AIConfPaper
← Search

Soheil Feizi

86 accepted papers

2026

GHOST: Hallucination-Inducing Image Generation for Multimodal LLMs

Aryan Yazdan Parast, Parsa Hosseini, Hesam Asadollahzadeh, Arshia Soltani Moakhar, Basim Azam, Soheil Feizi +1
ICLR 2026poster

Object hallucination in Multimodal Large Language Models (MLLMs) is a persistent failure mode that causes the model to perceive objects absent in the image. This weakness of MLLMs is currently studied using static benchmarks with fixed visual scenarios, which preempts the possibility of uncovering m…

Cited by 0Source ↗code ↗Scholar ↗
2026

Revisiting the Past: Data Unlearning with Model State History

Keivan Rezaei, Mehrdad Saberi, Abhilasha Ravichander, Soheil Feizi
ICLR 2026poster

Large language models are trained on massive corpora of web data, which may include private data, copyrighted material, factually inaccurate data, or data that degrades model performance. Eliminating the influence of such problematic datapoints on a model through complete retraining---by repeatedly…

Cited by 0Source ↗code ↗Scholar ↗
2026

SliderEdit: Continuous Image Editing with Fine-Grained Instruction Control

Arman Zarei, Samyadeep Basu, Mobina Pournemat, Sayan Nag, Ryan A. Rossi, Soheil Feizi
CVPR 2026

Instruction-based image editing models have recently achieved impressive performance, enabling complex edits to an input image from a multi-instruction prompt. However, these models apply each instruction in the prompt with a fixed strength, limiting the user's ability to precisely and continuously

Cited by 0Source ↗code ↗Scholar ↗
2025

A Closer Look at Bias and Chain-of-Thought Faithfulness of Large (Vision) Language Models

Sriram Balasubramanian, Samyadeep Basu, Soheil Feizi
EMNLP 2025

Chain-of-thought (CoT) reasoning enhances performance of large language models, but questions remain about whether these reasoning traces faithfully reflect the internal processes of the model. We present the first comprehensive study of CoT faithfulness in large vision-language models (LVLMs), inve

Cited by 0Source ↗PDF ↗Scholar ↗
2025

A Technical Report on “Erasing the Invisible”: The 2024 NeurIPS Competition on Stress Testing Image Watermarks

Mucong Ding, Bang An, Tahseen Rabbani, Chenghao Deng, Anirudh Satheesh, Souradip Chakraborty +13
NeurIPS 2025poster

AI-generated images have become pervasive, raising critical concerns around content authenticity, intellectual property, and the spread of misinformation. Invisible watermarks offer a promising solution for identifying AI-generated images, preserving content provenance without degrading visual quali…

Cited by 0Source ↗Scholar ↗
2025

Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text

Yize CHENG, Vinu Sankar Sadasivan, Mehrdad Saberi, Shoumik Saha, Soheil Feizi
NeurIPS 2025poster

The increasing capabilities of Large Language Models (LLMs) have raised concerns about their misuse in AI-generated plagiarism and social engineering. While various AI-generated text detectors have been proposed to mitigate these risks, many remain vulnerable to simple evasion techniques such as par…

Cited by 18Source ↗code ↗Scholar ↗
2025

DyePack: Provably Flagging Test Set Contamination in LLMs Using Backdoors

Yize Cheng, Wenxiao Wang, Mazda Moayeri, Soheil Feizi
EMNLP 2025

Open benchmarks are essential for evaluating and advancing large language models, offering reproducibility and transparency. However, their accessibility makes them likely targets of test set contamination. In this work, we introduce **DyePack**, a framework that leverages backdoor attacks to identi

Cited by 0Source ↗PDF ↗code ↗Scholar ↗
2025

How Learnable Grids Recover Fine Detail in Low Dimensions: A Neural Tangent Kernel Analysis of Multigrid Parametric Encodings

Samuel Audia, Soheil Feizi, Matthias Zwicker, Dinesh Manocha
ICLR 2025poster

Neural networks that map between low dimensional spaces are ubiquitous in computer graphics and scientific computing; however, in their naive implementation, they are unable to learn high frequency information. We present a comprehensive analysis comparing the two most common techniques for mitigati…

Cited by 0Source ↗PDF ↗Scholar ↗
2025

Localizing Knowledge in Diffusion Transformers

Arman Zarei, Samyadeep Basu, Keivan Rezaei, Zihao Lin, Sayan Nag, Soheil Feizi
NeurIPS 2025poster

Understanding how knowledge is distributed across the layers of generative models is crucial for improving interpretability, controllability, and adaptation. While prior work has explored knowledge localization in UNet-based architectures, Diffusion Transformer (DiT)-based models remain underexplore…

Cited by 0Source ↗Scholar ↗
2025

RePanda: Pandas-powered Tabular Verification and Reasoning

Atoosa Chegini, Keivan Rezaei, Hamid Eghbalzadeh, Soheil Feizi
ACL 2025long

Fact-checking tabular data is essential for ensuring the accuracy of structured information in domains such as journalism, finance, and scientific research. However, existing methods often rely on black-box models with opaque reasoning. We introduce RePanda, a structured fact verification approach t…

Cited by 0Source ↗PDF ↗code ↗Scholar ↗
2025

Rethinking Artistic Copyright Infringements In the Era Of Text-to-Image Generative Models

Mazda Moayeri, Sriram Balasubramanian, Samyadeep Basu, Priyatham Kattakinda, Atoosa Chegini, Robert Brauneis +1
ICLR 2025poster

The advent of text-to-image generative models has led artists to worry that their individual styles may be copied, creating a pressing need to reconsider the lack of protection for artistic styles under copyright law. This requires answering challenging questions, like what defines style and what co…

Cited by 4Source ↗PDF ↗Scholar ↗
2025

Tool Preferences in Agentic LLMs are Unreliable

Kazem Faghih, Wenxiao Wang, Yize Cheng, Siddhant Bharti, Gaurang Sriramanan, Sriram Balasubramanian +2
EMNLP 2025

Large language models (LLMs) can now access a wide range of external tools, thanks to the Model Context Protocol (MCP). This greatly expands their abilities as various agents. However, LLMs rely entirely on the text descriptions of tools to decide which ones to use—a process that is surprisingly fra

Cited by 0Source ↗PDF ↗code ↗Scholar ↗
2025

Unearthing Skill-level Insights for Understanding Trade-offs of Foundation Models

Mazda Moayeri, Vidhisha Balachandran, Varun Chandrasekaran, Safoora Yousefi, Thomas FEL, Soheil Feizi +3
ICLR 2025poster

With models getting stronger, evaluations have grown more complex, testing multiple skills in one benchmark and even in the same instance at once. However, skill-wise performance is obscured when inspecting aggregate accuracy, under-utilizing the rich signal modern benchmarks contain. We propose an…

Cited by 2Source ↗PDF ↗Scholar ↗
2024

DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness

Shoumik Saha, Wenxiao Wang, Yigitcan Kaya, Soheil Feizi, Tudor Dumitras
ICLR 2024poster

Machine Learning (ML) models have been utilized for malware detection for over two decades. Consequently, this ignited an ongoing arms race between malware authors and antivirus systems, compelling researchers to propose defenses for malware-detection models against evasion attacks. However, most if…

Cited by 3Source ↗PDF ↗code ↗Scholar ↗
2024

Decomposing and Interpreting Image Representations via Text in ViTs Beyond CLIP

Sriram Balasubramanian, Samyadeep Basu, Soheil Feizi
NeurIPS 2024poster

Recent work has explored how individual components of the CLIP-ViT model contribute to the final representation by leveraging the shared image-text representation space of CLIP. These components, such as attention heads and MLPs, have been shown to capture distinct image features like shape, color…

Cited by 3Source ↗PDF ↗code ↗Scholar ↗
2024

Distilling Knowledge from Text-to-Image Generative Models Improves Visio-Linguistic Reasoning in CLIP

Samyadeep Basu, Shell Xu Hu, Maziar Sanjabi, Daniela Massiceti, Soheil Feizi
EMNLP 2024main

Image-text contrastive models like CLIP have wide applications in zero-shot classification, image-text retrieval, and transfer learning. However, they often struggle on compositional visio-linguistic tasks (e.g., attribute-binding or object-relationships) where their performance is no better than ra…

Cited by 1Source ↗PDF ↗Scholar ↗
2024

Fast Adversarial Attacks on Language Models In One GPU Minute

Vinu Sankar Sadasivan, Shoumik Saha, Gaurang Sriramanan, Priyatham Kattakinda, Atoosa Chegini, Soheil Feizi
ICML 2024poster

In this paper, we introduce a novel class of fast, beam search-based adversarial attack (BEAST) for Language Models (LMs). BEAST employs interpretable parameters, enabling attackers to balance between attack speed, success rate, and the readability of adversarial prompts. The computational efficienc…

Cited by 27Source ↗PDF ↗code ↗Scholar ↗
2024

IntCoOp: Interpretability-Aware Vision-Language Prompt Tuning

Soumya Suvra Ghosal, Samyadeep Basu, Soheil Feizi, Dinesh Manocha
EMNLP 2024main

Image-text contrastive models such as CLIP learn transferable and robust representations for zero-shot transfer to a variety of downstream tasks. However, to obtain strong downstream performances, prompts need to be carefully curated, which can be a tedious engineering task. To address the issue of…

Cited by 2Source ↗PDF ↗Scholar ↗
2024

LLM-Check: Investigating Detection of Hallucinations in Large Language Models

Gaurang Sriramanan, Siddhant Bharti, Vinu Sankar Sadasivan, Shoumik Saha, Priyatham Kattakinda, Soheil Feizi
NeurIPS 2024poster

While Large Language Models (LLMs) have become immensely popular due to their outstanding performance on a broad range of tasks, these models are prone to producing hallucinations— outputs that are fallacious or fabricated yet often appear plausible or tenable at a glance. In this paper, we conduct…

Cited by 143Source ↗PDF ↗Scholar ↗
2024

Localizing and Editing Knowledge In Text-to-Image Generative Models

Samyadeep Basu, Nanxuan Zhao, Vlad I Morariu, Soheil Feizi, Varun Manjunatha
ICLR 2024poster

Text-to-Image Diffusion Models such as Stable-Diffusion and Imagen have achieved unprecedented quality of photorealism with state-of-the-art FID scores on MS-COCO and other generation benchmarks. Given a caption, image generation requires fine-grained knowledge about attributes such as object struct…

Cited by 21Source ↗PDF ↗Scholar ↗
2024

Loki: Low-rank Keys for Efficient Sparse Attention

Prajwal Singhania, Siddharth Singh, Shwai He, Soheil Feizi, Abhinav Bhatele
NeurIPS 2024poster

Inference on large language models (LLMs) can be expensive in terms of the compute and memory costs involved, especially when long sequence lengths are used. In particular, the self-attention mechanism used in LLM inference contributes significantly to these costs, which has sparked an interest in a…

Cited by 20Source ↗PDF ↗code ↗Scholar ↗
2024

Measuring Self-Supervised Representation Quality for Downstream Classification Using Discriminative Features

Neha Kalibhat, Kanika Narang, Hamed Firooz, Maziar Sanjabi, Soheil Feizi
AAAI 2024technical

Self-supervised learning (SSL) has shown impressive results in downstream classification tasks. However, there is limited work in understanding their failure modes and interpreting their learned representations. In this paper, we study the representation space of state-of-the-art self-supervised mod…

Cited by 7Source ↗PDF ↗Scholar ↗
2024

On Mechanistic Knowledge Localization in Text-to-Image Generative Models

Samyadeep Basu, Keivan Rezaei, Priyatham Kattakinda, Vlad I Morariu, Nanxuan Zhao, Ryan A. Rossi +2
ICML 2024poster

Identifying layers within text-to-image models which control visual attributes can facilitate efficient model editing through closed-form updates. Recent work, leveraging causal tracing show that early Stable-Diffusion variants confine knowledge primarily to the first layer of the CLIP text-encoder,…

Cited by 14Source ↗PDF ↗code ↗Scholar ↗
2024

PRIME: Prioritizing Interpretability in Failure Mode Extraction

Keivan Rezaei, Mehrdad Saberi, Mazda Moayeri, Soheil Feizi
ICLR 2024poster

In this work, we study the challenge of providing human-understandable descriptions for failure modes in trained image classification models. Existing works address this problem by first identifying clusters (or directions) of incorrectly classified samples in a latent space and then aiming to provi…

Cited by 4Source ↗PDF ↗Scholar ↗
2024

Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks

Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang +1
ICLR 2024poster

In light of recent advancements in generative AI models, it has become essential to distinguish genuine content from AI-generated one to prevent the malicious usage of fake materials as authentic ones and vice versa. Various techniques have been introduced for identifying AI-generated images, with w…

Cited by 47Source ↗PDF ↗code ↗Scholar ↗
2024

Strong Baselines for Parameter-Efficient Few-Shot Fine-Tuning

Samyadeep Basu, Shell Hu, Daniela Massiceti, Soheil Feizi
AAAI 2024technical

Few-shot classification (FSC) entails learning novel classes given only a few examples per class after a pre-training (or meta-training) phase on a set of base classes. Recent works have shown that simply fine-tuning a pre-trained Vision Transformer (ViT) on new test classes is a strong approach for…

Cited by 31Source ↗PDF ↗Scholar ↗
2024

Understanding Information Storage and Transfer in Multi-Modal Large Language Models

Samyadeep Basu, Martin Grayson, Cecily Morrison, Besmira Nushi, Soheil Feizi, Daniela Massiceti
NeurIPS 2024poster

Understanding the mechanisms of information storage and transfer in Transformer-based models is important for driving model understanding progress. Recent work has studied these mechanisms for Large Language Models (LLMs), revealing insights on how information is stored in a model's parameters and h…

Cited by 12Source ↗PDF ↗Scholar ↗
2023

Certifiably Robust Policy Learning against Adversarial Multi-Agent Communication

Yanchao Sun, Ruijie Zheng, Parisa Hassanzadeh, Yongyuan Liang, Soheil Feizi, Sumitra Ganesh +1
ICLR 2023poster

Communication is important in many multi-agent reinforcement learning (MARL) problems for agents to share information and make good decisions. However, when deploying trained communicative agents in a real-world application where noise and potential attackers exist, the safety of communication-based…

Cited by 21Source ↗PDF ↗Scholar ↗
2023

Diffused Redundancy in Pre-trained Representations

Vedant Nanda, Till Speicher, John P Dickerson, Krishna P. Gummadi, Soheil Feizi, Adrian Weller
NeurIPS 2023poster

Representations learned by pre-training a neural network on a large dataset are increasingly used successfully to perform a variety of downstream tasks. In this work, we take a closer look at how features are encoded in such pre-trained representations. We find that learned representations in a give…

Cited by 2Source ↗PDF ↗code ↗Scholar ↗
2023

Exploring Geometry of Blind Spots in Vision models

Sriram Balasubramanian, Gaurang Sriramanan, Vinu Sankar Sadasivan, Soheil Feizi
NeurIPS 2023spotlight

Despite the remarkable success of deep neural networks in a myriad of settings, several works have demonstrated their overwhelming sensitivity to near-imperceptible perturbations, known as adversarial attacks. On the other hand, prior works have also observed that deep networks can be under-sensitiv…

Cited by 2Source ↗PDF ↗code ↗Scholar ↗
2023

Hard-Meta-Dataset++: Towards Understanding Few-Shot Performance on Difficult Tasks

Samyadeep Basu, Megan Stanley, John F Bronskill, Soheil Feizi, Daniela Massiceti
ICLR 2023poster

Few-shot classification is the ability to adapt to any new classification task from only a few training examples. The performance of current top-performing few-shot classifiers varies widely across different tasks where they often fail on a subset of `difficult' tasks. This phenomenon has real-world…

Cited by 6Source ↗PDF ↗Scholar ↗
2023

Identifying Interpretable Subspaces in Image Representations

Neha Kalibhat, Shweta Bhardwaj, C. Bayan Bruss, Hamed Firooz, Maziar Sanjabi, Soheil Feizi
ICML 2023poster

We propose Automatic Feature Explanation using Contrasting Concepts (FALCON), an interpretability framework to explain features of image representations. For a target feature, FALCON captions its highly activating cropped images using a large captioning dataset (like LAION-400m) and a pre-trained vi…

Cited by 24Source ↗PDF ↗code ↗Scholar ↗
2023

Provable Robustness against Wasserstein Distribution Shifts via Input Randomization

Aounon Kumar, Alexander Levine, Tom Goldstein, Soheil Feizi
ICLR 2023poster

Certified robustness in machine learning has primarily focused on adversarial perturbations with a fixed attack budget for each sample in the input distribution. In this work, we present provable robustness guarantees on the accuracy of a model under bounded Wasserstein shifts of the data distributi…

Cited by 7Source ↗PDF ↗Scholar ↗
2023

Run-off Election: Improved Provable Defense against Data Poisoning Attacks

Keivan Rezaei, Kiarash Banihashem, Atoosa Chegini, Soheil Feizi
ICML 2023poster

In data poisoning attacks, an adversary tries to change a model's prediction by adding, modifying, or removing samples in the training data. Recently, *ensemble-based* approaches for obtaining *provable* defenses against data poisoning have been proposed where predictions are done by taking a majori…

Cited by 17Source ↗PDF ↗Scholar ↗
2023

Spuriosity Rankings: Sorting Data to Measure and Mitigate Biases

Mazda Moayeri, Wenxiao Wang, Sahil Singla, Soheil Feizi
NeurIPS 2023spotlight

We present a simple but effective method to measure and mitigate model biases caused by reliance on spurious cues. Instead of requiring costly changes to one's data or model training, our method better utilizes the data one already has by sorting them. Specifically, we rank images within their class…

Cited by 15Source ↗PDF ↗Scholar ↗
2022

A Comprehensive Study of Image Classification Model Sensitivity to Foregrounds, Backgrounds, and Visual Attributes

Mazda Moayeri, Phillip Pope, Yogesh Balaji, Soheil Feizi
CVPR 2022oral

While datasets with single-label supervision have propelled rapid advances in image classification, additional annotations are necessary in order to quantitatively assess how models make predictions. To this end, for a subset of ImageNet samples, we collect segmentation masks for the entire object a…

Cited by 63PDF ↗code ↗Scholar ↗
2022

Explicit Tradeoffs between Adversarial and Natural Distributional Robustness

Mazda Moayeri, Kiarash Banihashem, Soheil Feizi
NeurIPS 2022accept

Several existing works study either adversarial or natural distributional robustness of deep neural networks separately. In practice, however, models need to enjoy both types of robustness to ensure reliability. In this work, we bridge this gap and show that in fact, {\it explicit tradeoffs} exist b…

Cited by 25Source ↗PDF ↗Scholar ↗
2022

Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation

Wenxiao Wang, Alexander J Levine, Soheil Feizi
ICML 2022spotlight

Data poisoning attacks aim at manipulating model behaviors through distorting training data. Previously, an aggregation-based certified defense, Deep Partition Aggregation (DPA), was proposed to mitigate this threat. DPA predicts through an aggregation of base classifiers trained on disjoint subsets…

Cited by 73Source ↗PDF ↗code ↗Scholar ↗
2022

Improved deterministic l2 robustness on CIFAR-10 and CIFAR-100

Sahil Singla, Surbhi Singla, Soheil Feizi
ICLR 2022spotlight

Training convolutional neural networks (CNNs) with a strict Lipschitz constraint under the $l_{2}$ norm is useful for provable adversarial robustness, interpretable gradients and stable training. While $1$-Lipschitz CNNs can be designed by enforcing a $1$-Lipschitz constraint on each layer, training…

Cited by 73Source ↗PDF ↗code ↗Scholar ↗
2022

Segment and Complete: Defending Object Detectors Against Adversarial Patch Attacks With Robust Patch Detection

Jiang Liu, Alexander Levine, Chun Pong Lau, Rama Chellappa, Soheil Feizi
CVPR 2022poster

Object detection plays a key role in many security-critical systems. Adversarial patch attacks, which are easy to implement in the physical world, pose a serious threat to state-of-the-art object detectors. Developing reliable defenses for object detectors against patch attacks is critical but sever…

Cited by 111PDF ↗code ↗Scholar ↗
2022

Toward Efficient Robust Training against Union of $\ell_p$ Threat Models

Gaurang Sriramanan, Maharshi Gor, Soheil Feizi
NeurIPS 2022accept

The overwhelming vulnerability of deep neural networks to carefully crafted perturbations known as adversarial attacks has led to the development of various training techniques to produce robust models. While the primary focus of existing approaches has been directed toward addressing the worst-case…

Cited by 4Source ↗PDF ↗Scholar ↗
2021

Deep Partition Aggregation: Provable Defenses against General Poisoning Attacks

Alexander Levine, Soheil Feizi
ICLR 2021poster

Adversarial poisoning attacks distort training data in order to corrupt the test-time behavior of a classifier. A provable defense provides a certificate for each test sample, which is a lower bound on the magnitude of any adversarial distortion of the training set that can corrupt the test sample's…

Cited by 167Source ↗PDF ↗code ↗Scholar ↗
2021

Fantastic Four: Differentiable and Efficient Bounds on Singular Values of Convolution Layers

Sahil Singla, Soheil Feizi
ICLR 2021poster

In deep neural networks, the spectral norm of the Jacobian of a layer bounds the factor by which the norm of a signal changes during forward/backward propagation. Spectral norm regularizations have been shown to improve generalization, robustness and optimization of deep learning methods. Existing m…

Cited by 41Source ↗PDF ↗Scholar ↗
2021

GANs with Conditional Independence Graphs: On Subadditivity of Probability Divergences

Mucong Ding, Constantinos Daskalakis, Soheil Feizi
AISTATS 2021poster

Generative Adversarial Networks (GANs) are modern methods to learn the underlying distribution of a data set. GANs have been widely used in sample synthesis, de-noising, domain transfer, etc. GANs, however, are designed in a model-free fashion where no additional information about the underlying dis…

Cited by 10Source ↗PDF ↗Scholar ↗
2021

Improving Deep Learning Interpretability by Saliency Guided Training

Aya Abdelsalam Ismail, Hector Corrada Bravo, Soheil Feizi
NeurIPS 2021poster

Saliency methods have been widely used to highlight important input features in model predictions. Most existing methods use backpropagation on a modified gradient function to generate saliency maps. Thus, noisy gradients can result in unfaithful feature attributions. In this paper, we tackle this i…

Cited by 99Source ↗PDF ↗code ↗Scholar ↗
2021

Low Curvature Activations Reduce Overfitting in Adversarial Training

Vasu Singla, Sahil Singla, Soheil Feizi, David Jacobs
ICCV 2021poster

Adversarial training is one of the most effective defenses against adversarial attacks. Previous works suggest that overfitting is a dominant phenomenon in adversarial training leading to a large generalization gap between test and train accuracy in neural networks. In this work, we show that the ob…

Cited by 58PDF ↗code ↗Scholar ↗
2021

Perceptual Adversarial Robustness: Defense Against Unseen Threat Models

Cassidy Laidlaw, Sahil Singla, Soheil Feizi
ICLR 2021poster

A key challenge in adversarial robustness is the lack of a precise mathematical characterization of human perception, used in the definition of adversarial attacks that are imperceptible to human eyes. Most current attacks and defenses try to get around this issue by considering restrictive adversar…

Cited by 249Source ↗PDF ↗code ↗Scholar ↗
2021

Sample Efficient Detection and Classification of Adversarial Attacks via Self-Supervised Embeddings

Mazda Moayeri, Soheil Feizi
ICCV 2021poster

Adversarial robustness of deep models is pivotal in ensuring safe deployment in real world settings, but most modern defenses have narrow scope and expensive costs. In this paper, we propose a self-supervised method to detect adversarial attacks and classify them to their respective threat models, b…

Cited by 31PDF ↗Scholar ↗
2021

Understanding Over-parameterization in Generative Adversarial Networks

Yogesh Balaji, Mohammadmahdi Sajedi, Neha Mukund Kalibhat, Mucong Ding, Dominik Stöger, Mahdi Soltanolkotabi +1
ICLR 2021poster

A broad class of unsupervised deep learning methods such as Generative Adversarial Networks (GANs) involve training of overparameterized models where the number of parameters of the model exceeds a certain threshold. Indeed, most successful GANs used in practice are trained using overparameterized g…

Cited by 37Source ↗PDF ↗Scholar ↗
2021

Unsupervised anomaly detection with adversarial mirrored autoencoders

Gowthami Somepalli, Yexin Wu, Yogesh Balaji, Bhanukiran Vinzamuri, Soheil Feizi
UAI 2021poster

Detecting out-of-distribution (OOD) samples is of paramount importance in all Machine Learning applications. Deep generative modeling has emerged as a dominant paradigm to model complex data distributions without labels. However, prior work has shown that generative models tend to assign higher like…

Cited by 16Source ↗PDF ↗code ↗Scholar ↗
2020

(De)Randomized Smoothing for Certifiable Defense against Patch Attacks

Alexander Levine, Soheil Feizi
NeurIPS 2020poster

Patch adversarial attacks on images, in which the attacker can distort pixels within a region of bounded size, are an important threat model since they provide a quantitative model for physical adversarial attacks. In this paper, we introduce a certifiable defense against patch attacks that guarante…

Cited by 63Source ↗PDF ↗code ↗Scholar ↗
2020

Benchmarking Deep Learning Interpretability in Time Series Predictions

Aya Abdelsalam Ismail, Mohamed Gunady, Hector Corrada Bravo, Soheil Feizi
NeurIPS 2020poster

Saliency methods are used extensively to highlight the importance of input features in model predictions. These methods are mostly used in vision and language tasks, and their applications to time series data is relatively unexplored. In this paper, we set out to extensively compare the performance…

Cited by 244Source ↗PDF ↗code ↗Scholar ↗
2020

Certifying Confidence via Randomized Smoothing

Aounon Kumar, Alexander Levine, Soheil Feizi, Tom Goldstein
NeurIPS 2020poster

Randomized smoothing has been shown to provide good certified-robustness guarantees for high-dimensional classification problems. It uses the probabilities of predicting the top two most-likely classes around an input point under a smoothing distribution to generate a certified radius for a classifi…

Cited by 47Source ↗PDF ↗code ↗Scholar ↗
2020

Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness

Aounon Kumar, Alexander Levine, Tom Goldstein, Soheil Feizi
ICML 2020poster

Randomized smoothing, using just a simple isotropic Gaussian distribution, has been shown to produce good robustness guarantees against $\ell_2$-norm bounded adversaries. In this work, we show that extending the smoothing technique to defend against other attack models can be challenging, especially…

Cited by 110Source ↗PDF ↗code ↗Scholar ↗
2020

Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attacks

Wei-An Lin, Chun Pong Lau, Alexander Levine, Rama Chellappa, Soheil Feizi
NeurIPS 2020poster

Adversarial training is a popular defense strategy against attack threat models with bounded Lp norms. However, it often degrades the model performance on normal images and more importantly, the defense does not generalize well to novel attacks. Given the success of deep generative models such as GA…

Cited by 70Source ↗PDF ↗Scholar ↗
2020

Robust Optimal Transport with Applications in Generative Modeling and Domain Adaptation

Yogesh Balaji, Rama Chellappa, Soheil Feizi
NeurIPS 2020poster

Optimal Transport (OT) distances such as Wasserstein have been used in several areas such as GANs and domain adaptation. OT, however, is very sensitive to outliers (samples with large noise) in the data since in its objective function, every sample, including outliers, is weighed similarly due to th…

Cited by 130Source ↗PDF ↗code ↗Scholar ↗
2020

Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attacks

Alexander Levine, Soheil Feizi
AISTATS 2020poster

In the last couple of years, several adversarial attack methods based on different threat models have been proposed for the image classification problem. Most existing defenses consider additive threat models in which sample perturbations have bounded L_p norms. These defenses, however, can be vulne…

Cited by 66Source ↗PDF ↗Scholar ↗
2019

Entropic GANs meet VAEs: A Statistical Approach to Compute Sample Likelihoods in GANs

Yogesh Balaji, Hamed Hassani, Rama Chellappa, Soheil Feizi
ICML 2019oral

Building on the success of deep learning, two modern approaches to learn a probability model from the data are Generative Adversarial Networks (GANs) and Variational AutoEncoders (VAEs). VAEs consider an explicit probability model for the data and compute a generative distribution by maximizing a va…

Cited by 27Source ↗PDF ↗code ↗Scholar ↗
2019

Input-Cell Attention Reduces Vanishing Saliency of Recurrent Neural Networks

Aya Abdelsalam Ismail, Mohamed Gunady, Luiz Pessoa, Hector Corrada Bravo, Soheil Feizi
NeurIPS 2019poster

Recent efforts to improve the interpretability of deep neural networks use saliency to characterize the importance of input features to predictions made by models. Work on interpretability using saliency-based methods on Recurrent Neural Networks (RNNs) has mostly targeted language tasks, and their…

Cited by 66Source ↗PDF ↗code ↗Scholar ↗
2019

Normalized Wasserstein for Mixture Distributions With Applications in Adversarial Learning and Domain Adaptation

Yogesh Balaji, Rama Chellappa, Soheil Feizi
ICCV 2019poster

Understanding proper distance measures between distributions is at the core of several learning tasks such as generative models, domain adaptation, clustering, etc. In this work, we focus on mixture distributions that arise naturally in several application domains where the data contains different s…

Cited by 53PDF ↗Scholar ↗
2019

Quantum Wasserstein Generative Adversarial Networks

Shouvanik Chakrabarti, Huang Yiming, Tongyang Li, Soheil Feizi, Xiaodi Wu
NeurIPS 2019poster

The study of quantum generative models is well-motivated, not only because of its importance in quantum machine learning and quantum chemistry but also because of the perspective of its implementation on near-term quantum machines. Inspired by previous studies on the adversarial training of classica…

Cited by 131Source ↗PDF ↗code ↗Scholar ↗
2019

Understanding Impacts of High-Order Loss Approximations and Features in Deep Learning Interpretation

Sahil Singla, Eric Wallace, Shi Feng, Soheil Feizi
ICML 2019oral

Current saliency map interpretations for neural networks generally rely on two key assumptions. First, they use first-order approximations of the loss function, neglecting higher-order terms such as the loss curvature. Second, they evaluate each feature’s importance in isolation, ignoring feature in…

Cited by 64Source ↗PDF ↗code ↗Scholar ↗
2018

Porcupine Neural Networks: Approximating Neural Network Landscapes

Soheil Feizi, Hamid Javadi, Jesse Zhang, David Tse
NeurIPS 2018poster

Neural networks have been used prominently in several machine learning and statistics applications. In general, the underlying optimization of neural networks is non-convex which makes analyzing their performance challenging. In this paper, we take another approach to this problem by constraining th…

Cited by 6Source ↗PDF ↗code ↗Scholar ↗