Although much progress has been made towards robust deep learning, a
significant gap in robustness remains between real-world perturbations and more
narrowly defined sets typically studied in adversarial defenses. In this paper,
we aim to bridge this gap by learning perturbation sets from data, in order to
characterize real-world effects for robust training and evaluation.
Specifically, we use a conditional generator that defines the perturbation set
over a constrained region of the latent space. We formulate desirable
properties that measure the quality of a learned perturbation set, and
theoretically prove that a conditional variational autoencoder naturally
satisfies these criteria. Using this framework, our approach can generate a
variety of perturbations at different complexities and scales, ranging from
baseline spatial transformations, through common image corruptions, to lighting
variations. We measure the quality of our learned perturbation sets both
quantitatively and qualitatively, finding that our models are capable of
producing a diverse set of meaningful perturbations beyond the limited data
seen during training. Finally, we leverage our learned perturbation sets to
train models which are empirically and certifiably robust to adversarial image
corruptions and adversarial lighting variations, while improving generalization
on non-adversarial data. All code and configuration files for reproducing the
experiments as well as pretrained model weights can be found at
this https URL

本研究旨在通过从数据中学习扰动集，以便对鲁棒性进行训练和评估，从而缩小实际世界中的扰动和通常研究的更窄定义的集合之间的差距。使用条件生成器定义扰动集，并使用理想特性来衡量学习的扰动集的质量，理论上证明了条件变分自动编码器自然满足这些标准。最后，使用学习的扰动集来训练模型，使其对敌对图像污染和敌对光线变化具有实证和可证明的鲁棒性，并提高非敌对数据的泛化。