MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius

DE-CROP: Data-efficient Certified Robustness for Pretrained Classifiers

Certified defense using randomized smoothing is a popular technique to provide robustness guarantees for deep neural networks against l2 adversarial attacks. Existing works use this technique to provably secure a pretrained non-robust model by training a custom denoiser network on entire training data. However, access to the training set may be restricted to a handful of data samples due to constraints such as high transmission cost and the proprietary nature of the data. Thus, we formulate a novel problem of "how to certify the robustness of pretrained models using only a few training samples…

在观察攻击下的鲁棒多智能体路径寻找：一种基于对抗性加平滑训练的原理性配方

Robust Multi-Agent Path Finding under Observation Attacks: A Principled Adversarial-Plus-Smoothing Training Recipe

本文提出两种训练方法，使多智能体路径寻找在受扰观测下保持稳定，通过对抗训练和平滑项提升鲁棒性，实验显示在8x8地图上性能显著提升。

How Robust are Randomized Smoothing based Defenses to Data Poisoning?

Predictions of certifiably robust classifiers remain constant in a neighborhood of a point, making them resilient to test-time attacks with a guarantee. In this work, we present a previously unrecognized threat to robust machine learning models that highlights the importance of training-data quality in achieving high certified adversarial robustness. Specifically, we propose a novel bilevel optimization-based data poisoning attack that degrades the robustness guarantees of certifiably robust classifiers. Unlike other poisoning attacks that reduce the accuracy of the poisoned models on a small …

自适应认证训练：迈向更优的准确率-鲁棒性权衡

Adaptive Certified Training: Towards Better Accuracy-Robustness Tradeoffs

针对现有认证训练模型标准准确率过低的问题，提出基于自适应认证半径的新型认证训练方法，在多个数据集上实现了相同标准准确率下更优的鲁棒性，提升了准确率-鲁棒性权衡水平。

Towards Certified Robustness of Distance Metric Learning

Metric learning aims to learn a distance metric such that semantically similar instances are pulled together while dissimilar instances are pushed away. Many existing methods consider maximizing or at least constraining a distance margin in the feature space that separates similar and dissimilar pairs of instances to guarantee their generalization ability. In this paper, we advocate imposing an adversarial margin in the input space so as to improve the generalization and robustness of metric learning algorithms. We first show that, the adversarial margin, defined as the distance between traini…

Simpler Certified Radius Maximization by Propagating Covariances

One strategy for adversarially training a robust model is to maximize its certified radius -- the neighborhood around a given training sample for which the model's prediction remains unchanged. The scheme typically involves analyzing a "smoothed" classifier where one estimates the prediction corresponding to Gaussian samples in the neighborhood of each sample in the mini-batch, accomplished in practice by Monte Carlo sampling. In this paper, we investigate the hypothesis that this sampling bottleneck can potentially be mitigated by identifying ways to directly propagate the covariance matrix o…