{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/provably-robust-classification-of-adversarial","title":"Provably robust classification of adversarial examples with detection","arxiv_id":null,"date":"2021-01-01","proceeding":"ICLR 2021 1","authors":["Fatemeh Sheikholeslami","Ali Lotfi","J Zico Kolter"],"abstract":"Adversarial attacks against deep networks can be defended against either by building robust classifiers or, by creating classifiers that can \\emph{detect} the presence of adversarial perturbations.  Although it may intuitively seem easier to simply detect attacks rather than build a robust classifier, this has not bourne out in practice even empirically, as most detection methods have subsequently been broken by adaptive attacks, thus necessitating \\emph{verifiable} performance for detection mechanisms.  In this paper, we propose a new method for jointly training a provably robust classifier and detector.  Specifically, we show that by introducing an additional \"abstain/detection\" into a classifier, we can modify existing certified defense mechanisms to allow the classifier to either robustly classify \\emph{or} detect adversarial attacks.  We extend the common interval bound propagation (IBP) method for certified robustness under $\\ell_\\infty$ perturbations to account for our new robust objective, and show that the method outperforms traditional IBP used in isolation, especially for large perturbation sizes.  Specifically, tests on MNIST and CIFAR-10 datasets exhibit promising results, for example with provable robust error less than $63.63\\%$ and $67.92\\%$, for $55.6\\%$ and $66.37\\%$ natural error, for $\\epsilon=8/255$ and $16/255$ on the CIFAR-10 dataset, respectively.\n","url_abs":"https://openreview.net/forum?id=sRA5rLNpmQc","url_pdf":"https://openreview.net/pdf?id=sRA5rLNpmQc","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"provably-robust-classification-of-adversarial","repo_url":"https://github.com/boschresearch/robust_classification_with_detection","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"classification-1","task_name":"Classification"},{"task_slug":"classification","task_name":"General Classification"},{"task_slug":"robust-classification","task_name":"Robust classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}