Adversarial Robustness Guarantees for Classification with Gaussian Processes

Abstract

We investigate adversarial robustness of Gaussian Process Classification (GPC) models. Given a compact subset of the input space $T\subseteq {\mathbb{R}}^d$ enclosing a test point $x^{\ast }$ and a GPC trained on a dataset $\mathcal{D}$, we aim to compute the minimum and the maximum classification probability for the GPC over all the points in $T$. In order to do so, we show how functions lower- and upper-bounding the GPC output in $T$ can be derived, and implement those in a branch and bound optimisation algorithm. For any error threshold $\epsilon >0$ selected a priori, we show that our algorithm is guaranteed to reach values $\epsilon$-close to the actual values in finitely many iterations. We apply our method to investigate the robustness of GPC models on a 2D synthetic dataset, the SPAM dataset and a subset of the MNIST dataset, providing comparisons of different GPC training techniques, and show how our method can be used for interpretability analysis. Our empirical analysis suggests that GPC robustness increases with more accurate posterior estimation.

10 pages, 6 figures + Supplementary Material

References in corpus (10)

• Explaining and Harnessing Adversarial Examples
• Expectation Propagation for approximate Bayesian inference
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Deep Neural Networks as Gaussian Processes
• Detecting Adversarial Samples from Artifacts
• Robustness May Be at Odds with Accuracy
• Adversarial Examples, Uncertainty, and Transfer Testing Robustness in Gaussian Process Hybrid Deep Networks
• A PAC-Bayesian Tutorial with A Dropout Bound
• Adversarially Robust Optimization with Gaussian Processes
• The Limitations of Model Uncertainty in Adversarial Settings

Cited by in corpus (4)

• Recipes for when Physics Fails: Recovering Robust Learning of Physics Informed Neural Networks
• Robustness of Bayesian Neural Networks to Gradient-Based Attacks
• Strategy Synthesis for Partially-known Switched Stochastic Systems
• Formal Analysis of the Sampling Behaviour of Stochastic Event-Triggered Control