Signal Processing - November 2017 - 61

The importance of analyzing the vulnerability of deep neural
networks to perturbations therefore goes beyond the practical security implications, as it further reveals crucial geometric properties of deep networks. We hope that this close
Improving the robustness to geometric perturbations
relation between robustness and geometry will continue to be
Just as in the case of adversarial perturbations, one popular
leveraged to design more robust systems.
way of building more invariant representations to geometric perturbations is through virtual jittering (or data augDespite the recent and insightful ad--vances in the analysis
mentation), where training data are transformed and fed
of the vulnerability of deep neural networks, several chalback to the training set. One of the drawbacks of this approach
lenges remain:
is, however, that the training can become intractable, as the
■■ It is known that deep networks are vulnerable to universal
size of the training set becomes substantially larger than
perturbations due to the existence of correlations between
the original data set. In another effort to improve the invaridifferent parts of the decision boundary. Yet, little is
ance properties of deep CNNs, the authors in [45] proposed
known about the elementary operations in the architecture
a new module, the spatial transformer, that
(or learned weights) of a deep network
geometrically transforms the filter maps.
that cause the classifier to be sensitive to
Similarly to other modules in the network,
One of the main strengths
such directions.
spatial transformer modules are trained in
■■ S imilarly, the causes underlying the
of deep neural network
a purely supervised fashion. Using spatial
transferability of adversarial perturbaclassifiers with respect
transformer networks, the performance of
tions across different architectures are
to traditional shallow
classifiers improves significantly, especialstill not understood formally.
classifiers is that the
ly when images have noise and clutter, as
■■ While the classifier's decision boundary
former achieve higher
these modules automatically learn to localhas been shown to have a very small
ize and unwarp corrupted images. To build
curvature when sectioned by random
levels of invariance to
robust deep representations, [46] considers
normal planes, it is still unclear whether
transformations.
instead a new architecture with fixed filter
this property of the decision boundary
weights. Specifically, a similar structure
is due to the optimization method (i.e.,
to CNNs (i.e., cascade of filtering, nonlinearity, and pool stochastic gradient descent) or rather to the use of pieceing operations) is considered with the additional requirewise linear activation functions.
ment of stability of the representation to local deformations,
■■ While natural images have been shown to lie very close to
while retaining maximum information about the original
the decision boundary, it is still unclear whether there exist
data. The scattering network is proposed, where succespoints that lie far away from the decision boundary.
sive filtering with wavelets and pointwise nonlineariFinally, one of the main goals of the analysis of robustness
ties is applied and further shown to satisfy the stability
is to propose architectures with increased robustness to addiconstraints. Note that the approach used to build this scattive and structured perturbations. This is probably one of the
tering network significantly differs from traditional CNNs,
fundamental problems that needs special attention from the
as no learning of the filters is involved. It should further
community in the years to come.
be noted that while scattering transforms guarantee that
representations built by deep neural networks are robust
Authors
to small changes in the input, this does not imply that the
Alhussein Fawzi (fawzi@cs.ucla.edu) received the M.S. and
overall classification pipeline (feature representation and
Ph.D. degrees in electrical engineering from the Swiss Federal
discrete classification) is robust to small perturbations in
Institute of Technology, Lausanne, in 2012 and 2016, respecthe input, in the sense of (2). We believe that building deep
tively. He is now a postdoctoral researcher in the Computer
architectures with provable guarantees on the robustness
Science Department at the University of California, Los
of the overall classification function is a fundamental open
Angeles. He received the IBM Ph.D. fellowship in 2013 and
problem in the area.
2015. His research interests include signal processing, machine
learning, and computer vision.
Seyed-Mohsen Moosavi-Dezfooli (seyed.moosavi@epfl
Summary and open problems
.ch) received the B.S. degree in electrical engineering from
The robustness of deep neural networks to perturbations is a
Amirkabir University of Technology (Tehran Polytechnic),
fundamental requirement in a large number of practical appliIran, in 2012 and the M.S. degree in communication systems
cations involving critical prediction problems. We discussed
from the École Polytechnique Fédérale de Lausanne (EPFL),
in this article the robustness of deep networks to different
Switzerland, in 2014. Currently, he is a Ph.D. degree student
forms of perturbations: adversarial perturbations, random
in the Signal Processing Laboratory 4 at EPFL under the
noise, universal perturbations, and geometric transformasupervision of Prof. Pascal Frossard. Previously, he was a
tions. We further highlighted close connections between the
research assistant in the Audiovisual Communications
robustness to additive perturbations and geometric properties
Laboratory at EPFL. During the spring and the summer of
of the classifier's decision boundary (such as the curvature).
information such as depth maps can be exploited to detect
adversarial samples.

IEEE SIGNAL PROCESSING MAGAZINE

November 2017

Table of Contents for the Digital Edition of Signal Processing - November 2017