Using Reed-Muller Codes for Classification with Rejection and Recovery

TL;DR

This paper introduces RMAggNet, a Reed-Muller code-inspired classifier that can correct and reject inputs, improving robustness against adversarial attacks while reducing unnecessary rejections of correctly classifiable data.

Contribution

The paper proposes RMAggNet, a novel classification-with-rejection method based on Reed-Muller codes, capable of error correction and rejection to enhance robustness against adversarial perturbations.

Findings

RMAggNet reduces incorrect classifications under adversarial attacks.

It maintains high correctness on clean data.

It minimizes unnecessary rejections.

Abstract

When deploying classifiers in the real world, users expect them to respond to inputs appropriately. However, traditional classifiers are not equipped to handle inputs which lie far from the distribution they were trained on. Malicious actors can exploit this defect by making adversarial perturbations designed to cause the classifier to give an incorrect output. Classification-with-rejection methods attempt to solve this problem by allowing networks to refuse to classify an input in which they have low confidence. This works well for strongly adversarial examples, but also leads to the rejection of weakly perturbed images, which intuitively could be correctly classified. To address these issues, we propose Reed-Muller Aggregation Networks (RMAggNet), a classifier inspired by Reed-Muller error-correction codes which can correct and reject inputs. This paper shows that RMAggNet can minimise incorrectness while maintaining good correctness over multiple adversarial attacks at different perturbation budgets by leveraging the ability to correct errors in the classification process. This provides an alternative classification-with-rejection method which can reduce the amount of additional processing in situations where a small number of incorrect classifications are permissible.