WSAM: Visual Explanations from Style Augmentation as Adversarial Attacker and Their Influence in Image Classification

In the first neural algorithm [Gatys et al., 2015], a content image and a style image are inputted to the neural network to obtain an output image with the original content but a new style. [Jing et al., 2017] employed the Gram matrices to model textures by encoding the correlations between convolutional features from different layers. Previous style transfer works [Ulyanov et al., 2017] improve the visual fidelity in which semantic structure was preserved for images with higher resolution. In [Geirhos et al., 2018] was concluded that neural networks have a strong bias with texture. Although the initial developments generated exciting results compared to the pioneer method, drawbacks such as weak texture synthesis and high computational cost were present [Ulyanov et al., 2017, Jing et al., 2017]. More recently, [Li et al., 2018, Ghiasi et al., 2017] solved the problem by relying on arbitrary styles without retraining the neural model. Also, other techniques adjusted a new parameter or inserted noise carefully to generate more style variations from one style input [Ghiasi et al., 2017, Kotovenko, Dmytro, adn Sanakoyeu, Artsiom, and Lang, Sabine, and Ommer, 2019]. Using these latter strategies, the first augmentation employing successfully style augmentation performing a cross-domain classification task [Jackson et al., 2018] follows the methodology adopted on [Ghiasi et al., 2017], which uses an Inception-v3 [Szegedy et al., 2015] architecture for the encoder and residual blocks for the decoder networks. However, the latent space is modified by a multivariate normal distribution which changes the style embedding. Other contemporary approaches [Zheng et al., 2019, Georgievski, 2019] used style augmentation and reported exciting results in classification tasks, specifically STL-10, CIFAR-100, and Tiny-ImageNet-200 datasets. Other interesting applications are extended to segmentation tasks [Hesse et al., 2019, Gkitsas et al., 2019].

Based on this literature review, we used a neural transfer model following a trade-off between edge preservation, flexibility to generate style variations, time processing, and best visual fidelity under different styles. We also compare our methodology to prior approaches used for style augmentation.

Explaining a CNN is focused on analyzing the information passed through each layer inside the network. Following this idea, several methods were proposed to visualize and obtain a notion about which features of a deep CNN were activated in one specific layer. In [Simonyan et al., 2013] (saliency maps) showed the convolutional activations, [Zeiler and Fergus, 2014] showed the impact of applying occlusion to the input image. In other methods, they use the gradients to visualize features and explain deep CNN networks such as DeepLIFT [Shrikumar et al., 2017], which computes scores for each feature; Integrated Gradients [Sundararajan et al., 2017], which computes features based on gradients; CAM [Zhou et al., 2016], and Grad-CAM [Selvaraju et al., 2017] which computes relevant regions using gradient and feature maps. Each method identifies features with high and strong activation representing the prediction for a specific predicted category.

Guided by this literature review, we propose a new method called Style Activation Maps (SAM) based on the Grad-CAM method applied to style augmentation. We choose this one due to better behavior and performance against adversarial attacks or noise-adding techniques [Adebayo et al., 2018, Gilpin et al., 2018]. Our main goal is to understand and interpret the impact of applying style augmentation in classification tasks and analyze their influence.

For our experiments, we used the same methodology as [Jackson et al., 2018]; we nevertheless used a faster VGG-based network and added noise to diversify the style features. Specifically, we used an architecture composed of a generalized form of a linear transformation [Li et al., 2018]. Also, we compare with other related works [Jackson et al., 2018, Zheng et al., 2019] that use neural style augmentation.

Formally, let $C=\big{\{}c_{1},c_{2},...,c_{j}\big{\}},c_{i}\in\mathbb{R}^{N\times M\times C}$ be the content image set and let $Z=\big{\{}z_{1},z_{2},...,z_{i}\big{\}},z_{i}\in\mathbb{R}^{n}$ be the precomputed style embedding set from $S=\big{\{}s_{1},s_{2},...,s_{i}\big{\}},s_{i}\in\mathbb{R}^{N\times M\times C}$, are used to feed the styling algorithm to generate the output set $O=\big{\{}o_{1},o_{2},...,o_{j}\big{\}},o_{j}\in\mathbb{R}^{N\times M\times C}$. Moreover, we denote zero-mean vectors $\overline{c}_{j}\in\mathbb{R}^{N\times M\times C}$ and $\overline{z}_{i}\in\mathbb{R}^{n}$. Our style strategy transfers elements $z_{i}$ from the style set $Z$ to a specific element from the content set $C$.

The VGG (“r41”) architecture, denoted as $M(.)$, maps $\mathbb{R}^{N\times M\times C}\rightarrow\mathbb{R}^{N_{1}\times M_{1}\times F}$. and a non-linear function $\phi(.)$ maps $\mathbb{R}^{N_{1}\times M_{1}\times F_{1}}\rightarrow\mathbb{R}^{n}$, where $N_{1}<N$, $M_{1}<M$ and $F_{1}>F$. Also, we denote $C(.)$, $U(.)$ as the compress and uncompress CNN-based networks from the original paper [Li et al., 2018]. $\phi(.)$ embeds the input image to an embedding vector that contains the semantic information of the image. More concisely, we use this non-linear function to map the original image to an embedding vector as shown in Eq. 1 for the content image and Eq. 2 for the style image. In our implementation, the function $\phi(.)$ employs a CNN whose output is used to compute the covariance matrix and feed it to a fully-connected layer.

Since we use an architecture based on linear transformations, which is generalized from previous approaches [Ghiasi et al., 2017], the transformation matrix $T$ sets and preserves the feature affinity of the content image (determined by the covariance matrix of the content and the style). This is expressed in Eq. 3. In our implementation, we precomputed the style vectors and saved all textures in memory; thereby, our modifications are described in Eq.  4 and 5.

In our implementation, we precompute the style vector and save all textures in memory; thereby, our modifications are expressed in Eq. 4 and 5.

Where $\alpha$ is the interpolation hyper-parameter which controls the strength of the style transfer similarly to [Jackson et al., 2018], and $\hat{z_{i}}$, defined in Eq. 6, is the embedding vector of the style set with a noise addition for style randomization.

As argued in prior methodologies, minor variations increase the randomization in the process; thereby, we apply noise instead of using a sampling strategy similar to applying a Gaussian noise in the latent space of generative networks during the training. In particular, we set this noise source as a multivariate normal distribution which means covariance scales and shifts $\overline{z}_{i}$ into the embedding space. This is also useful for understanding the randomization process and the influence of the latent space.

In this work, we propose a new method Style Activation Map based on Grad-CAM to visualize the predictions and the highlighting regions with the most representative activated features from styled images. To do this, we extract from the penultimate layer the $A^{k}\in\mathbb{R}^{u\times v}$ feature maps of width u and height v, with each element indexed by i,j. So $A^{k}_{i,j}$ refers to the activation at location $(i,j)$ of the feature map $A^{k}$. We apply the GlobalAveragePooling (GAP) technique to the feature maps to get the neuron importance weights defined in Eq. 7.

Where $\delta^{c}_{k}$ represents the neuron importance weights, c is the class, $Z=u\times v$ the size of the image, k is the k-th feature map, $A^{k}_{ij}$ is the feature map, $y^{c}$ the score for class c, and $\frac{\partial y^{c}}{\partial A^{k}_{ij}}$ is the gradient vector obtained via back-propagation. Next, we calculate the corresponding activation maps for each prediction using Eq. 7. From this point, we propose a new technique to visualize the highlighted regions in stylization and their variations. We present two methods: the Style Activation Map (SAM) defined as the relevant highlighted regions of the different styles in predictions and the Weighted Style Activation Map (WSAM) defined as the weighted sum of all styles applied in all samples per class.

We denote the SAM of a styled image with style $\sigma$, style intensity $\alpha$, and class c by $I_{\alpha,\sigma}^{c}$. Where $\alpha$ is the style intensity used, $\sigma$ is the style used. Also, we have the k-th feature activation maps $A^{k}\in\mathbb{R}^{u\times v}$, and their class score $y^{c}$ for class c:

We apply the ReLU function to the weighted linear combination of the feature maps $A^{k}$ because we are only interested in features with a positive influence. Then, we use this result to obtain the WSAM doing a weighted mean of $SAM^{c}_{\alpha,\sigma}$ and their predictions $y^{c}_{\alpha,\sigma}$ using all styles and all intensities. We define $\Omega$ as the product of total styles and total intensities evaluated, so we have:

Once we calculate $WSAM^{c}$ in eq. 9 we will calculate the total variance region of $m$ samples to identify the most significant styles features for the classifier:

Where $I^{c}_{i}$ is the i-th input sample stylized with $\alpha=1.0$ (no style), $Z=u\times v$ the image size, and their class score $y^{c}_{i}$ for the class c. Our metric shows the highlighted region variance between an image and its styles with different $\alpha$s.

First, we explore the effects of style augmentation through t-SNE visualization of images after applying the styler network to a subset of the test set Figure 1(a); we note some clusters of original images and their styles separate a bit of distance such as truck and horse. In Figure 1(b), we performed some styles using some $\alpha$ values to find the best balance between style and content information as described above in Eq. 5. However, we emphasize the difference between traditional augmentation and the classical technique like rotation, mirroring, cutout [DeVries and Taylor, 2017], etc. With style augmentation, we increase the number of samples using about 80 000 styles and sampling for style intensity. Figure 1(b) shows different styles and different $\alpha$ values (style intensity) from 0.0 to 1.0 by steps of 0.2.

Images with augmentation strategies for training deep models include traditional augmentations, cutouts, and our style augmentation method using a lower style effect ($\alpha=0.7$). At this point, we can consider style augmentation as a noise-adding technique or adversarial attacker due to the style distortion, which makes images more challenging to represent and be associated with the correct class.

For experiments, we define four learning strategies, which are composed of no augmentation (None or N/A), traditional augmentation (Trad), style augmentation (SA), and both (Trad+SA) for each model. In Table 1, we present the quantitative comparisons between the state-of-the-art methods in style augmentation using styling and architectures for the STL-10 dataset; the Extra column means additional data is used to train that model, Trad column means traditional augmentation plus cutout, and Style column indicates our style augmentation.

We note that in all cases, style augmentation helps to improve results. Besides, we found that models with higher input resolution reached higher accuracy after applying the styling method shown in Figure 2(a). Experiments on different input sizes support this affirmation [Chollet, 2016].

Furthermore, in Figure 2(b), we analyze the influence of style additions to a subset of the test set composed of 100 samples (10 samples per class), computing their average accuracy in each point on axis X consisting of an overall 20,000 random styles, these styles were sorted following from greater to lower accuracy. Note that the accuracy of the model trained without style augmentation decreased drastically for some styles. In contrast, the use of styles in training becomes the same architecture more robust to strong variations without losing accuracy.