To address the shortcomings of real-world datasets, robust learning
algorithms have been designed to overcome arbitrary and indiscriminate data
corruption. However, practical processes of gathering data may lead to patterns
of data corruption that are localized to specific partitions of the training
dataset. Motivated by critical applications where the learned model is deployed
to make predictions about people from a rich collection of overlapping
subpopulations, we initiate the study of multigroup robust algorithms whose
robustness guarantees for each subpopulation only degrade with the amount of
data corruption inside that subpopulation. When the data corruption is not
distributed uniformly over subpopulations, our algorithms provide more
meaningful robustness guarantees than standard guarantees that are oblivious to
how the data corruption and the affected subpopulations are related. Our
techniques establish a new connection between multigroup fairness and
robustness.

通过设计健壮的学习算法以克服任意和无差别的数据损坏，我们提出了一种多群健壮算法，其对每个亚群体的健壮性仅随该亚群体内的数据损坏量而降低。当数据损坏在亚群体中分布不均匀时，我们的算法提供比标准保证更有意义的健壮性保证，这些标准保证对数据损坏和受影响亚群体的关系视而不见。我们的技术在多群公平性和健壮性之间建立了新的联系。

多组鲁棒性

Multigroup Robustness

Effective machine learning models learn both robust features that directly
determine the outcome of interest (e.g., an object with wheels is more likely
to be a car), and shortcut features (e.g., an object on a road is more likely
to be a car). The latter can be a source of error under distributional shift,
when the correlations change at test-time. The prevailing sentiment in the
robustness literature is to avoid such correlative shortcut features and learn
robust predictors. However, while robust predictors perform better on
worst-case distributional shifts, they often sacrifice accuracy on majority
subpopulations. In this paper, we argue that shortcut features should not be
entirely discarded. Instead, if we can identify the subpopulation to which an
input belongs, we can adaptively choose among models with different strengths
to achieve high performance on both majority and minority subpopulations. We
propose COnfidence-baSed MOdel Selection (CosMoS), where we observe that model
confidence can effectively guide model selection. Notably, CosMoS does not
require any target labels or group annotations, either of which may be
difficult to obtain or unavailable. We evaluate CosMoS on four datasets with
spurious correlations, each with multiple test sets with varying levels of data
distribution shift. We find that CosMoS achieves 2-5% lower average regret
across all subpopulations, compared to using only robust predictors or other
model aggregation methods.

本文提出 COnfidence-baSed MOdel Selection（CosMoS）方法，基于模型置信度动态选择不同强度的模型来在多数和少数子群体上实现高性能，并使用多个数据集验证其性能。

基于置信度的模型选择：何时为子集群转移采取捷径

Confidence-Based Model Selection: When to Take Shortcuts for  Subpopulation Shifts

Membership inference attacks allow a malicious entity to predict whether a
sample is used during training of a victim model or not. State-of-the-art
membership inference attacks have shown to achieve good accuracy which poses a
great privacy threat. However, majority of SOTA attacks require training dozens
to hundreds of shadow models to accurately infer membership. This huge
computation cost raises questions about practicality of these attacks on deep
models. In this paper, we introduce a fundamentally different MI attack
approach which obviates the need to train hundreds of shadow models. Simply
put, we compare the victim model output on the target sample versus the samples
from the same subpopulation (i.e., semantically similar samples), instead of
comparing it with the output of hundreds of shadow models. The intuition is
that the model response should not be significantly different between the
target sample and its subpopulation if it was not a training sample. In cases
where subpopulation samples are not available to the attacker, we show that
training only a single generative model can fulfill the requirement. Hence, we
achieve the state-of-the-art membership inference accuracy while significantly
reducing the training computation cost.

通过引入基于同质子集方法的会员推断攻击方案，本文成功提高了会员推断的准确性，同时极大地降低了对深度模型的计算成本。