Timezone: »
Poster
Relaxing Local Robustness
Klas Leino · Matt Fredrikson
Certifiable local robustness, which rigorously precludes small-norm adversarial examples, has received significant attention as a means of addressing security concerns in deep learning. However, for some classification problems, local robustness is not a natural objective, even in the presence of adversaries; for example, if an image contains two classes of subjects, the correct label for the image may be considered arbitrary between the two, and thus enforcing strict separation between them is unnecessary. In this work, we introduce two relaxed safety properties for classifiers that address this observation: (1) relaxed top-k robustness, which serves as the analogue of top-k accuracy; and (2) affinity robustness, which specifies which sets of labels must be separated by a robustness margin, and which can be $\epsilon$-close in $\ell_p$ space. We show how to construct models that can be efficiently certified against each relaxed robustness property, and trained with very little overhead relative to standard gradient descent. Finally, we demonstrate experimentally that these relaxed variants of robustness are well-suited to several significant classification problems, leading to lower rejection rates and higher certified accuracies than can be obtained when certifying "standard" local robustness.
Author Information
Klas Leino (Carnegie Mellon University)
I'm a researcher at CMU focused on studying the weaknesses and vulnerabilities of deep learning; I works to improve DNN security, transparency, and privacy
Matt Fredrikson (CMU)
More from the Same Authors
-
2023 Poster: Grounding Neural Inference with Satisfiability Modulo Theories »
Matt Fredrikson · Kaiji Lu · Somesh Jha · Saranya Vijayakumar · Vijay Ganesh · Zifan Wang -
2023 Poster: Scaling in Depth: Unlocking Robustness Certification on ImageNet »
Kai Hu · Andy Zou · Zifan Wang · Klas Leino · Matt Fredrikson -
2021 : Exploring Conceptual Soundness with TruLens »
Anupam Datta · Matt Fredrikson · Klas Leino · Kaiji Lu · Shayak Sen · Ricardo C Shih · Zifan Wang -
2020 Poster: Smoothed Geometry for Robust Attribution »
Zifan Wang · Haofan Wang · Shakul Ramkumar · Piotr Mardziel · Matt Fredrikson · Anupam Datta -
2018 Workshop: Workshop on Security in Machine Learning »
Nicolas Papernot · Jacob Steinhardt · Matt Fredrikson · Kamalika Chaudhuri · Florian Tramer -
2018 Poster: Hunting for Discriminatory Proxies in Linear Regression Models »
Samuel Yeom · Anupam Datta · Matt Fredrikson