Certified Training: Small Boxes are All You Need
read the original abstract
To obtain, deterministic guarantees of adversarial robustness, specialized training methods are used. We propose, SABR, a novel such certified training method, based on the key insight that propagating interval bounds for a small but carefully selected subset of the adversarial input region is sufficient to approximate the worst-case loss over the whole region while significantly reducing approximation errors. We show in an extensive empirical evaluation that SABR outperforms existing certified defenses in terms of both standard and certifiable accuracies across perturbation magnitudes and datasets, pointing to a new class of certified training methods promising to alleviate the robustness-accuracy trade-off.
This paper has not been read by Pith yet.
Forward citations
Cited by 4 Pith papers
-
Certified Training with Branch-and-Bound for Lyapunov-stable Neural Control
CT-BaB integrates branch-and-bound during training to tighten certified Lyapunov bounds, yielding neural controllers with 164X larger verifiable ROA and 11X faster verification than CEGIS on a 2D quadrotor.
-
Towards Generalized Certified Robustness with Multi-Norm Training
CURE is the first multi-norm certified training method that improves union robustness across l_p norms and unseen perturbations on MNIST, CIFAR-10 and TinyImagenet.
-
Measuring Model Robustness via Fisher Information: Spectral Bounds, Theoretical Guarantees, and Practical Algorithms
Proposes spectral norm of Fisher Information Matrix as attack-agnostic robustness metric with closed-form bounds for common architectures and correlation to adversarial vulnerability.
-
On the Extreme Variance of Certified Local Robustness Across Model Seeds
Certified robustness varies extremely across training seeds with std larger than recent gains, and generalizes poorly to unseen data.
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.