Source-linked AI summary
Adversarial Active Learning for Deep Networks: a Margin Based Approach
Melanie Ducoffe, Frederic Precioso
TL;DR
Deep-network active learning aims to reduce costly annotation, while existing scalable strategies largely rely on uncertainty and exact boundary distances are intractable. The paper proposes DFAL, which uses smallest adversarial perturbations, and reports efficient, accurate CNN training across MNIST, Shoe-Bag, and Quick-Draw.
Problem
Deep-network training commonly relies on large labeled datasets, but annotation costs motivate methods that reduce the number of queried labels.
Method
DFAL uses DeepFool adversarial perturbations to approximate distance to decision boundaries and labels both selected samples and their adversarial counterparts.
Results
DFAL is competitive with CORE-SET, runs faster, and achieves high accuracy on CNNs trained with MNIST, Shoe-Bag, and Quick-Draw.
Takeaways & Limitations
Adversarial examples can serve as guidance for margin-based active learning and support transfer of selected data across network architectures.
Abstract
from arXiv · showhide
We propose a new active learning strategy designed for deep neural networks. The goal is to minimize the number of data annotation queried from an oracle during training. Previous active learning strategies scalable for deep networks were mostly based on uncertain sample selection. In this work, we focus on examples lying close to the decision boundary. Based on theoretical works on margin theory for active learning, we know that such examples may help to considerably decrease the number of annotations. While measuring the exact distance to the decision boundaries is intractable, we propose to rely on adversarial examples. We do not consider anymore them as a threat instead we exploit the information they provide on the distribution of the input space in order to approximate the distance to decision boundaries. We demonstrate empirically that adversarial active queries yield faster convergence of CNNs trained on MNIST, the Shoe-Bag and the Quick-Draw datasets.
1. Introduction
Active learning can reduce annotation needs for deep networks, but existing strategies are difficult to scale and do not directly expose decision-boundary distances. The paper introduces DFAL, which uses adversarial examples to guide margin-based queries and reports faster, accurate training across three datasets.
- Motivation: Active learning builds task-specific training sets iteratively to limit human annotation for supervised learning.The approach alternates between training on labeled data and querying an oracle for selected unlabeled points.
- Related work: Existing active learning methods have reduced labeled-data requirements across applications, including image, sentiment, visual-question-answering, and dialogue tasks.The paper notes that transferring these methods directly to deep networks is not intuitive because scaling some approaches can be intractable.
- Research gap: Margin-based active learning queries unlabeled samples near decision boundaries, but computing their exact distances is intractable for deep networks.The paper cites theoretical work showing that margin-based approaches can substantially reduce human annotations in specific cases.
- Contribution: DFAL treats adversarial examples as guidance for selecting new data rather than as threats.It selects samples close to their adversarial attacks and labels both the original samples and adversarial counterparts with the same label.
- Evaluation: Experiments evaluate DFAL on MNIST, Quick-Draw, and Shoe-Bag, reporting state-of-the-art accuracy and faster execution than previous approaches.The paper presents these experiments as evidence of the method’s efficiency for deep-network active learning.
2. Related Work
Related work develops active learning through iterative batch selection, core-set objectives, and decision-boundary proximity. These approaches motivate margin-based selection but face stability, computational, or deep-network-specific obstacles.
- Active learning: Active learning iteratively trains a classifier on labeled data and queries an oracle for selected points from an unlabeled pool.Batch selection is useful for deep networks because querying one sample at a time may not produce a stable training impact.
- Core-set selection: Batch active learning can formulate subset selection as a core-set problem that controls population risk through a core-set loss.Sener et al. argue that CNN expressiveness makes training and generalization error terms negligible relative to this loss.
- Margin-based selection: Margin-based active learning selects examples near decision boundaries, but deep networks make geometric boundary distances difficult to compute.The paper contrasts this setting with models such as SVM, Perceptron, and AdaBoost, where margin assumptions are more established.
- Gradient-based selection: Expected-Gradient-Length selects samples with large gradient magnitude, but the true gradient cannot be computed without the unknown ground-truth label.The paper describes this as a practical obstacle for applying gradient-based selection to unlabeled data.
3. Adversarial Active Learning with Deep-Fool attacks
DFAL approximates a sample’s distance to a decision boundary by its smallest adversarial perturbation, using DeepFool to identify informative unlabeled samples. The method also adds adversarial counterparts with the same labels, providing extra training samples without additional annotation.
- Margin approximation: Margin-based selection seeks samples close to decision boundaries, but direct boundary-distance computation is difficult and nearest different-class samples provide a coarse, expensive approximation.Figure 1 contrasts direct projection, nearest different-class neighbors, and the adversarial-perturbation strategy.
- DFAL criterion: DFAL selects unlabeled samples with the smallest adversarial perturbations because adversarial attacks approximate the smallest boundary-crossing perturbation.This approximation is presented as closer to the original boundary distance than nearest-neighbor alternatives in the binary case.
- DeepFool attacks: In multiclass settings, DFAL uses DeepFool rather than constructing one perturbation per class, avoiding the time cost associated with the EGL-style alternative.DeepFool iteratively linearizes the classifier locally and updates the sample until it crosses the local decision boundary.
- DeepFool attacks: DeepFool is used because it is hyperparameter-free, fast, and competitive with state-of-the-art adversarial attacks.The method does not require target labels, which supports its use in multiclass contexts.
- Training-set update: DFAL adds selected unlabeled samples and their adversarial attacks to the training set, assigning both the same label.The paper states that one queried label thereby corresponds to two training samples and does not introduce corrupted labels.
- Algorithm: DFAL repeatedly trains the network, samples a candidate pool, computes DeepFool perturbations, and queries the candidates with the smallest Lp norms.Algorithm 1 specifies p = 2 and adds each selected sample together with its adversarial counterpart.
4. Experiments
Experiments on MNIST, Shoe-Bag, and Quick-Draw evaluate DFAL against uncertainty-based, random, and batch active-learning baselines across LeNet5 and VGG8. DFAL generally converges quickly, uses few annotations, remains competitive with CORE-SET, and transfers across architectures.
- Experimental setup: DFAL was evaluated on MNIST, Shoe-Bag, and Quick-Draw using LeNet5 and VGG8 CNNs.The experiments use fully supervised image classification and compare active-learning strategies under the stated CNN training setup.
- Accuracy results: DFAL converges faster than singleton-query methods and is always better than random selection across the evaluated networks and datasets.BALD, CEAL, EGL, and uncertainty selection do not always outperform random selection under top-score querying.
- Accuracy results: DFAL remains among the top three methods at 1000 labeled samples, with CORE-SET or pseudo-labeling exceeding it only by slight percentages when they outperform it.The authors suggest increasing query diversity through a batch-setting extension to better challenge CORE-SET.
- Annotation efficiency: DFAL reaches full-training-set accuracy with the smallest annotation count on MNIST and Quick-Draw, while requiring less than 1% of Shoe-Bag’s training set overall.The comparison considers effective annotations and real data required to reach the full-training accuracy within ±0.5.
- Computational comparison: DFAL is competitive with CORE-SET in accuracy and can outperform it in some experiments while offering better runtime performance.CORE-SET selection involves computationally costly greedy and Mixed Integer Programming procedures, whereas DFAL’s runtime is independent of labeled-set size in the reported comparison.
5. Conclusion
DFAL applies margin-based active learning to CNNs by approximating each sample’s projection to the decision boundary with its smallest adversarial attack. It is empirically efficient across three datasets, competitive with CORE-SET, and faster at runtime.
- DFAL approximates a sample’s projection to the decision boundary by its smallest adversarial attack.
- DFAL is empirically highly efficient for CNNs trained on MNIST, Shoe-Bag, and Quick-Draw.
- DFAL is competitive with the state-of-the-art batch active learning method CORE-SET and outperforms it in runtime performance.