PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testing

Abstract

Vision Transformer (ViT) is known to be highly nonlinear like other classical neural networks and could be easily fooled by both natural and adversarial patch perturbations. This limitation could pose a threat to the deployment of ViT in the real industrial environment, especially in safety-critical scenarios. In this work, we propose PatchCensor, aiming to certify the patch robustness of ViT by applying exhaustive testing. We try to provide a provable guarantee by considering the worst patch attack scenarios. Unlike empirical defenses against adversarial patches that may be adaptively breached, certified robust approaches can provide a certified accuracy against arbitrary attacks under certain conditions. However, existing robustness certifications are mostly based on robust training, which often requires substantial training efforts and the sacrifice of model performance on normal samples. To bridge the gap, PatchCensor seeks to improve the robustness of the whole system by detecting abnormal inputs instead of training a robust model and asking it to give reliable results for every input, which may inevitably compromise accuracy. Specifically, each input is tested by voting over multiple inferences with different mutated attention masks, where at least one inference is guaranteed to exclude the abnormal patch. This can be seen as complete-coverage testing, which could provide a statistical guarantee on inference at the test time. Our comprehensive evaluation demonstrates that PatchCensor is able to achieve high certified accuracy (e.g. 67.1% on ImageNet for 2%-pixel adversarial patches), significantly outperforming state-of-the-art techniques while achieving similar clean accuracy (81.8% on ImageNet). Meanwhile, our technique also supports flexible configurations to handle different adversarial patch sizes (up to 25%) by simply changing the masking strategy.

arXiv commentThis paper has been accepted by ACM Transactions on Software Engineering and Methodology (TOSEM'23) in "Continuous Special Section: AI and SE." Please include TOSEM for any citations

References in corpus (17)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• DeepGauge: Multi-Granularity Testing Criteria for Deep Learning Systems
• Guiding Deep Learning System Testing using Surprise Adequacy
• Intriguing Properties of Vision Transformers
• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing
• Adversarial and Clean Data Are Not Twins
• Are Transformers More Robust Than CNNs?
• Adversarial Training against Location-Optimized Adversarial Patches
• Dynamic Slicing for Deep Neural Networks
• Operational Calibration: Debugging Confidence Errors for DNNs in the Field
• PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches
• ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layers
• Certified Patch Robustness via Smoothed Vision Transformers

Cited by in corpus (1)

• Benchmarking Federated Learning in Edge Computing Environments: A Systematic Review and Performance Evaluation