Edge-Based Learning for Improved Classification Under Adversarial Noise

TL;DR

This work tackles the vulnerability of image classifiers to adversarial noise by investigating edge-based representations as a robustness cue. It propos es a pipeline that combines FGSM-generated perturbations, Canny edge maps, and a retraining regime on mixed clean/noisy data to assess edge-based resilience. Empirical evaluations on MRI brain tumor and COVID chest X-ray datasets show that models trained on edge representations exhibit superior robustness to adversarial perturbations across multiple architectures, with additional gains achieved through retraining. The results indicate edge-aware learning as a practical defense for critical medical imaging tasks, potentially improving reliability in real-world deployments.

Abstract

Adversarial noise introduces small perturbations in images, misleading deep learning models into misclassification and significantly impacting recognition accuracy. In this study, we analyzed the effects of Fast Gradient Sign Method (FGSM) adversarial noise on image classification and investigated whether training on specific image features can improve robustness. We hypothesize that while adversarial noise perturbs various regions of an image, edges may remain relatively stable and provide essential structural information for classification. To test this, we conducted a series of experiments using brain tumor and COVID datasets. Initially, we trained the models on clean images and then introduced subtle adversarial perturbations, which caused deep learning models to significantly misclassify the images. Retraining on a combination of clean and noisy images led to improved performance. To evaluate the robustness of the edge features, we extracted edges from the original/clean images and trained the models exclusively on edge-based representations. When noise was introduced to the images, the edge-based models demonstrated greater resilience to adversarial attacks compared to those trained on the original or clean images. These results suggest that while adversarial noise is able to exploit complex non-edge regions significantly more than edges, the improvement in the accuracy after retraining is marginally more in the original data as compared to the edges. Thus, leveraging edge-based learning can improve the resilience of deep learning models against adversarial perturbations.

Figures (4)

• Figure 1: Visual comparison of clean and noisy images, along with their corresponding edges. Each patch is of size 32$\times$32, extracted from the original and noisy 224$\times$224 images, with noise added at an epsilon of 0.05. (a) illustrates examples from the Brain Tumor dataset hamada2020br35h, and (b) shows samples from the COVID-19 dataset kermany2018largecohen2020covid19imagedatacollectionchen2020masks7pw-jr18-20.
• Figure 2: The process of training and retraining the model. Initially, the clean dataset is used to train and test a model, then a noisy dataset is created by introducing adversarial noise. The model is tested on both clean and noisy images to evaluate its baseline performance. A subset of the clean data is combined with the noisy training data, forming a new dataset for retraining. Finally, this retrained model undergoes evaluation against both clean and newly generated noisy images.
• Figure 3: Visual comparison of noise generated by models A and B. (a) represents the original or clean image from the Brain Tumor dataset, (b) represents the adversarial image generated using FGSM, (c) and (d) are the canny edge detected version of the (a) and (b) images, (e) and (f) represent the clean edges image and the corresponding adversarial image generated with Model B, respectively.
• Figure 4: Visual comparison of noise generated for the COVID dataset.