Papers
Topics
Authors
Recent
Search
2000 character limit reached

Effective and Robust Adversarial Training against Data and Label Corruptions

Published 7 May 2024 in cs.LG and cs.CV | (2405.04191v1)

Abstract: Corruptions due to data perturbations and label noise are prevalent in the datasets from unreliable sources, which poses significant threats to model training. Despite existing efforts in developing robust models, current learning methods commonly overlook the possible co-existence of both corruptions, limiting the effectiveness and practicability of the model. In this paper, we develop an Effective and Robust Adversarial Training (ERAT) framework to simultaneously handle two types of corruption (i.e., data and label) without prior knowledge of their specifics. We propose a hybrid adversarial training surrounding multiple potential adversarial perturbations, alongside a semi-supervised learning based on class-rebalancing sample selection to enhance the resilience of the model for dual corruption. On the one hand, in the proposed adversarial training, the perturbation generation module learns multiple surrogate malicious data perturbations by taking a DNN model as the victim, while the model is trained to maintain semantic consistency between the original data and the hybrid perturbed data. It is expected to enable the model to cope with unpredictable perturbations in real-world data corruption. On the other hand, a class-rebalancing data selection strategy is designed to fairly differentiate clean labels from noisy labels. Semi-supervised learning is performed accordingly by discarding noisy labels. Extensive experiments demonstrate the superiority of the proposed ERAT framework.

Definition Search Book Streamline Icon: https://streamlinehq.com
References (65)
  1. P.-F. Zhang, Y. Li, Z. Huang, and X.-S. Xu, “Aggregation-based graph convolutional hashing for unsupervised cross-modal retrieval,” IEEE Transactions on Multimedia, vol. 24, pp. 466–479, 2021.
  2. H. Tang, J. Zhu, M. Liu, Z. Gao, and Z. Cheng, “Frame-wise cross-modal matching for video moment retrieval,” IEEE Transactions on Multimedia, vol. 24, pp. 1338–1349, 2021.
  3. N. Ouyang, Q. Huang, P. Li, Y. Cai, B. Liu, H.-f. Leung, and Q. Li, “Suppressing biased samples for robust vqa,” IEEE Transactions on Multimedia, vol. 24, pp. 3405–3415, 2021.
  4. Z. Chen, Y. Luo, S. Wang, J. Li, and Z. Huang, “Gsmflow: generation shifts mitigating flow for generalized zero-shot learning,” IEEE Transactions on Multimedia, no. 99, pp. 1–12, 2022.
  5. H. Yuan, Q. Chu, F. Zhu, R. Zhao, B. Liu, and N.-H. Yu, “Automa: towards automatic model augmentation for transferable adversarial attacks,” IEEE Transactions on Multimedia, 2021.
  6. S. Li, T. Liu, J. Tan, D. Zeng, and S. Ge, “Trustable co-label learning from multiple noisy annotators,” IEEE Transactions on Multimedia, vol. 25, pp. 1045–1057, 2023.
  7. J. Zhuo, S. Wang, and Q. Huang, “Uncertainty modeling for robust domain adaptation under noisy environments,” IEEE Transactions on Multimedia, 2022.
  8. B. Biggio and F. Roli, “Wild patterns: ten years after the rise of adversarial machine learning,” Pattern Recognition, vol. 84, pp. 317–331, 2018.
  9. J. Feng, Q.-Z. Cai, and Z.-H. Zhou, “Learning to confuse: generating training time adversarial data with auto-encoder,” in Proceedings of the International Conference on Neural Information Processing Systems, 2019, pp. 11 994–12 004.
  10. H. Huang, X. Ma, S. M. Erfani, J. Bailey, and Y. Wang, “Unlearnable examples: making personal data unexploitable,” in Proceedings of the International Conference on Learning Representations, 2020.
  11. L. Fowl, M. Goldblum, P.-y. Chiang, J. Geiping, W. Czaja, and T. Goldstein, “Adversarial examples make strong poisons,” vol. 34, pp. 30 339–30 351, 2021.
  12. D. Yu, H. Zhang, W. Chen, J. Yin, and T.-Y. Liu, “Availability attacks create shortcuts,” in Proceedings of the ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2022, pp. 2367–2376.
  13. S. Sukhbaatar, J. Bruna, M. Paluri, L. Bourdev, and R. Fergus, “Training convolutional networks with noisy labels,” in Proceedings of the International Conference on Learning Representations, 2015.
  14. A. Ghosh, H. Kumar, and P. Sastry, “Robust loss functions under label noise for deep neural networks,” in Proceedings of the AAAI Conference on Artificial Intelligence, 2017, pp. 1919–1925.
  15. Y. Wang, X. Ma, Z. Chen, Y. Luo, J. Yi, and J. Bailey, “Symmetric cross entropy for robust learning with noisy labels,” in Proceedings of the IEEE International Conference on Computer Vision, 2019, pp. 322–330.
  16. C. Zhang, S. Bengio, M. Hardt, B. Recht, and O. Vinyals, “Understanding deep learning (still) requires rethinking generalization,” Communications of the ACM, vol. 64, no. 3, pp. 107–115, 2021.
  17. D. Tanaka, D. Ikami, T. Yamasaki, and K. Aizawa, “Joint optimization framework for learning with noisy labels,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018, pp. 5552–5560.
  18. D. Arpit, S. Jastrzebski, N. Ballas, D. Krueger, E. Bengio, M. S. Kanwal, T. Maharaj, A. Fischer, A. Courville, Y. Bengio et al., “A closer look at memorization in deep networks,” in Proceedings of the International Conference on Machine Learning, 2017, pp. 233–242.
  19. L. Tao, L. Feng, J. Yi, S.-J. Huang, and S. Chen, “Better safe than sorry: preventing delusive adversaries with adversarial training,” in Proceedings of the International Conference on Neural Information Processing Systems, vol. 34, 2021, pp. 16 209–16 225.
  20. Z. Liu, Z. Zhao, and M. Larson, “Image shortcut squeezing: countering perturbative availability poisons with compression,” in Proceedings of the International Conference on Machine Learning, 2023, pp. 22 473–22 487.
  21. T. Qin, X. Gao, J. Zhao, K. Ye, and C.-Z. Xu, “Learning the unlearnable: adversarial augmentations suppress unlearnable example attacks,” arXiv preprint arXiv:2303.15127, 2023.
  22. J. Goldberger and E. Ben-Reuven, “Training deep neural-networks using a noise adaptation layer,” in Proceedings of the International Conference on Learning Representations, 2017.
  23. G. Patrini, A. Rozza, A. Krishna Menon, R. Nock, and L. Qu, “Making deep neural networks robust to label noise: a loss correction approach,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017, pp. 1944–1952.
  24. X. Ma, Y. Wang, M. E. Houle, S. Zhou, S. Erfani, S. Xia, S. Wijewickrema, and J. Bailey, “Dimensionality-driven learning with noisy labels,” in Proceedings of the International Conference on Machine Learning, 2018, pp. 3355–3364.
  25. M. Ren, W. Zeng, B. Yang, and R. Urtasun, “Learning to reweight examples for robust deep learning,” in Proceedings of the International Conference on Machine Learning, 2018, pp. 4334–4343.
  26. L. Jiang, Z. Zhou, T. Leung, L.-J. Li, and L. Fei-Fei, “Mentornet: learning data-driven curriculum for very deep neural networks on corrupted labels,” in Proceedings of the International Conference on Machine Learning, 2018, pp. 2304–2313.
  27. J. Li, R. Socher, and S. C. Hoi, “Dividemix: learning with noisy labels as semi-supervised learning,” in Proceedings of the International Conference on Learning Representations, 2020.
  28. N. Karim, M. N. Rizve, N. Rahnavard, A. Mian, and M. Shah, “Unicon: combating label noise through uniform selection and contrastive learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 9676–9686.
  29. B. Han, Q. Yao, X. Yu, G. Niu, M. Xu, W. Hu, I. W. Tsang, and M. Sugiyama, “Co-teaching: robust training of deep neural networks with extremely noisy labels,” in Proceedings of the International Conference on Neural Information Processing Systems, 2018, pp. 8536–8546.
  30. D. T. Nguyen, C. K. Mummadi, T. P. N. Ngo, T. H. P. Nguyen, L. Beggel, and T. Brox, “Self: learning to filter noisy labels with self-ensembling,” in Proceedings of the International Conference on Learning Representations, 2019.
  31. Y. Shen and S. Sanghavi, “Learning with bad training data via iterative trimmed loss minimization,” in Proceedings of the International Conference on Machine Learning, 2019, pp. 5739–5748.
  32. X. Yu, B. Han, J. Yao, G. Niu, I. Tsang, and M. Sugiyama, “How does disagreement help generalization against label corruption?” in Proceedings of the International Conference on Machine Learning, 2019, pp. 7164–7173.
  33. H. Cheng, Z. Zhu, X. Li, Y. Gong, X. Sun, and Y. Liu, “Learning with instance-dependent label noise: a sample sieve approach,” in Proceedings of the International Conference on Learning Representations, 2020.
  34. P.-F. Zhang, Z. Huang, G. Bai, and X.-S. Xu, “Ideal: high-order-ensemble adaptation network for learning with noisy labels,” in Proceedings of the ACM International Conference on Multimedia, 2022, pp. 325–333.
  35. N. Srivastava, G. Hinton, A. Krizhevsky, I. Sutskever, and R. Salakhutdinov, “Dropout: a simple way to prevent neural networks from overfitting,” Journal of Machine Learning Research, vol. 15, no. 1, pp. 1929–1958, 2014.
  36. S. Laine and T. Aila, “Temporal ensembling for semi-supervised learning,” arXiv preprint arXiv:1610.02242, 2016.
  37. A. Tarvainen and H. Valpola, “Mean teachers are better role models: weight-averaged consistency targets improve semi-supervised deep learning results,” in Proceedings of the International Conference on Neural Information Processing Systems, 2017, pp. 1195–1204.
  38. H. Zhang, M. Cisse, Y. N. Dauphin, and D. Lopez-Paz, “Mixup: beyond empirical risk minimization,” arXiv preprint arXiv:1710.09412, 2017.
  39. P.-F. Zhang and Z. H. Huang, “Multi-head siamese prototype learning against both data and label corruption,” in Proceedings of the ACM International Conference on Multimedia in Asia, 2023, pp. 1–7.
  40. P. W. Koh and P. Liang, “Understanding black-box predictions via influence functions,” in Proceedings of the International Conference on Machine Learning, 2017, pp. 1885–1894.
  41. A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein, “Poison frogs! targeted clean-label poisoning attacks on neural networks,” in Proceedings of the International Conference on Neural Information Processing Systems, 2019, pp. 6106–6116.
  42. X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017.
  43. Y. Yao, H. Li, H. Zheng, and B. Y. Zhao, “Latent backdoor attacks on deep neural networks,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 2041–2055.
  44. I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572, 2014.
  45. Y. Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black-box attacks,” in Proceedings of the International Conference on Learning Representations, 2014.
  46. B. Han, J. Yao, G. Niu, M. Zhou, I. W. Tsang, Y. Zhang, and M. Sugiyama, “Masking: a new perspective of noisy supervision,” in Proceedings of the International Conference on Neural Information Processing Systems, 2018, pp. 5841–5851.
  47. I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, “Generative adversarial nets,” vol. 2672–2680, 2014.
  48. X. Xia, T. Liu, N. Wang, B. Han, C. Gong, G. Niu, and M. Sugiyama, “Are anchor points really indispensable in label-noise learning?” in Proceedings of the International Conference on Neural Information Processing Systems, 2019, pp. 6838–6849.
  49. Z. Zhang and M. R. Sabuncu, “Generalized cross entropy loss for training deep neural networks with noisy labels,” in Proceedings of the International Conference on Neural Information Processing Systems, 2018, pp. 8792–8802.
  50. Y. Liu and H. Guo, “Peer loss functions: learning from noisy labels without knowing noise rates,” in Proceedings of the International Conference on Machine Learning, 2020, pp. 6226–6236.
  51. H. Song, M. Kim, D. Park, Y. Shin, and J.-G. Lee, “Learning from noisy labels with deep neural networks: a survey,” IEEE Transactions on Neural Networks and Learning Systems, 2022.
  52. E. Arazo, D. Ortego, P. Albert, N. O’Connor, and K. McGuinness, “Unsupervised label noise modeling and loss correction,” in Proceedings of the International Conference on Machine Learning, 2019, pp. 312–321.
  53. A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” 2009.
  54. Y. Le and X. Yang, “Tiny imagenet visual recognition challenge,” CS 231N, vol. 7, no. 7, p. 3, 2015.
  55. F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in International conference on machine learning.   PMLR, 2020, pp. 2206–2216.
  56. A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in Proceedings of the International Conference on Learning Representations, 2018.
  57. X. Xia, T. Liu, B. Han, N. Wang, M. Gong, H. Liu, G. Niu, D. Tao, and M. Sugiyama, “Part-dependent label noise: towards instance-dependent label noise,” in Proceedings of the International Conference in Neural Information Processing Systems, 2020, pp. 7597–7610.
  58. K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2016, pp. 770–778.
  59. K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” Proceedings of the International Conference on Learning Representations, 2015.
  60. A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: transformers for image recognition at scale,” in International Conference on Learning Representations, 2020.
  61. E. D. Cubuk, B. Zoph, D. Mane, V. Vasudevan, and Q. V. Le, “Autoaugment: learning augmentation policies from data,” arXiv preprint arXiv:1805.09501, 2018.
  62. Y. Qu, S. Mo, and J. Niu, “Dat: training deep networks robust to label-noise by matching the feature distributions,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2021, pp. 6821–6829.
  63. D. Gragnaniello, F. Marra, L. Verdoliva, and G. Poggi, “Perceptual quality-preserving black-box attack against deep learning image classifiers,” Pattern Recognition Letters, vol. 147, pp. 142–149, 2021.
  64. R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018, pp. 586–595.
  65. K. Wu, A. Wang, and Y. Yu, “Stronger and faster wasserstein adversarial attacks,” in Proceedings of the International Conference on Machine Learning.   PMLR, 2020, pp. 10 377–10 387.
Citations (1)
View on Semantic Scholar

Summary

No one has generated a summary of this paper yet.

Sign Up to Summarize

Paper to Video (Beta)

No one has generated a video about this paper yet.

Sign Up to Generate All Videos Subscribe on YouTube

Whiteboard

No one has generated a whiteboard explanation for this paper yet.

Sign Up to Generate

Open Problems

We haven't generated a list of open problems mentioned in this paper yet.

Generate Now

Continue Learning

We haven't generated follow-up questions for this paper yet.

Generate Now

Collections

Sign up for free to add this paper to one or more collections.

Sign Up

Tweets

Sign up for free to view the 1 tweet with 0 likes about this paper.

Sign Up for Free