[DL輪読会]A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks

1 2018/4/27 DEEP LEARNING JP [DL Papers] A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks (NIPS’18) http://deeplearning.jp/

• http://deeplearning.jp/

Motivation • 分類タスクで予測した結果が，どれくらい正しいのか知りたい • • • 入力データが分類どれくらい難しいのか知りたい 訓練データと異なる分布のデータの入力を識別したい Adversarial sampleに強くしたい • Softmaxの予測値 (Confidence)と精度 (Accuracy)の関係は? • 例) • Softmaxで4クラス分類した結果が [0, 0.2, 0.7, 0.1] だった • 精度は0.7? 2

Confidence != Accuracy -  Confidence != Accuracy (Calibration 

) -  -   - weight decay - batch normalization  Overconfidence Chuan Guo et al., On Calibration of Modern Neural Networks, ICML’17. 3

Overconfidence
 1. 訓練時にSoftmax出力がCalibrationするようにする • • Confident classifier [Lee+, ICLR’18] Uncertainly-aware Attention [Heo+, NIPS’18] • Temperature Scaling [Guo+, ICLR’17] 2. 後からCalibrationする • softmax = e^(z/T) / sum_i e^(z_i/T), Tはvalidation setのNLLを最小化 3. Confidenceの値としてSoftmax以外を利用する • Confidence Scoreを陽に出力 [DeVries+, Arxiv’18] • • • • • p‘ = cp + (1-c)y, cがconfidence score Dirichlet Distribution [Gast+, CVPR’18] Mahalanobis distance-based score [K.Lee+, NIPS’18] (本日紹介) Multiple semantic label [Shalev+, NIPS’18] Softmax出力の密度比推定の結果を利用 [Subramanya+, Arxiv’17] 4


• • • A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks Jay Heo, Hae Beom Lee, Saehoon Kim, Juho Lee, Kwang Joon Kim, Eunho Yang, Sung Ju Hwang KAIST, UMich, Google Brain • • NIPS’18 (Splotlight) https://arxiv.org/abs/1807.03888 • Out-of-distribution / Adversarial sampleの双方の検知に有効な指標 の提案 • pre-trainedなclassifierに適用するもの 5

• https://arxiv.org/abs/1807.03888

Gaussian Discriminant Analysis (GDA) • class conditional distributionが多変量ガウス分布に従うと仮定して generative classifierを構成する • covariance matrixが全てのクラスで等しいと仮定 Softmax 6

Generative Classifier 7 • softmaxへの入力f(x)のclass-conditional分布が多変量ガウス分布に従うと仮定 • Rationale • softmax classifierのfeatureもclass-conditinal多変量ガウス分布に従う可能性がある • Mahalanobis distance-based confidence score

8  (uniform prior
)

Calibration technique • 前処理 • controlled-noiseをtest sampleに加える • Feature ensemble • 他の層のmahalanobis scoreも利用する • • 最終的な値は重み付き平均で得る 重みはvalidation setを使ってlogistic regression 9


(out-of-distribution) 10


(adversarial samples) 11


 • Mahalanobis距離によるシンプルなconfidence scoreの提案 • Out-of-distribution / Adversarial sample検知双方に有効 • 既存のclassifierの改善に使える 12

 • Chuan Guo, Geoff Pleiss, Yu Sun, Kilian Q. Weinberger, On Calibration of Modern Neural Networks, ICML’17. • Akshayvarun Subramanya, Suraj Srinivas, R.Venkatesh Babu, Confidence estimation in Deep Neural networks via density modelling, Arxiv’17. • Terrance DeVries, Graham W. Taylor, Learning Confidence Estimates for Neural Networks, Arxiv’18. • Jochen Gast, Stefan Roth, Lightweight Probabilistic Deep Networks, CVPR’18. • Kimin Lee, Honglak Lee, Kibok Lee, Jinwoo Shin, Training Confidence-calibrated classifiers for detecting out-of-distribution samples, ICLR’18. • Kimin Lee, Kibok Lee, Honglak Lee, Jinwoo Shin, A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks, NIPS’18. • Gabi Shalev, Yossi Adi, Joseph Keshet, Out-of-Distribution Detection using Multiple Semantic Label Representations, NIPS’18. • Jay Heo, Hae Beom Lee, Saehoon Kim, Juho Lee, Kwang Joon Kim, Eunho Yang, Sung Ju Hwang, Uncertainty-Aware Attention for Reliable Interpretation and Prediction, NIPS’18. 13