[Paper Review] Learning with Bad Training Data via Iterative Trimmed Loss Minimization

Yanyao Shen, Sujay Sanghavi|arXiv (Cornell University)|Oct 28, 2018

Adversarial Robustness in Machine Learning34 references62 citations

TL;DR

The paper proposes Iterative Trimmed Loss Minimization (ITLM), an approach that repeatedly selects low-loss training samples and retrains on them to learn despite tainted data, with theoretical guarantees for generalized linear models and strong empirical results across noisy labels, bad images, and backdoor attacks.

ABSTRACT

In this paper, we study a simple and generic framework to tackle the problem of learning model parameters when a fraction of the training samples are corrupted. We first make a simple observation: in a variety of such settings, the evolution of training accuracy (as a function of training epochs) is different for clean and bad samples. Based on this we propose to iteratively minimize the trimmed loss, by alternating between (a) selecting samples with lowest current loss, and (b) retraining a model on only these samples. We prove that this process recovers the ground truth (with linear convergence rate) in generalized linear models with standard statistical assumptions. Experimentally, we demonstrate its effectiveness in three settings: (a) deep image classifiers with errors only in labels, (b) generative adversarial networks with bad training images, and (c) deep image classifiers with adversarial (image, label) pairs (i.e., backdoor attacks). For the well-studied setting of random label noise, our algorithm achieves state-of-the-art performance without having access to any a-priori guaranteed clean samples.

Motivation & Objective

• Motivate a single, generic approach to learning from tainted data without prior knowledge of error type.
• Show that clean samples typically exhibit lower early training losses than corrupted ones.
• Develop and analyze an iterative algorithm that alternates between sample filtering and model fitting.
• Demonstrate the method's effectiveness on classification, GANs, and backdoor defense tasks.
• Establish theoretical convergence guarantees for generalized linear models under various corruptions.

Proposed method

• Define the trimmed loss objective and show it can be optimized iteratively by alternating between selecting a subset of size ⌊αn⌋ with smallest current losses and updating the model on this subset.
• Describe ITLM as an iterative procedure: at each round t, select S_t of the smallest-loss samples under θ_t, then update θ_{t+1} by a standard training step on S_t.
• Use BatchSGD as the model update routine with configurable steps M, batch size N, and learning rate η.
• Provide theoretical analysis showing per-round convergence bounds under generalized linear models with corrupted outputs.
• Extend the analysis to non-linear monotone link functions and to mixture data settings, showing conditions for linear or nearly linear convergence.

Experimental results

Research questions

• RQ1 Can a single generic iterative framework recover the ground-truth model when a fraction of training samples are corrupted?
• RQ2 What are the convergence guarantees of ITLM under arbitrary, random, or mixture corruptions for generalized linear and non-linear models?
• RQ3 How does ITLM perform empirically on deep networks with noisy labels, bad images, or backdoor attacks compared to state-of-the-art methods?
• RQ4 Does early stopping and mis-specification of the clean-sample fraction α affect ITLM’s effectiveness across tasks?
• RQ5 Can ITLM defend against backdoor attacks by filtering poisoned samples during training?

Key findings

• ITLM converges at least linearly to the ground truth in generalized linear models with various contamination types under standard assumptions.
• In deep learning settings, ITLM improves accuracy over naive training on CIFAR-10 and MNIST under random and systematic label noise, without needing prior clean samples.
• ITLM yields stronger GAN training performance when trained on mixed data, progressively focusing the generator on clean-like samples over iterations.
• Across backdoor attack scenarios, ITLM substantially reduces adversarially injected samples and can drive second-task accuracy toward zero on the poisoned test set while maintaining normal accuracy on clean data.
• Theoretical results show per-round error contracts under arbitrary or random corruption, and near-linear convergence in mixture-model scenarios, with consistency recovering in clean-data settings when α approaches 1.