Foveation-based Mechanisms Alleviate Adversarial Examples

We show that adversarial examples, i.e. the visually imperceptible perturbations that result in Convolutional Neural Networks (CNN) fail, can be alleviated with a mechanism based on foveations -applying the CNN in a different image region. To see this, first, we report results in ImageNet that lead to a revision of the hypothesis that adversarial perturbations are a consequence of CNNs acting too linearly: a CNN acts locally linearly, only to changes in the receptive fields with objects recognized by the CNN, otherwise the CNN acts non-linearly. Then, we corroborate the hypothesis that when the neural responses are in the linear region, applying the foveation mechanism to the adversarial example tends to reduce the effect of the perturbation. This is because CNNs in ImageNet are robust to changes produced by the foveation (scale and translation of the recognized objects), but this property does not generalize to transformations of the perturbation.