Abstract:Over the years, researchers have developed myriad attacks that exploit the ubiquity of adversarial examples, as well as defenses that aim to guard against the security vulnerabilities posed by such attacks. Of particular interest to this paper are defenses that provide provable guarantees against the class of $\ell_p$-bounded attacks. Certified defenses have made significant progress, taking robustness certification from toy models and datasets to large-scale problems like ImageNet classification. While this is undoubtedly an interesting academic problem, as the field has matured, its impact in practice remains unclear, thus we find it useful to revisit the motivation for continuing this line of research. There are three layers to this inquiry, which we address in this paper: (1) why do we care about robustness research? (2) why do we care about the $\ell_p$-bounded threat model? And (3) why do we care about certification as opposed to empirical defenses? In brief, we take the position that local robustness certification indeed confers practical value to the field of machine learning. We focus especially on the latter two questions from above. With respect to the first of the two, we argue that the $\ell_p$-bounded threat model acts as a minimal requirement for safe application of models in security-critical domains, while at the same time, evidence has mounted suggesting that local robustness may lead to downstream external benefits not immediately related to robustness. As for the second, we argue that (i) certification provides a resolution to the cat-and-mouse game of adversarial attacks; and furthermore, that (ii) perhaps contrary to popular belief, there may not exist a fundamental trade-off between accuracy, robustness, and certifiability, while moreover, certified training techniques constitute a particularly promising way for learning robust models.

CC-CERT: A Probabilistic Approach to Certify General Robustness of Neural Networks

Towards Certified Probabilistic Robustness with High Accuracy

Et Tu Certifications: Robustness Certificates Yield Better Adversarial Examples

Towards Certifying the Asymmetric Robustness for Neural Networks: Quantification and Applications

Adversarial Robustness Certification for Bayesian Neural Networks

Certifying Global Robustness for Deep Neural Networks

Certified Robustness to Programmable Transformations in LSTMs

Certifying Semantic Robustness of Deep Neural Networks

Certifying Model Accuracy under Distribution Shifts

SoK: Certified Robustness for Deep Neural Networks

Abstract Interpretation Based Robustness Certification For Graph Convolutional Networks

Certifiable Robustness to Adversarial State Uncertainty in Deep Reinforcement Learning

Certified Adversarial Robustness Within Multiple Perturbation Bounds

Globally-Robust Neural Networks

Is Certifying $\ell_p$ Robustness Still Worthwhile?

Towards Improving Robustness Against Common Corruptions using Mixture of Class Specific Experts

Robustness of Neural Networks: A Probabilistic and Practical Approach

Provable Robustness of (Graph) Neural Networks Against Data Poisoning and Backdoor Attacks

General Lipschitz: Certified Robustness Against Resolvable Semantic Transformations via Transformation-Dependent Randomized Smoothing

Towards Precise Observations of Neural Model Robustness in Classification

PROSAC: Provably Safe Certification for Machine Learning Models under Adversarial Attacks