Adversarial patch attacks are one of the most practical threat models against realworld computer vision systems. This paper studies the certified and empirical performance of defenses against patch attacks. We begin with a set of experiments showing that most existing defenses, which work by pre-processing input images to mitigate adversarial noise, are easily broken by simple white-box adversaries. Motivated by this finding, we present an approach for certified defense against patch attacks, and propose methods for fast training of these models. Finally, we experiment with different patch shapes for testing, and observe that robustness transfers across shapes surprisingly well.
The paper proposes a certified defense for adversarial patch attacks.
Technically, the authors use the well developed IBP based methods (Gowal et
al., 2018, Mirman et al., 2018, Zhang et al. 2019).  The technique is simple
but effective. Since the number of possible patches are quadratic w.r.t image
dimension, to reduce the number of bounds to propagate, the authors propose a
U-Net based NN to predict the worst case scenario, and only propagate "worst
case" bounds predicted by the U-net.
Empirically, the proposed method gets good results, with certified accuracy
sometimes even higher than empirical accuracy by previous methods.  The authors
also provide results for transferring robustness properties to shapes that are
not included during training.
Overall, the contribution of this paper is novel, and results are promising,
but it still has some missing components, especially the idea of combining
multiple IBP bounds into one, which can be very effective for adversarial
patches, as I will elaborate below.
Suggestions and Questions:
The core idea behind IBP is that for whatever input perturbation is given (any
Lp norm or semi-norm, or non-norm based perturbations like patches at arbitrary
locations), it converts them to per-neuron lower and upper bounds after the
first linear/conv layer.  For example, if the input perturbation is *two* patches
B_1 and B_2, after propagating them through the first layer of the network, we
got two lower bounds l_{i,1}, l_{i,2} and two upper bounds u_{i,1}, u_{i,2} for
the i-th neuron. We then take the worst case bound, l_i = min(l_{i,1},
l_{i,2}), u_i = max(u_{i,1}, u_{i,2}) and propagate only one set of bounds l_i
and u_i to the next layer. The authors should explore on this direction, as
detailed below:
1. For the exhaustive patch enumeration in (11), we can actually greatly reduce
the computation cost by combining the bounds of different patches after the
first layer of the network, as I mentioned above. At the input layer, the
number of bounds (each for one possible location of patch) are large; but after
the first linear/conv layer, we can compress them to one or a small group of
bounds by taking the worst cast of them, like l_i = min(l_{i,1}, ...,
l_{i,|L|}), u_i = max(u_{i,1}, ..., u_{i,2}). The patches close with each other
should also produces similar lower and upper bounds, so taking min or max over
them will not make the combined bounds much worse. This is better than U-net
prediction since we are guaranteed to include the worst case scenario.
2. Considering multiple patches (at different locations) on a single input. In
the simplest case, consider multiple 1x1 patches (in fact, this is equivalent
to bounded L0 norm threat model); since each patch is 1x1 (only changing one
pixel), the bounds should be relatively tight after the first layer, and after
the first linear/conv layer we got 28*28 or 32*32 bounds which will be combined
into one or very few sets of lower and upper bounds that will be propagate into
later layers.  Multiple larger patches (2x2, 5x5) can be difficult since bounds
are looser; multiple 1x1 in my opinion is both technically feasible and
practically important, and should definitely be included in this paper.
Minor issues:
1. Eq. (5) and (6) are incorrect; the second term should be \overline{z} -
\underline{z}. Also it is missing the bias term.
2. In related works (section 4.1, page 3), (Weng et al., 2018) is not a defense
method (it is a certification method, and no training is involved).
3. In Table 3, it is better if the authors can provide empirical adversarial
accuracy to IBP defended networks as well.
Overall, I think it is a good paper but the authors should explore more to
strengthen their contributions. I gave a weak reject but I will not hesitate
to recommend an accept as long as the authors can provide additional results
mentioned above.