PROSAC：对抗攻击下机器学习模型的可证明安全认证
PROSAC: Provably Safe Certification for Machine Learning Models under Adversarial Attacks
AI总结：
本文提出PROSAC框架，通过假设检验和贝叶斯优化为机器学习模型提供对抗攻击下的可证明安全认证，并实验证明ViT和大型模型更具鲁棒性。
摘要：
众所周知，最先进的机器学习模型（包括视觉和语言模型）可能受到对抗性扰动的严重破坏。因此，开发在存在最有效对抗攻击的情况下认证其性能的能力日益重要。我们的论文提出了一种新方法，在存在对抗攻击的情况下，以总体风险保证来认证机器学习模型的性能。具体而言，我们引入了$(α,ζ)$-安全机器学习模型的概念。我们提出了一种基于校准集可用性的假设检验程序，以推导统计保证，确保在模型实际上不安全（即模型的对抗性总体风险高于$α$）时，声明机器学习模型的对抗性（总体）风险小于$α$（即模型是安全的）的概率小于$ζ$。我们还提出了贝叶斯优化算法，以在存在对抗攻击的情况下有效确定机器学习模型是否为$(α,ζ)$-安全，并附带统计保证。我们将我们的框架应用于一系列机器学习模型——包括各种规模的视觉Transformer（ViT）和ResNet模型——这些模型受到各种对抗攻击（如PGDAttack、MomentumAttack、GenAttack和BanditAttack）的损害，以说明我们方法的运作。重要的是，我们表明ViT通常比ResNet对对抗攻击更鲁棒，而大型模型通常比小型模型更鲁棒。我们的方法超越了现有的基于经验对抗风险的认证保证。它制定了严格的（且可证明的）性能保证，可用于满足要求使用最先进技术工具的监管要求。
英文摘要：
It is widely known that state-of-the-art machine learning models, including vision and language models, can be seriously compromised by adversarial perturbations. It is therefore increasingly relevant to develop capabilities to certify their performance in the presence of the most effective adversarial attacks. Our paper offers a new approach to certify the performance of machine learning models in the presence of adversarial attacks with population level risk guarantees. In particular, we introduce the notion of $(α,ζ)$-safe machine learning model. We propose a hypothesis testing procedure, based on the availability of a calibration set, to derive statistical guarantees providing that the probability of declaring that the adversarial (population) risk of a machine learning model is less than $α$ (i.e. the model is safe), while the model is in fact unsafe (i.e. the model adversarial population risk is higher than $α$), is less than $ζ$. We also propose Bayesian optimization algorithms to determine efficiently whether a machine learning model is $(α,ζ)$-safe in the presence of an adversarial attack, along with statistical guarantees. We apply our framework to a range of machine learning models - including various sizes of vision Transformer (ViT) and ResNet models - impaired by a variety of adversarial attacks, such as PGDAttack, MomentumAttack, GenAttack and BanditAttack, to illustrate the operation of our approach. Importantly, we show that ViT's are generally more robust to adversarial attacks than ResNets, and large models are generally more robust than smaller models. Our approach goes beyond existing empirical adversarial risk-based certification guarantees. It formulates rigorous (and provable) performance guarantees that can be used to satisfy regulatory requirements mandating the use of state-of-the-art technical tools.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
