Certifying Model Accuracy under Distribution Shifts

Abstract

Certified robustness in machine learning has primarily focused on adversarial perturbations of the input with a fixed attack budget for each point in the data distribution. In this work, we present provable robustness guarantees on the accuracy of a model under bounded Wasserstein shifts of the data distribution. We show that a simple procedure that randomizes the input of the model within a transformation space is provably robust to distributional shifts under the transformation. Our framework allows the datum-specific perturbation size to vary across different points in the input distribution and is general enough to include fixedsized perturbations as well. Our certificates produce guaranteed lower bounds on the performance of the model for any (natural or adversarial) shift of the input distribution within a Wasserstein ball around the original distribution. We apply our technique to: (i) certify robustness against natural (non-adversarial) transformations of images such as color shifts, hue shifts and changes in brightness and saturation, (ii) certify robustness against adversarial shifts of the input distribution, and (iii) show provable lower bounds (hardness results) on the performance of models trained on so-called "unlearnable" datasets that have been poisoned to interfere with model training.

On Certifying and Improving Generalization to Unseen Domains

“…Analytical works in these areas [6,5,47,61,49,78,36,10] have shown that model's generalization performance remains high under distribution shifts when the training (source) and test (target) distributions are close under certain divergence measures. Distributional divergence measures studied in previous works include the Wasserstein distance [62,40,39,26], maximum mean discrepancy [63], f -divergence [7,70], H-divergence [6,1]. Since generalization to arbitrary domains is not possible, previous works make additional assumptions on the unseen domains such as [9] assumes that the source and target distributions are derived from the same hyper-distribution, [1,38] assumes that the target distributions belong to the convex hull of the source distribution(s), [40] considers shifts generated by different parameterized transformations.…”

“…Distributional divergence measures studied in previous works include the Wasserstein distance [62,40,39,26], maximum mean discrepancy [63], f -divergence [7,70], H-divergence [6,1]. Since generalization to arbitrary domains is not possible, previous works make additional assumptions on the unseen domains such as [9] assumes that the source and target distributions are derived from the same hyper-distribution, [1,38] assumes that the target distributions belong to the convex hull of the source distribution(s), [40] considers shifts generated by different parameterized transformations. Another line of work considers learning a representation space by minimizing different divergence measures between the source distributions [1,73,25,79,55,30].…”

“…Our work is different from these works since we are concerned with distributional robustness guarantees for DG, i.e., a certification that allows us to quantify the generalization performance on an unseen distribution rather than certifying the instance-wise performance (see Appendix C.3 for a comparison between point-wise and distributional robustness). Recently, certified robustness has gained attention in the context of certifying the performance of the classifier (in a distributional sense) on bounded distribution shifts [40,70,59].…”

“…The area of Domain Generalization (DG) [69] studies this crucial problem and aims to develop models whose performance remains high on unseen domains (or variations). Analyses in recent works have demonstrated that the distributional distance between the source and the unseen domains is a key metric to predict the generalization performance of the model on unseen domains [62,40,39,26,19,63,7,70,6,1]. To ensure that the unseen domain lies close to the source domains some works in DG impose additional assumptions [9,1,38,40,70] on the unseen domains whereas others learn a representation space in which the divergence between multiple source domains can be reduced while ensuring high performance on these domains [1,24,79,76].…”

“…Analyses in recent works have demonstrated that the distributional distance between the source and the unseen domains is a key metric to predict the generalization performance of the model on unseen domains [62,40,39,26,19,63,7,70,6,1]. To ensure that the unseen domain lies close to the source domains some works in DG impose additional assumptions [9,1,38,40,70] on the unseen domains whereas others learn a representation space in which the divergence between multiple source domains can be reduced while ensuring high performance on these domains [1,24,79,76]. By learning such a representation space, these methods aim to potentially reduce the divergence between source and unseen domains, thereby guaranteeing generalization.…”