Learning Adversarially Robust Representations via Worst-Case Mutual Information Maximization
This addresses the challenge of adversarial robustness in machine learning for security-critical applications, but it appears incremental as it builds on existing representation learning and robustness concepts.
The paper tackles the problem of learning adversarially robust representations by developing a notion of representation vulnerability based on worst-case mutual information changes and proposing an unsupervised method to maximize this information. Experiments on classification tasks show that the method yields robust representations, though no concrete numbers are provided.
Training machine learning models that are robust against adversarial inputs poses seemingly insurmountable challenges. To better understand adversarial robustness, we consider the underlying problem of learning robust representations. We develop a notion of representation vulnerability that captures the maximum change of mutual information between the input and output distributions, under the worst-case input perturbation. Then, we prove a theorem that establishes a lower bound on the minimum adversarial risk that can be achieved for any downstream classifier based on its representation vulnerability. We propose an unsupervised learning method for obtaining intrinsically robust representations by maximizing the worst-case mutual information between the input and output distributions. Experiments on downstream classification tasks support the robustness of the representations found using unsupervised learning with our training principle.