To facilitate a wide-spread acceptance of AI systems guiding decision making in real-world applications, trustworthiness of deployed models is key. That is, it is crucial for predictive models to be uncertainty-aware and yield well-calibrated (and thus trustworthy) predictions for both in-domain samples as well as under domain shift. Recent efforts to account for predictive uncertainty include post-processing steps for trained neural networks, Bayesian neural networks as well as alternative non-Bayesian approaches such as ensemble approaches and evidential deep learning. Here, we propose an efficient yet general modelling approach for obtaining well-calibrated, trustworthy probabilities for samples obtained after a domain shift. We introduce a new training strategy combining an entropy-encouraging loss term with an adversarial calibration loss term and demonstrate that this results in well-calibrated and technically trustworthy predictions for a wide range of domain drifts. We comprehensively evaluate previously proposed approaches on different data modalities, a large range of data sets including sequence data, network architectures and perturbation strategies. We observe that our modelling approach substantially outperforms existing state-of-the-art approaches, yielding well-calibrated predictions under domain drift.
Beijing University of Posts and Telecommunications（北京邮电大学）
Despite Graph Neural Networks (GNNs) have achieved remarkable accuracy, whether the results are trustworthy is still unexplored. Previous studies suggest that many modern neural networks are over-confident on the predictions, however, surprisingly, we discover that GNNs are primarily in the opposite direction, i.e., GNNs are under-confident. Therefore, the confidence calibration for GNNs is highly desired. In this paper, we propose a novel trustworthy GNN model by designing a topology-aware post-hoc calibration function. Specifically, we first verify that the confidence distribution in a graph…
Neural networks lack adversarial robustness, i.e., they are vulnerable to adversarial examples that through small perturbations to inputs cause incorrect predictions. Further, trust is undermined when models give miscalibrated predictions, i.e., the predicted probability is not a good indicator of how much we should trust our model. In this paper, we study the connection between adversarial robustness and calibration and find that the inputs for which the model is sensitive to small perturbations (are easily attacked) are more likely to have poorly calibrated predictions. Based on this insight…
Toward Trustworthy AI: Multi-Target Adversarial Attacks and Robust Defenses for Continuous Data Summarization
Nankai University（南开大学）；James Cook University（詹姆斯库克大学）；Western Sydney University（西悉尼大学）；Beijing University of Technology（北京工业大学）；Fuzhou University（福州大学）；Nanjing University of Science and Technology（南京理工大学）；CSIRO's Data 61（澳大利亚联邦科学与工业研究组织Data61）；The University of Adelaide（阿德莱德大学）
Google Research（谷歌研究院）；Rutgers University（罗格斯大学）；Courant Institute of Mathematical Sciences（库朗数学科学研究所）
We present a more general analysis of $H$-calibration for adversarially robust classification. By adopting a finer definition of calibration, we can cover settings beyond the restricted hypothesis sets studied in previous work. In particular, our results hold for most common hypothesis sets used in machine learning. We both fix some previous calibration results (Bao et al., 2020) and generalize others (Awasthi et al., 2021). Moreover, our calibration results, combined with the previous study of consistency by Awasthi et al. (2021), also lead to more general $H$-consistency results covering com…
Google Research（谷歌研究院）；Rutgers University（罗格斯大学）；Courant Institute of Mathematical Sciences（库朗数学科学研究所）
Adversarial robustness is an increasingly critical property of classifiers in applications. The design of robust algorithms relies on surrogate losses since the optimization of the adversarial loss with most hypothesis sets is NP-hard. But which surrogate losses should be used and when do they benefit from theoretical guarantees? We present an extensive study of this question, including a detailed analysis of the H-calibration and H-consistency of adversarial surrogate losses. We show that, under some general assumptions, convex loss functions, or the supremum-based convex losses often used in…
Bosch Center for Artificial Intelligence（博世人工智能中心）；University of Stuttgart（斯图加特大学）
Uncertainty estimates help to identify ambiguous, novel, or anomalous inputs, but the reliable quantification of uncertainty has proven to be challenging for modern deep networks. In order to improve uncertainty estimation, we propose On-Manifold Adversarial Data Augmentation or OMADA, which specifically attempts to generate the most challenging examples by following an on-manifold adversarial attack path in the latent space of an autoencoder-based generative model that closely approximates decision boundaries between two or more classes. On a variety of datasets as well as on multiple diverse…
IIT Jodhpur（印度理工学院焦特布尔分校）；University of Buffalo（布法罗大学）
Modern AI systems are reaping the advantage of novel learning methods. With their increasing usage, we are realizing the limitations and shortfalls of these systems. Brittleness to minor adversarial changes in the input data, ability to explain the decisions, address the bias in their training data, high opacity in terms of revealing the lineage of the system, how they were trained and tested, and under which parameters and conditions they can reliably guarantee a certain level of performance, are some of the most prominent limitations. Ensuring the privacy and security of the data, assigning …
Trustworthy machine learning is driving a large number of ML community works in order to improve ML acceptance and adoption. The main aspect of trustworthy machine learning are the followings: fairness, uncertainty, robustness, explainability and formal guaranties. Each of these individual domains gains the ML community interest, visible by the number of related publications. However few works tackle the interconnection between these fields. In this paper we show a first link between uncertainty and explainability, by studying the relation between calibration and interpretation. As the calibra…
University of Oxford（牛津大学）；Amazon（亚马逊）；Kings College London（伦敦国王学院）
This paper presents a novel approach to automatic fetal brain biometry motivated by needs in low- and medium- income countries. Specifically, we leverage high-end (HE) ultrasound images to build a biometry solution for low-cost (LC) point-of-care ultrasound images. We propose a novel unsupervised domain adaptation approach to train deep models to be invariant to significant image distribution shift between the image types. Our proposed method, which employs a Dual Adversarial Calibration (DAC) framework, consists of adversarial pathways which enforce model invariance to; i) adversarial perturb…
Trustworthy Graph Neural Networks: Aspects, Methods and Trends
Monash University（莫纳什大学）；University of Melbourne（墨尔本大学）；Griffith University（格里菲斯大学）；University of Illinois at Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；Duke University（杜克大学）
Ensuring trustworthiness in machine learning (ML) models is a multi-dimensional task. In addition to the traditional notion of predictive performance, other notions such as privacy, fairness, robustness to distribution shift, adversarial robustness, interpretability, explainability, and uncertainty quantification are important considerations to evaluate and improve (if deficient). However, these sub-disciplines or 'pillars' of trustworthiness have largely developed independently, which has limited us from understanding their interactions in real-world ML pipelines. In this paper, focusing spec…
Slumbering to Precision: Enhancing Artificial Neural Network Calibration Through Sleep-like Processes
Department of Computer Science \& Engineering, University of California, San Diego, La Jolla, California, USA；ARTISAN, Georgia Institute of Technology, Atlanta, Georgia, USA；Department of Medicine, University of California, San Diego, La Jolla, California, USA
On the Robustness of Adversarial Training Against Uncertainty Attacks
Department of Electric and Electronic Engineering, University of Cagliari（卡利亚里大学电子与电气工程系）；Department of Informatics, Bioengineering, Robotics, and Systems Engineering, University of Genova（热那亚大学信息学、生物工程、机器人与系统工程系）
Trustworthy Sensor Fusion against Inaudible Command Attacks in Advanced Driver-Assistance System
Macquarie University（麦考瑞大学）；Data61, CSIRO（联邦科学与工业研究组织数据61研究所）；Deakin University（迪肯大学）；University of Technology Sydney（悉尼科技大学）；Shangdong Computer Science Center, Qilu University of Technology（齐鲁工业大学山东省计算中心）
University of Liverpool（利物浦大学）；University of Oxford（牛津大学）；Lancaster University（兰卡斯特大学）；Defence Science and Technology Laboratory (Dstl)（国防科学技术实验室）；Queen’s University Belfast（贝尔法斯特女王大学）
In the past few years, significant progress has been made on deep neural networks (DNNs) in achieving human-level performance on several long-standing tasks. With the broader deployment of DNNs on various applications, the concerns over their safety and trustworthiness have been raised in public, especially after the widely reported fatal incidents involving self-driving cars. Research to address these concerns is particularly active, with a significant number of papers released in the past few years. This survey paper conducts a review of the current research effort into making DNNs safe and …
Enhancing model robustness under new and even adversarial environments is a crucial milestone toward building trustworthy machine learning systems. Current robust training methods such as adversarial training explicitly uses an "attack" (e.g., $\ell_{\infty}$-norm bounded perturbation) to generate adversarial examples during model training for improving adversarial robustness. In this paper, we take a different perspective and propose a new framework called SPROUT, self-progressing robust training. During model training, SPROUT progressively adjusts training label distribution via our proposed…
Testable and Actionable Calibration for Full Swap Regret
Department of Computer Science, Aarhus University（阿arhus大学计算机科学系）；Khoury College of Computer Sciences, Northeastern University（东北大学计算机科学学院）；Northeastern University（东北大学）
Towards Trustworthy and Aligned Machine Learning: A Data-centric Survey with Causality Perspectives
Bundelkhand Institute of Engineering and Technology（本德尔坎德工程技术学院）；Nanyang Technological University（南洋理工大学）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）
SUPER-Net: Trustworthy Image Segmentation via Uncertainty Propagation in Encoder-Decoder Networks
Department of Electrical and Computer Engineering, Rowan University（电气与计算机工程系，罗文大学）；Chester F. Carlson Center for Imaging Science, Rochester Institute of Technology（成像科学中心，罗切斯特理工学院）；Department of Neurology, University of Alabama at Birmingham School of Medicine（神经病学系，阿拉巴马大学伯明翰医学学院）；Machine Learning Department, Moffit Cancer Center（机器学习系，莫菲特癌症中心）
The Confidence Trap: Calibration Attacks for Graph Neural Networks
Virginia Polytechnic Institute and State University（弗吉尼亚理工学院暨州立大学）；The Pennsylvania State University（宾夕法尼亚州立大学）；VinUniversity；University of Illinois at Chicago（伊利诺伊大学芝加哥分校）
IBM Research（IBM研究院）；Univ Lyon（里昂大学）；UJM-Saint-Etienne（圣艾蒂安让·莫内大学）；CNRS（法国国家科学研究中心）；Institut d Optique Graduate School（高等光学学校）
Adversarial Robustness Toolbox (ART) is a Python library supporting developers and researchers in defending Machine Learning models (Deep Neural Networks, Gradient Boosted Decision Trees, Support Vector Machines, Random Forests, Logistic Regression, Gaussian Processes, Decision Trees, Scikit-learn Pipelines, etc.) against adversarial threats and helps making AI systems more secure and trustworthy. Machine Learning models are vulnerable to adversarial examples, which are inputs (images, texts, tabular data, etc.) deliberately modified to produce a desired response by the Machine Learning model.…
Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development (GECAD), School of Engineering, Polytechnic of Porto (ISEP/IPP)（先进创新与发展智能工程与计算研究组（GECAD），波尔图理工学院工程学院（ISEP/IPP））
The Internet of Things (IoT) faces tremendous security challenges. Machine learning models can be used to tackle the growing number of cyber-attack variations targeting IoT systems, but the increasing threat posed by adversarial attacks restates the need for reliable defense strategies. This work describes the types of constraints required for a realistic adversarial cyber-attack example and proposes a methodology for a trustworthy adversarial robustness analysis with a realistic adversarial evasion attack vector. The proposed methodology was used to evaluate three supervised algorithms, Rando…
University of Georgia（佐治亚大学）；Tencent AI Seattle Lab（腾讯AI西雅图实验室）；Microsoft Research（微软研究院）；University of Waterloo（滑铁卢大学）；Hong Kong Polytechnic University（香港理工大学）
Little is known about the trustworthiness of predictions made by knowledge graph embedding (KGE) models. In this paper we take initial steps toward this direction by investigating the calibration of KGE models, or the extent to which they output confidence scores that reflect the expected correctness of predicted knowledge graph triples. We first conduct an evaluation under the standard closed-world assumption (CWA), in which predicted triples not already in the knowledge graph are considered false, and show that existing calibration techniques are effective for KGE under this common but narro…
