Edge Detectors Can Make Deep Convolutional Neural Networks More Robust

TL;DR

This work tackles the vulnerability of deep CNNs to small adversarial perturbations by introducing a Binary Edge Feature Branch (BEFB) that leverages four learnable edge detectors to extract shape-like features. BEFB uses Sobel-like layers and a threshold to generate binary edge maps, which are concatenated with texture features from the backbone and processed by the classifier; backprop through the non-differentiable threshold is handled via STE. Integrated with VGG16 and ResNet34, BEFB improves robustness against FGSM, PGD, and C&W attacks and remains lightweight with no training drawbacks, and its benefits persist when combined with adversarial training (AT) and prototype conformity loss (PCL). The results demonstrate, for the first time, that combining shape-like edge features with texture features can enhance DCNN robustness, suggesting a promising direction for robust vision systems. The approach is versatile and can be integrated into popular backbones, offering practical impact for safety-critical applications.

Abstract

Deep convolutional neural networks (DCNN for short) are vulnerable to examples with small perturbations. Improving DCNN's robustness is of great significance to the safety-critical applications, such as autonomous driving and industry automation. Inspired by the principal way that human eyes recognize objects, i.e., largely relying on the shape features, this paper first employs the edge detectors as layer kernels and designs a binary edge feature branch (BEFB for short) to learn the binary edge features, which can be easily integrated into any popular backbone. The four edge detectors can learn the horizontal, vertical, positive diagonal, and negative diagonal edge features, respectively, and the branch is stacked by multiple Sobel layers (using edge detectors as kernels) and one threshold layer. The binary edge features learned by the branch, concatenated with the texture features learned by the backbone, are fed into the fully connected layers for classification. We integrate the proposed branch into VGG16 and ResNet34, respectively, and conduct experiments on multiple datasets. Experimental results demonstrate the BEFB is lightweight and has no side effects on training. And the accuracy of the BEFB integrated models is better than the original ones on all datasets when facing FGSM, PGD, and C\&W attacks. Besides, BEFB integrated models equipped with the robustness enhancing techniques can achieve better classification accuracy compared to the original models. The work in this paper for the first time shows it is feasible to enhance the robustness of DCNNs through combining both shape-like features and texture features.

Figures (18)

• Figure 1: Clean examples and adversarial examples.
• Figure 2: Thresholded edge images of Fig. \ref{['fig:ORIAE']}.
• Figure 3: Four types of edge detectors.
• Figure 4: The architecture of a BEFB integrated DCNN model.
• Figure 5: Comparison of training profiles between VGG16-BEFB-mutiple model and the original one on CIFAR-10 dataset.