[Paper Review] PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier

Chong Xiang, Saeed Mahloujifar+1 more|arXiv (Cornell University)|Aug 20, 2021

Adversarial Robustness in Machine Learning62 references19 citations

TL;DR

PatchCleanser is a certifiably robust defense against adversarial patch attacks that uses a two-round pixel masking technique to neutralize adversarial patches without abstaining from predictions. It achieves state-of-the-art performance—83.9% top-1 clean accuracy and 62.1% top-1 certified robust accuracy on ImageNet—while being compatible with any image classifier, including those with large receptive fields.

ABSTRACT

The adversarial patch attack against image classification models aims to inject adversarially crafted pixels within a restricted image region (i.e., a patch) for inducing model misclassification. This attack can be realized in the physical world by printing and attaching the patch to the victim object; thus, it imposes a real-world threat to computer vision systems. To counter this threat, we design PatchCleanser as a certifiably robust defense against adversarial patches. In PatchCleanser, we perform two rounds of pixel masking on the input image to neutralize the effect of the adversarial patch. This image-space operation makes PatchCleanser compatible with any state-of-the-art image classifier for achieving high accuracy. Furthermore, we can prove that PatchCleanser will always predict the correct class labels on certain images against any adaptive white-box attacker within our threat model, achieving certified robustness. We extensively evaluate PatchCleanser on the ImageNet, ImageNette, CIFAR-10, CIFAR-100, SVHN, and Flowers-102 datasets and demonstrate that our defense achieves similar clean accuracy as state-of-the-art classification models and also significantly improves certified robustness from prior works. Remarkably, PatchCleanser achieves 83.9% top-1 clean accuracy and 62.1% top-1 certified robust accuracy against a 2%-pixel square patch anywhere on the image for the 1000-class ImageNet dataset.

Motivation & Objective

• To address the lack of certifiably robust defenses that are compatible with high-accuracy, state-of-the-art image classifiers.
• To overcome the limitations of prior defenses that depend on small receptive fields, which constrain clean accuracy.
• To eliminate the need for model-specific architectural assumptions while maintaining strong robustness guarantees.
• To provide a defense that never abstains from prediction, ensuring functionality in safety-critical applications.
• To achieve high certified robustness against adaptive white-box attackers in the physical-world patch attack threat model.

Proposed method

• PatchCleanser applies a first round of masking by placing masks at all possible image locations to generate masked inputs.
• It evaluates the classifier's prediction on each masked image and identifies the majority prediction among all one-masked predictions.
• For predictions that disagree with the majority (disagreers), it applies a second round of masking using additional masks to generate two-masked inputs.
• If all two-masked predictions agree with a one-masked disagreer, that label is output as the final prediction.
• The defense ensures that if a benign prediction exists (i.e., a mask covering the patch), it will be recovered and correctly predicted.
• The double-masking process enables robustness certification without requiring model retraining or architectural constraints.

Experimental results

Research questions

• RQ1 Can a certifiably robust defense against adversarial patches be designed without requiring architectural modifications to the base classifier?
• RQ2 Can such a defense achieve high clean accuracy while maintaining strong certified robustness?
• RQ3 Is it possible to avoid prediction abstention in certifiably robust defenses, ensuring continuous operation in real-world systems?
• RQ4 How can adversarial patches be reliably neutralized when their location is unknown and the attacker is adaptive?
• RQ5 Can a defense maintain robustness guarantees under white-box threat models where the attacker knows the defense mechanism?

Key findings

• PatchCleanser achieves 83.9% top-1 clean accuracy on ImageNet, matching state-of-the-art undefended models.
• It attains 62.1% top-1 certified robust accuracy against a 2%-pixel square patch placed anywhere on the image.
• The defense is the first to achieve both high clean accuracy and high certified robust accuracy without architectural constraints.
• PatchCleanser outperforms prior certifiably robust defenses that rely on small receptive fields, which limit accuracy to around 55% on ImageNet.
• The method enables robust prediction without abstention, making it suitable for autonomous systems where prediction continuity is essential.
• The double-masking mechanism successfully recovers the correct prediction even when the adversarial patch is placed adaptively and knowledgeably.