Aliasing is a Driver of Adversarial Attacks
Not on the map. Why?
Abstract (arXiv)
Aliasing is a highly important concept in signal processing, as careful consideration of resolution changes is essential in ensuring transmission and processing quality of audio, image, and video. Despite this, up until recently aliasing has received very little consideration in Deep Learning, with all common architectures carelessly sub-sampling without considering aliasing effects. In this work, we investigate the hypothesis that the existence of adversarial perturbations is due in part to aliasing in neural networks. Our ultimate goal is to increase robustness against adversarial attacks using explainable, non-trained, structural changes only, derived from aliasing first principles. Our contributions are the following. First, we establish a sufficient condition for no aliasing for general image transformations. Next, we study sources of aliasing in common neural network layers, and derive simple modifications from first principles to eliminate or reduce it. Lastly, our experimental results show a solid link between anti-aliasing and adversarial attacks. Simply reducing aliasing already results in more robust classifiers, and combining anti-aliasing with robust training out-performs solo robust training on L2 attacks with none or minimal losses in performance on L∞ attacks.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 31 of its 48 references that are in the map. First posted on arXiv 22 Dec 2022.
Builds on
31 of 48 references.
References · 31
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
- 2021Alias-Free Generative Adversarial Networkscited by 1,184
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
- 2016Adversarial Machine Learning at Scalecited by 936
- 2018Robustness May Be at Odds with Accuracycited by 880
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
- 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
19 more
- 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
- 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
- 2019Making Convolutional Networks Shift-Invariant Againcited by 391
- 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
- 2019Adversarial Examples Improve Image Recognitioncited by 286
- 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 237
- 2018Spatially Transformed Adversarial Examplescited by 195
- 2020Torchattacks: A PyTorch Repository for Adversarial Attackscited by 158
- 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 155
- 2020Smooth Adversarial Trainingcited by 89
- 2020Delving Deeper into Anti-aliasing in ConvNetscited by 60
- 2020Truly shift-invariant convolutional neural networkscited by 53
- 2018On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functionscited by 32
- 2021Impact of Aliasing on Generalization in Deep Convolutional Networkscited by 25
- 2021Robustness and Generalization via Generative Adversarial Trainingcited by 20
- 2021Anti-aliasing Deep Image Classifiers using Novel Depth Adaptive Blurring and Activation Functioncited by 11
- 2022How Does Frequency Bias Affect the Robustness of Neural Image Classifiers against Common Corruption and Adversarial Perturbations?cited by 11
- 2021How Convolutional Neural Networks Deal with Aliasingcited by 10
- 2018Bypassing Feature Squeezing by Increasing Adversary Strengthcited by 8
Built on by
Citing papers per year: 2023: 1.
1 paper.