Robustness to Adversarial Perturbations in Learning from Incomplete Data

By Amir Najafi, Shin-ichi Maeda, Masanori Koyama, Takeru Miyato. 2019

138 citations recorded by the source corpus.

What is the role of unlabeled data in an inference problem, when the presumed underlying distribution is adversarially perturbed? To provide a concrete answer to this question, this paper unifies two major learning frameworks: Semi-Supervised Learning (SSL) and Distributionally Robust Learning (DRL). We develop a generalization theory for our framework based on a number of novel complexity measures, such as an adversarial extension of Rademacher complexity and its semi-supervised analogue. Moreover, our analysis is able to quantify the role of unlabeled data in the generalization under a more general condition compared to the existing theoretical works in SSL. Based on our framework, we also present a hybrid of DRL and EM algorithms that has a guaranteed convergence rate. When implemented with deep neural networks, our method shows a comparable performance to those of the state-of-the-art on a number of real-world benchmark datasets.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Measuring Robustness to Natural Distribution Shifts in Image Classification (2020, background): “[61] Najafi, A.”
Adversarial Examples Improve Image Recognition (2019, background): “Other works try to explain this tradeoff phenomenon from the perspective of the increased sample complexity of adversary [37, 25, 28], the limited amount of training data [1, 27, 34, 44, 48], or network overparameterization [31].”
Unlabeled Data Improves Adversarial Robustness (2019, background): “[32] extend the distributionally robust optimization perspective of [43] to a semisupervised setting.”
Are Labels Required for Improving Adversarial Robustness? (2019, background): “The observation that adversarial robustness can be optimized without labels was made independently and concurrently by [9, 30, 49].”
Understanding Self-Training for Gradual Domain Adaptation (2020, methodology): “We analyze self-training (also known as pseudolabeling), a method in the semi-supervised learning literature [5] that has led to state-of-the-art results on ImageNet [6] and adversarial robustness on CIFAR-10 [7, 8, 9].”
Fixing Data Augmentation to Improve Adversarial Robustness (2021, background): “In a bid to improve robustness, Hendrycks et al. (2019); Carmon et al. (2019); Uesato et al. (2019); Zhai et al. (2019); Najafi et al. (2019) pioneered the use of additional data (in both fully-supervised and semi-supervised settings).”
Semi-Supervised and Unsupervised Deep Visual Learning: A Survey (2022, background): “Notably, semi-supervised learning with adversarial perturbed unlabeled data does not only improve model generalization, but it also enhances robustness to adversarial attacks [56], [57].”
Understanding and Mitigating the Tradeoff Between Robustness and Accuracy (2020, methodology): “We first revisit the recently proposed robust self-training (RST) (Carmon et al., 2019; Najafi et al., 2019; Uesato et al., 2019) that incorporates additional unlabeled data via pseudo-labels from a standard estimator.”
Improving Robustness using Generated Data (2021, background): “We highlight the works by Carmon et al. [11], Najaﬁ et al. [52], Uesato et al. [73], Zhai et al. [81] who simultaneously proposed the use of additional unlabeled external data.”
Better Diffusion Models Further Improve Adversarial Training (2023, background): “Thus, several pioneer efforts are made to incorporate external datasets into AT (Hendrycks et al., 2019; Carmon et al., 2019; Alayrac et al., 2019; Najafi et al., 2019; Zhai et al., 2019; Wang et al., 2020), either in a fully-supervised or semi-supervised learning paradigm.”
Do Wider Neural Networks Really Help Adversarial Robustness? (2020, background): “Another line of works focuses on increasing the effective size of the training data, either by pre-trained models [30] or by semi-supervised learning [10, 1, 44].”
Improving Adversarial Robustness Requires Revisiting Misclassified Examples (2020, background): “…the sample complexity of adversarial training can be signiﬁcantly higher than that of natural training, that is, training robust DNNs tends to require more data either labeled (Schmidt et al., 2018) or unlabeled ones (Uesato et al., 2019; Carmon et al., 2019; Najaﬁ et al., 2019; Zhai et al., 2019).”