Deep neural networks (DNNs) have transformed several arti cial intelligence research areas including computer vision, speech recognition, and natural language processing. However, recent studies demonstrated that DNNs are vulnerable to adversarial manipulations at testing time. Speci cally, suppose we have a testing example, whose label can be correctly predicted by a DNN classi er. An a acker can add a small carefully cra ed noise to the testing example such that the DNN classi er predicts an incorrect label, where the cra ed testing example is called adversarial example. Such a acks are called evasion a acks. Evasion a acks are one of the biggest challenges for deploying DNNs in safety and security critical applications such as self-driving cars. In this work, we develop new methods to defend against evasion a acks. Our key observation is that adversarial examples are close to the classi cation boundary. erefore, we propose region-based classi cation to be robust to adversarial examples. For a benign/adversarial testing example, we ensemble information in a hypercube centered at the example to predict its label. Speci cally, we sample some data points from the hypercube centered at the testing example in the input space; we use an existing DNN to predict the label for each sampled data point; and we take a majority vote among the labels of the sampled data points as the label for the testing example. In contrast, traditional classi ers are point-based classi cation, i.e., given a testing example, the classi er predicts its label based on the testing example alone. Our evaluation results on MNIST and CIFAR-10 datasets demonstrate that our region-based classi cation can signi cantly mitigate evasion a acks without sacri cing classi cation accuracy on benign examples. Speci cally, our region-based classi cation achieves the same classi cation accuracy on testing benign examples as point-based classi cation, but our region-based classi cation is signi cantly more robust than point-based classi cation to various evasion a acks.

No abstract

Community detection plays a key role in understanding graph structure. However, several recent studies showed that community detection is vulnerable to adversarial structural perturbation. In particular, via adding or removing a small number of carefully selected edges in a graph, an attacker can manipulate the detected communities. However, to the best of our knowledge, there are no studies on certifying robustness of community detection against such adversarial structural perturbation. In this work, we aim to bridge this gap. Specifically, we develop the first certified robustness guarantee of community detection against adversarial structural perturbation. Given an arbitrary community detection method, we build a new smoothed community detection method via randomly perturbing the graph structure. We theoretically show that the smoothed community detection method provably groups a given arbitrary set of nodes into the same community (or different communities) when the number of edges added/removed by an attacker is bounded. Moreover, we show that our certified robustness is tight. We also empirically evaluate our method on multiple real-world graphs with ground truth communities.

No abstract