Learning Security Classifiers with Verified Global Robustness Properties

Abstract

Many recent works have proposed methods to train classifiers with local robustness properties, which can provably eliminate classes of evasion attacks for most inputs, but not all inputs. Since data distribution shift is very common in security applications, e.g., often observed for malware detection, local robustness cannot guarantee that the property holds for unseen inputs at the time of deploying the classifier. Therefore, it is more desirable to enforce global robustness properties that hold for all inputs, which is strictly stronger than local robustness. In this paper, we present a framework and tools for training classifiers that satisfy global robustness properties. We define new notions of global robustness that are more suitable for security classifiers. We design a novel booster-fixer training framework to enforce global robustness properties. We structure our classifier as an ensemble of logic rules and design a new verifier to verify the properties. In our training algorithm, the booster increases the classifier's capacity, and the fixer enforces verified global robustness properties following counterexample guided inductive synthesis. We show that we can train classifiers to satisfy different global robustness properties for three security datasets, and even multiple properties at the same time, with modest impact on the classifier's performance. For example, we train a Twitter spam account classifier to satisfy five global robustness properties, with 5.4% decrease in true positive rate, and 0.1% increase in false positive rate, compared to a baseline XGBoost model that doesn't satisfy any property.

ACM Conference on Computer and Communications Security (CCS) 2021 Best Paper Award Runner-Up

References in corpus (38)

• XGBoost: A Scalable Tree Boosting System
• Intriguing properties of neural networks
• Predictive learning via rule ensembles
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Certified Defenses against Adversarial Examples
• Efficient Neural Network Robustness Certification with General Activation Functions
• Evaluating Robustness of Neural Networks with Mixed Integer Programming
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• Formal Security Analysis of Neural Networks using Symbolic Intervals
• Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• An approach to reachability analysis for feed-forward ReLU neural networks
• Adversarial Robustness through Local Linearization
• Semidefinite relaxations for certifying robustness to adversarial examples
• Certified Adversarial Robustness with Additive Noise
• Efficient Formal Safety Analysis of Neural Networks
• A Dual Approach to Scalable Verification of Deep Networks
• Training robust neural networks using Lipschitz bounds
• A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks
• Scaling provable adversarial defenses
• Evasion and Hardening of Tree Ensemble Classifiers
• Training verified learners with learned verifiers
• Generalizable Adversarial Training via Spectral Normalization
• Sorting out Lipschitz function approximation
• Deep Neural Networks as 0-1 Mixed Integer Linear Programs: A Feasibility Study
• Fast and Complete: Enabling Complete Neural Network Verification with Rapid and Massively Parallel Incomplete Verifiers
• Monotonic Calibrated Interpolated Look-Up Tables
• Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing
• Globally-Robust Neural Networks
• SoK: Certified Robustness for Deep Neural Networks
• Scaling Polyhedral Neural Network Verification on GPUs
• Cost-Sensitive Robustness against Adversarial Examples
• Unconstrained Monotonic Neural Networks
• Universal Lipschitz Approximation in Bounded Depth Neural Networks
• Fantastic Four: Differentiable Bounds on Singular Values of Convolution Layers
• ART: Abstraction Refinement-Guided Training for Provably Correct Neural Networks
• Fast Training of Provably Robust Neural Networks by SingleProp