Efficient Certified Defenses Against Patch Attacks on Image Classifiers
arXiv:2102.04154
Abstract
Adversarial patches pose a realistic threat model for physical world attacks on autonomous systems via their perception component. Autonomous systems in safety-critical domains such as automated driving should thus contain a fail-safe fallback component that combines certifiable robustness against patches with efficient inference while maintaining high performance on clean inputs. We propose BagCert, a novel combination of model architecture and certification procedure that allows efficient certification. We derive a loss that enables end-to-end optimization of certified robustness against patches of different sizes and locations. On CIFAR10, BagCert certifies 10.000 examples in 43 seconds on a single GPU and obtains 86% clean and 60% certified accuracy against 5x5 patches.
accepted at ICLR 2021
References in corpus (6)
- Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
- Certified Adversarial Robustness via Randomized Smoothing
- Shake-Shake regularization
- Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNet
- On Physical Adversarial Patches for Object Detection
- Improving Robustness Without Sacrificing Accuracy with Patch Gaussian Augmentation