Adversarial robustness meets imperfect training set

人工智能算法可能会被对抗性欺骗，这迫切需要在安全关键应用中开发对抗性健壮的学习算法。另一方面，学习人工智能算法通常需要大量高质量的数据，这是昂贵的，有时是不现实的；因此，一个不完美的（例如，噪声标签或有毒的）数据不可避免地共存于学习阶段。在2022财年，我们在JSPS KAKENHI Grant的支持下开发了对抗鲁棒学习算法，该算法可以处理不完美的训练集，包括噪声标签[1]和互补标签[2]。此外，我们还利用多模型协作方案来进一步提高对抗鲁棒性[3]。我们的研究成果已经发表在高知名度的机器学习会议和期刊上改进对抗性训练和纠正噪声标签的刻板印象。张俊*，徐晓明，韩斌，刘涛，刚宁，崔丽丽，杉山明。机器学习研究学报（TMLR 2022）[2]具有互补标签的对抗性训练：关于逐渐信息攻击的好处。周建军，周建军，张建军*，刘涛，牛国光，韩斌，Sugiyama M.第36届神经信息处理系统年会（NeurIPS 2022），[3]：专家协同改进的对抗鲁棒性。崔世生，张军*，梁军，韩斌，Sugiyama M., Zhang C.第36届神经信息处理系统年会（NeurIPS 2022）

The AI algorithms can be adversarially fooled, which urgently requires developing adversarially robust learning algorithms in safety-critical applications. On the other hand, learning AI algorithms generally requires massive and high-quality data, which is costly and sometimes unrealistic; thus, an imperfect (e.g., noisy-label or poisoned) data unavoidably co-exists in the learning phase.In FY2022, we have developed adversarially robust learning algorithms with the support of the JSPS KAKENHI Grant, which can handle imperfect training sets, including noisy labels [1] and complementary labels [2]. Additionally, we have utilized a collaborative scheme with multiple models to further improve adversarial robustness [3]. Our research findings have been published in high-profile machine learning conferences and journals.[1] NoiLin: Improving Adversarial Training and Correcting Stereotype of Noisy Labels. J. Zhang*, X. Xu, B. Han, T. Liu, N. Gang, L. Cui, M. Sugiyama. Transactions on Machine Learning Research (TMLR 2022)[2] Adversarial Training with Complementary Labels: On the Benefit of Gradually Informative Attacks. J. Zhou, J. Zhou, J. Zhang*, T. Liu, G. Niu, B. Han, M. Sugiyama. 36th Annual Conference on Neural Information Processing Systems (NeurIPS 2022)[3] Synergy-of-Experts: Collaborate to Improve Adversarial Robustness. S. Cui, J. Zhang*, J. Liang, B. Han, M. Sugiyama, C. Zhang. 36th Annual Conference on Neural Information Processing Systems (NeurIPS 2022)