arXiv subjects

Linyi Li

Publications and source records attributed to Linyi Li.

51 records · Page 3Linked to original sources

arXiv2022

On the Certified Robustness for Ensemble Models and Beyond

Recent studies show that deep neural networks (DNN) are vulnerable to adversarial examples, which aim to mislead DNNs by adding perturbations with small magnitude. To defend against such attacks, both empirical and theoretical defense approaches have been extensively studied for a single ML model. In this work, we aim to analyze and provide the certified robustness for ensemble ML models, together with the sufficient and necessary conditions of robustness for different ensemble protocols. Although ensemble models are shown more robust than a single model empirically; surprisingly, we find that in terms of the certified robustness the standard ensemble models only achieve marginal improvement compared to a single model. Thus, to explore the conditions that guarantee to provide certifiably robust ensemble ML models, we first prove that diversified gradient and large confidence margin are sufficient and necessary conditions for certifiably robust ensemble models under the model-smoothness assumption. We then provide the bounded model-smoothness analysis based on the proposed Ensemble-before-Smoothing strategy. We also prove that an ensemble model can always achieve higher certified robustness than a single base model under mild conditions. Inspired by the theoretical findings, we propose the lightweight Diversity Regularized Training (DRT) to train certifiably robust ensemble ML models. Extensive experiments show that our DRT enhanced ensembles can consistently achieve higher certified robustness than existing single and ensemble ML models, demonstrating the state-of-the-art certified L2-robustness on MNIST, CIFAR-10, and ImageNet datasets.

cs.LG↗

arXiv2022

SapientML: Synthesizing Machine Learning Pipelines by Learning from Human-Written Solutions

Automatic machine learning, or AutoML, holds the promise of truly democratizing the use of machine learning (ML), by substantially automating the work of data scientists. However, the huge combinatorial search space of candidate pipelines means that current AutoML techniques, generate sub-optimal pipelines, or none at all, especially on large, complex datasets. In this work we propose an AutoML technique SapientML, that can learn from a corpus of existing datasets and their human-written pipelines, and efficiently generate a high-quality pipeline for a predictive task on a new dataset. To combat the search space explosion of AutoML, SapientML employs a novel divide-and-conquer strategy realized as a three-stage program synthesis approach, that reasons on successively smaller search spaces. The first stage uses a machine-learned model to predict a set of plausible ML components to constitute a pipeline. In the second stage, this is then refined into a small pool of viable concrete pipelines using syntactic constraints derived from the corpus and the machine-learned model. Dynamically evaluating these few pipelines, in the third stage, provides the best solution. We instantiate SapientML as part of a fully automated tool-chain that creates a cleaned, labeled learning corpus by mining Kaggle, learns from it, and uses the learned models to then synthesize pipelines for new predictive tasks. We have created a training corpus of 1094 pipelines spanning 170 datasets, and evaluated SapientML on a set of 41 benchmark datasets, including 10 new, large, real-world datasets from Kaggle, and against 3 state-of-the-art AutoML tools and 2 baselines. Our evaluation shows that SapientML produces the best or comparable accuracy on 27 of the benchmarks while the second best tool fails to even produce a pipeline on 9 of the instances.

cs.LG↗

arXiv2022

CROP: Certifying Robust Policies for Reinforcement Learning through Functional Smoothing

As reinforcement learning (RL) has achieved great success and been even adopted in safety-critical domains such as autonomous vehicles, a range of empirical studies have been conducted to improve its robustness against adversarial attacks. However, how to certify its robustness with theoretical guarantees still remains challenging. In this paper, we present the first unified framework CROP (Certifying Robust Policies for RL) to provide robustness certification on both action and reward levels. In particular, we propose two robustness certification criteria: robustness of per-state actions and lower bound of cumulative rewards. We then develop a local smoothing algorithm for policies derived from Q-functions to guarantee the robustness of actions taken along the trajectory; we also develop a global smoothing algorithm for certifying the lower bound of a finite-horizon cumulative reward, as well as a novel local smoothing algorithm to perform adaptive search in order to obtain tighter reward certification. Empirically, we apply CROP to evaluate several existing empirically robust RL algorithms, including adversarial training and different robust regularization, in four environments (two representative Atari games, Highway, and CartPole). Furthermore, by evaluating these algorithms against adversarial attacks, we demonstrate that our certification are often tight. All experiment results are available at website https://crop-leaderboard.github.io.

cs.LG↗

arXiv2022

COPA: Certifying Robust Policies for Offline Reinforcement Learning against Poisoning Attacks

As reinforcement learning (RL) has achieved near human-level performance in a variety of tasks, its robustness has raised great attention. While a vast body of research has explored test-time (evasion) attacks in RL and corresponding defenses, its robustness against training-time (poisoning) attacks remains largely unanswered. In this work, we focus on certifying the robustness of offline RL in the presence of poisoning attacks, where a subset of training trajectories could be arbitrarily manipulated. We propose the first certification framework, COPA, to certify the number of poisoning trajectories that can be tolerated regarding different certification criteria. Given the complex structure of RL, we propose two certification criteria: per-state action stability and cumulative reward bound. To further improve the certification, we propose new partition and aggregation protocols to train robust policies. We further prove that some of the proposed certification methods are theoretically tight and some are NP-Complete problems. We leverage COPA to certify three RL environments trained with different algorithms and conclude: (1) The proposed robust aggregation protocols such as temporal aggregation can significantly improve the certifications; (2) Our certification for both per-state action stability and cumulative reward bound are efficient and tight; (3) The certification for different training algorithms and environments are different, implying their intrinsic robustness properties. All experimental results are available at https://copa-leaderboard.github.io.

cs.LG↗

arXiv2021

TSS: Transformation-Specific Smoothing for Robustness Certification

As machine learning (ML) systems become pervasive, safeguarding their security is critical. However, recently it has been demonstrated that motivated adversaries are able to mislead ML systems by perturbing test data using semantic transformations. While there exists a rich body of research providing provable robustness guarantees for ML models against $\ell_p$ norm bounded adversarial perturbations, guarantees against semantic perturbations remain largely underexplored. In this paper, we provide TSS -- a unified framework for certifying ML robustness against general adversarial semantic transformations. First, depending on the properties of each transformation, we divide common transformations into two categories, namely resolvable (e.g., Gaussian blur) and differentially resolvable (e.g., rotation) transformations. For the former, we propose transformation-specific randomized smoothing strategies and obtain strong robustness certification. The latter category covers transformations that involve interpolation errors, and we propose a novel approach based on stratified sampling to certify the robustness. Our framework TSS leverages these certification strategies and combines with consistency-enhanced training to provide rigorous certification of robustness. We conduct extensive experiments on over ten types of challenging semantic transformations and show that TSS significantly outperforms the state of the art. Moreover, to the best of our knowledge, TSS is the first approach that achieves nontrivial certified robustness on the large-scale ImageNet dataset. For instance, our framework achieves 30.4% certified robust accuracy against rotation attack (within $\pm 30^\circ$) on ImageNet. Moreover, to consider a broader range of transformations, we show TSS is also robust against adaptive attacks and unforeseen image corruptions such as CIFAR-10-C and ImageNet-C.

cs.LG↗

arXiv2021

TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothness

Adversarial Transferability is an intriguing property - adversarial perturbation crafted against one model is also effective against another model, while these models are from different model families or training processes. To better protect ML systems against adversarial attacks, several questions are raised: what are the sufficient conditions for adversarial transferability and how to bound it? Is there a way to reduce the adversarial transferability in order to improve the robustness of an ensemble ML model? To answer these questions, in this work we first theoretically analyze and outline sufficient conditions for adversarial transferability between models; then propose a practical algorithm to reduce the transferability between base models within an ensemble to improve its robustness. Our theoretical analysis shows that only promoting the orthogonality between gradients of base models is not enough to ensure low transferability; in the meantime, the model smoothness is an important factor to control the transferability. We also provide the lower and upper bounds of adversarial transferability under certain conditions. Inspired by our theoretical analysis, we propose an effective Transferability Reduced Smooth(TRS) ensemble training strategy to train a robust ensemble with low transferability by enforcing both gradient orthogonality and model smoothness between base models. We conduct extensive experiments on TRS and compare with 6 state-of-the-art ensemble baselines against 8 whitebox attacks on different datasets, demonstrating that the proposed TRS outperforms all baselines significantly.

cs.LG↗

arXiv2021

Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimation

Boundary based blackbox attack has been recognized as practical and effective, given that an attacker only needs to access the final model prediction. However, the query efficiency of it is in general high especially for high dimensional image data. In this paper, we show that such efficiency highly depends on the scale at which the attack is applied, and attacking at the optimal scale significantly improves the efficiency. In particular, we propose a theoretical framework to analyze and show three key characteristics to improve the query efficiency. We prove that there exists an optimal scale for projective gradient estimation. Our framework also explains the satisfactory performance achieved by existing boundary black-box attacks. Based on our theoretical framework, we propose Progressive-Scale enabled projective Boundary Attack (PSBA) to improve the query efficiency via progressive scaling techniques. In particular, we employ Progressive-GAN to optimize the scale of projections, which we call PSBA-PGAN. We evaluate our approach on both spatial and frequency scales. Extensive experiments on MNIST, CIFAR-10, CelebA, and ImageNet against different models including a real-world face recognition API show that PSBA-PGAN significantly outperforms existing baseline attacks in terms of query efficiency and attack success rate. We also observe relatively stable optimal scales for different models and datasets. The code is publicly available at https://github.com/AI-secure/PSBA.

cs.LG↗

arXiv2021

Nonlinear Projection Based Gradient Estimation for Query Efficient Blackbox Attacks

Gradient estimation and vector space projection have been studied as two distinct topics. We aim to bridge the gap between the two by investigating how to efficiently estimate gradient based on a projected low-dimensional space. We first provide lower and upper bounds for gradient estimation under both linear and nonlinear projections, and outline checkable sufficient conditions under which one is better than the other. Moreover, we analyze the query complexity for the projection-based gradient estimation and present a sufficient condition for query-efficient estimators. Built upon our theoretic analysis, we propose a novel query-efficient Nonlinear Gradient Projection-based Boundary Blackbox Attack (NonLinear-BA). We conduct extensive experiments on four image datasets: ImageNet, CelebA, CIFAR-10, and MNIST, and show the superiority of the proposed methods compared with the state-of-the-art baselines. In particular, we show that the projection-based boundary blackbox attacks are able to achieve much smaller magnitude of perturbations with 100% attack success rate based on efficient queries. Both linear and nonlinear projections demonstrate their advantages under different conditions. We also evaluate NonLinear-BA against the commercial online API MEGVII Face++, and demonstrate the high blackbox attack performance both quantitatively and qualitatively. The code is publicly available at https://github.com/AI-secure/NonLinear-BA.

cs.LG↗

arXiv2020

On the Limitations of Denoising Strategies as Adversarial Defenses

As adversarial attacks against machine learning models have raised increasing concerns, many denoising-based defense approaches have been proposed. In this paper, we summarize and analyze the defense strategies in the form of symmetric transformation via data denoising and reconstruction (denoted as $F+$ inverse $F$, $F-IF$ Framework). In particular, we categorize these denoising strategies from three aspects (i.e. denoising in the spatial domain, frequency domain, and latent space, respectively). Typically, defense is performed on the entire adversarial example, both image and perturbation are modified, making it difficult to tell how it defends against the perturbations. To evaluate the robustness of these denoising strategies intuitively, we directly apply them to defend against adversarial noise itself (assuming we have obtained all of it), which saving us from sacrificing benign accuracy. Surprisingly, our experimental results show that even if most of the perturbations in each dimension is eliminated, it is still difficult to obtain satisfactory robustness. Based on the above findings and analyses, we propose the adaptive compression strategy for different frequency bands in the feature domain to improve the robustness. Our experiment results show that the adaptive compression strategies enable the model to better suppress adversarial perturbations, and improve robustness compared with existing denoising strategies.

cs.LG↗

arXiv2018

Seeing Double: ASASSN-18bt Exhibits a Two-Component Rise in the Early-Time K2 Light Curve

On 2018 Feb. 4.41, the All-Sky Automated Survey for SuperNovae (ASAS-SN) discovered ASASSN-18bt in the K2 Campaign 16 field. With a redshift of z=0.01098 and a peak apparent magnitude of B_{max}=14.31, ASASSN-18bt is the nearest and brightest SNe Ia yet observed by the Kepler spacecraft. Here we present the discovery of ASASSN-18bt, the K2 light curve, and pre-discovery data from ASAS-SN and the Asteroid Terrestrial-impact Last Alert System (ATLAS). The K2 early-time light curve has an unprecedented 30-minute cadence and photometric precision for an SN~Ia light curve, and it unambiguously shows a ~4 day nearly linear phase followed by a steeper rise. Thus, ASASSN-18bt joins a growing list of SNe Ia whose early light curves are not well described by a single power law. We show that a double-power-law model fits the data reasonably well, hinting that two physical processes must be responsible for the observed rise. However, we find that current models of the interaction with a non-degenerate companion predict an abrupt rise and cannot adequately explain the initial, slower linear phase. Instead, we find that existing, published models with shallow 56Ni are able to span the observed behavior and, with tuning, may be able to reproduce the ASASSN-18bt light curve. Regardless, more theoretical work is needed to satisfactorily model this and other early-time SNe~Ia light curves. Finally, we use Swift X-ray non-detections to constrain the presence of circumstellar material (CSM) at much larger distances and lower densities than possible with the optical light curve. For a constant density CSM these non-detections constrain rho<4.5 * 10^5 cm^-3 at a radius of 4 *10^15 cm from the progenitor star. Assuming a wind-like environment, we place mass-loss limits of Mdot< 8 * 10^-6 M_sun yr^-1 for v_w=100 km s^-1, ruling out some symbiotic progenitor systems.

astro-ph.HE↗

arXiv2018

Influence-Directed Explanations for Deep Convolutional Networks

We study the problem of explaining a rich class of behavioral properties of deep neural networks. Distinctively, our influence-directed explanations approach this problem by peering inside the network to identify neurons with high influence on a quantity and distribution of interest, using an axiomatically-justified influence measure, and then providing an interpretation for the concepts these neurons represent. We evaluate our approach by demonstrating a number of its unique capabilities on convolutional neural networks trained on ImageNet. Our evaluation demonstrates that influence-directed explanations (1) identify influential concepts that generalize across instances, (2) can be used to extract the "essence" of what the network learned about a class, and (3) isolate individual features the network uses to make decisions and distinguish related classes.

cs.LG↗

arXiv2018

SN 2014J in M82: New Insights On the Spectral Diversity of Type Ia Supernovae

We present extensive spectroscopic observations for one of the closest type Ia supernovae (SNe Ia), SN 2014J discovered in M82, ranging from 10.4 days before to 473.2 days after B-band maximum light. The diffuse interstellar band (DIB) features detected in a high-resolution spectrum allow an estimate of line-of-sight extinction as Av=1.9+/-0.6 mag. Spectroscopically, SN 2014J can be put into the high-velocity (HV) subgroup in Wang's classification with a velocity of Si~II 6355 at maximum light as about 12200 km/s, but has a low velocity gradient (LVG, following Benetti's classification) as 41+/-2 km/s/day, which is inconsistent with the trend that HV SNe Ia generally have larger velocity gradients. We find that the HV SNe Ia with LVGs tend to have relatively stronger Si III (at ~4400 Angstrom) absorptions in early spectra, larger ratios of S II 5468 to S II 5640, and weaker Si II 5972 absorptions compared to their counterparts with similar velocities but high velocity gradients. This shows that the HV+LVG subgroup of SNe Ia may have intrinsically higher photospheric temperature, which indicates that their progenitors may experience more complete burning in the explosions relative to the typical HV SNe Ia.

astro-ph.SR↗

arXiv2018

Optical Observations of the 2002cx-like Supernova 2014ek, and Characterizations of SNe Iax

We present optical observations of supernova (SN) 2014ek discovered during the Tsinghua-NAOC Transient Survey (TNTS), which shows properties that are consistent with those of SN 2002cx-like events (dubbed as SNe Iax). The photometry indicates that it is underluminous compared to normal SNe Ia, with the absolute $V$-band peak magnitude being as $-17.66\pm0.20$ mag. The spectra are characterized by highly ionized Fe III and intermediate-mass elements (IMEs). The expansion velocity of the ejecta is found to be $\sim$5000 km s$^{-1}$ near the maximum light, only half of that measured for normal SNe Ia. The overall spectral evolution is quite similar to SN 2002cx and SN 2005hk, while the absorption features of the main IMEs seem to be relatively weaker. The ${}^{56}$Ni mass synthesized in the explosion is estimated to be about 0.08 M$_{\odot}$ from the pseudo bolometric light curve. Based on a large sample of SNe Iax, we examined the relations between peak luminosity, ejecta velocity, decline rate, and peak $V - R$ color but did not find noticeable correlations between these observables, in particular when a few extreme events like SN 2008ha are excluded in the analysis. For this sample, we also studied the birthplace environments and confirm that they still hold the trend of occurring preferentially in late-type spiral galaxies. Moreover, SNe Iax tend to occur in large star-forming regions of their host galaxies, more similar to SNe Ibc than SNe II, favoring that their progenitors should be associated with very young stellar populations.

astro-ph.HE↗

arXiv2017

Case Study: Explaining Diabetic Retinopathy Detection Deep CNNs via Integrated Gradients

In this report, we applied integrated gradients to explaining a neural network for diabetic retinopathy detection. The integrated gradient is an attribution method which measures the contributions of input to the quantity of interest. We explored some new ways for applying this method such as explaining intermediate layers, filtering out unimportant units by their attribution value and generating contrary samples. Moreover, the visualization results extend the use of diabetic retinopathy detection model from merely predicting to assisting finding potential lesions.

cs.AI↗

arXiv2016

Discovery and Follow-up Observations of the Young Type Ia Supernova 2016coj

The Type~Ia supernova (SN~Ia) 2016coj in NGC 4125 (redshift $z=0.004523$) was discovered by the Lick Observatory Supernova Search 4.9 days after the fitted first-light time (FFLT; 11.1 days before $B$-band maximum). Our first detection (pre-discovery) is merely $0.6\pm0.5$ day after the FFLT, making SN 2016coj one of the earliest known detections of a SN Ia. A spectrum was taken only 3.7 hr after discovery (5.0 days after the FFLT) and classified as a normal SN Ia. We performed high-quality photometry, low- and high-resolution spectroscopy, and spectropolarimetry, finding that SN 2016coj is a spectroscopically normal SN Ia, but with a high velocity of \ion{Si}{2} $λ$6355 ($\sim 12,600$\,\kms\ around peak brightness). The \ion{Si}{2} $λ$6355 velocity evolution can be well fit by a broken-power-law function for up to a month after the FFLT. SN 2016coj has a normal peak luminosity ($M_B \approx -18.9 \pm 0.2$ mag), and it reaches a $B$-band maximum \about16.0~d after the FFLT. We estimate there to be low host-galaxy extinction based on the absence of Na~I~D absorption lines in our low- and high-resolution spectra. The spectropolarimetric data exhibit weak polarization in the continuum, but the \ion{Si}{2} line polarization is quite strong ($\sim 0.9\% \pm 0.1\%$) at peak brightness.

astro-ph.SR↗