arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2102.13170cs.LGcs.AI
收藏

师生情境下的鲁棒性理解:一个新视角

Understanding Robustness in Teacher-Student Setting: A New Perspective

Tsinghua University(清华大学);Columbia University(哥伦比亚大学);Facebook AI Research(Facebook人工智能研究)

Zhuolin Yang, Zhaoxi Chen, Tiffany Cai, Xinyun Chen, Bo Li, Yuandong Tian

摘要:

对抗性示例已经成为机器学习模型的一个普遍属性,其中有界对抗性扰动可能会误导模型做出任意错误的预测。这样的示例提供了一种评估机器学习模型的鲁棒性的方法,以及用于理解模型训练过程的代理。广泛的研究试图解释对抗性示例的存在,并提供提高模型鲁棒性的方法(例如对抗性训练)。虽然它们主要关注在具有预定义标签的数据集上训练的模型,但我们利用教师-学生框架并假设教师模型或Oracle为给定实例提供标签。我们在低秩输入数据的情况下扩展了Tian(2019),并表明学生专业化(训练的学生神经元与同一层的某些教师神经元高度相关)仍然发生在输入子空间内,但教师和学生节点可能在数据子空间外差异很大,我们推测这会导致对抗性示例。大量的实验表明,学生专业化与不同场景下的模型鲁棒性密切相关,包括通过标准训练,对抗训练,置信度校准对抗训练以及使用鲁棒特征数据集进行训练的学生。我们的研究可以为未来关于对抗性示例的探索以及通过有原则的数据增强来增强模型的鲁棒性提供启示。

英文摘要:

Adversarial examples have appeared as a ubiquitous property of machine learning models where bounded adversarial perturbation could mislead the models to make arbitrarily incorrect predictions. Such examples provide a way to assess the robustness of machine learning models as well as a proxy for understanding the model training process. Extensive studies try to explain the existence of adversarial examples and provide ways to improve model robustness (e.g. adversarial training). While they mostly focus on models trained on datasets with predefined labels, we leverage the teacher-student framework and assume a teacher model, or oracle, to provide the labels for given instances. We extend Tian (2019) in the case of low-rank input data and show that student specialization (trained student neuron is highly correlated with certain teacher neuron at the same layer) still happens within the input subspace, but the teacher and student nodes could differ wildly out of the data subspace, which we conjecture leads to adversarial examples. Extensive experiments show that student specialization correlates strongly with model robustness in different scenarios, including student trained via standard training, adversarial training, confidence-calibrated adversarial training, and training with robust feature dataset. Our studies could shed light on the future exploration about adversarial examples, and enhancing model robustness via principled data augmentation.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑