Reproduce “Understanding robustness and generalization of artificial neural networks through Fourier masks” on OpenResearch

About this paper

Nikos Karantzas, Emma Besier, Josue Ortega Caro, Xaq Pitkow, Andreas S. Tolias, Ankit B. Patel, Fabio Anselmi

The authors use a Fourier-mask method to find frequencies preserving a frozen classifier’s loss with a sparse mask. In a study of grayscale images from five ImageNet classes with VGG11, adversarial training shifted mask energy toward low frequencies unevenly across directions. On selected images, filtering adversarial examples with clean-image masks yielded 99.86% accuracy; this result is limited to their setup.

Key insights

• Adversarially trained networks exhibit an anisotropic low-frequency bias, relying more heavily on lower frequencies for robust classification.
• Different common data augmentations (e.g., scale, translation, rotation) induce distinct frequency biases in ANNs, varying from low to high-frequency preferences.
• ANNs can maintain original classification performance using sparse, texture-like frequency components that are often unrecognizable to human observers, suggesting a divergence in perceptual strategies compared to biological vision.

Summary by alphaXiv.