[论文解读] Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation

Matthias Hein, Maksym Andriushchenko|arXiv (Cornell University)|May 23, 2017

Adversarial Robustness in Machine Learning参考文献 1被引用 146

一句话总结

本文为分类器提供针对实例的正式鲁棒性保证，并引入 Cross-Lipschitz Regularization 以提高核方法和神经网络的鲁棒性。

ABSTRACT

Recent work has shown that state-of-the-art classifiers are quite brittle, in the sense that a small adversarial change of an originally with high confidence correctly classified input leads to a wrong classification again with high confidence. This raises concerns that such classifiers are vulnerable to attacks and calls into question their usage in safety-critical systems. We show in this paper for the first time formal guarantees on the robustness of a classifier by giving instance-specific lower bounds on the norm of the input manipulation required to change the classifier decision. Based on this analysis we propose the Cross-Lipschitz regularization functional. We show that using this form of regularization in kernel methods resp. neural networks improves the robustness of the classifier without any loss in prediction performance.

研究动机与目标

• Motivate the need for formal robustness guarantees in safety-critical systems against adversarial input changes.
• Derive instance-specific lower bounds on the input perturbation required to change classifier decisions.
• Propose the Cross-Lipschitz regularization functional to enhance robustness without sacrificing accuracy.
• Explain evaluation of bounds for kernel methods and for neural networks.
• Provide practical methods for box-constrained adversarial sample generation to assess robustness.

提出的方法

• Derive an instance-specific robustness bound: the perturbation norm is bounded below by alpha, based on the local cross-Lipschitz constants of class scores.
• Specialize the bound for kernel methods with Gaussian kernels and provide tractable expressions to estimate the local cross-Lipschitz terms.
• Specialize the bound for neural networks with one hidden layer and a differentiable activation to compute a tractable cross-Lipschitz bound.
• Introduce the Cross-Lipschitz Regularization functional Omega(f) that minimizes differences of gradients across class outputs at training points.
• Show that minimizing the training loss plus lambda times Omega(f) promotes robustness by increasing the min perturbation required for misclassification.
• Provide algorithms to generate box-constrained adversarial samples in O(d log d) time for p in {1,2,∞} using first-order approximations.

实验结果

研究问题

• RQ1 What are instance-specific lower bounds on the input perturbation norm that guarantee the classifier decision remains unchanged?
• RQ2 How can we compute and tighten local cross-Lipschitz constants for different classifier families to obtain meaningful robustness guarantees?
• RQ3 Can Cross-Lipschitz regularization improve robustness with minimal loss in predictive performance for kernel methods and neural networks?
• RQ4 How can adversarial samples be efficiently generated under box constraints to evaluate the derived robustness guarantees?
• RQ5 Do the proposed bounds and regularization yield tighter guarantees than previous global Lipschitz approaches?

主要发现

• A formal, instance-specific robustness bound is derived, guaranteeing the decision does not change within a ball around the input.
• For kernel methods with Gaussian kernels, the bound reduces to computable expressions involving training data, kernel derivatives, and local Lipschitz terms.
• For a one-hidden-layer neural network, a computable bound on the cross-Lipschitz term is derived using the network weights and activation derivatives.
• The Cross-Lipschitz Regularization Omega(f) is proposed and shown to improve robustness guarantees while preserving comparable accuracy.
• Box-constrained adversarial samples can be generated in O(d log d) time for p = 1, 2, ∞, enabling practical evaluation of robustness and tightness of bounds.