Certified Robustness

Uses Satisfiability Modulo Theories (SMT) and abstract interpretation to prove that no adversarial example exists within an Lp-norm ball around an input. Unlike empirical attacks that only search for failures, verification tools like alpha-beta-CROWN propagate symbolic bounds through the network to provide a definitive robustness certificate. If the lower bound of the correct class exceeds the upper bound of all others, the prediction is provably invariant.

A probabilistic certification method that constructs a smoothed classifier by adding isotropic Gaussian noise to inputs and aggregating predictions via majority vote. The resulting model is certifiably robust within a certified radius derived from the Neyman-Pearson lemma. Key properties:

• Scalable: Works on any base classifier without architectural changes
• Tightness: Advanced methods like Double Sampling Randomized Smoothing (DSRS) tighten the certified radius using multiple noise samples
• Trade-off: Larger noise increases certified radius but reduces clean accuracy

Enforces a global Lipschitz constant on the neural network, bounding how much the output can change relative to input perturbations. Techniques include:

• Spectral normalization: Constrains weight matrices to have bounded singular values
• 1-Lipschitz architectures: Specialized layers like GroupSort activations and orthogonal convolutions
• Certified training: Directly optimizes the certified robust loss during training, maximizing the provable margin between classes

A sound and complete certification method that propagates axis-aligned bounding boxes through the network. For each layer, IBP computes the convex relaxation of possible outputs given an input region. While computationally efficient, IBP produces loose bounds due to the "wrapping effect" where dependencies between neurons are lost. Modern variants like CROWN-IBP combine tight linear relaxations with interval arithmetic for a favorable accuracy-certification trade-off.

Certified defenses fall into two categories with distinct failure modes:

Probabilistic (Randomized Smoothing):

• Certificate holds with probability 1 - α
• Failure means the guarantee is void, not that an attack succeeded
• Requires multiple Monte Carlo samples for prediction

Deterministic (Verification, Lipschitz):

• Certificate is absolute — no probabilistic caveats
• Computationally harder to obtain for large models
• Preferred for safety-critical systems where any uncertainty is unacceptable

A maliciously perturbed input designed to cause a model to make a mistake while appearing unmodified to human observers. These inputs exploit the high-dimensional linearity of neural networks.

• Lp-norm bounds: Perturbations are typically constrained by L2 or L∞ distance metrics
• Imperceptibility: Human vision cannot detect the perturbation, yet the model's prediction flips entirely
• Physical domain: Examples can be printed and photographed, maintaining their adversarial nature in the real world

A probabilistic defense that constructs a certifiably robust classifier by adding Gaussian noise to inputs and aggregating predictions. It provides a provable lower bound on the L2 radius within which predictions remain constant.

• Mechanism: The smoothed classifier returns the most probable class under the noise distribution
• Certification: The radius is computed analytically using the Neyman-Pearson lemma
• Scalability: Works with any base classifier without modifying its architecture or training procedure

A multi-step iterative variant of the Fast Gradient Sign Method that projects perturbations onto an Lp-norm ball. PGD serves as the standard benchmark for evaluating empirical robustness.

• Iterative optimization: Takes multiple gradient steps with step size α, projecting back to the ε-ball after each step
• Random restarts: Multiple initializations prevent gradient masking from giving a false sense of security
• Standard benchmark: PGD-40 with cross-entropy loss is the baseline attack in RobustBench evaluations

The formal process of proving that a neural network's output satisfies specific properties for all inputs within a defined domain. Unlike empirical testing, verification provides mathematical guarantees.

• SMT solvers: Translate network constraints into satisfiability modulo theories formulations
• Abstract interpretation: Propagate symbolic bounds through layers to over-approximate output ranges
• Branch-and-bound: Combine incomplete verifiers with recursive splitting for complete certification

A defensive technique that augments training data with on-the-fly generated adversarial examples to improve model robustness. It remains the strongest empirical defense against gradient-based attacks.

• Min-max formulation: Inner maximization crafts adversarial examples; outer minimization updates weights
• Computational cost: Training time increases by a factor proportional to the number of PGD steps
• Trade-off: Robustness often comes at the cost of reduced accuracy on clean, unperturbed data

A standardized, parameter-free ensemble of attacks used to reliably evaluate empirical robustness. It combines four diverse attack strategies to avoid overfitting to any single evaluation method.

• APGD-CE: Auto-tuned PGD with cross-entropy loss and momentum
• APGD-DLR: PGD variant using difference of logits ratio loss
• FAB: Fast adaptive boundary attack targeting minimal-norm perturbations
• Square Attack: Query-efficient black-box attack using randomized square-shaped updates