Algorithm finds a nearly correct solution even when more than half of the data is corrupted.
problem Robust regression in the presence of a large fraction of adversarially corrupted data.
method List-decodable learning framework based on sum-of-squares method.
result Polynomial-time algorithm that outputs a small list of potential solutions.
Improved subspace recovery algorithm with dimension-independent error and polynomial time.
problem Efficiently recover a covariance matrix from a mix of inliers and adversarial outliers.
method List-decodable subspace recovery algorithm with faster fixed-polynomial time and less restrictive distributional assumptions.
result Achieved dimension-independent error guarantee of O(1/α) with poly(1/α d^O(1)) time complexity.
New method certifies anti-concentration for various non-Gaussian distributions.
problem Efficiently certifying anti-concentration for non-Gaussian distributions.
method Sum-of-Squares relaxation of integer program for anti-concentration.
result Quasi-polynomial time certificates for non-Gaussian distributions.
Robustly clusters mixtures of Gaussians even with outliers.
problem Clustering mixtures of statistically separated Gaussians robustly to outliers.
method Uses certifiable hypercontractivity, bounded variance, and anti-concentration of linear projections.
result First efficient algorithm for robust clustering of statistically separated Gaussians mixtures.
Algorithm learns Gaussian mixtures robust to outliers.
problem Efficiently learn high-dimensional Gaussian mixtures with outliers.
method Sum-of-Squares based proofs to algorithms approach.
result Polynomial time algorithm for k k k -mixture with pairwise separated components. Study provides bounds for estimating intrinsic dimension using Gaussian kernels.
problem Estimating intrinsic dimension from data.
method Finite-sample concentration and anti-concentration bounds for Gaussian kernel sums.
result Explicit dependence on sample size, bandwidth, and geometric parameters.
Greedy algorithm achieves sublinear regret for various distributions.
problem Efficient performance of greedy algorithms in linear contextual bandit problems.
method Introduced Local Anti-Concentration (LAC) condition to ensure sublinear regret.
result Greedy algorithm achieves O ( poly log T ) O(\operatorname{poly} \log T) O ( poly log T ) cumulative expected regret. Robustly learns Ising models with corrupted data.
problem Learning Ising models corrupted by a constant fraction of adversarial samples.
method Develops a computationally efficient algorithm for robust learning.
result First near-optimal error guarantees for robust learning of Ising models.
Algorithm learns halfspaces in noisy data efficiently.
problem Learning halfspaces with Tsybakov noise.
method Novel semi-definite programming and online convex optimization.
result First non-trivial PAC learning algorithm for Tsybakov noise.
Low-degree method fails to predict robust subspace recovery problem.
problem Predicting computational tractability of robust subspace recovery problem.
method Low-degree polynomial framework, anti-concentration properties.
result Low-degree method fails to predict computational tractability of robust subspace recovery problem even up to high degree.
New method certifies regression robustness without data distribution assumptions.
problem Certifying robustness of regression models against poisoning attacks.
method Reduces certified regression to certified classification using median decision function.
result Proposes six new provably-robust regression models.
SingleProp speeds up robust neural network training with minimal certification.
problem Efficiently defending neural networks against adversarial attacks with certified guarantees.
method SingleProp regularizer that requires only one forward pass per training iteration.
result Comparable certified accuracy to state-of-the-art defenses, but significantly faster training.
New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
BagCert efficiently certifies robustness against adversarial patches on image classifiers.
problem Adversarial patches pose a threat to autonomous systems' perception component.
method BagCert combines model architecture and certification procedure for efficient inference.
result BagCert certifies 10,000 examples in 43 seconds on a single GPU, achieving 86% clean and 60% certified accuracy against 5x5 patches.
Certified robustness for ImageNet models with randomized smoothing.
problem Creating robust models against adversarial attacks.
method Randomized smoothing with Gaussian noise.
result Certified top-1 accuracy of 49% on ImageNet under small ℓ 2 \ell_2 ℓ 2 perturbations. SAFER method certifies robustness to word substitutions without model structure.
problem Certified robustness against synonymous word substitutions in NLP models.
method Randomized smoothing with stochastic ensemble of randomized inputs.
result Significantly outperforms state-of-the-art methods for certified robustness.
RobBoost optimizes a deep model ensemble for certified robustness.
problem Improving the robustness of deep models.
method Optimizes a neural network's robustness certificate through model selection and weighting.
result RobBoost forms a more robust ensemble with better certified robustness and clean accuracy.
New techniques extend certified unlearning to deep neural networks.
problem Applying certified unlearning to deep neural networks (DNNs) is challenging due to their nonconvex nature.
method Developed simple techniques and an efficient computation method for nonconvex objectives, considering nonconvergence training and sequential unlearning.
result Demonstrated the efficacy of the method on real-world datasets, showing advantages of certified unlearning in DNNs.
This work improves certifiably robust models by distilling knowledge from adversarially robust teachers.
problem Certifiably robust models suffer from poor standard performance.
method Knowledge distillation from adversarially robust teachers to improve standard performance.
result Distillation from adversarially robust teachers consistently improves certified training performance.
Work on making classifiers robust against adversarial attacks for top-k predictions.
problem Vulnerability of classifiers to adversarial perturbations, especially for top-k predictions.
method Randomized smoothing to turn any classifier into a robust one, using Gaussian noise.
result Derives a tight robustness in ℓ2 norm for top-k predictions, achieving 62.8% certified top-5 accuracy on ImageNet.
One epoch training yields certifiably robust models.
problem Vulnerability of machine learning models to adversarial attacks.
method Deterministic certification approach based on regularized loss.
result Certifiable robust models achieved in one epoch.
Paper presents certified defenses against adversarial patch attacks.
problem Certified defenses against adversarial patch attacks are needed.
method Proposes the first certified defense and faster training methods.
result Demonstrates robustness transfer across different patch shapes.
New method improves certified robustness for classifier confidence.
problem Certifying confidence in classifier predictions.
method Randomized smoothing with modified Neyman-Pearson lemma.
result Certified radii for prediction confidence improved.
Improves safety region certification for smoothed classifiers without changing smoothing scheme.
problem Certified safety regions for smoothed classifiers are often small compared to optimal.
method Generalizes certified radius calculation as nested optimization problem, uses 0th-1st order information, and designs efficient estimators.
result Certified safety regions are significantly larger than current methods, achieving significant improvements on various metrics.
Certified training improves robustness against adversarial attacks.
problem Certified training's gap with empirical robustness limits its practical utility.
method Combining adversarial attacks with network over-approximations.
result Certified training can prevent catastrophic overfitting and bridge the gap to multi-step baselines.
New regularizers tighten convex relaxation bounds for neural networks.
problem Large gap between certifiable and empirical robustness in neural networks.
method Two regularizers to train neural networks yielding tighter convex relaxation bounds.
result Higher certified accuracy with proposed regularizers.
This paper proposes a framework for certifying neural network defenses against data poisoning attacks.
problem Vulnerability of neural networks to data poisoning attacks.
method Random selection based defenses that average predictions on sub-datasets sampled from the training set.
result The certified radius of bagging derived by the framework is tighter than previous work.
Proves the existence of accurate, certifiably robust neural networks.
problem Training neural networks to be robust against adversarial attacks.
method Proves the existence of networks that approximate continuous functions and ensure robustness through interval-bound propagation.
result Proves the existence of accurate, interval-certified ReLU networks.
Improved defense against data poisoning attacks by aggregating smaller subsets.
problem Mitigating the impact of poisoned data on model robustness.
method Finite Aggregation method that combines duplicates of smaller disjoint subsets for training.
result Consistent improvement in certified robustness bounds, up to 4.77% on GTSRB.
Certifiable defense method improves robustness of deep learning interpretation.
problem Vulnerability of gradient-based saliency maps to adversarial attacks.
method Sparsified SmoothGrad method, extending certifiably robust smooth classifier bounds.
result Sparsified SmoothGrad method is certifiably robust against adversarial perturbations.
New work shows limits of certifying neural network robustness.
problem Certified training improves robustness but decreases accuracy.
method Bayes error analysis to investigate robustness limits.
result Upper bound for certified robust accuracy established.
New approach detects adversarial samples with certifiable guarantees.
problem Adversarial samples can trick CNNs, posing a threat.
method Certifiable Taboo Trap (CTT) approach to detect adversarial inputs.
result CTT outperforms existing defenses on various l p l_p l p norms. Paper improves neural network robustness certification with tighter radii estimates.
problem Certifying neural networks' robustness against adversarial attacks.
method Advanced algorithms for discrete and continuous domains, optimizing sample size, standard deviation, and temperature.
result Significant improvement in certified test-set accuracy with tighter certified radii bounds.
We give concentration bounds for martingales that are uniform over finite times and extend classical Hoeffding and Bernstein inequalities. We also demonstrate our concentration bounds to be optimal with a matching anti-concentration inequality, proved using the same method. Together these constitute a finite-time versi…
Sharp concentration bounds for i.i.d. variables.
problem Controlling the tail probabilities of independent variables.
method Extension of Sanov's theorem using large deviations and information theory.
result Matching concentration and anti-concentration bounds for i.i.d. samples of any size.
New framework tightens certified robustness gaps in machine learning models.
problem Persistent gap between theoretical certified robustness and empirical accuracy.
method Leverages Lipschitz continuity and novel confidence intervals.
result Improves robust accuracy, compressing the gap between theory and practice.
Paper proposes faster certified robust training methods with short warmup.
problem Certified robust training methods require long warmup schedules, making training costly.
method Proposes three improvements: new weight initialization, BN, and regularization.
result Achieves 65.03% verified error on CIFAR-10 and 82.36% on TinyImageNet with short warmup.
OPSRL algorithm reduces regret with few samples in reinforcement learning.
problem High regret in reinforcement learning with limited data.
method Optimistic Posterior Sampling (OPSRL) with logarithmic sample complexity.
result Guaranteed high-probability regret bound of O ~ ( H 3 S A T ) \widetilde{\mathcal{O}}(\sqrt{H^3SAT}) O ( H 3 S A T ) . Paper improves robustness certification by integrating ML and logical reasoning.
problem Limited robustness certification under perturbation radius.
method Integrates statistical ML models with logical reasoning using Markov logic networks.
result First certified robustness bound for MLN derived and experimentally validated.
Adversarial training improves robustness of halfspaces in noisy data.
problem Learning robust halfspaces in the presence of label noise.
method Adversarial training with binary cross-entropy or nonconvex sigmoidal loss.
result Adversarial training yields robust halfspaces with improved classification error.
Improved training boosts certified robustness of L-infinity distance nets.
problem Certified robustness of L-infinity distance nets is not as strong as conventional networks.
method Improved training process combining scaled cross-entropy and clipped hinge loss with a decaying mixing coefficient.
result Certified accuracy of L-infinity distance nets improved from 33.30% to 40.06% on CIFAR-10.
Automates perturbation analysis for neural networks, enabling certified robustness on complex architectures.
problem Limited applicability of existing perturbation analysis methods to complex neural network architectures.
method Developed an automatic framework to generalize LiRPA algorithms to any neural network structure, enabling loss fusion and state-of-the-art certified defense results.
result Demonstrated LiRPA based certified defense on Tiny ImageNet and Downscaled ImageNet.
Policy certifies inventory levels meeting service requirements.
problem Maintaining stock levels meeting service requirements despite unknown demand.
method Data-driven order policy using online learning and integral action.
result Valid inference method for finite samples.
New framework certifies robustness for regression models.
problem Certifying robustness for regression models is challenging.
method Derives a prediction-centered certificate that exploits local geometry.
result Gradient information yields tighter robustness certificates.
New method certifies neural network function space norms from point evaluations.
problem Certifying neural network function space norms from point evaluations alone.
method Combining interval arithmetic enclosures, adaptive marking/refinement, and quadrature-based aggregation.
result Certified computation of L p L^p L p , W 1 , p W^{1,p} W 1 , p , and W 2 , p W^{2,p} W 2 , p norms. This paper provides a comprehensive benchmark and taxonomy for certifiably robust DNN defenses.
problem Certifiably robust defenses against adversarial attacks for deep neural networks.
method Taxonomy and benchmark of certifiably robust approaches.
result First comprehensive benchmark of certifiably robust approaches on different datasets.
Paper certifies intersection of minimum-volume confidence sets for multinomial outcomes.
problem Certifying intersection of minimum-volume confidence sets for multinomial outcomes.
method Exploits likelihood ordering to induce halfspace constraints, enabling adaptive geometric partitioning and computable bounds on p-values.
result Efficient and provably sound algorithm for certifying intersection, disjointness, or indeterminate result.
This paper assesses Gaussian and Exponential mechanisms for certifying adversarial robustness.
problem Certifying adversarial robustness using randomized smoothing mechanisms.
method Proposes a generic framework to assess the appropriateness of randomized smoothing mechanisms.
result Gaussian mechanism is an appropriate option for certifying both ℓ 2 \ell_2 ℓ 2 -norm and ℓ ∞ \ell_\infty ℓ ∞ -norm robustness.