RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletion
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2023
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866916104909094912 |
|---|---|
| author | Huang, Zhuoqun Marchant, Neil G. Lucas, Keane Bauer, Lujo Ohrimenko, Olga Rubinstein, Benjamin I. P. |
| author_facet | Huang, Zhuoqun Marchant, Neil G. Lucas, Keane Bauer, Lujo Ohrimenko, Olga Rubinstein, Benjamin I. P. |
| contents | Randomized smoothing is a leading approach for constructing classifiers that are certifiably robust against adversarial examples. Existing work on randomized smoothing has focused on classifiers with continuous inputs, such as images, where $\ell_p$-norm bounded adversaries are commonly studied. However, there has been limited work for classifiers with discrete or variable-size inputs, such as for source code, which require different threat models and smoothing mechanisms. In this work, we adapt randomized smoothing for discrete sequence classifiers to provide certified robustness against edit distance-bounded adversaries. Our proposed smoothing mechanism randomized deletion (RS-Del) applies random deletion edits, which are (perhaps surprisingly) sufficient to confer robustness against adversarial deletion, insertion and substitution edits. Our proof of certification deviates from the established Neyman-Pearson approach, which is intractable in our setting, and is instead organized around longest common subsequences. We present a case study on malware detection--a binary classification problem on byte sequences where classifier evasion is a well-established threat model. When applied to the popular MalConv malware detection model, our smoothing mechanism RS-Del achieves a certified accuracy of 91% at an edit distance radius of 128 bytes. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2302_01757 |
| institution | arXiv |
| publishDate | 2023 |
| record_format | arxiv |
| spellingShingle | RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletion Huang, Zhuoqun Marchant, Neil G. Lucas, Keane Bauer, Lujo Ohrimenko, Olga Rubinstein, Benjamin I. P. Cryptography and Security Machine Learning Randomized smoothing is a leading approach for constructing classifiers that are certifiably robust against adversarial examples. Existing work on randomized smoothing has focused on classifiers with continuous inputs, such as images, where $\ell_p$-norm bounded adversaries are commonly studied. However, there has been limited work for classifiers with discrete or variable-size inputs, such as for source code, which require different threat models and smoothing mechanisms. In this work, we adapt randomized smoothing for discrete sequence classifiers to provide certified robustness against edit distance-bounded adversaries. Our proposed smoothing mechanism randomized deletion (RS-Del) applies random deletion edits, which are (perhaps surprisingly) sufficient to confer robustness against adversarial deletion, insertion and substitution edits. Our proof of certification deviates from the established Neyman-Pearson approach, which is intractable in our setting, and is instead organized around longest common subsequences. We present a case study on malware detection--a binary classification problem on byte sequences where classifier evasion is a well-established threat model. When applied to the popular MalConv malware detection model, our smoothing mechanism RS-Del achieves a certified accuracy of 91% at an edit distance radius of 128 bytes. |
| title | RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletion |
| topic | Cryptography and Security Machine Learning |
| url | https://arxiv.org/abs/2302.01757 |