Abstract:As machine learning (ML) systems become pervasive, safeguarding their security is critical. However, recently it has been demonstrated that motivated adversaries are able to mislead ML systems by perturbing test data using semantic transformations. While there exists a rich body of research providing provable robustness guarantees for ML models against Lp bounded adversarial perturbations, guarantees against semantic perturbations remain largely underexplored. In this paper, we provide TSS-a unified framework for certifying ML robustness against general adversarial semantic transformations. First, depending on the properties of each transformation, we divide common transformations into two categories, namely resolvable (e.g., Gaussian blur) and differentially resolvable (e.g., rotation) transformations. For the former, we propose transformation-specific randomized smoothing strategies and obtain strong robustness certification. The latter category covers transformations that involve interpolation errors, and we propose a novel approach based on stratified sampling to certify the robustness. Our framework TSS leverages these certification strategies and combines with consistency-enhanced training to provide rigorous certification of robustness. We conduct extensive experiments on over ten types of challenging semantic transformations and show that TSS significantly outperforms the state of the art. Moreover, to the best of our knowledge, TSS is the first approach that achieves nontrivial certified robustness on the large-scale ImageNet dataset. For instance, our framework achieves 30.4% certified robust accuracy against rotation attack (within ±30°) on ImageNet. Moreover, to consider a broader range of transformations, we show TSS is also robust against adaptive attacks and unforeseen image corruptions such as CIFAR-10-C and ImageNet-C.

Enhancing Adversarial Robustness via Test-time Transformation Ensembling

Robust Training Using Natural Transformation

Ensemble Adversarial Training: Attacks and Defenses

Enhanced Security against Adversarial Examples Using a Random Ensemble of Encrypted Vision Transformer Models

Learning to Transform Dynamically for Better Adversarial Transferability

A Random Ensemble of Encrypted models for Enhancing Robustness against Adversarial Examples

Demystifying the Adversarial Robustness of Random Transformation Defenses

Robustifying Language Models with Test-Time Adaptation

A Random Ensemble of Encrypted Vision Transformers for Adversarially Robust Defense

Testing Robustness Against Unforeseen Adversaries

On the Perturbed States for Transformed Input-robust Reinforcement Learning

Transformation-Dependent Adversarial Attacks

Impact of Adversarial Training on Robustness and Generalizability of Language Models

Test-Time Adaptation and Adversarial Robustness

Improving Transferable Targeted Attacks with Feature Tuning Mixup

TSS - Transformation-Specific Smoothing for Robustness Certification.

TAPT: Test-Time Adversarial Prompt Tuning for Robust Inference in Vision-Language Models

Image classification adversarial attack with improved resizing transformation and ensemble models

Enhancing adversarial robustness with randomized interlayer processing

EEJE: Two-Step Input Transformation for Robust DNN Against Adversarial Examples