New method defends against patch attacks with high-certainty guarantees.
problem Patch attacks on images, especially physical adversarial attacks.
method Randomized smoothing, exploiting patch constraints.
result Meaningfully large robustness certificates against patch attacks.
New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
MadNet uses MAD optimization to enhance deep model robustness against adversarial attacks.
problem Defending deep models against adversarial attacks.
method Inspired by certificate defense, MAD optimization increases separability of class clusters and decreases sensitivity to small distortions.
result MadNet improves adversarial robustness compared to state-of-the-art methods.
This study improves scalability of randomized smoothing for certifying classifier robustness.
problem Certifying machine learning classifiers against adversarial attacks is challenging and scalable solutions are needed.
method The study reviews and explores randomized smoothing and its derivatives, focusing on scalability.
result The study provides theoretical guarantees and discusses scalability challenges of randomized smoothing.
Deep Partition Aggregation defends against poisoning attacks with provable certificates.
problem Adversarial poisoning attacks corrupt classifier test-time behavior.
method Deep Partition Aggregation (DPA) is an ensemble method using hash partitions and base models trained on these partitions.
result DPA can certify >= 50% of test images against over 500 poison image insertions on MNIST, and nine insertions on CIFAR-10.
New method certifies images against transformations like rotations and translations.
problem Certifying robustness of images against transformations like rotations and translations.
method Randomized smoothing with three different kinds of defenses.
result Individual certificates can be obtained via statistical error bounds or efficient online inverse computation.
SingleProp speeds up robust neural network training with minimal certification.
problem Efficiently defending neural networks against adversarial attacks with certified guarantees.
method SingleProp regularizer that requires only one forward pass per training iteration.
result Comparable certified accuracy to state-of-the-art defenses, but significantly faster training.
Defense against Wasserstein adversarial attacks using randomized smoothing.
problem Certified robustness against Wasserstein adversarial attacks.
method Randomized smoothing applied to the space of flows between images, bounding Wasserstein distance by L_1 distance.
result Significantly improved accuracy under Wasserstein adversarial attacks compared to unprotected models.
Paper tackles fairness issues in GNNs by proposing ELEGANT for certification.
problem Fairness issues in GNN predictions due to graph data perturbations.
method Proposes ELEGANT framework for certifying fairness of any GNN without assumptions or re-training.
result The fairness of any GNN backbone is impossible to be corrupted under certain perturbation budgets.
New method certifies robustness to sparse adversarial attacks.
problem Ensuring robustness of classifiers to sparse adversarial attacks.
method Randomized ablation of input features to provide robustness guarantees.
result Certifies robustness to sparse adversarial attacks with up to 31 pixels of distortion.
While neural networks have achieved high performance in different learning tasks, their accuracy drops significantly in the presence of small adversarial perturbations to inputs. Defenses based on regularization and adversarial training are often followed by new attacks to defeat them. In this paper, we propose attack-…
New method certifies joint adversarial robustness of model ensembles.
problem Ensuring robustness of model ensembles against adversarial attacks.
method Proposes a novel technique to certify joint robustness, building on prior work on single-model robustness certification.
result Demonstrates the effectiveness of certifying joint robustness of ensembles, improving understanding of ensemble defenses.
Paper optimizes statistical estimation for randomized smoothing to reduce adversarial robustness certification time.
problem Efficiently estimating robustness of points against adversarial attacks.
method Developed estimation procedures using confidence sequences and randomized Clopper-Pearson intervals.
result Achieved optimal sample complexities and stronger certificates with reduced computational burden.
New method improves robustness of smoothed classifiers.
problem Improving accuracy and robustness of smoothed classifiers.
method Regularized risk with adaptive regularization.
result Tighter robustness bounds with high probability.
Paper provides efficient robustness certificates for neural networks.
problem Ensuring neural networks are robust against adversarial attacks.
method Two-step approach: 1) Efficient convex optimization for robustness certificates with bounded Hessian eigenvalues, 2) Curvature-based regularization during training.
result Significantly higher certified robust accuracy achieved compared to existing methods.
Improved defense against data poisoning attacks by aggregating smaller subsets.
problem Mitigating the impact of poisoned data on model robustness.
method Finite Aggregation method that combines duplicates of smaller disjoint subsets for training.
result Consistent improvement in certified robustness bounds, up to 4.77% on GTSRB.
BagCert efficiently certifies robustness against adversarial patches on image classifiers.
problem Adversarial patches pose a threat to autonomous systems' perception component.
method BagCert combines model architecture and certification procedure for efficient inference.
result BagCert certifies 10,000 examples in 43 seconds on a single GPU, achieving 86% clean and 60% certified accuracy against 5x5 patches.
Surveying strategies for making machine learning models robust against adversarial attacks.
problem Ensuring machine learning models are robust and reliable in real-world applications.
method Taxonomy of adversarial attacks and defenses, Robust Optimization problem formulation, and survey of methods.
result Surveyed recent results in adversarial example generation, defense mechanisms, and formal robustness certificates.
New adversarial examples with structured distortion sets improve robustness and perceptibility.
problem Improving adversarial robustness and perceptibility of images.
method Exploring and constraining adversarial search with trace-norms and other norms.
result Structured adversarial perturbations allow larger distortions and control over generation.
This work improves deep reinforcement learning robustness to adversarial state uncertainty.
problem Robustness of deep reinforcement learning to adversarial state uncertainty.
method Certified adversarial robustness techniques are applied to deep reinforcement learning algorithms to compute guaranteed lower bounds on state-action values.
result The approach increases robustness to noise and adversaries in pedestrian collision avoidance and classic control tasks.
This paper provides a comprehensive benchmark and taxonomy for certifiably robust DNN defenses.
problem Certifiably robust defenses against adversarial attacks for deep neural networks.
method Taxonomy and benchmark of certifiably robust approaches.
result First comprehensive benchmark of certifiably robust approaches on different datasets.
Improves safety region certification for smoothed classifiers without changing smoothing scheme.
problem Certified safety regions for smoothed classifiers are often small compared to optimal.
method Generalizes certified radius calculation as nested optimization problem, uses 0th-1st order information, and designs efficient estimators.
result Certified safety regions are significantly larger than current methods, achieving significant improvements on various metrics.
New algorithms learn stability certificates from data, avoiding complex dynamics.
problem Synthesizing stability certificates from complex dynamical systems.
method Developed algorithms to learn certificate functions from trajectory data, establishing generalization error bounds.
result Efficiently learned certificates can be used for adaptive control.
Improved neural network robustness certification through tighter convex relaxations.
problem Certifying neural network robustness to perturbed and adversarial inputs.
method Exploiting ReLU network structure, novel partition-based certification procedure.
result Tightens existing linear programming relaxations to achieve zero relaxation error asymptotically.
Develops structured noise for more accurate graph classifier robustness certificates.
problem Isotropic noise limits robustness certificates for graph classifiers.
method Randomized smoothing with anisotropic noise distribution.
result Structured-aware robustness certificates provide more accurate predictions.
New method closes certification gap for adversarially trained models.
problem Certifying robustness of adversarially trained neural networks.
method Nonconvex low-rank SDP relaxation with polynomial-time optimization.
result Strong certifications comparable to SDP methods, but with fewer variables.
The adversarial training procedure proposed by Madry et al. (2018) is one of the most effective methods to defend against adversarial examples in deep neural networks (DNNs). In our paper, we shed some lights on the practicality and the hardness of adversarial training by showing that the effectiveness (robustness on t…
New framework improves adversarial robustness certification for various perturbations.
problem Certifying robustness against adversarial attacks in deep learning models.
method Unified functional optimization approach with non-Gaussian smoothing noise for multiple types of attacks.
result Achieves better certification results and identifies key trade-offs between accuracy and robustness.
Bayesian method synthesizes barrier certificates for unknown systems with latent states.
problem Certifying safety in systems with unknown dynamics and latent states.
method Bayesian inference with Metropolis-Hastings sampler and sum-of-squares program.
result Probabilistic validity of barrier certificates for unknown systems.
CITE algorithm provides anytime-valid certification of model outputs.
problem Challenges in controlling error levels in LLM self-consistency.
method Certification by Intersection-union Testing with E-processes (CITE) algorithm.
result Provable control of false certification at any prescribed level under arbitrary stopping rules.
Paper develops tighter risk certificates for contrastive learning models.
problem Statistical theory for contrastive learning is lacking, especially for practical models like SimCLR.
method Develops non-vacuous PAC-Bayesian risk certificates considering practical SimCLR factors.
result Risk certificates for contrastive loss and downstream prediction are much tighter than previous results.
Develops local population-risk certificates for model updates
problem Model updates in machine learning
method Certify population-risk increments around a model
result Certified upper endpoint yields a risk-controlled update rule
The performance of a reinforcement learning algorithm can vary drastically during learning because of exploration. Existing algorithms provide little information about the quality of their current policy before executing it, and thus have limited use in high-stakes applications like healthcare. We address this lack of …
New method provides tighter robustness guarantees for adversarial attacks.
problem Ensuring robustness against adversarial attacks in machine learning models.
method Developed a Second-order Smoothing (SoS) robustness certificate using Gaussian random smoothing.
result SoS certificates are tighter and provide improved robustness on high-dimensional datasets.
TUV Austria proposes certification for ML applications to ensure reliability.
problem Ensuring trust in AI applications to meet societal reliance requirements.
method Holistic approach analyzing security, functionality, data quality, ethics, and criticality levels.
result Certification process for low-risk ML applications in supervised learning.
Valid certifies LLMs' domain adherence, bounding out-of-domain behavior.
problem Adversarial susceptibility of LLMs to generate out-of-domain outputs.
method VALID approach providing adversarial bounds as a certificate.
result Validates LLMs' domain adherence with meaningful certificates.
Conformal Candidate Certification advances offline MBO by certifying candidate designs with statistical guarantees.
problem Offline model-based optimization
method Conformal Candidate Certification (CCC)
result CCC certifies 16.7% of an aggressive proposal pool with 0.990 empirical coverage at nominal 0.90.
New robustness certificates for streaming models with a sliding window.
problem Applying robustness certificates to streaming data with correlated inputs.
method Deriving robustness certificates for models using a sliding window over a sequence of potentially correlated inputs.
result Guarantees hold for the average model performance across the entire stream, independent of stream size.
Survey examines challenges of ML in avionic systems certification.
problem Challenges in current certification standards for ML in avionic systems.
method Literature review focusing on robustness and explainability of ML results.
result Current certification standards do not support ML in avionic systems.
Geometric technique determines exactness of SDP robustness certificate.
problem Certifying robustness of neural networks to adversarial examples.
method Geometric projection onto hyperbola, SDP relaxation of ReLU activation.
result SDP certificate is exact for a single hidden layer under mild assumptions.
ATHENA builds flexible defenses against adversarial attacks.
problem Extensive research on adversarial attacks is domain-specific and cannot be easily extended.
method Designing an extensible framework based on diverse weak defenses.
result Comprehensive empirical study demonstrates the effectiveness of ATHENA.
The paper improves risk certificate tightness for neural networks using PAC-Bayes bounds.
problem Improving the usability of risk certificates for neural networks based on PAC-Bayes bounds.
method Theoretical contributions including KL divergence bounds, efficient methodology for optimization, and methods for optimizing non-differentiable objectives.
result First non-vacuous generalization bounds on CIFAR-10 for neural networks.
Study adversarial perturbations in classification, analyzing learning and certification.
problem Formal study of classification under adversarial perturbations from both learner and third-party perspectives.
method PAC-type semi-supervised learning framework, black-box certification under limited query budget, adversary analysis.
result Existence of a polynomial query complexity adversary implies the existence of a sample efficient robust learner.
New defense method inspired by encryption improves visual classification accuracy.
problem Conventional defenses reduce accuracy and are defeated by obfuscated gradients.
method Block-wise pixel shuffling with secret key for training and test images.
result Achieves high accuracy (91.55%) on clean images and (89.66%) on adversarial examples.
New method improves robustness of smoothed classifiers against adversarial attacks.
problem Improving robustness of smoothed classifiers against adversarial attacks.
method Proposes worst-case adversarial loss over input distributions as a robustness certificate, and uses duality and smoothness properties to provide an easy-to-compute upper bound.
result Shows superior robustness performance over state-of-the-art certified or heuristic methods.
New framework certifies robustness for regression models.
problem Certifying robustness for regression models is challenging.
method Derives a prediction-centered certificate that exploits local geometry.
result Gradient information yields tighter robustness certificates.
Automated discovery of adaptive attacks improves adversarial defense evaluation.
problem Challenges in reliably evaluating adversarial defenses.
method Formalizes adaptive attacks as reusable building blocks in a search space for automatic discovery.
result Our tool discovers significantly stronger attacks than AutoAttack, improving adversarial defense evaluation.
SREC markets are a relatively novel market-based system to incentivize the production of energy from solar means. A regulator imposes a floor on the amount of energy each regulated firm must generate from solar power in a given period and provides them with certificates for each generated MWh. Firms offset these certif…