I Introduction & Related Work
Autonomous vehicles (AV) have received much attention in recent years. One pillar of AV perception systems is the RGB data captured by the camera. Through the RGB data, the system can understand its surrounding environment, including the location of vehicles, pedestrians and other crucial information. The deep convolutional neural network (CNN) is a widely accepted cuttingedge computer vision algorithm [15] [9] [27]
to process the RGB data, for detecting objects, segmenting urban scenes, etc. Despite the tremendous success accomplished by deep CNN models, the adversarial examples show that there are still reliability and robustness issues (see Fig. 1). The adversarial images are visually indistinguishable for a human viewer, but stateoftheart classifiers make wrong predictions with high confidence for those images. Since the first publication of adversarial attack
[28], numerous studies have appeared on this topic [8, 16, 25, 29, 20, 2, 21, 19, 1], which mainly consider pixel level perturbations. Such adversarial attacks on CNN raise concerns that the perception system of the autonomous vehicle can be maliciously hacked.In [5], it was shown that simple affine transformations (e.g., rotations) can cause deep CNNs to misclassify images. The images captured by the perception system could experience similar affine distortions during normal driving scenarios when vehicles are passing water puddles (see Fig. 2) or on rural roads. Both adversarial attack and affine distortions need to be addressed before integrating deep CNN vision systems into safetyrelated applications like autonomous vehicle at large scale.
GAN [7]
has been widely studied and utilized since its invention. It is a generative model which captures highdimensional data distribution through adversarial process. It can generate images that simulate the training images such as hand written digits, animals, vehicles, etc. Deep Convolutional GAN
[22] introduces convolution mechanism into the GAN structure by inserting the deconvolution layers in the generator network. Bidirectional GAN [4] further provides a pathway to convert data from image space back to latent space with additional encoder network. InfoGAN [3] utilizes a disentangled representation that separates features and noise in the latent space. The separated features can represent categorical and continuous attributes of the training images. In [18], the issue of inductive bias in disentangled representation is discussed. In [10], the concept of symmetry group concept is introduced to define disentanglement behaviour. DefenceGAN [24] uses GAN as a defence method against adversarial attacks.Several studies address invariance property of deep CNN for affine transformations. In [13]
, antidistortion classification result is achieved by inserting Spatial Transformer layer into the given network. However the affine parameters are not presented in a disentangled manner, which makes it less interpretable. Transforming Autoencoder
[11] uses autoencoder to model 2D affine transformation applied to images. The trained generative model can learn to generate transformed images in a disentangled way. However it does not tackle the improvement on classification accuracy. In [6], transformations that preserve the object identity are analyzed in the symmetry group. In [14][26], filter banks are designed to make the classifier transformation invariant.Our Contributions

We introduce Affine Disentangled GAN (ADISGAN) which is robust against both affine transformation and adversarial attack. It achieves classification accuracies comparable to that of stateoftheart supervised learning algorithm, although it is an unsupervised algorithm.

We show that affine transformation augmented training and adversarial augmented training are orthogonal, which means they can only defend typical attack they have been trained on.

Affine Disentangled GAN is more interpretable, providing information that helps to understand potential misclassifications. On MNIST dataset, it can achieve over 98 percent classification accuracy within 30 degrees rotation, and over 90 percent classification accuracy against FGSM and PGD adversarial attack.
Ii Preliminary
Iia Generative Adversarial Network
GAN [7] is a generative model which captures highdimensional data distribution through adversarial process: a minimax game between the generator and discriminator. The generator tries to produce images that are similar to real ones, while the discriminator judges whether the images are generated or real. During the training process, the generator will create images that do not belong to the original dataset. Those images may prevent the model from overfitting, and the model is more likely to learn a smoother data distribution which involves the adversarial samples. The vanilla GAN formulation is:
(1) 
A standard distribution in the latent space can be transferred to data space through generator . The discriminator judges whether the samples are from training dataset or generated dataset .
Bidirectional GAN [4] adds an encoder to the vanilla GAN, which makes the image to latent and latent to image transformation possible. The encoder and generator together can be treated as a filter where the reconstructed images may only keep meaningful information and discard noise such as adversarial perturbation. The Bidirectional GAN formulation is:
(2) 
InfoGAN [3]
can assign the latent vectors semantic meanings such as categorical and continuous information (e.g. skew of an image) by maximizing the mutual information between generated latent space and reconstructed latent space. The InfoGAN formulation is:
(3) 
Bidirectional Info GAN [12] uses encoder instead auxiliary to reconstruct the latent vectors. The Bidirectional InfoGAN formulation is :
(4)  
IiB Affine Transformation Matrix
Inspired by [13]
, we utilize the affine matrix as a regularizer in our model. Conventional affine matrix is a 2 by 3 matrix, matrix defined as:
(5) 
and represent the horizontal and vertical translation parameters respectively. These 2 parameters can be removed from the affine matrix without affecting other affine properties. The affine matrix becomes a 2 by 2 matrix after removing the translation parameters. It can be decomposed as rotation, skew, and zoom matrix respectively (see Appendix for an alternative formulation):
(6) 
Iii System Description
Iiia Affine Regularizer
Since the images captured by the camera usually will not be skewed during normal driving scenarios, we only focus on rotation and zoom attributes in this paper. If we discard skew matrix, the affine matrix equation can be simplified as follows:
(7) 
where:
(8)  
(9)  
(10)  
(11) 
Assume each image is composed of an affine matrix and a base image . The input image from training dataset can be expressed as:
(12) 
The scaled image transformed from with predefined affine matrix can be expressed as:
(13) 
With the assumption, the scaled image can also be expressed as:
(14) 
Through simple matrix manipulation we can obtain the affine regularizer:
(15) 
IiiB Model Architecture
The Affine Disentangled GAN (ADISGAN) maximizes the mutual information between generated affine matrix and reconstructed affine matrix with the assumption of affine regularizer (see Fig. 4). Three continuous latent vectors are assigned to , , and
respectively. Those continuous latent vectors are sampled from a random uniform distribution. They can be converted to
through (8) – (11). Similarly, training images and transformed images are encoded to continuous latent vectors through the encoder. They can be further converted to and through equations (8) – (11). Finally, the mutual information will be maximized between andvia (15). The updated loss function with affine regularizer is:
Block  
Layer  Encoder  Generator  Discriminator  
Input 
28x28  72  2x28, 72  
NN 




NN 




NN 




NN 




NN 




NN   



NN     


Output 

image: 28x28  real/fake: 1  
Output  continuous: 3 fc      
Output 

    

Iv Experimental Results
As a proof of concept experiment, we test our algorithm on the MNIST dataset [17]. In Section A, we consider experiments with rotated images. In Section B, we explore adversarial attacks. In Section C, we elaborate on the interpretability of the proposed algorithm.
Iva Classification Accuracy on Rotated Images
To test the robustness of model against the rotated images, we purposely rotate the images from 30 to +30 degrees as input images. Six models are tested, which are model trained with original dataset, model trained with rotation augmented dataset, model trained with FGSM adversarial sample augmented dataset, model trained with PGD adversarial sample augmented dataset, Bidirectional Info GAN trained with original dataset and the proposed ADISGAN trained with original dataset. Adding FGSM and PGD adversarial sample augmented model is to illustrate the robustness of adversarial training against rotated images. Adding Bidirectional Info GAN is to illustrate the robustness of generative model without affine inductive bias against rotated images.
As we can observe from Fig. 5, the model trained with clean dataset and adversarial augmented dataset suffer from rotation transformations. PGD Aug and FGSM Aug show that model trained with adversarial sample augmented dataset is not robust against rotation transformations. Bidirectional Info GAN shows that the generative model without affine inductive bias is not robust against rotation transformations. ADISGAN has achieved over 98 percent accuracy through all rotation degrees. It has less than 1 percent accuracy difference with the model trained with rotation augmented dataset. This demonstrates the effectiveness of ADISGAN against the rotation transformations.
IvB Classification Accuracy on Adversarial Images
To test the robustness of model against adversarial attacks, we create two kinds of adversarial samples with FoolBox [23].
Adversarial Attack  
Model  No Attack  FGSM = 0.3  PGD = 0.3  
Original 
99.13  25.88  0.10  

98.98  11.37 %  0  

98.60  86.57  61.01  

98.93  91.55  85.88  

98.22  93.10  96.53  

From Table II we can observe that the model trained with clean dataset and rotation augmented dataset are vulnerable to adversarial attacks, which shows that affine transformation augmented data training is orthogonal to adversarial attack. PGD is a relatively stronger attack compared to FGSM, and has a higher attack success rate, which shows that adversarial sample augmented training has its limitation: a stronger attack can defeat a model trained with a weaker attack. ADISGAN has consistently good performance with those 2 attacks, which shows it may capture a smoother data distribution that involves larger adversarial manifolds.
IvC Interpretability
Affine Disentangled GAN (ADISGAN) can express the data distribution in a more interpretable way, which mitigates the black box problem of deep learning to some degree. In this section, mapping between rotation angle and latent vectors is shown to explain how the algorithm understands rotational knowledge. Generated images are shown to demonstrate the relationship between latent space and data space.
As we can observe from Fig. 6, the latent vector values have a linear relationship with rotation angle. This explains why ADISGAN is robust against image rotation since it can interpret the rotation angles of the given image, which provides information that helps to understand potential misclassifications.
Fig. 7 and Fig. 8 show how the generated images change with latent vectors. These figures illustrate how the algorithm represents information.
V Conclusion and Future Work
Deep CNN based vision systems play a major role in the autonomous vehicle (AV) perception system. However, deep CNNs are not robust against affine transformations and adversarial attacks. The former could happen during normal driving scenarios when the vehicle is hitting water puddles or on rural roads, while the latter could happen when a malicious attack is implemented. It is necessary to overcome these challenges before integrating deep CNN based vision system to safetyrelated applications such autonomous vehicles (AV).
In this paper, we present the Affine Disentangled GAN (ADISGAN), which is robust to both rotation transformations and adversarial attacks. We also introduce the development of affine regularizer. We show that affine transformation augmented and adversarial augmented training is orthogonal, which means they can only defend typical attack they have been trained with.
Affine regularizer captures the symmetry transformations between latent space and image space during affine transformation. We believe there are many such kinds of symmetries in the physical world. By successfully mapping those symmetries, we can make the deep learning algorithm more robust and interpretable.
References
 [1] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. CoRR, abs/1707.07397, 2017.
 [2] Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. CoRR, abs/1608.04644, 2016.
 [3] Xi Chen, Yan Duan, Rein Houthooft, John Schulman, Ilya Sutskever, and Pieter Abbeel. Infogan: Interpretable representation learning by information maximizing generative adversarial nets. CoRR, abs/1606.03657, 2016.
 [4] Jeff Donahue, Philipp Krähenbühl, and Trevor Darrell. Adversarial feature learning. CoRR, abs/1605.09782, 2016.
 [5] Logan Engstrom, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry. A rotation and a translation suffice: Fooling cnns with simple transformations. CoRR, abs/1712.02779, 2017.
 [6] Robert Gens and Pedro M Domingos. Deep symmetry networks. In Z. Ghahramani, M. Welling, C. Cortes, N. D. Lawrence, and K. Q. Weinberger, editors, Advances in Neural Information Processing Systems 27, pages 2537–2545. Curran Associates, Inc., 2014.
 [7] Ian Goodfellow, Jean PougetAbadie, Mehdi Mirza, Bing Xu, David WardeFarley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Z. Ghahramani, M. Welling, C. Cortes, N. D. Lawrence, and K. Q. Weinberger, editors, Advances in Neural Information Processing Systems 27, pages 2672–2680. Curran Associates, Inc., 2014.
 [8] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. CoRR, abs/1412.6572, 2014.
 [9] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. CoRR, abs/1512.03385, 2015.
 [10] Irina Higgins, David Amos, David Pfau, Sébastien Racanière, Loïc Matthey, Danilo J. Rezende, and Alexander Lerchner. Towards a definition of disentangled representations. CoRR, abs/1812.02230, 2018.
 [11] Geoffrey E. Hinton, Alex Krizhevsky, and Sida D. Wang. Transforming autoencoders. In Proceedings of the 21th International Conference on Artificial Neural Networks  Volume Part I, ICANN’11, pages 44–51, Berlin, Heidelberg, 2011. SpringerVerlag.
 [12] Tobias Hinz and Stefan Wermter. Inferencing based on unsupervised learning of disentangled representations. CoRR, abs/1803.02627, 2018.
 [13] Max Jaderberg, Karen Simonyan, Andrew Zisserman, and Koray Kavukcuoglu. Spatial transformer networks. CoRR, abs/1506.02025, 2015.
 [14] Angjoo Kanazawa, Abhishek Sharma, and David W. Jacobs. Locally scaleinvariant convolutional neural networks. CoRR, abs/1412.5104, 2014.
 [15] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolutional neural networks. In Proceedings of the 25th International Conference on Neural Information Processing Systems  Volume 1, NIPS’12, pages 1097–1105, USA, 2012. Curran Associates Inc.
 [16] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. CoRR, abs/1607.02533, 2016.
 [17] Yann LeCun and Corinna Cortes. MNIST handwritten digit database. 2010.
 [18] Francesco Locatello, Stefan Bauer, Mario Lucic, Sylvain Gelly, Bernhard Schölkopf, and Olivier Bachem. Challenging common assumptions in the unsupervised learning of disentangled representations. CoRR, abs/1811.12359, 2018.
 [19] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. CoRR, abs/1706.06083, 2017.
 [20] SeyedMohsen MoosaviDezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. CoRR, abs/1511.04599, 2015.
 [21] Nicolas Papernot, Patrick D. McDaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. Practical blackbox attacks against deep learning systems using adversarial examples. CoRR, abs/1602.02697, 2016.
 [22] Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. CoRR, abs/1511.06434, 2015.
 [23] Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox v0.8.0: A python toolbox to benchmark the robustness of machine learning models. CoRR, abs/1707.04131, 2017.
 [24] Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defensegan: Protecting classifiers against adversarial attacks using generative models. CoRR, abs/1805.06605, 2018.

[25]
Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K. Reiter.
Accessorize to a crime: Real and stealthy attacks on stateoftheart face recognition.
In ACM Conference on Computer and Communications Security, pages 1528–1540. ACM, 2016. 
[26]
Kihyuk Sohn and Honglak Lee.
Learning invariant representations with local transformations.
In
Proceedings of the 29th International Coference on International Conference on Machine Learning
, ICML’12, pages 1339–1346, USA, 2012. Omnipress.  [27] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jonathon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. CoRR, abs/1512.00567, 2015.
 [28] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. CoRR, abs/1312.6199, 2013.
 [29] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Dan Boneh, and Patrick D. McDaniel. Ensemble adversarial training: Attacks and defenses. CoRR, abs/1705.07204, 2017.
Appendix A Two Affine Transformation Orders
In principle, there are 6 sequences of affine transformations (R for rotation, K for skew, Z for zoom):

RKZ  1,

RZK  1,

KRZ  2,

KZR  2,

ZKR  2,

ZRK  1.
The zoom operation can be inserted arbitrarily in the sequence, since it is a commutative operation. On the other hand, rotation and skew are noncommutative, therefore, their order in the sequence is essential. We can categorize the sequences according to whether the rotation operator is applied before skew or vice versa, leading to two different categories.
The affine transformation RKZ, which is an example of the first category, can be written as:
(16) 
The affine transformation KRZ, which is an example of the second category, can be written as:
(17) 
The matrix elements are computed as follows (left: category 1, right: category 2):
(18)  
(19)  
(20)  
(21) 
We can observe that A_{12} and A_{21} are the same for both categories, while A_{11} and A_{22} are different.
Comments
There are no comments yet.