Adaptive robustness certification against adversarial examples
Adaptive verifiable training enables the creation of machine learning models robust with respect to multiple robustness criteria. In general, such training exploits inherent inter-class similarities within input data and enforces multiple robustness criteria based on this information. In particular, the approach exploits pairwise class similarity and improves the performance of a robust model by relaxing robustness constraints for similar classes and increasing robustness constraints for dissimilar classes. Between similar classes, looser robustness criteria (i.e., smaller ∈) are enforced so as to minimize possible overlap when estimating the robustness region during verification. Between dissimilar classes, stricter robustness regions (i.e., larger ∈) are enforced. If pairwise class relationships are not available initially, preferably they are generated by receiving a pre-trained classifier and then applying a clustering algorithm (e.g., agglomerative clustering) to generate them. Once pre-defined or computed pairwise relationships are available, several grouping methods are provided to create classifiers for multiple robustness criteria.
1. A method of training and using a machine learning model, comprising:
obtaining class similarity data for a data set;
receiving a set of robustness criteria for the data set, wherein the set of robustness criteria includes at least first and second robustness criterion that differ from one another, wherein the set of robustness criteria increases as the class similarity decreases;
applying a smart label grouping algorithm to define the set of robustness criteria, wherein the smart label grouping algorithm uses a single classifier trained with a customized loss using an Inter-Group Robustness Prioritization (IGRP) scheme, wherein the customized loss comprises at least two types of relationships: an outer group loss and an inner group loss;
clustering dissimilar class data into different class groups, wherein the outer group loss enforces a strict robustness criterion between the different class groups and clustering similar class data into a same class group, wherein the inner group loss enforces a loose robustness criterion between the same class group;
training the machine learning model against the data set based on the class similarity data and the set of robustness criteria, wherein the trained machine learning model enforces multiple robustness criteria, and wherein during training, the outer group loss enforces the strict robustness criterion between different class groups by maximizing a distance between dissimilar classes, while the inner group loss enforces the loose robustness criterion between classes in the same group by minimizing the distance between similar classes; and
using the trained machine learning model for a subsequent classification task.
2. The method as described in claim 1 wherein the first robustness criterion is less strict than the second robustness criterion.
3. The method as described in claim 2 wherein the first robustness criterion is applied between similar classes, and wherein the second robustness criterion is applied between dissimilar classes.
4. The method as described in claim 1 wherein the class similarity data is obtained by agglomerative clustering of last layer weights extracted from a base machine learning model trained with the data set.
5. The method as described in claim 2 wherein training the machine learning model includes dynamically applying the set of robustness criteria based on similarity of predicted classes.
6. The method as described in claim 5 further including applying a loss function that comprises an outer loss term, and an inner loss term, wherein the outer loss term enforces the second robustness criterion between dissimilar classes, and the inner loss term enforces the first robustness criterion between similar classes.
7. The method as described in claim 2 wherein training the machine learning model comprises building a hierarchical classifier with a tree structure having a plurality of nodes, wherein each node is a classifier over groups of classes.
8. The method as described in claim 7 further including training a classifier at one node with the first robustness criterion, and training a classifier at another node with the second robustness criterion.
9. The method as described in claim 7 wherein the tree structure is created from agglomerative clustering over a vector representation of classes.
10. An apparatus, comprising:
a processor;
computer memory holding computer program instructions executed by the processor to train and use a machine learning model, the computer program instructions configured to:
obtain class similarity data for a data set;
receive a set of robustness criteria for the data set, wherein the set of robustness criteria includes at least first and second robustness criterion that differ from one another, wherein the set of robustness criteria increases as the class similarity decreases;
apply a smart label grouping algorithm to define the set of robustness criteria, wherein the smart label grouping algorithm uses a single classifier trained with a customized loss using an Inter-Group Robustness Prioritization (IGRP) scheme, wherein the customized loss comprises at least two types of relationships: an outer group loss and an inner group loss;
cluster dissimilar class data into different class groups, wherein the outer group loss enforces a strict robustness criterion between the different class groups and cluster similar class data into a same class group, wherein the inner group loss enforces a loose robustness criterion between the same class group;
train the machine learning model against the data set based on the class similarity data and the set of robustness criteria, wherein the trained machine learning model enforces multiple robustness criteria, and wherein during training, the outer group loss enforces the strict robustness criterion between different class groups by maximizing a distance between dissimilar classes, while the inner group loss enforces the loose robustness criterion between classes in the same group by minimizing the distance between similar classes; and
use the trained machine learning model for a subsequent classification task.
11. The apparatus as described in claim 10 wherein the first robustness criterion is less strict than the second robustness criterion.
12. The apparatus as described in claim 11 wherein the first robustness criterion is applied between similar classes, and wherein the second robustness criterion is applied between dissimilar classes.
13. The apparatus as described in claim 10 wherein the computer program instructions configured to obtain the class similarity data includes computer program instructions configured to perform agglomerative clustering of last layer weights extracted from a base machine learning model trained with the data set.
14. The apparatus as described in claim 11 wherein the computer program instructions configured to train the machine learning model include computer program instructions further configured to dynamically apply the set of robustness criteria based on similarity of predicted classes.
15. The apparatus as described in claim 14 wherein the computer program instructions configured to dynamically apply the set of robustness criteria further include computer program instructions also configured to apply a loss function that comprises an outer loss term, and an inner loss term, wherein the outer loss term enforces the second robustness criterion between dissimilar classes, and the inner loss term enforces the first robustness criterion between similar classes.
16. The apparatus as described in claim 11 wherein the computer program instructions configured to train the machine learning model include computer program instructions further configured to build a hierarchical classifier with a tree structure having a plurality of nodes, wherein each node is a classifier over groups of classes.
17. The apparatus as described in claim 16 wherein the computer program instructions configured to build the hierarchical classifier further include computer program instructions also configured to train a classifier at one node with the first robustness criteria, and train a classifier at another node with the second robustness criterion.
18. The apparatus as described in claim 16 wherein the tree structure is created from agglomerative clustering over a vector representation of classes.
19. A computer program product in a non-transitory computer readable medium for use in a data processing system to train and use a machine learning model, the computer program product holding computer program instructions that, when executed by the data processing system, are configured to:
obtain class similarity data for a data set;
receive a set of robustness criteria for the data set, wherein the set of robustness criteria includes at least first and second robustness criterion that differ from one another, wherein the set of robustness criteria increases as the class similarity decreases;
apply a smart label grouping algorithm to define the set of robustness criteria, wherein the smart label grouping algorithm uses a single classifier trained with a customized loss using an Inter-Group Robustness Prioritization (IGRP) scheme, wherein the customized loss comprises at least two types of relationships: an outer group loss and an inner group loss;
cluster dissimilar class data into different class groups, wherein the outer group loss enforces a strict robustness criterion between the different class groups and cluster similar class data into a same class group, wherein the inner group loss enforces a loose robustness criterion between the same class group;
train the machine learning model against the data set based on the class similarity data and the set of robustness criteria, wherein the trained machine learning model enforces multiple robustness criteria, and wherein during training, the outer group loss enforces the strict robustness criterion between different class groups by maximizing a distance between dissimilar classes, while the inner group loss enforces the loose robustness criterion between classes in the same group by minimizing the distance between similar classes; and
use the trained machine learning model for a subsequent classification task.
20. The computer program product as described in claim 19 wherein the first robustness criterion is less strict than the second robustness criterion.
21. The computer program product as described in claim 20 wherein the first robustness criterion is applied between similar classes, and wherein the second robustness criterion is applied between dissimilar classes.
22. The computer program product as described in claim 19 wherein the computer program instructions configured to obtain the class similarity data includes computer program instructions configured to perform agglomerative clustering of last layer weights extracted from a base machine learning model trained with the data set.
23. The computer program product as described in claim 20 wherein the computer program instructions configured to train the machine learning model include computer program instructions further configured to dynamically apply the set of robustness criteria based on similarity of predicted classes.
24. The computer program product as described in claim 23 wherein the computer program instructions configured to dynamically apply the set of robustness criteria further include computer program instructions also configured to apply a loss function that comprises an outer loss term, and an inner loss term, wherein the outer loss term enforces the second robustness criterion between dissimilar classes, and the inner loss term enforces the first robustness criterion between similar classes.
25. The computer program product as described in claim 20 wherein the computer program instructions configured to train the machine learning model include computer program instructions further configured to build a hierarchical classifier with a tree structure having a plurality of nodes, wherein each node is a classifier over groups of classes.
26. The computer program product as described in claim 25 wherein the computer program instructions configured to build the hierarchical classifier further include computer program instructions also configured to train a classifier at one node with the first robustness criterion, and train a classifier at another node with the second robustness criterion.
27. The computer program product as described in claim 25 wherein the tree structure is created from agglomerative clustering over a vector representation of classes.
28. A method for building a machine learning classifier that is adversarially robust, comprising:
identifying inter-class relationships among a data set;
applying a smart label grouping algorithm to define the set of robustness criteria, wherein the smart label grouping algorithm uses a single classifier trained with a customized loss using an Inter-Group Robustness Prioritization (IGRP) scheme, wherein the customized loss comprises at least two types of relationships: an outer group loss and an inner group loss;
clustering dissimilar class data into different class groups, wherein the outer group loss enforces a strict robustness criterion between the different class groups and clustering similar class data into a same class group, wherein the inner group loss enforces a loose robustness criterion between the same class group;
based on pairwise similarity data derived from the identified inter-class relationships, training the machine learning classifier such that robustness criterion for similar class pairs is less strict than the robustness criterion for dissimilar class pairs another, wherein the trained machine learning model enforces multiple robustness criteria, and wherein during training, the outer group loss enforces the strict robustness criterion between different class groups by maximizing a distance between dissimilar classes, while the inner group loss enforces the loose robustness criterion between classes in the same group by minimizing the distance between similar classes; and
using the trained machine learning classifier to classify an input.
29. The method as described in claim 28 wherein training the machine learning classifier applies a grouping algorithm that is one of: a classifier trained with a custom loss function, and a neural decision tree with a set of mixed robustness classifiers.