Input Space Mode Connectivity in Deep Neural Networks

TL;DR

It is conjecture that input space mode connectivity in high-dimensional spaces is a geometric effect that takes place even in untrained models and can be explained through percolation theory, and exploited to obtain new insights about adversarial examples and demonstrate its potential for adversarial detection.

Abstract

We extend the concept of loss landscape mode connectivity to the input space of deep neural networks. Mode connectivity was originally studied within parameter space, where it describes the existence of low-loss paths between different solutions (loss minimizers) obtained through gradient descent. We present theoretical and empirical evidence of its presence in the input space of deep networks, thereby highlighting the broader nature of the phenomenon. We observe that different input images with similar predictions are generally connected, and for trained models, the path tends to be simple, with only a small deviation from being a linear path. Our methodology utilizes real, interpolated, and synthetic inputs created using the input optimization technique for feature visualization. We conjecture that input space mode connectivity in high-dimensional spaces is a geometric effect that takes place even in untrained models and can be explained through percolation theory. We exploit mode connectivity to obtain new insights about adversarial examples and demonstrate its potential for adversarial detection. Additionally, we discuss applications for the interpretability of deep networks.

Figures (13)

• Figure 1: Barrier between two input modes. Two examples (A and C) that minimize loss for the class jackfruit are shown. The interpolated point B exhibits maximal loss. Left middle: Cross-entropy loss for interpolated virtual points between A and C. Left bottom: Diagram illustrating the interpolation paths and subsequent optimization of point B, constrained within the orthogonal hyperplane to vector AC. The optimized point B' minimizes the loss and is nearly indistinguishable from the original point B. Right bottom: Normalized difference pattern B'$-$B, where the maximum pixel value of the difference pattern is 1--5% of the maximum pixel in the original image.
• Figure 2: Bypassing the barrier. After optimizing the intermediate point B, we obtained the updated point B', which linearly connects to both A and C. Note that small secondary barriers, below the threshold of $\delta = 0.001$ loss, are disregarded.
• Figure 3: Images along two paths. We sampled and compared images along the updated path A$\rightarrow$B'$\rightarrow$C (dashed rectangle) and the original linear path A$\rightarrow$C (bottom row). These paths are illustrated in the diagram in Figure \ref{['fig:1']}. The high-loss intermediate point B and its optimized version B' are denoted by the blue vertical rectangle.
• Figure 4: Adversarial attack. From the left: i) real input A that minimizes the loss for class golf ball, ii) source input K from a different class, iii) optimized pattern added to the K, and iv) adversarial example K' that minimizes the loss for the same class as A. The network predicts K' as a golf ball.
• Figure 5: Barriers and path complexity. Left: Max loss point B on the primary barrier (between the real mode A and adversarial attack K'). Right: Interpolated paths between points from Figure \ref{['fig:attack1']}. The primary barrier was bypassed through the optimized point B'. Secondary barriers (with lower loss) emerged on the new path A$\rightarrow$B'$\rightarrow$K' and can be further bypassed by a repeated application of the procedure to both segments of the new path (omitted here). This suggests that the path between a real mode A and an adversarial attack K' is more complex than that between two real images.

Theorems & Definitions (4)

• Conjecture 5.1: Geometric Input Space Connectivity
• Lemma C.1: Lipschitz Continuity of the Network
• proof : Proof of Lemma \ref{['zap:lem:LipschitzNet']}
• Remark C.1