Certified Robustness to Label-Flipping Attacks via Randomized Smoothing

Abstract

Machine learning algorithms are known to be susceptible to data poisoning attacks, where an adversary manipulates the training data to degrade performance of the resulting classifier. In this work, we present a unifying view of randomized smoothing over arbitrary functions, and we leverage this novel characterization to propose a new strategy for building classifiers that are pointwise-certifiably robust to general data poisoning attacks. As a specific instantiation, we utilize our framework to build linear classifiers that are robust to a strong variant of label flipping, where each test example is targeted independently. In other words, for each test point, our classifier includes a certification that its prediction would be the same had some number of training labels been changed adversarially. Randomized smoothing has previously been used to guarantee---with high probability---test-time robustness to adversarial manipulation of the input to a classifier; we derive a variant which provides a deterministic, analytical bound, sidestepping the probabilistic certificates that traditionally result from the sampling subprocedure. Further, we obtain these certified bounds with minimal additional runtime complexity over standard classification and no assumptions on the train or test distributions. We generalize our results to the multi-class case, providing the first multi-class classification algorithm that is certifiably robust to label-flipping attacks.

arXiv commentICML 2020

References in corpus (18)

• A Simple Framework for Contrastive Learning of Visual Representations
• DeCAF: A Deep Convolutional Activation Feature for Generic Visual Recognition
• How transferable are features in deep neural networks?
• Understanding Black-box Predictions via Influence Functions
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Classification with Noisy Labels by Importance Reweighting
• Certified Adversarial Robustness via Randomized Smoothing
• Security Evaluation of Pattern Classifiers under Attack
• Spectral Signatures in Backdoor Attacks
• Is feature selection secure against training data poisoning?
• Generative Poisoning Attack Method Against Neural Networks
• Transferable Clean-Label Poisoning Attacks on Deep Neural Nets
• Learning with Bad Training Data via Iterative Trimmed Loss Minimization
• Stronger Data Poisoning Attacks Break Data Sanitization Defenses
• Robust Regression via Hard Thresholding
• Representer Point Selection for Explaining Deep Neural Networks
• Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
• Efficient Algorithms for Outlier-Robust Regression

Cited by in corpus (5)

• (De)Randomized Smoothing for Certifiable Defense against Patch Attacks
• RAB: Provable Robustness Against Backdoor Attacks
• Deep Partition Aggregation: Provable Defense against General Poisoning Attacks
• Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attacks
• A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attacks