Certified Patch Defense via Dual Mask-Preservation Prediction
摘要
Certified patch defense can ensure correct predictions under any adversarial patch attack, making it one of the promising methods for achieving general robustness against attacks. However, certified patch defense is challenging due to the occlusion of object regions of interest and expensive computational overhead. Additionally, most defense methods require modifications on downstream classifiers. To address these challenges, we propose Certified Dual Mask-Preservation (CertDMP), a certified defense method that employs a simple yet highly effective mask-preservation strategy against patch attacks of any known size. Our defense consists of two stages: Firstly, multiple predictions are made on an image using shifted masks to identify possible attacked regions. Secondly, we perform dual preservation prediction to distinguish whether masked regions contain patches or objects of interest. We design two sets of mask-preservation pairs for better locating the patch region. By examining the contrapositive proposition of prior defense, we theoretically prove that CertDMP can provide certified robustness and lower the certification threshold. This property contributes to a better certified accuracy and a reduction in inference time. Furthermore, our defense does not require modifying classifiers; thus, it can be easily applied to different classification models. Experiments on different datasets and base classifiers show that our CertDMP achieves state-of-the-art certified accuracy and significantly improves inference efficiency. Our code repository is: https://github.com/Zimingcs/CertDMP .