Learning perturbation sets for robust machine learning

Abstract

Although much progress has been made towards robust deep learning, a significant gap in robustness remains between real-world perturbations and more narrowly defined sets typically studied in adversarial defenses. In this paper, we aim to bridge this gap by learning perturbation sets from data, in order to characterize real-world effects for robust training and evaluation. Specifically, we use a conditional generator that defines the perturbation set over a constrained region of the latent space. We formulate desirable properties that measure the quality of a learned perturbation set, and theoretically prove that a conditional variational autoencoder naturally satisfies these criteria. Using this framework, our approach can generate a variety of perturbations at different complexities and scales, ranging from baseline spatial transformations, through common image corruptions, to lighting variations. We measure the quality of our learned perturbation sets both quantitatively and qualitatively, finding that our models are capable of producing a diverse set of meaningful perturbations beyond the limited data seen during training. Finally, we leverage our learned perturbation sets to train models which are empirically and certifiably robust to adversarial image corruptions and adversarial lighting variations, while improving generalization on non-adversarial data. All code and configuration files for reproducing the experiments as well as pretrained model weights can be found at https://github.com/locuslab/perturbation_learning.

References in corpus (27)

• Adam: A Method for Stochastic Optimization
• mixup: Beyond Empirical Risk Minimization
• Improved Regularization of Convolutional Neural Networks with Cutout
• Wide Residual Networks
• Synthesizing Robust Adversarial Examples
• On Evaluating Adversarial Robustness
• AugMix: A Simple Data Processing Method to Improve Robustness and Uncertainty
• Certified Defenses against Adversarial Examples
• Distributionally Robust Neural Networks for Group Shifts: On the Importance of Regularization for Worst-Case Generalization
• Certifying Some Distributional Robustness with Principled Adversarial Training
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Spatially Transformed Adversarial Examples
• Generating Adversarial Examples with Adversarial Networks
• A General Framework for Adversarial Examples with Objectives
• Adversarial Training Methods for Semi-Supervised Text Classification
• Benchmarking Robustness in Object Detection: Autonomous Driving when Winter is Coming
• Functional Adversarial Attacks
• Adversarial Robustness Against the Union of Multiple Perturbation Models
• Unrestricted Adversarial Examples via Semantic Manipulation
• Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
• Adversarial camera stickers: A physical camera-based attack on deep learning systems
• Overfitting in adversarially robust deep learning
• Towards Stable and Efficient Training of Verifiably Robust Neural Networks
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Randomized Smoothing of All Shapes and Sizes
• Adversarial Music: Real World Audio Adversary Against Wake-word Detection System
• Certified Robustness to Adversarial Word Substitutions

Cited by in corpus (14)

• On the Opportunities and Risks of Foundation Models
• RobustBench: a standardized adversarial robustness benchmark
• A Review of Adversarial Attack and Defense for Classification Methods
• Viewmaker Networks: Learning Views for Unsupervised Representation Learning
• Neural Transformation Learning for Deep Anomaly Detection Beyond Images
• Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming
• Model-Based Domain Generalization
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• Adversarial Robustness with Non-uniform Perturbations
• Auditing AI models for Verified Deployment under Semantic Specifications
• Fair Normalizing Flows
• Wiggling Weights to Improve the Robustness of Classifiers
• Localized Uncertainty Attacks
• Built-in Elastic Transformations for Improved Robustness