Relaxing Local Robustness

• URL: http://arxiv.org/abs/2106.06624v1
• Date: Fri, 11 Jun 2021 22:02:03 GMT
• Title: Relaxing Local Robustness
• Abstract summary: Local robustness is not a natural objective, even in the presence of adversaries. We show how to construct models that can be efficiently certified against each relaxed robustness property. We demonstrate experimentally that these relaxed variants of robustness are well-suited to several significant classification problems.
• Score: 21.40979740283219
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Certifiable local robustness, which rigorously precludes small-norm adversarial examples, has received significant attention as a means of addressing security concerns in deep learning. However, for some classification problems, local robustness is not a natural objective, even in the presence of adversaries; for example, if an image contains two classes of subjects, the correct label for the image may be considered arbitrary between the two, and thus enforcing strict separation between them is unnecessary. In this work, we introduce two relaxed safety properties for classifiers that address this observation: (1) relaxed top-k robustness, which serves as the analogue of top-k accuracy; and (2) affinity robustness, which specifies which sets of labels must be separated by a robustness margin, and which can be $\epsilon$-close in $\ell_p$ space. We show how to construct models that can be efficiently certified against each relaxed robustness property, and trained with very little overhead relative to standard gradient descent. Finally, we demonstrate experimentally that these relaxed variants of robustness are well-suited to several significant classification problems, leading to lower rejection rates and higher certified accuracies than can be obtained when certifying "standard" local robustness.

Related papers

• Beyond Red-Teaming: Formal Guarantees of LLM Guardrail Classifiers [1.9839136494100942]
  Guardrails defend production language models against harmful behavior, but they provide no formal guarantees.<n>We propose two constructions of such regions: SVD-aligned hyper-rectangles and Gaussian Mixture Models.<n>Applying this framework to three author-trained Guardrails on the toxicity domain, every hyper-rectangle configuration returns SAT.<n>While GPT-2 and Llama-3.1-8B maintain robust coverage of 90% and 80% across varying boundaries, BERT's safety guarantees prove uniquely volatile.
  arXiv  Detail & Related papers  (2026-05-11T17:41:38Z)
• Learning from Similarity/Dissimilarity and Pairwise Comparison [0.07646713951724009]
  We propose a binary judgment based weakly supervised learning framework that relies on relative judgments, namely class agreement between two instances and pairwise preference toward the positive class.<n>We show that the proposed approach improves classification performance over methods using a single weak label, and is robust to label noise and uncertainty in class prior estimation.
  arXiv  Detail & Related papers  (2026-03-20T07:35:03Z)
• Learning from Similarity-Confidence and Confidence-Difference [0.24578723416255752]
  We propose a novel Weakly Supervised Learning (WSL) framework that leverages complementary weak supervision signals from multiple perspectives.<n>Specifically, we introduce SconfConfDiff Classification, a method that integrates two distinct forms of weaklabels.<n>We prove that both estimators achieve optimal convergence rates with respect to estimation error bounds.
  arXiv  Detail & Related papers  (2025-08-07T07:42:59Z)
• TrustLoRA: Low-Rank Adaptation for Failure Detection under Out-of-distribution Data [62.22804234013273]
  We propose a simple failure detection framework to unify and facilitate classification with rejection under both covariate and semantic shifts. Our key insight is that by separating and consolidating failure-specific reliability knowledge with low-rank adapters, we can enhance the failure detection ability effectively and flexibly.
  arXiv  Detail & Related papers  (2025-04-20T09:20:55Z)
• Certified Robustness against Sparse Adversarial Perturbations via Data Localization [39.883465335244594]
  We show that a simple classifier emerges from our theory, dubbed Box-NN, which naturally incorporates the geometry of the problem and improves upon the current state-of-the-art in certified robustness against sparse attacks for the MNIST and Fashion-MNIST datasets.
  arXiv  Detail & Related papers  (2024-05-23T05:02:00Z)
• Shrinking Class Space for Enhanced Certainty in Semi-Supervised Learning [59.44422468242455]
  We propose a novel method dubbed ShrinkMatch to learn uncertain samples. For each uncertain sample, it adaptively seeks a shrunk class space, which merely contains the original top-1 class. We then impose a consistency regularization between a pair of strongly and weakly augmented samples in the shrunk space to strive for discriminative representations.
  arXiv  Detail & Related papers  (2023-08-13T14:05:24Z)
• Ambiguity-Resistant Semi-Supervised Learning for Dense Object Detection [98.66771688028426]
  We propose a Ambiguity-Resistant Semi-supervised Learning (ARSL) for one-stage detectors. Joint-Confidence Estimation (JCE) is proposed to quantifies the classification and localization quality of pseudo labels. ARSL effectively mitigates the ambiguities and achieves state-of-the-art SSOD performance on MS COCO and PASCAL VOC.
  arXiv  Detail & Related papers  (2023-03-27T07:46:58Z)
• Confidence-aware Training of Smoothed Classifiers for Certified Robustness [75.95332266383417]
  We use "accuracy under Gaussian noise" as an easy-to-compute proxy of adversarial robustness for an input. Our experiments show that the proposed method consistently exhibits improved certified robustness upon state-of-the-art training methods.
  arXiv  Detail & Related papers  (2022-12-18T03:57:12Z)
• Robustness and Accuracy Could Be Reconcilable by (Proper) Definition [109.62614226793833]
  The trade-off between robustness and accuracy has been widely studied in the adversarial literature. We find that it may stem from the improperly defined robust error, which imposes an inductive bias of local invariance. By definition, SCORE facilitates the reconciliation between robustness and accuracy, while still handling the worst-case uncertainty.
  arXiv  Detail & Related papers  (2022-02-21T10:36:09Z)
• SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustness [61.212486108346695]
  We propose a training scheme, coined SmoothMix, to control the robustness of smoothed classifiers via self-mixup. The proposed procedure effectively identifies over-confident, near off-class samples as a cause of limited robustness. Our experimental results demonstrate that the proposed method can significantly improve the certified $ell$-robustness of smoothed classifiers.
  arXiv  Detail & Related papers  (2021-11-17T18:20:59Z)
• Taming Adversarial Robustness via Abstaining [7.1975923901054575]
  We consider a binary classification problem where the observations can be perturbed by an adversary. We include an abstaining option, where the classifier abstains from taking a decision when it has low confidence about the prediction. We show that there exist a tradeoff between the two metrics regardless of what method is used to choose the abstaining region.
  arXiv  Detail & Related papers  (2021-04-06T07:36:48Z)
• Consistent Non-Parametric Methods for Adaptive Robustness [26.016647703500887]
  A major drawback of the standard robust learning framework is the imposition of an artificial robustness radius $r$ that applies to all inputs. We propose a new framework for adaptive robustness, called neighborhood preserving robustness.
  arXiv  Detail & Related papers  (2021-02-18T00:44:07Z)
• Consistency Regularization for Certified Robustness of Smoothed Classifiers [89.72878906950208]
  A recent technique of randomized smoothing has shown that the worst-case $ell$-robustness can be transformed into the average-case robustness. We found that the trade-off between accuracy and certified robustness of smoothed classifiers can be greatly controlled by simply regularizing the prediction consistency over noise.
  arXiv  Detail & Related papers  (2020-06-07T06:57:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.