Detection as Regression: Certified Object Detection by Median Smoothing

Abstract

Despite the vulnerability of object detectors to adversarial attacks, very few defenses are known to date. While adversarial training can improve the empirical robustness of image classifiers, a direct extension to object detection is very expensive. This work is motivated by recent progress on certified classification by randomized smoothing. We start by presenting a reduction from object detection to a regression problem. Then, to enable certified regression, where standard mean smoothing fails, we propose median smoothing, which is of independent interest. We obtain the first model-agnostic, training-free, and certified defense for object detection against 2 -bounded attacks.Preprint. Under review.

Certified Neural Network Watermarks with Randomized Smoothing

“…For our certificates, we focus on the 2 adversary described above: the goal of certification is to bound the worst-case decrease in trigger set accuracy, given that the model parameters do not move too far in 2 distance. Doing this directly is in general quite difficult (Katz et al, 2019), but using techniques from (Chiang et al, 2020;Cohen et al, 2019), we show that by adding random noise to the parameters it is possible to define a smoothed version of the model and bound the change in its trigger set accuracy.…”

“…Certified adversarial robustness involves not only training the model to be robust to adversarial attacks under particular threat models, but also proving that no possible attacks under a particular constraint could possibly succeed. Specifically, in this paper, we used the randomized smoothing technique first developed by (Cohen et al, 2019;Lecuyer et al, 2019) for classifiers, and later extended by (Chiang et al, 2020) to deal with regression models. However, as opposed to defending against an 2 -bounded threat models in the image space, we are now defending against an 2 -bounded adversary in the parameter space.…”

“…Deriving the certificate Before we start describing the watermark certificate, we will first introduce the percentile smoothed function from (Chiang et al, 2020). Definition 3.1.…”

“…As mentioned in (Chiang et al, 2020), the two forms h p and h p are needed to handle edge cases with discrete distributions. While h p may not admit a closed form, we can approximate it by Monte Carlo sampling (Cohen et al, 2019).…”

Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detection

“…In the domain of object detection, most existing defenses focus on global perturbations with a l p norm constraint [8,10,51] and only a few defenses [20,39,48] for patch attacks have been proposed. Saha [39] proposed Grad-defense and OOC defense for defending blindness attacks such that the detector is blind to a specific object category chosen by the adversary.…”