We identify a trade-off between robustness and accuracy that serves as a guiding principle in the design of defenses against adversarial examples. Although this problem has been widely studied empirically, much remains unknown concerning the theory underlying this trade-off. In this work, we decompose the prediction error for adversarial examples (robust error) as the sum of the natural (classification) error and boundary error, and provide a differentiable upper bound using the theory of classification-calibrated loss, which is shown to be the tightest possible upper bound uniform over all probability distributions and measurable predictors. Inspired by our theoretical analysis, we also design a new defense method, TRADES, to trade adversarial robustness off against accuracy. Our proposed algorithm performs well experimentally in real-world datasets. The methodology is the foundation of our entry to the NeurIPS 2018 Adversarial Vision Challenge in which we won the 1st place out of ~2,000 submissions, surpassing the runner-up approach by $11.41\%$ in terms of mean $\ell_2$ perturbation distance.
University of Southern California（南加州大学）；Microsoft Research（微软研究院）；Amazon Research Cambridge（亚马逊剑桥研究院）；University of Cambridge（剑桥大学）；DeepMind
Differential privacy is a mathematical framework for privacy-preserving data analysis. Changing the hyperparameters of a differentially private algorithm allows one to trade off privacy and utility in a principled way. Quantifying this trade-off in advance is essential to decision-makers tasked with deciding how much privacy can be provided in a particular application while maintaining acceptable utility. Analytical utility guarantees offer a rigorous tool to reason about this trade-off, but are generally only available for relatively simple problems. For more complex tasks, such as training n…
The popular Alternating Least Squares (ALS) algorithm for tensor decomposition is efficient and easy to implement, but often converges to poor local optima---particularly when the weights of the factors are non-uniform. We propose a modification of the ALS approach that is as efficient as standard ALS, but provably recovers the true factors with random initialization under standard incoherence assumptions on the factors of the tensor. We demonstrate the significant practical superiority of our approach over traditional ALS for a variety of tasks on synthetic data---including tensor factorizati…
Massachusetts Institute of Technology（麻省理工学院）；IBM Thomas J. Watson Research Center（IBM托马斯·J·沃森研究中心）
As a contribution to interpretable machine learning research, we develop a novel optimization framework for learning accurate and sparse two-level Boolean rules. We consider rules in both conjunctive normal form (AND-of-ORs) and disjunctive normal form (OR-of-ANDs). A principled objective function is proposed to trade classification accuracy and interpretability, where we use Hamming loss to characterize accuracy and sparsity to characterize interpretability. We propose efficient procedures to optimize these objectives based on linear programming (LP) relaxation, block coordinate descent, and …
ECUAS$_n$: A family of metrics for principled evaluation of uncertainty-augmented systems
School of Engineering, UBA, Argentina（阿根廷UBA工程学院）；ICC, CONICET-Universidad de Buenos Aires, Argentina（阿根廷CONICET-布宜诺斯艾利斯大学ICC）；LISN, CNRS, Université Paris-Saclay, France（法国CNRS巴黎萨克雷大学LISN）；International Laboratory on Learning Systems, Canada（加拿大学习系统国际实验室）；CSC, CONICET, Argentina（阿根廷CONICET CSC）；Mila - Quebec AI Institute, Canada（加拿大魁北克AI研究所Mila）；CNRS, Université Paris-Saclay, France（法国CNRS巴黎萨克雷大学）
EPFL（洛桑联邦理工学院）；UC San Diego（加州大学圣地亚哥分校）；UC Berkeley（加州大学伯克利分校）；Columbia University（哥伦比亚大学）
Having similar behavior at training time and test time $-$ what we call a "What You See Is What You Get" (WYSIWYG) property $-$ is desirable in machine learning. Models trained with standard stochastic gradient descent (SGD), however, do not necessarily have this property, as their complex behaviors such as robustness or subgroup performance can differ drastically between training and test time. In contrast, we show that Differentially-Private (DP) training provably ensures the high-level WYSIWYG property, which we quantify using a notion of distributional generalization. Applying this connect…
Recently, deep reinforcement learning (RL) has achieved remarkable empirical success by integrating deep neural networks into RL frameworks. However, these algorithms often require a large number of training samples and admit little theoretical understanding. To mitigate these issues, we propose a theoretically principled nearest neighbor (NN) function approximator that can improve the value networks in deep RL methods. Inspired by human similarity judgments, the NN approximator estimates the action values using rollouts on past observations and can provably obtain a small regret bound that de…
Center for Advanced Intelligence Project, RIKEN（理化学研究所先进智能项目中心）；Graduate School of Frontier Sciences, The University of Tokyo（东京大学前沿科学研究生院）；Department of Statistics, Seoul National University（首尔国立大学统计系）
We consider the problem of learning a binary classifier from only positive and unlabeled observations (called PU learning). Recent studies in PU learning have shown superior performance theoretically and empirically. However, most existing algorithms may not be suitable for large-scale datasets because they face repeated computations of a large Gram matrix or require massive hyperparameter optimization. In this paper, we propose a computationally efficient and theoretically grounded PU learning algorithm. The proposed PU learning algorithm produces a closed-form classifier when the hypothesis …
Recent works have theoretically and empirically shown that deep neural networks (DNNs) have an inherent vulnerability to small perturbations. Applying the Deep k-Nearest Neighbors (DkNN) classifier, we observe a dramatically increasing robustness-accuracy trade-off as the layer goes deeper. In this work, we propose a Deep Adversarially-Enhanced k-Nearest Neighbors (DAEkNN) method which achieves higher robustness than DkNN and mitigates the robustness-accuracy trade-off in deep layers through two key elements. First, DAEkNN is based on an adversarially trained model. Second, DAEkNN makes predic…
Courant Institute of Mathematical Sciences（库朗数学科学研究所）；Facebook AI Research（Facebook人工智能研究院）
The goal of this paper is not to introduce a single algorithm or method, but to make theoretical steps towards fully understanding the training dynamics of generative adversarial networks. In order to substantiate our theoretical analysis, we perform targeted experiments to verify our assumptions, illustrate our claims, and quantify the phenomena. This paper is divided into three sections. The first section introduces the problem at hand. The second section is dedicated to studying and proving rigorously the problems including instability and saturation that arize when training generative adve…
Theoretically Principled Federated Learning for Balancing Privacy and Utility
Huazhong University of Science and Technology（华中科技大学）；Tsinghua University（清华大学）；Peng Cheng Laboratory（鹏城实验室）；WeBank（微众银行）；The Hong Kong Polytechnic University（香港理工大学）
Studying the invertibility of deep neural networks (DNNs) provides a principled approach to better understand the behavior of these powerful models. Despite being a promising diagnostic tool, a consistent theory on their invertibility is still lacking. We derive a theoretically motivated approach to explore the preimages of ReLU-layers and mechanisms affecting the stability of the inverse. Using the developed theory, we numerically show how this approach uncovers characteristic properties of the network.
By searching for shared inductive biases across tasks, meta-learning promises to accelerate learning on novel tasks, but with the cost of solving a complex bilevel optimization problem. We introduce and rigorously define the trade-off between accurate modeling and optimization ease in meta-learning. At one end, classic meta-learning algorithms account for the structure of meta-learning but solve a complex optimization problem, while at the other end domain randomized search (otherwise known as joint training) ignores the structure of meta-learning and solves a single level optimization problem…
In many machine learning settings there is an inherent tension between fairness and accuracy desiderata. How should one proceed in light of such trade-offs? In this work we introduce and study $γ$-disqualification, a new framework for reasoning about fairness-accuracy tradeoffs w.r.t a benchmark class $H$ in the context of supervised learning. Our requirement stipulates that a classifier should be disqualified if it is possible to improve its fairness by switching to another classifier from $H$ without paying "too much" in accuracy. The notion of "too much" is quantified via a parameter $γ$ th…
We formulate the continual learning (CL) problem via dynamic programming and model the trade-off between catastrophic forgetting and generalization as a two-player sequential game. In this approach, player 1 maximizes the cost due to lack of generalization whereas player 2 minimizes the cost due to catastrophic forgetting. We show theoretically that a balance point between the two players exists for each task and that this point is stable (once the balance is achieved, the two players stay at the balance point). Next, we introduce balanced continual learning (BCL), which is designed to attain …
Department of Computer Science & Engineering University of Washington（华盛顿大学计算机科学与工程系）；Department of Computer Science University of Chicago（芝加哥大学计算机科学系）
Temporal horizons in forecasting: a performance-learnability trade-off
Institute of Neuroinformatics, ETH Zürich and University of Zürich（神经信息学研究所，苏黎世联邦理工学院和苏黎世大学）；School of Computing, National Australian University（计算学院，澳大利亚国立大学）；Unit of Land Change Science, Swiss Federal Research Institute for Forest, Snow and Landscape（土地变化科学单位，瑞士联邦森林、雪和景观研究 institute）
University of Wisconsin-Madison（威斯康星大学麦迪逊分校）；Mitsubishi Electric Research Laboratories（三菱电机研究实验室）；Boston University（波士顿大学）
We propose a data-driven framework for optimizing privacy-preserving data release mechanisms to attain the information-theoretically optimal tradeoff between minimizing distortion of useful data and concealing specific sensitive information. Our approach employs adversarially-trained neural networks to implement randomized mechanisms and to perform a variational approximation of mutual information privacy. We validate our Privacy-Preserving Adversarial Networks (PPAN) framework via proof-of-concept experiments on discrete and continuous synthetic data, as well as the MNIST handwritten digits d…
IBM Research（IBM研究院）；Carnegie Mellon University（卡内基梅隆大学）
A trade-off between accuracy and fairness is almost taken as a given in the existing literature on fairness in machine learning. Yet, it is not preordained that accuracy should decrease with increased fairness. Novel to this work, we examine fair classification through the lens of mismatched hypothesis testing: trying to find a classifier that distinguishes between two ideal distributions when given two mismatched distributions that are biased. Using Chernoff information, a tool in information theory, we theoretically demonstrate that, contrary to popular belief, there always exist ideal distr…
Capabilities and Fundamental Limits of Latent Chain-of-Thought
Department of Mathematics and Statistics, Xi'an Jiaotong University（西安交通大学数学与统计学系）；Department of Artificial Intelligence, Gaoling School of Artificial Intelligence, Renmin University of China（中国人民大学人工智能学院）
Trade-offs Between Individual and Group Fairness in Machine Learning: A Comprehensive Review
Departamento de Estadística, Universidad Carlos III de Madrid（统计系，卡洛斯三世大学）；uc3m-Santander Big Data Institute (IBiDat), Universidad Carlos III de Madrid（圣安德烈斯-卡洛斯三世大学大数据研究所）；Department of Statistics and O.R., Universidad Nacional de Educación a Distancia (UNED), Madrid, Spain（统计与运筹学系，国家远程教育大学）
