New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
New method improves certified robustness for classifier confidence.
problem Certifying confidence in classifier predictions.
method Randomized smoothing with modified Neyman-Pearson lemma.
result Certified radii for prediction confidence improved.
It is well-known that classifiers are vulnerable to adversarial perturbations. To defend against adversarial perturbations, various certified robustness results have been derived. However, existing certified robustnesses are limited to top-1 predictions. In many real-world applications, top-k predictions are more rel…
BagCert efficiently certifies robustness against adversarial patches on image classifiers.
problem Adversarial patches pose a threat to autonomous systems' perception component.
method BagCert combines model architecture and certification procedure for efficient inference.
result BagCert certifies 10,000 examples in 43 seconds on a single GPU, achieving 86% clean and 60% certified accuracy against 5x5 patches.
We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the ℓ2 norm. This "randomized smoothing" technique has been proposed recently in the literature, but existing guarantees are loose. We prove a tight robu…
New method certifies regression robustness without data distribution assumptions.
problem Certifying robustness of regression models against poisoning attacks.
method Reduces certified regression to certified classification using median decision function.
result Proposes six new provably-robust regression models.
Regularization improves robustness of smoothed classifiers.
problem Certifying robustness of smoothed classifiers.
method Regularizing prediction consistency over Gaussian noise.
result Significantly improved certified robustness with less training costs.
SWEEN improves certified robustness via weighted ensembling of smoothed classifiers.
problem Finding optimal base classifiers for randomized smoothing.
method Smoothed WEighted ENsembling (SWEEN) scheme.
result SWEEN achieves optimal certified robustness under mild assumptions.
New method certifies deep graph classifiers with tighter risk bounds.
problem Certifying the reliability of deep graph classifiers.
method Linearized deep assignment flows with random initial conditions, using PAC-Bayes risk certification.
result Computes tighter out-of-sample risk certificates efficiently.
Improves safety region certification for smoothed classifiers without changing smoothing scheme.
problem Certified safety regions for smoothed classifiers are often small compared to optimal.
method Generalizes certified radius calculation as nested optimization problem, uses 0th-1st order information, and designs efficient estimators.
result Certified safety regions are significantly larger than current methods, achieving significant improvements on various metrics.
RS-Del provides robustness for sequence classifiers against edit distance attacks.
problem Certifying robustness of discrete sequence classifiers against edit distance attacks.
method Randomized deletion (RS-Del) for discrete sequence classifiers, focusing on edit distance-bounded adversaries.
result Achieved a certified accuracy of 91% at an edit distance radius of 128 bytes on malware detection.
Enhances robustness of deep neural networks with randomized smoothing.
problem Improving robustness of deep neural networks against noisy inputs and adversarial attacks.
method Introduces a variance-margin trade-off approach to increase certified robust radius using pre-trained models.
result Significant improvement in certified accuracy compared to state-of-the-art methods.
This paper proposes a framework for certifying neural network defenses against data poisoning attacks.
problem Vulnerability of neural networks to data poisoning attacks.
method Random selection based defenses that average predictions on sub-datasets sampled from the training set.
result The certified radius of bagging derived by the framework is tighter than previous work.
Improved defense against data poisoning attacks by aggregating smaller subsets.
problem Mitigating the impact of poisoned data on model robustness.
method Finite Aggregation method that combines duplicates of smaller disjoint subsets for training.
result Consistent improvement in certified robustness bounds, up to 4.77% on GTSRB.
Machine learning algorithms are known to be susceptible to data poisoning attacks, where an adversary manipulates the training data to degrade performance of the resulting classifier. In this work, we present a unifying view of randomized smoothing over arbitrary functions, and we leverage this novel characterization t…
Convex relaxations are effective for training and certifying neural networks against norm-bounded adversarial attacks, but they leave a large gap between certifiable and empirical robustness. In principle, convex relaxation can provide tight bounds if the solution to the relaxed problem is feasible for the original non…
Adversarial training is one of the most popular ways to learn robust models but is usually attack-dependent and time costly. In this paper, we propose the MACER algorithm, which learns robust models without using adversarial training but performs better than all existing provable l2-defenses. Recent work shows that ran…
Extends randomized smoothing to certify robustness against various threat models and adversarial perturbations.
problem Certifying robustness of classifiers against adversarial perturbations.
method Develops a method to certify robustness against any ℓp (p∈N>0) minimized adversarial perturbation. result Randomized smoothing suffers from the curse of dimensionality, reducing effective radius as p increases. Novel neural network approximates exact distance for robust classification.
problem Adversarial attacks on neural networks in safety-critical systems.
method Signed Distance Classifiers (SDCs) and Unitary-Gradient Neural Network.
result Approximates exact distance from classification boundary for certifiable predictions.
New framework certifies robustness for regression models.
problem Certifying robustness for regression models is challenging.
method Derives a prediction-centered certificate that exploits local geometry.
result Gradient information yields tighter robustness certificates.
New method improves robustness of smoothed classifiers against adversarial attacks.
problem Improving robustness of smoothed classifiers against adversarial attacks.
method Proposes worst-case adversarial loss over input distributions as a robustness certificate, and uses duality and smoothness properties to provide an easy-to-compute upper bound.
result Shows superior robustness performance over state-of-the-art certified or heuristic methods.
New method defends against patch attacks with high-certainty guarantees.
problem Patch attacks on images, especially physical adversarial attacks.
method Randomized smoothing, exploiting patch constraints.
result Meaningfully large robustness certificates against patch attacks.
Deep learning interpretation is essential to explain the reasoning behind model predictions. Understanding the robustness of interpretation methods is important especially in sensitive domains such as medical applications since interpretation results are often used in downstream tasks. Although gradient-based saliency …
New method certifies individual fairness in representations.
problem Ensuring fairness in data representations without sacrificing utility.
method Mapping similar individuals to close latent representations to certify individual fairness.
result Certifies individual fairness for existing and new data points.
Deep Partition Aggregation defends against poisoning attacks with provable certificates.
problem Adversarial poisoning attacks corrupt classifier test-time behavior.
method Deep Partition Aggregation (DPA) is an ensemble method using hash partitions and base models trained on these partitions.
result DPA can certify >= 50% of test images against over 500 poison image insertions on MNIST, and nine insertions on CIFAR-10.
Good data stewardship requires removal of data at the request of the data's owner. This raises the question if and how a trained machine-learning model, which implicitly stores information about its training data, should be affected by such a removal request. Is it possible to "remove" data from a machine-learning mode…
Certified calibration methods protect model confidence from adversarial attacks.
problem Adversarial attacks degrade model calibration, reducing confidence in predictions.
method Developed certified calibration methods to provide worst-case bounds on calibration under adversarial perturbations.
result Certified calibration methods produce analytic and approximate bounds for the Brier score and expected calibration error.
Paper aims to ensure reliable detection of out-of-distribution data with certifiable worst-case guarantees.
problem Deep neural networks are overconfident with OOD inputs, posing safety risks.
method Enforces low confidence and bounds in an l∞-ball around OOD points using interval bound propagation (IBP). result Certifiable worst-case guarantees for OOD detection are possible without significant loss in accuracy.
New approach to certifiably robust neural networks using Boolean function perspective.
problem Lack of principled understanding and certified robustness for ℓ∞ perturbations. method New perspective on Boolean functions, deriving impossibility results, and developing a unified Lipschitz network.
result Unified Lipschitz network that bypasses expressive power limitations and achieves better certified robustness.
New method certifies neural network robustness to random input noise.
problem Certifying neural networks' robustness to random input noise.
method Chance-constrained optimization problem reformulated using input-output samples.
result Certifies a uniform infinity-norm uncertainty region with a radius 50 times larger.
This study improves scalability of randomized smoothing for certifying classifier robustness.
problem Certifying machine learning classifiers against adversarial attacks is challenging and scalable solutions are needed.
method The study reviews and explores randomized smoothing and its derivatives, focusing on scalability.
result The study provides theoretical guarantees and discusses scalability challenges of randomized smoothing.
Adversarial attacks against machine learning models are a rather hefty obstacle to our increasing reliance on these models. Due to this, provably robust (certified) machine learning models are a major topic of interest. Lipschitz continuous models present a promising approach to solving this problem. By leveraging the …
Paper defends deep learning classifiers against channel-aware adversarial attacks.
problem Deep learning classifiers are vulnerable to adversarial attacks.
method Channel-aware adversarial attacks are presented and defended against.
result Certified defense based on randomized smoothing makes classifiers robust.
Finding minimum distortion of adversarial examples and thus certifying robustness in neural network classifiers for given data points is known to be a challenging problem. Nevertheless, recently it has been shown to be possible to give a non-trivial certified lower bound of minimum adversarial distortion, and some rece…
Fusion of robustness and uncertainty techniques improves adversarial defense.
problem Adversarial attacks on deep neural networks.
method Integrating uncertainty quantification into randomized smoothing for robustness guarantees.
result Improved robustness guarantees for uncertainty aware classifiers.
Study on conditions for Bayes optimal classifier in adversarial robustness.
problem Existence of Bayes optimal classifier for adversarial robustness.
method General sufficient conditions for existence of Bayes optimal classifier.
result Guaranteed existence of Bayes optimal classifier under certain conditions.
This work improves robustness guarantees for neural networks using low rank representations.
problem Certified robustness to adversarial perturbations in neural networks.
method Low rank representations to provide improved robustness guarantees.
result Improved robustness guarantees for ℓ∞ perturbations using natural low rank representations. New method improves robustness of large models without sacrificing accuracy.
problem Improving robustness of large pre-trained models without accuracy loss.
method Multi-scale diffusion denoised smoothing, selectively applying smoothing at multiple noise scales.
result Strong certified robustness at high noise levels with accuracy close to non-smoothed classifiers.
Paper optimizes statistical estimation for randomized smoothing to reduce adversarial robustness certification time.
problem Efficiently estimating robustness of points against adversarial attacks.
method Developed estimation procedures using confidence sequences and randomized Clopper-Pearson intervals.
result Achieved optimal sample complexities and stronger certificates with reduced computational burden.
This work improves adversarial robustness in sparse coding models.
problem The gap between theoretical models and practical deployment in adversarial robustness.
method Combining a sparsity-promoting encoder with a linear classifier, and providing a robustness certificate.
result Bounding the robust risk and providing a robustness certificate for end-to-end classification.
SingleProp speeds up robust neural network training with minimal certification.
problem Efficiently defending neural networks against adversarial attacks with certified guarantees.
method SingleProp regularizer that requires only one forward pass per training iteration.
result Comparable certified accuracy to state-of-the-art defenses, but significantly faster training.
Input-dependent smoothing mitigates classical issues but suffers from the curse of dimensionality.
problem Certifiably robust classifiers with input-dependent smoothing suffer from the curse of dimensionality.
method Proposed a theoretical and practical framework for input-dependent smoothing under strict restrictions.
result Input-dependent smoothing mitigates some classical issues but is limited by the curse of dimensionality.
New method certifies generative models' robustness.
problem Certifying generative models' robustness is challenging due to non-convex sets.
method ApproxLine, a scalable certification method capturing infinite sets or distributions over them.
result ApproxLine provides sound deterministic and probabilistic guarantees.
Paper provides efficient robustness certificates for neural networks.
problem Ensuring neural networks are robust against adversarial attacks.
method Two-step approach: 1) Efficient convex optimization for robustness certificates with bounded Hessian eigenvalues, 2) Curvature-based regularization during training.
result Significantly higher certified robust accuracy achieved compared to existing methods.
With deep neural networks providing state-of-the-art machine learning models for numerous machine learning tasks, quantifying the robustness of these models has become an important area of research. However, most of the research literature merely focuses on the \textit{worst-case} setting where the input of the neural …
SAFER method certifies robustness to word substitutions without model structure.
problem Certified robustness against synonymous word substitutions in NLP models.
method Randomized smoothing with stochastic ensemble of randomized inputs.
result Significantly outperforms state-of-the-art methods for certified robustness.
New techniques extend certified unlearning to deep neural networks.
problem Applying certified unlearning to deep neural networks (DNNs) is challenging due to their nonconvex nature.
method Developed simple techniques and an efficient computation method for nonconvex objectives, considering nonconvergence training and sequential unlearning.
result Demonstrated the efficacy of the method on real-world datasets, showing advantages of certified unlearning in DNNs.
This work improves certifiably robust models by distilling knowledge from adversarially robust teachers.
problem Certifiably robust models suffer from poor standard performance.
method Knowledge distillation from adversarially robust teachers to improve standard performance.
result Distillation from adversarially robust teachers consistently improves certified training performance.