Identifying and exploiting structures for reliable deep learning

Thesis

Deep learning research has recently witnessed an impressively fast-paced progress in a wide range of tasks including computer vision, natural language processing, and reinforcement learning. The extraordinary performance of these systems often gives the impression that they can be used to revolutionise our lives for the better. However, as recent works point out, these systems suffer from several issues that make them unreliable for use in the real world, including vulnerability to adversarial attacks (Szegedy et al. [243]), tendency to memorise noise (Zhang et al. [286]), being over-confident on incorrect predictions (miscalibration) (Guo et al. [99]), and unsuitability for handling private data (Gilad-Bachrach et al. [88]). In this the- sis, we look at each of these issues in detail, investigate their causes, and propose computationally cheap algorithms for mitigating them in practice.

To do this, we identify structures in deep neural networks that can be exploited to mitigate the above causes of unreliability of deep learning algorithms. In Chapter 4, we show that minimising a property of matrices, called stable rank, for individual weight matrix in a neural network reduces the tendency of the network to memorise noise without sacrificing its performance on noiseless data.

In Chapter 5, we prove that memorising label noise or doing improper representation learning makes achieving adversarial robustness impossible. Chapter 6 shows that a low-rank prior on the representation space of neural networks increases the robustness of neural networks to adversarial perturbations without inducing any tradeoff with accuracy in practice.

In Chapter 7, we highlight the use of focal loss, which weights loss components from individual samples differentially by how well the neural network classifies each of them, as an alternative loss function to cross-entropy for minimising miscalibration in neural networks.

In Chapter 8, we first define a new framework called Encrypted Prediction As A Service (EPAAS) along with a set of computational and privacy constraints. Then we propose the use of a Fully Homomorphic Encryption [84] scheme which can be used with a Binary neural network [61], along with a set of algebraic and computational tricks, to satisfy all our conditions for EPAAS while being computationally efficient.

Authors: Sanyal, A

• DOI: 10.5287/ora-7q6e25b28
• Type of award: DPhil
• Level of award: Doctoral
• Awarding institution: University of Oxford
• Language: English
• Keywords: regularisation; machine learning; generalisation; adversarial robustness; calibration; encyrpted prediction; label noise; benign overfitting
• Subjects: reliability of deep learning algorithms