Certified Defenses against Adversarial Examples

Abstract

While neural networks have achieved high accuracy on standard image classification benchmarks, their accuracy drops to nearly zero in the presence of small adversarial perturbations to test inputs. Defenses based on regularization and adversarial training have been proposed, but often followed by new, stronger attacks that defeat these defenses. Can we somehow end this arms race? In this work, we study this problem for neural networks with one hidden layer. We first propose a method based on a semidefinite relaxation that outputs a certificate that for a given network and test input, no attack can force the error to exceed a certain value. Second, as this certificate is differentiable, we jointly optimize it with the network parameters, providing an adaptive regularizer that encourages robustness against all attacks. On MNIST, our approach produces a network and a certificate that no attack that perturbs each pixel by at most ε= 0.1 can cause more than 35% test error.

Published at the International Conference on Learning Representations (ICLR) 2018

References in corpus (10)

• Adam: A Method for Stochastic Optimization
• Ensemble Adversarial Training: Attacks and Defenses
• Achieving Human Parity in Conversational Speech Recognition
• Security Evaluation of Pattern Classifiers under Attack
• Distributional Smoothing with Virtual Adversarial Training
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
• Defensive Distillation is Not Robust to Adversarial Examples
• Towards Proving the Adversarial Robustness of Deep Neural Networks
• Biologically inspired protection of deep networks from adversarial attacks

Cited by in corpus (201)

• Ensemble Adversarial Training: Attacks and Defenses
• On Evaluating Adversarial Robustness
• Adversarially Robust Generalization Requires More Data
• Adversarial Examples Are Not Bugs, They Are Features
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Robustness May Be at Odds with Accuracy
• Efficient Neural Network Robustness Certification with General Activation Functions
• Certifying Some Distributional Robustness with Principled Adversarial Training
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Security and Privacy Approaches in Mixed Reality: A Literature Survey
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Motivating the Rules of the Game for Adversarial Example Research
• Algorithmic decision-making in AVs: Understanding ethical and technical concerns for smart cities
• Adversarial Training and Robustness for Multiple Perturbations
• Constructing Unrestricted Adversarial Examples with Generative Models
• Rademacher Complexity for Adversarially Robust Generalization
• Do Adversarially Robust ImageNet Models Transfer Better?
• Blind Backdoors in Deep Learning Models
• Adversarial Attacks Against Medical Deep Learning Systems
• Training for Faster Adversarial Robustness Verification via Inducing ReLU Stability
• Unsolved Problems in ML Safety
• Towards quantum enhanced adversarial robustness in machine learning
• On the Robustness of Interpretability Methods
• Test-Time Training with Self-Supervision for Generalization under Distribution Shifts
• Unlabeled Data Improves Adversarial Robustness
• On the (In)fidelity and Sensitivity for Explanations
• Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting
• The Limitations of Adversarial Training and the Blind-Spot Attack
• Security and Privacy Issues in Deep Learning
• Excessive Invariance Causes Adversarial Vulnerability
• Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
• Adversarial Robustness of Deep Neural Networks: A Survey from a Formal Verification Perspective
• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
• Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
• RAB: Provable Robustness Against Backdoor Attacks
• Certified Adversarial Robustness for Deep Reinforcement Learning
• Efficient and Accurate Estimation of Lipschitz Constants for Deep Neural Networks
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• Overfitting in adversarially robust deep learning
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Understanding and Improving Fast Adversarial Training
• VC Classes are Adversarially Robustly Learnable, but Only Improperly
• Logit Pairing Methods Can Fool Gradient-Based Attacks
• Learning perturbation sets for robust machine learning
• Towards Stable and Efficient Training of Verifiably Robust Neural Networks
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking
• Provably Robust Boosted Decision Stumps and Trees against Adversarial Attacks
• On the Loss Landscape of Adversarial Training: Identifying Challenges and How to Overcome Them
• DNNV: A Framework for Deep Neural Network Verification
• Algorithms for Verifying Deep Neural Networks
• Adversarial Robustness for Code
• Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functions
• Randomized Smoothing of All Shapes and Sizes
• L2-Nonexpansive Neural Networks
• Towards a Robust and Trustworthy Machine Learning System Development: An Engineering Perspective
• Graph Adversarial Training: Dynamically Regularizing Based on Graph Structure
• Transferable Adversarial Attacks for Image and Video Object Detection
• Globally-Robust Neural Networks
• Adversarial Robustness via Fisher-Rao Regularization
• Data Poisoning against Differentially-Private Learners: Attacks and Defenses
• Learning Security Classifiers with Verified Global Robustness Properties
• ADef: an Iterative Algorithm to Construct Adversarial Deformations
• Towards Understanding Fast Adversarial Training
• Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack
• Adversarial Risk Bounds via Function Transformation
• Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attacks
• Fast Neural Network Verification via Shadow Prices
• Viewmaker Networks: Learning Views for Unsupervised Representation Learning
• Morphence: Moving Target Defense Against Adversarial Examples
• More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models
• Provable Certificates for Adversarial Examples: Fitting a Ball in the Union of Polytopes
• Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features
• PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier
• Improving adversarial robustness of deep neural networks by using semantic information
• Model Assertions for Monitoring and Improving ML Models
• Semialgebraic Optimization for Lipschitz Constants of ReLU Networks
• Adversarial Machine Learning in Wireless Communications using RF Data: A Review
• Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagation
• Physically Realizable Adversarial Examples for LiDAR Object Detection
• Certified Robustness to Adversarial Word Substitutions
• A Provable Defense for Deep Residual Networks
• ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies
• Robust Deep Reinforcement Learning through Adversarial Loss
• Towards Understanding the Adversarial Vulnerability of Skeleton-based Action Recognition
• A Spectral View of Adversarially Robust Features
• Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Utility is in the Eye of the User: A Critique of NLP Leaderboards
• Defending Against Physically Realizable Attacks on Image Classification
• Counterexample-Guided Learning of Monotonic Neural Networks
• Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them
• DeepCover: Advancing RNN Test Coverage and Online Error Prediction using State Machine Extraction
• SoK: Machine Learning Governance
• Calibrated Surrogate Losses for Adversarially Robust Classification
• Understanding Generalization in Adversarial Training via the Bias-Variance Decomposition
• Distributionally Robust Local Non-parametric Conditional Estimation
• Enhancing Certifiable Robustness via a Deep Model Ensemble
• Efficient Adversarial Training with Transferable Adversarial Examples
• Towards neural networks that provably know when they don't know
• GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems
• Universal Lipschitz Approximation in Bounded Depth Neural Networks
• On Certifying Non-uniform Bound against Adversarial Attacks
• Correctness Verification of Neural Networks
• Improved Image Wasserstein Attacks and Defenses
• Understanding Adversarial Robustness: The Trade-off between Minimum and Average Margin
• Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothing
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Improving Adversarial Robustness via Guided Complement Entropy
• Truth or Backpropaganda? An Empirical Investigation of Deep Learning Theory
• Detecting Adversarial Examples via Neural Fingerprinting
• On the Need for Topology-Aware Generative Models for Manifold-Based Defenses
• On Training Robust PDF Malware Classifiers
• HoneyModels: Machine Learning Honeypots
• Semantics Preserving Adversarial Learning
• Lipschitz Networks and Distributional Robustness
• Boosting the Certified Robustness of L-infinity Distance Nets
• ART: Abstraction Refinement-Guided Training for Provably Correct Neural Networks
• Improving the Tightness of Convex Relaxation Bounds for Training Certifiably Robust Classifiers
• Adversarial Robustness of Supervised Sparse Coding
• Refactoring Neural Networks for Verification
• Fast Certified Robust Training with Short Warmup
• Lipschitz Bounds and Provably Robust Training by Laplacian Smoothing
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations
• Enhancing Certified Robustness via Smoothed Weighted Ensembling
• A Comprehensive Evaluation Framework for Deep Model Robustness
• A Method for Computing Class-wise Universal Adversarial Perturbations
• On the Sample Complexity of Adversarial Multi-Source PAC Learning
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Certified Adversarial Defenses Meet Out-of-Distribution Corruptions: Benchmarking Robustness and Simple Baselines
• Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent
• Rearchitecting Classification Frameworks For Increased Robustness
• Towards Understanding Limitations of Pixel Discretization Against Adversarial Attacks
• Detection as Regression: Certified Object Detection by Median Smoothing
• Robust Adversarial Learning via Sparsifying Front Ends
• Double Backpropagation for Training Autoencoders against Adversarial Attack
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbation
• CROP: Certifying Robust Policies for Reinforcement Learning through Functional Smoothing
• Improving Adversarial Robustness via Unlabeled Out-of-Domain Data
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• Adversarially Robust Learning for Security-Constrained Optimal Power Flow
• Understanding Catastrophic Overfitting in Adversarial Training
• DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks
• Architecture Selection via the Trade-off Between Accuracy and Robustness
• Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neurons
• A Singular Value Perspective on Model Robustness
• On the Tightness of Semidefinite Relaxations for Certifying Robustness to Adversarial Examples
• Provable robustness against all adversarial $l_p$-perturbations for $p\ge 1$
• Adversarial Examples for Cost-Sensitive Classifiers
• Accelerating Robustness Verification of Deep Neural Networks Guided by Target Labels
• RecurJac: An Efficient Recursive Algorithm for Bounding Jacobian Matrix of Neural Networks and Its Applications
• Robust Classification using Robust Feature Augmentation
• AdvFoolGen: Creating Persistent Troubles for Deep Classifiers
• Universal Approximation with Certified Networks
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• Certified Defense via Latent Space Randomized Smoothing with Orthogonal Encoders
• Adversarial Robustness Guarantees for Random Deep Neural Networks
• A Robust Classification-autoencoder to Defend Outliers and Adversaries
• Relaxing Local Robustness
• Insta-RS: Instance-wise Randomized Smoothing for Improved Robustness and Accuracy
• Adversarial Learning with Cost-Sensitive Classes
• A Multiclass Boosting Framework for Achieving Fast and Provable Adversarial Robustness
• Generating Structured Adversarial Attacks Using Frank-Wolfe Method
• Overestimation learning with guarantees
• Meta Gradient Adversarial Attack
• Adversarial Robustness on Image Classification with $k$-means
• Resilience from Diversity: Population-based approach to harden models against adversarial attacks
• 10 Security and Privacy Problems in Large Foundation Models
• Robust Generalization of Quadratic Neural Networks via Function Identification
• Domain Invariant Adversarial Learning
• Towards Evaluating and Training Verifiably Robust Neural Networks
• Sample Complexity of Adversarially Robust Linear Classification on Separated Data
• Safety-Aware Hardening of 3D Object Detection Neural Network Systems
• When the Guard failed the Droid: A case study of Android malware
• When are Non-Parametric Methods Robust?
• Neural Belief Reasoner
• Empirically Measuring Concentration: Fundamental Limits on Intrinsic Robustness
• Probabilistic Verification of Fairness Properties via Concentration
• Training Machine Learning Models by Regularizing their Explanations
• Expected Tight Bounds for Robust Training
• Training Provably Robust Models by Polyhedral Envelope Regularization
• Hidden Cost of Randomized Smoothing
• Using an ensemble color space model to tackle adversarial examples
• Towards Robustness against Unsuspicious Adversarial Examples
• Robust Machine Learning via Privacy/Rate-Distortion Theory
• Consistent Non-Parametric Methods for Maximizing Robustness
• Intriguing Properties of Input-dependent Randomized Smoothing
• Adaptive Perturbation for Adversarial Attack
• Is the Rush to Machine Learning Jeopardizing Safety? Results of a Survey
• Adversarial attacks on neural networks through canonical Riemannian foliations
• Local Lipschitz Constant Computation of ReLU-FNNs: Upper Bound Computation with Exactness Verification
• Reachability Analysis of Neural Networks with Uncertain Parameters
• A Primer on Multi-Neuron Relaxation-based Adversarial Robustness Certification
• Group-Structured Adversarial Training
• Self-Gradient Networks
• A Neuro-Inspired Autoencoding Defense Against Adversarial Perturbations
• Defenses Against Multi-Sticker Physical Domain Attacks on Classifiers
• Improving Resistance to Adversarial Deformations by Regularizing Gradients
• A New Family of Neural Networks Provably Resistant to Adversarial Attacks