Achieving Robustness in the Wild via Adversarial Mixing With Disentangled Representations

Gowal, Sven; Qin, Chongli; Huang, Po-Sen; Cemgil, Taylan; Dvijotham, Krishnamurthy; Mann, Timothy; Kohli, Pushmeet

doi:10.1109/cvpr42600.2020.00129

Cited by 41 publications

(33 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Instead of using heuristic data augmentations which cannot be used to learn more complex transformations, the desired augmentation can be learnt. The training data can be augmented by transforming samples using a generative model to either come from another part of the domain conditioned on an attribute (Goel et al, 2020), another domain (Zhou et al, 2020), be domain agnostic (Carlucci et al, 2019), or to have a different style (Gowal et al, 2020;Geirhos et al, 2019). These methods often build on work in image generation, such as CYCLEGAN and STYLEGAN (Karras et al, 2019).…”

Section: Literature Reviewmentioning

confidence: 99%

A Fine-Grained Analysis on Distribution Shift

Wiles¹,

Gowal²,

Stimberg³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Robustness to distribution shifts is critical for deploying machine learning models in the real world. Despite this necessity, there has been little work in defining the underlying mechanisms that cause these shifts and evaluating the robustness of algorithms across multiple, different distribution shifts. To this end, we introduce a framework that enables fine-grained analysis of various distribution shifts. We provide a holistic analysis of current state-of-the-art methods by evaluating 19 distinct methods grouped into five categories across both synthetic and real-world datasets. Overall, we train more than 85K models. Our experimental framework can be easily extended to include new methods, shifts, and datasets. We find, unlike previous work (Gulrajani & Lopez-Paz, 2021), that progress has been made over a standard ERM baseline; in particular, pretraining and augmentations (learned or heuristic) offer large gains in many cases. However, the best methods are not consistent over different datasets and shifts.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

A Fine-Grained Analysis on Distribution Shift

Wiles¹,

Gowal²,

Stimberg³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Bhattad et al [2] leverage pre-trained colourisation and texturetransfer models to adversarially change the colours and textures of an image. A number of publications in some way exploit generative models with disentangled latent spaces, be it by using Fader Networks [24], using a dataset with labelled attributes to train a conditional generator [36], or using a StyleGAN and partitioning the latent space according to whether or not it should influence the label [15]. Selecting the features to perturb like this allows for precise control over these features, but like hand-crafted perturbations, result in narrow kinds of changes to images.…”

Section: Related Workmentioning

confidence: 99%

Exposing previously undetectable faults in deep neural networks

Dunn

Pouget

Kroening

et al. 2021

Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis

View full text Add to dashboard Cite

Existing methods for testing DNNs solve the oracle problem by constraining the raw features (e.g. image pixel values) to be within a small distance of a dataset example for which the desired DNN output is known. But this limits the kinds of faults these approaches are able to detect. In this paper, we introduce a novel DNN testing method that is able to find faults in DNNs that other methods cannot. The crux is that, by leveraging generative machine learning, we can generate fresh test inputs that vary in their high-level features (for images, these include object shape, location, texture, and colour). We demonstrate that our approach is capable of detecting deliberately injected faults as well as new faults in state-of-the-art DNNs, and that in both cases, existing methods are unable to find these faults. CCS CONCEPTS• Software and its engineering → Software testing and debugging; • Computing methodologies → Neural networks.

show abstract

“…However, in this paper we make no particular assumption on the specific form of ∆. In particular, our results apply to arbitrary perturbation sets, such as those used in [62][63][64][65][66].…”

Section: Problem Formulationmentioning

confidence: 99%

Adversarial Robustness with Semi-Infinite Constrained Learning

Robey¹,

Chamon²,

Pappas³

et al. 2021

Preprint

View full text Add to dashboard Cite

Despite strong performance in numerous applications, the fragility of deep learning to input perturbations has raised serious questions about its use in safety-critical domains. While adversarial training can mitigate this issue in practice, state-ofthe-art methods are increasingly application-dependent, heuristic in nature, and suffer from fundamental trade-offs between nominal performance and robustness. Moreover, the problem of finding worst-case perturbations is non-convex and underparameterized, both of which engender a non-favorable optimization landscape. Thus, there is a gap between the theory and practice of adversarial training, particularly with respect to when and why adversarial training works. In this paper, we take a constrained learning approach to address these questions and to provide a theoretical foundation for robust learning. In particular, we leverage semi-infinite optimization and non-convex duality theory to show that adversarial training is equivalent to a statistical problem over perturbation distributions, which we characterize completely. Notably, we show that a myriad of previous robust training techniques can be recovered for particular, sub-optimal choices of these distributions. Using these insights, we then propose a hybrid Langevin Monte Carlo approach of which several common algorithms (e.g., PGD) are special cases. Finally, we show that our approach can mitigate the trade-off between nominal and robust performance, yielding state-of-the-art results on MNIST and CIFAR-10. Our code is available at: https://github.com/arobey1/advbench.

show abstract

Achieving Robustness in the Wild via Adversarial Mixing With Disentangled Representations

Cited by 41 publications

References 15 publications

A Fine-Grained Analysis on Distribution Shift

A Fine-Grained Analysis on Distribution Shift

Exposing previously undetectable faults in deep neural networks

Adversarial Robustness with Semi-Infinite Constrained Learning

Contact Info

Product

Resources

About