[Paper Review] (De)Randomized Smoothing for Certifiable Defense against Patch Attacks

Alexander Levine, Soheil Feizi|arXiv (Cornell University)|Feb 25, 2020

Adversarial Robustness in Machine Learning26 references49 citations

TL;DR

This paper presents a derandomized, structured ablation defense against patch attacks using block and band smoothing to provide exact, certifiable robustness for images, scalable from CIFAR-10 to ImageNet.

ABSTRACT

Patch adversarial attacks on images, in which the attacker can distort pixels within a region of bounded size, are an important threat model since they provide a quantitative model for physical adversarial attacks. In this paper, we introduce a certifiable defense against patch attacks that guarantees for a given image and patch attack size, no patch adversarial examples exist. Our method is related to the broad class of randomized smoothing robustness schemes which provide high-confidence probabilistic robustness certificates. By exploiting the fact that patch attacks are more constrained than general sparse attacks, we derive meaningfully large robustness certificates against them. Additionally, in contrast to smoothing-based defenses against L_p and sparse attacks, our defense method against patch attacks is de-randomized, yielding improved, deterministic certificates. Compared to the existing patch certification method proposed by Chiang et al. (2020), which relies on interval bound propagation, our method can be trained significantly faster, achieves high clean and certified robust accuracy on CIFAR-10, and provides certificates at ImageNet scale. For example, for a 5-by-5 patch attack on CIFAR-10, our method achieves up to around 57.6% certified accuracy (with a classifier with around 83.8% clean accuracy), compared to at most 30.3% certified accuracy for the existing method (with a classifier with around 47.8% clean accuracy). Our results effectively establish a new state-of-the-art of certifiable defense against patch attacks on CIFAR-10 and ImageNet. Code is available at https://github.com/alevine0/patchSmoothing.

Motivation & Objective

• Motivate robust defenses against patch adversaries modeling physical attacks on images.
• Develop a certifiable defense that leverages the structured nature of patch attacks to improve protection.
• Propose a derandomized smoothing approach with block/band ablation that yields exact robustness certificates.
• Show that the method scales to large datasets (CIFAR-10, ImageNet) with superior certified accuracy.
• Compare against prior interval-bound propagation methods to demonstrate faster training and better performance.

Proposed method

• Propose two structured ablation schemes (Block Smoothing and Band Smoothing) that retain correlated pixel groups to minimize patch overlap probability.
• Use a base classifier fed with ablated inputs; count votes across all possible retained blocks/bands to form n_c(x) for each class.
• Provide deterministic robustness certificates by exact computation of class probabilities rather than sampling-based estimates.
• Utilize a threshold (theta) to allow abstention or multi-class voting when the base classifier is uncertain.
• Derandomize traditional L0 randomized smoothing to obtain certificates that are exact rather than probabilistic.
• Empirically determine that Column Smoothing (bands/columns) yields the strongest certificates across datasets.

Experimental results

Research questions

• RQ1 Can structured ablation (block/band) reduce the probability that a patch attack intersects retained pixels more effectively than naive sparse ablation?
• RQ2 Does a derandomized, structured smoothing approach provide exact robustness certificates and improve certified accuracy on CIFAR-10 and ImageNet-scale tasks?
• RQ3 How do block vs. band smoothing compare in terms of certified and clean accuracy across different patch sizes?
• RQ4 Can the method scale to large datasets like ImageNet while maintaining competitive certified robustness?
• RQ5 What are the practical training-time and implementation advantages over prior interval-bound propagation methods?

Key findings

• Column smoothing (band/column-based ablation) consistently yields higher certified accuracy than block smoothing on MNIST and CIFAR-10.
• For 5x5 patches on CIFAR-10, the method achieves 57.58% certified accuracy with 83.82% clean accuracy, vs. 30.3% certified with 47.8% clean for Chiang et al. (2020).
• On MNIST, the method attains 52.44% certified accuracy with 96.54% clean accuracy.
• On ImageNet (42x42 patch), the method achieves 13.9% certified accuracy with 44.6% clean accuracy.
• Derandomized (structured) smoothing improves certificates over randomized counterparts by up to ~7 percentage points on CIFAR-10.
• The approach scales to ImageNet and offers faster training relative to prior certifiable defenses against patch attacks.