Machine Teaching and its Applications

Transcription

1 Machine Teaching and its Applications Jerry Zhu University of Wisconsin-Madison Jan. 8, /64

2 Introduction 2/64

3 Machine teaching Given target model θ, learner A Find the best training set D so that A(D) θ 3/64

4 Passive learning, active learning, teaching 4/64

5 Passive learning with large probability ˆθ θ = O(n 1 ) 5/64

6 Active learning ˆθ θ = O(2 n ) 6/64

7 Machine teaching ɛ > 0, n = 2 7/64

8 Another example: teaching hard margin SVM T D = 2 vs. V C = d + 1 8/64

9 Machine learning vs. machine teaching learning (D given, learn ˆθ) ˆθ = argmin θ (x,y) D teaching (θ given, learn D) l(x, y, θ) + λ θ 2 min D,ˆθ s.t. ˆθ θ 2 + η D 0 ˆθ = argmin θ (x,y) D l(x, y, θ) + λ θ 2 D not i.i.d. synthetic or pool-based 9/64

10 Why bother if we already know θ? teach ing / teching/ noun 1. education 2. controlling 3. shaping 4. persuasion 5. influence maximization 6. attacking 7. poisoning 10/64

11 The coding view message=θ decoder=learning algorithm A language=d D A A(D) θ 1 Α (θ ) D Α 1 Θ 11/64

12 Machine teaching generic form min D,ˆθ s.t. TeachingRisk(ˆθ) + ηteachingcost(d) ˆθ = MachineLearning(D) 12/64

13 Fascinating things I will not discuss today probing graybox learners teaching by features, pairwise comparisons learner anticipates teaching reward shaping, reinforcement learning, optimal control 13/64

14 Machine learning debugging 14/64

15 Harry Potter toy example 15/64

16 education Labels y contain historical bias + hired by the Ministry of Magic o no magical heritage 16/64

17 education Trusted items ( x, ỹ) expensive insufficient to learn magical heritage 17/64

18 education Idea magical heritage Flip training labels and re-train model to agree with trusted items. Ψ(ˆθ) := [ˆθ( x) = ỹ] 18/64

19 Not our goal: only to learn a better model min θ Θ s.t. l(x, Y, θ) + λ θ Ψ(θ) = true 19/64

20 Our goal: To find bugs and learn a better model min Y,ˆθ s.t. Y Y Ψ(ˆθ) = true ˆθ = argmin l(x, Y, θ) + λ θ θ Θ 20/64

21 Solving combinatorial, bilevel optimization (Stackelberg game) step 1. label to probability simplex step 2. counting to probability mass y i δ i Y Y 1 n n (1 δ i,yi ) i=1 step 3. soften postcondition ˆθ( X) = Ỹ 1 m m l( x i, ỹ i, θ) i=1 21/64

22 Continuous now, but still bilevel argmin δ n,ˆθ s.t. 1 m m l( x i, ỹ i, ˆθ) + γ 1 n i=1 ˆθ = argmin θ 1 n n i=1 j=1 n (1 δ i,yi ) i=1 k δ ij l(x i, j, θ) + λ θ 2 22/64

23 Removing the lower level problem ˆθ = argmin θ step 4. the KKT condition 1 n n 1 n i=1 j=1 n i=1 j=1 k δ ij l(x i, j, θ) + λ θ 2 k δ ij θ l(x i, j, θ) + 2λθ = 0 step 5. plug implicit function θ(δ) into upper level problem argmin δ 1 m m l( x i, ỹ i, θ(δ)) + γ 1 n i=1 n (1 δ i,yi ) i=1 step 6. compute gradient δ with implicit function theorem 23/64

24 Software available. 24/64

25 education education Precision education education education Harry Potter Toy Example magical heritage magical heritage magical heritage data our debugger influence function magical heritage magical heritage DUTI INF NN LND (Oracle) Recall nearest neighbor label noise detection average PR 25/64

26 Adversarial Attacks 26/64

27 Level 1 attack: test item ( x, ỹ) manipulation Model ˆθ fixed. min x x x p s.t. ˆθ(x) ỹ. 27/64

28 Level 2 attack: training set poisoning min D s.t. D 0 D p Ψ(A(D)) e.g. Ψ(θ) := [θ( x + ɛ) = y ] 28/64

29 Level 2 attack on regression Lake Mendota, Wisconsin (x, y) ICE DAYS YEAR 29/64

30 Level 2 attack on regression min δ, β δ p s.t. β1 0 β = argmin (y + δ) Xβ 2 β ICE DAYS original, β 1 = norm attack, β 1 = YEAR ICE DAYS original, β 1 = norm attack, β 1 = YEAR minimize δ 2 2 minimize δ 1 [Mei, Z 15a] 30/64

31 Level 2 attack on latent Dirichlet allocation [Mei, Z 15b] 31/64

32 Guess the classification task Ready? 32/64

33 Guess the classification task (1) 33/64

34 Guess the classification task (2) 34/64

35 Guess the classification task (3) + The Angels won their home opener against the Brewers today before 33,000+ at Anaheim Stadium, 3-1 on a 3-hitter by Mark Lan + I m *very* interested in finding out how I might be able to get two tickets for the All Star game in Baltimore this year. + I know there s been a lot of talk about Jack Morris horrible start, but what about Dennis Martinez. Last I checked he s 0-3 with 6+ E... - Where are all the Bruins fans??? Good point - there haven t even been any recent posts about Ulf! - I agree thouroughly!! Screw the damn contractual agreements! Show the exciting hockey game. They will lose fans of ESPN - TV Coverage - NHL to blame! Give this guy a drug test, and some Ridalin whale you are at it /64

36 Did you get it right? (1) gun vs. phone 36/64

37 Did you get it right? (2) woman vs. man 37/64

38 Did you get it right? (3) 20Newsgroups soc.religion.christian vs. alt.atheism + : T H E W I T N E S S & P R O O F O F : : J E S U S C H R I S T S R E S U R R E C T I O N : : F R O M T H E D E A D : + I ve heard it said that the accounts we have of Christs life and ministry in the Gospels were actually written many years after - An Introduction to Atheism by mathew <mathew@mantis.co.uk> - Computers are an excellent example... of evolution without a creator. 38/64

39 Camouflage attack Social engineering against Eve 39/64

40 Camouflage attack Alice knows S (e.g. women, men) C (e.g. 7, 1) A Eve s inspection function MMD (maximum mean discrepancy) finds argmin D C s.t. (x,y) S l(a(d), x, y) MMD(D, C) α 40/64

41 Test set error baseline1 baseline /1 Error Budget (Gun vs. Phone) camouflaged as (5 vs. 2) 41/64

42 Enhance human learning 42/64

43 Hedging 1. Find D to maximize accuracy on cognitive model A 2. Give humans D either human performance improved or cognitive model A revised 43/64

44 Human learning example 1 [Patil et al. 2014] y= 1 y=1 A = kernel density estimator 0 θ =0.5 1 human trained on human test accuracy random items 69.8% D 72.5% (statistically significant) 44/64

45 Human learning example 2 [Sen et al. in preparation] Lewis space-filling A = neural network human trained on human test error random 28.6% expert 28.1% D 25.1% (statistically significant) 45/64

46 Human learning example 3 [Nosofsky & Sanders, Psychonomics 2017] A = Generalized Context Model (GCM) human trained on human accuracy random 67.2% coverage 71.2% D 69.3% D not better on humans (experts revising the model) 46/64

47 Super Teaching 47/64

48 48/64

49 Super teaching example 1 Let D iid U(0, 1), A(D) =SVM. whole training set O(n 1 ) most symmetrical pair O(n 2 ) (Not training set reduction) 49/64

50 Super teaching example 2 Let D iid N(0, 1), A(D) = 1 D x D x. Theorem: Fix k. For n sufficiently large, with large probablity kk ɛ min A(S) n k ɛ A(D) S D, S =k k 50/64

51 Thank you me for Machine Teaching Tutorial Collaborators: Security: Scott Alfeld, Paul Barford HCI: Saleema Amershi, Bilge Mutlu, Jina Suh Programming language: Aws Albarghouthi, Loris D Antoni, Shalini Ghosh Machine learning: Ran Gilad-Bachrach, Manuel Lopes, Yuzhe Ma, Christopher Meek, Shike Mei, Robert Nowak, Gorune Ohannessian, Philippe Rigollet, Ayon Sen, Patrice Simard, Ara Vartanian, Xuezhou Zhang Optimization: Ji Liu, Stephen Wright Psychology: Bradley Love, Robert Nosofsky, Martina Rau, Tim Rogers 51/64

52 52/64

53 Yet another example: teach Gaussian density T D = d + 1: tetrahedron vertices 53/64

54 education Proposed bugs flipping them makes re-trained model agree with trusted items given to experts to interpret magical heritage 54/64

55 The ML pipeline data (X, Y ) learner l parameters λ model ˆθ ˆθ = argmin l(x, Y, θ) + λ θ θ Θ 55/64

56 Postconditions Examples: Ψ(ˆθ) the learned model must correctly predict an important item ( x, ỹ) ˆθ( x) = ỹ the learned model must satisfy individual fairness x, x, p(y = 1 x, ˆθ) p(y = 1 x, ˆθ) L x x 56/64

57 Bug Assumptions Ψ satisfied if we were to train through clean pipeline bugs are changes to the clean pipeline Ψ violated on the dirty pipeline 57/64

58 Debugging formulation min Y s.t. Y Y ˆθ( X) = Ỹ ˆθ = argmin θ Θ 1 n n l(x i, y i, θ) + λ θ 2 i=1 bilevel optimization (Stackelberg game) combinatorial 58/64

59 pass/fail Another special case: bug in regularization weight (logistic regression) score 59/64

60 Postcondition violated Ψ(ˆθ): Individual fairness (Lipschitz condition) x, x, p(y = 1 x, ˆθ) p(y = 1 x, ˆθ) L x x 60/64

61 Bug assumption Learner s regularization weight λ = was inappropriate ˆθ = argmin l(x, Y, θ) + λ θ 2 θ Θ 61/64

62 Debugging formulation min λ,ˆθ s.t. (λ λ) 2 Ψ(ˆθ) = true ˆθ = argmin l(x, Y, θ) + λ θ 2 θ Θ 62/64

63 pass/fail Suggested bug 1 λ = λ = score 63/64

64 Guaranteed defense? Let A(D 0 )( x) = ỹ Attacker can use the debug formulation D 1 := argmin D s.t. D 0 D p Ψ 1 (A(D)) := A(D)( x) ỹ Defender can use the debug formulation, too D 2 := argmin D s.t. D 1 D p Ψ 2 (A(D)) := A(D)( x) = ỹ When does D 2 = D 0? 64/64