Does a Hybrid Space-Aware Randomized Defense Improve Empirical and Certified Adversarial Robustness?
Indian Institute of Technology Ropar · RoentGen Health · Aarhus University · Deakin University · Center for AI Safety · University of Bristol · University of Manchester · Khalifa University of Science, Technology and Research · University of Queensland · Monash University · University of Sheffield · Curtin University · Medizinische Universität Wien · Microsoft Research · CSIRO’Data61 and University of New South Wales · University of New South Wales (❤UNSW❤) · Univ of Edinburgh · Monash University, Australia · Seoul National University · UCSD, USA · University of Cambridge
PDF 由论文原始站点提供，PaperCompass 不保存论文文件。
摘要
We introduce Hybrid Space-aware Stochastic Convolution Attention Noise (HySCAN), a hybrid randomized defense that helps close the long-standing gap between provable robustness under ℓ2 certificates and empirical robustness against strong ℓ∞ attacks, while maintaining strong generalization across diverse imaging benchmarks. HySCAN jointly explores complementary sources of stochasticity at both training and inference: (i) implicit weight-space randomness via stochastic-aware Random Weights, and (ii) explicit feature-space randomness via Stochastic Attention Noise Injection modules. By incorporating randomness at both the parameter and representation levels, HySCAN enables meaningful certified guarantees while improving empirical robustness in practice. Comprehensive experiments on diverse imaging datasets, e.g., CelebA, CIFAR-10, and CIFAR-100, ImageNet-1k, HAM10000, and NIH Chest X-ray, demonstrate that HySCAN outperforms existing certified and empirical defenses, improving certified robustness by up to ≈ 9.6% and empirical robustness by up to ≈ 5% without reducing clean accuracy.