Towards robust image recognition via deep generative classifiers

Abstract

Recent years have witnessed the success of deep neural network models in image recognition. Yet at the same time, they are also surprisingly vulnerable to malicious inputs, e.g. adversarial examples, corrupted examples, out-of-distribution~(OOD) samples. Previous work usually tries to address one of them and design specific solutions that are not applicable to other ones. Another important but largely neglected fact is that all the previous work focuses only on the discriminative classifiers. This can be explained by the fact that the progresses of image recognition during the past several years is completely due to the discriminative models. Though generative models are believed to be more robust, and demonstrate great success in the relistic synthesis of images, audio etc, they perform poorly in terms of classification tasks.

In this thesis, we first explore why fully likelihood-based generative models fail in image classification. Second, we propose an end-to-end generative classifier Supervised Deep Infomax~(SDIM). SDIM models the generative process on the representations, rather than the raw image pixels. SDIM is able to achieve same level accuracy as discriminative ones. With the explicit class conditionals in our hands, we could reject illegal inputs by setting thresholds. Our experiments on adversarial examples and OOD samples show promissing results. Third, instead of training SDIM-based generative classifiers from scratch, we propose SDIM-\emph{logit}, which takes the logits of any discriminative classifier as inputs, and transformes it into a generative one. The training of SDIM-\emph{logit} is very cheap compared to the full training. Based on increasingly powerful well-trained discriminative classifiers, we see improved results on various malicious inputs detection.