High-Frequency Component Helps Explain the Generalization ...

1 High-Frequency Component Helps Explainthe Generalization of Convolutional neural NetworksHaohan Wang, Xindi Wu, Zeyi Huang, Eric P. XingSchool of Computer ScienceCarnegie Mellon investigate the relationship between the frequencyspectrum of image data and the Generalization behaviorof convolutional neural networks (CNN). We first noticeCNN s ability in capturing the High-Frequency componentsof images. These High-Frequency components are almost im-perceptible to a human. Thus the observation leads to multi-ple hypotheses that are related to the Generalization behav-iors of CNN, including a potential explanation for adver-sarial examples, a discussion of CNN s trade-off betweenrobustness and accuracy, and some evidence in understand-ing training IntroductionDeep learning has achieved many recent advances in pre-dictive modeling in various tasks, but the community hasnonetheless become alarmed by the unintuitive generaliza-tion behaviors of neural networks, such as the capacity inmemorizing label shuffled data [65] and the vulnerabilitytowards adversarial examples [54,21]To Explain the Generalization behaviors of neural net-works, many theoretical breakthroughs have been madeprogressively, including studying the properties of stochas-tic gradient descent [31], different complexity measures[46], Generalization gaps [50], and many more from differ-ent model or algorithm perspectives [30,43,7,51].

2 In this paper, inspired by previous understandings thatconvolutional neural networks (CNN) can learn from con-founding signals [59] and superficial signals [29,19,58],we investigate the Generalization behaviors of CNN froma data perspective. Together with [27], we suggest thatthe unintuitive Generalization behaviors of CNN as a directoutcome of the perceptional disparity between human andmodels (as argued by Figure1):CNN can view the data ata much higher granularity than the human , different from [27], we provide an interpreta-Label semantic High-Frequency How a human understands the data Distribution-specific correlation What a model picks up Data Figure 1. The central hypothesis of our paper: within a data col-lection, there are correlations between the High-Frequency com-ponents and the semantic Component of the images. As a re-sult, the model will perceive both High-Frequency components aswell as the semantic ones, leading to Generalization behaviorscounter-intuitive to human ( , adversarial examples).

3 Tion of this high granularity of the model s perception:CNNcan exploit the High-Frequency image components that arenot perceivable to example, Figure2shows the prediction results ofeight testing samples from CIFAR10 data set, together withthe prediction results of the high and low-frequency compo-nent counterparts. For these examples, the prediction out-comes are almost entirely determined by the high-frequencycomponents of the image, which are barely perceivable tohuman. On the other hand, the low-frequency components,which almost look identical to the original image to human,are predicted to something distinctly different by the by the above empirical observations, we fur-ther investigate the Generalization behaviors of CNN andattempt to Explain such behaviors via differential responsesto theimage frequency spectrumof the inputs (Remark 1).Our main contributions are summarized as follows:8684(a) A sample of frog(b) A sample of mobile(c) A sample of ship(d) A sample of bird(e) A sample of truck(f) A sample of cat(g) A sample of airplane(h) A sample of shipFigure 2.

4 Eight testing samples selected from CIFAR10 that help Explain that CNN can capture the High-Frequency image: the model(ResNet18) correctly predicts the original image (1stcolumn in each panel) and the High-Frequency reconstructed image (3rdcolumn ineach panel), but incorrectly predict the low-frequency reconstructed image (2ndcolumn in each panel). The prediction confidences are alsoshown. The frequency components are split withr= 12. Details of the experiment will be introduced later. We reveal the existing trade-off between CNN s accu-racy and robustness by offering examples of how CNNexploits the High-Frequency components of images totrade robustness for accuracy (Corollary1). With image frequency spectrum as a tool, we offerhypothesis to Explain several Generalization behaviorsof CNN, especially the capacity in memorizing label-shuffled data. We propose defense methods that can help improvingthe adversarial robustness of CNN towards simple at-tacks without training or fine-tuning the remainder of the paper is organized as follows.

5 InSection2, we first introduce related discussions. In Sec-tion3, we will present our main contributions, including aformal discussion on that CNN can exploit high-frequencycomponents, which naturally leads to the trade-off betweenadversarial robustness and accuracy. Further, in Section4-6,we set forth to investigate multiple Generalization behaviorsof CNN, including the paradox related to capacity of mem-orizing label-shuffled data ( 4), the performance boost in-troduced by heuristics such as Mixup and BatchNorm ( 5),and the adversarial vulnerability ( 6). We also attempt toinvestigate tasks beyond image classification in , we will briefly discuss some related topics in Sec-tion8before we conclude the paper in Related WorkThe remarkable success of deep learning has attracted atorrent of theoretical work devoted to explaining the gener-alization mystery of example, ever since Zhanget al.[65] demonstratedthe effective capacity of several successful neural networkarchitectures is large enough to memorize random labels,the community sees a prosperity of many discussions aboutthis apparent paradox [61,15,17,15,11].

6 Arpitet al.[3]demonstrated that effective capacity are unlikely to explainthe Generalization performance of gradient-based-methodstrained deep networks due to the training data largely deter-mine memorization. Krugeret al.[35] empirically argues byshowing largest Hessian eigenvalue increased when trainingon random labels in deep concept of adversarial example [54,21] has becomeanother intriguing direction relating to the behavior of neu-ral networks. Along this line, researchers invented powerfulmethods such as FGSM [21], PGD [42], and many others[62,9,53,36,12] to deceive the models. This is known asattack methods. In order to defend the model against the de-ception, another group of researchers proposed a wide rangeof methods (known asdefense methods) [1,38,44,45,24].These are but a few highlights among a long history of pro-posed attack and defense methods. One can refer to com-prehensive reviews for detailed discussions [2,10]However, while improving robustness, these methodsmay see a slight drop of prediction accuracy, which leadsto another thread of discussion in the trade-off between ro-bustness and accuracy.

7 The empirical results in [49] demon-strated that more accurate model tend to be more robust overgenerated adversarial examples. While [25] argued that theseemingly increased robustness are mostly due to the in-creased accuracy, and more accurate models ( , VGG,ResNet) are actually less robust than AlexNet. Theoreti-cal discussions have also been offered [56,67], which alsoinspires new defense methods [67].86853. High-Frequency Components & CNN s Gen-eralizationWe first set up the basic notations used in this paper:hx,yidenotes a data sample (the image and the correspond-ing label).f( ; )denotes a convolutional neural networkwhose parameters are denoted as . We useHto denotea human model, and as a result,f( ;H)denotes how hu-man will classify the data .l( , )denotes a generic lossfunction ( , cross entropy loss). ( , )denotes a functionevaluating prediction accuracy (for every sample, this func-tion the sample is correctly classified, ).d( , )denotes a function evaluating the distancebetween two ( )denotes the Fourier transform;thus,F 1( )denotes the inverse Fourier transform.

8 We usezto denote the frequency Component of a sample. There-fore, we havez=F(x)andx=F 1(z).Notice that Fourier transform or its inverse may intro-duce complex numbers. In this paper, we simply discardthe imaginary part of the results ofF 1( )to make sure theresulting image can be fed into CNN as CNN Exploit High-Frequency ComponentsWe decompose the raw datax={xl,xh}, wherexlandxhdenote the low-frequency Component (shortened asLFC) and High-Frequency Component (shortened asHFC)ofx. We have the following four equations:z=F(x),zl,zh=t(z;r),xl=F 1(zl),xh=F 1(zh),wheret( ;r)denotes a thresholding function that separatesthe low and high frequency components fromzaccordingto a hyperparameter, definet( ;r)formally, we first consider a grayscale(one channel) image of sizen nwithNpossible pixelvalues (in other words,x Nn n), then we havez Cn n, whereCdenotes the complex number. We usez(i, j)to index the value ofzat position(i, j), and we useci, cjtodenote the centroid.

9 We have the equationzl,zh=t(z;r)formally defined as:zl(i, j) ={z(i, j),ifd((i, j),(ci, cj)) r0,otherwise,zh(i, j) ={0,ifd((i, j),(ci, cj)) rz(i, j),otherwiseWe considerd( , )int( ;r)as the Euclidean distance inthis paper. Ifxhas more than one channel, then the proce-dure operates on every channel of pixels an assumption (referred to as A1) that pre-sumes onlyxlis perceivable to human, but bothxlandxhare perceivable to a CNN, we have:y:=f(x;H) =f(xl;H),but when a CNN is trained witharg min l(f(x; ),y),which is equivalent toarg min l(f({xl,xh}; ),y),CNN may learn to exploitxhto minimize the loss. As aresult, CNN s Generalization behavior appears unintuitiveto a that CNN may learn to exploitxh differs from CNN overfit becausexhcan contain more informationthan sample-specific idiosyncrasy, and these more informa-tion can be generalizable across training, validation, andtesting sets, but are just imperceptible to a Assumption A1 has been demonstrated to hold insome cases ( , in Figure2), we believe Remark1canserve as one of the explanations to CNN s generalizationbehavior.}}

10 For example, the adversarial examples [54,21]can be generated by perturbingxh; the capacity of CNNin reducing training error to zero over label shuffled data[65] can be seen as a result of exploitingxhand overfittingsample-specific idiosyncrasy. We will discuss more in thefollowing Trade-off between Robustness and AccuracyWe continue with Remark1and discuss CNN s trade-offbetween robustness and accuracy given from the imagefrequency perspective. We first formally state the accuracyof as:E(x,y) (f(x; ),y)(1)and the adversarial robustness of as , [8]:E(x,y)minx :d(x ,x) (f(x ; ),y)(2)where is the upper bound of the perturbation another assumption (referred to as A2): for model , there exists a samplehx,yisuch that:f(x; )6=f(xl; ), we can extend our main argument (Remark1) to a formalstatement:Corollary assumptions A1 and A2, there exists asamplehx,yithat the model cannot predict both accu-rately (evaluated to be by Equation1) and robustly(evaluated to be by Equation2) under any distance met-ricd( , )and bound as long as d(x,xl).