[Paper Review] MultiGuard: Provably Robust Multi-label Classification against Adversarial Examples

Jinyuan Jia, Wenjie Qu+1 more|arXiv (Cornell University)|Oct 3, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

MultiGuard is the first provably robust defense for multi-label classification using randomized smoothing with isotropic Gaussian noise. It guarantees that a certified number of ground truth labels remain in the predicted set under $ε$-bounded $l_2$ adversarial perturbations, achieving superior robustness over generalized multi-class provable defenses on VOC 2007, MS-COCO, and NUS-WIDE datasets.

ABSTRACT

Multi-label classification, which predicts a set of labels for an input, has many applications. However, multiple recent studies showed that multi-label classification is vulnerable to adversarial examples. In particular, an attacker can manipulate the labels predicted by a multi-label classifier for an input via adding carefully crafted, human-imperceptible perturbation to it. Existing provable defenses for multi-class classification achieve sub-optimal provable robustness guarantees when generalized to multi-label classification. In this work, we propose MultiGuard, the first provably robust defense against adversarial examples to multi-label classification. Our MultiGuard leverages randomized smoothing, which is the state-of-the-art technique to build provably robust classifiers. Specifically, given an arbitrary multi-label classifier, our MultiGuard builds a smoothed multi-label classifier via adding random noise to the input. We consider isotropic Gaussian noise in this work. Our major theoretical contribution is that we show a certain number of ground truth labels of an input are provably in the set of labels predicted by our MultiGuard when the $\ell_2$-norm of the adversarial perturbation added to the input is bounded. Moreover, we design an algorithm to compute our provable robustness guarantees. Empirically, we evaluate our MultiGuard on VOC 2007, MS-COCO, and NUS-WIDE benchmark datasets. Our code is available at: \url{https://github.com/quwenjie/MultiGuard}

Motivation & Objective

• To address the lack of provably robust defenses for multi-label classification, which remains vulnerable to adversarial examples.
• To extend randomized smoothing—effective in multi-class robustness—to multi-label settings with formal guarantees on label set stability.
• To derive a certified intersection size $e$, ensuring that at least $e$ ground truth labels are provably predicted under bounded perturbations.
• To design an efficient algorithm for computing certified robustness guarantees in multi-label settings.
• To empirically validate MultiGuard’s robustness and trade-offs across hyperparameters on standard benchmarks.

Proposed method

• Leverages randomized smoothing by adding isotropic Gaussian noise to inputs to create a smoothed multi-label classifier.
• Uses label probabilities $p_i$—the likelihood that label $i$ appears in the top-$k'$ predictions of the base classifier—as the basis for smoothing.
• Predicts the $k$ labels with the highest $p_i$ values as the final output, forming a robust multi-label prediction.
• Introduces a novel variant of the Neyman-Pearson Lemma for multiple functions to handle multi-label prediction in the theoretical analysis.
• Derives a certified intersection size $e$ using a constrained optimization problem (Equation 8), balancing lower and upper bounds on label probabilities.
• Employs a Monte Carlo sampling-based algorithm to estimate label probabilities and compute robustness guarantees efficiently.

Experimental results

Research questions

• RQ1 Can randomized smoothing be extended to provide provable robustness guarantees in multi-label classification, where multiple labels are predicted per input?
• RQ2 What is the theoretical bound on the number of ground truth labels that remain in the predicted set under $l_2$-bounded adversarial perturbations?
• RQ3 How do hyperparameters such as $k'$, $k$, $\sigma$, $n$, and $\alpha$ affect the certified intersection size and robustness in practice?
• RQ4 Does incorporating second-order terms in the robustness optimization (Equation 8) significantly improve certified performance?
• RQ5 How does MultiGuard compare to existing provable defenses in terms of robustness and accuracy on multi-label benchmarks?

Key findings

• With the second-order terms in Equation 8, MultiGuard achieves 31.3% certified top-$k$ precision@$R$ at $R=0.5$ on VOC 2007, compared to 23.6% without them.
• The certified top-$k$ recall@$R$ improves from 48.8% to 66.4% when including the second-order terms, demonstrating their significant impact.
• Larger $k'$ increases performance without attacks but reduces robustness, as it expands the attacker's feasible perturbation space.
• Larger $k$ improves robustness against increasing $R$, though at the cost of lower precision without attacks.
• Larger $\sigma$ enhances robustness but reduces clean-set performance, showing a trade-off between robustness and accuracy.
• Increasing $n$ and $\alpha$ improves certified intersection size, but effects plateau when $n$ is large and $\alpha$ is small enough.