Lei Hsiung

selected publications

1. 

   Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations

   Lei Hsiung, Yun-Yun Tsai, Pin-Yu Chen, and Tsung-Yi Ho

   In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2023)

   Abs arXiv Code

   Model robustness against adversarial examples of single perturbation type such as the \(\ell_p\)-norm has been widely studied, yet its generalization to more realistic scenarios involving multiple semantic perturbations and their composition remains largely unexplored. In this paper, we first propose a novel method for generating composite adversarial examples. Our method can find the optimal attack composition by utilizing component-wise projected gradient descent and automatic attack-order scheduling. We then propose generalized adversarial training (GAT) to extend model robustness from \(\ell_p\)-ball to composite semantic perturbations, such as the combination of Hue, Saturation, Brightness, Contrast, and Rotation. Results obtained using ImageNet and CIFAR-10 datasets indicate that GAT can be robust not only to all the tested types of a single attack, but also to any combination of such attacks. GAT also outperforms baseline \(\ell_∞\)-norm bounded adversarial training approaches by a significant margin.

2. 

   A Lab-Based Investigation of Reaction Time and Reading Performance Using Different In-Vehicle Reading Interfaces during Self-Driving

   Lei Hsiung, Yung-Ju Chang, Wei-Ko Li, Tsung-Yi Ho, and Shan-Hung Wu

   In Proceedings of the 14th International ACM Conference on Automotive User Interfaces and Interactive Vehicular Applications, AutomotiveUI (2022)

   Abs PDF

   The demand for autonomous vehicles (AVs) is rapidly growing these years. As AVs have a potential to free drivers’ cognitive resources from driving to other tasks, reading is one of the common activities users conduct in travel multitasking. Nevertheless, ways to supporting reading in AVs have been little explored. To fill this gap, we explored the design of an in-vehicle reader on a windshield in AVs along three dimensions: dynamics, position, and text segmentation. We conducted two in-lab within-subject experiments to examine the eight kinds of in-car reading modalities that represented the combinations of the three dimensions in terms of drivers’ reaction time and reading comprehension. Our results show a case where an adaptive positioning would be particularly beneficial for supporting reading in AVs. And our general suggestion is to use a static reading zone presented on-sky and in sentences because it leads to faster reaction and better reading comprehension.

3. 

   NeuralFuse: Improving the Accuracy of Access-Limited Neural Network Inference in Low-Voltage Regimes

   Hao-Lun Sun,  Lei Hsiung, Nandhini Chandramoorthy, Pin-Yu Chen, and Tsung-Yi Ho

   Under Review. Preliminary version in NeurIPS workshop. (2022)

   Abs PDF Code Poster

   Deep neural networks (DNNs) are state-of-the-art models adopted in many machine learning based systems and algorithms. However, a notable issue of DNNs is their considerable energy consumption for training and inference. At the hardware level, one current energy-saving solution at the inference phase is to reduce the voltage supplied to the DNN hardware accelerator. However, operating in the low-voltage regime would induce random bit errors saved in the memory and thereby degrade the model performance. To address this challenge, we propose , a novel input transformation technique as an add-on module, to protect the model from severe accuracy drops in low-voltage regimes. With NeuralFuse, we can mitigate the tradeoff between energy and accuracy without retraining the model, and it can be readily applied to DNNs with limited access, such as DNNs on non-configurable hardware or remote access to cloud-based APIs. Compared with unprotected DNNs, our experimental results show that NeuralFuse can reduce memory access energy up to 24% and simultaneously improve the accuracy in low-voltage regimes up to an increase of 57%. To the best of our knowledge, this is the first model-agnostic approach (i.e., no model retraining) to mitigate the accuracy-energy tradeoff in low-voltage regimes.

4. 

   NCTV: Neural Clamping Toolkit and Visualization for Neural Network Calibration

   Lei Hsiung, Yung-Chen Tang, Pin-Yu Chen, and Tsung-Yi Ho

   In Proceedings of the 37th AAAI Conference on Artificial Intelligence Demo Track, AAAI (2023)

   Abs arXiv Demo

   With the advancement of deep learning technology, neural networks have demonstrated their excellent ability to provide accurate predictions in many tasks. However, a lack of consideration for neural network calibration will not gain trust from humans, even for high-accuracy models. In this regard, the gap between the confidence of the model’s predictions and the actual correctness likelihood must be bridged to derive a well-calibrated model. In this paper, we introduce the Neural Clamping Toolkit, the first open-source framework designed to help developers employ state-of-the-art model-agnostic calibrated models. Furthermore, we provide animations and interactive sections in the demonstration to familiarize researchers with calibration in neural networks. A Colab tutorial on utilizing our toolkit is also introduced.

5. 

   CARBEN: Composite Adversarial Robustness Benchmark

   Lei Hsiung, Yun-Yun Tsai, Pin-Yu Chen, and Tsung-Yi Ho

   In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence Demo Track, IJCAI (2022)

   Abs arXiv Demo Poster

   Prior literature on adversarial attack methods has mainly focused on attacking with and defending against a single threat model, e.g., perturbations bounded in Lp ball. However, multiple threat models can be combined into composite perturbations. One such approach, composite adversarial attack (CAA), not only expands the perturbable space of the image, but also may be overlooked by current modes of robustness evaluation. This paper demonstrates how CAA’s attack order affects the resulting image, and provides real-time inferences of different models, which will facilitate users’ configuration of the parameters of the attack level and their rapid evaluation of model prediction. A leaderboard to benchmark adversarial robustness against CAA is also introduced.