PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking
arXiv:2005.10884
Abstract
Localized adversarial patches aim to induce misclassification in machine learning models by arbitrarily modifying pixels within a restricted region of an image. Such attacks can be realized in the physical world by attaching the adversarial patch to the object to be misclassified, and defending against such attacks is an unsolved/open problem. In this paper, we propose a general defense framework called PatchGuard that can achieve high provable robustness while maintaining high clean accuracy against localized adversarial patches. The cornerstone of PatchGuard involves the use of CNNs with small receptive fields to impose a bound on the number of features corrupted by an adversarial patch. Given a bounded number of corrupted features, the problem of designing an adversarial patch defense reduces to that of designing a secure feature aggregation mechanism. Towards this end, we present our robust masking defense that robustly detects and masks corrupted features to recover the correct prediction. Notably, we can prove the robustness of our defense against any adversary within our threat model. Our extensive evaluation on ImageNet, ImageNette (a 10-class subset of ImageNet), and CIFAR-10 datasets demonstrates that our defense achieves state-of-the-art performance in terms of both provable robust accuracy and clean accuracy.
arXiv commentUSENIX Security Symposium 2021; extended technical report
References in corpus (23)
- PyTorch: An Imperative Style, High-Performance Deep Learning Library
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
- Understanding the Effective Receptive Field in Deep Convolutional Neural Networks
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Certified Adversarial Robustness via Randomized Smoothing
- Certified Defenses against Adversarial Examples
- Adversarially Robust Generalization Requires More Data
- Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
- On Detecting Adversarial Perturbations
- Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNet
- LaVAN: Localized and Visible Adversarial Noise
- Adversarial Patch
- Rademacher Complexity for Adversarially Robust Generalization
- Adversarial Training against Location-Optimized Adversarial Patches
- Certified Defenses for Adversarial Patches
- (De)Randomized Smoothing for Certifiable Defense against Patch Attacks
- What are the Receptive, Effective Receptive, and Projective Fields of Neurons in Convolutional Neural Networks?
- Lower Bounds on Adversarial Robustness from Optimal Transport
- Generalized No Free Lunch Theorem for Adversarial Robustness
- Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos
- Efficient Certified Defenses Against Patch Attacks on Image Classifiers
- PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning