Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attacks

TL;DR

This paper introduces an improved certification method for defending against poisoning attacks in machine learning, providing stronger guarantees of robustness by leveraging differential privacy and Gaussian mechanisms.

Contribution

It presents a novel pointwise certification approach that offers more than twice the robustness guarantees compared to previous methods, enhancing defenses against poisoning attacks.

Findings

Robustness guarantees more than doubled compared to prior work

Utilizes differential privacy and Gaussian mechanisms for certification

Provides formal pointwise robustness guarantees against poisoning

Abstract

Poisoning attacks can disproportionately influence model behaviour by making small changes to the training corpus. While defences against specific poisoning attacks do exist, they in general do not provide any guarantees, leaving them potentially countered by novel attacks. In contrast, by examining worst-case behaviours Certified Defences make it possible to provide guarantees of the robustness of a sample against adversarial attacks modifying a finite number of training samples, known as pointwise certification. We achieve this by exploiting both Differential Privacy and the Sampled Gaussian Mechanism to ensure the invariance of prediction for each testing instance against finite numbers of poisoned examples. In doing so, our model provides guarantees of adversarial robustness that are more than twice as large as those provided by prior certifications.