Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates

2020/03/19 by Ghiasi, Amin, Shafahi, Ali, Goldstein, Tom
#FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML)

paper · doi:10.48550/arxiv.2003.08937

Abstract

To deflect adversarial attacks, a range of "certified" classifiers have been proposed. In addition to labeling an image, certified classifiers produce (when possible) a certificate guaranteeing that the input image is not an ℓ_p-bounded adversarial example. We present a new attack that exploits not only the labelling function of a classifier, but also the certificate generator. The proposed method applies large perturbations that place images far from a class boundary while maintaining the imperceptibility property of adversarial examples. The proposed "Shadow Attack" causes certifiably robust networks to mislabel an image and simultaneously produce a "spoofed" certificate of robustness.

Related

• Certified but Fooled! Breaking Certified Defences with Ghost Certificates
• Adversarial Examples Make Strong Poisons
• Certified Defenses against Adversarial Examples
• Et Tu Certifications: Robustness Certificates Yield Better Adversarial Examples
• Adversarial Attacks are Reversible with Natural Supervision