Adversarial Attacks and Certified Defences for Deep Image Classifiers

Abstract

A change of a few pixel values, too small for a person to notice, can flip the label a deep classifier assigns to an image. Twelve years after that observation, the defensive picture has settled into two camps that are often confused with one another. Empirical defences resist the attacks that were tried against them and carry no guarantee. Certified defences return a proof that no perturbation inside a stated ball can change the prediction, and pay for that proof in accuracy, in compute, or in both. This review covers thirty two works. We describe the attack surface by what the adversary is assumed to know, we trace why a long run of empirical defences was broken by adaptive attacks, and we compare three certification strategies: exact solvers, convex relaxation with bound propagation, and randomized smoothing. Two findings deserve emphasis. Robust accuracy on standard benchmarks remains far below clean accuracy, and the gap is not closing quickly. And an evaluation that does not include an adaptive attack tells the reader almost nothing.