A Framework for Verification of Wasserstein Adversarial Robustness
This work addresses the challenge of robust machine learning for image classification, offering incremental improvements in verification efficiency and attack methods.
The authors tackled the problem of verifying adversarial robustness of image classifiers under the Wasserstein metric, which better captures human similarity perception than Lp-norms, by developing a framework to transfer existing certification methods to this threat model and introducing a computationally efficient projected gradient descent-based attack.
Machine learning image classifiers are susceptible to adversarial and corruption perturbations. Adding imperceptible noise to images can lead to severe misclassifications of the machine learning model. Using $L_p$-norms for measuring the size of the noise fails to capture human similarity perception, which is why optimal transport based distance measures like the Wasserstein metric are increasingly being used in the field of adversarial robustness. Verifying the robustness of classifiers using the Wasserstein metric can be achieved by proving the absence of adversarial examples (certification) or proving their presence (attack). In this work we present a framework based on the work by Levine and Feizi, which allows us to transfer existing certification methods for convex polytopes or $L_1$-balls to the Wasserstein threat model. The resulting certification can be complete or incomplete, depending on whether convex polytopes or $L_1$-balls were chosen. Additionally, we present a new Wasserstein adversarial attack that is projected gradient descent based and which has a significantly reduced computational burden compared to existing attack approaches.