[Paper Review] Provably Adversarially Robust Nearest Prototype Classifiers

Václav Voràček, Matthias Hein|arXiv (Cornell University)|Jul 14, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes Provably Adversarially Robust Nearest Prototype Classifiers (PNPC), which provide exact and scalable certification of robustness under multiple threat models, including ℓ₁, ℓ₂, ℓ∞, and the perceptual LPIPS metric. By deriving improved lower bounds on minimal adversarial perturbations and integrating domain constraints, PNPC achieves state-of-the-art certified robust accuracy on MNIST and CIFAR-10, outperforming both standard neural networks and prior certified methods.

ABSTRACT

Nearest prototype classifiers (NPCs) assign to each input point the label of the nearest prototype with respect to a chosen distance metric. A direct advantage of NPCs is that the decisions are interpretable. Previous work could provide lower bounds on the minimal adversarial perturbation in the $\ell_p$-threat model when using the same $\ell_p$-distance for the NPCs. In this paper we provide a complete discussion on the complexity when using $\ell_p$-distances for decision and $\ell_q$-threat models for certification for $p,q \in \{1,2,\infty\}$. In particular we provide scalable algorithms for the \emph{exact} computation of the minimal adversarial perturbation when using $\ell_2$-distance and improved lower bounds in other cases. Using efficient improved lower bounds we train our Provably adversarially robust NPC (PNPC), for MNIST which have better $\ell_2$-robustness guarantees than neural networks. Additionally, we show up to our knowledge the first certification results w.r.t. to the LPIPS perceptual metric which has been argued to be a more realistic threat model for image classification than $\ell_p$-balls. Our PNPC has on CIFAR10 higher certified robust accuracy than the empirical robust accuracy reported in (Laidlaw et al., 2021). The code is available in our repository.

Motivation & Objective

• To develop a provably robust nearest prototype classifier (PNPC) that offers exact and scalable certification of adversarial robustness under diverse threat models.
• To improve upon existing lower bounds for minimal adversarial perturbations in ℓp-distance-based NPCs, especially for ℓ₂ and ℓ∞ metrics.
• To extend certified robustness beyond ℓp-norms to perceptual metrics like LPIPS, which better reflect human perception in image classification.
• To achieve higher certified robust accuracy than prior methods, including randomized smoothing and multi-norm certified models, on standard benchmarks.
• To enable efficient training and certification by deriving fast-computable lower bounds for ℓ₂, ℓ₁, and ℓ∞ robustness.

Proposed method

• Derives improved lower bounds on minimal adversarial perturbations for NPCs using general semi-metrics, extending beyond the limitations of semi-norms used in prior work.
• Proposes scalable algorithms for exact computation of minimal ℓ₂-perturbations in NPCs, enabling efficient training with robustness guarantees.
• Integrates input domain constraints (e.g., [0,1]^d for images) to tighten ℓ₂-robustness certification bounds.
• Introduces novel lower bounds for ℓ₁ and ℓ∞-NPCs, improving over prior work and enabling multi-norm robustness certification.
• Adapts the nearest prototype classifier to use the LPIPS perceptual metric as a semi-metric, enabling certification under a more realistic threat model.
• Employs a training procedure that optimizes prototypes to maximize certified robust accuracy under the chosen metric and threat model.

Experimental results

Research questions

• RQ1 Can we derive tighter and more scalable lower bounds on minimal adversarial perturbations for nearest prototype classifiers under ℓp and non-ℓp metrics?
• RQ2 Can we achieve provable robustness certification for NPCs under the LPIPS perceptual metric, which better models human perception than ℓp-norms?
• RQ3 Can PNPC achieve higher certified robust accuracy than state-of-the-art methods, including neural networks with randomized smoothing and multi-norm certified models?
• RQ4 How does the integration of input domain constraints improve the tightness of ℓ₂-robustness certification in NPCs?
• RQ5 Can we efficiently train and certify NPCs for multiple threat models (ℓ₁, ℓ₂, ℓ∞) using a unified framework?

Key findings

• The ℓ₂-PNPC achieves higher ℓ₂-robust accuracy on MNIST than any previously reported model, including randomized smoothing, for large perturbation radii.
• On CIFAR-10, the ℓ₂-PNPC achieves a certified robust accuracy of 41.9% at ε₂ = 0.1, outperforming the empirical robust accuracy of the adversarially trained ResNet-50 from (Laidlaw et al., 2021).
• The ℓ₂-PNPC achieves 32.7% certified robust accuracy under the union of ℓ₁, ℓ₂, and ℓ∞ threat models, surpassing the MMR-Univ baseline.
• For ℓ₁ and ℓ∞ NPCs, the authors derive novel lower bounds that improve upon prior work, enabling tighter certification.
• The PNPC with the LPIPS metric achieves higher clean and certified robust accuracy than the adversarially trained ResNet-50 on CIFAR-10, demonstrating the viability of perceptual metrics for certification.
• Exact certification of ℓ₁ and ℓ∞ robustness for ℓ₂-NPCs is achieved, enabling multi-norm robustness guarantees with improved tightness.