PaperlayerView exact revision on arXiv

Source-linked AI summary

Transfer Learning without Knowing: Reprogramming Black-box Machine Learning Models with Scarce Data and Limited Resources

Yun-Yun Tsai, Pin-Yu Chen, Tsung-Yi Ho

arXiv:2007.08714v2cs.CVcs.LGstat.ML

TL;DR

Transfer learning commonly relies on finetuning, which requires access to the pretrained model, while scarce data and limited resources can make adaptation challenging. BAR reprograms black-box models from input-output responses using zeroth-order optimization and multi-label mapping. On three data-scarce medical tasks, it outperformed state-of-the-art methods and finetuning and performed comparably to white-box adversarial reprogramming.

  • Problem

    Conventional transfer learning often finetunes a pretrained model, requiring full knowledge and control, while medical tasks may have scarce data and limited resources.

    Source: §1 · pp. 1–2

  • Method

    BAR reprograms black-box models using input-output responses, zeroth-order optimization, and multi-label mapping, without knowing or finetuning the pretrained model.

    Source: §1 · p. 2, §5 · p. 9

  • Results

    On three data-scarce medical tasks, BAR outperformed state-of-the-art methods and finetuning and showed comparable performance to vanilla white-box adversarial reprogramming.

    Source: §5 · p. 9

  • Takeaways & Limitations

    BAR offers a cost-effective way to reprogram access-limited models for transfer learning, including real-life online image-classification APIs.

    Source: §5 · p. 9

    BAR assumes queried inputs yield observable model outputs, while gradients are inadmissible.

    Source: §3.1 · p. 3

Abstract

from arXiv · show

Current transfer learning methods are mainly based on finetuning a pretrained model with target-domain data. Motivated by the techniques from adversarial machine learning (ML) that are capable of manipulating the model prediction via data perturbations, in this paper we propose a novel approach, black-box adversarial reprogramming (BAR), that repurposes a well-trained black-box ML model (e.g., a prediction API or a proprietary software) for solving different ML tasks, especially in the scenario with scarce data and constrained resources. The rationale lies in exploiting high-performance but unknown ML models to gain learning capability for transfer learning. Using zeroth order optimization and multi-label mapping techniques, BAR can reprogram a black-box ML model solely based on its input-output responses without knowing the model architecture or changing any parameter. More importantly, in the limited medical data setting, on autism spectrum disorder classification, diabetic retinopathy detection, and melanoma detection tasks, BAR outperforms state-of-the-art methods and yields comparable performance to the vanilla adversarial reprogramming method requiring complete knowledge of the target ML model. BAR also outperforms baseline transfer learning approaches by a significant margin, demonstrating cost-effective means and new insights for transfer learning.

1. Introduction

BAR addresses whether transfer learning can avoid finetuning and work with black-box models, where only input-output responses are observable. It reprograms such models for medical imaging tasks and reports strong performance in data-scarce settings.

1. Introduction

  • Conventional transfer learning often finetunes a pretrained model, requiring full knowledge and control of its architecture and parameters.The paper asks whether finetuning is necessary and whether transfer learning can use models whose only observable information is input-output responses.Source: §1 · p. 1
  • Vanilla adversarial reprogramming showed that a learned input perturbation can repurpose a model, but it did not study limited data and still required backpropagation.Thus, it did not address the black-box setting.Source: §1 · pp. 1–2
  • Medical applications can face scarce or costly labeled data, while researchers may lack the resources to train or adapt large models.The paper motivates reusing access-limited, well-trained models under these constraints.Source: §1 · p. 2
  • BAR combines zeroth-order optimization of input-output responses with multi-label mapping to reprogram black-box models.The method does not require knowledge of or finetuning the pretrained model.Source: §1 · p. 2
  • Across three medical imaging tasks, BAR outperformed state-of-the-art methods and finetuning by a significant margin.The tasks were autism spectrum disorder classification, diabetic retinopathy detection, and melanoma detection.Source: §1 · p. 2
  • Reprogramming two real-life image-classification APIs for ASD classification cost less than $24 in total.The authors present this as evidence of BAR’s practicality; vanilla white-box AR cannot be used in the black-box setting.Source: §1 · p. 3

2. Related Work

Related work frames adversarial reprogramming as repurposing a model through an input program and output-label mapping, while noting that prior methods retain white-box requirements. Zeroth-order optimization provides a gradient-free route to black-box optimization through function evaluations.

2.1. Adversarial ML and Reprogramming

  • Adversarial ML studies manipulating model decisions; cited examples include adversarial examples and poisoning or backdoor attacks.The passage lists Biggio & Roli (2018), Biggio et al. (2013), Szegedy et al. (2014), Goodfellow et al. (2015), Carlini & Wagner (2017), Chen et al. (2018), Mu˜noz-Gonz´alez et al. (2017), Chen et al. (2017b), Shafahi et al. (2018), Gu et al. (2019), and Xie et al. (2020).Source: §2.1 · p. 3
  • Adversarial reprogramming keeps the model architecture unchanged and uses a trainable input transformation and output-label mapping to adapt it to a different task.Prior text-classification reprogramming also assumed white-box access.Source: §2.1 · p. 3

2.2. Zeroth Order Optimization for Black-box Setting

  • Vanilla adversarial reprogramming requires full model access for backpropagation, excluding access-limited APIs from its reach.The paper motivates zeroth-order optimization to reprogram models that reveal outputs but disallow gradients.Source: §2.2 · p. 3
  • Zeroth-order optimization estimates gradients from numerical function evaluations rather than requiring gradients, making it applicable to black-box tasks.Prior work also developed query-efficient zeroth-order methods (Liu et al., 2018; 2019; 2020).Source: §2.2 · p. 3

3. Black-box Adversarial Reprogramming (BAR): Method and Algorithm

BAR reprograms a black-box classifier using input-output responses, without accessing its internal details or modifying its parameters. It combines an adversarial input program, multi-label mapping, and zeroth-order optimization.

3.1. Problem Formulation

  • The black-box setting permits observing confidence-score outputs for queried inputs but not gradients, which makes backpropagation through the model infeasible.The gradient estimator uses q random perturbations; each training sample requires q + 1 model queries, trading fewer queries at smaller q against potentially greater estimation error.Source: §3.1 · p. 3, §3.2 · pp. 4–5
  • A shared adversarial program adds a masked perturbation to zero-padded target samples, preserving the embedded data while mapping them into the source model’s input space.The program is parameterized by trainable W, and the mask marks dimensions reserved for embedding target data.Source: §3.1 · pp. 3–4
  • Multi-label mapping averages groups of source-class scores into target-class predictions; the focal loss penalizes low-probability predictions during training.The paper reports that many-to-one mapping can improve accuracy over one-to-one mapping, and that frequency-based mapping improves accuracy over random mapping.Source: §3.1 · p. 4

3.2. Zeroth Order Optimization for BAR

  • BAR uses only model input-output responses and zeroth-order optimization to train an adversarial program without accessing model gradients or internal details.The estimated gradient replaces the unavailable gradient in a gradient-based update; the paper uses SGD with the estimate.Source: §3.2 · pp. 4–5
  • BAR updates the adversarial-program parameters with SGD using estimated gradients, and its training process depends on model queries rather than model internals.The paper gives the query count as iterations × minibatch size × (q + 1).Source: §3.2 · p. 5

4. Experiments

The experiments section evaluates and compares performance.

  • The experiments evaluate and compare performance.Source: §4 · p. 5

1. Reprogramming three pretrained black-box Ima-

The experiments evaluate BAR on three pretrained ImageNet classifiers and real prediction APIs. Across medical tasks, BAR performs comparably to white-box AR and outperforms reported alternatives, while API tests demonstrate reprogramming at stated costs.

1. Reprogramming three pretrained black-box Ima-

  • Experiments applied BAR to three pretrained ImageNet classifiers across three medical tasks and reprogrammed two online MLaaS toolkits.The medical classifiers were ResNet 50, Inception V3, and DenseNet 121.Source: §1 · p. 5

4.1. Autism Spectrum Disorder Classification

  • BAR accuracy was 17%-18% better than transfer learning on ASD, and comparable to white-box AR while exceeding the cited state-of-the-art results.The ASD results use 10-fold cross-validation.Source: Table 1 · p. 6, §4.1 · p. 6

4.2. Diabetic Retinopathy Detection

  • BAR achieved 79.33% accuracy on diabetic retinopathy, 2.7% better than SOTA and nearly matching white-box AR at 80.48%.Without augmentation or ensembling, AR/BAR performance was close to the reported 81.36% best accuracy.Source: Table 2 · p. 6, §4.2 · p. 6

4.3. Melanoma Detection

  • On melanoma detection, BAR/AR exceeded finetuning by 5-10% and outperformed the reported best accuracy of 78.65%.Training from scratch had low accuracy with the limited data.Source: Table 3 · p. 7, §4.3 · p. 7

4.4. Reprogramming Real-life Prediction APIs

  • On Clarifai Moderation, BAR reached 67.32% ASD accuracy for $23.04 and 72.75% DR accuracy for $31.68; on Microsoft Custom Vision, it reached 69.15% ASD accuracy for $20.46.Increasing q can improve accuracy but also raises query and expense costs.Source: Table 4 · p. 7, §4.4 · p. 7, Table 5 · p. 7

4.5. Ablation Study and Sensitivity Analysis

  • Accuracy rose with q and then saturated, while increasing mapping size m improved accuracy; frequency mapping accelerated convergence and gained roughly 3%-5% over random mapping.The sensitivity tests reprogrammed ResNet 50 for ASD, DR, and melanoma; frequency mapping improved results for both AR and BAR.Source: Figure 2 · p. 8, §4.5 · p. 8, Figure 3 · p. 8
  • Focal loss sped convergence for AR and BAR and improved BAR accuracy by 3%-5%; t-SNE showed AR representations more clustered and separable than before reprogramming and better than finetuning.The representation comparison used melanoma training data and ResNet 50 feature maps.Source: Figure 4 · p. 8, §4.5 · pp. 8–9, Figure 5 · p. 9

5. Conclusion

The paper proposes BAR, which reprograms black-box models using zeroth order optimization and multi-label mapping, relying only on input-output responses. Across three data-scarce medical tasks, BAR outperformed state-of-the-art methods and finetuning, performed comparably to white-box AR, and was demonstrated on online APIs at affordable expense.

5. Conclusion

  • Across three data-scarce medical tasks, BAR performed comparably to white-box AR and outperformed state-of-the-art methods and the widely used finetuning approach.The paper also reports BAR's practicality and effectiveness on real-life online image classification APIs at affordable expense.Source: §5 · p. 9
  • BAR reprograms black-box models through zeroth order optimization and multi-label mapping, using only input-output responses rather than model knowledge or parameter changes.The approach targets access-limited models and transfer learning without knowing or modifying the pretrained model.Source: §5 · p. 9
  • The authors report that BAR provides a new perspective and an effective approach for transfer learning without knowing or modifying the pretrained model.Source: §5 · p. 9

A. Training details

The finetuning baseline uses pretrained Keras networks with convolutional layers as the base, followed by a fully connected layer, dropout, and a softmax classifier. Training settings are specified for ASD, DR, and melanoma tasks.

A. Training details

  • The finetuning setup uses pretrained Keras convolutional layers as a base, followed by a fully connected layer, dropout at 0.5, and a final classification softmax layer.Finetuning every layer performed better than finetuning only the last fully connected layer.Source: §A.1 · p. 12
  • For ASD, ResNet 50 and Inception V3 were fine-tuned with Adam at 1e-5, batch size 32, and 50 epochs.Source: §A.1 · p. 12
  • For DR and melanoma detection, the ASD training settings were followed and ResNet 50, Inception V3, and DenseNet 121 were fine-tuned.Source: §A.1 · p. 12

A.2. Training from scratch:

The from-scratch baseline trains randomly initialized networks on ASD, DR, and melanoma data using a shared optimizer and training schedule.

A.2. Training from scratch:

  • Networks trained from scratch use random initialization rather than pretrained weights on ASD, DR, and melanoma datasets.Source: §A.2 · p. 12
  • The from-scratch training uses Adam with learning rate 1e-5 and batch size 32.Source: §A.2 · p. 12
  • The from-scratch networks are trained for 50 epochs across the three datasets.Source: §A.2 · p. 12

B. Additional experiments

Additional experiments reprogrammed pretrained ImageNet models for facial recognition on the Georgia Tech Face Database, where BAR outperformed baseline methods and was comparable to AR.

B. Additional experiments

C. t-SNE

The section visualizes ResNet 50 representations before adversarial reprogramming, after it, and after fine-tuning; across ASD, diabetic retinopathy, and melanoma, the authors report better representations after adversarial reprogramming than after fine-tuning.

C. t-SNE

  • The plots compare ResNet 50 pre-logit representations before adversarial reprogramming, after it, and after fine-tuning, using zero-padding for the before-AR inputs.The authors used t-SNE with perplexity 50; after AR, features were extracted from original data with the adversarial program.Source: C. t-SNE · p. 12

C.1. Autism Spectrum Disorder classification

  • For ASD, representations are non-separable before adversarial reprogramming but highly clustered and well separated afterward; fine-tuning performs worse than adversarial reprogramming.The authors associate the improved separation with high predictability.Source: §C.1 · p. 12, Figure 6 · p. 13

C.2. Diabetic Retinopathy detection

  • For diabetic retinopathy, the t-SNE plot indicates that adversarial programming learns better data representations than fine-tuning.Figure 7 colors represent five class labels.Source: §C.2 · p. 12, Figure 7 · p. 13

C.3. Melanoma detection

  • For melanoma detection, the t-SNE plot likewise indicates that adversarial programming learns better data representations than fine-tuning.Figure 8 compares representations for the melanoma task.Source: §C.3 · p. 12, Figure 8 · p. 13

Related papers

Loading 2007.08714v2…