Evaluating Robustness to Context-Sensitive Feature Perturbations of Different Granularities
This addresses robustness issues in image classification for deployment scenarios, but it is incremental as it builds on existing perturbation and adversarial training methods.
The paper tackled the problem of ensuring image classifiers are robust to context-sensitive feature perturbations of varying granularities, finding that state-of-the-art models are not robust to such changes and that adversarial training against pixel-space perturbations can be counterproductive for coarse-grained features.
We cannot guarantee that training datasets are representative of the distribution of inputs that will be encountered during deployment. So we must have confidence that our models do not over-rely on this assumption. To this end, we introduce a new method that identifies context-sensitive feature perturbations (e.g. shape, location, texture, colour) to the inputs of image classifiers. We produce these changes by performing small adjustments to the activation values of different layers of a trained generative neural network. Perturbing at layers earlier in the generator causes changes to coarser-grained features; perturbations further on cause finer-grained changes. Unsurprisingly, we find that state-of-the-art classifiers are not robust to any such changes. More surprisingly, when it comes to coarse-grained feature changes, we find that adversarial training against pixel-space perturbations is not just unhelpful: it is counterproductive.