English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Adversarial examples pose a security risk as they can alter decisions of amachine learning classifier through slight input perturbations. Certifiedrobustness has been proposed as a mitigation where given an input $\mathbf{x}$,a classifier returns a prediction and a certified radius $R$ with a provableguarantee that any perturbation to $\mathbf{x}$ with $R$-bounded norm will notalter the classifier's prediction. In this work, we show that these guaranteescan be invalidated due to limitations of floating-point representation thatcause rounding errors. We design a rounding search method that can efficientlyexploit this vulnerability to find adversarial examples againststate-of-the-art certifications in two threat models, that differ in how thenorm of the perturbation is computed. We show that the attack can be carriedout against linear classifiers that have exact certifiable guarantees andagainst neural networks that have conservative certifications. In the weakthreat model, our experiments demonstrate attack success rates over 50% onrandom linear classifiers, up to 23% on the MNIST dataset for linear SVM, andup to 15% for a neural network. In the strong threat model, the success ratesare lower but positive. The floating-point errors exploited by our attacks canrange from small to large (e.g., $10^{-13}$ to $10^{3}$) - showing that evennegligible errors can be systematically exploited to invalidate guaranteesprovided by certified robustness. Finally, we propose a formal mitigationapproach based on bounded interval arithmetic, encouraging futureimplementations of robustness certificates to account for limitations of moderncomputing architecture to provide sound certifiable guarantees.

Getting a-Round Guarantees: Floating-Point Attacks on Certified Robustness