Getting a-Round Guarantees: Floating-Point Attacks on Certified Robustness

Understand

Adversarial examples pose a security risk as they can alter decisions of a machine learning classifier through slight input perturbations.

• Certified robustness has been proposed as a mitigation where given an input $\mathbf{x}$, a classifier returns a prediction and a certified radius $R$ with a provable guarantee that any perturbation to $\mathbf{x}$ with $R$-bounded norm will not alter the classifier's prediction.
• In this work, we show that these guarantees can be invalidated due to limitations of floating-point representation that cause rounding errors.
• We design a rounding search method that can efficiently exploit this vulnerability to find adversarial examples against state-of-the-art certifications in two threat models, that differ in how the norm of the perturbation is computed.