(De)Randomized Smoothing for Certifiable Defense against Patch Attacks

2020/02/25 by Alexander Levine, Soheil Feizi, Levine, Alexander +1 · 14 citations
Computer Science · Mathematics · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #Physical Unclonable Functions (PUFs) and Hardware Security #cs.CV #cs.LG #stat.ML

paper · pdf · doi:10.48550/arxiv.2002.10733

NeurIPS 2020

openalex publication_date 2020/02/25 · arxiv created 2021/01/08 · arxiv updated 2021/01/11 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Patch adversarial attacks on images, in which the attacker can distort pixels within a region of bounded size, are an important threat model since they provide a quantitative model for physical adversarial attacks. In this paper, we introduce a certifiable defense against patch attacks that guarantees for a given image and patch attack size, no patch adversarial examples exist. Our method is related to the broad class of randomized smoothing robustness schemes which provide high-confidence probabilistic robustness certificates. By exploiting the fact that patch attacks are more constrained than general sparse attacks, we derive meaningfully large robustness certificates against them. Additionally, in contrast to smoothing-based defenses against L_p and sparse attacks, our defense method against patch attacks is de-randomized, yielding improved, deterministic certificates. Compared to the existing patch certification method proposed by Chiang et al. (2020), which relies on interval bound propagation, our method can be trained significantly faster, achieves high clean and certified robust accuracy on CIFAR-10, and provides certificates at ImageNet scale. For example, for a 5-by-5 patch attack on CIFAR-10, our method achieves up to around 57.6% certified accuracy (with a classifier with around 83.8% clean accuracy), compared to at most 30.3% certified accuracy for the existing method (with a classifier with around 47.8% clean accuracy). Our results effectively establish a new state-of-the-art of certifiable defense against patch attacks on CIFAR-10 and ImageNet. Code is available at https://github.com/alevine0/patchSmoothing.

Citations

• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Certified Adversarial Robustness via Randomized Smoothing

Cited by

• EXE-Bench: Ranking the Tradeoffs of AI-based Windows Malware Detectors for Real-World Usability
• DeepDefense: Robust Learning via Layer-Wise Gradient-Feature Alignment
• Tight Robustness Certification Through the Convex Hull of ℓ₀ Attacks
• CertMask: Certifiable Defense Against Adversarial Patches via Theoretically Optimal Mask Coverage
• Filtered-ViT: A Robust Defense Against Multiple Adversarial Patch Attacks
• Provably Robust Adaptation for Language-Empowered Foundation Models
• Reconcile Certified Robustness and Accuracy for DNN-based Smoothed Majority Vote Classifier
• DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks
• Backdoor Attacks and Defenses in Computer Vision Domain: A Survey
• IPG: Incremental Patch Generation for Generalized Adversarial Patch Training
• Scalable and Precise Patch Robustness Certification for Deep Learning Models with Top-k Predictions
• Adversarial Patch Camouflage against Aerial Detection
• Position: Certified Robustness Does Not (Yet) Imply Model Security
• PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches

Related

• Certified Defenses for Adversarial Patches
• PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier
• Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablation
• PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches
• PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking