  Despite extensive diagnostics and debugging by developers, AI systems
sometimes exhibit harmful unintended behaviors. Finding and fixing these is
challenging because the attack surface is so large -- it is not tractable to
exhaustively search for inputs that may elicit harmful behaviors. Red-teaming
and adversarial training (AT) are commonly used to improve robustness, however,
they empirically struggle to fix failure modes that differ from the attacks
used during training. In this work, we utilize latent adversarial training
(LAT) to defend against vulnerabilities without generating inputs that elicit
them. LAT leverages the compressed, abstract, and structured latent
representations of concepts that the network actually uses for prediction. We
use it to remove trojans and defend against held-out classes of adversarial
attacks. We show in image classification, text classification, and text
generation tasks that LAT usually improves both robustness to novel attacks and
performance on clean data relative to AT. This suggests that LAT can be a
promising tool for defending against failure modes that are not explicitly
identified by developers.
