Provable Robustness Against a Union of ${\ell }_0$ Adversarial Attacks

Abstract

Sparse or ${\ell }_0$ adversarial attacks arbitrarily perturb an unknown subset of the features. ${\ell }_0$ robustness analysis is particularly well-suited for heterogeneous (tabular) data where features have different types or scales. State-of-the-art ${\ell }_0$ certified defenses are based on randomized smoothing and apply to evasion attacks only. This paper proposes feature partition aggregation (FPA) -- a certified defense against the union of ${\ell }_0$ evasion, backdoor, and poisoning attacks. FPA generates its stronger robustness guarantees via an ensemble whose submodels are trained on disjoint feature sets. Compared to state-of-the-art ${\ell }_0$ defenses, FPA is up to 3,000$\times$ faster and provides larger median robustness guarantees (e.g., median certificates of 13 pixels over 10 for CIFAR10, 12 pixels over 10 for MNIST, 4 features over 1 for Weather, and 3 features over 1 for Ames), meaning FPA provides the additional dimensions of robustness essentially for free.

Accepted at AAAI 2024 -- Extended version including the supplementary material

References in corpus (12)

• Poisoning Attacks against Support Vector Machines
• Certified Adversarial Robustness via Randomized Smoothing
• Vertical Federated Learning: Challenges, Methodologies and Experiments
• Efficient Certified Defenses Against Patch Attacks on Image Classifiers
• Privacy-Preserving Feature Selection with Secure Multiparty Computation
• Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation
• Adapting and Evaluating Influence-Estimation Methods for Gradient-Boosted Decision Trees
• Run-Off Election: Improved Provable Defense against Data Poisoning Attacks
• On Collective Robustness of Bagging Against Data Poisoning
• Provable Adversarial Robustness for Fractional Lp Threat Models
• Reducing Certified Regression to Certified Classification for General Poisoning Attacks
• Lethal Dose Conjecture on Data Poisoning

Cited by in corpus (2)

• How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses
• Training Data Influence Analysis and Estimation: A Survey