Awais

selected publications

1. arXiv

   Foundational Models Defining a New Era in Vision: A Survey and Outlook

   Awais, Muhammad, Muzammal, Naseer, Khan, Salman, Anwer, Rao Muhammad, Cholakkal, Hisham, Shah, Mubarak, Yang, Ming-Hsuan, and Khan, Fahad Shahbaz

   Under Review (arXiv) 2023

   PDF Code
2. arXiv

   FROD: Robust Object Detection for Free

   Awais, Muhammad, Weiming, Zhuang, Lingjuan, , Lyu, , and Sung-Ho, Bae

   Under Review (arXiv) 2023
3. NeurIPS

   ZooD: Exploiting model zoo for out-of-distribution generalization

   Qishi, Dong*, Awais, Muhammad, *, , Zhou, Fengwei, Xie, Chuanlong, Hu, Tianyang, Yang, Yongxin, Sung-Ho, Bae, and Li, Zhenguo

   Conference on Neural Information Processing Systems (NeurIPS) 2022

   PDF
4. NeurIPS

   MixACM: Mixup-Based Robustness Transfer via Distillation of Activated Channel Maps

   Awais, Muhammad, Fengwei, Zhou, Chuanlong, Xie, Jiawei, Li, Sung-Ho, Bae, and Zhenguo, Li

   Conference on Neural Information Processing Systems (NeurIPS) 2021

   Abs PDF

   Deep neural networks are susceptible to adversarially crafted, small and imperceptible changes in the natural inputs. The most effective defense mechanism against these examples is adversarial training which constructs adversarial examples during training by iterative maximization of loss. The model is then trained to minimize the loss on these constructed examples. This min-max optimization requires more data, larger capacity models, and additional computing resources. It also degrades the standard generalization performance of a model. Can we achieve robustness more efficiently? In this work, we explore this question from the perspective of knowledge transfer. First, we theoretically show the transferability of robustness from an adversarially trained teacher model to a student model with the help of mixup augmentation. Second, we propose a novel robustness transfer method called Mixup-Based Activated Channel Maps (MixACM) Transfer. MixACM transfers robustness from a robust teacher to a student by matching activated channel maps generated without expensive adversarial perturbations. Finally, extensive experiments on multiple datasets and different learning scenarios show our method can transfer robustness while also improving generalization on natural images.

5. ICCV

   Adversarial Robustness for Unsupervised Domain Adaptation

   Awais, Muhammad, Fengwei, Zhou, Hang, Xu, Lanqing, Hong, Ping, Luo, Sung-Ho, Bae, and Zhenguo, Li

   Internatioanl Conference on Computer Vision (ICCV) 2021

   Abs HTML PDF

   Extensive Unsupervised Domain Adaptation (UDA) studies have shown great success in practice by learning transferable representations across a labeled source domain and an unlabeled target domain with deep models. However, previous works focus on improving the generalization ability of UDA models on clean examples without considering the adversarial robustness, which is crucial in real-world applications. Conventional adversarial training methods are not suitable for the adversarial robustness on the unlabeled target domain of UDA since they train models with adversarial examples generated by the supervised loss function. In this work, we leverage intermediate representations learned by multiple robust ImageNet models to improve the robustness of UDA models. Our method works by aligning the features of the UDA model with the robust features learned by ImageNet pre-trained models along with domain adaptation training. It utilizes both labeled and unlabeled domains and instills robustness without any adversarial intervention or label requirement during domain adaptation training. Experimental results show that our method significantly improves adversarial robustness compared to the baseline while keeping clean accuracy on various UDA benchmarks.

6. TNNLS

   Revisiting Internal Covariant Shift for Batch Normalization

   Awais, Muhammad, Md. Tauhid Bin, Iqbal, and Sung-Ho, Bae

   IEEE Transactions on Neural Networks and Learning Systems (TNNLS) 2020

   Abs HTML

   Despite the success of Batch Normalization (BatchNorm) and a plethora of its variants, the exact reasons for its success are still shady. The original BatchNorm paper explained it as a mechanism that reduces the Internal Covariate Shift (ICS), i.e., the distribution shifts in the input of the layers during training. Recently, some papers manifested skepticism on this hypothesis and provided \textitalternative explanations for the success of BatchNorm, such as the applicability of very high learning rates and the ability to smooth the landscape in optimization. In this work, we counter this textit alternative arguments by demonstrating the importance of reduction in ICS following an empirical approach. We demonstrated various ways to achieve the above-mentioned alternative properties without any performance boost. In this light, we explored the importance of different BatchNorm parameters (i.e., batch statistics, affine transformation parameters) by visualizing their effectiveness in the performance and analyzed their connections with ICS. Afterward, we showed a different normalization scheme that fulfills all alternative explanations except reduction in ICS. Despite having all the alternative properties, we observed its poor performance, which nullifies the alternative claims rather signifies the importance of the ICS reduction. We performed comprehensive experiments on many variants of BatchNorm, finding that all of them similarly reduce ICS.

7. arXiv

   Towards Adversarially Robust Normalization Approach

   Awais, Muhammad, Fahad, Shamshad, and Sung-Ho, Bae

   Under Review 2020

   Abs PDF

   Batch Normalization (BatchNorm) is effective for improving performance and accelerating the training of deep neural networks. However, it is also a cause of adversarial vulnerability. In this paper, we first investigated how BatchNorm causes this vulnerability. We observed that adversarial inputs tend to shift the distributions of the BatchNorm layer. This shift makes train-time estimated statistics of BatchNorm inaccurate. We hypothesize that these inaccurate statistics make models with BatchNorm more vulnerable to adversarial attacks. We empirically verified our hypothesis by conducting multiple experiments on a diverse set of architectures and datasets. Based on the insights from these experiments, we also proposed a robust version of BatchNorm. We experimentally show that models trained with RobustNorm perform better under adversarial settings while retaining the benefits of BatchNorm.