{'fraction_non_alphanumeric': 0.013581129378127233, 'fraction_numerical': 0.0, 'mean_word_length': 5.306306306306307, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Induced Attention Invariance: Defending VQA Models against Adversarial Attacks

Deep learning models are increasingly being deployed in a wide number of safety critical applications, which makes protecting them from adversarial attacks a topic of paramount importance. In this paper we study state of the art adversarial attacks and their effect on top performing Visual Question Answering (VQA) models. Since most modern VQA architectures rely heavily on the use of attention, we hypothesize that defending VQA models against adversarial attacks involves protecting the attention maps from distortion due to these attacks. Based on this hypothesis, we propose a new loss term which we name as ‘Induced attention Invariance loss’ (IAI) which is designed to reduce variations in the attention maps due to such distortions. We evaluate the advantages of this approach on a number of top performing VQA models and show that models trained with our proposed IAI loss are almost twice as robust as standard models against state of the art adversarial attacks. We further analyze the effect of adversarial attacks on attention maps and confirm that the adversarial attacks typically distort the attention maps, leading them to focus on the incorrect image regions while also reducing their sharpness. In comparison, models trained with our proposed IAI loss show increased robustness to these distortions.