This work improves certifiably robust models by distilling knowledge from adversarially robust teachers.
problem Certifiably robust models suffer from poor standard performance.
method Knowledge distillation from adversarially robust teachers to improve standard performance.
result Distillation from adversarially robust teachers consistently improves certified training performance.
New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
New method certifies regression robustness without data distribution assumptions.
problem Certifying robustness of regression models against poisoning attacks.
method Reduces certified regression to certified classification using median decision function.
result Proposes six new provably-robust regression models.
SAFER method certifies robustness to word substitutions without model structure.
problem Certified robustness against synonymous word substitutions in NLP models.
method Randomized smoothing with stochastic ensemble of randomized inputs.
result Significantly outperforms state-of-the-art methods for certified robustness.
New framework tightens certified robustness gaps in machine learning models.
problem Persistent gap between theoretical certified robustness and empirical accuracy.
method Leverages Lipschitz continuity and novel confidence intervals.
result Improves robust accuracy, compressing the gap between theory and practice.
New work shows limits of certifying neural network robustness.
problem Certified training improves robustness but decreases accuracy.
method Bayes error analysis to investigate robustness limits.
result Upper bound for certified robust accuracy established.
SingleProp speeds up robust neural network training with minimal certification.
problem Efficiently defending neural networks against adversarial attacks with certified guarantees.
method SingleProp regularizer that requires only one forward pass per training iteration.
result Comparable certified accuracy to state-of-the-art defenses, but significantly faster training.
Intensive algorithmic efforts have been made to enable the rapid improvements of certificated robustness for complex ML models recently. However, current robustness certification methods are only able to certify under a limited perturbation radius. Given that existing pure data-driven statistical approaches have reache…
It is well-known that classifiers are vulnerable to adversarial perturbations. To defend against adversarial perturbations, various certified robustness results have been derived. However, existing certified robustnesses are limited to top-1 predictions. In many real-world applications, top-k predictions are more rel…
BagCert efficiently certifies robustness against adversarial patches on image classifiers.
problem Adversarial patches pose a threat to autonomous systems' perception component.
method BagCert combines model architecture and certification procedure for efficient inference.
result BagCert certifies 10,000 examples in 43 seconds on a single GPU, achieving 86% clean and 60% certified accuracy against 5x5 patches.
This paper provides a comprehensive benchmark and taxonomy for certifiably robust DNN defenses.
problem Certifiably robust defenses against adversarial attacks for deep neural networks.
method Taxonomy and benchmark of certifiably robust approaches.
result First comprehensive benchmark of certifiably robust approaches on different datasets.
One epoch training yields certifiably robust models.
problem Vulnerability of machine learning models to adversarial attacks.
method Deterministic certification approach based on regularized loss.
result Certifiable robust models achieved in one epoch.
We propose an algorithm to enhance certified robustness of a deep model ensemble by optimally weighting each base model. Unlike previous works on using ensembles to empirically improve robustness, our algorithm is based on optimizing a guaranteed robustness certificate of neural networks. Our proposed ensemble framewor…
Certified training improves robustness against adversarial attacks.
problem Certified training's gap with empirical robustness limits its practical utility.
method Combining adversarial attacks with network over-approximations.
result Certified training can prevent catastrophic overfitting and bridge the gap to multi-step baselines.
We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the ℓ2 norm. This "randomized smoothing" technique has been proposed recently in the literature, but existing guarantees are loose. We prove a tight robu…
New framework certifies robustness for regression models.
problem Certifying robustness for regression models is challenging.
method Derives a prediction-centered certificate that exploits local geometry.
result Gradient information yields tighter robustness certificates.
New approach to certifiably robust neural networks using Boolean function perspective.
problem Lack of principled understanding and certified robustness for ℓ∞ perturbations. method New perspective on Boolean functions, deriving impossibility results, and developing a unified Lipschitz network.
result Unified Lipschitz network that bypasses expressive power limitations and achieves better certified robustness.
This paper proposes a framework for certifying neural network defenses against data poisoning attacks.
problem Vulnerability of neural networks to data poisoning attacks.
method Random selection based defenses that average predictions on sub-datasets sampled from the training set.
result The certified radius of bagging derived by the framework is tighter than previous work.
Convex relaxations are effective for training and certifying neural networks against norm-bounded adversarial attacks, but they leave a large gap between certifiable and empirical robustness. In principle, convex relaxation can provide tight bounds if the solution to the relaxed problem is feasible for the original non…
This paper assesses Gaussian and Exponential mechanisms for certifying adversarial robustness.
problem Certifying adversarial robustness using randomized smoothing mechanisms.
method Proposes a generic framework to assess the appropriateness of randomized smoothing mechanisms.
result Gaussian mechanism is an appropriate option for certifying both ℓ2-norm and ℓ∞-norm robustness. Recent works show that Graph Neural Networks (GNNs) are highly non-robust with respect to adversarial attacks on both the graph structure and the node attributes, making their outcomes unreliable. We propose the first method for certifiable (non-)robustness of graph convolutional networks with respect to perturbations …
Paper proposes faster certified robust training methods with short warmup.
problem Certified robust training methods require long warmup schedules, making training costly.
method Proposes three improvements: new weight initialization, BN, and regularization.
result Achieves 65.03% verified error on CIFAR-10 and 82.36% on TinyImageNet with short warmup.
Improved training boosts certified robustness of L-infinity distance nets.
problem Certified robustness of L-infinity distance nets is not as strong as conventional networks.
method Improved training process combining scaled cross-entropy and clipped hinge loss with a decaying mixing coefficient.
result Certified accuracy of L-infinity distance nets improved from 33.30% to 40.06% on CIFAR-10.
How can we make machine learning provably robust against adversarial examples in a scalable way? Since certified defense methods, which ensure ε-robust, consume huge resources, they can only achieve small degree of robustness in practice. Lipschitz margin training (LMT) is a scalable certified defense, but it can als…
SWEEN improves certified robustness via weighted ensembling of smoothed classifiers.
problem Finding optimal base classifiers for randomized smoothing.
method Smoothed WEighted ENsembling (SWEEN) scheme.
result SWEEN achieves optimal certified robustness under mild assumptions.
New method certifies global robustness of neural networks efficiently.
problem Adversarial examples threaten certifiably robust neural networks.
method Formalized global robustness, adapted widely-used architectures with efficient global Lipschitz bounds.
result Certifiable robust models achieve state-of-the-art verifiable accuracy with negligible costs.
Regularization improves robustness of smoothed classifiers.
problem Certifying robustness of smoothed classifiers.
method Regularizing prediction consistency over Gaussian noise.
result Significantly improved certified robustness with less training costs.
LOT improves adversarial robustness by training 1-Lipschitz convolution layers.
problem Improving adversarial robustness of deep neural networks.
method LOT: Layer-wise Orthogonal Training for 1-Lipschitz convolution layers.
result LOT significantly enhances certified robustness of Lipschitz-bounded models.
Certifiably robust VAEs are trained with bounds on input perturbations.
problem Ensuring VAEs are robust to adversarial attacks.
method Derive bounds on minimal perturbation size, control parameters, and train VAEs to meet criteria.
result Certifiably robust VAEs are more robust to attacks than standard VAEs.
Deep learning interpretation is essential to explain the reasoning behind model predictions. Understanding the robustness of interpretation methods is important especially in sensitive domains such as medical applications since interpretation results are often used in downstream tasks. Although gradient-based saliency …
Paper improves neural network robustness certification with tighter radii estimates.
problem Certifying neural networks' robustness against adversarial attacks.
method Advanced algorithms for discrete and continuous domains, optimizing sample size, standard deviation, and temperature.
result Significant improvement in certified test-set accuracy with tighter certified radii bounds.
This work improves robustness guarantees for neural networks using low rank representations.
problem Certified robustness to adversarial perturbations in neural networks.
method Low rank representations to provide improved robustness guarantees.
result Improved robustness guarantees for ℓ∞ perturbations using natural low rank representations. Paper presents certified defenses against adversarial patch attacks.
problem Certified defenses against adversarial patch attacks are needed.
method Proposes the first certified defense and faster training methods.
result Demonstrates robustness transfer across different patch shapes.
Deterministic method for certifying neural network robustness.
problem Certifying neural network robustness against adversarial attacks.
method Equivalence between training and Gaussian averaging for robustness certification.
result Comparable certified accuracy and robustness to stochastic methods but with single model evaluation.
Improved defense against data poisoning attacks by aggregating smaller subsets.
problem Mitigating the impact of poisoned data on model robustness.
method Finite Aggregation method that combines duplicates of smaller disjoint subsets for training.
result Consistent improvement in certified robustness bounds, up to 4.77% on GTSRB.
New method certifies neural network robustness to random input noise.
problem Certifying neural networks' robustness to random input noise.
method Chance-constrained optimization problem reformulated using input-output samples.
result Certifies a uniform infinity-norm uncertainty region with a radius 50 times larger.
New method improves certified robustness for classifier confidence.
problem Certifying confidence in classifier predictions.
method Randomized smoothing with modified Neyman-Pearson lemma.
result Certified radii for prediction confidence improved.
Despite the exploding interest in graph neural networks there has been little effort to verify and improve their robustness. This is even more alarming given recent findings showing that they are extremely vulnerable to adversarial attacks on both the graph structure and the node attributes. We propose the first method…
Despite their impressive performance on diverse tasks, neural networks fail catastrophically in the presence of adversarial inputs---imperceptibly but adversarially perturbed versions of natural inputs. We have witnessed an arms race between defenders who attempt to train robust networks and attackers who try to constr…
Efficient local Lipschitz bounds improve neural network robustness.
problem Certifying robustness of neural networks is challenging and often leads to over-regularization.
method Proposes an efficient trainable local Lipschitz upper bound by considering activation functions and weight matrices.
result Consistently outperforms state-of-the-art methods in clean and certified accuracy on various datasets.
Training neural networks to be certifiably robust is critical to ensure their safety against adversarial attacks. However, it is currently very difficult to train a neural network that is both accurate and certifiably robust. In this work we take a step towards addressing this challenge. We prove that for every continu…
Extends randomized smoothing to certify robustness against various threat models and adversarial perturbations.
problem Certifying robustness of classifiers against adversarial perturbations.
method Develops a method to certify robustness against any ℓp (p∈N>0) minimized adversarial perturbation. result Randomized smoothing suffers from the curse of dimensionality, reducing effective radius as p increases. Adversarial training is one of the most popular ways to learn robust models but is usually attack-dependent and time costly. In this paper, we propose the MACER algorithm, which learns robust models without using adversarial training but performs better than all existing provable l2-defenses. Recent work shows that ran…
CIVET method provides robustness guarantees for VAEs under adversarial attacks.
problem Certified probabilistic guarantees for VAEs in safety-critical applications.
method Bounding worst-case VAE error by error on support sets at the latent layer.
result CIVET outperforms state-of-the-art methods in robustness and standard performance.
This work improves deep reinforcement learning robustness to adversarial state uncertainty.
problem Robustness of deep reinforcement learning to adversarial state uncertainty.
method Certified adversarial robustness techniques are applied to deep reinforcement learning algorithms to compute guaranteed lower bounds on state-action values.
result The approach increases robustness to noise and adversaries in pedestrian collision avoidance and classic control tasks.
AdvImmune improves certifiable robustness of GNNs against adversarial attacks.
problem Vulnerability of graph neural networks to adversarial attacks.
method Proposes AdvImmune, an algorithm that optimizes with meta-gradient to improve certifiable robustness.
result Remarkably improves the ratio of robust nodes by 12%, 42%, 65% with an affordable immune budget of only 5% edges.
Paper aims to ensure reliable detection of out-of-distribution data with certifiable worst-case guarantees.
problem Deep neural networks are overconfident with OOD inputs, posing safety risks.
method Enforces low confidence and bounds in an l∞-ball around OOD points using interval bound propagation (IBP). result Certifiable worst-case guarantees for OOD detection are possible without significant loss in accuracy.
Enhances robustness for time series classification using self-ensemble method.
problem Limited adversarial robustness in time series classification.
method Proposes a self-ensemble method to improve Randomized Smoothing's robustness certification.
result Demonstrates superior robustness compared to baseline approaches.