[Paper Review] Second-Order Adversarial Attack and Certifiable Robustness

Bai Li, Changyou Chen+2 more|arXiv (Cornell University)|Sep 10, 2018

Adversarial Robustness in Machine LearningComputer Science49 citations

TL;DR

This paper introduces a novel second-order adversarial attack that significantly reduces the accuracy of state-of-the-art adversarially trained models, prompting the development of a new framework for certifiable robustness. The method enables the derivation of a provable lower bound on model accuracy against adversarial examples, demonstrating improved robustness and higher accuracy compared to prior defenses under the same attack.

ABSTRACT

We propose a powerful second-order attack method that outperforms existing attack methods on reducing the accuracy of state-of-the-art defense models based on adversarial training. The effectiveness of our attack method motivates an investigation of provable robustness of a defense model. To this end, we introduce a framework that allows one to obtain a certifiable lower bound on the prediction accuracy against adversarial examples. We conduct experiments to show the effectiveness of our attack method. At the same time, our defense models obtain higher accuracies compared to previous works under our proposed attack.

Motivation & Objective

• To develop a more effective adversarial attack method that surpasses existing approaches in reducing the accuracy of robustly trained models.
• To investigate the provable robustness of defense models under increasingly powerful adversarial attacks.
• To design a framework that provides a certifiable lower bound on model accuracy against adversarial perturbations.
• To evaluate defense models under the new attack and demonstrate improved performance compared to prior works.

Proposed method

• The paper proposes a second-order attack that leverages curvature information of the model's loss surface to generate more effective adversarial examples.
• It formulates the attack as a bilevel optimization problem, optimizing perturbations to maximize the model's loss while respecting perturbation constraints.
• The method computes second-order gradients using Hessian-vector products to improve the direction of perturbation search.
• A novel robustness certification framework is introduced, which provides a mathematically provable lower bound on the model's accuracy under adversarial perturbations.
• The certification framework is designed to be scalable and applicable to models trained with adversarial training.

Experimental results

Research questions

• RQ1 How effective is the proposed second-order attack in reducing the accuracy of state-of-the-art adversarially trained models?
• RQ2 Can a provable lower bound on model accuracy be derived under adversarial perturbations using the proposed framework?
• RQ3 How does the performance of defense models trained under the new attack compare to previous defenses in terms of accuracy and robustness?
• RQ4 To what extent does the second-order attack expose vulnerabilities in current adversarial training defenses?

Key findings

• The proposed second-order attack achieves higher success rates in reducing the accuracy of robustly trained models compared to existing first-order and second-order attack methods.
• The defense models trained under the new attack achieve higher clean accuracy than previous defenses while maintaining strong robustness.
• The proposed certification framework successfully provides a certifiable lower bound on model accuracy, offering mathematical guarantees against adversarial examples.
• Empirical results confirm that the new attack is more effective than prior methods, especially on models with strong defenses.