[Paper Review] VarMixup: Exploiting the Latent Space for Robust Training and Inference

Puneet Mangla, Vedant Singh+2 more|arXiv (Cornell University)|Mar 14, 2020

Adversarial Robustness in Machine Learning5 references4 citations

TL;DR

VarMixup proposes a novel data augmentation technique that leverages the latent space of deep neural networks to generate more robust training samples, significantly improving adversarial robustness without adversarial training. It outperforms state-of-the-art adversarial training methods on CIFAR-10, CIFAR-100, SVHN, and Tiny-ImageNet by actively sampling mixup images from the data manifold, achieving superior robustness, low calibration error, and transferability.

ABSTRACT

The vulnerability of Deep Neural Networks (DNNs) to adversarial attacks has led to the development of many defense approaches. Among them, Adversarial Training (AT) is a popular and widely used approach for training adversarially robust models. Mixup Training (MT), a recent popular training algorithm, improves the generalization performance of models by introducing globally linear behavior in between training examples. Although still in its early phase, we observe a shift in trend of exploiting Mixup from perspectives of generalisation to that of adversarial robustness. It has been shown that the Mixup trained models improves the robustness of models but only passively. A recent approach, Mixup Inference (MI), proposes an inference principle for Mixup trained models to counter adversarial examples at inference time by mixing the input with other random clean samples. In this work, we propose a new approach - extit{VarMixup (Variational Mixup)} - to better sample mixup images by using the latent manifold underlying the data. Our experiments on CIFAR-10, CIFAR-100, SVHN and Tiny-Imagenet demonstrate that extit{VarMixup} beats state-of-the-art AT techniques without training the model adversarially. Additionally, we also conduct ablations that show that models trained on extit{VarMixup} samples are also robust to various input corruptions/perturbations, have low calibration error and are transferable.

Motivation & Objective

• To address the vulnerability of deep neural networks to adversarial attacks by improving robustness through improved data augmentation.
• To overcome the limitations of passive robustness in standard Mixup training by actively leveraging the underlying data manifold during mixup sampling.
• To develop a training method that enhances robustness against adversarial examples, distribution shifts, and input corruptions without requiring adversarial training.
• To improve model calibration and transferability through a more structured sampling strategy in the latent space.
• To demonstrate that latent space-aware mixup sampling leads to models that generalize better and are more robust than those trained with standard or adversarial methods.

Proposed method

• VarMixup introduces a variational inference framework to sample mixup augmentations from the latent space of a pre-trained autoencoder or feature encoder.
• It models the latent representation of input images using a variational autoencoder (VAE), enabling the generation of diverse and semantically meaningful mixup samples.
• The method performs mixup not in pixel space but in the latent space, using interpolated latent codes to generate new training samples.
• The latent codes are sampled from a learned posterior distribution, ensuring that the interpolated samples lie on or near the data manifold.
• During training, the model is optimized on these latent-space mixup samples, which encourages global linear behavior and improved robustness.
• The approach is compatible with standard training pipelines and does not require adversarial data generation or adversarial loss terms.

Experimental results

Research questions

• RQ1 Can sampling mixup augmentations from the data's latent manifold improve adversarial robustness more effectively than standard Mixup or adversarial training?
• RQ2 Does VarMixup enhance robustness not only to adversarial examples but also to natural distribution shifts and input corruptions?
• RQ3 Can models trained with VarMixup achieve better calibration and transferability compared to standard and adversarial training baselines?
• RQ4 How does the performance of VarMixup compare to state-of-the-art adversarial training techniques across multiple benchmark datasets?
• RQ5 To what extent does the use of latent space interpolation improve generalization and robustness without explicit adversarial data augmentation?

Key findings

• VarMixup achieves state-of-the-art robust accuracy on CIFAR-10, CIFAR-100, SVHN, and Tiny-ImageNet without any adversarial training, outperforming existing AT methods.
• Models trained with VarMixup show strong robustness to various natural corruptions and perturbations, indicating generalization beyond adversarial examples.
• The models exhibit low calibration error, suggesting reliable confidence estimates even under distributional shift.
• VarMixup-trained models demonstrate high transferability, indicating that the learned representations are robust and generalizable.
• The ablation studies confirm that the latent space sampling strategy is key to the improved performance, as random or pixel-space mixup does not yield the same gains.
• The method achieves superior robustness while maintaining high natural accuracy, demonstrating a favorable trade-off between robustness and standard performance.