Learning perturbation sets for robust machine learning

Abstract

Although much progress has been made towards robust deep learning, a significant gap in robustness remains between real-world perturbations and more narrowly defined sets typically studied in adversarial defenses. In this paper, we aim to bridge this gap by learning perturbation sets from data, in order to characterize realworld effects for robust training and evaluation. Specifically, we use a conditional generator that defines the perturbation set over a constrained region of the latent space. We formulate desirable properties that measure the quality of a learned perturbation set, and theoretically prove that a conditional variational autoencoder naturally satisfies these criteria. Using this framework, our approach can generate a variety of perturbations at different complexities and scales, ranging from baseline digit transformations, through common image corruptions, to lighting variations. We measure the quality of our learned perturbation sets both quantitatively and qualitatively, finding that our models are capable of producing a diverse set of meaningful perturbations beyond the limited data seen during training. Finally, we leverage our learned perturbation sets to learn models which have improved generalization performance and are empirically and certifiably robust to adversarial image corruptions and adversarial lighting variations. All code and configuration files for reproducing the experiments as well as pretrained model weights can be found at https://github.com/locuslab/perturbation_learning.Preprint. Under review.

Adversarial Robustness with Semi-Infinite Constrained Learning

“…However, in this paper we make no particular assumption on the specific form of ∆. In particular, our results apply to arbitrary perturbation sets, such as those used in [62][63][64][65][66].…”

“…Due to space constraints, we considered only pertubations of the form G(x, δ) = x + δ as in (P-RO). Yet, by once again fixing the pertubation distribution λ, we can obtain a myriad of data augmentation techniques, including the group-theoretic data-augmentation scheme discussed in [93], where G denotes the group action, and the model-based robust training methods discussed in [62][63][64][65]. Indeed, exploring the efficacy of DALE toward improving robustness beyond norm-bounded perturbations is an exciting direction for future work.…”

Built-in Elastic Transformations for Improved Robustness

“…Gulshad et al [10] trained on images with adversarial as well as natural perturbations like occlusions or elastic deformations, while achieving good generalization for many other unseen perturbations. Robey et al [18] and Wong et al [26] argued that it is impossible to capture all possible natural perturbations mathematically. Therefore, they used generative models to generate images with perturbations to train the network.…”

Wiggling Weights to Improve the Robustness of Classifiers

“…[16] trained on images with adversarial as well as natural perturbations like occlusions or elastic deformations, while achieving good generalization for many other unseen perturbations. [31] and [43] argued that it is impossible to capture all possible natural perturbations mathematically. Therefore, they used generative models to generate images with perturbations to train the network.…”