text: 285,89,1285270207402061827,53464710,Eric Wong,"1/ New paper on learning perturbation sets for robust machine learning! We study how to characterize real world perturbations in a well-defined set.  Paper: <LINK> Blog post: <LINK> Code: <LINK> Joint work with @zicokolter <LINK> 2/ We define a learned perturbation set over an Lp ball in the latent space of a generator, which uses a latent vector to perturb an example, and is trained on pairs of perturbed examples. The generator captures complex perturbations, and is well-defined over the latent Lp ball. 3/ You may be (rightfully) suspicious of a perturbation set defined by a generative model learned from data.  We define concrete, measurable properties of a ""good"" perturbation set, in order to properly evaluate the quality of perturbation sets learned from data. 4/ To learn the generator, we use the conditional variational autoencoder framework.  We theoretically prove that training the CVAE objective results in a perturbation set that satisfies these good properties, resulting in a principled approach for learning perturbation sets. 5/ We can now easily leverage methods from Lp robustness to learn robustness to real-world effects captured by a learned perturbation set: simply run Lp approaches in the latent space of the generator!  This also gives another reason to care about methods for Lp robustness. 6/ We learn a perturbation set that captures common image corruptions, and another perturbation set that captures lighting changes for scenes in the wild.  Common corruptions: <LINK> Multi-Illumination dataset: <LINK> @DanHendrycks @murmurmann 7/ We can then train models which are adversarially robust to common corruptions and lighting changes, using PGD adversarial training and randomized smoothing.  This results in empirically and certifiably robust models to real-world perturbations. 8/ Finally, models trained with a meaningful learned perturbation set can have non-adversarial benefits as well.  For example, for CIFAR10 common corruptions, we can get improved average-case corrupted performance over directly training on the corrupted examples.",https://arxiv.org/abs/2007.08450,"Although much progress has been made towards robust deep learning, a significant gap in robustness remains between real-world perturbations and more narrowly defined sets typically studied in adversarial defenses. In this paper, we aim to bridge this gap by learning perturbation sets from data, in order to characterize real-world effects for robust training and evaluation. Specifically, we use a conditional generator that defines the perturbation set over a constrained region of the latent space. We formulate desirable properties that measure the quality of a learned perturbation set, and theoretically prove that a conditional variational autoencoder naturally satisfies these criteria. Using this framework, our approach can generate a variety of perturbations at different complexities and scales, ranging from baseline spatial transformations, through common image corruptions, to lighting variations. We measure the quality of our learned perturbation sets both quantitatively and qualitatively, finding that our models are capable of producing a diverse set of meaningful perturbations beyond the limited data seen during training. Finally, we leverage our learned perturbation sets to train models which are empirically and certifiably robust to adversarial image corruptions and adversarial lighting variations, while improving generalization on non-adversarial data. All code and configuration files for reproducing the experiments as well as pretrained model weights can be found at this https URL ",Learning perturbation sets for robust machine learning,8,"['1/ New paper on learning perturbation sets for robust machine learning! We study how to characterize real world perturbations in a well-defined set. \n\nPaper: <LINK>\nBlog post: <LINK>\nCode: <LINK>\n\nJoint work with @zicokolter <LINK>', '2/ We define a learned perturbation set over an Lp ball in the latent space of a generator, which uses a latent vector to perturb an example, and is trained on pairs of perturbed examples.\n\nThe generator captures complex perturbations, and is well-defined over the latent Lp ball.', '3/ You may be (rightfully) suspicious of a perturbation set defined by a generative model learned from data. \n\nWe define concrete, measurable properties of a ""good"" perturbation set, in order to properly evaluate the quality of perturbation sets learned from data.', '4/ To learn the generator, we use the conditional variational autoencoder framework. \n\nWe theoretically prove that training the CVAE objective results in a perturbation set that satisfies these good properties, resulting in a principled approach for learning perturbation sets.', '5/ We can now easily leverage methods from Lp robustness to learn robustness to real-world effects captured by a learned perturbation set: simply run Lp approaches in the latent space of the generator! \n\nThis also gives another reason to care about methods for Lp robustness.', '6/ We learn a perturbation set that captures common image corruptions, and another perturbation set that captures lighting changes for scenes in the wild. \n\nCommon corruptions: https://t.co/pbSFBbLYdB\nMulti-Illumination dataset: https://t.co/xbwcA8SFSP\n\n@DanHendrycks @murmurmann', '7/ We can then train models which are adversarially robust to common corruptions and lighting changes, using PGD adversarial training and randomized smoothing. \n\nThis results in empirically and certifiably robust models to real-world perturbations.', '8/ Finally, models trained with a meaningful learned perturbation set can have non-adversarial benefits as well. \n\nFor example, for CIFAR10 common corruptions, we can get improved average-case corrupted performance over directly training on the corrupted examples.']",20,07,2081