Cross-Input Certified Training for Universal Perturbations

arXiv:2405.09176v1 Announce Type: cross
Abstract: Existing work in trustworthy machine learning primarily focuses on single-input adversarial perturbations. In many real-world attack scenarios, input-agnostic adversarial attacks, e.g. universal adversarial perturbations (UAPs), are much more feasible. Current certified training methods train models robust to single-input perturbations but achieve suboptimal clean and UAP accuracy, thereby limiting their applicability in practical applications. We propose a novel method, CITRUS, for certified training of networks robust against UAP attackers. We show in an extensive evaluation across …

accuracy adversarial adversarial attacks arxiv attack attacks certified cs.cr cs.lg current input machine machine learning real single train training uap work world