PaperlayerView exact revision on arXiv

Source-linked AI summary

Certified Defenses for Adversarial Patches

Ping-Yeh Chiang, Renkun Ni, Ahmed Abdelkader, Chen Zhu, Christoph Studer, Tom Goldstein

arXiv:2003.06693v2cs.CRcs.LGstat.ML

TL;DR

Patch attacks provide a practical physical-world threat, while existing preprocessing defenses may fail against white-box adversaries. This paper develops a certified patch defense using interval bound propagation, faster training strategies, and evaluations across patch shapes and sparse attacks. The experiments show strong certified-defense improvements, robustness transfer across shapes, and preliminary sparse-attack results, while the current defense is unlikely to scale to ImageNet.

  • Problem

    Patch attacks are practical physical-world threats, but existing preprocessing defenses can be broken by stronger white-box adversaries.

  • Method

    The paper extends interval bound propagation to certify patch robustness, modifies training for speed, and evaluates transfer across patch shapes and sparse attacks.

  • Results

    All-patch certificate training outperforms the second-best certified defense by 2.6% to 7.3% across the reported MNIST and CIFAR-10 tasks, while robustness transfers well across patch shapes.

  • Takeaways & Limitations

    Certified defenses provide a lower-bound guarantee against patch attacks and can generalize to different patch shapes, with preliminary evidence extending to sparse attacks.

  • Takeaways & Limitations

    In its current form, the proposed certified defense is unlikely to scale to ImageNet.

Abstract

from arXiv · show

Adversarial patch attacks are among one of the most practical threat models against real-world computer vision systems. This paper studies certified and empirical defenses against patch attacks. We begin with a set of experiments showing that most existing defenses, which work by pre-processing input images to mitigate adversarial patches, are easily broken by simple white-box adversaries. Motivated by this finding, we propose the first certified defense against patch attacks, and propose faster methods for its training. Furthermore, we experiment with different patch shapes for testing, obtaining surprisingly good robustness transfer across shapes, and present preliminary results on certified defense against sparse attacks. Our complete implementation can be found on: https://github.com/Ping-C/certifiedpatchdefense.

1 INTRODUCTION

Patch attacks model practical physical-world threats by restricting arbitrary pixel changes to a confined region, while existing preprocessing defenses can fail against stronger white-box adversaries. The paper responds with a certified patch defense, faster training strategies, shape-transfer experiments, and preliminary sparse-attack results.

  • 1 INTRODUCTION: Patch attacks let an adversary arbitrarily alter pixels within a confined region, modeling physical modifications such as stickers or paint.These attacks can fool classifiers with high reliability while changing only a limited portion of the image.
  • 1 INTRODUCTION: Existing preprocessing defenses such as Local Gradient Smoothing and Digital Watermarking are easily broken by stronger white-box adversaries.The adversary optimizes against the model together with its preprocessing steps.
  • 1 INTRODUCTION: The paper proposes the first certifiable defense against patch attacks by extending interval bound propagation defenses.It also modifies IBP training to make robust training faster in the patch setting.
  • 1 INTRODUCTION: Robustness transfers well across different patch shapes, and the paper reports preliminary certified-defense results for sparse attacks.Sparse attacks permit a fixed number of possibly non-adjacent pixels to be arbitrarily modified.

2 PROBLEM SETUP

The paper defines patch robustness against a white-box adversary that chooses patch contents and locations, then distinguishes empirical approximations from certified lower bounds because exact evaluation is intractable.

  • 2 PROBLEM SETUP: The white-box adversary chooses a patch from P and a location from L, then succeeds by changing the network’s classification to a wrong label.The patch operator places the selected patch on the image at the selected location.
  • 2 PROBLEM SETUP: Patch attack robust accuracy is the primary metric, measuring classification accuracy under the adversary’s worst patch and location choices.The formulation allows the adversary to choose both the patch and its placement.
  • 2 PROBLEM SETUP: The standard setup permits any patch perturbation keeping pixel intensities in [0, 1], with the patch usually restricted to a prescribed square size.The paper considers both corner-only and broader sets of possible patch locations.
  • 2 PROBLEM SETUP: 16% of adversarial accuracy is not reported
  • 2 PROBLEM SETUP: Exact adversarial accuracy is intractable because of non-convexity, so empirical adversarial accuracy approximates it while certified accuracy provides a lower bound.The certified approach avoids relying solely on how the inner minimization is solved.

3 VULNERABILITY OF EXISTING DEFENSES

Existing patch defenses preprocess images to detect or smooth patches, but white-box evaluation that incorporates preprocessing reduces their reported robustness to around 10% on ImageNet.

  • 3.1 EXISTING DEFENSES: Existing defenses use input transformations to detect and remove adversarial patches.Digital Watermarking masks dense regions identified through loss-gradient saliency, while Local Gradient Smoothing targets sharp image gradients within patches.
  • 3.1 EXISTING DEFENSES: Table 1 compares Local Gradient Smoothing and Digital Watermarking under attackers that either do or do not account for the defense during backpropagation.
  • 3.1 EXISTING DEFENSES: 12% clean-accuracy loss accompanied Digital Watermarking’s reported 63% empirical adversarial accuracy for 42 × 42 patches on ImageNet VGG19.That result used 400 randomly picked images and patches covering 2% of image pixels.
  • 3.2 BREAKING EXISTING DEFENSES: Approximately 70% for Local Gradient Smoothing and 50% for Digital Watermarking dropped to around 10% when preprocessing was included in the attack.The evaluation used IFGSM and replicated the reported setup before applying stronger white-box attacks.
  • 3.2 BREAKING EXISTING DEFENSES: BPDA breaks Digital Watermarking, while directly incorporating smoothing during backpropagation breaks Local Gradient Smoothing.The smoothing operator supplies enough gradient information despite non-differentiable windowing and thresholding.

4 CERTIFIED DEFENSES

The paper extends interval bound propagation to certify robustness against patch attacks, then reduces the quadratic cost of naïve certification through random and guided patch training. It also adapts the framework to sparse attacks and evaluates how certificates handle different patch locations and shapes.

  • Certified defense framework: Certified defenses provide lower bounds on adversarial accuracy, avoiding dependence on the strength of a particular attack optimizer.The verifier checks whether the certification condition holds across all feasible adversarial inputs and labels.
  • Certified defense framework: IBP certifies a patch by assigning patch pixels bounds [0, 1], retaining original values elsewhere, and propagating these intervals through the network.For all possible patch locations, the certificate uses the worst-case margin across location-specific bounds.
  • Efficient certificate training: Naïve certification scales quadratically with image size because every possible patch location requires a network forward pass.For a square patch of size n × n in an m × m image, there are (m − n + 1)^2 possible locations.
  • Efficient certificate training: Random Patch training samples a subset of locations, while Guided Patch training uses a U-net to predict low-margin patches before selecting locations for training.The guided method learns to predict the minimum margin and reduces the number of patches passed forward.
  • Sparse attacks: IBP can also certify sparse attacks by changing the first-layer bound to account for the k largest perturbation contributions.Subsequent layers use the same interval-propagation rules.

5 EXPERIMENTS

Experiments evaluate certified patch defenses against existing methods, compare training strategies, and test sparse-attack and cross-shape robustness. Results show strong certified performance in selected settings, efficiency–accuracy trade-offs, reasonable sparse robustness, and good transfer across patch shapes.

  • Comparison Against Existing Defenses: 91.6% certified accuracy is achieved for a 2×2 patch adversary on MNIST, while 24.9% is achieved for a 5×5 patch adversary on CIFAR-10.The 2×2 patch covers approximately .5% of MNIST image pixels, whereas the 5×5 patch covers approximately 2.5% of CIFAR-10 image pixels.
  • Comparison Against Existing Defenses: Existing defenses fell below the IBP model’s certified accuracy against stronger adversaries, despite comparable or better accuracy against weaker adversaries.The comparison concerns the analyzed cases where existing defenses achieved non-trivial accuracy against weaker attacks.
  • Comparison of Training Strategies: All-patch certificate training achieved the highest certified accuracy for a fixed architecture, exceeding the second-best defense by 2.6%–7.3% on MNIST and 3.4%–3.9% on CIFAR-10.The gains were 2.6% for MNIST 2×2, 7.3% for MNIST 5×5, 3.9% for CIFAR-10 2×2, and 3.4% for CIFAR-10 5×5.
  • Comparison of Training Strategies: Random- and guided-patch training outperform all-patch training under a fixed computational budget, while guided training consistently slightly exceeds random training.All-patch training takes 4–15 times longer than guided training and over 30–70 times longer than random training; larger architectures improve certified accuracy by over 10% compared with the best small all-patch model.
  • Effectiveness Against Sparse Attack: IBP also provides sparse-attack certificates, with 90.8% certified accuracy for k=4 on MNIST versus 91.5% for a 2×2 patch, while fully connected networks outperform convolutional networks.Against Random Ablation, IBP achieves higher certified accuracy on MNIST across sparse radii but lower accuracy on CIFAR-10, using a smaller fully connected model than ResNet-18.
  • Transferability to Patches of Different Shapes: Square-patch-trained models transfer well to other shapes, losing no more than 5% on most MNIST cases and 6% on most CIFAR-10 cases.The largest degradation occurs for rectangles and lines; MNIST with small patches even improves when transferred to lines.

6 CONCLUSION AND FUTURE WORK

The paper presents the first certified defense against patch attacks, demonstrates its effectiveness, and develops faster robust-training strategies. Certified models also transfer robustly across patch shapes, but the current defense is unlikely to scale to ImageNet.

  • The paper proposes the first certified defense against patch attacks and demonstrates its effectiveness on two datasets.
  • The authors propose strategies to speed up robust training and establish robust transferability to different patch shapes.
  • The current certified defense is unlikely to scale to ImageNet.

A.1 EXPERIMENTAL SETTINGS AND NETWORK STRUCTURE

The evaluation uses an MLP and convolutional networks of varying depth and width, including a larger CIFAR10 model with approximately 89% clean accuracy and 17M parameters.

  • The proposed defense is evaluated on an MLP and two CNNs with different depths.The MLP has one 255-neuron hidden layer; the CNNs use distinct convolutional architectures.
  • The larger CIFAR10 model has 5 convolutional layers, a 512-neuron fully connected layer, around 89% clean accuracy, and 17M parameters.

A.2 SAMPLE SHAPES FOR GENERALIZATION EXPERIMENTS

The generalization experiments test patch shapes beyond those used during training. Figure 1 presents square, parallelogram, diamond, and rectangle shapes with 4 and 25 pixels.

  • Robust accuracy transfers surprisingly well to patch shapes not considered during training.The paper points to Figure 1 and Table 5 for the generalization results.
  • Figure 1 shows square, parallelogram, diamond, and rectangle shapes containing 4 and 25 pixels.

A.3 BOUND POOLING

Bound pooling reduces computation by merging interval bounds for groups of patches, especially adjacent patches assumed to have similar bounds. It trades performance for efficiency but remains less favorable and less scalable than random- or guided-patch training.

  • Bound pooling partially reduces computation by pooling interval bounds in intermediate layers before later network layers.
  • Adjacent patches are grouped because they are assumed to generate similar bounds, producing tighter certificates.
  • Pooling 16 patches reduces training time by 35% while losing 0.7% performance on MNIST 2 × 2.
  • Guided-patch training achieves a similar performance level with almost 90% reduction in training time.
  • Bound pooling remains expensive and cannot scale to larger models like random-patch or guided-patch training.

A.4 MULTI-PATCH SPARSE TRAINING

This section reports certified-accuracy results for sparse defenses across sparsity levels and model architectures, while describing strategies that reduce patch-training cost. Random- and guided-patch training can enable larger models under fixed computational budgets.

  • A.4 MULTI-PATCH SPARSE TRAINING: Certified accuracy is tabulated across sparsity levels and model architectures for sparse defenses.The detailed results cover varying sparsity levels and architectures.
  • A.4 MULTI-PATCH SPARSE TRAINING: Random- and guided-patch training reduce cost by considering only a subset of patches instead of all possible patches.All-patch training can become too expensive for larger models or images.
  • A.4 MULTI-PATCH SPARSE TRAINING: Given a fixed computational budget, random and guided training can produce stronger models than all-patch training.These strategies allow training a larger model that would otherwise be infeasible.
Loading 2003.06693v2…