Pith. sign in

REVIEW 3 major objections 5 minor 31 references

Edge-Based Learning for Improved Classification Under Adversarial Noise

T0 review · 3 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Training image classifiers on Canny edge maps makes them markedly more robust to FGSM adversarial noise than training on raw images.

desk verdict A plausible but under-tested claim: edge-trained models look robust against FGSM only because the attack is run on edge maps, not through the non-differentiable Canny transform. read the letter →

arxiv 2504.20077 v1 pith:LS2M7AP7 submitted 2025-04-25 cs.CV cs.AI

Manish Kansana , Keyan Alexander Rahimi , Elias Hossain , Iman Dehzangi , Noorbakhsh Amiri Golilarz This is my paper · ORCID
classification cs.CVcs.AI
keywords adversarialnoiseFGSMCannyedgedetectionedge-basedlearningimageclassificationrobustnessbraintumorMRICOVID-19chestX-ray
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether the structural edges of an image survive adversarial perturbation better than the full image, and whether training solely on edges therefore makes classifiers harder to fool. The authors report that, across six architectures and two medical imaging datasets, models trained on Canny edge maps keep far higher accuracy on FGSM-perturbed test images than models trained on raw pixels—for instance, a CNN on brain tumor data holds 86% versus 56%, and on COVID X-rays 91% versus 68%. Retraining on a 1:1 mix of clean and noisy images improves both representations, with raw-image models recovering more absolute accuracy while edge models stay more robust. The paper argues that FGSM noise exploits non-edge, texture-rich regions far more than it disrupts edge structure, so edge-based learning is a useful defense.

What carries the argument

The load-bearing object is the Canny edge map, a binary image of sharp intensity boundaries produced by Gaussian smoothing, Sobel gradient magnitude computation, non-maximum suppression, and double thresholding. The paper converts each image to grayscale, applies Canny detection with threshold values 100 and 200, normalizes the binary map to $[0,1]$, and replicates it across three channels so standard architectures can consume it. This representation does the work of stripping away texture and color so that models learn from structure alone. The attack used to test robustness is FGSM, which adds $\epsilon \, \mathrm{sign}(\nabla_x J(\theta, x, y))$ to the input; the paper's comparisons evaluate accuracy on clean and noisy versions of both raw and edge inputs.

What would settle it

Run the same six-model comparison with PGD, or with FGSM noise computed through a differentiable approximation of the edge-extraction pipeline, at the same epsilon values; if edge-trained noisy accuracy falls to or below raw-trained accuracy, the claimed edge robustness is an artifact of the non-adaptive attack.

Watch

Extended reading notes

Core claim

On its own terms, the central claim is that Canny edges are a more robust input representation for deep image classifiers under FGSM. The evidence is a systematic comparison in which models were trained and tested on two versions of the same data—original images and Canny edge maps—with adversarial noise added at small epsilon values. In nearly every row of the comparison tables, edge-trained accuracy on noisy test images exceeds raw-trained accuracy by a wide margin, and this holds on both the brain tumor and COVID datasets. Retraining on combined clean and noisy images raises noisy accuracy for both representations, but the edge-trained models continue to lead under noise; the raw-image models gain more in absolute points. Pixel-level visualizations show the perturbation is barely visible in raw images but clearly visible in edge maps, consistent with the claim that edges carry the structure the attack leaves intact.

Load-bearing premise

The load-bearing premise is that FGSM noise generated against the model under test is the relevant threat model, and that the drop in accuracy under that attack is the right measure of robustness.

Editorial extensions

If this is right

  • For medical image classifiers operating under small bounded perturbations, edge-only training can preserve clinically relevant accuracy where raw-image training collapses—the reported margins are 30 points or more on the CNN.
  • Retraining on clean plus noisy images is a cheap, architecture-agnostic robustness boost: raw-image CNNs recovered 18 points on brain tumor and 8 points on COVID, while edge models stayed above 86% noisy accuracy.
  • Because FGSM noise is model-specific—noise from one architecture barely fools others—evaluating robustness requires specifying which model generated the noise; the paper's fooling-rate table provides a template for that comparison.
  • Edge-based representations can serve as a complement rather than a replacement: raw-image retraining recovers more absolute accuracy, suggesting that raw and edge inputs carry different useful signal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The reported robustness may partly reflect attack non-adaptivity: Canny detection is non-differentiable, and FGSM noise is computed against the raw-image model, so the perturbation is not aligned to the edge-classifier loss. An adaptive PGD attack or a differentiable surrogate of the edge pipeline could erode the margin; the paper does not test this.
  • The same reasoning suggests a testable extension: jointly training on raw and edge channels, rather than either alone, should combine raw-image recoverability with edge robustness; the paper's own retraining numbers hint at this but the paper does not try it.
  • The argument that edges are 'stable' could be examined directly by measuring per-pixel perturbation magnitude on edge versus non-edge pixels under FGSM across many images; the paper shows visual evidence but does not quantify it.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies the effect of FGSM adversarial noise on medical image classifiers and proposes training on Canny edge maps as a robustness-improving representation. The authors train CNN, ResNet50, VGG16, VGG19, InceptionV3, and DenseNet on two datasets (brain tumor MRI and COVID X-ray), evaluate clean and FGSM-noisy accuracy, and then retrain models on a 1:1 mix of clean and noisy images. Their main empirical finding is that models trained on Canny edge maps retain higher accuracy under FGSM noise than models trained on raw images (Tables 3 and 4), while retraining improves raw-image models more in absolute terms but leaves edge-trained models more robust in most cases. The paper concludes that edge-based learning improves resilience to adversarial perturbations.

Significance. If the robustness advantage of edge-based training holds under realistic attack models, the result would be a lightweight, architecture-agnostic preprocessing defense, which could be attractive in medical imaging settings. The paper has concrete strengths: it surveys six architectures over two datasets, reports cross-model fooling rates, and includes a retraining comparison with a fixed dataset size. The contribution is empirical and reproducible in principle, although no code is provided. The central claim is not yet established, however, because the evaluation attacks each model in its own input representation and never tests an adaptive adversary that perturbs raw images before edge extraction. The significance is therefore conditional on whether the edge advantage survives such a test.

major comments (3)
  1. [§4.1, Tables 3 and 4] The central comparison is asymmetrical. Raw-trained models are attacked with FGSM noise computed on raw images, while edge-trained models are attacked with FGSM noise computed on pre-extracted edge maps. Because Canny edge detection involves non-differentiable operations (gradient magnitude thresholding, non-maximum suppression, and hysteresis), the attack on the edge model does not optimize over perturbations to the raw image that would survive edge extraction. A deployment adversary would perturb the raw input before the edge transform is applied, and this scenario is never tested. This is the gradient-masking situation discussed in the paper's own reference [2], yet no adaptive attack, no differentiable approximation of the preprocessing, and no cross-representation transfer attack is reported. Until the edge model is evaluated under attacks that account for the full raw-image-to-edge pipeline, the headline claim that edge-based training is more resilient to adversarial attacks is not established for natural-image inputs.
  2. [§4.1, §4.2, Tables 3 and 4] No estimate of variability is reported, even though the text states that 'accuracy varied slightly between runs.' Several of the headline margins are small: for ResNet50 on Brain Tumor, the noisy accuracy is 67% on original versus 66% on edges, and after retraining it is 70% versus 72% (Table 3). These differences could be within run-to-run variation. The authors should report means and standard deviations over multiple seeds, or confidence intervals, or paired significance tests for the main comparisons in Tables 3 and 4. Without this, the quantitative strength of the central claim is difficult to assess.
  3. [§4.1, §2, Fig. 1] The FGSM perturbation magnitude is inconsistent across the paper: the accuracy experiments in §4.1 use an epsilon of 0.015, the visualization experiment in §4.1 uses 0.04, and Fig. 1 uses 0.05. Robustness results depend strongly on epsilon, so every reported accuracy needs its epsilon stated, and the main comparisons in Tables 3 and 4 should be run at a single epsilon or, preferably, across a sweep of epsilon values to show that the edge advantage is not an artifact of one perturbation magnitude.
minor comments (5)
  1. [§2, Fig. 1] The text says adversarial noise introduces 'non important pixels, particularly around the edges,' while the paper's hypothesis is that edges remain relatively stable; these statements should be reconciled, ideally with quantitative pixel-level measurements rather than only visual examples.
  2. [§4.1, 'Visualizing noise effects'] The paper repeatedly refers to 'pixel-wise analysis,' but the supporting evidence is qualitative figure inspection; actual pixel statistics, such as the number of changed edge pixels or the distribution of perturbation magnitudes on edge versus non-edge regions, would make the claim testable.
  3. [Tables 3 and 4] There are formatting typos in the headers ('T raining', 'Model T raining') that should be corrected.
  4. [References] Reference [29] contains a typo, 'exa mples,' and the reference list would benefit from a consistency pass.
  5. [§4.1] Details of the retraining subset selection, dataset splits, and random seeds are not specified; providing these would improve reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the edge-robustness comparison is an empirical measurement, not a construction that equates output with input.

full rationale

The paper is an empirical study. Its central claim—that models trained on Canny edge maps retain higher accuracy under FGSM noise than models trained on raw images—is established by the measurements in Tables 3 and 4, not by a derivation. The FGSM perturbation in Eq. (1) is the standard white-box attack from Goodfellow et al., and the Canny procedure is an external image transform; neither is defined in terms of the reported noisy accuracies. No model parameter is fitted to the noisy-test accuracies and then renamed as a prediction. There are no equations whose output equals an input by construction, and there is no load-bearing self-citation: the cited Athalye et al. work is used only to acknowledge that defenses can be bypassed, not to justify the empirical result. The main caveat is that the attack is generated in the same representation used for training (raw images for Model A, edge maps for Model B), so the comparison does not test an adversary who perturbs raw images and then applies Canny preprocessing; this is a threat-model/validity concern, not circularity, because the edge model's noisy accuracy is still an independently measured quantity. Since the paper makes no fitted-theory claim and derives no result from its own conclusion, there is no definitional equivalence to flag.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

No new entities are invented. The load-bearing choices are the FGSM epsilon, the Canny thresholds, and the implicit assumption that the attack setup is representative. These are hand-chosen parameters and domain assumptions rather than fitted physical constants.

free parameters (2)
  • FGSM epsilon values = 0.015, 0.04, 0.05 (used inconsistently across experiments)
    The epsilon magnitude controls attack strength and is chosen by hand; different values are used in different experiments, making comparisons across tables inconsistent.
  • Canny edge detection thresholds = 100 and 200
    The thresholds determine which edges are kept and are chosen by hand; no sensitivity analysis is provided, though the central claim depends on this choice.
assumptions (3)
  • domain assumption Canny edge detection with fixed thresholds preserves the class-relevant information in the brain tumor and COVID images.
    The entire method assumes that edges retain enough information for the classification task; if edges discarded diagnostic content, the accuracy comparison would be meaningless.
  • domain assumption FGSM generated for a given model is a representative adversarial threat for that model.
    The paper evaluates robustness only against FGSM, treating it as sufficient to demonstrate edge resilience, without testing stronger adaptive attacks.
  • domain assumption The test set is not used to set thresholds or training choices.
    The paper does not explicitly state that the Canny thresholds or retraining subset were selected without looking at test performance; the lack of a held-out validation protocol creates a risk of selection bias.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Edge-Based Learning for Improved Classification Under Adversarial Noise." pith.science (2026). https://pith.science/paper/LS2M7AP7

@misc{pith2026250420077,
  author       = {Pith},
  title        = {Pith review of: Edge-Based Learning for Improved Classification Under Adversarial Noise},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LS2M7AP7}},
  note         = {Machine review of arXiv:2504.20077}
}
read the original abstract

Adversarial noise introduces small perturbations in images, misleading deep learning models into misclassification and significantly impacting recognition accuracy. In this study, we analyzed the effects of Fast Gradient Sign Method (FGSM) adversarial noise on image classification and investigated whether training on specific image features can improve robustness. We hypothesize that while adversarial noise perturbs various regions of an image, edges may remain relatively stable and provide essential structural information for classification. To test this, we conducted a series of experiments using brain tumor and COVID datasets. Initially, we trained the models on clean images and then introduced subtle adversarial perturbations, which caused deep learning models to significantly misclassify the images. Retraining on a combination of clean and noisy images led to improved performance. To evaluate the robustness of the edge features, we extracted edges from the original/clean images and trained the models exclusively on edge-based representations. When noise was introduced to the images, the edge-based models demonstrated greater resilience to adversarial attacks compared to those trained on the original or clean images. These results suggest that while adversarial noise is able to exploit complex non-edge regions significantly more than edges, the improvement in the accuracy after retraining is marginally more in the original data as compared to the edges. Thus, leveraging edge-based learning can improve the resilience of deep learning models against adversarial perturbations.

Figures

Figures reproduced from arXiv: 2504.20077 by the authors.

Figure 1
Figure 1. Visual comparison of clean and noisy images, along with their corresponding edges. Each patch is of size 32×32, extracted from the original and noisy 224×224 images, with noise added at an epsilon of 0.05. (a) illustrates examples from the Brain Tumor dataset [13], and (b) shows samples from the COVID-19 dataset [18,8,7,26]. to approximate the target model’s behavior and generate adversarial examples based on the su… view at source ↗
Figure 2
Figure 2. The process of training and retraining the model. Initially, the clean dataset is used to train and test a model, then a noisy dataset is created by introducing adversarial noise. The model is tested on both clean and noisy images to evaluate its baseline performance. A subset of the clean data is combined with the noisy training data, forming a new dataset for retraining. Finally, this retrained model undergoes eva… view at source ↗
Figure 3
Figure 3. Visual comparison of noise generated by models A and B. (a) represents the original or clean image from the Brain Tumor dataset, (b) represents the adversarial image generated using FGSM, (c) and (d) are the canny edge detected version of the (a) and (b) images, (e) and (f) represent the clean edges image and the corresponding adversarial image generated with Model B, respectively. the same hyperparameters, batch si… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Visual comparison of noise generated for the COVID dataset. training on edge images is more resilient against adversarial attacks generated using FGSM, compared to training on original images [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 11 canonical work pages

  1. [2]

    In: International confer- ence on machine learning

    Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In: International confer- ence on machine learning. pp. 274–283. PMLR (2018)

    2018

  2. [1]

    Ieee Access6, 14410–14430 (2018)

    Akhtar, N., Mian, A.: Threat of adversarial attacks on deep learning in computer vision: A survey. Ieee Access6, 14410–14430 (2018)

    work page 2018

  3. [3]

    In: 2022 45th International Conference on Telecommunications and Signal Processing (TSP)

    Ayas, M.S., Ayas, S., Djouadi, S.M.: Projected gradient descent adversarial attack and its defense on a fault diagnosis system. In: 2022 45th International Conference on Telecommunications and Signal Processing (TSP). pp. 36–39. IEEE (2022)

    work page 2022

  4. [4]

    arXiv preprint arXiv:1712.09665 (2017)

    Brown, T.B., Mané, D., Roy, A., Abadi, M., Gilmer, J.: Adversarial patch. arXiv preprint arXiv:1712.09665 (2017)

    arXiv 2017

  5. [5]

    IEEE Transactions on pattern analysis and machine intelligence (6), 679–698 (1986)

    Canny, J.: A computational approach to edge detection. IEEE Transactions on pattern analysis and machine intelligence (6), 679–698 (1986)

    1986

  6. [6]

    In: 2017 ieee symposium on security and privacy (sp)

    Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 ieee symposium on security and privacy (sp). pp. 39–57. Ieee (2017)

    2017

  7. [7]

    IEEE Dataport10 (2020)

    Chen, Z.: Mask-rcnn detection of covid-19 pneumonia symptoms by employing stacked autoencoders in deep unsupervised learning on low-dose high resolution ct. IEEE Dataport10 (2020)

    work page 2020

  8. [8]

    Cohen, J.P., Morrison, P., Dao, L.: Covid-19 image data collection (2020),https: //arxiv.org/abs/2003.11597

    arXiv 2020

Show all 31 references
  1. [9]

    arXiv preprint arXiv:2402.09154 (2024)

    Geisler, S., Wollschläger, T., Abdalla, M., Gasteiger, J., Günnemann, S.: At- tacking large language models with projected gradient descent. arXiv preprint arXiv:2402.09154 (2024)

    2024 arXiv

  2. [10]

    arXiv preprint arXiv:1412.6572 (2014)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  3. [11]

    arXiv preprint arXiv:1702.06280 (2017)

    Grosse, K., Manoharan, P., Papernot, N., Backes, M., McDaniel, P.: On the (sta- tistical) detection of adversarial examples. arXiv preprint arXiv:1702.06280 (2017)

    2017 arXiv

  4. [12]

    arXiv preprint arXiv:1412.5068 (2014)

    Gu,S.,Rigazio,L.:Towardsdeepneuralnetworkarchitecturesrobusttoadversarial examples. arXiv preprint arXiv:1412.5068 (2014)

    2014 arXiv

  5. [13]

    Hamada, A.: BR35H: Brain Tumor Detection Dataset.https://www.kaggle.com/ datasets/ahmedhamada0/brain-tumor-detection/data (2020), accessed: 2025- 04-22

    2020

  6. [14]

    He,K.,Zhang,X.,Ren,S.,Sun,J.:Deepresiduallearningforimagerecognition.In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)

    2016

  7. [15]

    In: proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    He, Z., Rakin, A.S., Fan, D.: Parametric noise injection: Trainable randomness to improve deep neural network robustness against adversarial attack. In: proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 588– 597 (2019)

    2019

  8. [16]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Huang, G., Liu, Z., Van Der Maaten, L., Weinberger, K.Q.: Densely connected convolutional networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 4700–4708 (2017) 16 Manish Kansana et al

    2017

  9. [17]

    arXiv preprint arXiv:1702.02284 (2017)

    Huang, S., Papernot, N., Goodfellow, I., Duan, Y., Abbeel, P.: Adversarial attacks on neural network policies. arXiv preprint arXiv:1702.02284 (2017)

    2017 arXiv

  10. [18]

    Mendeley Data3(10.17632) (2018)

    Kermany, D., Zhang, K., Goldbaum, M.: Large dataset of labeled optical coherence tomography (oct) and chest x-ray images. Mendeley Data3(10.17632) (2018)

    2018

  11. [19]

    In: Artificial intelligence safety and security, pp

    Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial examples in the physical world. In: Artificial intelligence safety and security, pp. 99–112. Chapman and Hall/CRC (2018)

    2018

  12. [20]

    Proceedings of the IEEE86(11), 2278–2324 (1998)

    LeCun, Y., Bottou, L., Bengio, Y., Haffner, P.: Gradient-based learning applied to document recognition. Proceedings of the IEEE86(11), 2278–2324 (1998)

    1998

  13. [21]

    In: 2019 IEEE symposium on security and privacy (SP)

    Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., Jana, S.: Certified robustness to adversarial examples with differential privacy. In: 2019 IEEE symposium on security and privacy (SP). pp. 656–672. IEEE (2019)

    2019

  14. [22]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., Zhu, J.: Defense against adver- sarial attacks using high-level representation guided denoiser. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 1778–1787 (2018)

    2018

  15. [23]

    arXiv preprint arXiv:1706.06083 (2017)

    Madry, A.: Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

    2017 arXiv

  16. [24]

    arXiv preprint arXiv:1702.04267 (2017)

    Metzen, J.H., Genewein, T., Fischer, V., Bischoff, B.: On detecting adversarial perturbations. arXiv preprint arXiv:1702.04267 (2017)

    2017 arXiv

  17. [25]

    In: 2016 IEEE European sym- posium on security and privacy (EuroS&P)

    Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.: The limitations of deep learning in adversarial settings. In: 2016 IEEE European sym- posium on security and privacy (EuroS&P). pp. 372–387. IEEE (2016)

    2016

  18. [26]

    https://doi.org/10.21227/s7pw-jr18, https://dx.doi.org/10.21227/ s7pw-jr18

    Sheet, D., Chakravarty, A., Sarkar, T., Sathish, R., Raj, A., Balasubramanian, V., Rajan, R., Sathish, R., Chakravorty, N., Sinha, M., Sharma, M., Kumar, V., Kumar, R., Kumar, A., Singhal, A., Reddy, G.: Covid19action-radiology-cxr (2020). https://doi.org/10.21227/s7pw-jr18, h...

    2020 doi

  19. [27]

    arXiv preprint arXiv:1409.1556 (2014)

    Simonyan, K.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)

    2014 arXiv

  20. [28]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., Wojna, Z.: Rethinking the incep- tion architecture for computer vision. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 2818–2826 (2016)

    2016

  21. [29]

    arXiv preprint arXiv:1704.01155 (2017)

    Xu, W.: Feature squeezing: Detecting adversarial exa mples in deep neural net- works. arXiv preprint arXiv:1704.01155 (2017)

    2017 arXiv

  22. [30]

    IEEE/ACM Transactions on Networking30(3), 1294–1311 (2022)

    Zhang, C., Costa-Perez, X., Patras, P.: Adversarial attacks against deep learning- based network intrusion detection systems and defense mechanisms. IEEE/ACM Transactions on Networking30(3), 1294–1311 (2022)

    2022

  23. [31]

    Advances in neural information processing systems31 (2018)

    Zhang, H., Weng, T.W., Chen, P.Y., Hsieh, C.J., Daniel, L.: Efficient neural net- work robustness certification with general activation functions. Advances in neural information processing systems31 (2018)

    2018

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.