Learning perturbation sets for robust machine learning

by   Eric Wong, et al.

Although much progress has been made towards robust deep learning, a significant gap in robustness remains between real-world perturbations and more narrowly defined sets typically studied in adversarial defenses. In this paper, we aim to bridge this gap by learning perturbation sets from data, in order to characterize real-world effects for robust training and evaluation. Specifically, we use a conditional generator that defines the perturbation set over a constrained region of the latent space. We formulate desirable properties that measure the quality of a learned perturbation set, and theoretically prove that a conditional variational autoencoder naturally satisfies these criteria. Using this framework, our approach can generate a variety of perturbations at different complexities and scales, ranging from baseline digit transformations, through common image corruptions, to lighting variations. We measure the quality of our learned perturbation sets both quantitatively and qualitatively, finding that our models are capable of producing a diverse set of meaningful perturbations beyond the limited data seen during training. Finally, we leverage our learned perturbation sets to learn models which have improved generalization performance and are empirically and certifiably robust to adversarial image corruptions and adversarial lighting variations. All code and configuration files for reproducing the experiments as well as pretrained model weights can be found at https://github.com/locuslab/perturbation_learning.


page 7

page 8

page 25

page 26

page 29

page 30

page 31


Improved Image Wasserstein Attacks and Defenses

Robustness against image perturbations bounded by a ℓ_p ball have been w...

Foolbox v0.8.0: A Python toolbox to benchmark the robustness of machine learning models

Even todays most advanced machine learning models are easily fooled by a...

Achieving Robustness in the Wild via Adversarial Mixing with Disentangled Representations

Recent research has made the surprising finding that state-of-the-art de...

Benchmarking Robustness of Deep Learning Classifiers Using Two-Factor Perturbation

This paper adds to the fundamental body of work on benchmarking the robu...

Measuring the Robustness of Graph Properties

In this paper, we propose a perturbation framework to measure the robust...

Perturbation of Deep Autoencoder Weights for Model Compression and Classification of Tabular Data

Fully connected deep neural networks (DNN) often include redundant weigh...

Class-Level Logit Perturbation

Features, logits, and labels are the three primary data when a sample pa...

Please sign up or login with your details

Forgot password? Click here to reset