SingleProp speeds up robust neural network training with minimal certification.
problem Efficiently defending neural networks against adversarial attacks with certified guarantees.
method SingleProp regularizer that requires only one forward pass per training iteration.
result Comparable certified accuracy to state-of-the-art defenses, but significantly faster training.
This work improves certifiably robust models by distilling knowledge from adversarially robust teachers.
problem Certifiably robust models suffer from poor standard performance.
method Knowledge distillation from adversarially robust teachers to improve standard performance.
result Distillation from adversarially robust teachers consistently improves certified training performance.
Certified training improves robustness against adversarial attacks.
problem Certified training's gap with empirical robustness limits its practical utility.
method Combining adversarial attacks with network over-approximations.
result Certified training can prevent catastrophic overfitting and bridge the gap to multi-step baselines.
Paper proposes faster certified robust training methods with short warmup.
problem Certified robust training methods require long warmup schedules, making training costly.
method Proposes three improvements: new weight initialization, BN, and regularization.
result Achieves 65.03% verified error on CIFAR-10 and 82.36% on TinyImageNet with short warmup.
New regularizers tighten convex relaxation bounds for neural networks.
problem Large gap between certifiable and empirical robustness in neural networks.
method Two regularizers to train neural networks yielding tighter convex relaxation bounds.
result Higher certified accuracy with proposed regularizers.
Improved defense against data poisoning attacks by aggregating smaller subsets.
problem Mitigating the impact of poisoned data on model robustness.
method Finite Aggregation method that combines duplicates of smaller disjoint subsets for training.
result Consistent improvement in certified robustness bounds, up to 4.77% on GTSRB.
One epoch training yields certifiably robust models.
problem Vulnerability of machine learning models to adversarial attacks.
method Deterministic certification approach based on regularized loss.
result Certifiable robust models achieved in one epoch.
New method certifies regression robustness without data distribution assumptions.
problem Certifying robustness of regression models against poisoning attacks.
method Reduces certified regression to certified classification using median decision function.
result Proposes six new provably-robust regression models.
Improved training boosts certified robustness of L-infinity distance nets.
problem Certified robustness of L-infinity distance nets is not as strong as conventional networks.
method Improved training process combining scaled cross-entropy and clipped hinge loss with a decaying mixing coefficient.
result Certified accuracy of L-infinity distance nets improved from 33.30% to 40.06% on CIFAR-10.
This paper proposes a framework for certifying neural network defenses against data poisoning attacks.
problem Vulnerability of neural networks to data poisoning attacks.
method Random selection based defenses that average predictions on sub-datasets sampled from the training set.
result The certified radius of bagging derived by the framework is tighter than previous work.
Adversarial training is one of the most popular ways to learn robust models but is usually attack-dependent and time costly. In this paper, we propose the MACER algorithm, which learns robust models without using adversarial training but performs better than all existing provable l2-defenses. Recent work shows that ran…
This paper provides a comprehensive benchmark and taxonomy for certifiably robust DNN defenses.
problem Certifiably robust defenses against adversarial attacks for deep neural networks.
method Taxonomy and benchmark of certifiably robust approaches.
result First comprehensive benchmark of certifiably robust approaches on different datasets.
Training neural networks to be certifiably robust is critical to ensure their safety against adversarial attacks. However, it is currently very difficult to train a neural network that is both accurate and certifiably robust. In this work we take a step towards addressing this challenge. We prove that for every continu…
CIVET method provides robustness guarantees for VAEs under adversarial attacks.
problem Certified probabilistic guarantees for VAEs in safety-critical applications.
method Bounding worst-case VAE error by error on support sets at the latent layer.
result CIVET outperforms state-of-the-art methods in robustness and standard performance.
New approach detects adversarial samples with certifiable guarantees.
problem Adversarial samples can trick CNNs, posing a threat.
method Certifiable Taboo Trap (CTT) approach to detect adversarial inputs.
result CTT outperforms existing defenses on various lp norms. New method certifies global robustness of neural networks efficiently.
problem Adversarial examples threaten certifiably robust neural networks.
method Formalized global robustness, adapted widely-used architectures with efficient global Lipschitz bounds.
result Certifiable robust models achieve state-of-the-art verifiable accuracy with negligible costs.
New work shows limits of certifying neural network robustness.
problem Certified training improves robustness but decreases accuracy.
method Bayes error analysis to investigate robustness limits.
result Upper bound for certified robust accuracy established.
LOT improves adversarial robustness by training 1-Lipschitz convolution layers.
problem Improving adversarial robustness of deep neural networks.
method LOT: Layer-wise Orthogonal Training for 1-Lipschitz convolution layers.
result LOT significantly enhances certified robustness of Lipschitz-bounded models.
Efficient local Lipschitz bounds improve neural network robustness.
problem Certifying robustness of neural networks is challenging and often leads to over-regularization.
method Proposes an efficient trainable local Lipschitz upper bound by considering activation functions and weight matrices.
result Consistently outperforms state-of-the-art methods in clean and certified accuracy on various datasets.
New techniques extend certified unlearning to deep neural networks.
problem Applying certified unlearning to deep neural networks (DNNs) is challenging due to their nonconvex nature.
method Developed simple techniques and an efficient computation method for nonconvex objectives, considering nonconvergence training and sequential unlearning.
result Demonstrated the efficacy of the method on real-world datasets, showing advantages of certified unlearning in DNNs.
How can we make machine learning provably robust against adversarial examples in a scalable way? Since certified defense methods, which ensure ε-robust, consume huge resources, they can only achieve small degree of robustness in practice. Lipschitz margin training (LMT) is a scalable certified defense, but it can als…
Paper presents certified defenses against adversarial patch attacks.
problem Certified defenses against adversarial patch attacks are needed.
method Proposes the first certified defense and faster training methods.
result Demonstrates robustness transfer across different patch shapes.
Certifiably robust VAEs are trained with bounds on input perturbations.
problem Ensuring VAEs are robust to adversarial attacks.
method Derive bounds on minimal perturbation size, control parameters, and train VAEs to meet criteria.
result Certifiably robust VAEs are more robust to attacks than standard VAEs.
SWEEN improves certified robustness via weighted ensembling of smoothed classifiers.
problem Finding optimal base classifiers for randomized smoothing.
method Smoothed WEighted ENsembling (SWEEN) scheme.
result SWEEN achieves optimal certified robustness under mild assumptions.
Despite their impressive performance on diverse tasks, neural networks fail catastrophically in the presence of adversarial inputs---imperceptibly but adversarially perturbed versions of natural inputs. We have witnessed an arms race between defenders who attempt to train robust networks and attackers who try to constr…
SAFER method certifies robustness to word substitutions without model structure.
problem Certified robustness against synonymous word substitutions in NLP models.
method Randomized smoothing with stochastic ensemble of randomized inputs.
result Significantly outperforms state-of-the-art methods for certified robustness.
Paper aims to ensure reliable detection of out-of-distribution data with certifiable worst-case guarantees.
problem Deep neural networks are overconfident with OOD inputs, posing safety risks.
method Enforces low confidence and bounds in an l∞-ball around OOD points using interval bound propagation (IBP). result Certifiable worst-case guarantees for OOD detection are possible without significant loss in accuracy.
Recent works show that Graph Neural Networks (GNNs) are highly non-robust with respect to adversarial attacks on both the graph structure and the node attributes, making their outcomes unreliable. We propose the first method for certifiable (non-)robustness of graph convolutional networks with respect to perturbations …
New approach to certifiably robust neural networks using Boolean function perspective.
problem Lack of principled understanding and certified robustness for ℓ∞ perturbations. method New perspective on Boolean functions, deriving impossibility results, and developing a unified Lipschitz network.
result Unified Lipschitz network that bypasses expressive power limitations and achieves better certified robustness.
We propose an algorithm to enhance certified robustness of a deep model ensemble by optimally weighting each base model. Unlike previous works on using ensembles to empirically improve robustness, our algorithm is based on optimizing a guaranteed robustness certificate of neural networks. Our proposed ensemble framewor…
Good data stewardship requires removal of data at the request of the data's owner. This raises the question if and how a trained machine-learning model, which implicitly stores information about its training data, should be affected by such a removal request. Is it possible to "remove" data from a machine-learning mode…
Deep Partition Aggregation defends against poisoning attacks with provable certificates.
problem Adversarial poisoning attacks corrupt classifier test-time behavior.
method Deep Partition Aggregation (DPA) is an ensemble method using hash partitions and base models trained on these partitions.
result DPA can certify >= 50% of test images against over 500 poison image insertions on MNIST, and nine insertions on CIFAR-10.
Framework certifies fairness of machine learning models interactively and privately.
problem Certifying fairness of machine learning models in privacy-preserving scenarios.
method Interactive test with cryptographic techniques for fairness certification.
result Empirical evaluation of fairness for various models and definitions.
Unified framework for certifying LLM reliability without extra supervision.
problem Improving reliability of large language models without additional supervision.
method Unified framework using majority voting and Martingale Majority Certificate (MMC).
result Certifiable inference in LLMs with statistical guarantees and adaptive stopping rules.
Unified framework certifies predictor performance under distribution shift.
problem Certifying predictor performance under distribution shift.
method Unified framework with explicit inequalities, sound verification, and identifiable structure.
result Explicit upper bound on excess risk under shift.
Regularization improves robustness of smoothed classifiers.
problem Certifying robustness of smoothed classifiers.
method Regularizing prediction consistency over Gaussian noise.
result Significantly improved certified robustness with less training costs.
New method certifies neural network function space norms from point evaluations.
problem Certifying neural network function space norms from point evaluations alone.
method Combining interval arithmetic enclosures, adaptive marking/refinement, and quadrature-based aggregation.
result Certified computation of Lp, W1,p, and W2,p norms. Deterministic method for certifying neural network robustness.
problem Certifying neural network robustness against adversarial attacks.
method Equivalence between training and Gaussian averaging for robustness certification.
result Comparable certified accuracy and robustness to stochastic methods but with single model evaluation.
New method removes specific training data influence from neural networks.
problem Removing specific training data influence from neural networks for privacy and regulatory reasons.
method Noisy fine-tuning on retain data to ensure provable unlearning guarantees without restrictive assumptions.
result Achieves formal unlearning guarantees and performs effectively in practice.
New method for certified unlearning reduces noise injection.
problem Achieving formal unlearning guarantees with adaptive noise calibration.
method Adaptive per-instance noise calibration based on individual data point sensitivities.
result Derivation of high-probability per-instance sensitivity bounds for ridge regression.
Machine learning algorithms are known to be susceptible to data poisoning attacks, where an adversary manipulates the training data to degrade performance of the resulting classifier. In this work, we present a unifying view of randomized smoothing over arbitrary functions, and we leverage this novel characterization t…
Proposes CRA framework for certifying fair predictive models.
problem Certifying fairness of predictive models trained on biased data.
method Formulates CRA for fairness queries, uses background knowledge and limited target population stats.
result Builds certifiably fair predictive models on target population.
COLEP improves robustness of conformal prediction via probabilistic circuits.
problem Adversarial perturbations can undermine the coverage guarantees of conformal prediction.
method COLEP uses probabilistic circuits to learn and reason about different semantic concepts, providing certifiable coverage guarantees.
result COLEP achieves higher prediction coverage and accuracy than a single model, especially with non-trivial knowledge models.
Despite the exploding interest in graph neural networks there has been little effort to verify and improve their robustness. This is even more alarming given recent findings showing that they are extremely vulnerable to adversarial attacks on both the graph structure and the node attributes. We propose the first method…
New method certifies deep graph classifiers with tighter risk bounds.
problem Certifying the reliability of deep graph classifiers.
method Linearized deep assignment flows with random initial conditions, using PAC-Bayes risk certification.
result Computes tighter out-of-sample risk certificates efficiently.
Paper defends models from backdoor attacks using randomized smoothing.
problem Vulnerability of deep neural networks to backdoor attacks.
method Unified framework via randomized smoothing for both evasion and backdoor attacks; RAB robust training process.
result First provable robustness bound for backdoor attacks.
Neural networks are vulnerable to adversarial examples and researchers have proposed many heuristic attack and defense mechanisms. We address this problem through the principled lens of distributionally robust optimization, which guarantees performance under adversarial input perturbations. By considering a Lagrangian …
New method defends against patch attacks with high-certainty guarantees.
problem Patch attacks on images, especially physical adversarial attacks.
method Randomized smoothing, exploiting patch constraints.
result Meaningfully large robustness certificates against patch attacks.