Certifying Joint Adversarial Robustness for Model Ensembles
arXiv:2004.10250
Abstract
Deep Neural Networks (DNNs) are often vulnerable to adversarial examples.Several proposed defenses deploy an ensemble of models with the hope that, although the individual models may be vulnerable, an adversary will not be able to find an adversarial example that succeeds against the ensemble. Depending on how the ensemble is used, an attacker may need to find a single adversarial example that succeeds against all, or a majority, of the models in the ensemble. The effectiveness of ensemble defenses against strong adversaries depends on the vulnerability spaces of models in the ensemble being disjoint. We consider the joint vulnerability of an ensemble of models, and propose a novel technique for certifying the joint robustness of ensembles, building upon prior works on single-model robustness certification. We evaluate the robustness of various models ensembles, including models trained using cost-sensitive robustness to be diverse, to improve understanding of the potential effectiveness of ensemble models as a defense against adversarial examples.
Open source code for our implementation and for reproducing our experiments is available at https://github.com/jonas-maj/ensemble-adversarial-robustness
References in corpus (9)
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Certified Adversarial Robustness via Randomized Smoothing
- Robust Physical-World Attacks on Deep Learning Models
- Detecting Adversarial Samples from Artifacts
- Evaluating Robustness of Neural Networks with Mixed Integer Programming
- Cost-Sensitive Robustness against Adversarial Examples
- ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
- -ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers