Renovando estudos comportamentais para o modelo CLIP
Arquivos
Data
2022-02
Autores
Galindo, Yuri Oliveira 
Orientadores
Faria, Fabio Augusto
Tipo
Trabalho de conclusão de curso
Título da Revista
ISSN da Revista
Título de Volume
Resumo
Redes neurais são capazes de atingir níveis altíssimos de desempenho em problemas como reconhecimento de imagem quando testadas em condições controladas, como 90% de acerto no desafio ImageNet. No entanto, ao testar esses modelos em condições adversas observamos uma falta de robustez — o desempenho cai ao lidar com variações, como por exemplo a variação natural presente em um novo conjunto de dados. Um caso extremo dessa falta de robustez é demonstrado nos exemplos adversariais — imagens que são alteradas com modificações imperceptíveis para humanos mas capazes de enganar o modelo, que faz classificações erradas com altíssima confiança. Embora não haja explicações definitivas para a existência de exemplos adversariais e a falta de robustez das redes neurais, alguns estudos apontam possíveis culpados, como a dependência excessiva na textura dos objetos (humanos utilizam primariamente a forma), e a dependência em regularidades pequenas que se aplicam para um conjunto reduzido de imagens mas que podem induzir ao erro no caso geral. O CLIP (Contrastive Language-Image Pre-training) é um novo modelo de rede neural que apresenta uma melhora considerável na robustez quando testado em imagens de novas distribuições, mas se mostra ainda vulnerável a ataques adversariais. Esse novo modelo se diferencia dos seus predecessores em alguns pontos-chave, como a quantidade de imagens no conjunto de dados, arquitetura, e método de treinamento. Os experimentos que buscam explicar os problemas de robustez a existência de exemplos adversariais se baseiam principalmente em modelos Resnet, treinados na base de dados Imagenet. Dessa forma, o CLIP apresenta uma oportunidade ideal de verificar se as conclusões apresentadas por esses estudos continuam pertinentes, ou se elas se aplicavam apenas aos modelos anteriores. Assim, buscamos fortalecer a relação entre a teoria e a parte empírica da área de exemplos adversariais e robustez, estendendo o conhecimento atual ao atualizar as hipóteses existentes para um modelo novo. Realizamos três experimentos utilizando o CLIP, baseados em experimentos existentes: medição do viés de textura, verificação da vulnerabilidade a perturbações de diferentes frequências, e geração de imagens para verificação de features robustas. Nos dois primeiros experimentos observamos que o CLIP obtém comportamento mais robusto do que os modelos anteriores, indicando uma correlação entre a melhora nesses aspectos e a melhora do modelo ao ser testado em novas distribuições. No entanto, no terceiro experimento não observamos comportamento robusto — indicando que essa característica pode estar ligada apenas a exemplos adversariais. Com esses resultados, conseguimos entender melhor quais características parecem estar relacionadas com melhor desempenho em dados de novas distribuições, e quais parecem estar relacionadas apenas com vulnerabilidade a exemplos adversariais. Se trata de uma contribuição para o entendimento de redes neurais, e que pode indicar direções promissoras para modelos futuros.
Neural networks are able to achieve very high performance in problems such as image classification in controlled conditions, such as 90% accuracy in the Imagenet challenge. However, these models show lack of robustness when tested in adverse conditions: performance falls when dealing with variation, such as the natural variation due to the change to a new dataset. An extreme example of this lack of robustness is the existence of adversarial examples — images altered in a way that is imperceptible to humans but leads models to make wrong and highly confident predictions. Currently, there is no definitive explanation for the existence of adversarial examples and the lack of robustness of Neural Networks. However, studies raise hypotheses and suggest some possible culprits, such as the dependency on texture information (humans rely firstly on shape), and learned regularities that can correctly classify a reduced dataset but lead to mistakes on the general case. CLIP (Contrastive Language-Image Pre-training) is a new Neural Network model that shows considerable improvement on robustness to new distributions. However, it remains vulnerable to adversarial examples. This new model is different from its predecessors in some key points, such as the dataset and number of training examples, network architecture, and training procedure. The studies that aimed to explain the lack of robustness and existence of adversarial examples were based on experiments performed primarily on Resnet models trained on the Imagenet dataset. Therefore, CLIP is the ideal model for verifying if the conclusions reached by these studies remain valid, or if they applied solely to the previous models. Our experiments aim to extend the existing knowledge and discussion, strengthening the empirical aspect of robustness and adversarial examples research. We performed three experiments with CLIP, based on existing work: measurement of texture bias, measurement of vulnerability of perturbations of various frequencies, and image generation for assessment of robust features. On the first two experiments, CLIP showed more robust behavior than previous models, indicating a correlation between progress in these aspects and its good performance on new distributions. However, the third experiment didn't show robust behavior - indicating that this characteristic may be only related to adversarial examples. With these results, we can better understand which characteristics seem to be related with better performance on data from new distributions, and which may be only related to adversarial examples. It's a contribution to the understanding of neural networks, and that may indicate promising directions for future models.
Neural networks are able to achieve very high performance in problems such as image classification in controlled conditions, such as 90% accuracy in the Imagenet challenge. However, these models show lack of robustness when tested in adverse conditions: performance falls when dealing with variation, such as the natural variation due to the change to a new dataset. An extreme example of this lack of robustness is the existence of adversarial examples — images altered in a way that is imperceptible to humans but leads models to make wrong and highly confident predictions. Currently, there is no definitive explanation for the existence of adversarial examples and the lack of robustness of Neural Networks. However, studies raise hypotheses and suggest some possible culprits, such as the dependency on texture information (humans rely firstly on shape), and learned regularities that can correctly classify a reduced dataset but lead to mistakes on the general case. CLIP (Contrastive Language-Image Pre-training) is a new Neural Network model that shows considerable improvement on robustness to new distributions. However, it remains vulnerable to adversarial examples. This new model is different from its predecessors in some key points, such as the dataset and number of training examples, network architecture, and training procedure. The studies that aimed to explain the lack of robustness and existence of adversarial examples were based on experiments performed primarily on Resnet models trained on the Imagenet dataset. Therefore, CLIP is the ideal model for verifying if the conclusions reached by these studies remain valid, or if they applied solely to the previous models. Our experiments aim to extend the existing knowledge and discussion, strengthening the empirical aspect of robustness and adversarial examples research. We performed three experiments with CLIP, based on existing work: measurement of texture bias, measurement of vulnerability of perturbations of various frequencies, and image generation for assessment of robust features. On the first two experiments, CLIP showed more robust behavior than previous models, indicating a correlation between progress in these aspects and its good performance on new distributions. However, the third experiment didn't show robust behavior - indicating that this characteristic may be only related to adversarial examples. With these results, we can better understand which characteristics seem to be related with better performance on data from new distributions, and which may be only related to adversarial examples. It's a contribution to the understanding of neural networks, and that may indicate promising directions for future models.