[Paper Review] PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches

Chong Xiang, Prateek Mittal|arXiv (Cornell University)|Apr 26, 2021

Adversarial Robustness in Machine Learning18 references25 citations

TL;DR

PatchGuard++ detects adversarial patch attacks by masking feature-space regions and checking prediction consensus, achieving high clean and provable robust accuracy on high-resolution images.

ABSTRACT

An adversarial patch can arbitrarily manipulate image pixels within a restricted region to induce model misclassification. The threat of this localized attack has gained significant attention because the adversary can mount a physically-realizable attack by attaching patches to the victim object. Recent provably robust defenses generally follow the PatchGuard framework by using CNNs with small receptive fields and secure feature aggregation for robust model predictions. In this paper, we extend PatchGuard to PatchGuard++ for provably detecting the adversarial patch attack to boost both provable robust accuracy and clean accuracy. In PatchGuard++, we first use a CNN with small receptive fields for feature extraction so that the number of features corrupted by the adversarial patch is bounded. Next, we apply masks in the feature space and evaluate predictions on all possible masked feature maps. Finally, we extract a pattern from all masked predictions to catch the adversarial patch attack. We evaluate PatchGuard++ on ImageNette (a 10-class subset of ImageNet), ImageNet, and CIFAR-10 and demonstrate that PatchGuard++ significantly improves the provable robustness and clean performance.

Motivation & Objective

• Motivate robust defense against localized adversarial patches that can be physically realized.
• Propose a detection framework that provably identifies patch attacks while preserving clean accuracy.
• Leverage small receptive field feature extractors to bound corrupted features and use feature-space masking to flag inconsistencies.
• Provide provable guarantees for attack detection under white-box adaptive attacks.

Proposed method

• Use a CNN with small receptive fields to bound the number of corrupted features by a patch.
• Apply masks over all possible feature-space locations and obtain predictions for each masked feature map.
• Detect attacks by identifying inconsistencies among masked predictions when a patch is present.
• If all non-abstained masked predictions are correct, return the original prediction; otherwise issue an attack alert.
• Provide a provable analysis showing that if every non-abstained masked prediction is correct, the image is provably robust to patches.

Experimental results

Research questions

• RQ1 Can a masking-based, feature-space approach reliably detect localized adversarial patches under white-box conditions?
• RQ2 Does PatchGuard++ improve both clean accuracy and provable robustness compared to prior defenses?
• RQ3 What are the trade-offs between detection threshold settings and robustness/accuracy?
• RQ4 How well does the approach scale to high-resolution datasets like ImageNet and ImageNette?

Key findings

• PatchGuard++ achieves state-of-the-art clean and provable robust accuracy on ImageNette (τ=0.6) with 96.1% clean and 91.8% provable robust accuracy.
• On ImageNet, PatchGuard++ surpasses prior defenses in both clean (≈6% higher) and provable robust accuracy (≈13% higher) at τ=0.5.
• For CIFAR-10, PatchGuard++ shows competitive provable robustness with significantly lower computation than Minority Report (MR).
• Lowering the confidence threshold τ increases provable robustness faster than clean accuracy, indicating favorable trade-offs.
• Compared to prior provable defenses, PatchGuard++ delivers higher accuracy and scalable attack detection for high-resolution images.