Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart
Tianyu Panga b, Huishuai Zhangc, Di Hec, Yinpeng Donga b, Hang Sua b, Wei Ren Chend, Jun Zhua b, Tie- Yan Liuc
- aInstitute for AI, Tsinghua University,BNRist Center, THBI Lab,Dept. of Comp. Sci. and Tech
- bDept. of Comp. Sci. and Tech., BNRist Center, THBI Lab, Institute for AI, Tsinghua University
- cMSRA
- dICT, CAS
Papers open inside SciRah from the original publisher or repository; SciRah never hosts them.
Abstract
Correctly classifying adversarial examples is an essential but challenging requirement for safely deploying machine learning models. As reported in RobustBench, even the state-of-the-art adversarially trained models struggle to exceed 67% robust test accuracy on CIFAR-10, which is far from practical. A complementary way towards robustness is to introduce a rejection option, allowing the model to not return predictions on uncertain inputs, where confidence is a commonly used certainty proxy. Along with this routine, we find that confidence and a rectified confidence (R-Con) can form two coupled rejection metrics, which could provably distinguish wrongly classified inputs from correctly classified ones. This intriguing property sheds light on using coupling strategies to better detect and reject adversarial examples. We evaluate our rectified rejection (RR) module on CIFAR-10, CIFAR-10-C, and CIFAR-100 under several attacks including adaptive ones, and demonstrate that the RR module is compatible with different adversarial training frameworks on improving robustness, with little extra computation.
TL;DRThis work finds that confidence and a rectified confidence can form two coupled rejection metrics, which could provably distinguish wrongly classified inputs from correctly classified ones, and sheds light on using coupling strategies to better detect and reject adversarial examples. (Semantic Scholar)