Certified Defenses against Adversarial Examples
Aditi Raghunathan, Jacob Steinhardt、Percy Liang Department of Computer Science Stanford University
Abstract
While neural networks have achieved high accuracy on standard image classification benchmarks, their accuracy drops to nearly zero in the presence of small adversarial perturbations to test inputs. Defenses based on regularization and adversarial training have been proposed, but often followed by new, stronger attacks that defeat these defenses. Can we somehow end this arms race? In this work, we study this problem for neural networks with one hidden layer. We first propose a method based on a semidefinite relaxation that outputs a certificate that for a given network and test input, no attack can force the error to exceed a certain value. Second, as this certificate is differentiable, we jointly optimize it with the network parameters, providing an adaptive regularizer that encourages robustness against all attacks. On MNIST, our approach produces a network and a certificate that no attack that perturbs each pixel by at most $\epsilon=0.1$ can cause more than $35\%$ test error.
中文速览
对抗样本（adversarial examples）会让神经网络在图像分类上的准确率骤降至接近零，现有防御方法总是被更强的攻击击破，陷入"攻防军备竞赛"。这项工作针对单隐层神经网络，提出了一种基于半定规划松弛（semidefinite programming relaxation）的方法：先将任意攻击下的最坏分类误差转化为一个可高效求解的上界，从而为给定网络和输入颁发一张"鲁棒性证书"，数学上保证不存在任何扰动能使误差超过该上界；再利用该上界可微的特性，在训练时将其作为正则化项与网络参数联合优化，主动鼓励模型对所有攻击保持鲁棒。在MNIST上，该方法训练出的网络干净测试误差仅4.2%，并附有严格证书：在每个像素扰动不超过ε=0.1的条件下，任何攻击都无法使测试错误率超过35%。这是首批能同时做到"可证明、可训练、可扩展"的对抗防御方案之一，从根本上跳出了攻防博弈的循环。
原文 arXiv:1801.09344;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1801.09344v2