hello everyone my name is H I'm very
glad to have this opportunity to share
our work in a SNP conference the paper
title is lakas latent concept masking
for General robustness enhancement of
DNS the ERS are from
University from CS J from University of
New sou Wales
Benjamin from col University and mean
share from
CSL I would like start this presentation
by introducing the background of machine
learning in machine learning we have
training data and this data can be
images text audio and
video once we have collected this
training data we can put them into a
learning algorithm to train a machine
learning model and once the model is
trained it can be deployed in many
applications and this applications can
include like chatbot like image
generator and video generator but
although machine learning and especially
deep learning they have achieved so
Advanced
results one fundamental problem is the
robustness remains an open
question robustness is important to deep
neural networks Because deep NE because
in many practical applications we need
to ensure that the model is Lous to
different conditions and to different
adversary attacks however even in
traditional classification
tasks the Deep neural networks are
suspicious to different kind of
adversary
attacks and now I want to introduce
three typical scenarios that the model
will cause misclassification
the first one is adversary robus so
adversary robus means the model can make
correct predictions on the original
benign samples but if we add some pixel
level probations that is very difficult
to notice by human but the model will
make incorrect prediction results and
cause
misclassifications the second one is
sematic robustness the semantic
robustness means the model can make
correct predictions on be samples but if
we change the sematic condition for
example like we put the face under
different L conditions the model cannot
recognize these samples anymore and the
this CA
misclassification the third one is
distribution
robustness so some samples if they are
out of distribution then the model is
very difficult to recognizing and this
also cause
misclassifications and so how to enhance
the less of DNN so aular training is a
popular defense method to enhance the
less of G
networks so what is adversity training
so in traditional training we have
benign samples we just use the benign s
to train the model and once the model
train the lossess is not guaranteed
ination here is because the model has
never seen like examples so the bossness
of the model is very low and this is
traditional
training so adversarial training is when
we train the model we not only feed the
benign samples to the model we also feed
aoral samples to the model because
during training the model now has seen
the other vers
samples so the Lotus of the model is
enhanced and this is the process ofers
chain however there are several
limitations of existing adversor
chaining meod and we identify four
research
gaps the first research Gap is the
current adversary training the
effectiveness is attex basic so this
means if the adversary
example is generated by attack a then
the trend model can mitigate attack a
but for attack B the effectiveness is a
question the second research Gap is
valuation
specific for example if the adversar
example is generated by pixel probation
based attack then the model can mitigate
pixel based attack but for semantic
attacks the effectiveness is a
question the third Gap is robustness and
the utility sh
off because we have put aders examples
into the training of the model so the
result is the lostness of the model is
improved but it will affect the normal
utility of the
model the last Gap we identify is the
adversor example has low level
abstraction and the feasibility of the
adversary example can be a question so
the first lowlevel abstraction means is
very difficult to understand what the
noise
means and the visibility means in some
applications we only have limited access
to the training data so we can't have
plenty of adversary examples and this
makes the effectiveness of adversary
training based on large amount of
adversary examples a
question so we off all solution latent
concept masking for robustness
enhancement that is luckas to improve
the existing adversor
training so in lakas at the beginning we
have a sample x with its label y
z and we put the sample into the
encoder so function of the in holder is
to map High dimensional X into the low
dimensional
representation and here each V is a d
dimensional
Vector the cor idea of lmas is we have a
prain code book and in the code book
each C is a concept and each concept
captures the structure attribute of the
sample and each concept is a d
dimensional vector because the dimension
of the concept and the dimension of V is
the same so we can use Vector conation
methods to transfer the representation
by V to the representation by
concept so once we have the concept
magic then we can use concept masking
mechanism to mask one of the concept in
the magic for example we can mask the
concept of C9 and change the concept of
C9 to c0 and once we have finished this
step we can map this concept magic back
to the vector
magic and the vector magic is then put
into a decoder and the function of the
decoder is to reconstruct the sample X
Prime which has the same Dimension as
the sample X and we put the sample X
Prime to the model X
FX and we want ensure that the
reconstructed sample X Prime the label
predicted by the model is not equal to
the original label y
Zer if we can ensure that then together
the sample X Prime and the label y z we
construct a new type of AAL example
called conceptual
example now we have conceptual example
now we can combine the conceptual
adversary example with adversary
training to enhance the less of the
model and the high level intuition is we
want to force in the model to make
predictions based on essential
conceptual elements rather than
non-common conceptual
features for the technical details
please check our
paper now let me introduce the
experimental results of
lmas so in the experiment setting we
only utilize less than 1% of the
original training sample in both
adversarial training and evaluation
phase for all
scenarios so the first experiment
investigate the utility and the
robustness of the
model the research question we asked is
how the model Utility change when using
conceptual adversary example for
adversor training and the table one here
shows the performance of the model after
adversor training with conceptual
adversor example on clean test and
adversor test image M by
accuracy and as we can see from this
table the takeways here is LM maintains
or even includes a model's accuracy on
clean date and highly influence the
Lotus against the conceptual example
after ad
training the second experience we want
to show is how the model performance
against adversor and sematic
attacks and the question here is how the
model Lobos generalized to noers and
sematic
attacks and we provide table two the
accuracy of models after of the
adversarial training with conceptual
adversarial example against the values
of the veral and sematic attacks for
example aders attacks of fgsm pgd pixel
attack and the semantic attacks of spal
attack and spare attack and this table
only show the results of amist data set
and for the other data set we provide it
in paper and the takeways here is using
lakas alone enhances a model's
resilience against a broader spectum of
CA pixel other and semantic other typ
the third experiment investigate the
model performance against the data
distribution
DFT we asked the question how the model
lus to data distribution DFT after lmas
aders training
framework and we provide Table Three the
accuracy of the model after adversary
training with Concept adversity example
against data distribution
DFT and we test two distribution DFT one
is in distribution hard samples which
means the samples is in the data
distribution but they are very difficult
to
recognize the other is out of
distribution corrupted
samples and the takeways here is lakas
has a stronger ability in handling
harder and cored samples compared to
standard ofil
training now we come to the conclusions
and the future work of this
paper conclusions of the paper is lmas
offers an attack agnostic model agnostic
robustness enhancement solution with
limited number of training
samples the limitation of this paper is
more advanced concept replacing strategy
should be should be proposed in our
current concept replacing stage although
we have some statistical methods for how
to select a concept and which position
of the concept should be changed but an
automated and adaptive selection
mechanism can be proposed to better
improve the current lmas
framework and there are some future
directions of this paper the first paper
is in this paper we mainly evaluate
lakas framework on traditional
convolutional neural networks so what's
the performance of lmas to other
architectures like
Vision transform
models and what's the performance of the
lockas to other domains like ANP
domain we also want to emphasize that
lakas is in its early stage and in the
current lakas framework the auto the
encoder and the decoder framework we
used is
vqv but more advanced generative models
can also be be considered to be
integrated to improve the current lockas
framework thank you for your attention
of our paper for any questions you can
reach me through the
email thank you