Certified Adversarial Robustness with Additive Noise

Abstract

The existence of adversarial data examples has drawn significant attention in the deep-learning community; such data are seemingly minimally perturbed relative to the original data, but lead to very different outputs from a deep-learning algorithm. Although a significant body of work on developing defensive models has been considered, most such models are heuristic and are often vulnerable to adaptive attacks. Defensive methods that provide theoretical robustness guarantees have been studied intensively, yet most fail to obtain non-trivial robustness when a large-scale model and data are present. To address these limitations, we introduce a framework that is scalable and provides certified bounds on the norm of the input manipulation for constructing adversarial examples. We establish a connection between robustness against adversarial perturbation and additive random noise, and propose a training strategy that can significantly improve the certified bounds. Our evaluation on MNIST, CIFAR-10 and ImageNet suggests that the proposed method is scalable to complicated models and large data sets, while providing competitive robustness to state-of-the-art provable defense methods.

NIPS 2019; Code: https://github.com/Bai-Li/STN-Code

Cited by in corpus (64)

• Towards Deep Learning Models Resistant to Adversarial Attacks
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond
• Adversarial Self-Supervised Contrastive Learning
• Stabilizing Differentiable Architecture Search via Perturbation-based Regularization
• Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness
• HYDRA: Pruning Adversarially Robust Neural Networks
• Adversarial Robustness via Fisher-Rao Regularization
• Drastic Circuit Depth Reductions with Preserved Adversarial Robustness by Approximate Encoding for Quantum Machine Learning
• Learning Security Classifiers with Verified Global Robustness Properties
• Towards Understanding Fast Adversarial Training
• Efficient Certified Defenses Against Patch Attacks on Image Classifiers
• Morphence: Moving Target Defense Against Adversarial Examples
• Consistency Regularization for Certified Robustness of Smoothed Classifiers
• A Simple Fine-tuning Is All You Need: Towards Robust Deep Learning Via Adversarial Fine-tuning
• Randomization matters. How to defend against strong adversarial attacks
• Percival: Making In-Browser Perceptual Ad Blocking Practical With Deep Learning
• Certifiably Robust Interpretation in Deep Learning
• Random Smoothing Might be Unable to Certify ${\ell }_{\infty }$ Robustness for High-Dimensional Images
• Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features
• Training Robust Deep Models for Time-Series Domain: Novel Algorithms and Theoretical Analysis
• Backdoor Attacks to Graph Neural Networks
• How adversarial attacks can disrupt seemingly stable accurate classifiers
• Adversarial Image Translation: Unrestricted Adversarial Examples in Face Recognition Systems
• Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space
• Improved, Deterministic Smoothing for L_1 Certified Robustness
• Certifying Confidence via Randomized Smoothing
• On the Certified Robustness for Ensemble Models and Beyond
• Boosting the Certified Robustness of L-infinity Distance Nets
• Detection Defense Against Adversarial Attacks with Saliency Map
• TSS: Transformation-Specific Smoothing for Robustness Certification
• Fast Certified Robust Training with Short Warmup
• PointGuard: Provably Robust 3D Point Cloud Classification
• Adversarial robustness via robust low rank representations
• NLP Verification: Towards a General Methodology for Certifying Robustness
• Training Certifiably Robust Neural Networks with Efficient Local Lipschitz Bounds
• Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbation
• Analyzing Accuracy Loss in Randomized Smoothing Defenses
• Policy Smoothing for Provably Robust Reinforcement Learning
• Weight-Covariance Alignment for Adversarially Robust Neural Networks
• Tight Second-Order Certificates for Randomized Smoothing
• A Game Theoretic Analysis of Additive Adversarial Attacks and Defenses
• Statistically Robust Neural Network Classification
• Provable Robust Classification via Learned Smoothed Densities
• Multi-head Ensemble of Smoothed Classifiers for Certified Robustness
• Universal Approximation with Certified Networks
• ANCER: Anisotropic Certification via Sample-wise Volume Maximization
• Adversarial Robustness Guarantees for Random Deep Neural Networks
• Downscaling Attack and Defense: Turning What You See Back Into What You Get
• A Multiclass Boosting Framework for Achieving Fast and Provable Adversarial Robustness
• A Distributionally Robust Optimization Method for Adversarial Multiple Kernel Learning
• A unified framework for divergences, free energies, and Fokker-Planck equations
• Dynamic Defense Approach for Adversarial Robustness in Deep Neural Networks via Stochastic Ensemble Smoothed Model
• Towards Assessment of Randomized Smoothing Mechanisms for Certifying Adversarial Robustness
• Hidden Cost of Randomized Smoothing
• Deterministic Certification to Adversarial Attacks via Bernstein Polynomial Approximation
• Comparative Study on Noise-Augmented Training and its Effect on Adversarial Robustness in ASR Systems
• Simpler Certified Radius Maximization by Propagating Covariances
• Identifying and Exploiting Structures for Reliable Deep Learning
• Adversarial Defenses via Vector Quantization
• Certified Robustness of Graph Classification against Topology Attack with Randomized Smoothing
• Intriguing Properties of Input-dependent Randomized Smoothing