminate between classes (Goodfellow et al., 2016)(Krizhevsky et al., 2012)(He et al., 2016).” Deep neural nets were not initially proposed in these papers, so it is somehow inappropriate to cite these papers here (except, maybe, Krizhevsky*12). Third paragraph of the introduction: “[...] the representations (fL?1) are linearly projected (Wang et al., 2019).” Same here. The main figures to explain the idea are not really helping the argument: Figure 1. (b) is simply Fig 1. (a) rotated 180 degrees and re-scaled, but the information is essentially the same; maybe not the best example. Figure 2: the provided t-SNE projections do not show a clear advantage of the proposed method. A quantitative analysis would better support the argument. The time measurement given in section 3 is not indicative: what are the 320s? An indication in terms of epochs or training iterations would be better. It would be appreciated to have measures of standard deviations for the results especially in tables 1 and 2 since some results are very close and might depend mostly on random perturbations. Moreover, it is not mentioned for which datasets these tables are for.