[论文解读] PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking

Chong Xiang, Arjun Nitin Bhagoji+2 more|arXiv (Cornell University)|May 17, 2020

Adversarial Robustness in Machine Learning参考文献 64被引用 37

一句话总结

PatchGuard 通过 使用 具有 小感受野 的 CNNs 以及 鲁棒 的 掩蔽 聚合 来 恢复 正确 预测，建立了 对 局部 对抗性 贴片 的 可证明 鲁棒 防御。

ABSTRACT

Localized adversarial patches aim to induce misclassification in machine learning models by arbitrarily modifying pixels within a restricted region of an image. Such attacks can be realized in the physical world by attaching the adversarial patch to the object to be misclassified, and defending against such attacks is an unsolved/open problem. In this paper, we propose a general defense framework called PatchGuard that can achieve high provable robustness while maintaining high clean accuracy against localized adversarial patches. The cornerstone of PatchGuard involves the use of CNNs with small receptive fields to impose a bound on the number of features corrupted by an adversarial patch. Given a bounded number of corrupted features, the problem of designing an adversarial patch defense reduces to that of designing a secure feature aggregation mechanism. Towards this end, we present our robust masking defense that robustly detects and masks corrupted features to recover the correct prediction. Notably, we can prove the robustness of our defense against any adversary within our threat model. Our extensive evaluation on ImageNet, ImageNette (a 10-class subset of ImageNet), and CIFAR-10 datasets demonstrates that our defense achieves state-of-the-art performance in terms of both provable robust accuracy and clean accuracy.

研究动机与目标

• Motivate the threat of localized adversarial patches in real-world settings and the need for provable robustness.
• Propose a generic defense framework, PatchGuard, that preserves clean accuracy while achieving provable robustness.
• Demonstrate that small receptive fields limit corrupted features and robust masking securely aggregates features.
• Provide a formal robustness analysis showing an adversarial dilemma that enables provable guarantees.
• Empirically evaluate on ImageNet, ImageNette, and CIFAR-10 to establish state-of-the-art performance.

提出的方法

• Adopt CNNs with small receptive fields to bound the number of features an adversarial patch can corrupt.
• Introduce robust masking as a secure feature-aggregation mechanism that detects and masks corrupted features.
• Clip and window-based detection to identify regions with abnormally high class evidence and mask them.
• Use sliding windows sized to upper-bound patch influence, enabling robust masking across classes.
• Provide a provable robustness analysis showing that masking limits adversarial influence and certifies correct predictions under the threat model.

实验结果

研究问题

• RQ1 Can PatchGuard provide provable robustness against a single localized adversarial patch within a defined region?
• RQ2 How do small receptive fields and secure aggregation affect robustness and clean accuracy compared to prior defenses?
• RQ3 What is the practical effectiveness of robust masking across ImageNet, ImageNette, and CIFAR-10 under a strong adversarial patch threat model?

主要发现

• PatchGuard achieves state-of-the-art provable robustness against localized patches while maintaining high clean accuracy.
• Small receptive fields effectively bound the number of corrupted features, enabling secure aggregation.
• Robust masking detects and masks corrupted features, recovering correct predictions in most certified cases.
• The framework subsumes several existing defenses and outperforms them in provable robustness and accuracy metrics across evaluated datasets.