MRCert: Towards Post-deployment Patch Robustness Certification for Adversarially Patched Samples via Type-specific Masking

Key points

• However, existing smoothing-based and masking-based recovery defenders cannot achieve both simultaneously: they degrade the prediction accuracy much and cannot verify the benignity of the returned label of an adversarially patched input, respectively.1
• We propose MRCert, the first masking-based certified recovery defender that shows the feasibility of achieving both.1
• Unlike all existing works to apply a common condition across both types of input (benign and adversarially patched samples) for certification, MRCert infers type-specific necessary properties of deep learning models for both types in post-deployment time and formally relates them to verify the label benignity through a novel type-oriented design of label recovery and certification function pair.1
• Without incurring the degradation in clean accuracy caused by smoothing, experimental results confirm that MRCert achieves 35.1% adversarial certified accuracy on ImageNet at patch size 16 pixels, whereas the SOTA PatchCURE fails completely.1

Sources (1)

• [1]MRCert: Towards Post-deployment Patch Robustness Certification for Adversarially Patched Samples via Type-specific Masking
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 7, 07:27 AM

  In post-deployment time, inputs to deep learning models may or may not be adversarially patched.

  However, existing smoothing-based and masking-based recovery defenders cannot achieve both simultaneously: they degrade the prediction accuracy much and cannot verify the benignity of the returned label of an adversarially patched input, respectively.

Extractive summary: sentences quoted from the sources.