Provable Adversarial Robustness for Group Equivariant Tasks: Graphs, Point Clouds, Molecules, and More

Jan Schuchardt,Yan Scholten,Stephan Günnemann

2024-01-15

Abstract:A machine learning model is traditionally considered robust if its prediction remains (almost) constant under input perturbations with small norm. However, real-world tasks like molecular property prediction or point cloud segmentation have inherent equivariances, such as rotation or permutation equivariance. In such tasks, even perturbations with large norm do not necessarily change an input's semantic content. Furthermore, there are perturbations for which a model's prediction explicitly needs to change. For the first time, we propose a sound notion of adversarial robustness that accounts for task equivariance. We then demonstrate that provable robustness can be achieved by (1) choosing a model that matches the task's equivariances (2) certifying traditional adversarial robustness. Certification methods are, however, unavailable for many models, such as those with continuous equivariances. We close this gap by developing the framework of equivariance-preserving randomized smoothing, which enables architecture-agnostic certification. We additionally derive the first architecture-specific graph edit distance certificates, i.e. sound robustness guarantees for isomorphism equivariant tasks like node classification. Overall, a sound notion of robustness is an important prerequisite for future work at the intersection of robust and geometric machine learning.

Machine Learning,Cryptography and Security

What problem does this paper attempt to address?

This paper explores how to define and implement adversarial robustness in tasks with group equivariance, such as image, point cloud, and molecule prediction. Traditionally, a model's prediction is considered robust if it remains unchanged under small perturbations in the input, but in group equivariant tasks, even large perturbations do not alter the semantic content of the input. The paper introduces the concept of adversarial robustness considering task equivariance and suggests that robustness can be demonstrated by selecting models that match the equivariance of the task and using random smoothing methods. Additionally, the paper develops an equivariance-preserving random smoothing framework for achieving architecture-independent certification and provides robustness guarantees for graph edit distance. Overall, this research redefines the foundation for considering both robustness and equivariance in geometric machine learning.