Scalable and Precise Patch Robustness Certification for Deep Learning Models with Top-k Predictions

The Education University of Hong Kong, Hong Kong *corresponding author Abstract--Patch robustness certification is an emerging verification approach for defending against adversarial patch attacks with provable guarantees for deep learning systems. Certified recovery techniques guarantee the prediction of the sole true label of a certified sample. However, existing techniques, if applicable to top-k predictions, commonly conduct pairwise comparisons on those votes between labels, failing to certify the sole true label within the top k prediction labels precisely due to the inflation on the number of votes controlled by the attacker (i.e., attack budget); yet enumerating all combinations of vote allocation suffers from the combinatorial explosion problem. We propose CostCert, a novel, scalable, and precise voting-based certified recovery defender. CostCert verifies the true label of a sample within the top k predictions without pairwise comparisons and combinatorial explosion through a novel design: whether the attack budget on the sample is infeasible to cover the smallest total additional votes on top of the votes uncontrollable by the attacker to exclude the true labels from the top k prediction labels. Experiments show that CostCert significantly outperforms the current state-of-the-art defender PatchGuard, such as retaining up to 57.3% in certified accuracy when the patch size is 96, whereas PatchGuard has already dropped to zero. Deep learning (DL) systems are susceptible to adversarial attacks [1-3]. For instances, tag-like perturbations patched on items can fool online shopping platforms [3] (see Figure 1), which is an example generally known as a patch attack [1]: a model for physical adversarial attacks [4], where attackers can change pixels arbitrarily within a specific region (called a patch region [5-7]) in a sample. Quality assurance on them and improving their robustness are essential.