Enhances deep learning robustness to noise without sacrificing clean data accuracy.
problem Robustness of deep neural networks to input noise.
method Discriminative loss at penultimate layer and class-wise feature alignment with Gaussian noise.
result Improves robustness to various perturbations without degrading clean data accuracy.
SAT improves adversarial training by smoothing the loss landscape through curriculum learning.
problem Adversarial training sacrifices clean accuracy for robustness and suffers from large generalization error.
method SAT uses curriculum learning to smooth the adversarial loss landscape, improving both clean and robust accuracy.
result SAT models improve clean and robust accuracy significantly compared to adversarial training and other baselines.
Deploying machine learning systems in the real world requires both high accuracy on clean data and robustness to naturally occurring corruptions. While architectural advances have led to improved accuracy, building robust models remains challenging. Prior work has argued that there is an inherent trade-off between robu…
Neural networks are vulnerable to small adversarial perturbations. Existing literature largely focused on understanding and mitigating the vulnerability of learned models. In this paper, we demonstrate an intriguing phenomenon about the most popular robust training method in the literature, adversarial training: Advers…
PClean automates Bayesian data cleaning for specific datasets.
problem Bayesian inference for diverse and complex data cleaning.
method Domain-specific probabilistic programming language with custom models and inference.
result PClean programs outperform general-purpose PPLs in accuracy and runtime.
EntProp increases entropy of clean samples to generate out-of-distribution data for better DNN performance.
problem Improving deep neural networks' accuracy and robustness to out-of-distribution data.
method High entropy propagation using data augmentation and free adversarial training.
result EntProp achieves higher standard accuracy and robustness with lower training cost.
It has been demonstrated that deep neural networks are prone to noisy examples particular adversarial samples during inference process. The gap between robust deep learning systems in real world applications and vulnerable neural networks is still large. Current adversarial training strategies improve the robustness ag…
Empirical adversarial risk minimization (EARM) is a widely used mathematical framework to robustly train deep neural nets (DNNs) that are resistant to adversarial attacks. However, both natural and robust accuracies, in classifying clean and adversarial images, respectively, of the trained robust models are far from sa…
TS-Fault benchmarks TSF models against structural faults.
problem Evaluating the robustness of time series forecasting models against structured events.
method TS-Fault uses parameterized fault scenarios with controllable difficulty.
result Three findings contradict common leaderboard intuition.
PrIU optimizes machine learning model updates after data cleaning.
problem Incrementally updating machine learning models after removing problematic training samples.
method Provenance-based approach for efficient model parameter updates.
result PrIU-opt achieves up to two orders of magnitude speed-up compared to retraining from scratch.
New method improves false-/true-positive-rate estimation in fraud detection with noisy labels.
problem Estimating FPR/TPR in fraud detection with class-conditional label noise.
method Directly cleaning model's validation data to de-correlate cleaning error with model scores.
result Improves accuracy of FPR/TPR estimates, especially in asymmetric label noise scenarios.
Adversarial training can lead to unfair accuracy disparities between different groups.
problem Adversarial training algorithms introduce unfair accuracy disparities between different groups of data.
method Propose a Fair-Robust-Learning (FRL) framework to mitigate unfairness in adversarial defenses.
result Empirical and theoretical validation of FRL's effectiveness in mitigating unfairness.
This work benchmarks and theorizes robust NAS under adversarial training.
problem Lack of benchmark evaluations and theoretical guarantees for robust NAS architectures under adversarial training.
method Released a comprehensive data set and established a generalization theory using the neural tangent kernel.
result Established a generalization theory for robust NAS architectures under adversarial training.
RATIO improves neural network robustness and explainability.
problem Neural networks' lack of robustness to adversarial changes and uncertainty on out-distribution samples.
method RATIO: Adversarial Training on In- and Out-distribution.
result RATIO leads to robust models with reliable confidence estimates on out-distribution samples.
New method defends against patch attacks with high-certainty guarantees.
problem Patch attacks on images, especially physical adversarial attacks.
method Randomized smoothing, exploiting patch constraints.
result Meaningfully large robustness certificates against patch attacks.
We propose an algorithm to enhance certified robustness of a deep model ensemble by optimally weighting each base model. Unlike previous works on using ensembles to empirically improve robustness, our algorithm is based on optimizing a guaranteed robustness certificate of neural networks. Our proposed ensemble framewor…
Adversarial training, in which a network is trained on both adversarial and clean examples, is one of the most trusted defense methods against adversarial attacks. However, there are three major practical difficulties in implementing and deploying this method - expensive in terms of extra memory and computation costs; …
CAT improves robustness of neural networks by customizing perturbation levels.
problem Poor generalization of adversarial training on clean and perturbed data.
method CAT adapts perturbation level and label for each sample.
result CAT achieves better clean and robust accuracy than previous methods.
Method cleans noisy training labels for biomedical data.
problem Accurately labeling biomedical data is challenging.
method Reliability-based training data cleaning with inductive conformal prediction.
result Significant enhancements in classification performance across multiple tasks.
In this paper, we develop improved techniques for defending against adversarial examples at scale. First, we implement the state of the art version of adversarial training at unprecedented scale on ImageNet and investigate whether it remains effective in this setting - an important open scientific question (Athalye et …
Data quality issues have attracted widespread attention due to the negative impacts of dirty data on data mining and machine learning results. The relationship between data quality and the accuracy of results could be applied on the selection of the appropriate algorithm with the consideration of data quality and the d…
New method finds optimal training stop point with noisy labeled data.
problem Finding optimal training stop point with noisy labeled data.
method Analyzed training accuracy rate changes for different noise ratios to identify a training stop region. Developed a heuristic algorithm based on a small-learning assumption.
result Identified optimal training stop point at or close to maximum obtainable test accuracy.
This paper proposes BAT to balance accuracy and robustness in adversarial training.
problem Balancing accuracy and robustness in adversarial training models.
method Blind adversarial training (BAT) uses a cutoff-scale strategy to adaptively estimate a nonuniform budget for AEs.
result BAT improves the overall robustness of adversarial training models.
Paper proposes a robust metric learning algorithm.
problem Robustness of metric learning against adversarial perturbations is insufficient.
method Proposes a novel Mahalanobis distance metric learning algorithm.
result Certifiable robustness improvement over Euclidean distance.
Defense against backdoor attacks by clustering incompatible data subsets.
problem Backdoor poisoning attacks on deep neural networks.
method Incompatibility clustering of data subsets during training.
result Successfully reduces attack success rate to below 1%.
Data poisoning attacks compromise the integrity of machine-learning models by introducing malicious training samples to influence the results during test time. In this work, we investigate backdoor data poisoning attack on deep neural networks (DNNs) by inserting a backdoor pattern in the training images. The resulting…
Noisy labeled data is more a norm than a rarity for self-generated content that is continuously published on the web and social media. Due to privacy concerns and governmental regulations, such a data stream can only be stored and used for learning purposes in a limited duration. To overcome the noise in this on-line s…
CROP verifies clean prefixes in reasoning traces, improving downstream repair accuracy.
problem Uncertainty in reasoning traces prevents full certification of entire responses.
method CROP selects a calibrated threshold to certify the longest prefix with low risk proxies.
result CROP improves downstream repair accuracy by preserving valid reasoning and discarding misleading suffixes.
Neural networks learn clean data patterns first, then noisy data, leading to improved performance initially but deteriorating later.
problem Improvement in prediction error on clean data during early training of neural networks with noisy labels.
method Theoretical analysis and experiments to explore the dynamics of gradient descent and the impact of clean and noisy data.
result Neural networks prioritize learning clean data patterns first, leading to improved performance initially but deteriorating later due to diminishing gradient dominance of clean samples over noisy ones.
Data augmentation has been widely applied as an effective methodology to improve generalization in particular when training deep neural networks. Recently, researchers proposed a few intensive data augmentation techniques, which indeed improved accuracy, yet we notice that these methods augment data have also caused a …
BagCert efficiently certifies robustness against adversarial patches on image classifiers.
problem Adversarial patches pose a threat to autonomous systems' perception component.
method BagCert combines model architecture and certification procedure for efficient inference.
result BagCert certifies 10,000 examples in 43 seconds on a single GPU, achieving 86% clean and 60% certified accuracy against 5x5 patches.
PatchGuard defends against localized adversarial patches with provable robustness.
problem Localized adversarial patches induce misclassification in machine learning models.
method PatchGuard uses CNNs with small receptive fields and robust masking to detect and mask corrupted features.
result PatchGuard achieves state-of-the-art provable robust accuracy and clean accuracy.
A new model cleans vocal note event annotations in music.
problem Erroneous labels in music datasets.
method Contrastive learning to automatically create local deformations of likely correct labels.
result Transcription model accuracy improves with the proposed strategy.
DynaCor detects noisy labels by learning from corrupted training signals.
problem Label noise in real-world datasets hinders model generalization.
method DynaCor introduces label corruption to indirectly simulate noisy labels and learns to distinguish clean from noisy instances.
result DynaCor outperforms state-of-the-art competitors in noisy label detection.
The paper cleans label noise in supervised classification using Bernoulli sampling.
problem Label noise degrades supervised classifier performance.
method Proposes a label noise cleaning method based on Bernoulli random sampling.
result The method separates clean and noisy observations without prior label information.
Satellite-based positioning system such as GPS often suffers from large amount of noise that degrades the positioning accuracy dramatically especially in real-time applications. In this work, we consider a data-mining approach to enhance the GPS signal. We build a large-scale high precision GPS receiver grid system to …
Meta-learning enables a model to learn from very limited data to undertake a new task. In this paper, we study the general meta-learning with adversarial samples. We present a meta-learning algorithm, ADML (ADversarial Meta-Learner), which leverages clean and adversarial samples to optimize the initialization of a lear…
DIP-FAT improves adversarial training by diversifying perturbations.
problem Adversarial examples fool deep neural networks, leading to overfitting and poor performance.
method DIP-FAT uses random directions to diversify perturbations in adversarial training.
result DIP-FAT reduces overfitting and improves clean data accuracy.
Paper studies how incomplete data affects machine learning, proposing 'Certain Predictions' for NN classifiers.
problem Impact of incomplete and inconsistent data on machine learning applications.
method Extends Certain Answers concept to machine learning, introduces 'Certain Predictions' for NN classifiers.
result Developed efficient solutions for CP queries in NN classifiers, improving classification accuracy.
New method recovers clean data from corrupted samples.
problem Recovering clean data from corrupted samples with uncertainty.
method Probabilistic Tomographic Auto-Encoder method that derives reduced entropy condition approximate inference.
result Superior performance in imputation and de-noising compared to existing methods.
It is known that evaluating a certain approximation to the Jones polynomial for the plat closure of a braid is a BQP-complete problem. That is, this problem exactly captures the power of the quantum circuit model. The one clean qubit model is a model of quantum computation in which all but one qubit starts in the maxim…
Detects adversarial inputs in deep learning models without modifying the main network.
problem Vulnerability of deep learning models to adversarial inputs.
method Augment main network with observer networks that classify inputs as clean or adversarial.
result 99.5% detection accuracy on MNIST and 97.5% on CIFAR-10 datasets.
This paper presents a statistical method of single-channel speech enhancement that uses a variational autoencoder (VAE) as a prior distribution on clean speech. A standard approach to speech enhancement is to train a deep neural network (DNN) to take noisy speech as input and output clean speech. Although this supervis…
INN method refines clean labeled data from noisy labels.
problem Handling noisy labels in deep neural networks.
method INN method based on memorization effect at neighbor regions.
result INN method resolves memorization effect shortcomings.
Study improves resilience against adversarial clean-label attacks in real and noisy settings.
problem Ensuring accurate predictions in the presence of adversarial clean-label samples.
method Sequential learning from a stream of i.i.d. data, allowing abstention for uncertain predictions.
result Theoretical analysis and adaptations for the agnostic setting with a clean-label adversary and noise.
The graph-based semi-supervised label propagation algorithm has delivered impressive classification results. However, the estimated soft labels typically contain mixed signs and noise, which cause inaccurate predictions due to the lack of suitable constraints. Moreover, available methods typically calculate the weights…
Unify gradients to improve deep networks' robustness against black-box attacks.
problem Defending against score-based query attacks (SQAs) in deep neural networks.
method Unifying Gradients (UniG) to provide universal attack perturbations.
result Significantly improves real-world robustness of deep networks without sacrificing clean accuracy.
DVERGE diversifies adversarial vulnerabilities to enhance robust ensemble models.
problem Diverse adversarial vulnerabilities for robust ensemble models.
method Isolates and diversifies adversarial vulnerabilities through distillation and training.
result Achieves higher robustness against transfer attacks compared to previous methods.