Efficient Certified Defenses Against Patch Attacks on Image Classifiers

Abstract

Adversarial patches pose a realistic threat model for physical world attacks on autonomous systems via their perception component. Autonomous systems in safety-critical domains such as automated driving should thus contain a fail-safe fallback component that combines certifiable robustness against patches with efficient inference while maintaining high performance on clean inputs. We propose BagCert, a novel combination of model architecture and certification procedure that allows efficient certification. We derive a loss that enables end-to-end optimization of certified robustness against patches of different sizes and locations. On CIFAR10, BagCert certifies 10.000 examples in 43 seconds on a single GPU and obtains 86% clean and 60% certified accuracy against 5x5 patches.

accepted at ICLR 2021

References in corpus (10)

• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Shake-Shake regularization
• Certified Adversarial Robustness with Additive Noise
• Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNet
• On Physical Adversarial Patches for Object Detection
• Improving Robustness Without Sacrificing Accuracy with Patch Gaussian Augmentation
• Certified Defenses for Adversarial Patches

Cited by in corpus (6)

• PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking
• PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches
• Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Frame
• PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier
• Provable Robustness Against a Union of ${\ell }_0$ Adversarial Attacks
• DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks