Attribute-Guided Adversarial Training for Robustness to Natural Perturbations
Tejas Gokhale1111Work performed during internship at LLNL., Rushil Anirudh2, Bhavya Kailkhura2, Jayaraman J. Thiagarajan2, Chitta Baral1, Yezhou Yang1
Abstract
While existing work in robust deep learning has focused on small pixel-level norm-based perturbations, this may not account for perturbations encountered in several real-world settings. In many such cases although test data might not be available, broad specifications about the types of perturbations (such as an unknown degree of rotation) may be known. We consider a setup where robustness is expected over an unseen test domain that is not i.i.d. but deviates from the training domain. While this deviation may not be exactly known, its broad characterization is specified a priori, in terms of attributes. We propose an adversarial training approach which learns to generate new samples so as to maximize exposure of the classifier to the attributes-space, without having access to the data from the test domain. Our adversarial training solves a min-max optimization problem, with the inner maximization generating adversarial perturbations, and the outer minimization finding model parameters by optimizing the loss on adversarial perturbations generated from the inner maximization. We demonstrate the applicability of our approach on three types of naturally occurring perturbations — object
中文速览
现有的对抗鲁棒性研究大多只关注像素级的微小扰动，但真实世界中的图像变化往往来自旋转、形状改变、光照偏移等"属性层面"的自然扰动，这些变化远超传统方法的覆盖范围。为此，研究者提出了一种名为属性引导对抗训练（Attribute-Guided Adversarial Training，AGAT）的框架：在无需获取任何测试数据的前提下，只需预先指定扰动类型（如几何变换、物体外观变化、常见图像污染），就能通过可微分的代理函数在属性空间中生成最难样本，再用最小-最大优化交替训练分类器。在 MNIST、CIFAR-10 以及研究者新建的 CLEVR-Singles 基准上，AGAT 均优于现有的鲁棒性基线方法，甚至在传统像素级扰动评测上也表现更好。这项工作的意义在于，它为模型提供了一种面向现实场景的鲁棒性保障，只需粗略描述可能遭遇的扰动类型，无需真实测试样本，大幅降低了部署门槛。
原文 arXiv:2012.01806;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2012.01806v3