Achieving Robustness in the Wild via Adversarial Mixing with Disentangled Representations
Sven Gowal∗ DeepMind Chongli Qin∗ Po-Sen Huang Taylan Cemgil Krishnamurthy (Dj) Dvijotham Timothy Mann Pushmeet Kohli
Abstract
Recent research has made the surprising finding that state-of-the-art deep learning models sometimes fail to generalize to small variations of the input. Adversarial training has been shown to be an effective approach to overcome this problem. However, its application has been limited to enforcing invariance to analytically defined transformations like $\ell_{p}$ -norm bounded perturbations. Such perturbations do not necessarily cover plausible real-world variations that preserve the semantics of the input (such as a change in lighting conditions). In this paper, we propose a novel approach to express and formalize robustness to these kinds of real-world transformations of the input. The two key ideas underlying our formulation are (1) leveraging disentangled representations of the input to define different factors of variations, and (2) generating new input images by adversarially composing the representations of different images. We use a StyleGAN model to demonstrate the efficacy of this framework. Specifically, we leverage the disentangled latent representations computed by a StyleGAN model to generate perturbations of an image that are similar to real-world variations (like ad
中文速览
深度学习模型在面对真实世界中语义不变但外观有所变化的输入（如光照变化、妆容差异、肤色不同）时，往往会失效——这类变化远比传统对抗训练针对的像素级微扰更贴近实际。作者提出了一套名为 AdvMix（Adversarial Mixing with Disentangled Representations，基于解耦表示的对抗混合）的框架：借助 StyleGAN 模型将图像编码为与分类标签无关和有关的两组解耦隐变量，再通过对抗优化的方式，把一张图中与标签无关的属性（如妆容或肤色）"最坏情况式地"替换到另一张图上，从而生成语义上合理的扰动样本来训练分类器。在受控的彩色 MNIST 数据集和人脸属性数据集 CelebA 上的大量实验表明，该方法显著提升了模型对数据偏差和虚假相关性的鲁棒性，例如将"微笑"检测器的错误率降低了 21%。这项工作的意义在于，它首次在语义层面将对抗训练与数据增强系统性地对比，并证明只要扰动定义在合理的语义流形上，鲁棒性与准确率并不必然相互牺牲。
原文 arXiv:1912.03192;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1912.03192v2