[Paper Review] RAB: Provable Robustness Against Backdoor Attacks

Maurice Weber, Xiaojun Xu+3 more|arXiv (Cornell University)|Mar 19, 2020

Adversarial Robustness in Machine Learning55 references48 citations

TL;DR

This paper introduces RAB, a certifiably robust training framework against backdoor (poisoning) attacks using randomized smoothing over training data, with theoretical guarantees and efficient implementations, plus extensive benchmarks.

ABSTRACT

Recent studies have shown that deep neural networks (DNNs) are vulnerable to adversarial attacks, including evasion and backdoor (poisoning) attacks. On the defense side, there have been intensive efforts on improving both empirical and provable robustness against evasion attacks; however, the provable robustness against backdoor attacks still remains largely unexplored. In this paper, we focus on certifying the machine learning model robustness against general threat models, especially backdoor attacks. We first provide a unified framework via randomized smoothing techniques and show how it can be instantiated to certify the robustness against both evasion and backdoor attacks. We then propose the first robust training process, RAB, to smooth the trained model and certify its robustness against backdoor attacks. We prove the robustness bound for machine learning models trained with RAB and prove that our robustness bound is tight. In addition, we theoretically show that it is possible to train the robust smoothed models efficiently for simple models such as K-nearest neighbor classifiers, and we propose an exact smooth-training algorithm that eliminates the need to sample from a noise distribution for such models. Empirically, we conduct comprehensive experiments for different machine learning (ML) models such as DNNs, support vector machines, and K-NN models on MNIST, CIFAR-10, and ImageNette datasets and provide the first benchmark for certified robustness against backdoor attacks. In addition, we evaluate K-NN models on a spambase tabular dataset to demonstrate the advantages of the proposed exact algorithm. Both the theoretic analysis and the comprehensive evaluation on diverse ML models and datasets shed light on further robust learning strategies against general training time attacks.

Motivation & Objective

• Address the lack of certifiable robustness against backdoor attacks.
• Develop a unified framework that extends randomized smoothing to training-time attacks.
• Propose RAB, a robust training pipeline that certifies robustness against backdoors.
• Provide theoretical bounds and demonstrate tightness of these bounds.
• Benchmark across diverse models and datasets to establish a foundational robustness benchmark.

Proposed method

• Define a smoothed classifier that randomizes both test inputs and training data.
• Use Neyman–Pearson lemma to derive a general, tight robustness condition (Theorem 1).
• Instantiate the framework with Gaussian and uniform smoothing to certify backdoor robustness (GaussianCorollary 1).
• Propose RAB training: generate N smoothed training sets, train N models, and aggregate outputs.
• Prove the robustness bound is tight (Theorem 2).
• Develop an exact, efficient smoothing algorithm for K-nearest neighbors (no Monte Carlo sampling needed).

Figure 1 : In this paper, we define a robust training process RAB against backdoor attacks. Given a poisoned dataset $\mathcal{D}^{\prime}$ — produced by adding backdoor patterns $\Delta$ to some instances in the dataset $\mathcal{D}$ with clean features — this robust training process guarantees tha

Experimental results

Research questions

• RQ1 Can we certify robustness of ML models against backdoor (poisoning) attacks?
• RQ2 How can smoothing distributions be chosen to certify backdoor robustness and what are the resulting norms/bounds?
• RQ3 Is the robustness bound tight, and under what conditions?
• RQ4 How can we efficiently certify robustness for specific model families like K-NN?
• RQ5 How do certified robustness bounds hold across DNNs, SVMs, and K-NN on real datasets?

Key findings

• First certifiable robustness bound for general ML models against backdoor attacks.
• Robustness bound is tight (Theorem 2).
• An exact efficient smoothing algorithm is provided for K-NN models that avoids sampling.
• Extensive experiments demonstrate robustness bounds on DNNs, SVMs, and K-NN across MNIST, CIFAR-10, and ImageNette, establishing a benchmark for certified backdoor robustness.
• Spambase experiments illustrate advantages of the exact K-NN smoothing algorithm.
• Code and evaluation protocol are publicly released to enable reproducible research.

Figure 2 : An illustration of the RAB robust training process. Given a poisoned training set $\mathcal{D}+\Delta$ and a training process $\mathcal{A}$ vulnerable to backdoor attacks, RAB generates $N$ smoothed training sets $\{\mathcal{D}_{i}\}_{i\in[N]}$ and trains $N$ different classifiers $\mathc