Abstract
Algorithms that fuse multiple input sources benefit from both complementaryand shared information. Shared information may provide robustness to faulty ornoisy inputs, which is indispensable for safetycritical applications likeselfdriving cars. We investigate learning fusion algorithms that are robustagainst noise added to a single source. We first demonstrate that robustnessagainst single source noise is not guaranteed in a linear fusion model.Motivated by this discovery, two possible approaches are proposed to increaserobustness: a carefully designed loss with corresponding training algorithmsfor deep fusion models, and a simple convolutional fusion layer that has astructural advantage in dealing with noise. Experimental results show that bothtraining algorithms and our fusion layer make a deep fusionbased 3D objectdetector robust against noise applied to a single source, while preserving theoriginal performance on clean data.
Quick Read (beta)
On Single Source Robustness in Deep Fusion Models
Abstract
Algorithms that fuse multiple input sources benefit from both complementary and shared information. Shared information may provide robustness to faulty or noisy inputs, which is indispensable for safetycritical applications like selfdriving cars. We investigate learning fusion algorithms that are robust against noise added to a single source. We first demonstrate that robustness against single source noise is not guaranteed in a linear fusion model. Motivated by this discovery, two possible approaches are proposed to increase robustness: a carefully designed loss with corresponding training algorithms for deep fusion models, and a simple convolutional fusion layer that has a structural advantage in dealing with noise. Experimental results show that both training algorithms and our fusion layer make a deep fusionbased 3D object detector robust against noise applied to a single source, while preserving the original performance on clean data.
On Single Source Robustness in Deep Fusion Models
Taewan Kim The University of Texas at Austin Austin, TX 78712 [email protected] Joydeep Ghosh The University of Texas at Austin Austin, TX 78712 [email protected]
noticebox[b]Preprint. Under review.\[email protected]
1 Introduction
Deep learning models have accomplished superior performance in several machine learning problems (LeCun et al., 2015) including object recognition (Krizhevsky et al., 2012; Simonyan and Zisserman, 2015; Szegedy et al., 2015; He et al., 2016; Huang et al., 2017), object detection (Ren et al., 2015; He et al., 2017; Dai et al., 2016; Redmon et al., 2016; Liu et al., 2016; Redmon and Farhadi, 2017) and speech recognition (Hinton et al., 2012; Graves et al., 2013; Sainath et al., 2013; Chorowski et al., 2015; Chan et al., 2016; Chiu et al., 2018), which use either visual or audio sources. One natural way of improving a model’s performance is to make use of multiple input sources relevant to a given task so that enough information can be extracted to build strong features. Therefore, deep fusion models have recently attracted considerable attention for autonomous driving (Kim and Ghosh, 2016; Chen et al., 2017; Qi et al., 2018; Ku et al., 2018), medical imaging (Kiros et al., 2014; Wu et al., 2013; Simonovsky et al., 2016; Liu et al., 2015), and audiovisual speech recognition (Huang and Kingsbury, 2013; Mroueh et al., 2015; Sui et al., 2015; Chung et al., 2017).
Two benefits are expected when fusionbased learning models are selected for a given problem. First, given adequate data, more information from multiple sources can enrich the model’s feature space to achieve higher prediction performance, especially, when different input sources provide complementary information to the model. This expectation coincides with a simple information theoretic fact: if we have multiple input sources ${X}_{1},\mathrm{\cdots},{X}_{m}$ and a target variable $Y$, mutual information $I(;)$ obeys $I(Y;{X}_{1},\mathrm{\cdots},{X}_{m})\ge I(Y;{X}_{i})(\forall i\in [m])$.
The second expected advantage is increased robustness against single source faults, which is the primary concern of our work. An underlying intuition comes from the fact that different sources may have shared information so one sensor can partially compensate for others. This type of robustness is critical in realworld fusion models, because each source may be exposed to different types of corruption but not at the same time. For example, LIDARs used in autonomous vehicles work fine at night whereas RGB cameras do not. Also, each source used in the model may have its own sensing device, and hence not necessarily be corrupted by some physical attack simultaneously with others. It would be ideal if the structure of machine learning based fusion models and shared information could compensate for the corruption and automatically guarantee robustness without additional steps.
This paper shows that a fusion model needs a supplementary strategy and a specialized structure to avoid vulnerability to noise or corruption on a single source. Our contributions are as follows:

•
We show that a fusion model learned with a standard robustness is not guaranteed to provide robustness against noise on a single source. Inspired by the analysis, a novel loss is proposed to achieve the desired robustness (Section 3).

•
Two efficient training algorithms for minimizing our loss in deep fusion models are devised to ensure robustness without impacting performance on clean data (Section 4.1).

•
We introduce a simple but an effective fusion layer which naturally reduces error by applying ensembling to latent convolutional features (Section 4.2).
We apply our loss and the fusion layer to a complex deep fusionbased 3D object detector used in autonomous driving for further investigation in practice. Note that our findings can be easily generalized to other applications exhibiting intermittent defects in a subset of input sources.
2 Related Works
Deep fusion models have been actively studied in object detection for autonomous vehicles. There exist two major streams classified according to their algorithmic structures: twostage detectors with RCNN (Regionbased Convolutional Neural Networks) technique (Girshick et al., 2014; Girshick, 2015; Ren et al., 2015; Dai et al., 2016; He et al., 2017), and single stage detectors for faster inference speed (Redmon et al., 2016; Redmon and Farhadi, 2017; Liu et al., 2016).
Earlier deep fusion models extended Fast RCNN (Girshick, 2015) to provide better quality of region proposals from multiple sources (Kim and Ghosh, 2016; Braun et al., 2016). With a highresolution LIDAR, point cloud was used as a major source of the region proposal stage before the fusion step (Du et al., 2017), whereas FPointNet (Qi et al., 2018) used it for validating 2D proposals from RGB images and predicting 3D shape and location within the visual frustum. MV3D (Chen et al., 2017) extended the idea of region proposal network (RPN) (Ren et al., 2015) by generating proposals from RGB image, and LIDAR’s front view and BEV (bird’s eye view) maps. Recent works tried to remove region proposal stages for faster inference and directly fused LIDAR’s front view depth image (Kim et al., 2018b) or BEV image (Wang et al., 2018) with RGB images. ContFuse (Liang et al., 2018) utilizes both RGB and LIDAR’s BEV images with a new continuous fusion scheme, which is further improved in MMF (Liang et al., 2019) by handling multiple tasks at once. Our experimental results are based on AVOD (Ku et al., 2018), a recent opensourced 3D object detector that generates region proposals from RPN using RGB and LIDAR’s BEV images.
Compared to the active efforts in accomplishing higher performance on clean data, very few works have focused on robust learning methods in multisource settings to the best of our knowledge. Adaptive fusion methods using gating networks weight the importance of each source automatically (Mees et al., 2016; Valada et al., 2017), but these works lack indepth studies of the robustness against single source faults. A recent work proposed a gated fusion at the feature level and applied data augmentation techniques with randomly chosen corruption methods (Kim et al., 2018a). In contrast, our training algorithms are surrogate minimization schemes for the proposed loss function, which is grounded from the analyses on underlying weakness of fusion methods. Also the fusion layer proposed in this paper focuses more on how to mix convolutional feature maps channelwise with simple trainable procedures. For extensive literature reviews, please refer to the recent survey papers about deep multimodal learning methods in general (Ramachandram and Taylor, 2017) and for autonomous driving (Feng et al., 2019).
3 Single Source Robustness of Fusion Models
3.1 Regression on linear fusion data
To show the vulnerability of naive fusion models, we introduce a simple data model and a fusion algorithm. Suppose $y$ is a linear function consisting of three different inherent (latent) components ${z}_{i}\in {\mathbb{R}}^{{d}_{i}}$ $(i\in \{1,2,3\})$. There are two input sources, ${x}_{1}$ and ${x}_{2}$. Here $\psi $’s are unknown functions.
$$y=\sum _{i=1}^{3}\beta _{i}{}^{T}{z}_{i},\text{where}{z}_{1}={\psi}_{1}({x}_{1}),{z}_{2}={\psi}_{2}({x}_{2}),{z}_{3}={\psi}_{3,1}({x}_{1})={\psi}_{3,2}({x}_{2})$$  (1) 
Our simple data model simulates a target variable $y$ relevant to two different sources, where each source has its own special information ${z}_{1}$ and ${z}_{2}$ and a shared one ${z}_{3}$. For example, if two sources are obtained from an RGB camera and a LIDAR sensor, one can imagine that any features related to objectness are captured in ${z}_{3}$ whereas colors and depth information may be located in ${z}_{1}$ and ${z}_{2}$, respectively. Our objective is to build a regression model by effectively incorporating information from the sources $({x}_{1},{x}_{2})$ to predict the target variable $y$.
Now, consider a fairly simple setting ${x}_{1}=[{z}_{1};{z}_{3}]\in {\mathbb{R}}^{{d}_{1}+{d}_{3}}$ and ${x}_{2}=[{z}_{2};{z}_{3}]\in {\mathbb{R}}^{{d}_{2}+{d}_{3}}$, where $({\psi}_{1},{\psi}_{2},{\psi}_{3,1},{\psi}_{3,2})$ can be defined accordingly to satisfy (1). A straightforward fusion approach is to stack the sources, i.e. $x=[{x}_{1};{x}_{2}]\in {\mathbb{R}}^{{d}_{1}+{d}_{2}+2{d}_{3}}$, and learn a linear model. Then, it is easy to show that there exists a feasible errorfree model for noisefree data:
$${f}_{\text{direct}}({x}_{1},{x}_{2})={h}_{1}^{T}{x}_{1}+{h}_{2}^{T}{x}_{2}=({\beta}_{1}^{T}{z}_{1}+{g}_{1}^{T}{z}_{3})+({\beta}_{2}^{T}{z}_{2}+{g}_{2}^{T}{z}_{3}),s.t.{g}_{1}+{g}_{2}={\beta}_{3}$$  (2) 
where ${h}_{1}=[{\beta}_{1};{g}_{1}],{h}_{2}=[{\beta}_{2};{g}_{2}]$. Parameter vectors responsible for the shared information ${z}_{3}$ are denoted by ${g}_{1}$ and ${g}_{2}$.^{1}^{1} 1 In practice, $Y=[{X}_{1},{X}_{2}]\left[\begin{array}{c}\hfill {h}_{1}\hfill \\ \hfill {h}_{2}\hfill \end{array}\right]$ has to be solved for ${X}_{1}\in {\mathbb{R}}^{n\times ({d}_{1}+{d}_{3})},{X}_{2}\in {\mathbb{R}}^{n\times ({d}_{2}+{d}_{3})}$ and $Y\in {\mathbb{R}}^{n}$ with enough number of $n$ data samples. Then a standard least squares solution using a pseudoinverse gives ${h}_{1}=[{\beta}_{1};{\beta}_{3}/2],{h}_{2}=[{\beta}_{2};{\beta}_{3}/2]$. This is equivalent to the solution robust against random noise added to all the sources at once, which is vulnerable to single source faults (Section 3.2).
Suppose the true parameters of data satisfy ${{\beta}_{1}}_{2}\approx {{\beta}_{2}}_{2}$ and ${{\beta}_{3}}_{2}\gg {{\beta}_{1}}_{2}$. Assume that the obtained solution’s parameters for ${z}_{3}$ are unbalanced, i.e. ${g}_{1}=\mathrm{\Delta}$ and ${g}_{2}={\beta}_{3}\mathrm{\Delta}$ with some weight vector $\mathrm{\Delta}$ having a small norm. Then adding noise to the source ${x}_{2}$ will give significant corruption to the prediction while ${x}_{1}$ is relatively robust because ${({\beta}_{3}\mathrm{\Delta})}^{T}{\u03f5}_{3}\gg {\mathrm{\Delta}}^{T}{\u03f5}_{3}$ for any noise ${\u03f5}_{3}$ affecting ${z}_{3}$. This simple example illustrates that additional training strategies or components are indispensable to achieve robust fusion model working even if one of the sources is disturbed. The next section introduces a novel loss for a balanced robustness against a fault in a single source.
3.2 Robust learning for single source noise
Fusion methods are not guaranteed to provide robustness against faults in a single source without additional supervision. Also, we demonstrate that naive regularization or robust learning methods are not sufficient for the robustness later in this section. Therefore, a supplementary constraint or strategy needs to be considered in training which can correctly guide learning parameters for the desired robustness.
One essential requirement of fusion models is showing balanced performance regardless of corruption added to any source. If the model is significantly vulnerable to corruption in one source, this model becomes untrustworthy and we need to balance the degradation levels of different input sources’ faults. For example, suppose there is a model robust against noise in RGB channels but shows huge degradation in performance for any fault of LIDAR. Then the overall system should be considered untrustworthy, because there exist certain corruption or environments which can consistently fool the model. Our loss, MaxSSN (Maximum Single Source Noise), for such robustness is introduced to handle this issue and further analyses are provided under the linear fusion data model explained in Section 3.1. This loss makes the model focus more on corruption of a single source, SSN, rather than focusing on noise added to all the sources at once, ASN.
Definition 1.
For multiple sources ${x}_{\mathrm{1}}\mathrm{,}\mathrm{\cdots}\mathrm{,}{x}_{{n}_{s}}$ and a target variable $y$, denote a predefined loss function by $\mathrm{L}$. If each source ${x}_{i}$ is perturbed with some additive noise ${\u03f5}_{i}$ for $i\mathrm{\in}\mathrm{[}{n}_{s}\mathrm{]}$, MaxSSN loss for a model $f$ is defined as follows:
${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}(f,\u03f5)\triangleq \underset{i}{\mathrm{max}}{\left\{\mathcal{L}(y,f({x}_{1},\mathrm{\cdots},{x}_{i1},{x}_{i}+{\u03f5}_{i},{x}_{i+1},\mathrm{\cdots},{x}_{{n}_{s}}))\right\}}_{i=1}^{{n}_{s}}$ 
Another key principle in our robust training is to retain the model’s performance on clean data. Although techniques like data augmentation help improving a model’s generalization error in general, learning a model robust against certain types perturbation including adversarial attacks may harm the model’s accuracy on noncorrupt data (Tsipras et al., 2019). Deterioration in the model’s ability on normal data is an unwanted side effect, and hence our approach aims to avoid this.
Random noise
To investigate the importance of our MaxSSN loss, we revisit the linear fusion data model with the optimal direct fusion model ${f}_{\text{direct}}$ of the regression problem introduced in Section 3.1. Suppose the objective is to find a model with robustness against single source noises, while preserving errorfree performance, i.e., unchanged loss under clean data. For the noise model, consider $\u03f5=[{\delta}_{1};{\delta}_{2}]$ where ${\delta}_{1}=[{\u03f5}_{1};{\u03f5}_{3}]$ and ${\delta}_{2}=[{\u03f5}_{2};{\u03f5}_{4}]$, which satisfy $\mathbb{E}[{\u03f5}_{i}]=0$, $Var({\u03f5}_{i})={\sigma}^{2}I$, and $\mathbb{E}[{\u03f5}_{i}{\u03f5}_{j}^{T}]=0$ for $i\ne j$. Note that noises added to the shared information, ${\u03f5}_{3}$ and ${\u03f5}_{4}$, are not identical, which resembles direct perturbation to the input sources in practice. For example, noise directly affecting a camera lens does not need to perturb other sources.
Optimal fusion model for MaxSSN
The robust linear fusion model $f({x}_{1},{x}_{2})=({w}_{1}^{T}{z}_{1}+{g}_{1}^{T}{z}_{3})+({w}_{2}^{T}{z}_{1}+{g}_{2}^{T}{z}_{3})$ is found by minimizing ${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}(f,\u03f5)$ over parameters ${w}_{1},{w}_{2},{g}_{1}$ and ${g}_{2}$. As shown in the previous section, any ${f}_{\text{direct}}$ satisfying ${w}_{1}={\beta}_{1},{w}_{2}={\beta}_{2}$ and ${g}_{1}+{g}_{2}={\beta}_{3}$ should achieve zeroerror. Therefore, overall optimization problem can be reduced to the following one:
$$\underset{{g}_{1},{g}_{2}}{\mathrm{min}}\mathrm{max}\{\mathcal{L}(y,{f}_{\text{direct}}({x}_{1}+{\delta}_{1},{x}_{2})),\mathcal{L}(y,{f}_{\text{direct}}({x}_{1},{x}_{2}+{\delta}_{2}))\}\mathit{\hspace{1em}}s.t.{g}_{1}+{g}_{2}={\beta}_{3}$$  (3) 
If we use a standard expected squared loss $\mathcal{L}(y,f({x}_{1},{x}_{2}))=\mathbb{E}[{(yf({x}_{1},{x}_{2}))}^{2}]$ and solve the optimization problem, the following solution ${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{*}$ with corresponding parameters ${g}_{1}^{*},{g}_{2}^{*}$ can be obtained, and there exist three cases based on the relative sizes of ${{\beta}_{i}}_{2}$’s.
$$({\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{*},{g}_{1}^{*},{g}_{2}^{*})=\{\begin{array}{cc}({\sigma}^{2}{{\beta}_{2}}_{2}^{2},{\beta}_{3},0)\text{if}{{\beta}_{1}}_{2}^{2}+{{\beta}_{3}}_{2}^{2}\le {{\beta}_{2}}_{2}^{2}\hfill & \\ ({\sigma}^{2}{{\beta}_{1}}_{2}^{2},0,{\beta}_{3})\text{if}{{\beta}_{2}}_{2}^{2}+{{\beta}_{3}}_{2}^{2}\le {{\beta}_{1}}_{2}^{2}\hfill & \\ ({\sigma}^{2}(\frac{{{\beta}_{1}}_{2}^{2}+{{\beta}_{2}}_{2}^{2}}{2}+\frac{{{\beta}_{3}}_{2}^{2}}{4}+\frac{{({{\beta}_{2}}_{2}^{2}{{\beta}_{1}}_{2}^{2})}^{2}}{4{{\beta}_{3}}_{2}^{2}}),\hfill & \\ \frac{1}{2}(1+\frac{{{\beta}_{2}}_{2}^{2}{{\beta}_{1}}^{2}}{{{\beta}_{3}}_{2}^{2}}),\frac{1}{2}(1\frac{{{\beta}_{2}}_{2}^{2}{{\beta}_{1}}^{2}}{{{\beta}_{3}}_{2}^{2}}))\hspace{1em}\hspace{1em}\text{otherwise}\hfill & \end{array}$$  (4) 
The three cases reflect the relative influence of each weight vector for ${z}_{i}$. For instance, if ${z}_{2}$ has larger importance compared to the rest in generating $y$, the optimal way of balancing the effect of noise over ${z}_{3}$ is to remove all the influence of ${z}_{2}$ in ${x}_{2}$ by setting ${g}_{2}=0$. When neither of ${z}_{1}$ nor ${z}_{2}$ dominates the importance, i.e. $$, the optimal solution tries to make $\mathcal{L}(y,{f}_{\text{direct}}({x}_{1}+{\delta}_{1},{x}_{2}))=\mathcal{L}(y,{f}_{\text{direct}}({x}_{1},{x}_{2}+{\delta}_{2}))$.
Comparison with the standard robust fusion model
Minimizing loss with noise added to a model’s input is a standard process in robust learning. The same strategy can be applied to learn fusion models by considering all sources as a single combined source, then add noise to all the sources at once. However, this simple strategy cannot achieve low error in terms of the single source robustness. The optimal solution to ${\mathrm{min}}_{{g}_{1},{g}_{2}}\mathbb{E}[{(y{f}_{\text{direct}}({x}_{1}+{\delta}_{1},{x}_{2}+{\delta}_{2}))}^{2}]$, a least squares solution, is achieved when ${g}_{1}={g}_{2}=\frac{{\beta}_{3}}{2}$. The corresponding MaxSSN loss can be evaluated as ${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{\prime}={\sigma}^{2}\mathrm{max}\{{{\beta}_{1}}_{2}^{2}+\frac{1}{4}{{\beta}_{3}}_{2}^{2},{{\beta}_{2}}_{2}^{2}+\frac{1}{4}{{\beta}_{3}}_{2}^{2}\}$. A nontrivial gap exists between ${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}$ and ${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{\prime}$, which is directly proportional to the data model’s inherent characteristics:
$${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{\prime}{\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{*}\ge \{\begin{array}{cc}\frac{1}{4}{{\beta}_{3}}_{2}^{2}\hfill & \text{if}\left\frac{{{\beta}_{2}}_{2}^{2}{{\beta}_{1}}_{2}^{2}}{{{\beta}_{3}}_{2}^{2}}\right\ge 1\hfill \\ \frac{1}{4}\left{{\beta}_{2}}_{2}^{2}{{\beta}_{1}}_{2}^{2}\right\hfill & \text{otherwise}\hfill \end{array}$$  (5) 
If either ${z}_{1}$ or ${z}_{2}$ has more influence on the target value $y$ than the other components, single source robustness of the model trained by MaxSSN loss is better than the fusion model for the general noise robustness with an amount proportional to the influence of shared feature ${z}_{3}$. Otherwise, the gap’s lower bound is proportional to the difference in complementary information, ${{\beta}_{2}}_{2}^{2}{{\beta}_{1}}_{2}^{2}/4$.
Remark 1.
In linear systems such as the one studied above, having redundant information in the feature space is similar to multicollinearity in statistics. In this case, feature selection methods usually try to remove such redundancy. However, this redundant or shared information helps preventing degradation of the fusion model when a subset of the input sources are corrupted.
4 Robust Deep Fusion Models
In simple linear settings, our analyses illustrate that using MaxSSN loss can effectively minimize the degradation of a fusion model’s performance. This suggests a training strategy for complex deep fusion models to be equipped with robustness against single source faults. A principal factor considered in designing a common framework for our algorithms is the preservation of model’s performance on clean data while minimizing a loss for defending corruption. Therefore, our training algorithms use data augmentation to encounter both clean and corrupted data. The second way of achieving robustness is to take advantage of the fusion method’s structure. A simple but effective method of mixing convolutional features coming from different input sources is introduced later in this section.
4.1 Robust training algorithms for single source noise
Our common training framework alternately provides clean samples and corrupted samples per iteration to preserve the original performance of the model on uncontaminated data.^{2}^{2} 2 We also try finetuning only a subset of the model’s parameters, ${\bm{\theta}}_{\text{fusion}}\subset f$, to preserve essential parts for extracting features from normal data. However, training the whole network from the beginning shows better performance in practice. See Appendix B for a detailed comparison. On top of this strategy, one standard robust training scheme and two algorithms for minimizing MaxSSN loss are introduced for handling robustness against noise in different sources.
Standard robust training method
A standard robust training algorithm can be developed by considering all ${n}_{s}$ sources as a single combined source. Given noise generating functions ${\phi}_{i}(\cdot )$ ($i\in [{n}_{s}]$), the algorithm generates and adds corruption to all the sensors at once. Then the corresponding loss can be computed to update parameters using backpropagation. This algorithm is denoted by TrainASN and tested in experiments to investigate whether the procedure is also able to cover robustness against single source noise.
Minimization of MaxSSN loss
Minimization of the MaxSSN loss requires ${n}_{s}$ (number of input sources) forwardpropagations within one iteration. Each propagation needs a different set of corrupted samples generated by adding single source noise to the fixed clean minibatch of data. There are two possible approaches to compute gradients properly from these multiple passes. First, we can run backpropagation ${n}_{s}$ times to save the gradients temporarily without updating any parameters, then the saved gradients with the maximum loss is used for updating parameters. However, this process requires not only ${n}_{s}$ forward and backward passes but also large memory usage proportional to ${n}_{s}$ for saving the gradients. Another reasonable approach is to run ${n}_{s}$ forward passes to find the maximum loss and compute gradients by going back to the corresponding set of corrupted samples. Algorithm 2 adopts this idea for its efficiency, ${n}_{s}+1$ forward passes and one backpropagation. A faster version of the algorithm, TrainSSNAlt, is also considered since multiple forward passes may take longer as the number of sources increases. This algorithm ignores the maximum loss and alternately augments corrupted data. By a slight abuse of notation, symbols used in our algorithms also represent the iteration steps with the size of minibatches greater than one. Also, $f({x}_{1},\mathrm{\cdots},{x}_{j1},{x}_{j}+{\u03f5}_{j},{x}_{j+1},\mathrm{\cdots},{x}_{{n}_{s}})$ is shortened to $f(\{{x}_{j}+{\u03f5}_{j},{x}_{j}\})$ in the algorithms.
4.2 Feature fusion methods
Fusion of features extracted from multiple input sources can be done in various ways (Chen et al., 2017). One of the popular methods is to fuse via an elementwise mean operation (Ku et al., 2018), but this assumes that each feature must have a same shape, i.e., width, height, and number of channels for a 3D feature. An elementwise mean can be also viewed as averaging channels from different 3D features, and it has an underlying assumption that the channels of each feature should share same information regardless of the input source origin. Therefore, the risk of becoming vulnerable to single source corruption may increase with this simple mean fusion method.
Our fusion method, latent ensemble layer (LEL), is devised for three objectives: (i) maintaining the known advantage—error reduction—of ensemble methods (Tumer and Ghosh, 1996b, a), (ii) admitting sourcespecific features to survive even after the fusion procedure, and (iii) allowing each source to provide a different number of channels. The proposed layer learns parameters so that channels of the 3D features from the different sources can be selectively mixed. Sparse constraints are introduced to let the training procedure find good subsets of channels to be fused across the ${n}_{s}$ feature maps. For example, mixing the ${i}^{\text{th}}$ channel of the convolutional feature from an RGB image with the ${j}^{\text{th}}$ and ${k}^{\text{th}}$ channels of the LIDAR’s latent feature is possible in our LEL, whereas in an elementwise mean layer the ${i}^{\text{th}}$ latent channel from RGB is only mixed with the other sources’ ${i}^{\text{th}}$ channels.
We also apply an activation function to supplement a semiadaptive behavior to the fusion procedure. Definition 2 explains the details of our LEL, and Figure 3 visualizes the overall process. In practice, this layer can be easily constructed by using $1\times 1$ convolutions with the ReLU activation and ${\mathrm{\ell}}_{1}$ constraints. The output channeldepth is set to $\widehat{d}={\mathrm{max}}_{i}\{{d}_{i}\}$ in the experiments.
Definition 2 (Latent ensemble layer).
Suppose we have ${n}_{s}$ convolutional features ${\mathrm{z}}_{i}\mathrm{\in}{\mathrm{R}}^{a\mathrm{\times}b\mathrm{\times}{d}_{i}}$ from different input sources $\mathrm{(}i\mathrm{\in}\mathrm{[}{n}_{s}\mathrm{]}\mathrm{)}$, which can be stacked as $\mathrm{z}\mathrm{=}\mathrm{(}{\mathrm{z}}_{\mathrm{1}}\mathrm{,}\mathrm{\cdots}\mathrm{,}{\mathrm{z}}_{m}\mathrm{)}\mathrm{\in}{\mathrm{R}}^{a\mathrm{\times}b\mathrm{\times}{d}_{\text{\mathit{s}\mathit{u}\mathit{m}}}}$ $\mathrm{(}{d}_{\text{\mathit{s}\mathit{u}\mathit{m}}}\mathrm{=}{\mathrm{\sum}}_{i\mathrm{=}\mathrm{1}}^{m}{d}_{i}\mathrm{)}$. The ${k}^{t\mathit{}h}$ channel of the stacked feature is denoted by ${\mathrm{[}\mathrm{z}\mathrm{]}}_{k}\mathrm{\in}{\mathrm{R}}^{a\mathrm{\times}b}$. Let ${\mathbf{w}}_{j}\mathrm{=}\mathrm{(}{w}_{\mathrm{1}}^{\mathrm{(}j\mathrm{)}}\mathrm{,}\mathrm{\cdots}\mathrm{,}{w}_{{d}_{\text{\mathit{s}\mathit{u}\mathit{m}}}}^{\mathrm{(}j\mathrm{)}}\mathrm{)}$ be a ${d}_{\text{\mathit{s}\mathit{u}\mathit{m}}}$dimensional weight vector to mix ${\mathrm{z}}_{i}$’s in channelwise fashion. Then LEL outputs $\widehat{\mathrm{z}}\mathrm{\in}{\mathrm{R}}^{a\mathrm{\times}b\mathrm{\times}\widehat{d}}$ where each channel is computed as ${\mathrm{[}\widehat{\mathrm{z}}\mathrm{]}}_{j}\mathrm{=}\varphi \mathit{}\mathrm{(}{\mathbf{w}}_{j}\mathrm{\odot}\mathrm{z}\mathrm{)}\mathrm{\triangleq}\varphi \mathit{}\mathrm{\left(}{\mathrm{\sum}}_{k\mathrm{=}\mathrm{1}}^{{d}_{\text{\mathit{s}\mathit{u}\mathit{m}}}}{w}_{k}^{\mathrm{(}j\mathrm{)}}\mathit{}{\mathrm{[}\mathrm{z}\mathrm{]}}_{k}\mathrm{\right)}$, with some activation function $\varphi $ and sparse constraints ${\mathrm{}{\mathbf{w}}_{j}\mathrm{}}_{\mathrm{0}}\mathrm{\le}t$ for all $j\mathrm{\in}\mathrm{\{}\mathrm{1}\mathrm{,}\mathrm{\cdots}\mathrm{,}\widehat{d}\mathrm{\}}$.
5 Experimental Results
We test our algorithms and the LEL fusion method on 3D and BEV object detection tasks using the car class of the KITTI dataset (Geiger et al., 2012). As our experiments include random generation of corruption, each task is evaluated 5 times to compare average scores (reported with 95% confidence intervals), and thus a validation set is used for ease of manipulating data and repetitive evaluation. We follow the split of (Ku et al., 2018), 3712 and 3769 frames for training and validation sets, respectively. Results are reported based on three difficulty levels defined by KITTI (easy, medium, hard) and a standard metric for object detection Average Precision (AP) is used. A recent opensourced 3D object detector AVOD (Ku et al., 2018) with a feature pyramid network is selected as a baseline algorithm. Four different algorithms are compared: AVOD trained on (i) clean data, (ii) data augmented with ASN samples (TrainASN), (iii) SSN augmented data with direct MaxSSN loss minimization (TrainSSN), and (iv) SSN augmented data (TrainSSNAlt). The AVOD architecture is varied to use either elementwise mean fusion layers or our LELs. We follow the original training setups of AVOD, e.g., 120k iterations using an ADAM optimizer with an initial learning rate of 0.0001.^{3}^{3} 3 Our methods are implemented with TensorFlow on top of the official AVOD code. The computing machine has a Intel Xeon E51660v3 CPU with Nvidia Titan X Pascal GPUs. The source code is available at: https://github.com/twankim/avod_ssn
Corruption methods
Gaussian noise generated i.i.d. with $\mathcal{N}(0,{\sigma}_{\text{Gaussian}}^{2})$ is directly added to the pixel value of an image ($r,g,b$) and the coordinate value of a LIDAR’s point ($x,y,z$). ${\sigma}_{\text{Gaussian}}$ is set to $0.75\tau $ experimentally with ${\tau}_{\text{RGB}}=255$ and ${\tau}_{\text{LIDAR}}=0.2$. The second method downsampling selects only 16 out of 64 lasers of LIDAR data. To match this effect, 3 out of 4 horizontal lines of an RGB image are deleted. Effects of corruption on each input source are visualized in Figure 4, where the color of a 2D LIDAR image represents a distance from the sensor. Although our analyses in Section 3.2 assume the noise variances to be identical, it is nontrivial to set equal noise levels for different modalities in practice, e.g., RGB pixels vs points in a 3D space. Nevertheless, an underlying objective of our MaxSSN loss, balancing the degradation rates of different input sources’ faults, does not depend on the choice of noise types or levels.
Evaluation metrics for single source robustness
To assess the robustness against single source noise, a new metric minAP is introduced. The AP score is evaluated on the dataset with a single corrupted input source, then after going over all ${n}_{s}$ sources, minAP reports the lowest score among the ${n}_{s}$ AP scores. Our second metric maxDiffAP computes the maximum absolute difference among the scores, which measures the balance of different input sources’ single source robustness; low value of maxDiffAP means the wellbalanced robustness.
(Data) Train Algo.  Easy  Moderate  Hard  Easy  Moderate  Hard 

Fusion method: Mean  
(Clean Data)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  76.41  72.74  66.86  89.33  86.49  79.44 
+TrainASN  75.96  66.68  65.97  88.63  79.45  78.79 
+TrainSSN  76.28  67.10  66.51  88.86  79.60  79.11 
+TrainSSNAlt  77.46  67.61  66.06  89.68  86.71  79.41 
(Gaussian SSN)  $\mathrm{min}A{P}_{3D}(\%)$  $\mathrm{min}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $47.41\pm 0.28$  $41.84\pm 0.17$  $36.47\pm 0.16$  $65.63\pm 0.28$  $58.02\pm 0.23$  $50.43\pm 0.14$ 
+TrainASN  $61.53\pm 0.57$  $52.72\pm 0.08$  $47.25\pm 0.13$  $87.71\pm 0.14$  $78.37\pm 0.06$  $77.85\pm 0.08$ 
+TrainSSN  $71.65\pm 0.31$  $\mathbf{62.14}\pm \mathbf{0.08}$  $\mathbf{56.78}\pm \mathbf{0.12}$  $88.21\pm 0.08$  $78.90\pm 0.09$  $\mathbf{77.92}\pm \mathbf{0.11}$ 
+TrainSSNAlt  $\mathbf{71.66}\pm \mathbf{0.48}$  $57.61\pm 0.12$  $55.90\pm 0.11$  $\mathbf{89.42}\pm \mathbf{0.04}$  $\mathbf{79.56}\pm \mathbf{0.06}$  $\mathbf{77.92}\pm \mathbf{0.05}$ 
(Gaussian SSN)  $\mathrm{max}\text{Diff}A{P}_{3D}(\%)$  $\mathrm{max}\text{Diff}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $26.70\pm 0.52$  $22.42\pm 0.29$  $20.92\pm 0.25$  $22.27\pm 0.41$  $20.76\pm 0.33$  $20.09\pm 0.20$ 
+TrainASN  $14.48\pm 0.82$  $12.72\pm 0.33$  $11.18\pm 0.27$  $0.88\pm 0.22$  $0.48\pm 0.13$  $0.28\pm 0.12$ 
+TrainSSN  $\mathbf{3.71}\pm \mathbf{0.46}$  $\mathbf{3.42}\pm \mathbf{0.25}$  $7.50\pm 0.25$  $0.36\pm 0.17$  $\mathbf{0.04}\pm \mathbf{0.15}$  $0.71\pm 0.17$ 
+TrainSSNAlt  $5.55\pm 0.81$  $8.73\pm 0.32$  $\mathbf{2.91}\pm \mathbf{0.22}$  $\mathbf{0.09}\pm \mathbf{0.14}$  $0.13\pm 0.11$  $\mathbf{0.18}\pm \mathbf{0.11}$ 
Fusion method: Latent Ensemble Layer  
(Clean Data)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  77.79  67.69  66.31  88.90  85.64  78.86 
+TrainASN  75.00  64.75  58.28  88.30  78.60  77.23 
+TrainSSN  74.25  65.00  63.83  87.88  78.84  77.66 
+TrainSSNAlt  76.04  66.42  64.41  88.80  79.53  78.53 
(Gaussian SSN)  $\mathrm{min}A{P}_{3D}(\%)$  $\mathrm{min}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $61.97\pm 0.55$  $53.95\pm 0.42$  $47.24\pm 0.27$  $79.44\pm 0.09$  $72.46\pm 3.14$  $68.25\pm 0.06$ 
+TrainASN  $\mathbf{74.24}\pm \mathbf{0.38}$  $58.25\pm 0.16$  $\mathbf{56.13}\pm \mathbf{0.10}$  $88.10\pm 0.26$  $\mathbf{78.19}\pm \mathbf{0.13}$  $70.42\pm 0.07$ 
+TrainSSN  $68.16\pm 0.88$  $\mathbf{60.39}\pm \mathbf{0.38}$  $56.04\pm 0.28$  $\mathbf{88.12}\pm \mathbf{0.16}$  $78.17\pm 0.06$  $70.21\pm 0.05$ 
+TrainSSNAlt  $68.63\pm 0.40$  $55.48\pm 0.16$  $54.42\pm 0.17$  $86.51\pm 0.46$  $76.85\pm 0.11$  $\mathbf{71.95}\pm \mathbf{2.72}$ 
(Data) Train Algo.  Easy  Moderate  Hard  Easy  Moderate  Hard 

(Clean Data)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  77.79  67.69  66.31  88.90  85.64  78.86 
+TrainASN  71.74  61.78  60.26  87.29  77.08  75.89 
+TrainSSN  75.54  66.26  63.72  88.07  79.18  78.03 
+TrainSSNAlt  76.22  66.05  63.87  89.00  79.65  78.03 
(Downsample SSN)  $\mathrm{min}A{P}_{3D}(\%)$  $\mathrm{min}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  61.70  51.66  46.17  86.08  69.99  61.55 
+TrainASN  65.74  53.49  51.35  82.27  67.88  65.79 
+TrainSSN  73.33  57.85  54.91  86.61  76.07  68.59 
+TrainSSNAlt  64.77  53.34  48.29  85.27  69.87  67.77 
Results
When the fusion model uses the elementwise mean fusion (Table 1), TrainSSN algorithm shows the best single source robustness against Gaussian SSN while preserving the original performance on clean data (only small decrease in the moderate BEV detection). Also a balance of the both input sources’ performance is dramatically decreased compared to the models trained without robust learning and a naive TrainASN method.
Encouragingly, AVOD model constructed with our LEL method already achieves relatively high robustness without any robust learning strategies compared to the mean fusion layers. For all the tasks, minAP scores are dramatically increased, e.g., 61.97 vs. 47.41 minAP for the easy 3D detection task, and the maxDiffAP scores are decreased (maxDiffAP scores for AVOD with LEL are reported in Appendix B.). Then the robustness is further improved by minimizing our MaxSSN loss. As our LEL’s structure inherently handles corruption on a single source well, even the TrainASN algorithm can successfully guide the model to be equipped with the desired robustness. A corruption method with a different style, downsampling, is also tested with our LEL. Table 2 shows that the model achieves the best performance among the four algorithms when trained with our TrainSSN.
Remark 3.
A simple TrainSSNAlt achieves fairly robust models in both fusion methods against Gaussian noise, and two reasons may explain this phenomenon. First, all parameters are updated instead of finetuning only fusion related parts. Therefore, unlike our analyses on the linear model, the latent representation can be transformed to meet the objective function. In fact, TrainSSNAlt performs poorly when we finetune the model with concatenation fusion layers as shown in the supplement. Secondly, the loss function $\mathcal{L}$ inside our ${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}$ is usually nonconvex so that it may be enough to use an indirect approach for small number of sources, ${n}_{s}=2$.
6 Conclusion
We study two strategies to improve robustness of fusion models against single source corruption. Motivated by analyses on linear fusion models, a loss function is introduced to balance performance degradation of deep fusion models caused by corruption in different sources. We also demonstrate the importance of a fusion method’s structure by proposing a simple ensemble layer achieving such robustness inherently. Our experimental results show that deep fusion models can effectively use complementary and shared information of different input sources by training with our loss and fusion layer to obtain both robustness and high accuracy. We hope our results motivate further work to improve the single source robustness of more complex fusion models with either large number of input sources or adaptive networks. Another interesting direction is to investigate the single source robustness against adversarial attacks in deep fusion models, which can be compared with our analyses in the supplementary material.
References
 Braun et al. [2016] Markus Braun, Qing Rao, Yikang Wang, and Fabian Flohr. Posercnn: Joint object detection and pose estimation using 3d object proposals. In IEEE 19th international conference on intelligent transportation systems (ITSC), pages 1546–1551, 2016.
 Chan et al. [2016] William Chan, Navdeep Jaitly, Quoc Le, and Oriol Vinyals. Listen, attend and spell: A neural network for large vocabulary conversational speech recognition. In IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 4960–4964, 2016.
 Chen et al. [2017] Xiaozhi Chen, Huimin Ma, Ji Wan, Bo Li, and Tian Xia. Multiview 3d object detection network for autonomous driving. In IEEE conference on computer vision and pattern recognition (CVPR), pages 1907–1915, 2017.
 Chiu et al. [2018] ChungCheng Chiu, Tara N Sainath, Yonghui Wu, Rohit Prabhavalkar, Patrick Nguyen, Zhifeng Chen, Anjuli Kannan, Ron J Weiss, Kanishka Rao, Ekaterina Gonina, et al. Stateoftheart speech recognition with sequencetosequence models. In IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 4774–4778, 2018.
 Chorowski et al. [2015] Jan K Chorowski, Dzmitry Bahdanau, Dmitriy Serdyuk, Kyunghyun Cho, and Yoshua Bengio. Attentionbased models for speech recognition. In Advances in neural information processing systems (NeurIPS), pages 577–585, 2015.
 Chung et al. [2017] Joon Son Chung, Andrew Senior, Oriol Vinyals, and Andrew Zisserman. Lip reading sentences in the wild. In IEEE conference on computer vision and pattern recognition (CVPR), pages 3444–3453, 2017.
 Dai et al. [2016] Jifeng Dai, Yi Li, Kaiming He, and Jian Sun. Rfcn: Object detection via regionbased fully convolutional networks. In Advances in neural information processing systems (NeurIPS), pages 379–387, 2016.
 Du et al. [2017] Xinxin Du, Marcelo H Ang, and Daniela Rus. Car detection for autonomous vehicle: Lidar and vision fusion approach through deep learning framework. In IEEE/RSJ international conference on intelligent robots and systems (IROS), pages 749–754, 2017.
 Feng et al. [2019] Di Feng, Christian HaaseSchuetz, Lars Rosenbaum, Heinz Hertlein, Fabian Duffhauss, Claudius Glaeser, Werner Wiesbeck, and Klaus Dietmayer. Deep multimodal object detection and semantic segmentation for autonomous driving: Datasets, methods, and challenges. arXiv preprint arXiv:1902.07830, 2019.
 Geiger et al. [2012] Andreas Geiger, Philip Lenz, and Raquel Urtasun. Are we ready for autonomous driving? the kitti vision benchmark suite. In IEEE conference on computer vision and pattern recognition (CVPR), pages 3354–3361, 2012.
 Girshick [2015] Ross Girshick. Fast rcnn. In IEEE international conference on computer vision (ICCV), pages 1440–1448, 2015.
 Girshick et al. [2014] Ross Girshick, Jeff Donahue, Trevor Darrell, and Jitendra Malik. Rich feature hierarchies for accurate object detection and semantic segmentation. In IEEE conference on computer vision and pattern recognition (CVPR), pages 580–587, 2014.
 Goodfellow et al. [2015] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International conference on learning representations (ICLR), 2015.
 Graves et al. [2013] Alex Graves, Abdelrahman Mohamed, and Geoffrey Hinton. Speech recognition with deep recurrent neural networks. In IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 6645–6649, 2013.
 He et al. [2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE conference on computer vision and pattern recognition (CVPR), pages 770–778, 2016.
 He et al. [2017] Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask rcnn. In IEEE international conference on computer vision (ICCV), pages 2961–2969, 2017.
 Hinton et al. [2012] Geoffrey Hinton, Li Deng, Dong Yu, George Dahl, Abdelrahman Mohamed, Navdeep Jaitly, Andrew Senior, Vincent Vanhoucke, Patrick Nguyen, Brian Kingsbury, et al. Deep neural networks for acoustic modeling in speech recognition. IEEE signal processing magazine, 29, 2012.
 Huang et al. [2017] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In IEEE conference on computer vision and pattern recognition (CVPR), pages 4700–4708, 2017.
 Huang and Kingsbury [2013] Jing Huang and Brian Kingsbury. Audiovisual deep learning for noise robust speech recognition. In IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 7596–7599, 2013.
 Kim et al. [2018a] Jaekyum Kim, Junho Koh, Yecheol Kim, Jaehyung Choi, Youngbae Hwang, and Jun Won Choi. Robust deep multimodal learning based on gated information fusion network. In Asian conference on computer vision (ACCV), 2018a.
 Kim and Ghosh [2016] Taewan Kim and Joydeep Ghosh. Robust detection of nonmotorized road users using deep learning on optical and lidar data. In IEEE 19th international conference on intelligent transportation systems (ITSC), pages 271–276, 2016.
 Kim et al. [2018b] Taewan Kim, Michael Motro, Patrícia Lavieri, Saharsh Samir Oza, Joydeep Ghosh, and Chandra Bhat. Pedestrian detection with simplified depth prediction. In IEEE 21st international conference on intelligent transportation systems (ITSC), pages 2712–2717, 2018b.
 Kiros et al. [2014] Ryan Kiros, Karteek Popuri, Dana Cobzas, and Martin Jagersand. Stacked multiscale feature learning for domain independent medical image segmentation. In International workshop on machine learning in medical imaging, pages 25–32. Springer, 2014.
 Krizhevsky et al. [2012] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. In Advances in neural information processing systems (NeurIPS), pages 1097–1105, 2012.
 Ku et al. [2018] Jason Ku, Melissa Mozifian, Jungwook Lee, Ali Harakeh, and Steven L Waslander. Joint 3d proposal generation and object detection from view aggregation. In IEEE/RSJ international conference on intelligent robots and systems (IROS), pages 1–8, 2018.
 LeCun et al. [2015] Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. nature, 521(7553):436, 2015.
 Liang et al. [2018] Ming Liang, Bin Yang, Shenlong Wang, and Raquel Urtasun. Deep continuous fusion for multisensor 3d object detection. In European conference on computer vision (ECCV), pages 641–656, 2018.
 Liang et al. [2019] Ming Liang, Bin Yang, Yun Chen, Rui Hui, and Raquel Urtasun. Multitask multisensor fusion for 3d object detection. In IEEE conference on computer vision and pattern recognition (CVPR), 2019.
 Liu et al. [2015] Siqi Liu, Sidong Liu, Weidong Cai, Hangyu Che, Sonia Pujol, Ron Kikinis, Dagan Feng, Michael J Fulham, et al. Multimodal neuroimaging feature learning for multiclass diagnosis of alzheimer’s disease. IEEE transactions on biomedical engineering, 62(4):1132–1140, 2015.
 Liu et al. [2016] Wei Liu, Dragomir Anguelov, Dumitru Erhan, Christian Szegedy, Scott Reed, ChengYang Fu, and Alexander C Berg. Ssd: Single shot multibox detector. In European conference on computer vision (ECCV), pages 21–37. Springer, 2016.
 Mees et al. [2016] Oier Mees, Andreas Eitel, and Wolfram Burgard. Choosing smartly: Adaptive multimodal fusion for object detection in changing environments. In IEEE/RSJ international conference on intelligent robots and systems (IROS), pages 151–156, 2016.
 Mroueh et al. [2015] Youssef Mroueh, Etienne Marcheret, and Vaibhava Goel. Deep multimodal learning for audiovisual speech recognition. In IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 2130–2134, 2015.
 Qi et al. [2018] Charles R Qi, Wei Liu, Chenxia Wu, Hao Su, and Leonidas J Guibas. Frustum pointnets for 3d object detection from rgbd data. In IEEE conference on computer vision and pattern recognition (CVPR), pages 918–927, 2018.
 Ramachandram and Taylor [2017] Dhanesh Ramachandram and Graham W Taylor. Deep multimodal learning: A survey on recent advances and trends. IEEE signal processing magazine, 34(6):96–108, 2017.
 Redmon and Farhadi [2017] Joseph Redmon and Ali Farhadi. Yolo9000: better, faster, stronger. In IEEE conference on computer vision and pattern recognition (CVPR), pages 7263–7271, 2017.
 Redmon et al. [2016] Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Unified, realtime object detection. In IEEE conference on computer vision and pattern recognition (CVPR), pages 779–788, 2016.
 Ren et al. [2015] Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster rcnn: Towards realtime object detection with region proposal networks. In Advances in neural information processing systems (NeurIPS), pages 91–99, 2015.
 Sainath et al. [2013] Tara N Sainath, Abdelrahman Mohamed, Brian Kingsbury, and Bhuvana Ramabhadran. Deep convolutional neural networks for lvcsr. In IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 8614–8618, 2013.
 Simonovsky et al. [2016] Martin Simonovsky, Benjamín GutiérrezBecker, Diana Mateus, Nassir Navab, and Nikos Komodakis. A deep metric for multimodal registration. In International conference on medical image computing and computerassisted intervention, pages 10–18. Springer, 2016.
 Simonyan and Zisserman [2015] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for largescale image recognition. In International conference on learning representations (ICLR), 2015.
 Sui et al. [2015] Chao Sui, Mohammed Bennamoun, and Roberto Togneri. Listening with your eyes: Towards a practical visual speech recognition system using deep boltzmann machines. In IEEE international conference on computer vision (ICCV), pages 154–162, 2015.
 Szegedy et al. [2015] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In IEEE conference on computer vision and pattern recognition (CVPR), pages 1–9, 2015.
 Tsipras et al. [2019] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In International conference on learning representations (ICLR), 2019.
 Tumer and Ghosh [1996a] Kagan Tumer and Joydeep Ghosh. Analysis of decision boundaries in linearly combined neural classifiers. Pattern Recognition, 29(2):341–348, 1996a.
 Tumer and Ghosh [1996b] Kagan Tumer and Joydeep Ghosh. Error correlation and error reduction in ensemble classifiers. Connection science, 8(34):385–404, 1996b.
 Valada et al. [2017] Abhinav Valada, Johan Vertens, Ankit Dhall, and Wolfram Burgard. Adapnet: Adaptive semantic segmentation in adverse environmental conditions. In IEEE international conference on robotics and automation (ICRA), pages 4644–4651, 2017.
 Wang et al. [2018] Zining Wang, Wei Zhan, and Masayoshi Tomizuka. Fusing bird’s eye view lidar point cloud and front view camera image for 3d object detection. In IEEE intelligent vehicles symposium (IV), pages 1–6, 2018.
 Wu et al. [2013] Pengcheng Wu, Steven CH Hoi, Hao Xia, Peilin Zhao, Dayong Wang, and Chunyan Miao. Online multimodal deep similarity learning with application to image retrieval. In 21st ACM international conference on multimedia, pages 153–162. ACM, 2013.
Appendix A Proofs and supplementary Analyses
A.1 Proofs and analyses for Section 3.2
Proof.
The original ${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}$ loss minimization problem with an additional constraint of preserving loss under clean data can be transformed to the problem stated in (3) due to the flexibility of ${g}_{1}$ and ${g}_{2}$ under the constraint ${g}_{1}+{g}_{2}={\beta}_{3}$:
$$\underset{{g}_{1},{g}_{2}}{\mathrm{min}}\mathrm{max}\{\mathcal{L}(y,{f}_{\text{direct}}({x}_{1}+{\delta}_{1},{x}_{2})),\mathcal{L}(y,{f}_{\text{direct}}({x}_{1},{x}_{2}+{\delta}_{2}))\}\mathit{\hspace{1em}}s.t.{g}_{1}+{g}_{2}={\beta}_{3}$$ 
Under the expected squared loss with ${f}_{\text{direct}}$ function, the loss can be evaluated,
$\mathcal{L}(y,{f}_{\text{direct}}({x}_{1}+{\delta}_{1},{x}_{2}))$  $=\mathbb{E}\left[{\left(y({\beta}_{1}^{T}({z}_{1}+{\u03f5}_{1})+{g}_{1}^{T}({z}_{3}+{\u03f5}_{3})+{\beta}_{2}^{T}{z}_{2}+{g}_{2}^{T}{z}_{3})\right)}^{2}\right]$  
$=\mathbb{E}\left[{({\beta}_{1}^{T}{\u03f5}_{1}+{g}_{1}^{T}{\u03f5}_{3})}^{2}\right]\mathit{\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}}(\because y={\displaystyle \sum _{i=1}^{3}}\beta _{i}{}^{T}{z}_{i})$  
$={\sigma}^{2}({\beta}_{1}{}_{2}^{2}+{g}_{1}{}_{2}^{2})\mathit{\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}}(\because \text{Statistical assumption on}{\u03f5}_{i}.)$ 
Hence the equivalent problem (6) is achieved.
$${\sigma}^{2}\underset{{g}_{1},{g}_{2}}{\mathrm{min}}\mathrm{max}\{{{\beta}_{1}}_{2}^{2}+{{g}_{1}}_{2}^{2},{{\beta}_{2}}_{2}^{2}+{{g}_{2}}_{2}^{2}\}\mathit{\hspace{1em}}s.t.{g}_{1}+{g}_{2}={\beta}_{3}$$  (6) 
For simple notation, substitute variables as $g={g}_{1},v={\beta}_{3},{c}_{1}={{\beta}_{1}}_{2}^{2},{c}_{2}={{\beta}_{2}}_{2}^{2}$, and solve the following convex optimization problem.
$$\underset{g}{\mathrm{min}}\mathrm{max}\{{g}_{2}^{2}+{c}_{1},{gv}_{2}^{2}+{c}_{2}\}$$ 
This problem can be solved by introducing a variable $\gamma $ for the upper bound of the inner maximum value:
$$\underset{g,\gamma}{\mathrm{min}}\gamma \mathit{\hspace{1em}}s.t.{c}_{1}+{g}_{2}^{2}\gamma \le 0,{c}_{2}+{gv}_{2}^{2}\gamma \le 0$$ 
KKT condition gives:
(Primal feasibility)  ${c}_{1}+{g}_{2}^{2}\gamma \le 0,{c}_{2}+{gv}_{2}^{2}\gamma \le 0$  
(Dual feasibility)  ${\lambda}_{1}\ge 0,{\lambda}_{2}\ge 0$  
(Complementary slackness)  ${\lambda}_{1}({c}_{1}+{g}_{2}^{2}\gamma )=0,{\lambda}_{2}({c}_{2}+{gv}_{2}^{2}\gamma )=0$  
(Stationary)  ${\lambda}_{1}+{\lambda}_{2}=1,g={\displaystyle \frac{{\lambda}_{2}}{{\lambda}_{1}+{\lambda}_{2}}}v$ 
Considering ${\lambda}_{1}+{\lambda}_{2}=1$ and ${\lambda}_{1},{\lambda}_{2}\ge 0$, we first need to analyze the case ${\lambda}_{1}=0$. This gives $g=v$ and the complementary slackness condition to find $\gamma ={c}_{2}+{gv}_{2}^{2}={c}_{2}$. ${\lambda}_{2}=0$ can be analyzed with similar steps. If both ${\lambda}_{1}$ and ${\lambda}_{2}$ are positive, the complementary slackness condition gives $\gamma ={c}_{1}+{g}_{2}^{2}={c}_{2}+{gv}_{2}^{2}$, which ensures the balance of the original problem’s maximum value $\mathrm{max}\{{c}_{1}+{g}_{2}^{2},{c}_{2}+{gv}_{2}^{2}\}$. This case gives $\gamma =\frac{{c}_{1}+{c}_{2}}{2}+\frac{{v}_{2}^{2}}{4}+\frac{{({c}_{2}{c}_{1})}^{2}}{4{v}_{2}^{2}}$ with $g=\frac{1}{2}\left(1+\frac{{c}_{2}{c}_{1}}{{v}_{2}^{2}}\right)v$. Therefore, we can have the result (4) which provides the fusion model robust against single source corruptions from random noise. ∎
Comparison to the model not considering MaxSSN loss
If random noise are added to ${x}_{1}$ and ${x}_{2}$ simultaneously, the objective of the problem becomes ${\mathrm{min}}_{{g}_{1},{g}_{2}}\mathbb{E}[{(y{f}_{\text{direct}}({x}_{1}+{\delta}_{1},{x}_{2}+{\delta}_{2}))}^{2}]$ instead of considering the MaxSSN loss. This is equivalent to minimizing ${\sigma}^{2}({{\beta}_{1}}_{2}^{2}+{{\beta}_{2}}_{2}^{2}+{{g}_{1}}_{2}^{2}+{{g}_{2}}_{2}^{2})$ subject to ${g}_{1}+{g}_{2}={\beta}_{3}$, and the solution can be directly found as it is a simple convex problem, which is ${g}_{1}={g}_{2}=\frac{{\beta}_{3}}{2}$. If we denote this model as ${f}_{\text{direct}}^{\prime}$, then MaxSSN loss is:
$${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}({f}_{\text{direct}}^{\prime},\u03f5)={\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{\prime}={\sigma}^{2}\mathrm{max}\{{{\beta}_{1}}_{2}^{2}+\frac{1}{4}{{\beta}_{3}}_{2}^{2},{{\beta}_{2}}_{2}^{2}+\frac{1}{4}{{\beta}_{3}}_{2}^{2}\}$$ 
Now, let’s compute the difference ${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{\prime}{\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{*}$.
Proof.
As both term includes ${\sigma}^{2}$, let’s assume ${\sigma}^{2}=1$ for ease of notation. Among the three cases in (4), consider the first case ${{\beta}_{1}}_{2}^{2}+{{\beta}_{3}}_{2}^{2}\le {{\beta}_{2}}_{2}^{2}$.
${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{\prime}{\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{*}={\beta}_{2}{}_{2}^{2}+{\displaystyle \frac{1}{4}}{\beta}_{3}{}_{2}^{2}{\beta}_{2}{}_{2}^{2}={\displaystyle \frac{1}{4}}{\beta}_{3}{}_{2}^{2}\mathit{\hspace{1em}}(\because {\beta}_{2}{}_{2}^{2}\ge {\beta}_{1}{}_{2}^{2})$ 
The second case can be shown similarly. Now assume that $$ holds, and let ${{\beta}_{2}}_{2}^{2}\ge {{\beta}_{1}}_{2}^{2}$ without loss of generality. Then we can show that,
${\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{\prime}{\mathcal{L}}_{\mathrm{\text{MaxSSN}}}^{*}$  $={{\beta}_{2}}_{2}^{2}+{\displaystyle \frac{1}{4}}{{\beta}_{3}}_{2}^{2}\left({\displaystyle \frac{{{\beta}_{1}}_{2}^{2}+{{\beta}_{2}}_{2}^{2}}{2}}+{\displaystyle \frac{{{\beta}_{3}}_{2}^{2}}{4}}+{\displaystyle \frac{{({{\beta}_{2}}_{2}^{2}{{\beta}_{1}}_{2}^{2})}^{2}}{4{{\beta}_{3}}_{2}^{2}}}\right)$  
$={\displaystyle \frac{1}{2}}({{\beta}_{2}}_{2}^{2}{{\beta}_{1}}_{2}^{2})\left(1{\displaystyle \frac{{{\beta}_{2}}_{2}^{2}{{\beta}_{1}}_{2}^{2}}{2{{\beta}_{3}}_{2}^{2}}}\right)$  
$$ 
∎
Therefore we can conclude that simply optimizing under noise added to all the input sources at the same time cannot do better than minimizing MaxSSN loss with some nonnegative gap in our linear fusion model.
A.2 Single Source Robustness against Adversarial attacks
Another important type of perturbation is an adversarial attack. Different from the previously studied random noise, perturbation to the input sources is also optimized to maximize the loss to consider the worst case. Adversarial version of the MaxSSN loss is defined as follows:
Definition 3.
For multiple sources ${x}_{\mathrm{1}}\mathrm{,}\mathrm{\cdots}\mathrm{,}{x}_{{n}_{s}}$ and a target variable $y$, denote a predefined loss function by $\mathrm{L}$. If each input source ${x}_{i}$ is maximally perturbed with some additive noise ${\eta}_{i}\mathrm{\in}{\mathrm{S}}_{i}$ for $i\mathrm{\in}\mathrm{[}{n}_{s}\mathrm{]}$, AdvMaxSSN loss for a model $f$ is defined as follows:
${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}(f,\eta )\triangleq \underset{i}{\mathrm{max}}{\left\{\underset{{\eta}_{i}\in {\mathcal{S}}_{i}}{\mathrm{max}}\mathcal{L}(y,f({x}_{i}+{\eta}_{i},{x}_{i}))\right\}}_{i=1}^{{n}_{s}}$ 
As a simple model analysis, let’s consider a binary classification problem using the logistic regression. Again, two input sources ${x}_{1}=[{z}_{1};{z}_{3}]$ and ${x}_{2}=[{z}_{2};{z}_{3}]$ have a common feature vector ${z}_{3}$ as in the linear fusion data model. A binary classifier $\text{sgn}(f({x}_{1},{x}_{2}))$ is trained to predict label $y\in \{1,1\}$, where $f({x}_{1},{x}_{2})=({w}_{1}^{T}{z}_{1}+{g}_{1}^{T}{z}_{3})+({w}_{2}^{T}{z}_{2}+{g}_{2}^{T}{z}_{3})$ and the training loss is ${\mathbb{E}}_{x,y}\left[\mathrm{\ell}\left(y\cdot f({x}_{1},{x}_{2})\right)\right]$ with the logistic function $\mathrm{\ell}(x)=\mathrm{log}(1+\mathrm{exp}(x))$. Here, we apply one of the most popular attacks, fast gradient sign (FGS) method, which was also motivated by linear models without a fusion framework (Goodfellow et al., 2015). The adversarial attack ${\eta}_{i}$ per each source ${x}_{i}$ under ${\mathrm{\ell}}_{\mathrm{\infty}}$ norm constraint ${{\eta}_{i}}_{\mathrm{\infty}}\le \epsilon $ can be similarly derived as follows:
$${\eta}_{1}=[\epsilon y\cdot \text{sgn}({w}_{1});\epsilon y\cdot \text{sgn}({g}_{1})],{\eta}_{2}=[\epsilon y\cdot \text{sgn}({w}_{2});\epsilon y\cdot \text{sgn}({g}_{2})]$$  (7) 
As a substitute for the linear fusion data model, let’s assume the true classes are generated by the hidden relationship $y=\text{sgn}\left({\sum}_{i=1}^{3}{\beta}_{i}^{T}{z}_{i}\right)$. Then the optimal fusion binary classifier becomes $\text{sgn}({f}_{\text{direct}}({x}_{1},{x}_{2}))$. Similar to the previous section, suppose an objective is to find a model with robustness against single source adversarial attacks, while preserving the performance on clean data. Then the overall optimization problem can be reduced to the following one:
$$\underset{{g}_{1},{g}_{2}}{\mathrm{min}}\mathrm{max}\{\mathcal{L}(y,{f}_{\text{direct}}({x}_{1}+{\eta}_{1},{x}_{2})),\mathcal{L}(y,{f}_{\text{direct}}({x}_{1},{x}_{2}+{\eta}_{2}))\}\mathit{\hspace{1em}}s.t.{g}_{1}+{g}_{2}={\beta}_{3}$$  (8) 
As $\mathrm{\ell}$ is a decreasing function, optimal ${g}_{1}$ and ${g}_{2}$ of the original problem are equivalent to the minimizer of the following one:
$$\epsilon \underset{{g}_{1},{g}_{2}}{\mathrm{min}}\mathrm{max}\{{{w}_{1}}_{1}+{{g}_{1}}_{1},{{w}_{2}}_{1}+{{g}_{2}}_{1}\}\mathit{\hspace{1em}}s.t.{g}_{1}+{g}_{2}={\beta}_{3}$$  (9) 
By solving this convex optimization problem, we can achieve solution ${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}^{*}$ and optimizers ${g}_{1}^{*},{g}_{2}^{*}$. Also, we can find ${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}^{\prime}$, a ${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}$ value evaluated using the optimal model for minimizing the adversarial attacks added to all the sources at once. Interestingly, we can show that ${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}^{\prime}\ge {\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}^{*}$ if $\frac{{{\beta}_{2}}_{1}{{\beta}_{1}}_{1}}{{{\beta}_{3}}_{1}}>1$, but ${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}^{\prime}={\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}^{*}$ otherwise. In other words, if inherent influence of ${z}_{1}$ and ${z}_{2}$ are well balanced compared to the common feature ${z}_{3}$ in the sense of ${\mathrm{\ell}}_{1}$ norm, adversarial attacks only applied to a single source can be equivalently defended by just using a traditional adversarial training strategy to learn a model robust against attacks added to all the sources at once.
Proof.
The original minimizing ${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}$ loss minimization problem with an additional constraint of preserving loss under clean data can be transformed to the problem stated in (8) due to the flexibility of ${g}_{1}$ and ${g}_{2}$:
$$\underset{{g}_{1},{g}_{2}}{\mathrm{min}}\mathrm{max}\{\mathcal{L}(y,{f}_{\text{direct}}({x}_{1}+{\eta}_{1},{x}_{2})),\mathcal{L}(y,{f}_{\text{direct}}({x}_{1},{x}_{2}+{\eta}_{2}))\}\mathit{\hspace{1em}}s.t.{g}_{1}+{g}_{2}={\beta}_{3}$$ 
As ${\eta}_{i}$’s are assumed to be made with FGS method, adversarial attacks under ${\mathrm{\ell}}_{\mathrm{\infty}}$ norm constraints are as follows:
$${\eta}_{1}=[\epsilon y\cdot \text{sgn}({w}_{1});\epsilon y\cdot \text{sgn}({g}_{1})],{\eta}_{2}=[\epsilon y\cdot \text{sgn}({w}_{2});\epsilon y\cdot \text{sgn}({g}_{2})]$$ 
Therefore, minimizing ${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}({f}_{\text{direct}},\eta )$ over ${g}_{1},{g}_{2}$ becomes:
$\underset{{g}_{1},{g}_{2}}{\mathrm{min}}\mathrm{max}\{$  $\mathbb{E}\left[\mathrm{\ell}\left(y\cdot {f}_{\text{direct}}({x}_{1},{x}_{2})\epsilon ({{w}_{1}}_{1}+{{g}_{1}}_{1})\right)\right],$  
$\mathbb{E}\left[\mathrm{\ell}(y\cdot {f}_{\text{direct}}({x}_{1},{x}_{2})\epsilon ({w}_{2}{}_{1}+{g}_{2}{}_{1}))\right]\}\mathit{\hspace{1em}}s.t.g{}_{1}+g{}_{2}=\beta {}_{3}$ 
We can solve the following problem to find minimizers ${g}_{1}^{*}$ and ${g}_{2}^{*}$.
$$\underset{{g}_{1},{g}_{2}}{\mathrm{min}}\mathrm{max}\{{{w}_{1}}_{1}+{{g}_{1}}_{1},{{w}_{2}}_{1}+{{g}_{2}}_{1}\}\mathit{\hspace{1em}}s.t.{g}_{1}+{g}_{2}={\beta}_{3}$$ 
Similar to the random noise case, substitute variables as $g={g}_{1},v={\beta}_{3},{c}_{1}={{\beta}_{1}}_{1},{c}_{2}={{\beta}_{2}}_{2}$, and solve the following convex optimization problem:
$$\underset{g}{\mathrm{min}}\mathrm{max}\{{g}_{1}+{c}_{1},{gv}_{1}+{c}_{2}\}$$ 
which can be solved by introducing $\gamma $,
$$\underset{g,\gamma}{\mathrm{min}}\gamma \mathit{\hspace{1em}}s.t.{c}_{1}+{g}_{1}\gamma \le 0,{c}_{2}+{gv}_{1}\gamma \le 0$$ 
KKT condition gives:
(Primal feasibility)  ${c}_{1}+{g}_{1}\gamma \le 0,{c}_{2}+{gv}_{1}\gamma \le 0$  
(Dual feasibility)  ${\lambda}_{1}\ge 0,{\lambda}_{2}\ge 0$  
(Complementary slackness)  ${\lambda}_{1}({c}_{1}+{g}_{1}\gamma )=0,{\lambda}_{2}({c}_{2}+{gv}_{1}\gamma )=0$  
(Stationary)  ${\lambda}_{1}+{\lambda}_{2}=1,0\in {\lambda}_{1}\partial {g}_{1}+{\lambda}_{2}\partial {gv}_{1}$ 
If ${\lambda}_{1}=0$ or ${\lambda}_{2}=0$, these cases handle when the inherent imbalance of three components ${z}_{1},{z}_{2}$ and ${z}_{3}$. Consider ${\lambda}_{2}=0$, which gives ${g}_{1}+{c}_{1}\gamma =0$ from the complementary slackness condition. And the stationary condition becomes $0\in \partial {g}_{1}$. As a subgradient of ${g}_{1}$ can be zero if and only if $g(i)=0$ for any ${i}^{th}$ component, the solution is $g=0$ with $\gamma ={c}_{1}$ and the necessary condition is ${v}_{1}+{c}_{2}\le {c}_{1}$. Similar solution can be found for ${\lambda}_{1}=0$ case as $g=v,\gamma ={c}_{2}$ if ${v}_{1}+{c}_{1}\le {c}_{2}$. Therefore, we can have ${\gamma}^{*}=\mathrm{min}\mathrm{max}\{{{w}_{1}}_{1}+{{g}_{1}}_{1},{{w}_{2}}_{1}+{{\beta}_{3}{g}_{1}}_{1}\}$ and corresponding parameters as:
$$({\gamma}^{*},{g}_{1}^{*},{g}_{2}^{*})=\{\begin{array}{cc}({{\beta}_{2}}_{1},{\beta}_{3},0)\hfill & \text{if}{{\beta}_{1}}_{1}+{{\beta}_{3}}_{1}\le {{\beta}_{2}}_{1}\hfill \\ ({{\beta}_{1}}_{1},0,{\beta}_{3})\hfill & \text{if}{{\beta}_{2}}_{1}+{{\beta}_{3}}_{1}\le {{\beta}_{1}}_{1}\hfill \end{array}$$ 
Now let’s consider ${\lambda}_{1}\ne 0,{\lambda}_{2}\ne 0$. Denote $q\in {\lambda}_{1}\partial {g}_{1}+{\lambda}_{2}\partial {gv}_{1}$ as the element of subdifferential of the Lagrangian. We need to find cases for $q(i)=0$ to hold.
(i) If $v(i)=0$, then $\text{sgn}(g(i))=\text{sgn}(g(i)v(i))$ holds. Therefore, if $g(i)\ne =0$, a subgradient becomes $q(i)={\lambda}_{1}\text{sgn}(g(i))+{\lambda}_{2}\text{sgn}(g(i))=\text{sgn}(g(i))$ which cannot be zero. $\Rightarrow $ $g(i)=v(i)=0$.
(ii) If $v(i)\ne 0$, we need to consider three different sub cases. First, if $g(i)\ne 0$ and $g(i)\ne v(i)$, then $q(i)={\lambda}_{1}(\text{sgn}(g(i))\text{sgn}(g(i)v(i)))+\text{sgn}(g(i)v(i))$. For $q(i)=0$ to hold, $\text{sgn}(g(i))=\text{sgn}(g(i)v(i))$ must be true with ${\lambda}_{1}=\frac{1}{2}$. This gives a solution $g(i)={\alpha}_{i}v(i)$ with $\forall {\alpha}_{i}\in (0,1)$.
Secondly, if $g(i)=0$ but $g(i)\ne v(i)$, then the subgradient is $q(i)={\lambda}_{1}{\alpha}_{i}+(1{\lambda}_{1})\text{sgn}(v(i))$ for any ${\alpha}_{i}\in [1,1]$. Therefore, if ${\alpha}_{i}=\frac{1{\lambda}_{1}}{{\lambda}_{1}}\text{sgn}(v(i))$ with some ${\lambda}_{1}\in [\frac{1}{2},1)$, the stationary condition holds.
Finally, if $g(i)\ne 0$ and $g(i)=v(i)$, then $q(i)={\lambda}_{1}\text{sgn}(g(i))+(1{\lambda}_{1}){\alpha}_{i}$ for any ${\alpha}_{i}\in [1,1]$. Therefore, if ${\alpha}_{i}=\frac{{\lambda}_{1}}{1{\lambda}_{1}}\text{sgn}(v(i))$ with ${\lambda}_{1}\in (0,\frac{1}{2}]$, $q(i)=0$ holds for the stationary condition.
All the above cases in (i) and (ii) can be restated as a combined solution $g(i)={\alpha}_{i}v(i)$, $\forall {\alpha}_{i}\in [0,1]$. It is easy to show that $g(i)+g(i)v(i)=v(i)$ holds for any $i$. Also, ${\lambda}_{1}\ne 0,{\lambda}_{2}\ne 0$ with the complementary slackness condition gives a new constraint $\gamma ={g}_{1}+{c}_{1}={gv}_{1}+{c}_{2}$. Hence, we can calculate $\gamma $ by averaging the two equivalent values:
$$\gamma =\frac{1}{2}({c}_{1}+{c}_{2}+{g}_{1}+{gv}_{1})=\frac{1}{2}({c}_{1}+{c}_{2}+{v}_{1})$$ 
Therefore, $({\gamma}^{*},{g}_{1}^{*},{g}_{2}^{*})=(\frac{1}{2}({{\beta}_{1}}_{1}+{{\beta}_{2}}_{1}+{{\beta}_{3}}_{1}),\alpha \odot {\beta}_{3},{\beta}_{3}\alpha \odot {\beta}_{3})$, where $\odot $ is an elementwise product and each element of $\alpha $ can have any value in $[0,1]$, i.e. $\alpha (i)\in [0,1]$.
Now, let’s consider a model robust against adversarial attacks added to both sources ${x}_{1}$ and ${x}_{2}$ at the same time. This becomes a problem of minimizing ${{\beta}_{1}}_{1}+{{\beta}_{2}}_{1}+{{g}_{1}}_{1}+{{\beta}_{3}{g}_{1}}_{1}$. And the optimal solution can be achieved by $({g}_{1}^{\prime},{g}_{2}^{\prime})=(\alpha \odot {\beta}_{3},{\beta}_{3}\alpha \odot {\beta}_{3})$ for any alpha satisfying $\alpha (i)\in [0,1]$. Therefore, we can conclude that our ${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}$ loss is necessary to give a binary classifier more robust against single source adversarial attacks, i.e. ${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}^{*}\le {\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}^{\prime}$, if $\frac{{{\beta}_{2}}_{1}{{\beta}_{1}}_{1}}{{{\beta}_{3}}_{1}}>1$ holds. Surprisingly, if $\frac{{{\beta}_{2}}_{1}{{\beta}_{1}}_{1}}{{{\beta}_{3}}_{1}}\le 1$ holds to have balanced influence from inherent components from the different source of inputs, ${\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}^{*}={\mathcal{L}}_{\mathrm{\text{AdvMaxSSN}}}^{\prime}$. In other words, if different input sources contributes to the target variable with certain balance, a traditional way of generating adversarial samples by considering all the sources at once can train a model robust against single source attacks as well. ∎
Appendix B Additional Experimental Results
Finetuning
We also consider another algorithmic framework using finetuing. The algorithm starts with a normal training on clean data for ${m}_{\text{clean}}$ iterations, which may include some general data augmentation methods like random cropping, and flipping. Then ${m}_{\text{tune}}$ steps of finetuning is run to update only a subset of the model’s parameters, ${\bm{\theta}}_{\text{fusion}}\subset f$, so that any essential parts for extracting features from normal data are not affected. Convolutional layers extracting features from different sources before the fusion stages are fixed, and other layers for fusing the features and making predictions are updated in the finetuning stage. The experimental results using this method are provided in Table 4 and 6 for the Gaussian noise case. Overall performance of the fusion model trained from the scratch is better than using finetuning. This shows the importance of feature extraction parts in deep learning models.
Evaluation on ASN data
Although our main focus is corruption on a single source, it is possible for a model to encounter a case where all the sources are corrupted. If the level of corruption is severe, then extracting any meaningful information from the input sources is impossible, e.g. occlusion on every sensors. However, we hope our model to be robust against reasonably corrupted input sources even if our training objective leans toward the single source robustness. Therefore, we also report the model’s performance against data corrupted with ASN. In most cases, the AVOD learned with TrainASN method achieves the best robustness against ASN, which is designed to do so. However, a model using elementwise mean fusion layers trained with TrainASN shows lower robustness scores compared to the SSN oriented approaches. We believe that this phenomenon is caused by corrupted feature extraction combined with the structural limitation of the mean fusion layer.
(Data) Train Algo.  Easy  Moderate  Hard  Easy  Moderate  Hard 

(Clean Data)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  76.41  72.74  66.86  89.33  86.49  79.44 
+TrainASN  75.96  66.68  65.97  88.63  79.45  78.79 
+TrainSSN  76.28  67.10  66.51  88.86  79.60  79.11 
+TrainSSNAlt  77.46  67.61  66.06  89.68  86.71  79.41 
(Gaussian ASN)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $28.08\pm 0.91$  $26.35\pm 2.18$  $21.81\pm 0.63$  $42.01\pm 0.23$  $33.68\pm 0.17$  $33.60\pm 0.13$ 
+TrainASN  $61.26\pm 0.45$  $47.71\pm 0.24$  $45.60\pm 0.19$  $87.40\pm 0.07$  $72.07\pm 2.89$  $70.13\pm 0.05$ 
+TrainSSN  $69.33\pm 0.43$  $55.41\pm 0.21$  $\mathbf{52.90}\pm \mathbf{2.12}$  $\mathbf{88.39}\pm \mathbf{0.13}$  $\mathbf{78.37}\pm \mathbf{0.10}$  $\mathbf{70.75}\pm \mathbf{0.05}$ 
+TrainSSNAlt  $\mathbf{71.63}\pm \mathbf{0.04}$  $\mathbf{56.24}\pm \mathbf{0.16}$  $49.14\pm 0.10$  $87.95\pm 0.08$  $77.88\pm 0.17$  $69.96\pm 0.08$ 
(Gaussian SSN)  $\mathrm{min}A{P}_{3D}(\%)$  $\mathrm{min}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $47.41\pm 0.28$  $41.84\pm 0.17$  $36.47\pm 0.16$  $65.63\pm 0.28$  $58.02\pm 0.23$  $50.43\pm 0.14$ 
+TrainASN  $61.53\pm 0.57$  $52.72\pm 0.08$  $47.25\pm 0.13$  $87.71\pm 0.14$  $78.37\pm 0.06$  $77.85\pm 0.08$ 
+TrainSSN  $71.65\pm 0.31$  $\mathbf{62.14}\pm \mathbf{0.08}$  $\mathbf{56.78}\pm \mathbf{0.12}$  $88.21\pm 0.08$  $78.90\pm 0.09$  $\mathbf{77.92}\pm \mathbf{0.11}$ 
+TrainSSNAlt  $\mathbf{71.66}\pm \mathbf{0.48}$  $57.61\pm 0.12$  $55.90\pm 0.11$  $\mathbf{89.42}\pm \mathbf{0.04}$  $\mathbf{79.56}\pm \mathbf{0.06}$  $\mathbf{77.92}\pm \mathbf{0.05}$ 
(Gaussian SSN)  $\mathrm{max}\text{Diff}A{P}_{3D}(\%)$  $\mathrm{max}\text{Diff}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $26.70\pm 0.52$  $22.42\pm 0.29$  $20.92\pm 0.25$  $22.27\pm 0.41$  $20.76\pm 0.33$  $20.09\pm 0.20$ 
+TrainASN  $14.48\pm 0.82$  $12.72\pm 0.33$  $11.18\pm 0.27$  $0.88\pm 0.22$  $0.48\pm 0.13$  $0.28\pm 0.12$ 
+TrainSSN  $\mathbf{3.71}\pm \mathbf{0.46}$  $\mathbf{3.42}\pm \mathbf{0.25}$  $7.50\pm 0.25$  $0.36\pm 0.17$  $\mathbf{0.04}\pm \mathbf{0.15}$  $0.71\pm 0.17$ 
+TrainSSNAlt  $5.55\pm 0.81$  $8.73\pm 0.32$  $\mathbf{2.91}\pm \mathbf{0.22}$  $\mathbf{0.09}\pm \mathbf{0.14}$  $0.13\pm 0.11$  $\mathbf{0.18}\pm \mathbf{0.11}$ 
(Data) Train Algo.  Easy  Moderate  Hard  Easy  Moderate  Hard 

(Clean Data)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  76.41  72.74  66.86  89.33  86.49  79.44 
+TrainASN  62.55  55.81  55.34  79.08  69.90  69.83 
+TrainSSN  73.50  65.66  64.74  88.27  85.65  78.98 
+TrainSSNAlt  75.76  71.99  66.31  88.76  85.73  79.14 
(Gaussian ASN)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $28.08\pm 0.91$  $26.35\pm 2.18$  $21.81\pm 0.63$  $42.01\pm 0.23$  $33.68\pm 0.17$  $33.60\pm 0.13$ 
+TrainASN  $\mathbf{68.58}\pm \mathbf{1.93}$  $\mathbf{54.76}\pm \mathbf{0.30}$  $\mathbf{48.00}\pm \mathbf{0.29}$  $\mathbf{83.15}\pm \mathbf{3.01}$  $\mathbf{76.10}\pm \mathbf{0.069}$  $\mathbf{68.49}\pm \mathbf{0.08}$ 
+TrainSSN  $60.73\pm 0.32$  $45.52\pm 0.19$  $44.42\pm 0.11$  $78.24\pm 0.10$  $68.41\pm 0.10$  $60.45\pm 0.07$ 
+TrainSSNAlt  $53.25\pm 0.27$  $44.96\pm 0.14$  $38.64\pm 0.10$  $68.69\pm 0.18$  $59.41\pm 0.14$  $51.37\pm 0.07$ 
(Gaussian SSN)  $\mathrm{min}A{P}_{3D}(\%)$  $\mathrm{min}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $47.41\pm 0.28$  $41.84\pm 0.17$  $36.47\pm 0.16$  $65.63\pm 0.28$  $58.02\pm 0.23$  $50.43\pm 0.14$ 
+TrainASN  $52.72\pm 0.34$  $45.66\pm 0.24$  $39.29\pm 0.22$  $69.33\pm 0.21$  $60.19\pm 0.15$  $59.66\pm 0.15$ 
+TrainSSN  $62.46\pm 0.48$  $53.85\pm 0.22$  $47.62\pm 0.14$  $77.77\pm 0.16$  $68.71\pm 0.09$  $67.89\pm 0.09$ 
+TrainSSNAlt  $\mathbf{70.09}\pm \mathbf{0.46}$  $\mathbf{56.20}\pm \mathbf{0.21}$  $\mathbf{54.46}\pm \mathbf{0.13}$  $\mathbf{84.46}\pm \mathbf{2.66}$  $\mathbf{76.32}\pm \mathbf{0.06}$  $\mathbf{68.74}\pm \mathbf{0.08}$ 
(Data) Train Algo.  Easy  Moderate  Hard  Easy  Moderate  Hard 

(Clean Data)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  77.79  67.69  66.31  88.90  85.64  78.86 
+TrainASN  75.00  64.75  58.28  88.30  78.60  77.23 
+TrainSSN  74.25  65.00  63.83  87.88  78.84  77.66 
+TrainSSNAlt  76.04  66.42  64.41  88.80  79.53  78.53 
(Gaussian ASN)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $46.79\pm 0.37$  $41.46\pm 0.27$  $36.31\pm 0.20$  $77.40\pm 0.34$  $67.46\pm 0.11$  $59.53\pm 0.11$ 
+TrainASN  $\mathbf{74.24}\pm \mathbf{0.29}$  $\mathbf{63.47}\pm \mathbf{0.18}$  $\mathbf{57.25}\pm \mathbf{0.19}$  $87.72\pm 0.12$  $\mathbf{77.89}\pm \mathbf{0.09}$  $\mathbf{70.36}\pm \mathbf{0.05}$ 
+TrainSSN  $67.69\pm 0.28$  $55.74\pm 0.30$  $53.16\pm 0.32$  $\mathbf{87.73}\pm \mathbf{0.16}$  $77.80\pm 0.15$  $70.00\pm 0.10$ 
+TrainSSNAlt  $63.72\pm 0.40$  $53.15\pm 0.29$  $48.17\pm 0.22$  $85.36\pm 0.08$  $75.60\pm 0.08$  $69.17\pm 0.03$ 
(Gaussian SSN)  $\mathrm{min}A{P}_{3D}(\%)$  $\mathrm{min}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $61.97\pm 0.55$  $53.95\pm 0.42$  $47.24\pm 0.27$  $79.44\pm 0.09$  $72.46\pm 3.14$  $68.25\pm 0.06$ 
+TrainASN  $\mathbf{74.24}\pm \mathbf{0.38}$  $58.25\pm 0.16$  $\mathbf{56.13}\pm \mathbf{0.10}$  $88.10\pm 0.26$  $\mathbf{78.19}\pm \mathbf{0.13}$  $70.42\pm 0.07$ 
+TrainSSN  $68.16\pm 0.88$  $\mathbf{60.39}\pm \mathbf{0.38}$  $56.04\pm 0.28$  $\mathbf{88.12}\pm \mathbf{0.16}$  $78.17\pm 0.06$  $70.21\pm 0.05$ 
+TrainSSNAlt  $68.63\pm 0.40$  $55.48\pm 0.16$  $54.42\pm 0.17$  $86.51\pm 0.46$  $76.85\pm 0.11$  $\mathbf{71.95}\pm \mathbf{2.72}$ 
(Gaussian SSN)  $\mathrm{max}\text{Diff}A{P}_{3D}(\%)$  $\mathrm{max}\text{Diff}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $3.75\pm 2.05$  $0.98\pm 0.55$  $5.95\pm 0.40$  $7.28\pm 0.37$  $4.46\pm 3.25$  $\mathbf{1.25}\pm \mathbf{0.13}$ 
+TrainASN  $\mathbf{1.54}\pm \mathbf{0.40}$  $\mathbf{0.85}\pm \mathbf{0.24}$  $\mathbf{0.83}\pm \mathbf{0.25}$  $0.92\pm 0.17$  $1.09\pm 0.14$  $7.44\pm 0.08$ 
+TrainSSN  $4.61\pm 1.16$  $2.51\pm 0.50$  $0.74\pm 0.46$  $\mathbf{0.16}\pm \mathbf{0.32}$  $\mathbf{0.72}\pm \mathbf{0.14}$  $7.10\pm 0.14$ 
+TrainSSNAlt  $4.65\pm 1.04$  $7.88\pm 0.46$  $2.90\pm 0.45$  $1.12\pm 0.71$  $1.83\pm 0.17$  $3.42\pm 2.84$ 
(Data) Train Algo.  Easy  Moderate  Hard  Easy  Moderate  Hard 

(Clean Data)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  77.79  67.69  66.31  88.90  85.64  78.86 
+TrainASN  74.65  65.40  63.40  88.18  79.21  78.42 
+TrainSSN  76.95  67.22  65.66  88.77  79.74  78.96 
+TrainSSNAlt  76.81  67.46  66.12  88.47  79.62  78.86 
(Gaussian ASN)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $46.79\pm 0.37$  $41.46\pm 0.27$  $36.31\pm 0.20$  $77.40\pm 0.34$  $67.46\pm 0.11$  $59.53\pm 0.11$ 
+TrainASN  $\mathbf{63.73}\pm \mathbf{0.24}$  $\mathbf{53.16}\pm \mathbf{0.16}$  $\mathbf{47.79}\pm \mathbf{0.17}$  $\mathbf{80.18}\pm \mathbf{0.07}$  $\mathbf{76.26}\pm \mathbf{0.03}$  $\mathbf{69.12}\pm \mathbf{0.04}$ 
+TrainSSN  $60.80\pm 0.48$  $47.73\pm 0.13$  $45.67\pm 0.15$  $79.82\pm 0.22$  $69.66\pm 0.10$  $68.38\pm 0.10$ 
+TrainSSNAlt  $52.25\pm 1.47$  $43.77\pm 0.62$  $37.91\pm 0.48$  $77.51\pm 0.12$  $67.32\pm 0.09$  $59.65\pm 0.10$ 
(Gaussian SSN)  $\mathrm{min}A{P}_{3D}(\%)$  $\mathrm{min}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $61.97\pm 0.55$  $53.95\pm 0.42$  $47.24\pm 0.27$  $79.44\pm 0.09$  $72.46\pm 3.14$  $68.25\pm 0.06$ 
+TrainASN  $\mathbf{68.08}\pm \mathbf{0.44}$  $\mathbf{57.28}\pm \mathbf{0.18}$  $\mathbf{55.27}\pm \mathbf{0.20}$  $86.45\pm 0.08$  $77.19\pm 0.08$  $69.57\pm 0.08$ 
+TrainSSN  $67.98\pm 1.31$  $55.61\pm 0.23$  $53.76\pm 0.20$  $\mathbf{86.87}\pm \mathbf{0.12}$  $\mathbf{77.56}\pm \mathbf{0.05}$  $\mathbf{69.81}\pm \mathbf{0.08}$ 
+TrainSSNAlt  $62.76\pm 0.41$  $52.14\pm 0.26$  $46.55\pm 0.13$  $85.34\pm 2.36$  $75.72\pm 0.04$  $68.60\pm 0.02$ 
Results on downsampling corruption
Downsampling the LIDAR sensor is important as it is not clear whether a model trained with a highresolution sensor will still work with a lowresolution one. In fact, reducing the number of lasers of a LIDAR is directly related to its price, which an important practical issue in deploying an actual autonomous vehicle. As the rotating LIDAR sensor used in the KITTI dataset outputs point clouds with a horizontal structure, an RGB image’s horizontal lines are also set to black to match the information loss ratio 1/4. Table 7 fully reports the performance of AVOD using our LEL when downsampling is considered as a corruption method.
(Data) Train Algo.  Easy  Moderate  Hard  Easy  Moderate  Hard 

(Clean Data)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  77.79  67.69  66.31  88.90  85.64  78.86 
+TrainASN  71.74  61.78  60.26  87.29  77.08  75.89 
+TrainSSN  75.54  66.26  63.72  88.07  79.18  78.03 
+TrainSSNAlt  76.22  66.05  63.87  89.00  79.65  78.03 
(Downsample ASN)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  36.13  27.39  26.39  77.60  59.84  51.82 
+TrainASN  71.30  56.04  49.08  85.66  70.17  68.55 
+TrainSSN  64.88  48.92  47.06  86.21  69.26  61.48 
+TrainSSNAlt  48.98  36.30  31.06  75.00  51.35  49.60 
(Downsample SSN)  $\mathrm{min}A{P}_{3D}(\%)$  $\mathrm{min}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  61.70  51.66  46.17  86.08  69.99  61.55 
+TrainASN  65.74  53.49  51.35  82.27  67.88  65.79 
+TrainSSN  73.33  57.85  54.91  86.61  76.07  68.59 
+TrainSSNAlt  64.77  53.34  48.29  85.27  69.87  67.77 
(Downsample SSN)  $\mathrm{max}\text{Diff}A{P}_{3D}(\%)$  $\mathrm{max}\text{Diff}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  11.71  5.88  3.59  1.96  7.60  8.65 
+TrainASN  10.00  11.34  11.76  6.53  11.23  12.40 
+TrainSSN  0.94  5.71  3.11  1.74  2.36  9.00 
+TrainSSNAlt  6.98  3.63  1.34  1.67  0.12  0.81 
Concatenation
Our analyses in Section 3 assume to use a linear fusion model with a simple concatenation strategy. Therefore, we first train the AVOD model with concatenation fusion layers on clean data and finetune with different training strategies. Interestingly, a simple data augmentation strategy TrainSSNAlt does not work well in this case, and TrainASN algorithm learns the best robust model. Unlike our simple linear model deep learning jointly learns both feature representation and weights for the fusion layers. Also, concatenated convolutional features have large number of channels which are mixed without sparse constraints. Therefore, this may lead to a model with too complex joint feature representation which needs stronger guideline in optimization steps.
(Data) Train Algo.  Easy  Moderate  Hard  Easy  Moderate  Hard 

(Clean Data)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  78.40  74.88  67.78  89.74  87.76  79.83 
+TrainASN  72.89  63.47  62.22  88.44  84.97  78.88 
+TrainSSN  76.15  66.79  65.78  89.02  86.06  79.29 
+TrainSSNAlt  76.46  72.98  66.94  89.07  86.39  79.34 
(Gaussian ASN)  $A{P}_{3D}(\%)$  $A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $16.50\pm 2.27$  $15.12\pm 0.06$  $15.06\pm 0.08$  $25.81\pm 0.23$  $25.38\pm 0.18$  $17.45\pm 0.08$ 
+TrainASN  $\mathbf{69.21}\pm \mathbf{0.24}$  $\mathbf{54.85}\pm \mathbf{0.08}$  $\mathbf{53.30}\pm \mathbf{0.08}$  $\mathbf{86.07}\pm \mathbf{0.11}$  $\mathbf{76.42}\pm \mathbf{0.04}$  $\mathbf{69.54}\pm \mathbf{0.02}$ 
+TrainSSN  $62.05\pm 0.36$  $50.35\pm 2.58$  $46.04\pm 0.25$  $79.21\pm 0.08$  $69.31\pm 0.10$  $61.21\pm 0.06$ 
+TrainSSNAlt  $33.86\pm 2.85$  $27.99\pm 0.64$  $22.59\pm 0.60$  $42.65\pm 0.18$  $41.77\pm 0.18$  $34.13\pm 0.12$ 
(Gaussian SSN)  $\mathrm{min}A{P}_{3D}(\%)$  $\mathrm{min}A{P}_{BEV}(\%)$  
AVOD (Ku et al., 2018)  $31.23\pm 0.31$  $30.27\pm 0.13$  $30.49\pm 0.18$  $43.04\pm 0.16$  $42.81\pm 0.10$  $42.96\pm 0.08$ 
+TrainASN  $\mathbf{68.21}\pm \mathbf{0.37}$  $54.50\pm 0.26$  $47.91\pm 0.21$  $\mathbf{86.66}\pm \mathbf{0.11}$  $\mathbf{76.95}\pm \mathbf{0.11}$  $\mathbf{69.70}\pm \mathbf{0.08}$ 
+TrainSSN  $64.39\pm 0.23$  $\mathbf{55.12}\pm \mathbf{0.21}$  $\mathbf{48.38}\pm \mathbf{0.14}$  $79.71\pm 0.07$  $70.05\pm 0.07$  $69.32\pm 0.10$ 
+TrainSSNAlt  $44.25\pm 0.49$  $37.23\pm 0.44$  $37.58\pm 0.34$  $59.06\pm 0.12$  $51.19\pm 0.08$  $51.28\pm 0.06$ 