[Paper Review] PatchGuard: Provable Defense against Adversarial Patches Using Masks on Small Receptive Fields.

Chong Xiang, Arjun Nitin Bhagoji+2 more|arXiv (Cornell University)|May 17, 2020

Adversarial Robustness in Machine Learning41 references17 citations

TL;DR

PatchGuard is a provably robust defense against localized adversarial patches that uses convolutional networks with small receptive fields to limit corruption to a bounded number of features, followed by a robust masking mechanism to detect and suppress these corrupted features. It achieves state-of-the-art provable robust accuracy—86.5% on 10-class ImageNette, 18.6% on ImageNet, and 58.1% on CIFAR-10—while maintaining high clean accuracy.

ABSTRACT

Localized adversarial patches aim to induce misclassification in machine learning models by arbitrarily modifying pixels within a restricted region of an image. Such attacks can be realized in the physical world by attaching the adversarial patch to the object to be misclassified. In this paper, we propose a general defense framework called PatchGuard that can achieve both high clean accuracy and provable robustness against localized adversarial patches. The cornerstone of PatchGuard is to use convolutional networks with small receptive fields that impose a bound on the number of features corrupted by an adversarial patch. Given a bound on the number of corrupted features, the problem of designing an adversarial patch defense reduces to that of designing a secure feature aggregation mechanism. Towards this end, we present our robust masking defense that robustly detects and masks corrupted features to recover the correct prediction. Our defense achieves state-of-the-art provable robust accuracy on ImageNette (a 10-class subset of ImageNet), ImageNet, and CIFAR-10 datasets. Against the strongest untargeted white-box adaptive attacker, we achieve 94.4% clean accuracy and 86.5% provable robust accuracy on 10-class ImageNette images against an adversarial patch consisting of 1% image pixels, 55.1% clean accuracy and 18.6% provable robust accuracy on 1000-class ImageNet images against a 1% pixel patch, and 84.5% clean accuracy and 58.1% provable accuracy on CIFAR-10 images against a 2.4% pixel patch.

Motivation & Objective

• To address the threat of localized adversarial patches that can mislead machine learning models in physical-world deployments.
• To develop a defense that maintains high clean accuracy while ensuring provable robustness against adversarial patches.
• To reduce the number of corrupted features by leveraging small receptive fields in convolutional networks.
• To design a secure feature aggregation mechanism that can detect and mask corrupted features under adversarial conditions.
• To achieve state-of-the-art provable robust accuracy across multiple benchmark datasets including ImageNette, ImageNet, and CIFAR-10.

Proposed method

• Employing convolutional neural networks with small receptive fields to constrain the number of features affected by an adversarial patch.
• Defining a bound on the number of corrupted features based on the receptive field size, enabling formal robustness guarantees.
• Designing a robust masking mechanism that identifies and suppresses corrupted features using secure aggregation techniques.
• Using the bounded corruption model to reduce the defense problem to a secure feature aggregation task.
• Applying the masking mechanism during inference to recover correct predictions even when a patch corrupts a limited number of features.
• Training the model end-to-end with the masking mechanism to ensure compatibility and robustness under adversarial patch attacks.

Experimental results

Research questions

• RQ1 Can a defense be designed to achieve both high clean accuracy and provable robustness against localized adversarial patches?
• RQ2 How can small receptive fields be leveraged to limit the number of corrupted features in a way that enables formal robustness guarantees?
• RQ3 What secure feature aggregation mechanism can reliably detect and mask corrupted features under adversarial patch attacks?
• RQ4 How does the proposed defense perform under strong white-box adaptive attackers on diverse datasets?
• RQ5 Can the defense scale effectively to large-scale datasets like ImageNet while maintaining strong robustness and accuracy?

Key findings

• PatchGuard achieves 94.4% clean accuracy and 86.5% provable robust accuracy on 10-class ImageNette against a 1% pixel adversarial patch.
• On the full 1000-class ImageNet dataset, it attains 55.1% clean accuracy and 18.6% provable robust accuracy under the same 1% patch attack.
• For CIFAR-10, the defense achieves 84.5% clean accuracy and 58.1% provable robust accuracy against a 2.4% pixel patch.
• The defense maintains strong performance across diverse datasets, demonstrating scalability and robustness.
• The use of small receptive fields effectively bounds the number of corrupted features, enabling formal robustness guarantees.
• The robust masking mechanism successfully recovers correct predictions even when a significant portion of the image is perturbed by an adversarial patch.