Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates

Abstract

To deflect adversarial attacks, a range of "certified" classifiers have been proposed. In addition to labeling an image, certified classifiers produce (when possible) a certificate guaranteeing that the input image is not an ${\ell }_p$-bounded adversarial example. We present a new attack that exploits not only the labelling function of a classifier, but also the certificate generator. The proposed method applies large perturbations that place images far from a class boundary while maintaining the imperceptibility property of adversarial examples. The proposed "Shadow Attack" causes certifiably robust networks to mislabel an image and simultaneously produce a "spoofed" certificate of robustness.

References in corpus (11)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Certified Adversarial Robustness via Randomized Smoothing
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Training for Faster Adversarial Robustness Verification via Inducing ReLU Stability
• Functional Adversarial Attacks
• Unrestricted Adversarial Examples
• Maximal Jacobian-based Saliency Map Attack

Cited by in corpus (6)

• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• The Threat of Adversarial Attacks on Machine Learning in Network Security -- A Survey
• TSS: Transformation-Specific Smoothing for Robustness Certification
• Deterministic Certification to Adversarial Attacks via Bernstein Polynomial Approximation
• Group-Structured Adversarial Training