How Does Frequency Bias Affect the Robustness of Neural Image Classifiers against Common Corruption and Adversarial Perturbations?

1 Introduction

Recent research has shown that model performances can drop drastically when natural test images are altered [Szegedy et al., 2013; Hendrycks et al., 2021]. One of these scenarios is when common image corruptions are added to the images. These corruptions include noise attributed to weather conditions, noisy environments, blurring effects and digital artifacts [Hendrycks and Dietterich, 2019]. Another case where models can fail is adversarial examples where a malicious party can craft imperceptible perturbations to images to influence the model's prediction [Szegedy et al., 2013; Croce and Hein, 2019]. While research to build models more robust to these two situations started independently, recent studies have started to draw a connection between them. Interestingly, models trained to be robust against adversarial examples have shown mixed results in common corruptions:

∗Corresponding author: guoweialvin.chan@ntu.edu.sg

improving accuracy for some corruptions types while doing poorly for others.

Though studies have shown a link between data augmentation strategies and robustness against corruptions with different frequency components [Yin et al., 2019], there is no study on how direct changes to a model's Fourier profile would affect its robustness. Here, we aim to directly alter the Fourier profile of a model to study its direct effect on both the model's adversarial and corruption robustness. To achieve this, we investigate the model's Jacobian which represents a visual map of pixel importance in a particular input image. Intuitively, a model would be relying on low (high)-frequency features when its Jacobians have a large ratio of low (high)-frequency components. While observing the Fourier spectra of natural images such as SVHN, CIFAR-10 and CIFAR-100, and the Jacobians of standard-trained models (Figure 1), these images have a much larger component of low-frequency features than their standard-trained models. This mismatch of frequency profiles motivates us to train models to bias towards low-frequency features through its Jacobians and study its effect on robustness.

To quantify the frequency profile of a model, we propose a frequency bias term that computes a scalar value from a Fourier spectrum of 2-D inputs such as an image or Jacobian to improve frequency evaluation beyond the visual inspection of Fourier spectra. Through this differentiable frequency bias term, we can use Jacobian frequency regularization (JaFR) to explicitly train a model to bias more heavily on low- or highfrequency features. Through our experiments, we find that a more direct change in a model's frequency profile towards low-frequency regions to match the frequency profile of the training data can boost clean accuracy, adversarial robustness and common corruptions in certain settings while trading off performance against low-frequency noise. Conversely, regularizing the model towards high-frequency regions can boost performance against low-frequency noise while sacrificing accuracy under high-frequency noise and adversarial examples. All in all, the core contributions of this paper are 1 :

• We propose a frequency bias term to measure the frequency bias of a Fourier spectrum.
• We show that biasing the Jacobians of models towards

1 Full version with the Appendix in arXiv. Code available at: https://github.com/alvinchangw/JaFR IJCAI2022

low or high frequency have implications on model robustness against adversarial robustness and an array of corruptions.

• To achieve this, we propose Jacobian frequency regularization (JaFR) to train model's Jacobians to have a larger or smaller weightage of low-frequency components.
• We conduct experiments on SVHN, CIFAR-10, CIFAR100 and TinyImageNet to show how low-frequency bias in Jacobians can improve robustness against adversarial and high-frequency corruptions, albeit with tradeoffs in performance for low-frequency corruptions.

2 Background and RelatedWork

Adversarial Robustness. Adversarial robustness measures how well a model is resistant to attacks by malicious actors. In such attacks, imperceptible perturbations could be crafted to form adversarial examples with the aim to control the prediction of neural networks [Szegedy et al., 2013]. This threat could undermine the deployment of deep learning models in mission-critical applications. In a classification task, a model (f) parameterized by θ takes an input x to predict the probabilities for k classes, i.e., f(x; θ) : x ↦→ Rk . In supervised setting of empirical risk minimization (ERM), given training samples (x, y) ∼ D, the model's parameters are trained to minmize the standard cross-entropy loss:

where y ∈ Rk is the one-hot label for the input x. Though ERM can train models that display high accuracy on a holdout test set, their performance degrades under adversarial examples. Given an adversarial perturbation of magnitude ε, we say a model is robust against this attack if

where p = ∞ in this paper and is the most widely studied scenario.

One of the most effective approaches to train models robust against adversarial examples is adversarial training (AT) [Goodfellow et al., 2014; Andriushchenko and Flammarion, 2020; Wu et al., 2020]. More details of related work in adversarial training are deferred to the Appendix.

Corruption Robustness. In contrast to adversarial robustness, corruption robustness [Hendrycks and Dietterich, 2019] entails studying the performance of models when input data are corrupted with common-occurring noise, not necessarily those created by a malicious actor to control models' prediction. CIFAR-10-C and CIFAR-100-C are two benchmark datasets that study 19 corruption types, each with 5 levels of severity. These 19 corruption types can be grouped under the 'Noise', 'Blur', 'Weather', 'Digital' categories. There is a line of work that seek to improve performances under these common corruptions by mostly improving the training data augmentation [Geirhos et al., 2018; Vasconcelos et al., 2020]. Some other works assemble expert models whose performance are finetuned for subsets of the corruptions [Saikia et al., 2021] to boost overall performance. Different from these work, our paper aims to study the effect of frequency bias on corruption robustness of different types that corrupts features of varying frequencies, rather than to propose a new way to better resist these corruptions.

Link between Frequency and Robustness. There is a line of work that seeks to understand how robust models respond to corruption and adversarial perturbations of various frequency profiles [Yin et al., 2019; Vasconcelos et al., 2021]. In contrast to these prior works, our work here takes the frequency analysis in a different direction by studying models through the Fourier spectrum of their Jacobians rather than their test or training data. More concretely, with the original training data, we train models and bias the frequency profile of the model's Jacobians towards low-frequency regions to see its effect on model robustness.

Jacobians of Robust Models. The Jacobian,

defines how the model's prediction changes with an infinitesimally small change to the input x. For image classification, Jacobians can be loosely interpreted as a map of which pixels affect the model's prediction the most and, hence, give an illustration of important regions in an input image [Smilkov et al., 2017; Etmann et al., 2019; Ilyas et al., 2019]. There is a line of work that seeks to improve the adversarial robustness of models by matching the Jacobians to a target distribution [Chan et al., 2019; Chan et al., 2020] or by constraining their magnitude [Jakubovitz and Giryes, 2018]. Rather than aiming to improve the adversarial robustness, the core aim of our paper here is to investigate the relationship between the Fourier profile of models and robustness against corruptions. Moreover, the regularizing effect of JaFR has a different mechanism that acts directly on the Fourier spectrum of the Jacobians. A detailed comparison is in the Appendix.

3 Jacobian Frequency Bias

Motivation. As mentioned in § 2, it has been shown that there is a link between Fourier profile of input training data and robustness against corruptions with different frequency components. However, there is still no study on how changes to a neural network's Fourier profile would affect its robustness. Since the Jacobian of a model represents a visual map of pixel importance [Smilkov et al., 2017], it offers a medium for us to regularize the Fourier profile of the model. Intuitively, when a model's Jacobians are concentrated with lowfrequency components, it places more importance on lowfrequency features. Conversely, the model relies more on high-frequency features if its Jacobians have a relatively large proportion of high-frequency components. Here, we aim to study how changing the Fourier spectrum of the Jacobians would affect its robustness.

When analyzing the Fourier profile of Jacobians of adversarially robust models (Table 2), we see that it resembles the profile of the training data much more than the non-robust standard trained models. This raises the question of what would happen to model robustness if we directly train neural networks to have a low-frequency profile, similar to what we see in the images from SVHN, CIFAR-10 and CIFAR-100 (see Figure 1). This motivates a metric to quantitatively measure and control the Fourier profile of the neural network to more directly study the effect of Fourier profile on robustness. In the next sections, we propose the Jacobian frequency bias to achieve this goal and discuss how we can use it to train a neural network.

3.1 Jacobian Frequency Bias

Here, we present the measure of Jacobian frequency bias with an example of single-channel image classification where the input images are denoted as x ∈ Rhw . Given a training dataset (Dtrain) where each training sample consists of an input image x and one-hot label vector of k classes as y ∈ Rk , we can express fcls(x) ∈ Rk as the prediction of the classifier (fcls), parameterized by θ. Then, the classification cross entropy loss (Lcls) is:

where fcls is the classifier model. The Jacobian matrix J ∈ Rhw of the model's classication loss value with respect to the input layer can be computed through backpropagation:

We can then compute the Jacobian's Fourier spectrum to retrieve a frequency profile of the model. Since the input images are made up of discrete pixels, we can extract this information by applying a discrete Fourier transform (F) to the Jacobian to get a map (M) of its frequency components' magnitude:

In our experiments where the input images have 3 RGB channels, we compute the Fourier map for each other channel separately (Mr, Mg, Mb) and take the mean across these channels, i.e., Mi,j = Mr[i,j]+Mg[i,j]+Mb[i,j] 3 .

Next, we propose to compute a scalar bias term (Blow) from the 2-D map (M) to measure the relative bias (or ratio) of low-frequency components with respect to high-frequency components. One criterion for Blow is that the contribution of the frequency magnitude to this term should monotonically decrease as the frequency increase, i.e., larger high-frequency magnitudes results in lower Blow values. To satisfy this, we monotonically decrease the exponent value on the frequency magnitude as its frequency increases. For a 1-D scenario where l is the dimension of the Fourier spectrum, we can express this bias term Blow as:

where M1 and Ml are the magnitudes of the lowest and highest frequency components respectively. To ensure that Blow measures the relative ratio between the frequencies rather than absolute values of the frequency components, we use the following constraint on the α so that it is independent of the sum of the components' magnitudes:

In all our experiments, we use an array of values whose values are evenly spaced with distance k from α1 and αl for the α values, i.e,

and use α1 = 1, αl = -1. When generalizing the bias term to two axes, we can compute the sum of all bias terms along each row and column of the 2-D Fourier spectrum to give:

In the next section, we discuss how Blow can be used to regularize neural networks' Jacobians to bias them towards lowfrequency components.

3.2 Jacobian Frequency Regularization (JaFR)

To recall, the aim here is to control the Fourier spectrum of a model's Jacobians to study how its Fourier profile can affect model robustness. To achieve this, we propose Jacobian Frequency Regularization (JaFR) to bias the Fourier spectrum of a model towards the low-frequency region. Figure 2 shows a summary of how our proposed Jacobian Frequency Regularization (JaFR) trains a model to alter its frequency profile. Since the operations involved in computing Blow are differentiable, we can simply incorporate it in the following loss function with the aim to maximize the low-frequency bias of a model:

Combining with the classification loss in Equation 4, we can optimize through stochastic gradient descent to approximate the optimal parameters for the classifier fcls as follows,

where λfreq determines the weight of JaFR in the model's training. A positive λfreq value regularizes the model to bias towards low-frequency features while a negative value (indicated as JaFR(-)) conversely steers the model towards highfrequency features. The Lfreq term can be computed during each standard training iteration with an additional backpropagation step. Algorithm 1 summarizes the training of a classifier with JaFR. In the next sections, we present the results on the effect of JaFR on model robustness under adversarial examples and corruption noises.

Algorithm 1 Jacobian Frequency Regularization Training

Input: Train data Dtrain, learning rate γ

• 1: for each training iteration do
• 2: Sample (x, y) ∼ Dtrain
• 3: Lcls ←-y⊤ log fcls(x) (1) Compute classification cross-entropy loss
• 4: J ←∇xLcls (2) Compute Jacobian matrix
• 5: Mi,j ← |F(J)[i, j]| (3) Compute frequency magnitudes
• 6: Lfreq ←-log [∑j [Πi(Mi,j)α ] + ∑i [Πj(Mi,j)β ]] (4) Compute frequency bias
• 7: θ ← θ -γ ∇θ(Lcls +λfreqLfreq) (5) Update the classifier fcls to minimize Lcls and Lfreq
• 8: end for

4 Experiments

We conduct experiments across 4 image datasets (SVHN, CIFAR-10 and CIFAR-100, TinyImageNet) to study the effect of JaFR on model robustness against adversarial examples and common image corruptions. We largely follow the training setting as [Andriushchenko and Flammarion, 2020] where the PreAct ResNet-18 architecture [He et al., 2016] is used for all models. To benchmark JaFR's effect on adversarial robustness, we compare with a relatively weak AT baseline (FGSM AT) and 2 strong AT baselines (FGSM AT + GradAlign [Andriushchenko and Flammarion, 2020] and PGD AT [Madry et al., 2017]). All AT models use ϵ = 8 255 . The dataset-specific parameters are further detailed in the following sections. Experiments are run on Nvidia V100 GPUs.

SVHN. All models were trained for 15 epochs, with a cyclic learning rate schedule and a max learning rate of 0.05. We use λfreq = 0.001 and λfreq = 0.05 for the JaFR and FGSM AT + JaFR model respectively. FGSM + GradAlign model uses the same hyperparameters in [Andriushchenko and Flammarion, 2020] for training.

CIFAR-10. The training setup largely follows the SVHN experiments where the PreAct ResNet-18 architecture is used for all models. All models were trained for 30 epochs, with a cyclic learning schedule. The standard-trained, JaFR and FGSM models use a max learning rate of 0.2 while the FGSM + JaFR, FGSM + GradAlign and PGD AT models used a max learning rate of 0.3. Both JaFR and FGSM AT + JaFR models use λfreq = 0.001.

CIFAR-100. The training setup is similar to that in CIFAR10, except for the learning rates and λfreq = 0.001 values. The max learning rates for all models are 0.3 except for the JaFR (0.1) and standard-trained (0.2) models.

TinyImageNet. The training setup is similar to that in CIFAR-100, except for the λfreq = 0.002 value.

4.1 Common Corruption Robustness

CIFAR-10-C and CIFAR-100-C are common corruption benchmarks where the CIFAR-10/CIFAR-100 test sets are corrupted with an array of 19 corruption types with 5 levels of severity. The accuracy values are reported as the average over the 5 severities of each corruption.

JaFR improves corruption robustness for standardtrained models. From Table 1 and 8 (Appendix), we observe that the JaFRmodel achieves the best overall corruption robustness for both CIFAR-10 and -100 images, as indicated by its lowest relative mean corruption errors (mCE). The JaFR outperforms the second-best model (standard-trained) in 14 out of 19 corruptions for CIFAR-10-C and 17 out of 19 corruptions for CIFAR-100-C test samples. This is an encouraging sign for direct frequency regularization of neural networks as an approach for better corruption robustness.

When comparing the spectra of the standard and JaFR model in Table 2, we observe that the intensities shift from the highest-frequency (bottom-right) region to lower frequency regions (left and top) with JaFR. This marks a lower reliance on high-frequency features in the model, which can confer better robustness against high-frequency corruptions. Indeed, with JaFR, we see the biggest improvements for high-frequency corruptions (e.g., Glass, Shot and Gaussian noise). Moreover, we can see that the spectra of our JaFRonly model, unlike the adversarially trained models (e.g., PGD AT), do not concentrate the intensities on the lowestfrequency region (top-left) which may result in an overreliance on low-frequency features and make the model more susceptible to low-frequency corruptions. During our experiments, larger λfreq values for JaFR do concentrate the intensities even more in the low-frequency regions but result in poorer overall performance. This balance in reliance on both high and low-frequency features may explain the improved overall performance of JaFR against corruption.

Tradeoff between robustness against low- and highfrequency corruption exists. For both CIFAR-10-C (Table 1) and CIFAR-100-C (Table 8), we observe that when JaFR is added to FGSM AT, the performance against lowfrequency corruptions (e.g., Fog & Contrast) drops when the accuracy against high-frequency corruptions (e.g., Impulse & Gaussian noise) improves. We also see such behavior when JaFR is added to the standard trained model in CIFAR-10-C. This aligns with previous studies that show such a tradeoff between corruptions with different frequency profiles.

To study the opposite effect of JaFR, a JaFR(-) model variant is added where the λfreq term has a negative value to investigate the effect of biasing the model towards highfrequency components. We can see such tradeoff emerging with an opposite effect when JaFR(-) is combined with FGSM AT to bias the model towards high frequency features, where the performance against high-frequency corruptions (e.g., Impulse & Gaussian noise) drops when the accuracy against low-frequency corruptions (e.g., Fog & Contrast) improves. This suggests that direct frequency regularization of models is a promising way to tailoring robustness against a set of corruptions that is more relevant for their applications.

FGSM AT + JaFR outperforms PGD AT in almost all corruptions. From our experiments, apart from one case of Impulse corruption in CIFAR-10-C, the FGSM AT + JaFR outperforms the PGD AT model in all the other 37 corruptions scenarios. We speculate that the PGD AT model might have overfitted to resist adversarial perturbations, making them excessively reliant on a small subset of low-frequency features that can be easily disrupted by the common corruptions.

4.2 Adversarial Robustness

We evaluate the adversarial robustness of models with FGSM [Goodfellow et al., 2014] and PGD [Madry et al., 2017] attacks. PGD uses 50 gradient iterations and 10 restarts with a step size of αadv = ϵ/4.

Biasing towards low frequency can boost adversarial robustness in weakly adversarially trained models. For all the four image datasets, when JaFR is combined with FGSM, there is a significant boost in both clean and adversarial accuracy values from the FGSM AT model for all attack types (see Table 3, 4, 5 and 6). This observation is similar to what is observed for a recent defense, GradAlign, which also requires combining with FGSM to improve the adversarial robustness of the model. The need of using FGSM training samples to see an improvement in JaFR's adversarial robustness indicates that strong adversarial examples are more than just high-frequency noise and are able to find regions of high error in the uneven loss landscape of a non-adversarially trained model [Liu et al., 2020]. For the CIFAR-10 and -100, the improvement of adding JaFR to FGSM is large enough to achieve a robustness level that is competitive with the strong PGD AT baseline. In Table C, we observe that JaFR scales well to a larger dataset, with a smaller amount of computation than PGD AT. Conversely, combining with JaFR(-) to bias the FGSM AT model towards high frequency with a negative λfreq term was observed in our experiments to worsen its adversarial robustness against PGD attacks. Experiments (Table 7 in Appendix) on more advanced attacks such as CW [Carlini and Wagner, 2017] and AutoAttack [Croce and Hein, 2020] show that the robustness gain from JaFR can resist even stronger attacks and is not due to gradient masking. Moreover, from Table 6, we observe that JaFR scales well, with a smaller amount of computation than the PGD AT.

JaFR removes high-frequency components in models' Jacobian. From Table 2, we can see that models with JaFR have the highest low-frequency bias (Blow) values, indicating that the training regularization is successful in increasing the low-frequency components of the model's Jacobians. Furthermore, from the Jacobian's Fourier spectra (E [|F(J)|]), intensities of the spectra shift from the high-frequency regions (right and bottom) towards the left and top regions of the spectra which indicate the low-frequency components along the horizontal and vertical axis respectively. In contrast, using a negative λfreq term (in FGSM AT + JaFR(-)) concentrates the spectra towards highest-frequency (bottomright) region and drastically lowers the (Blow) value which indicates a strong reliance in high-frequency features.

JaFR improves saliency of Jacobians. When JaFR is added to the FGSM AT model, we observe that its Jacobians (J) become more salient (see Table 2). Together with the boost in adversarial robustness from the FGSM AT model, this corroborates previous results that saliency of Jacobian is correlated with adversarial robustness [Etmann et al., 2019].

5 Conclusion

Model robustness is growing more important as deep learning models are gaining wider adoption. Here, we delve further into the link between the frequency characteristic of a model and its robustness by proposing Jacobian frequency bias. Through this term, we can control the distribution of high- and low-frequency components in the model's Jacobian and find that it can affect both corruption and adversarial robustness. We hope that our findings here will open an avenue for future work to explore other frequency-focused approaches to improve model robustness.

Acknowledgements

This work was partially supported by the Data Science and Artificial Intelligence Research Centre, School of Computer Science and Engineering at the Nanyang Technological University (NTU), Singapore, and the A*Star Center for Frontier Artificial Intelligence Research.