Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablation

Abstract

Recently, techniques have been developed to provably guarantee the robustness of a classifier to adversarial perturbations of bounded L1 and L2 magnitudes by using randomized smoothing: the robust classification is a consensus of base classifications on randomly noised samples where the noise is additive. In this paper, we extend this technique to the L0 threat model. We propose an efficient and certifiably robust defense against sparse adversarial attacks by randomly ablating input features, rather than using additive noise. Experimentally, on MNIST, we can certify the classifications of over 50% of images to be robust to any distortion of at most 8 pixels. This is comparable to the observed empirical robustness of unprotected classifiers on MNIST to modern L0 attacks, demonstrating the tightness of the proposed robustness certificate. We also evaluate our certificate on ImageNet and CIFAR-10. Our certificates represent an improvement on those provided in a concurrent work (Lee et al. 2019) which uses random noise rather than ablation (median certificates of 8 pixels versus 4 pixels on MNIST; 16 pixels versus 1 pixel on ImageNet.) Additionally, we empirically demonstrate that our classifier is highly robust to modern sparse adversarial attacks on MNIST. Our classifications are robust, in median, to adversarial perturbations of up to 31 pixels, compared to 22 pixels reported as the state-of-the-art defense, at the cost of a slight decrease (around 2.3%) in the classification accuracy. Code and supplementary material is available at https://github.com/alevine0/randomizedAblation/.

Backdoor Attacks to Graph Neural Networks

“…Graph is essentially binary data, i.e., a pair of nodes can be either connected or unconnected. For binary data, a randomized smoothing method called randomized subsampling [27] achieves state-of-the-art certified robustness. Therefore, we design our certified defense based on randomized subsampling.…”

“…Randomized smoothing: Randomized smoothing [4,10,19,24,25,27,28,32] is state-of-the-art technique to build provably robust machine learning. Compared with other certified defense mechanisms, randomized smoothing has two key advantages: 1) scalable to large neural networks, and 2) applicable to arbitrary classifiers.…”

“…All these randomized smoothing methods add additive noise to a testing example. Levine et al [27] proposed randomized subsampling, which does not use additive noise and achieves state-of-the-art ℓ 0 norm certified robustness. We extend randomized subsampling to defend against our backdoor attacks.…”

“…Graph is binary data, i.e., a pair of nodes can be connected or unconnected. Randomized subsampling [27] is state-of-the-art randomized smoothing method for binary data. Therefore, we generalize randomized subsampling to defend against our backdoor attacks.…”

Towards Adversarial Patch Analysis and Certified Defense against Crowd Counting

“…Our defense strategy consists of two parts: image ablation and certificate retraining crowd counting models. The first step is inspired by the recent advance in image classifier certification [23]. Specifically, randomized ablation is effective against APAM attacks because the ablation results of normal image 𝑥 and adversarially perturbed image x are likely to be same (e.g., retaining 45 pixels for each images in Fig.…”