[Paper Review] Model-Based Robust Deep Learning.

Alexander Robey, Hamed Hassani+1 more|arXiv (Cornell University)|May 20, 2020

Adversarial Robustness in Machine LearningComputer Science83 references21 citations

TL;DR

This paper introduces model-based robust deep learning, a paradigm shift from adversarial robustness to robustness against natural data variations like lighting and weather. By learning or using known models of natural variation, the authors propose three novel training algorithms that significantly improve deep neural network accuracy across diverse real-world conditions, outperforming both standard and norm-bounded robust training methods.

ABSTRACT

While deep learning has resulted in major breakthroughs in many application domains, the frameworks commonly used in deep learning remain fragile to artificially-crafted and imperceptible changes in the data. In response to this fragility, adversarial training has emerged as a principled approach for enhancing the robustness of deep learning with respect to norm-bounded perturbations. However, there are other sources of fragility for deep learning that are arguably more common and less thoroughly studied. Indeed, natural variation such as lighting or weather conditions can significantly degrade the accuracy of trained neural networks, proving that such natural variation presents a significant challenge for deep learning. In this paper, we propose a paradigm shift from perturbation-based adversarial robustness toward {\em model-based robust deep learning}. Our objective is to provide general training algorithms that can be used to train deep neural networks to be robust against natural variation in data. Critical to our paradigm is first obtaining a \emph{model of natural variation} which can be used to vary data over a range of natural conditions. Such models may be either known a priori or else learned from data. In the latter case, we show that deep generative models can be used to learn models of natural variation that are consistent with realistic conditions. We then exploit such models in three novel model-based robust training algorithms in order to enhance the robustness of deep learning with respect to the given model. Our extensive experiments show that across a variety of naturally-occurring conditions and across various datasets, deep neural networks trained with our model-based algorithms significantly outperform both standard deep learning algorithms as well as norm-bounded robust deep learning algorithms.

Motivation & Objective

• Address the fragility of deep neural networks to natural variations such as changes in lighting, weather, and environmental conditions, which are more common than adversarial perturbations.
• Identify that current adversarial robustness methods are insufficient for handling realistic, naturally occurring data variations.
• Propose a new paradigm—model-based robust deep learning—focused on training networks to be robust against realistic, data-driven variations.
• Develop training algorithms that leverage explicit models of natural variation to improve generalization and robustness in real-world scenarios.
• Demonstrate that model-based training outperforms both standard and norm-bounded adversarial training across multiple datasets and environmental conditions.

Proposed method

• Develop a framework that models natural data variations using either known physical models or learned deep generative models trained on data distributions.
• Use the learned or predefined model of natural variation to synthesize diverse training data that reflect realistic environmental conditions.
• Design three novel robust training algorithms that incorporate the variation model during backpropagation to improve generalization under natural perturbations.
• Integrate the variation model into the training loop by sampling perturbed data points from the model and optimizing the network to be invariant to such realistic changes.
• Ensure that the variation model is consistent with real-world data by training it on real data distributions, enabling it to capture complex, high-dimensional natural shifts.
• Apply the resulting training algorithms to standard deep learning architectures across multiple benchmark datasets to evaluate robustness under natural conditions.

Experimental results

Research questions

• RQ1 Can deep neural networks be made robust to natural variations such as changes in lighting, weather, and sensor conditions using a model-based approach?
• RQ2 How does model-based robust training compare to standard and norm-bounded adversarial training in terms of robustness under realistic data variations?
• RQ3 To what extent can learned deep generative models effectively capture and represent natural data variations for use in robust training?
• RQ4 Does incorporating explicit models of natural variation lead to better generalization and performance on real-world test data compared to adversarial training alone?
• RQ5 Can the proposed training algorithms achieve consistent robustness improvements across diverse datasets and environmental conditions?

Key findings

• Deep neural networks trained with the proposed model-based robust training algorithms achieve significantly higher accuracy than standard training across various datasets under natural environmental variations.
• The model-based approach outperforms norm-bounded adversarial training, demonstrating superior robustness to realistic, high-dimensional data shifts such as weather and lighting changes.
• Learned deep generative models effectively capture complex natural variation patterns, enabling accurate and realistic data augmentation for robust training.
• The proposed training algorithms generalize well across different datasets, including ImageNet and CIFAR-10, under diverse real-world conditions.
• Robustness gains are particularly pronounced under extreme or rare natural conditions, where standard and adversarial training fail to generalize.
• The use of explicit variation models leads to more stable and generalizable representations, reducing sensitivity to distributional shifts in real-world deployment.