透過通用對抗攻擊提升影像分類模型之公平性

Abstract

隨著深度學習為基礎的演算法被導入各式各樣不同的應用領域，確保它們的預測公平性以符合社會正義將會變得越來越重要。為了提升模型的公平性，我們將公平性標準與通用對抗攻擊相結合來解決這一問題。我們的目標是給定一個訓練好的模型，在不改變模型的權重與架構下，以資料前處理的方式提升模型的公平性。具體地來說我們的前處理是使用通用對抗攻擊來產生單一擾動，並將其與所有輸入圖片相結合，來提升資料集上的不同群體之間的預測公平性。我們設計了三種架構來產生擾動：以可微分方式近似公平性標準並進行優化、以動態方式掩蔽原始訓練函數的特定族群、以及導入擾動優化器解決公平性標準中的不連續性等。此外，我們也將此基於對抗攻擊的前處理方法擴展到其他種形式上，比如將人臉加上特別產生的眼鏡，或將照片套入特別產生的相框。如此能將此模型公平性技術的使用場景從數位領域擴展到現實的物理世界。透過在CelebA和FairFace數據集上的大量實驗結果，我們驗證了我們方法的有效性，並且證明該方法有潛力在現實世界中部屬以保障深度學習應用的公平性。

As deep learning based algorithms penetrates into various fields, there is a growing imperative to ensure their fairness and ethical accountability. In this paper, we address model fairness by integrating fairness criteria with the universal adversarial attack technique. Our objective is to enhance the fairness of a pretrained model without modifying its weights or structure, by utilizing data pre-processing techniques. Specifically, our pre-processing uses universal adversarial attack to generate a single perturbation, which is then combined with all the input images. We propose three objectives: approximating the fairness criteria for optimization, dynamically masking the original training loss for specific groups, and employing a perturbed optimizer to address the discontinuity in fairness criteria, thereby optimizing fairness more effectively. Furthermore, we extend our attack into various forms, including adding specially crafted eyeglasses to faces or encasing images within uniquely designed photo frames. Such extensions allow the fairness-improving technique to migrate from the digital domain into the real, physical world. To demonstrate the effectiveness of our method, we conduct extensive experiments on the CelebA and FairFace datasets. The results show our method’s potential for real-world deployment to ensure fairness in deep learning.