Certifiably Adversarially Robust Detection of Out-of-Distribution Data
Deep neural networks are known to be overconfident when applied to out-of-distribution (OOD) inputs which clearly do not belong to any class. This is a problem in safety-critical applications since a reliable assessment of the uncertainty of a classifier is a key property, allowing the system to trigger human intervention or to transfer into a safe state. In this paper, we aim for certifiable worst case guarantees for OOD detection by enforcing not only low confidence at the OOD point but also in an $l_\infty$-ball around it. For this purpose, we use interval bound propagation (IBP) to upper bound the maximal confidence in the $l_\infty$-ball and minimize this upper bound during training time. We show that non-trivial bounds on the confidence for OOD data generalizing beyond the OOD dataset seen at training time are possible. Moreover, in contrast to certified adversarial robustness which typically comes with significant loss in prediction performance, certified guarantees for worst case OOD detection are possible without much loss in accuracy.
Code (2)
Tasks
Adversarial RobustnessOut of Distribution (OOD) DetectionSimilar Papers 제목 키워드 기반
Certified Robustness to Label-Flipping Attacks via Randomized Smoothing
Machine learning algorithms are known to be susceptible to data poisoning attacks, where an adversary manipulates the training data to degrade performance of the resulting classifier. In this work, we present a unifying …
Data PoisoningGeneral ClassificationMulti-class ClassificationLearning Better Certified Models from Empirically-Robust Teachers
Adversarial training attains strong empirical robustness to specific adversarial attacks by training on concrete adversarial perturbations, but it produces neural networks that are not amenable to strong robustness certi…
Knowledge DistillationPointCert: Point Cloud Classification with Deterministic Certified Robustness Guarantees
Point cloud classification is an essential component in many security-critical applications such as autonomous driving and augmented reality. However, point cloud classifiers are vulnerable to adversarially perturbed poi…
Autonomous DrivingClassificationPoint Cloud ClassificationAdversarially Learned Anomaly Detection
Anomaly detection is a significant and hence well-studied problem. However, developing effective anomaly detection methods for complex and high-dimensional data remains a challenge. As Generative Adversarial Networks (GA…
Anomaly DetectionPatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier
The adversarial patch attack against image classification models aims to inject adversarially crafted pixels within a restricted image region (i.e., a patch) for inducing model misclassification. This attack can be reali…
image-classificationImage Classification