一句话：提出 Calzone，首个对 L0（少像素）对抗攻击给出可靠且完备分析的神经网络鲁棒性验证器。
神经网络虽性能优异，却易受对抗样本攻击。在 L0 攻击（即少像素攻击）中，攻击者选取图像中的 t 个像素并任意扰动其取值；要判定网络的鲁棒性，必须对每个 t 像素集合的扰动都进行检验，而这样的集合数量随 t 指数增长，使得一次只能推理单个像素集合的现有验证器在实际中不可行。本文提出 Calzone：其核心观察是，若分类器对大小为 k（k>t）的像素集合的任意扰动都鲁棒，则对其所有大小为 t 的子集也鲁棒。Calzone 先用动态规划与采样预测可被证明鲁棒的最大 k，再借助覆盖设计（covering designs）用大小为 k 的集合覆盖整幅图像；对覆盖中的每个集合，将其对应的 box 邻域交给已有的 L∞ 鲁棒性验证器；若某集合的邻域不鲁棒，则以更小的 k'<k 重新覆盖该集合。作者在多个数据集与网络上对 t≤5 进行评估：Calzone 通常能在数分钟内完成验证，最困难的实例（如 t=5）在数小时内完成；与 MILP 基线相比，后者在 t=3 时已无法扩展。
While successful, neural networks have been shown to be vulnerable to adversarial example attacks. In L 0 adversarial attacks, also known as few-pixel attacks, the attacker picks t pixels from the image and arbitrarily perturbs them. To understand the robustness level of a network to these attacks, it is required to check the robustness of the network to perturbations of every set of t pixels. Since the number of sets is exponentially large, existing robustness verifiers, which can reason about a single set of pixels at a time, are impractical for L 0 robustness verification. We introduce Calzone, an L 0 robustness verifier for neural networks. To the best of our knowledge, Calzone is the first to provide a sound and complete analysis for L 0 adversarial attacks. Calzone builds on the following observation: if a classifier is robust to any perturbation of a set of k pixels, for k > t , then it is robust to any perturbation of its subsets of size t . Thus, to reduce the verification time, Calzone predicts the largest k that can be proven robust, via dynamic programming and sampling. It then relies on covering designs to compute a covering of the image with sets of size k . For each set in the covering, Calzone submits its corresponding box neighborhood to an existing L ∞ robustness verifier. If a set’s neighborhood is not robust, Calzone repeats this process and covers this set with sets of size k ′< k . We evaluate Calzone on several datasets and networks, for t ≤ 5. Typically, Calzone verifies L 0 robustness within few minutes. On our most challenging instances (e.g., t =5), Calzone completes within few hours. We compare to a MILP baseline and show that it does not scale already for t =3.
@article{paperbot2046,
title = {Deep Learning Robustness Verification for Few-Pixel Attacks},
author = {Yuval Shapira and Eran Avneri and Dana Drachsler-Cohen},
journal = {Proceedings of the ACM on Programming Languages},
volume = {7},
number = {OOPSLA1},
year = {2023},
doi = {10.1145/3586042}
}