Machine-learning models demand for periodic updates to improve their average
accuracy, exploiting novel architectures and additional data. However, a
newly-updated model may commit mistakes that the previous model did not make.
Such misclassifications are referred to as negative flips, and experienced by
users as a regression of performance. In this work, we show that this problem
also affects robustness to adversarial examples, thereby hindering the
development of secure model update practices. In particular, when updating a
model to improve its adversarial robustness, some previously-ineffective
adversarial examples may become misclassified, causing a regression in the
perceived security of the system. We propose a novel technique, named
robustness-congruent adversarial training, to address this issue. It amounts to
fine-tuning a model with adversarial training, while constraining it to retain
higher robustness on the adversarial examples that were correctly classified
before the update. We show that our algorithm and, more generally, learning
with non-regression constraints, provides a theoretically-grounded framework to
train consistent estimators. Our experiments on robust models for computer
vision confirm that (i) both accuracy and robustness, even if improved after
model update, can be affected by negative flips, and (ii) our
robustness-congruent adversarial training can mitigate the problem,
outperforming competing baseline methods.

我们展示了机器学习模型的周期性更新可能导致负面翻转，进而影响模型的安全性和性能，为此我们提出了 robustness-congruent adversarial training 方法用于解决这个问题。实验证明，我们的方法可以有效降低负面翻转问题，提高模型的准确性和鲁棒性。

鲁棒性一致的对抗训练用于安全机器学习模型更新

Robustness-Congruent Adversarial Training for Secure Machine Learning  Model Updates

With the shift towards on-device deep learning, ensuring a consistent
behavior of an AI service across diverse compute platforms becomes tremendously
important. Our work tackles the emergent problem of reducing predictive
inconsistencies arising as negative flips: test samples that are correctly
predicted by a less accurate model, but incorrectly by a more accurate one. We
introduce REGression constrained Neural Architecture Search (REG-NAS) to design
a family of highly accurate models that engender fewer negative flips. REG-NAS
consists of two components: (1) A novel architecture constraint that enables a
larger model to contain all the weights of the smaller one thus maximizing
weight sharing. This idea stems from our observation that larger weight sharing
among networks leads to similar sample-wise predictions and results in fewer
negative flips; (2) A novel search reward that incorporates both Top-1 accuracy
and negative flips in the architecture search metric. We demonstrate that
\regnas can successfully find desirable architectures with few negative flips
in three popular architecture search spaces. Compared to the existing
state-of-the-art approach, REG-NAS enables 33-48% relative reduction of
negative flips.

这篇研究论文介绍了 REG-NAS (基于回归约束的神经架构搜索)，通过增加网络中的权重共享，将 Neural Architecture Search 中出现的样本级预测不确定性偏差降至最低，通过 Top-1 准确性和负翻转这一构架搜索度量标准，我们证明了egnas 可以在三个流行的建筑搜索空间中成功地找到合适的架构。与现有的技术相比，REG-NAS 能够使负翻转相对减少 33-48％。