Adversarial Examples, Uncertainty, and Transfer Testing Robustness in Gaussian Process Hybrid Deep Networks

2017/07/08 by John Bradshaw, Bradshaw, John, Alexander Matthews +4 · 15 citations
Computer Science · Mathematics · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #FOS: Computer and information sciences #Gaussian Processes and Bayesian Inference #Machine Learning (stat.ML) #stat.ML

paper · pdf · doi:10.48550/arxiv.1707.02476

arxiv created 2017/07/08 · openalex publication_date 2017/07/08 · arxiv updated 2017/07/11 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Deep neural networks (DNNs) have excellent representative power and are state of the art classifiers on many tasks. However, they often do not capture their own uncertainties well making them less robust in the real world as they overconfidently extrapolate and do not notice domain shift. Gaussian processes (GPs) with RBF kernels on the other hand have better calibrated uncertainties and do not overconfidently extrapolate far from data in their training set. However, GPs have poor representational power and do not perform as well as DNNs on complex domains. In this paper we show that GP hybrid deep networks, GPDNNs, (GPs on top of DNNs and trained end-to-end) inherit the nice properties of both GPs and DNNs and are much more robust to adversarial examples. When extrapolating to adversarial examples and testing in domain shift settings, GPDNNs frequently output high entropy class probabilities corresponding to essentially "don't know". GPDNNs are therefore promising as deep architectures that know when they don't know.

Citations

• Thoughts on Massively Scalable Gaussian Processes
• Deep Neural Networks for Acoustic Modeling in Speech Recognition: The Shared Views of Four Research Groups
• ImageNet classification with deep convolutional neural networks
• End to End Learning for Self-Driving Cars
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Densely Connected Convolutional Networks
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Dropout Inference in Bayesian Neural Networks with Alpha-divergences
• Universal adversarial perturbations
• Learning Multiple Layers of Features from Tiny Images

Cited by

• Response to Promises and Pitfalls of Deep Kernel Learning
• Opportunities and challenges in developing deep learning models using electronic health records data: a systematic review
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Practical Deep Learning with Bayesian Principles
• Stochastic-Shield: A Probabilistic Approach Towards Training-Free Adversarial Defense in Quantized CNNs
• A Fine-Grained Spectral Perspective on Neural Networks
• Ptolemy: Architecture Support for Robust Deep Learning
• Tensor Programs I: Wide Feedforward or Recurrent Neural Networks of Any Architecture are Gaussian Processes
• On The Utility of Conditional Generation Based Mutual Information for Characterizing Adversarial Subspaces
• Scalable Deep Basis Kernel Gaussian Processes
• Probabilistic Modeling for Novelty Detection with Applications to Fraud Identification
• Kernelized Capsule Networks
• Calibrating Deep Convolutional Gaussian Processes
• Input Validation for Neural Networks via Runtime Local Robustness Verification
• Defence against adversarial attacks using classical and quantum-enhanced Boltzmann machines †

Related

• Deep Neural Networks as Gaussian Processes
• Deep Neural Networks as Point Estimates for Deep Gaussian Processes
• Improving Output Uncertainty Estimation and Generalization in Deep Learning via Neural Network Gaussian Processes
• Approximate Inference Turns Deep Networks into Gaussian Processes
• The Limitations of Model Uncertainty in Adversarial Settings