-
CancerLLM: A Large Language Model in Cancer Domain
Authors:
Mingchen Li,
Anne Blaes,
Steven Johnson,
Hongfang Liu,
Hua Xu,
Rui Zhang
Abstract:
Medical Large Language Models (LLMs) such as ClinicalCamel 70B, Llama3-OpenBioLLM 70B have demonstrated impressive performance on a wide variety of medical NLP task.However, there still lacks a large language model (LLM) specifically designed for cancer domain. Moreover, these LLMs typically have billions of parameters, making them computationally expensive for healthcare systems.Thus, in this stu…
▽ More
Medical Large Language Models (LLMs) such as ClinicalCamel 70B, Llama3-OpenBioLLM 70B have demonstrated impressive performance on a wide variety of medical NLP task.However, there still lacks a large language model (LLM) specifically designed for cancer domain. Moreover, these LLMs typically have billions of parameters, making them computationally expensive for healthcare systems.Thus, in this study, we propose CancerLLM, a model with 7 billion parameters and a Mistral-style architecture, pre-trained on 2,676,642 clinical notes and 515,524 pathology reports covering 17 cancer types, followed by fine-tuning on three cancer-relevant tasks, including cancer phenotypes extraction, cancer diagnosis generation, and cancer treatment plan generation. Our evaluation demonstrated that CancerLLM achieves state-of-the-art results compared to other existing LLMs, with an average F1 score improvement of 8.1\%. Additionally, CancerLLM outperforms other models on two proposed robustness testbeds. This illustrates that CancerLLM can be effectively applied to clinical AI systems, enhancing clinical research and healthcare delivery in the field of cancer.
△ Less
Submitted 14 June, 2024;
originally announced June 2024.
-
Ambient neutron dosimetry in high energy and pulsed neutron fields
Authors:
Ariel Tarifeno-Saldivia,
Francisco Calvino,
Alfredo De Blas,
Benedetta Brusasco,
Adria Casanovas-Hoste,
Ana M. Cives,
Guillem Cortes,
Roger Garcia,
Francisco Molina,
Nil Mont-Geli,
Max Pallas,
Cristian Pavez
Abstract:
The status of the LINrem project is presented, focusing on the development of innovative neutron dosimeters with enhanced energy sensitivity, time resolution, and portability. Designed to meet the technical demands of radiation protection in modern particle and nuclear facilities, these dosimeters are discussed in detail. Results from experimental campaigns showcasing their efficacy in pulsed fiel…
▽ More
The status of the LINrem project is presented, focusing on the development of innovative neutron dosimeters with enhanced energy sensitivity, time resolution, and portability. Designed to meet the technical demands of radiation protection in modern particle and nuclear facilities, these dosimeters are discussed in detail. Results from experimental campaigns showcasing their efficacy in pulsed fields generated by fusion plasmas and high-intensity pulsed lasers are presented. Additionally, prospects and future plans for the LINrem project are outlined.
△ Less
Submitted 27 March, 2024;
originally announced March 2024.
-
Robust multimodal models have outlier features and encode more concepts
Authors:
Jonathan Crabbé,
Pau Rodríguez,
Vaishaal Shankar,
Luca Zappella,
Arno Blaas
Abstract:
What distinguishes robust models from non-robust ones? This question has gained traction with the appearance of large-scale multimodal models, such as CLIP. These models have demonstrated unprecedented robustness with respect to natural distribution shifts. While it has been shown that such differences in robustness can be traced back to differences in training data, so far it is not known what th…
▽ More
What distinguishes robust models from non-robust ones? This question has gained traction with the appearance of large-scale multimodal models, such as CLIP. These models have demonstrated unprecedented robustness with respect to natural distribution shifts. While it has been shown that such differences in robustness can be traced back to differences in training data, so far it is not known what that translates to in terms of what the model has learned. In this work, we bridge this gap by probing the representation spaces of 12 robust multimodal models with various backbones (ResNets and ViTs) and pretraining sets (OpenAI, LAION-400M, LAION-2B, YFCC15M, CC12M and DataComp). We find two signatures of robustness in the representation spaces of these models: (1) Robust models exhibit outlier features characterized by their activations, with some being several orders of magnitude above average. These outlier features induce privileged directions in the model's representation space. We demonstrate that these privileged directions explain most of the predictive power of the model by pruning up to $80 \%$ of the least important representation space directions without negative impacts on model accuracy and robustness; (2) Robust models encode substantially more concepts in their representation space. While this superposition of concepts allows robust models to store much information, it also results in highly polysemantic features, which makes their interpretation challenging. We discuss how these insights pave the way for future research in various fields, such as model pruning and mechanistic interpretability.
△ Less
Submitted 19 October, 2023;
originally announced October 2023.
-
The Role of Entropy and Reconstruction in Multi-View Self-Supervised Learning
Authors:
Borja Rodríguez-Gálvez,
Arno Blaas,
Pau Rodríguez,
Adam Goliński,
Xavier Suau,
Jason Ramapuram,
Dan Busbridge,
Luca Zappella
Abstract:
The mechanisms behind the success of multi-view self-supervised learning (MVSSL) are not yet fully understood. Contrastive MVSSL methods have been studied through the lens of InfoNCE, a lower bound of the Mutual Information (MI). However, the relation between other MVSSL methods and MI remains unclear. We consider a different lower bound on the MI consisting of an entropy and a reconstruction term…
▽ More
The mechanisms behind the success of multi-view self-supervised learning (MVSSL) are not yet fully understood. Contrastive MVSSL methods have been studied through the lens of InfoNCE, a lower bound of the Mutual Information (MI). However, the relation between other MVSSL methods and MI remains unclear. We consider a different lower bound on the MI consisting of an entropy and a reconstruction term (ER), and analyze the main MVSSL families through its lens. Through this ER bound, we show that clustering-based methods such as DeepCluster and SwAV maximize the MI. We also re-interpret the mechanisms of distillation-based approaches such as BYOL and DINO, showing that they explicitly maximize the reconstruction term and implicitly encourage a stable entropy, and we confirm this empirically. We show that replacing the objectives of common MVSSL methods with this ER bound achieves competitive performance, while making them stable when training with smaller batch sizes or smaller exponential moving average (EMA) coefficients.
Github repo: https://github.com/apple/ml-entropy-reconstruction.
△ Less
Submitted 9 December, 2023; v1 submitted 20 July, 2023;
originally announced July 2023.
-
DUET: 2D Structured and Approximately Equivariant Representations
Authors:
Xavier Suau,
Federico Danieli,
T. Anderson Keller,
Arno Blaas,
Chen Huang,
Jason Ramapuram,
Dan Busbridge,
Luca Zappella
Abstract:
Multiview Self-Supervised Learning (MSSL) is based on learning invariances with respect to a set of input transformations. However, invariance partially or totally removes transformation-related information from the representations, which might harm performance for specific downstream tasks that require such information. We propose 2D strUctured and EquivarianT representations (coined DUET), which…
▽ More
Multiview Self-Supervised Learning (MSSL) is based on learning invariances with respect to a set of input transformations. However, invariance partially or totally removes transformation-related information from the representations, which might harm performance for specific downstream tasks that require such information. We propose 2D strUctured and EquivarianT representations (coined DUET), which are 2d representations organized in a matrix structure, and equivariant with respect to transformations acting on the input data. DUET representations maintain information about an input transformation, while remaining semantically expressive. Compared to SimCLR (Chen et al., 2020) (unstructured and invariant) and ESSL (Dangovski et al., 2022) (unstructured and equivariant), the structured and equivariant nature of DUET representations enables controlled generation with lower reconstruction error, while controllability is not possible with SimCLR or ESSL. DUET also achieves higher accuracy for several discriminative tasks, and improves transfer learning.
△ Less
Submitted 17 November, 2023; v1 submitted 28 June, 2023;
originally announced June 2023.
-
Commissioning of miniBELEN-10A, a moderated neutron counter with a flat efficiency for thick-target neutron yields measurements
Authors:
N Mont-Geli,
A Tarifeño-Saldivia,
L M Fraile,
S Viñals,
A Perea,
M Pallàs,
G Cortés,
G Garcia,
E Nácher,
J L Tain,
V Alcayne,
O Alonso-Sañudo,
A Algora,
J Balibrea-Correa,
J Benito,
M J G Borge,
J A Briz,
F Calviño,
D Cano-Ott,
A De Blas,
C Domingo-Pardo,
B Fernández,
R Garcia,
J Gómez-Camacho,
E M González-Romero
, et al. (18 additional authors not shown)
Abstract:
miniBELEN-10A is a modular and transportable moderated neutron counter with a nearly flat detection efficiency up to 8 MeV. The detector was designed to carry out measurements of (alpha, n) reactions in the context of the Measurement of Alpha Neutron Yields (MANY) project. In this work we present the results of the commissioning of miniBELEN-10A using the relatively well-known thick-target neutron…
▽ More
miniBELEN-10A is a modular and transportable moderated neutron counter with a nearly flat detection efficiency up to 8 MeV. The detector was designed to carry out measurements of (alpha, n) reactions in the context of the Measurement of Alpha Neutron Yields (MANY) project. In this work we present the results of the commissioning of miniBELEN-10A using the relatively well-known thick-target neutron yields from 27Al(alpha, n)30P.
△ Less
Submitted 14 April, 2023;
originally announced April 2023.
-
miniBELEN: a modular neutron counter for (alpha,n) reactions
Authors:
N Mont-Geli,
A Tarifeño-Saldivia,
L M Fraile,
S Viñals,
A Perea,
M Pallàs,
G Cortés,
E Nácher,
J L Tain,
V Alcayne,
A Algora,
J Balibrea-Correa,
J Benito,
M J G Borge,
J A Briz,
F Calviño,
D Cano-Ott,
A De Blas,
C Domingo-Pardo,
B Fernández,
R Garcia,
G García,
J Gómez-Camacho,
E M González-Romero,
C Guerrero
, et al. (16 additional authors not shown)
Abstract:
miniBELEN is a modular and transportable neutron moderated counter with a nearly flat neutron detection efficiency up to 10 MeV. Modularity implies that the moderator can be reassembled in different ways in order to obtain different types of response. The detector has been developed in the context of the Measurement of Alpha Neutron Yields (MANY) collaboration, which is a scientific effort aiming…
▽ More
miniBELEN is a modular and transportable neutron moderated counter with a nearly flat neutron detection efficiency up to 10 MeV. Modularity implies that the moderator can be reassembled in different ways in order to obtain different types of response. The detector has been developed in the context of the Measurement of Alpha Neutron Yields (MANY) collaboration, which is a scientific effort aiming to carry out measurements of (alpha,n) production yields, reaction cross-sections and neutron energy spectra. In this work we present and discuss several configurations of the miniBELEN detector. The experimental validation of the efficiency calculations using 252Cf sources and the measurement of the 27Al(alpha,n)30P reaction is also presented.
△ Less
Submitted 14 April, 2023;
originally announced April 2023.
-
A Cross-institutional Evaluation on Breast Cancer Phenoty** NLP Algorithms on Electronic Health Records
Authors:
Sicheng Zhou,
Nan Wang,
Liwei Wang,
Ju Sun,
Anne Blaes,
Hongfang Liu,
Rui Zhang
Abstract:
Objective: The generalizability of clinical large language models is usually ignored during the model development process. This study evaluated the generalizability of BERT-based clinical NLP models across different clinical settings through a breast cancer phenotype extraction task.
Materials and Methods: Two clinical corpora of breast cancer patients were collected from the electronic health r…
▽ More
Objective: The generalizability of clinical large language models is usually ignored during the model development process. This study evaluated the generalizability of BERT-based clinical NLP models across different clinical settings through a breast cancer phenotype extraction task.
Materials and Methods: Two clinical corpora of breast cancer patients were collected from the electronic health records from the University of Minnesota and the Mayo Clinic, and annotated following the same guideline. We developed three types of NLP models (i.e., conditional random field, bi-directional long short-term memory and CancerBERT) to extract cancer phenotypes from clinical texts. The models were evaluated for their generalizability on different test sets with different learning strategies (model transfer vs. locally trained). The entity coverage score was assessed with their association with the model performances.
Results: We manually annotated 200 and 161 clinical documents at UMN and MC, respectively. The corpora of the two institutes were found to have higher similarity between the target entities than the overall corpora. The CancerBERT models obtained the best performances among the independent test sets from two clinical institutes and the permutation test set. The CancerBERT model developed in one institute and further fine-tuned in another institute achieved reasonable performance compared to the model developed on local data (micro-F1: 0.925 vs 0.932).
Conclusions: The results indicate the CancerBERT model has the best learning ability and generalizability among the three types of clinical NLP models. The generalizability of the models was found to be correlated with the similarity of the target entities between the corpora.
△ Less
Submitted 15 March, 2023;
originally announced March 2023.
-
Long-term evolution of the neutron rate at the Canfranc Underground Laboratory
Authors:
S. E. A. Orrigo,
J. L. Tain,
N. Mont-Geli,
A. Tarifeño-Saldivia,
L. M. Fraile,
M. Grieger,
J. Agramunt,
A. Algora,
D. Bemmerer,
F. Calviño,
G. Cortés,
A. De Blas,
I. Dillmann,
A. Domínguez Bugarín,
R. García,
E. Nacher,
A. Tolosa-Delgado
Abstract:
We report results on the long-term variation of the neutron counting rate at the Canfranc Underground Laboratory, of importance for several low-background experiments installed there, including rare-event searches. The measurement campaign was performed employing the High Efficiency Neutron Spectrometry Array (HENSA) mounted in Hall A and lasted 412 live days. The present study is the first long-t…
▽ More
We report results on the long-term variation of the neutron counting rate at the Canfranc Underground Laboratory, of importance for several low-background experiments installed there, including rare-event searches. The measurement campaign was performed employing the High Efficiency Neutron Spectrometry Array (HENSA) mounted in Hall A and lasted 412 live days. The present study is the first long-term measurement of the neutron rate with sensitivity over a wide range of neutron energies (from thermal up to 0.1 GeV and beyond) performed in any underground laboratory so far. Data on the environmental variables inside the experimental hall (radon concentration, air temperature, air pressure and humidity) were also acquired during all the measurement campaign. We have investigated for the first time the evolution of the neutron rate for different energies of the neutrons and its correlation with the ambient variables.
△ Less
Submitted 29 August, 2022; v1 submitted 29 April, 2022;
originally announced April 2022.
-
Predicting Cancer Treatments Induced Cardiotoxicity of Breast Cancer Patients
Authors:
Sicheng Zhou,
Rui Zhang,
Anne Blaes,
Chetan Shenoy,
Gyorgy Simon
Abstract:
Cardiotoxicity induced by the breast cancer treatments (i.e., chemotherapy, targeted therapy and radiation therapy) is a significant problem for breast cancer patients. The cardiotoxicity risk for breast cancer patients receiving different treatments remains unclear. We developed and evaluated risk predictive models for cardiotoxicity in breast cancer patients using EHR data. The AUC scores to pre…
▽ More
Cardiotoxicity induced by the breast cancer treatments (i.e., chemotherapy, targeted therapy and radiation therapy) is a significant problem for breast cancer patients. The cardiotoxicity risk for breast cancer patients receiving different treatments remains unclear. We developed and evaluated risk predictive models for cardiotoxicity in breast cancer patients using EHR data. The AUC scores to predict the CHF, CAD, CM and MI are 0.846, 0.857, 0.858 and 0.804 respectively. After adjusting for baseline differences in cardiovascular health, patients who received chemotherapy or targeted therapy appeared to have higher risk of cardiotoxicity than patients who received radiation therapy. Due to differences in baseline cardiac health across the different breast cancer treatment groups, caution is recommended in interpreting the cardiotoxic effect of these treatments.
△ Less
Submitted 31 January, 2022;
originally announced January 2022.
-
First results from the HENSA/ANAIS collaboration at the Canfranc Underground Laboratory
Authors:
N Mont-Geli,
A Tarifeño-Saldivia,
S E A Orrigo,
J L Tain,
M Grieger,
J Agramunt,
A Algora,
J Amaré,
D Bemmerer,
F Calviño,
S Cebrián,
I Coarasa,
G Cortés,
A De Blas,
I Dillmann,
L M Fraile,
E García,
R García,
M Martínez,
E Nacher,
Y Ortigoza,
A Ortiz,
M Pallàs,
J Puimedón,
A Salinas
, et al. (2 additional authors not shown)
Abstract:
The HENSA/ANAIS collaboration aims for the precise determination of the neutron flux that could affect ANAIS-112, an experiment looking for the dark matter annual modulation using NaI(Tl) scintillators. In this work, the first measurements of the neutron flux and Monte Carlo simulations of the neutron spectrum are reported.
The HENSA/ANAIS collaboration aims for the precise determination of the neutron flux that could affect ANAIS-112, an experiment looking for the dark matter annual modulation using NaI(Tl) scintillators. In this work, the first measurements of the neutron flux and Monte Carlo simulations of the neutron spectrum are reported.
△ Less
Submitted 3 February, 2022; v1 submitted 24 November, 2021;
originally announced November 2021.
-
Challenges of Adversarial Image Augmentations
Authors:
Arno Blaas,
Xavier Suau,
Jason Ramapuram,
Nicholas Apostoloff,
Luca Zappella
Abstract:
Image augmentations applied during training are crucial for the generalization performance of image classifiers. Therefore, a large body of research has focused on finding the optimal augmentation policy for a given task. Yet, RandAugment [2], a simple random augmentation policy, has recently been shown to outperform existing sophisticated policies. Only Adversarial AutoAugment (AdvAA) [11], an ap…
▽ More
Image augmentations applied during training are crucial for the generalization performance of image classifiers. Therefore, a large body of research has focused on finding the optimal augmentation policy for a given task. Yet, RandAugment [2], a simple random augmentation policy, has recently been shown to outperform existing sophisticated policies. Only Adversarial AutoAugment (AdvAA) [11], an approach based on the idea of adversarial training, has shown to be better than RandAugment. In this paper, we show that random augmentations are still competitive compared to an optimal adversarial approach, as well as to simple curricula, and conjecture that the success of AdvAA is due to the stochasticity of the policy controller network, which introduces a mild form of curriculum.
△ Less
Submitted 3 December, 2021; v1 submitted 24 November, 2021;
originally announced November 2021.
-
Measurement of the neutron flux at the Canfranc Underground Laboratory with HENSA
Authors:
S. E. A. Orrigo,
J. L. Tain,
N. Mont-Geli,
A. Tarifeño-Saldivia,
L. M. Fraile,
M. Grieger,
J. Agramunt,
A. Algora,
D. Bemmerer,
F. Calviño,
G. Cortés,
A. De Blas,
I. Dillmann,
A. Domínguez Bugarín,
R. García,
E. Nacher,
A. Tolosa
Abstract:
We have performed a long-term measurement of the neutron flux with the High Efficiency Neutron Spectrometry Array HENSA in the Hall A of the Canfranc Underground Laboratory. The Hall A measurement campaign lasted from October 2019 to March 2021, demonstrating an excellent stability of the HENSA setup. Preliminary results on the neutron flux from this campaign are presented for the first time. In P…
▽ More
We have performed a long-term measurement of the neutron flux with the High Efficiency Neutron Spectrometry Array HENSA in the Hall A of the Canfranc Underground Laboratory. The Hall A measurement campaign lasted from October 2019 to March 2021, demonstrating an excellent stability of the HENSA setup. Preliminary results on the neutron flux from this campaign are presented for the first time. In Phase 1 (113 live days) a total neutron flux of 1.66(2) $\times$10$^{-5}$ cm$^{-2}$ s$^{-1}$ is obtained. Our results are in good agreement with those from our previous shorter measurement where a reduced experimental setup was employed.
△ Less
Submitted 17 November, 2021;
originally announced November 2021.
-
Adversarial Attacks on Graph Classification via Bayesian Optimisation
Authors:
Xingchen Wan,
Henry Kenlay,
Binxin Ru,
Arno Blaas,
Michael A. Osborne,
Xiaowen Dong
Abstract:
Graph neural networks, a popular class of models effective in a wide range of graph-based learning tasks, have been shown to be vulnerable to adversarial attacks. While the majority of the literature focuses on such vulnerability in node-level classification tasks, little effort has been dedicated to analysing adversarial attacks on graph-level classification, an important problem with numerous re…
▽ More
Graph neural networks, a popular class of models effective in a wide range of graph-based learning tasks, have been shown to be vulnerable to adversarial attacks. While the majority of the literature focuses on such vulnerability in node-level classification tasks, little effort has been dedicated to analysing adversarial attacks on graph-level classification, an important problem with numerous real-life applications such as biochemistry and social network analysis. The few existing methods often require unrealistic setups, such as access to internal information of the victim models, or an impractically-large number of queries. We present a novel Bayesian optimisation-based attack method for graph classification models. Our method is black-box, query-efficient and parsimonious with respect to the perturbation applied. We empirically validate the effectiveness and flexibility of the proposed method on a wide range of graph classification tasks involving varying graph properties, constraints and modes of attack. Finally, we analyse common interpretable patterns behind the adversarial samples produced, which may shed further light on the adversarial robustness of graph classification models.
△ Less
Submitted 4 November, 2021;
originally announced November 2021.
-
On Invariance Penalties for Risk Minimization
Authors:
Kia Khezeli,
Arno Blaas,
Frank Soboczenski,
Nicholas Chia,
John Kalantari
Abstract:
The Invariant Risk Minimization (IRM) principle was first proposed by Arjovsky et al. [2019] to address the domain generalization problem by leveraging data heterogeneity from differing experimental conditions. Specifically, IRM seeks to find a data representation under which an optimal classifier remains invariant across all domains. Despite the conceptual appeal of IRM, the effectiveness of the…
▽ More
The Invariant Risk Minimization (IRM) principle was first proposed by Arjovsky et al. [2019] to address the domain generalization problem by leveraging data heterogeneity from differing experimental conditions. Specifically, IRM seeks to find a data representation under which an optimal classifier remains invariant across all domains. Despite the conceptual appeal of IRM, the effectiveness of the originally proposed invariance penalty has recently been brought into question. In particular, there exists counterexamples for which that invariance penalty can be arbitrarily small for non-invariant data representations. We propose an alternative invariance penalty by revisiting the Gramian matrix of the data representation. We discuss the role of its eigenvalues in the relationship between the risk and the invariance penalty, and demonstrate that it is ill-conditioned for said counterexamples. The proposed approach is guaranteed to recover an invariant representation for linear settings under mild non-degeneracy conditions. Its effectiveness is substantiated by experiments on DomainBed and InvarianceUnitTest, two extensive test beds for domain generalization.
△ Less
Submitted 17 June, 2021;
originally announced June 2021.
-
Adversarial Robustness Guarantees for Gaussian Processes
Authors:
Andrea Patane,
Arno Blaas,
Luca Laurenti,
Luca Cardelli,
Stephen Roberts,
Marta Kwiatkowska
Abstract:
Gaussian processes (GPs) enable principled computation of model uncertainty, making them attractive for safety-critical applications. Such scenarios demand that GP decisions are not only accurate, but also robust to perturbations. In this paper we present a framework to analyse adversarial robustness of GPs, defined as invariance of the model's decision to bounded perturbations. Given a compact su…
▽ More
Gaussian processes (GPs) enable principled computation of model uncertainty, making them attractive for safety-critical applications. Such scenarios demand that GP decisions are not only accurate, but also robust to perturbations. In this paper we present a framework to analyse adversarial robustness of GPs, defined as invariance of the model's decision to bounded perturbations. Given a compact subset of the input space $T\subseteq \mathbb{R}^d$, a point $x^*$ and a GP, we provide provable guarantees of adversarial robustness of the GP by computing lower and upper bounds on its prediction range in $T$. We develop a branch-and-bound scheme to refine the bounds and show, for any $ε> 0$, that our algorithm is guaranteed to converge to values $ε$-close to the actual values in finitely many iterations. The algorithm is anytime and can handle both regression and classification tasks, with analytical formulation for most kernels used in practice. We evaluate our methods on a collection of synthetic and standard benchmark datasets, including SPAM, MNIST and FashionMNIST. We study the effect of approximate inference techniques on robustness and demonstrate how our method can be used for interpretability. Our empirical results suggest that the adversarial robustness of GPs increases with accurate posterior estimation.
△ Less
Submitted 7 April, 2021;
originally announced April 2021.
-
The Effect of Prior Lipschitz Continuity on the Adversarial Robustness of Bayesian Neural Networks
Authors:
Arno Blaas,
Stephen J. Roberts
Abstract:
It is desirable, and often a necessity, for machine learning models to be robust against adversarial attacks. This is particularly true for Bayesian models, as they are well-suited for safety-critical applications, in which adversarial attacks can have catastrophic outcomes. In this work, we take a deeper look at the adversarial robustness of Bayesian Neural Networks (BNNs). In particular, we cons…
▽ More
It is desirable, and often a necessity, for machine learning models to be robust against adversarial attacks. This is particularly true for Bayesian models, as they are well-suited for safety-critical applications, in which adversarial attacks can have catastrophic outcomes. In this work, we take a deeper look at the adversarial robustness of Bayesian Neural Networks (BNNs). In particular, we consider whether the adversarial robustness of a BNN can be increased by model choices, particularly the Lipschitz continuity induced by the prior. Conducting in-depth analysis on the case of i.i.d., zero-mean Gaussian priors and posteriors approximated via mean-field variational inference, we find evidence that adversarial robustness is indeed sensitive to the prior variance.
△ Less
Submitted 7 January, 2021;
originally announced January 2021.
-
Adversarial Robustness Guarantees for Classification with Gaussian Processes
Authors:
Arno Blaas,
Andrea Patane,
Luca Laurenti,
Luca Cardelli,
Marta Kwiatkowska,
Stephen Roberts
Abstract:
We investigate adversarial robustness of Gaussian Process Classification (GPC) models. Given a compact subset of the input space $T\subseteq \mathbb{R}^d$ enclosing a test point $x^*$ and a GPC trained on a dataset $\mathcal{D}$, we aim to compute the minimum and the maximum classification probability for the GPC over all the points in $T$. In order to do so, we show how functions lower- and upper…
▽ More
We investigate adversarial robustness of Gaussian Process Classification (GPC) models. Given a compact subset of the input space $T\subseteq \mathbb{R}^d$ enclosing a test point $x^*$ and a GPC trained on a dataset $\mathcal{D}$, we aim to compute the minimum and the maximum classification probability for the GPC over all the points in $T$. In order to do so, we show how functions lower- and upper-bounding the GPC output in $T$ can be derived, and implement those in a branch and bound optimisation algorithm. For any error threshold $ε> 0$ selected a priori, we show that our algorithm is guaranteed to reach values $ε$-close to the actual values in finitely many iterations. We apply our method to investigate the robustness of GPC models on a 2D synthetic dataset, the SPAM dataset and a subset of the MNIST dataset, providing comparisons of different GPC training techniques, and show how our method can be used for interpretability analysis. Our empirical analysis suggests that GPC robustness increases with more accurate posterior estimation.
△ Less
Submitted 11 March, 2020; v1 submitted 28 May, 2019;
originally announced May 2019.
