New method certifies regression robustness without data distribution assumptions.
problem Certifying robustness of regression models against poisoning attacks.
method Reduces certified regression to certified classification using median decision function.
result Proposes six new provably-robust regression models.
SingleProp speeds up robust neural network training with minimal certification.
problem Efficiently defending neural networks against adversarial attacks with certified guarantees.
method SingleProp regularizer that requires only one forward pass per training iteration.
result Comparable certified accuracy to state-of-the-art defenses, but significantly faster training.
New techniques extend certified unlearning to deep neural networks.
problem Applying certified unlearning to deep neural networks (DNNs) is challenging due to their nonconvex nature.
method Developed simple techniques and an efficient computation method for nonconvex objectives, considering nonconvergence training and sequential unlearning.
result Demonstrated the efficacy of the method on real-world datasets, showing advantages of certified unlearning in DNNs.
New method improves certified robustness for classifier confidence.
problem Certifying confidence in classifier predictions.
method Randomized smoothing with modified Neyman-Pearson lemma.
result Certified radii for prediction confidence improved.
This work improves robustness guarantees for neural networks using low rank representations.
problem Certified robustness to adversarial perturbations in neural networks.
method Low rank representations to provide improved robustness guarantees.
result Improved robustness guarantees for ℓ∞ perturbations using natural low rank representations. We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the ℓ2 norm. This "randomized smoothing" technique has been proposed recently in the literature, but existing guarantees are loose. We prove a tight robu…
CIVET method provides robustness guarantees for VAEs under adversarial attacks.
problem Certified probabilistic guarantees for VAEs in safety-critical applications.
method Bounding worst-case VAE error by error on support sets at the latent layer.
result CIVET outperforms state-of-the-art methods in robustness and standard performance.
Paper aims to ensure reliable detection of out-of-distribution data with certifiable worst-case guarantees.
problem Deep neural networks are overconfident with OOD inputs, posing safety risks.
method Enforces low confidence and bounds in an l∞-ball around OOD points using interval bound propagation (IBP). result Certifiable worst-case guarantees for OOD detection are possible without significant loss in accuracy.
New approach detects adversarial samples with certifiable guarantees.
problem Adversarial samples can trick CNNs, posing a threat.
method Certifiable Taboo Trap (CTT) approach to detect adversarial inputs.
result CTT outperforms existing defenses on various lp norms. New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
Extends randomized smoothing to certify robustness against various threat models and adversarial perturbations.
problem Certifying robustness of classifiers against adversarial perturbations.
method Develops a method to certify robustness against any ℓp (p∈N>0) minimized adversarial perturbation. result Randomized smoothing suffers from the curse of dimensionality, reducing effective radius as p increases. New method for certified unlearning reduces noise injection.
problem Achieving formal unlearning guarantees with adaptive noise calibration.
method Adaptive per-instance noise calibration based on individual data point sensitivities.
result Derivation of high-probability per-instance sensitivity bounds for ridge regression.
New method certifies neural network function space norms from point evaluations.
problem Certifying neural network function space norms from point evaluations alone.
method Combining interval arithmetic enclosures, adaptive marking/refinement, and quadrature-based aggregation.
result Certified computation of Lp, W1,p, and W2,p norms. New method removes specific training data influence from neural networks.
problem Removing specific training data influence from neural networks for privacy and regulatory reasons.
method Noisy fine-tuning on retain data to ensure provable unlearning guarantees without restrictive assumptions.
result Achieves formal unlearning guarantees and performs effectively in practice.
Unified framework for certifying LLM reliability without extra supervision.
problem Improving reliability of large language models without additional supervision.
method Unified framework using majority voting and Martingale Majority Certificate (MMC).
result Certifiable inference in LLMs with statistical guarantees and adaptive stopping rules.
One epoch training yields certifiably robust models.
problem Vulnerability of machine learning models to adversarial attacks.
method Deterministic certification approach based on regularized loss.
result Certifiable robust models achieved in one epoch.
Certified guidance ensures generative models always meet planning objectives.
problem Lack of guarantees for generated outputs satisfying planning objectives.
method Certified guidance modifies generative models without retraining, ensuring outputs meet STL specifications.
result Certified guidance produces models that are always correct, unlike non-certified methods.
Policy certifies inventory levels meeting service requirements.
problem Maintaining stock levels meeting service requirements despite unknown demand.
method Data-driven order policy using online learning and integral action.
result Valid inference method for finite samples.
We propose an algorithm to enhance certified robustness of a deep model ensemble by optimally weighting each base model. Unlike previous works on using ensembles to empirically improve robustness, our algorithm is based on optimizing a guaranteed robustness certificate of neural networks. Our proposed ensemble framewor…
This work improves deep reinforcement learning robustness to adversarial state uncertainty.
problem Robustness of deep reinforcement learning to adversarial state uncertainty.
method Certified adversarial robustness techniques are applied to deep reinforcement learning algorithms to compute guaranteed lower bounds on state-action values.
result The approach increases robustness to noise and adversaries in pedestrian collision avoidance and classic control tasks.
SAFER method certifies robustness to word substitutions without model structure.
problem Certified robustness against synonymous word substitutions in NLP models.
method Randomized smoothing with stochastic ensemble of randomized inputs.
result Significantly outperforms state-of-the-art methods for certified robustness.
We certify federated learning model performance under meta-distribution shifts.
problem Certifying model performance on unseen networks with heterogeneous distributions.
method Derive worst-case uniform guarantees for federated learning model's average loss and risk CDF.
result Asymptotically minimax optimal and privacy-preserving certification.
New framework certifies robustness for regression models.
problem Certifying robustness for regression models is challenging.
method Derives a prediction-centered certificate that exploits local geometry.
result Gradient information yields tighter robustness certificates.
New method defends against patch attacks with high-certainty guarantees.
problem Patch attacks on images, especially physical adversarial attacks.
method Randomized smoothing, exploiting patch constraints.
result Meaningfully large robustness certificates against patch attacks.
Certified training improves robustness against adversarial attacks.
problem Certified training's gap with empirical robustness limits its practical utility.
method Combining adversarial attacks with network over-approximations.
result Certified training can prevent catastrophic overfitting and bridge the gap to multi-step baselines.
New neural network design resists small ℓ∞-norm adversarial perturbations.
problem Vulnerability of neural networks to small ℓ∞-norm adversarial perturbations. method Designing ℓ∞-dist neurons and constructing ℓ∞-dist nets, proving their 1-Lipschitz property and expressive power. result Certified robustness of ℓ∞-dist nets with state-of-the-art performance on various datasets. A mechanism to share risks and costs with guarantees against extreme outcomes.
problem Softening extreme individual burdens in risk sharing schemes.
method Formalizes Certified Allocation Problem; uses Conformal Risk Sharing with interpretable sharing policy and split conformal calibration.
result Reduces extreme obligations for high-risk agents while controlling harm to others.
Good data stewardship requires removal of data at the request of the data's owner. This raises the question if and how a trained machine-learning model, which implicitly stores information about its training data, should be affected by such a removal request. Is it possible to "remove" data from a machine-learning mode…
Unified framework TSS certifies robustness against semantic transformations.
problem Certifying robustness of ML models against semantic transformations.
method Unified framework TSS categorizes transformations into resolvable and differentially resolvable, proposing randomized smoothing and stratified sampling strategies.
result Significantly outperforms state of the art on over ten types of semantic transformations.
Recent works show that Graph Neural Networks (GNNs) are highly non-robust with respect to adversarial attacks on both the graph structure and the node attributes, making their outcomes unreliable. We propose the first method for certifiable (non-)robustness of graph convolutional networks with respect to perturbations …
Efficiently certifies global robustness of large neural networks with probabilistic guarantees.
problem Certifying robustness of large neural networks in a scalable and efficient manner.
method Sampling an ε-net and invoking a local robustness oracle.
result Certifies a probabilistic relaxation of robustness efficiently and globally.
New method certifies images against transformations like rotations and translations.
problem Certifying robustness of images against transformations like rotations and translations.
method Randomized smoothing with three different kinds of defenses.
result Individual certificates can be obtained via statistical error bounds or efficient online inverse computation.
Improves safety region certification for smoothed classifiers without changing smoothing scheme.
problem Certified safety regions for smoothed classifiers are often small compared to optimal.
method Generalizes certified radius calculation as nested optimization problem, uses 0th-1st order information, and designs efficient estimators.
result Certified safety regions are significantly larger than current methods, achieving significant improvements on various metrics.
Training certifiable neural networks enables one to obtain models with robustness guarantees against adversarial attacks. In this work, we introduce a framework to bound the adversary-free region in the neighborhood of the input data by a polyhedral envelope, which yields finer-grained certified robustness. We further …
Paper proposes faster certified robust training methods with short warmup.
problem Certified robust training methods require long warmup schedules, making training costly.
method Proposes three improvements: new weight initialization, BN, and regularization.
result Achieves 65.03% verified error on CIFAR-10 and 82.36% on TinyImageNet with short warmup.
Framework certifies fairness of machine learning models interactively and privately.
problem Certifying fairness of machine learning models in privacy-preserving scenarios.
method Interactive test with cryptographic techniques for fairness certification.
result Empirical evaluation of fairness for various models and definitions.
Neural networks are vulnerable to adversarial examples and researchers have proposed many heuristic attack and defense mechanisms. We address this problem through the principled lens of distributionally robust optimization, which guarantees performance under adversarial input perturbations. By considering a Lagrangian …
Despite their impressive performance on diverse tasks, neural networks fail catastrophically in the presence of adversarial inputs---imperceptibly but adversarially perturbed versions of natural inputs. We have witnessed an arms race between defenders who attempt to train robust networks and attackers who try to constr…
Paper optimizes statistical estimation for randomized smoothing to reduce adversarial robustness certification time.
problem Efficiently estimating robustness of points against adversarial attacks.
method Developed estimation procedures using confidence sequences and randomized Clopper-Pearson intervals.
result Achieved optimal sample complexities and stronger certificates with reduced computational burden.
Develops a method to ensure accuracy of few-shot transfer learning models.
problem Lack of generalization guarantees for low-data transfer learning.
method Trains a distribution over PEFT parameters using upstream tasks and samples plausible PEFTs for downstream tasks.
result Demonstrates non-vacuous generalization guarantees compared to existing methods in the low-shot regime.
Certifiably robust VAEs are trained with bounds on input perturbations.
problem Ensuring VAEs are robust to adversarial attacks.
method Derive bounds on minimal perturbation size, control parameters, and train VAEs to meet criteria.
result Certifiably robust VAEs are more robust to attacks than standard VAEs.
Efficient local Lipschitz bounds improve neural network robustness.
problem Certifying robustness of neural networks is challenging and often leads to over-regularization.
method Proposes an efficient trainable local Lipschitz upper bound by considering activation functions and weight matrices.
result Consistently outperforms state-of-the-art methods in clean and certified accuracy on various datasets.
ConfHit provides valid guarantees for generative models without oracle access.
problem Reliable guarantees for novel candidate generation in generative models.
method Formalizes certification and refinement of generated sets, leveraging weighted exchangeability and density-ratio weighted conformal p-values.
result Consistently delivers valid coverage guarantees and compact certified sets across various generative tasks.
Efficient method certifies robustness of discrete data models, especially graphs.
problem Certifying robustness of discrete data models, especially graphs, is difficult.
method Randomized smoothing framework, sparsity-aware, model-agnostic, tight and efficient.
result Proposes a scalable method for certifying robustness of discrete data models, especially graphs.
High-dimensional smoothing techniques struggle with robustness guarantees against various attacks.
problem Challenges in extending randomized smoothing to other attack models in high-dimensional space.
method Analysis of isotropic and generalized Gaussian smoothing distributions, proving bounds on certified robustness radii.
result Certifiable robustness radii decrease as $O(1/d^{ rac{1}{2} - rac{1}{p}})$ with dimension d for p>2. Fusion of robustness and uncertainty techniques improves adversarial defense.
problem Adversarial attacks on deep neural networks.
method Integrating uncertainty quantification into randomized smoothing for robustness guarantees.
result Improved robustness guarantees for uncertainty aware classifiers.
Adversarial examples that fool machine learning models, particularly deep neural networks, have been a topic of intense research interest, with attacks and defenses being developed in a tight back-and-forth. Most past defenses are best effort and have been shown to be vulnerable to sophisticated attacks. Recently a set…
Hierarchical randomized smoothing improves model robustness for complex data.
problem Certifying robustness on complex data (e.g. images, graphs) is challenging.
method Add random noise to a randomly selected subset of entities in a hierarchical manner.
result Hierarchical randomized smoothing yields stronger robustness guarantees with high accuracy.