Robustness-Congruent Adversarial Training for Secure Machine Learning Model Updates

Area of Science:

• Machine Learning
• Computer Vision
• Cybersecurity

Background:

• Machine learning models require regular updates for improved accuracy using new data and architectures.
• Model updates can introduce 'negative flips,' where the new model performs worse on previously correct inputs, degrading user experience.
• These negative flips also impact adversarial robustness, undermining secure model update practices.

Purpose of the Study:

• To investigate the impact of negative flips on adversarial robustness during model updates.
• To propose a novel method, robustness-congruent adversarial training, to mitigate performance regressions in adversarial robustness.
• To establish a theoretical framework for training consistent estimators using non-regression constraints.

Main Methods:

• Fine-tuning machine learning models using adversarial training.
• Implementing a constraint to maintain high robustness on samples unaffected by adversarial attacks prior to the update.
• Developing a theoretically-grounded framework for learning with non-regression constraints.

Main Results:

• Negative flips affect both accuracy and adversarial robustness, even when overall performance improves after an update.
• Robustness-congruent adversarial training effectively mitigates negative flips in adversarial robustness.
• The proposed method outperforms existing baseline methods in maintaining consistent performance and security.

Conclusions:

• Model updates present a significant challenge due to negative flips, impacting both general accuracy and adversarial security.
• Robustness-congruent adversarial training offers a viable solution to prevent performance regressions during model updates.
• The framework of learning with non-regression constraints provides a theoretically sound approach for developing more reliable machine learning models.