Certified but Fooled! Breaking Certified Defences with Ghost Certificates

TL;DR

This paper reveals how adversaries can exploit probabilistic certification frameworks to generate imperceptible perturbations that spoof robustness guarantees, effectively bypassing state-of-the-art certified defenses like Densepure.

Contribution

It demonstrates the feasibility of crafting small, region-focused adversarial examples that deceive certified defenses, exposing vulnerabilities in current robustness certification methods.

Findings

Effective bypass of Densepure certification using ghost certificates

Imperceptible perturbations can generate false robustness guarantees

Extensive evaluations on ImageNet validate the attack method

Abstract

Certified defenses promise provable robustness guarantees. We study the malicious exploitation of probabilistic certification frameworks to better understand the limits of guarantee provisions. Now, the objective is to not only mislead a classifier, but also manipulate the certification process to generate a robustness guarantee for an adversarial input certificate spoofing. A recent study in ICLR demonstrated that crafting large perturbations can shift inputs far into regions capable of generating a certificate for an incorrect class. Our study investigates if perturbations needed to cause a misclassification and yet coax a certified model into issuing a deceptive, large robustness radius for a target class can still be made small and imperceptible. We explore the idea of region-focused adversarial examples to craft imperceptible perturbations, spoof certificates and achieve certification radii larger than the source class ghost certificates. Extensive evaluations with the ImageNet demonstrate the ability to effectively bypass state-of-the-art certified defenses such as Densepure. Our work underscores the need to better understand the limits of robustness certification methods.