Certified Defenses for Adversarial Patches

Abstract

Adversarial patch attacks are among one of the most practical threat models against real-world computer vision systems. This paper studies certified and empirical defenses against patch attacks. We begin with a set of experiments showing that most existing defenses, which work by pre-processing input images to mitigate adversarial patches, are easily broken by simple white-box adversaries. Motivated by this finding, we propose the first certified defense against patch attacks, and propose faster methods for its training. Furthermore, we experiment with different patch shapes for testing, obtaining surprisingly good robustness transfer across shapes, and present preliminary results on certified defense against sparse attacks. Our complete implementation can be found on: https://github.com/Ping-C/certifiedpatchdefense.

arXiv commentInternational Conference on Learning Representations, ICLR 2020

References in corpus (7)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• LaVAN: Localized and Visible Adversarial Noise
• Enhancing Gradient-based Attacks with Symbolic Intervals

Cited by in corpus (24)

• Blind Backdoors in Deep Learning Models
• Adversarial Training against Location-Optimized Adversarial Patches
• (De)Randomized Smoothing for Certifiable Defense against Patch Attacks
• Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness
• PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking
• PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches
• Efficient Certified Defenses Against Patch Attacks on Image Classifiers
• Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Frame
• Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attacks
• PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier
• ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layers
• Improved, Deterministic Smoothing for L_1 Certified Robustness
• Certifying Confidence via Randomized Smoothing
• Adversarial Patch Camouflage against Aerial Detection
• Provable Robustness Against a Union of ${\ell }_0$ Adversarial Attacks
• Adversarial Training Helps Transfer Learning via Better Representations
• Meta Adversarial Training against Universal Patches
• Policy Smoothing for Provably Robust Reinforcement Learning
• DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks
• Detecting Patch Adversarial Attacks with Image Residuals
• 10 Security and Privacy Problems in Large Foundation Models
• Group-Structured Adversarial Training
• Physical world assistive signals for deep neural network classifiers -- neither defense nor attack
• Robust Face Verification via Disentangled Representations