Certified Adversarial Robustness with Additive Noise

By Bai Li, Changyou Chen, Wenlin Wang, Lawrence Carin. 2018

393 citations recorded by the source corpus.

The existence of adversarial data examples has drawn significant attention in the deep-learning community; such data are seemingly minimally perturbed relative to the original data, but lead to very different outputs from a deep-learning algorithm. Although a significant body of work on developing defensive models has been considered, most such models are heuristic and are often vulnerable to adaptive attacks. Defensive methods that provide theoretical robustness guarantees have been studied intensively, yet most fail to obtain non-trivial robustness when a large-scale model and data are present. To address these limitations, we introduce a framework that is scalable and provides certified bounds on the norm of the input manipulation for constructing adversarial examples. We establish a connection between robustness against adversarial perturbation and additive random noise, and propose a training strategy that can significantly improve the certified bounds. Our evaluation on MNIST, CIFAR-10 and ImageNet suggests that the proposed method is scalable to complicated models and large data sets, while providing competitive robustness to state-of-the-art provable defense methods.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Hardware and Architecture

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Hardware and Architecture

Citations in the corpus

Certified Adversarial Robustness via Randomized Smoothing (2019, methodology): “Tables for ImageNet and CIFAR-10 are in Appendix D. Prior randomized smoothing bounds Figure 6a plots the certified accuracy obtained using our bound alongside the certified accuracy obtained using the bounds of Lecuyer et al. (2019) and Li et al. (2018).”
Towards Stable and Efficient Training of Verifiably Robust Neural Networks (2019, methodology): “Besides these deterministic verification approaches, randomized smoothing can be used to certify the robustness of any model in a probabilistic manner (Cohen et al., 2019; Salman et al., 2019a; Lecuyer et al., 2018; Li et al., 2018).”
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (2020, background): “Another line of work are provable defenses, either deterministic (Wong et al., 2018; Croce et al., 2019a; Mirman et al., 2018; Gowal et al., 2019a) or based on randomized smoothing (Li et al., 2019; Lecuyer et al., 2019; Cohen et al., 2019).”
Certifying LLM Safety against Adversarial Prompting (2023, neutral): “…propagation (Gowal et al., 2018; Huang et al., 2019; Dvijotham et al., 2018; Mirman et al., 2018), curvature bounds (Wong & Kolter, 2018; Raghunathan et al., 2018; Singla & Feizi, 2020; 2021) and randomized smoothing (Cohen et al., 2019; L´ecuyer et al., 2019; Li et al., 2019; Salman et al., 2019).”
The Roadmap to 6G Security and Privacy (2021, background): “Another countermeasure against model inversion attacks is to add noise to ML prediction [136].”
Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond (2020, methodology): “Along with these methods, randomization based probabilistic defenses have been proposed [5, 27, 26, 34], but in this work we mostly focus on LiRPA based deterministic certified defense method.”
Adversarial Self-Supervised Contrastive Learning (2020, background): “Li et al.[23], "randomized smoothing" technique has been empirically proposed as certiﬁed robustness.”