Assessing Document Classification in Adversarial Settings

In recent years, the use of computers to classify documents like ID cards and invoices has become more popular. However, many computer vision systems that analyze images have shown weaknesses, especially when faced with specially crafted inputs called Adversarial Attacks. These attacks are designed to trick the system into making wrong classifications. Most research has focused on regular images, but document images are quite different and require a new approach.

The main goal of this work is to assess how well current Document Classification systems can deal with these adversarial attacks. The research uses various methods to create adversarial inputs and tests how well popular models perform against these attacks. This article discusses the findings and implications for future work in this area.

#The Importance of Document Classification

With the rise in the volume of documents handled by large organizations, computer vision techniques have become an effective way to classify these documents automatically. This technology helps in sorting through various types of documents, such as ads, emails, and handwritten notes, making business processes more efficient. However, these classification systems must be robust against adversarial attacks that can easily exploit their weaknesses.

#The Problem of Adversarial Attacks

Adversarial attacks are inputs that have been slightly modified to confuse the model, leading to incorrect classifications. These attacks are particularly concerning in sensitive applications where misclassification can have serious consequences. For example, if a document is misclassified as an invoice instead of an ID card, it could lead to significant processing errors.

Existing studies have shown that computer vision models are often vulnerable to such attacks. Many of these studies have used datasets designed for common image classification tasks, like ImageNet. However, document images are different; they often contain text, structured layouts, and specific colors or backgrounds that make them distinct from natural images.

#Setting the Stage for Evaluation

To properly evaluate the robustness of document classification systems, a suitable dataset and a well-defined threat model must be established. The RVL-CDIP dataset was chosen for this study. It includes 400,000 black-and-white document images, categorized into 16 types, making it a comprehensive choice for testing.

The researchers devised a threat model that defines the goals and capabilities of those attempting to execute adversarial attacks. This model aims to guide the evaluation of how well the document classification systems withstand different types of attacks.

#Various Types of Attacks

To assess the effectiveness of different attacks, a variety of methods were employed. Some attacks are designed to work when the attacker has complete knowledge of the model, known as white-box attacks. Others do not require such knowledge and are called black-box attacks.

1. Gradient-based Attacks: These attacks generate perturbations based on the model's parameters to confuse the classification. Several methods, including Fast Gradient Method and Momentum Iterative Method, were used in this study.

2. Transfer-based Attacks: These involve creating adversarial examples from a different, often simpler model. The goal is to see if these examples can still mislead the target model.

3. Score-based Attacks: This type is based on querying the model to understand its predictions and then generating examples that exploit those predictions.

#Models and Defense Strategies

The researchers focused on two popular deep learning models: EfficientNetB0 and ResNet50. These models have been shown to perform well in classifying document images.

A variety of defense strategies were also tested. These included:

1. JPEG Compression: By compressing document images into JPEG format before they were classified, the hope was to introduce a layer of protection against attacks.

2. Grey-Scale Transformation: Since the document images in the dataset were mostly in grey-scale, averaging the color values aimed to simplify the input while maintaining performance.

3. Adversarial Training: This effective strategy involves training the model with adversarial examples during the learning process, thereby improving its resilience against future attacks.

#Experimentation and Results

The researchers conducted numerous experiments to measure how well the models withstand various attacks. Each model's accuracy was assessed under normal conditions and during attacks.

For gradient-based attacks, under certain conditions, the performance of models dropped significantly, as low as 0.6% accuracy in some cases. While JPEG compression and grey-scale transformations provided some benefits, they were inconsistent. In contrast, adversarially trained models showed minimal drops in accuracy, proving to be much more resilient.

Transfer-based attacks also highlighted weaknesses. Models that were undefended suffered a considerable drop in performance when faced with adversarial examples generated from robust substitute models.

Score-based attacks were similarly challenging, revealing that the models without any defense would perform poorly, while adversarially trained models maintained a decent level of accuracy even under attack.

#Conclusions and Future Directions

The research concludes that convolutional models such as EfficientNetB0 and ResNet50 are particularly vulnerable to carefully crafted adversarial examples, especially under optimal attack conditions. Techniques like JPEG compression do not consistently enhance robustness, though adversarial training proves to be highly effective.

Given the unique challenges posed by document images, there is a clear need for ongoing study in this area. Future research could explore multimodal models that utilize additional context from layout and text, potentially leading to more sophisticated defenses.

As document classification systems become increasingly integrated into various industries, ensuring their reliability against adversarial attacks will be critical. The findings in this study serve as a stepping stone for further investigations aimed at safeguarding these systems from emerging threats in the field of artificial intelligence.