Classification Boundaries of Complex Machine Learning Models

最先进的深度神经网络在广泛的人工智能任务中取得了重大成功，例如，建立在图像/文本分类基础上的应用，如计算机辅助医疗诊断、自动驾驶汽车、情感分析等。然而，这些网络可能容易受到对抗性攻击技术以几乎无法察觉的方式扰动的数据对象的影响。该项目的重点是通过研究机器学习模型引起的分类边界和区域的性质来提高神经网络的对抗鲁棒性。本文旨在解决以下研究问题：1.在不可感知的对抗扰动的存在与分类边界和区域的属性之间，理论上可证明的关系是什么？2.如何在不牺牲自然目标分类精度的前提下提高扰动目标的分类精度？该项目旨在通过研究分类区域和决策边界的几何和拓扑特征来回答这些问题。将建立对对抗鲁棒性的新的理论认识，并开发新颖有效的对抗防御技术。该项目为EPSRC的人工智能和数值分析研究领域做出了贡献，它的成功将使所有其他使用深度神经网络作为底层计算工具的科学和工程领域受益。

State of the art deep neural networks have experienced significant success across a wide range of AI tasks, e.g., those building on image/text classification, with successful application cases like computer-aided medical diagnosis, automatic driving cars, sentiment analysis. However, these networks can be vulnerable to handle data objects perturbed in an almost imperceptible manner by adversarial attack techniques. Such perturbations cause the networks to misclassify and significantly reduce their accuracy.This project is focused on improving the adversarial robustness of neural networks by researching properties of the classification boundaries and regions induced by machine learning models. It aims at addressing the following research questions:1. What are the theoretically provable relationships between the existence of imperceptible adversarial perturbations and the properties of classification boundaries and regions?2. How to improve classification accuracy of perturbed objects without sacrificing the classification accuracy of natural objects?The project aims at answering these questions through investigating the geometric and topological features of the classification regions and decision boundaries. New theoretical understanding of adversarial robustness will be established, and novel and effective adversarial defense techniques will be developed. The project contributes to the EPSRC research areas of AI and numerical analysis, and its success will benefit all the other science and engineering areas that use deep neural networks as their underlying computational tools.