Certified patch defense can ensure correct predictions under any adversarial patch attack, making it one of the promising methods for achieving general robustness against attacks. However, certified patch defense is challenging due to the occlusion of object regions of interest and expensive computational overhead. Additionally, most defense methods require modifications on downstream classifiers. To address these challenges, we propose Certified Dual Mask-Preservation (CertDMP), a certified defense method that employs a simple yet highly effective mask-preservation strategy against patch attacks of any known size. Our defense consists of two stages: Firstly, multiple predictions are made on an image using shifted masks to identify possible attacked regions. Secondly, we perform dual preservation prediction to distinguish whether masked regions contain patches or objects of interest. We design two sets of mask-preservation pairs for better locating the patch region. By examining the contrapositive proposition of prior defense, we theoretically prove that CertDMP can provide certified robustness and lower the certification threshold. This property contributes to a better certified accuracy and a reduction in inference time. Furthermore, our defense does not require modifying classifiers; thus, it can be easily applied to different classification models. Experiments on different datasets and base classifiers show that our CertDMP achieves state-of-the-art certified accuracy and significantly improves inference efficiency. Our code repository is: https://github.com/Zimingcs/CertDMP .

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Certified Patch Defense via Dual Mask-Preservation Prediction

  • Ziming Zhao,
  • Jun Yan,
  • Huilin Yin

摘要

Certified patch defense can ensure correct predictions under any adversarial patch attack, making it one of the promising methods for achieving general robustness against attacks. However, certified patch defense is challenging due to the occlusion of object regions of interest and expensive computational overhead. Additionally, most defense methods require modifications on downstream classifiers. To address these challenges, we propose Certified Dual Mask-Preservation (CertDMP), a certified defense method that employs a simple yet highly effective mask-preservation strategy against patch attacks of any known size. Our defense consists of two stages: Firstly, multiple predictions are made on an image using shifted masks to identify possible attacked regions. Secondly, we perform dual preservation prediction to distinguish whether masked regions contain patches or objects of interest. We design two sets of mask-preservation pairs for better locating the patch region. By examining the contrapositive proposition of prior defense, we theoretically prove that CertDMP can provide certified robustness and lower the certification threshold. This property contributes to a better certified accuracy and a reduction in inference time. Furthermore, our defense does not require modifying classifiers; thus, it can be easily applied to different classification models. Experiments on different datasets and base classifiers show that our CertDMP achieves state-of-the-art certified accuracy and significantly improves inference efficiency. Our code repository is: https://github.com/Zimingcs/CertDMP .