RAB：抵御后门攻击的可证明鲁棒性
RAB: Provable Robustness Against Backdoor Attacks
AI总结：
本文提出首个鲁棒训练流程RAB，基于随机平滑技术构建统一框架，提供并证明了抵御后门攻击的紧致可证明鲁棒性界限，并在多种模型和数据集上建立了首个基准。
摘要：
近期研究表明，深度神经网络（DNNs）容易受到对抗攻击的威胁，包括逃逸攻击和后门（投毒）攻击。在防御方面，针对提升抵御逃逸攻击的经验鲁棒性和可证明鲁棒性已有大量研究；然而，针对后门攻击的可证明鲁棒性在很大程度上仍未被探索。本文重点关注认证机器学习模型在一般威胁模型（尤其是后门攻击）下的鲁棒性。我们首先通过随机平滑技术提供了一个统一框架，并展示了如何将其实例化以认证抵御逃逸和后门攻击的鲁棒性。随后，我们提出了首个鲁棒训练流程 RAB，用于平滑已训练的模型并认证其抵御后门攻击的鲁棒性。我们证明了使用 RAB 训练的机器学习模型的鲁棒性界限，并证明该界限是紧的。此外，我们从理论上证明，对于 K 近邻分类器等简单模型，可以高效地训练鲁棒的平滑模型，并提出了一种精确的平滑训练算法，消除了此类模型从噪声分布中采样的需求。在实验方面，我们在 MNIST、CIFAR-10 和 ImageNette 数据集上，针对 DNNs、支持向量机和 K-NN 模型等不同机器学习（ML）模型进行了全面实验，并提供了首个抵御后门攻击的可证明鲁棒性基准。此外，我们在 spambase 表格数据集上评估了 K-NN 模型，以展示所提精确算法的优势。理论分析以及在多种 ML 模型和数据集上的全面评估，为抵御一般训练时攻击的进一步鲁棒学习策略提供了启示。
英文摘要：
Recent studies have shown that deep neural networks (DNNs) are vulnerable to adversarial attacks, including evasion and backdoor (poisoning) attacks. On the defense side, there have been intensive efforts on improving both empirical and provable robustness against evasion attacks; however, the provable robustness against backdoor attacks still remains largely unexplored. In this paper, we focus on certifying the machine learning model robustness against general threat models, especially backdoor attacks. We first provide a unified framework via randomized smoothing techniques and show how it can be instantiated to certify the robustness against both evasion and backdoor attacks. We then propose the first robust training process, RAB, to smooth the trained model and certify its robustness against backdoor attacks. We prove the robustness bound for machine learning models trained with RAB and prove that our robustness bound is tight. In addition, we theoretically show that it is possible to train the robust smoothed models efficiently for simple models such as K-nearest neighbor classifiers, and we propose an exact smooth-training algorithm that eliminates the need to sample from a noise distribution for such models. Empirically, we conduct comprehensive experiments for different machine learning (ML) models such as DNNs, support vector machines, and K-NN models on MNIST, CIFAR-10, and ImageNette datasets and provide the first benchmark for certified robustness against backdoor attacks. In addition, we evaluate K-NN models on a spambase tabular dataset to demonstrate the advantages of the proposed exact algorithm. Both the theoretic analysis and the comprehensive evaluation on diverse ML models and datasets shed light on further robust learning strategies against general training time attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
