Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data

Abstract

While deep learning has resulted in major breakthroughs in many application domains, the frameworks commonly used in deep learning remain fragile to artificially-crafted and imperceptible changes in the data. In response to this fragility, adversarial training has emerged as a principled approach for enhancing the robustness of deep learning with respect to norm-bounded perturbations. However, there are other sources of fragility for deep learning that are arguably more common and less thoroughly studied. Indeed, natural variation such as lighting or weather conditions can significantly degrade the accuracy of trained neural networks, proving that such natural variation presents a significant challenge for deep learning. In this paper, we propose a paradigm shift from perturbation-based adversarial robustness toward model-based robust deep learning. Our objective is to provide general training algorithms that can be used to train deep neural networks to be robust against natural variation in data. Critical to our paradigm is first obtaining a model of natural variation which can be used to vary data over a range of natural conditions. Such models may be either known a priori or else learned from data. In the latter case, we show that deep generative models can be used to learn models of natural variation that are consistent with realistic conditions. We then exploit such models in three novel model-based robust training algorithms in order to enhance the robustness of deep learning with respect to the given model. Our extensive experiments show that across a variety of naturally-occurring conditions and across various datasets, deep neural networks trained with our model-based algorithms significantly outperform both standard deep learning algorithms as well as norm-bounded robust deep learning algorithms.

References in corpus (45)

• Auto-Encoding Variational Bayes
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• ADADELTA: An Adaptive Learning Rate Method
• Large Scale GAN Training for High Fidelity Natural Image Synthesis
• Conditional Adversarial Domain Adaptation
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Toward Multimodal Image-to-Image Translation
• Theoretically Principled Trade-off between Robustness and Accuracy
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Domain Generalization via Invariant Feature Representation
• AugMix: A Simple Data Processing Method to Improve Robustness and Uncertainty
• Certified Defenses against Adversarial Examples
• Group Equivariant Convolutional Networks
• Adversarially Robust Generalization Requires More Data
• Generating Natural Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Robustness May Be at Odds with Accuracy
• Billion-scale semi-supervised learning for image classification
• Augmented CycleGAN: Learning Many-to-Many Mappings from Unpaired Data
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Exploring the Landscape of Spatial Robustness
• Spatially Transformed Adversarial Examples
• Towards the first adversarially robust neural network model on MNIST
• Generating Adversarial Examples with Adversarial Networks
• Natural Adversarial Examples
• Gauge Equivariant Convolutional Networks and the Icosahedral CNN
• Domain Generalization by Marginal Transfer Learning
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Traffic Sign Detection under Challenging Conditions: A Deeper Look Into Performance Variations and Spectral Characteristics
• Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN
• Cross-Domain Transferability of Adversarial Perturbations
• Learning Latent Subspaces in Variational Autoencoders
• Cold Case: The Lost MNIST Digits
• Excessive Invariance Causes Adversarial Vulnerability
• Permutation-equivariant neural networks applied to dynamics prediction
• Learning perturbation sets for robust machine learning
• Learning Invariances using the Marginal Likelihood
• Learning Invariances in Neural Networks
• A Direct Approach to Robust Deep Learning Using Adversarial Networks
• Benchmarking Adversarial Robustness
• Imitation Attacks and Defenses for Black-box Machine Translation Systems
• Robustness of Rotation-Equivariant Networks to Adversarial Perturbations
• Stochastic Conditional Generative Networks with Basis Decomposition