Universal Adversarial Perturbations to Understand Robustness of Texture vs. Shape-biased Training
Kenneth T. Co, Luis Muñoz-González, Leslie Kanthan, Ben Glocker, Emil Lupu · arXiv (Cornell University) · 2019
Convolutional Neural Networks (CNNs) used on image classification tasks such as ImageNet have been shown to be biased towards recognizing textures rather than shapes. Recent work has attempted to alleviate this by augmenting the training dataset with shape-based examples to create Stylized-ImageNet. However, in this paper we show that models trained on this modified dataset remain as vulnerable to Universal Adversarial Perturbations (UAPs) as those trained in ImageNet. We use UAPs to evaluate, compare, and understand the robustness of CNN models with varying degrees of shape-based training. We also find that a posteriori fine-tuning on ImageNet negates features learned from training on Stylized-ImageNet. This study reveals an important current limitation and highlights the need for further research into robustness of CNNs for visual recognition.