Certified Robustness Meets Floating-Point Attacks: Rounding Errors Can Invalidate the Guarantee of Certified Radii
Getting a-Round Guarantees: Floating-Point Attacks on Certified Robustness
Translation in progress — untranslated text is omitted.
The paper proposes a rounding search attack that exploits floating-point rounding errors causing certified radii to be overestimated, finding adversarial examples within the certified radius and invalidating the guarantee of certified robustness. The method first uses a PGD-like linear approximation to determine the shortest perturbation direction, then samples and fine-tunes perturbations within the floating-point neighborhood to approach the gap between the true certified radius and the computed radius. Under the weak threat model, the attack success rate is about 50% on a random linear classifier, up to 23.24% on a linear SVM on MNIST, and up to 15% on neural networks; on the β-CROWN and Gurobi MIP verifiers it is 2.6% and 60.76% respectively (on an artificially constructed fully-activated ReLU network), and 15.83% (on a conventionally trained network). Under the strong threat model the success rate is lower but still non-zero, up to 0.16% on a linear SVM. The authors propose computing certified radii using rounding interval arithmetic, reducing the attack success rate of both threat models to 0% on a random linear classifier.
- Certified robustness mechanisms prove under real-number assumptions that there are no adversarial examples within radius R, but actual implementations use floating-point arithmetic, and rounding error can overestimate the certified radius, so that adversarial examples still exist within the certified radius.
- The authors propose rounding search: first use the piecewise-linear property of ReLU networks to obtain a local linear approximation and thus a perturbation direction (ReluPGD), then sample floating-point neighborhood perturbations near the certified radius boundary and check for samples whose norm does not exceed the computed radius and that flip the prediction; they also propose a defense based on rounded interval arithmetic.
- Under the weak threat model, the attack success rate on the random linear classifier is about 50%, the MNIST linear SVM is at most 23.24%, the MIP-certified network is at most 60.76%, and randomized smoothing certification is at most 21.11%; under the strong threat model the success rate is lower but nonzero. The authors state that the defense reduces the attack success rate on the random linear classifier to 0%.
- The authors note: the relationship between the attack success rate on randomized smoothing and its soundness probability was not studied; the defense was demonstrated only on linear models and exact certification; evaluation is limited to smaller models and MNIST, with larger models and datasets left for future work.
The paper empirically shows that floating-point rounding causes certified radii to be overestimated, with an attack success rate of 23.24% on a linear SVM on MNIST, and provides a fix based on interval arithmetic.