论文标题
对抗补丁的认证防御
Certified Defenses for Adversarial Patches
论文作者
论文摘要
对抗贴片攻击是针对现实世界计算机视觉系统的最实际威胁模型之一。本文研究了针对补丁攻击的认证和经验防御。我们从一组实验开始，表明大多数现有的防御能力（通过预处理图像来减轻对抗贴剂）可以通过简单的白色盒子对手轻松打破。在这一发现的激励下，我们提出了针对补丁攻击的首次认证防御，并提出了更快的培训方法。此外，我们试验了不同的贴片形状，以进行测试，从而获得了跨形状的良好稳健性转移，并呈现了针对稀疏攻击的认证防御的初步结果。我们的完整实施可以在以下网址找到：https：//github.com/ping-c/certifiedpatchdefense。
Adversarial patch attacks are among one of the most practical threat models against real-world computer vision systems. This paper studies certified and empirical defenses against patch attacks. We begin with a set of experiments showing that most existing defenses, which work by pre-processing input images to mitigate adversarial patches, are easily broken by simple white-box adversaries. Motivated by this finding, we propose the first certified defense against patch attacks, and propose faster methods for its training. Furthermore, we experiment with different patch shapes for testing, obtaining surprisingly good robustness transfer across shapes, and present preliminary results on certified defense against sparse attacks. Our complete implementation can be found on: https://github.com/Ping-C/certifiedpatchdefense.
