Cross-Input Certified Training for Universal Perturbations
Not on the map. Why?
Abstract (arXiv)
Existing work in trustworthy machine learning primarily focuses on single-input adversarial perturbations. In many real-world attack scenarios, input-agnostic adversarial attacks, e.g. universal adversarial perturbations (UAPs), are much more feasible. Current certified training methods train models robust to single-input perturbations but achieve suboptimal clean and UAP accuracy, thereby limiting their applicability in practical applications. We propose a novel method, CITRUS, for certified training of networks robust against UAP attackers. We show in an extensive evaluation across different datasets, architectures, and perturbation magnitudes that our method outperforms traditional certified training methods on standard accuracy (up to 10.3%) and achieves SOTA performance on the more practical certified UAP accuracy metric.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 32 of its 55 references that are in the map. First posted on arXiv 15 May 2024.
Builds on
32 of 55 references.
References · 32
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2016Universal adversarial perturbationscited by 774
- 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2019A Survey of Deep Learning Techniques for Autonomous Drivingcited by 401
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
- 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
20 more
- 2017Formal Verification of Piece-Wise Linear Feed-Forward Neural Networkscited by 241
- 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
- 2020Fast and Complete: Enabling Complete Neural Network Verification with Rapid and Massively Parallel Incomplete Verifierscited by 183
- 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 178
- 2018Efficient Formal Safety Analysis of Neural Networkscited by 165
- 2022(Certified!!) Adversarial Robustness for Free!cited by 130
- 2018Universal Adversarial Trainingcited by 85
- 2021PRIMA: General and Precise Neural Network Certification via Scalable Convex Hull Approximationscited by 77
- 2019Adversarial camera stickers: A physical camera-based attack on deep learning systemscited by 69
- 2020Enabling certification of verification-agnostic networks via memory-efficient semidefinite programmingcited by 65
- 2022Certified Training: Small Boxes are All You Needcited by 51
- 2021Fast Certified Robust Training with Short Warmupcited by 45
- 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
- 2019Adversarial Music: Real World Audio Adversary Against Wake-word Detection Systemcited by 20
- 2022Provable Defense Against Geometric Transformationscited by 14
- 2021Universal Adversarial Training with Class-Wise Perturbationscited by 13
- 2021On the Paradox of Certified Trainingcited by 12
- 2023TAPS: Connecting Certified and Adversarial Trainingcited by 11
- 2018Playing the Game of Universal Adversarial Perturbationscited by 9
- 2020Provably Robust Adversarial Examplescited by 8
Built on by
Citing papers per year: 2025: 1.
1 paper.
- 2025Support is All You Need for Certified VAE Trainingcited by 0
- 2025Support is All You Need for Certified VAE Training16 Apr 2025