用数学最优掩码策略，单次处理就能高效防御对抗性贴图攻击。
CertMask: Certifiable Defense Against Adversarial Patches via Theoretically Optimal Mask Coverage
- 基于数学覆盖原理生成二值掩码集，确保每个可能贴图位置被覆盖至少k次。
- 仅需一次掩码操作，推理耗时从O(n²)降至O(n)，效率显著提升。
- 在ImageNet等数据集上认证准确率比现有方法最高提升13.4%，适合高安全场景。
对抗性贴图攻击通过在图像局部注入扰动误导深度视觉模型，且可物理部署，对现实应用构成严重威胁。本文提出CertMask，一种可证明鲁棒的防御方法，构建一个理论充分的二值掩码集合，以彻底消除贴图影响并提供强理论保证。相比当前最优方法PatchCleanser需两轮掩码且推理成本为O(n²)，CertMask仅需一轮掩码，时间复杂度降至O(n)，其中n为掩码集基数。所提掩码集采用严格数学覆盖策略，确保每个可能贴图位置至少被覆盖k次，兼顾效率与鲁棒性。我们对覆盖条件进行理论分析，并证明其认证充分性。在ImageNet、ImageNette和CIFAR-10上的实验表明，CertMask在保持原始模型干净准确率的同时，认证鲁棒准确率相较PatchCleanser最高提升13.4%。
原文摘要 · Abstract (English)
Adversarial patch attacks inject localized perturbations into images to mislead deep vision models. These attacks can be physically deployed, posing serious risks to real-world applications. In this paper, we propose CertMask, a certifiably robust defense that constructs a provably sufficient set of binary masks to neutralize patch effects with strong theoretical guarantees. While the state-of-the-art approach (PatchCleanser) requires two rounds of masking and incurs $O(n^2)$ inference cost, CertMask performs only a single round of masking with $O(n)$ time complexity, where $n$ is the cardinality of the mask set to cover an input image. Our proposed mask set is computed using a mathematically rigorous coverage strategy that ensures each possible patch location is covered at least $k$ times, providing both efficiency and robustness. We offer a theoretical analysis of the coverage condition and prove its sufficiency for certification. Experiments on ImageNet, ImageNette, and CIFAR-10 show that CertMask improves certified robust accuracy by up to +13.4\% over PatchCleanser, while maintaining clean accuracy nearly identical to the vanilla model.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。