[论文解读] PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testing

Yuheng Huang, Yuanchun Li+1 more|arXiv (Cornell University)|Nov 19, 2021

Adversarial Robustness in Machine Learning参考文献 27被引用 5

一句话总结

PatchCensor 提出了一种针对视觉变换器（Vision Transformers）的测试时认证方法，通过全面测试多种注意力掩码变异，实现了对对抗性补丁的可证明鲁棒性。该方法通过确保至少一次推理排除了被污染的补丁，从而保证预测正确，在 ImageNet 上对 2% 像素的对抗性补丁实现了 67.1% 的认证准确率，且干净准确率与原始 ViT 模型相当。

ABSTRACT

Vision Transformer (ViT) is known to be highly nonlinear like other classical neural networks and could be easily fooled by both natural and adversarial patch perturbations. This limitation could pose a threat to the deployment of ViT in the real industrial environment, especially in safety-critical scenarios. In this work, we propose PatchCensor, aiming to certify the patch robustness of ViT by applying exhaustive testing. We try to provide a provable guarantee by considering the worst patch attack scenarios. Unlike empirical defenses against adversarial patches that may be adaptively breached, certified robust approaches can provide a certified accuracy against arbitrary attacks under certain conditions. However, existing robustness certifications are mostly based on robust training, which often requires substantial training efforts and the sacrifice of model performance on normal samples. To bridge the gap, PatchCensor seeks to improve the robustness of the whole system by detecting abnormal inputs instead of training a robust model and asking it to give reliable results for every input, which may inevitably compromise accuracy. Specifically, each input is tested by voting over multiple inferences with different mutated attention masks, where at least one inference is guaranteed to exclude the abnormal patch. This can be seen as complete-coverage testing, which could provide a statistical guarantee on inference at the test time. Our comprehensive evaluation demonstrates that PatchCensor is able to achieve high certified accuracy (e.g. 67.1% on ImageNet for 2%-pixel adversarial patches), significantly outperforming state-of-the-art techniques while achieving similar clean accuracy (81.8% on ImageNet). Meanwhile, our technique also supports flexible configurations to handle different adversarial patch sizes (up to 25%) by simply changing the masking strategy.

研究动机与目标

• 解决视觉变换器在安全关键应用中对对抗性补丁攻击的脆弱性问题。
• 在不微调模型的前提下，提供一种可证明的、测试时的鲁棒性认证方法。
• 在保持原始模型干净准确率的同时，实现高认证准确率。
• 通过自适应掩码策略，支持针对不同对抗性补丁尺寸的灵活配置。

提出的方法

• PatchCensor 在推理过程中通过生成多个变异的注意力掩码，实现全面测试。
• 每个输入通过多次推理中的投票机制进行评估，且至少一次推理可保证排除对抗性补丁。
• 该方法利用视觉变换器的结构特性，确保对注意力头的完整覆盖测试。
• 其掩码策略系统性地排除不同补丁，以检测并减轻其影响。
• 通过变异集的完备性推导出的统计保证实现认证。
• 该方法与输入模态无关，可通过特征级掩码扩展至 NLP 任务。

实验结果

研究问题

• RQ1 测试时防御能否为视觉变换器提供对抗性补丁的可证明鲁棒性？
• RQ2 如何在不降低干净准确率的前提下最大化认证准确率？
• RQ3 该方法能否灵活适配不同大小的对抗性补丁？
• RQ4 该防御在包括 ImageNet 和 GTSRB 在内的多样化基准上是否有效？
• RQ5 该掩码策略能否推广至 NLP 中的文本等其他模态？

主要发现

• PatchCensor 在 ImageNet 上对 2% 像素的对抗性补丁实现了 67.1% 的认证准确率，显著优于当前最先进方法。
• 该方法在 ImageNet 上保持了 81.8% 的干净准确率，与原始 ViT 模型完全一致。
• 通过可调节的掩码策略，支持针对不同对抗性补丁尺寸的灵活配置。
• 在 CIFAR-10、GTSRB、Food-101 和 PartImageNet 上的评估验证了其在多样化数据集和真实场景下的鲁棒性。
• 该方法展现出实际可行性和可扩展性，由于仅在测试时运行，计算开销较低。
• 该方法可扩展至 NLP 任务，因为其掩码操作基于抽象特征层级，与输入模态无关。