International Business Machines Corporation

Rensselaer Polytechnic Institute

Massachusetts Institute of Technology

Tsinghua University

Sijia Liu

Chuang Gan

Dakuo Wang

Pin-Yu Chen

Quanfu Fan

Gaoyuan Zhang

Chia-Yu Chen

Yang Zhang

Qi Cheng Li

Lingfei Wu

Richard Chen

Abel Nicolas Valente

Akhilan Boopathy

Lirong Xia

Ao Liu

Nitin Gaur

Jinjun Xiong

Bei Chen

Yada Zhu

Louis M Weitzman

Lucian Popa

Kumar Bhaskaran

Horst Cornelius Samulowitz

Payel Das

Shiyu Chang

I-Hsin Chung

Bo Wu

Mo Yu

Gregory Bramble

Rameswar Panda

Deepak Vijaykeerthy

Vaibhav Saxena

Arunima Chaudhary

Parikshit Ram

Alexander Gray

Subhro Das

Daniel Karl I Weidele

Luca Daniel

Qian Pan

Abhishek Bhandwaldar

Koushik Kar

Yun-Yun Tsai

Minhao Cheng

Tsung-Yi Ho

Yi Sun

Dongyu Liu

Sai Radhakrishna Manikant Sarma Palepu

Aparna Gupta

Songtao Lu

Meng Wang

Ren Wang

Pin-yu Chen

Tsui-Wei Weng

Hildegard Kuehne

Scalable distributed adversarial training techniques for robust deep neural networks are provided. In one aspect, a method for adversarial training of a deep neural network-based model by distributed computing machines M includes, by distributed computing machines M: obtaining adversarial perturbation-modified training examples for samples in a local dataset D; computing gradients of a local cost function ƒwith respect to parameters θ of the deep neural network-based model using the adversarial perturbation-modified training examples; transmitting the gradients of the local cost function ƒto a server which aggregates the gradients of the local cost function ƒand transmits an aggregated gradient to the distributed computing machines M; and updating the parameters θ of the deep neural network-based model stored at each of the distributed computing machines M based on the aggregated gradient received from the server. A method for distributed adversarial training of a deep neural network-based model by the server is also provided.

Distributed adversarial training for robust deep neural networks

A graph neural network can be built and trained to predict a risk of an entity. A multi-relational graph network can include a first graph network and a second graph network. The first graph network can include a first set of nodes and a first set of edges connecting some of the nodes in the first set. The second graph network can include a second set of nodes and a second set of edges connecting some of the nodes in the second set. The first set of nodes and the second set of nodes can represent entities, the first set of edges can represent a first relationship between the entities and the second set of edges can represent a second relationship between the entities. A graph convolutional network (GCN) can be structured to incorporate the multi-relational graph network, and trained to predict a risk associated with a given entity.

Multi-relational graph convolutional network (GCN) in risk prediction

The exemplary embodiments disclose a method, a computer program product, and a computer system for determining that one or more model pipelines satisfy one or more constraints. The exemplary embodiments may include detecting a user uploading data, one or more constraints, and one or more model pipelines, collecting the data, the one or more constraints, and the one or more model pipelines, and determining that one or more of the model pipelines satisfies all of the one or more constraints based on applying one or more algorithms to the collected data, constraints, and model pipelines.

Machine learning with multiple constraints

Use a computerized trained graph neural network model to classify an input instance with a predicted label. With a computerized graph neural network interpretation module, compute a gradient-based saliency matrix based on the input instance and the predicted label, by taking a partial derivative of class prediction with respect to an adjacency matrix of the model. With a computerized user interface, obtain user input responsive to the gradient-based saliency matrix. Optionally, modify the trained graph neural network model based on the user input; and re-classify the input instance with a new predicted label based on the modified trained graph neural network model.

Interpretable visualization system for graph neural network

An adversarial robustness testing method, system, and computer program product include testing, via an accelerator, a robustness of a black-box system under different access settings, where the testing includes tearing down the robustness testing to a subtask of a predetermined size.

Testing adversarial robustness of systems with limited access

Transfer learning in machine learning can include receiving a machine learning model. Target domain training data for reprogramming the machine learning model using transfer learning can be received. The target domain training data can be transformed by performing a transformation function on the target domain training data. Output labels of the machine learning model can be mapped to target labels associated with the target domain training data. The transformation function can be trained by optimizing a parameter of the transformation function. The machine learning model can be reprogrammed based on input data transformed by the transformation function and a mapping of the output labels to target labels.

Transfer learning with machine learning systems

A hybrid-distance adversarial patch generator can be trained to generate a hybrid adversarial patch effective at multiple distances. The hybrid patch can be inserted into multiple sample images, each depicting an object, to simulate inclusion of the hybrid patch at multiple distances. The multiple sample images can then be used to train an object detection model to detect the objects.

Detecting hybdrid-distance adversarial patches

An adversarial robustness testing method, system, and computer program product include testing a robustness of a black-box system under different access settings via an accelerator.

A method comprises receiving a new data set; identifying at least one prior data set of a plurality of prior data sets that matches the new data set; generating a natural language data science problem statement for the new data set based on information associated with the at least prior one data set that matches the new data set; outputting the generated natural language data science problem statement for user verification; and in response to receiving user input verifying the natural language generated data science problem statement, generating one or more AutoAI configuration settings for the new data set based on one or more AutoAI configuration settings associated with the at least one prior data set that matches the new data set.

Automatic formulation of data science problem statements

Interpretation maps of convolutional neural networks having certifiable robustness using R&#xe9;nyi differential privacy are provided. In one aspect, a method for generating an interpretation map includes: adding generalized Gaussian noise to an image x to obtain T noisy images, wherein the generalized Gaussian noise constitutes perturbations to the image x; providing the T noisy images as input to a convolutional neural network; calculating T noisy interpretations of output from the convolutional neural network corresponding to the T noisy images; re-scaling the T noisy interpretations using a scoring vector &#x3c5; to obtain T re-scaled noisy interpretations; and generating the interpretation map using the T re-scaled noisy interpretations, wherein the interpretation map is robust against the perturbations.

Certifiably robust interpretation

A certification method, system, and computer program product include certifying an adversarial robustness of a convolutional neural network by deriving an analytic solution for a neural network output using an efficient upper bound and an efficient lower bound on an activation function and applying the analytic solution in computing a certified robustness.

Framework for certifying a lower bound on a robustness level of convolutional neural networks

Method and apparatus that includes receiving a query describing an aspect in a video, the video including a plurality of frames, identifying multiple proposals that potentially correspond to the query where each of the proposals includes a subset of the plurality of frames, ranking the proposals using a graph convolution network that identifies relationships between the proposals, and selecting, based on the ranking, one of the proposals as a video segment that correlates to the query.

Graph convolutional networks for video grounding

An illustrative embodiment includes a method for protecting a machine learning model. The method includes: determining concept-level interpretability of respective units within the model; determining sensitivity of the respective units within the model to an adversarial attack; identifying units within the model which are both interpretable and sensitive to the adversarial attack; and enhancing defense against the adversarial attack by masking at least a portion of the units identified as both interpretable and sensitive to the adversarial attack.

Root cause analysis of vulnerability of neural networks to adversarial examples

Techniques for training robust machine learning models for adversarial input data. Training data for a machine learning (ML) model is received. The training data includes a plurality of labels for data elements. First modified training data is generated by modifying one or more of the plurality of labels in the training data using parameterized label smoothing with a first optimization parameter. The ML model is trained using the first modified training data. The training includes updating a first one or more model weights in the ML model, and generating a second optimization parameter suitable for use in future parameterized label smoothing for future training of the ML model

Training robust machine learning models

Embodiments relate to a system, program product, and method to support a convolutional neural network (CNN). A class-specific discriminative image region is localized to interpret a prediction of a CNN and to apply a class activation map (CAM) function to received input data. First and second attacks are generated on the CNN with respect to the received input data. The first attack generates first perturbed data and a corresponding first CAM, and the second attack generates second perturbed data and a corresponding second CAM. An interpretability discrepancy is measured to quantify one or more differences between the first CAM and the second CAM. The measured interpretability discrepancy is applied to the CNN. The application is a response to an inconsistency between the first CAM and the second CAM and functions to strengthen the CNN against an adversarial attack.

Interpretability-aware adversarial attack and defense method for deep learnings

Growing community of inventors

Somerville, MA, United States of America

Sijia Liu