Gaussian processes (GPs) enable principled computation of model uncertainty, making them attractive for safety-critical applications. Such scenarios demand that GP decisions are not only accurate, but also robust to perturbations. In this paper we present a framework to analyse adversarial robustness of GPs, defined as invariance of the model's decision to bounded perturbations. Given a compact subset of the input space $T\subseteq \mathbb{R}^d$, a point $x^*$ and a GP, we provide provable guarantees of adversarial robustness of the GP by computing lower and upper bounds on its prediction range in $T$. We develop a branch-and-bound scheme to refine the bounds and show, for any $\epsilon > 0$, that our algorithm is guaranteed to converge to values $\epsilon$-close to the actual values in finitely many iterations. The algorithm is anytime and can handle both regression and classification tasks, with analytical formulation for most kernels used in practice. We evaluate our methods on a collection of synthetic and standard benchmark datasets, including SPAM, MNIST and FashionMNIST. We study the effect of approximate inference techniques on robustness and demonstrate how our method can be used for interpretability. Our empirical results suggest that the adversarial robustness of GPs increases with accurate posterior estimation.
翻译:高斯进程( GPs) 能够对模型不确定性进行有原则的计算, 使其对安全关键应用具有吸引力。 这些情况要求GP的决定不仅准确, 而且还能对扰动产生积极影响。 在本文中, 我们提出了一个框架, 分析GP的对抗性强性强性, 其定义是: 与模型对受约束的扰动决定不一致。 输入空间 $T\ subseteq\ mathbb{R ⁇ d$ 的紧凑子集, 一个点 $x $ 美元 和一个 GP, 我们为GP的对抗性强性保证, 计算其预测范围为$T$的上下限和上限值。 我们开发了一个分支和约束性计划, 来完善GPs的界限, 并显示我们的算法与有限重复中的实际值相匹配。 算法可以随时处理回归和分类任务, 并且为实践中的大多数内核内核应用的分析配。 我们评估了我们用于合成和基准MIS的精确性方法的精确性, 我们用在分析方法上的精确性研究中, 我们的模型和基准性分析方法的精确性研究, 能够显示我们用来测量和基准性地研算法的精确性研究。