Current Deep Neural Networks are vulnerable to adversarial examples, which
alter their predictions by adding carefully crafted noise. Since human eyes are
robust to such inputs, it is possible that the vulnerability stems from the
standard way of processing inputs in one shot by processing every pixel with
the same importance. In contrast, neuroscience suggests that the human vision
system can differentiate salient features by (1) switching between multiple
fixation points (saccades) and (2) processing the surrounding with a
non-uniform external resolution (foveation). In this work, we advocate that the
integration of such active vision mechanisms into current deep learning systems
can offer robustness benefits. Specifically, we empirically demonstrate the
inherent robustness of two active vision methods - GFNet and FALcon - under a
black box threat model. By learning and inferencing based on downsampled
glimpses obtained from multiple distinct fixation points within an input, we
show that these active methods achieve (2-3) times greater robustness compared
to a standard passive convolutional network under state-of-the-art adversarial
attacks. More importantly, we provide illustrative and interpretable
visualization analysis that demonstrates how performing inference from distinct
fixation points makes active vision methods less vulnerable to malicious
inputs.

当前深度神经网络容易受到对抗样本的攻击，添加有针对性的噪音改变预测结果。本研究提出将主动视觉机制融入深度学习系统，通过从不同的注视点获取下采样视觉片段进行学习和推理，实现更大幅度的鲁棒性提升，同时可视化分析证明了从不同注视点进行推理使主动视觉方法对恶意输入更加抵抗。