Adversarial Robustness Guarantees for Gaussian Processes
This work addresses the need for robust and interpretable machine learning models in safety-critical domains, though it is incremental as it extends existing GP methods with a new robustness analysis framework.
The paper tackles the problem of ensuring adversarial robustness for Gaussian processes (GPs) in safety-critical applications by developing a framework that provides provable guarantees through computed bounds on prediction ranges, with an algorithm that converges finitely and is evaluated on datasets like MNIST, showing robustness increases with accurate posterior estimation.
Gaussian processes (GPs) enable principled computation of model uncertainty, making them attractive for safety-critical applications. Such scenarios demand that GP decisions are not only accurate, but also robust to perturbations. In this paper we present a framework to analyse adversarial robustness of GPs, defined as invariance of the model's decision to bounded perturbations. Given a compact subset of the input space $T\subseteq \mathbb{R}^d$, a point $x^*$ and a GP, we provide provable guarantees of adversarial robustness of the GP by computing lower and upper bounds on its prediction range in $T$. We develop a branch-and-bound scheme to refine the bounds and show, for any $ε> 0$, that our algorithm is guaranteed to converge to values $ε$-close to the actual values in finitely many iterations. The algorithm is anytime and can handle both regression and classification tasks, with analytical formulation for most kernels used in practice. We evaluate our methods on a collection of synthetic and standard benchmark datasets, including SPAM, MNIST and FashionMNIST. We study the effect of approximate inference techniques on robustness and demonstrate how our method can be used for interpretability. Our empirical results suggest that the adversarial robustness of GPs increases with accurate posterior estimation.