[Paper Review] RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletion

Zhuoqun Huang, Neil G. Marchant+4 more|arXiv (Cornell University)|Jan 31, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper introduces RS-Del, a randomized smoothing method that uses only random deletions to certify robustness of sequence classifiers against edit distance-bounded adversaries—covering substitutions, insertions, and deletions. It achieves 91% certified accuracy at an edit distance radius of 128 bytes on MalConv, using a novel proof based on longest common subsequences instead of the standard Neyman-Pearson framework.

ABSTRACT

Randomized smoothing is a leading approach for constructing classifiers that are certifiably robust against adversarial examples. Existing work on randomized smoothing has focused on classifiers with continuous inputs, such as images, where $\ell_p$-norm bounded adversaries are commonly studied. However, there has been limited work for classifiers with discrete or variable-size inputs, such as for source code, which require different threat models and smoothing mechanisms. In this work, we adapt randomized smoothing for discrete sequence classifiers to provide certified robustness against edit distance-bounded adversaries. Our proposed smoothing mechanism randomized deletion (RS-Del) applies random deletion edits, which are (perhaps surprisingly) sufficient to confer robustness against adversarial deletion, insertion and substitution edits. Our proof of certification deviates from the established Neyman-Pearson approach, which is intractable in our setting, and is instead organized around longest common subsequences. We present a case study on malware detection--a binary classification problem on byte sequences where classifier evasion is a well-established threat model. When applied to the popular MalConv malware detection model, our smoothing mechanism RS-Del achieves a certified accuracy of 91% at an edit distance radius of 128 bytes.

Motivation & Objective

• To address the lack of certified robustness methods for discrete, variable-length sequence inputs such as source code and binary executables.
• To develop a robustness certification framework for edit distance-bounded adversaries that include insertions, deletions, and substitutions.
• To enable efficient and sound certification using only random deletions, simplifying the smoothing mechanism and analysis.
• To allow tunable decision thresholds to balance robustness and accuracy, especially in high-stakes settings like malware detection.
• To provide a scalable and practical certification method compatible with arbitrary base classifiers via oracle query access.

Proposed method

• Proposes RS-Del, a randomized smoothing mechanism that applies random deletions to input sequences to build a smoothed classifier.
• Uses the longest common subsequence (LCS) between an input and its perturbed version as a reference point to bound confidence scores in the smoothed space.
• Derives a certification bound based on the probability that the LCS remains consistent across perturbations, enabling robustness guarantees.
• Replaces the intractable Neyman-Pearson framework with a novel proof structure centered on LCS-based confidence bounds.
• Employs binary search to efficiently compute the maximum certified edit distance radius for a given input and confidence threshold.
• Supports tunable decision thresholds to adjust trade-offs between robustness radius and misclassification rate, particularly useful in adversarial settings with strong incentives to misclassify malicious samples.

Experimental results

Research questions

• RQ1 Can a smoothing mechanism based solely on random deletions provide certified robustness against adversarial edits that include insertions, deletions, and substitutions in sequence classifiers?
• RQ2 Is it possible to derive a tractable certification method for edit distance robustness without relying on the standard Neyman-Pearson framework?
• RQ3 How does the performance of RS-Del compare to existing methods like randomized ablation in terms of certification radius and confidence bounds?
• RQ4 To what extent can RS-Del be applied to real-world sequence classification tasks such as malware detection with high practical accuracy?
• RQ5 Can the use of longest common subsequences enable tighter and more efficient robustness certificates than traditional Hamming-distance-based approaches?

Key findings

• RS-Del achieves 91% certified accuracy on the MalConv malware detection model at an edit distance radius of 128 bytes.
• The method provides certified robustness against all three types of edit operations—substitutions, insertions, and deletions—using only random deletions in the smoothing process.
• The certification proof based on longest common subsequences enables tighter confidence bounds than the standard Neyman-Pearson approach, which is intractable in this setting.
• RS-Del outperforms randomized ablation in terms of certification tightness, as shown by a formal comparison in the paper.
• The method is efficient and practical, requiring only oracle access to a base classifier and enabling scalable certification for long sequences.
• The use of tunable decision thresholds allows for effective trade-offs between robustness and accuracy, particularly beneficial in high-stakes classification tasks.