## BREAKING CERTIFIED DEFENSES: SEMANTIC ADVERSARIAL EXAMPLES WITH SPOOFED ROBUSTNESS CERTIFICATES

25 Sept 2019, 19:32 (modified: 10 Feb 2022, 11:43)ICLR 2020 Conference Blind SubmissionReaders: Everyone
Original Pdf: pdf
Code: [![github](/images/github_icon.svg) AminJun/BreakingCertifiableDefenses](https://github.com/AminJun/BreakingCertifiableDefenses)
Data: [ImageNet](https://paperswithcode.com/dataset/imagenet)
Abstract: Defenses against adversarial attacks can be classified into certified and non-certified. Certifiable defenses make networks robust within a certain $\ell_p$-bounded radius, so that it is impossible for the adversary to make adversarial examples in the certificate bound. We present an attack that maintains the imperceptibility property of adversarial examples while being outside of the certified radius. Furthermore, the proposed "Shadow Attack" can fool certifiably robust networks by producing an imperceptible adversarial example that gets misclassified and produces a strong spoofed'' certificate.
7 Replies