The vanilla convolutional neural network (CNN) is vulnerable to images with small variations (e.g. corrupted and adversarial samples). One of the possible reasons is that CNN pays more attention to the most discriminative regions, but ignores the auxiliary features  , leading to the lack of feature diversity  . In our method, we propose to dynamically suppress significant activation values of vanilla CNN by group-wise inhibition, but not fix or randomly handle them when training. Then, the feature maps with different activation distribution are processed separately due to the independence of features. Vanilla CNN is finally guided to learn more rich discriminative features hierarchically for robust classification according to  proposed regularization. The proposed method is able to achieve a significant gain of robustness over 15\% comparing with the state-of-the-art. We also show that the proposed regularization method complements other defense paradigms, such as adversarial training, to further improve the robustness .
The convolutional neural network (CNN) is vulnerable to degraded images with even very small variations (e.g. corrupted and adversarial samples). One of the possible reasons is that CNN pays more attention to the most discriminative regions, but ignores the auxiliary features when learning , leading to the lack of feature diversity for final judgment . In our method, we propose to dynamically suppress significant activation values of CNN by group-wise inhibition, but not fixedly or randomly handle them when training. The feature maps with different activation distribution are then processed separately to take the feature independence into account. CNN is finally guided to learn richer discriminative features hierarchically for robust classification according to the proposed regularization. Our method is comprehensively evaluated under multiple settings, including classification against corruptions, adversarial attacks and low data regime. Extensive experimental results show that the proposed method can achieve significant improvements in terms of both robustness and generalization performances, when compared with the state-of-the-art methods .
D
vanilla
R
images with
degraded images with even very
A
when learning
A
for final judgment
D
vanilla
R
fix
fixedly
R
Then, the
The
R
processed separately due to the independence of features. Vanilla
then processed separately to take the feature independence into account.
R
more rich
richer
A
the
R
The proposed method is able to achieve a significant gain of robustness over 15\% comparing with the state-of-the-art. We also
Our method is comprehensively evaluated under multiple settings, including classification against corruptions, adversarial attacks and low data regime. Extensive experimental results
R
regularization method complements other defense paradigms, such as adversarial training, to further improve the robustness
method can achieve significant improvements in terms of both robustness and generalization performances, when compared with the state-of-the-art methods