Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them

1 INTRODUCTION . Building models that are robust to adversarial examples ( Szegedy et al. , 2014 ; Biggio et al. , 2013 ) is a major challenge and open-problem in machine learning . Due to the inherent difficulty in building robust classifiers , researchers have attempted to build techniques to at least detect adversarial examples , a weaker task that is largely considered easier than robust classification ( Xu et al. , 2018 ; Pang et al. , 2021 ; Sheikholeslami et al. , 2021 ) . Yet , evaluating the robustness of empirical detector defenses is challenging . This is in part due to a lack of strong evaluation guidelines and benchmarks—akin to those developed for robust classifiers ( Carlini et al. , 2019 ; Croce et al. , 2020 ) —as well as to a lack of long-standing comparative baselines such as adversarial training ( Madry et al. , 2018 ) . To illustrate , consider the following ( fictitious ) claims about two defenses against adversarial examples on CIFAR-10 : • defense A is a classifier that achieves robust accuracy of 90 % under ` ∞-perturbations bounded by = 4/255 ; • defense B also has a “ rejection ” option , and achieves robust accuracy of 90 % under ` ∞- perturbations bounded by = 8/255 ( we say that defense B is robust for some example if it classifies that example correctly , and either rejects/detects or correctly classifies all perturbed examples at distance . ) Which of these two ( empirical ) claims are you more likely to believe to be correct ? Defense A claims much higher robustness than the current best result achieved with adversarial training ( Madry et al. , 2018 ; Rebuffi et al. , 2021 ) , the only empirical defense against adversarial examples that has stood the test of time . Indeed , the state-of-the-art ` ∞ robustness for = 4/255 on CIFAR-10 ( without external data ) is ≈ 79 % ( Rebuffi et al. , 2021 ) . Thus , the claim of defense A would likely be met with some initial skepticism and heightened scrutiny , as could be expected for such a claimed breakthrough result . The claim of defense B is harder to assess , due to a lack of long-standing baselines for robust detectors ( many detection defenses have been shown to be broken ( Carlini & Wagner , 2017 ; Tramèr et al. , 2020 ) ) . On one hand , detection of adversarial examples has largely been considered to be an easier task than classification ( Xu et al. , 2018 ; Pang et al. , 2021 ; Sheikholeslami et al. , 2021 ) . On the other hand , defense B claims robustness to perturbations that are twice as large as defense A ( = 8/255 vs. = 4/255 ) . In this paper , we show that the claims of defenses A and B are , in fact , equivalent ! ( up to computational efficiency . ) We prove a general hardness reduction between classification and detection of adversarial examples . Given a detector defense that achieves robust risk α for attacks at distance ( under any metric ) , we show how to build an explicit but inefficient classifier that achieves robust risk α for classifying attacks at distance /2 . The reverse implication also holds : a classifier robust at distance /2 implies an explicit but inefficient robust detector at distance . To the authors knowledge , there is no known way of leveraging computational inefficiency to build more robust models . We should thus be as “ surprised ” by the claim made by defense B as by the claim made by defense A . Our reduction provides a way of assessing the plausibility of new robust detection claims , by contrasting them with results from the more mature literature on robust classification . To illustrate , we revisit 14 published detection defenses across three datasets , and show that in 12/14 cases the defense ’ s robust detection claims would imply an inefficient classifier with robustness far superior to the current state-of-the-art . Yet , none of these detection papers make the claim that their techniques should imply such a breakthrough in robust classification . Using our reduction , it is obvious that many detection defenses are claiming much stronger robustness than we believe feasible with current techniques . And indeed , many of these defenses were later shown to have overestimated their robustness ( Carlini & Wagner , 2017 ; Tramèr et al. , 2020 ) . Remarkably , we find that for certified defenses , the state-of-the-art results for provable robust classification and detection perfectly match the results implied by our reduction . For example , Sheikholeslami et al . ( 2021 ) recently proposed a certified detector on CIFAR-10 with provable robust error that is within 3 % of the provable error of the inefficient detector obtained by combining our result with the state-of-the-art robust classifier of Zhang et al . ( 2020a ) . In summary , we prove that giving classifiers access to a detection option does not help robustness ( or at least , not much ) . Our work provides , to our knowledge , the first example of a hardness reduction between different approaches for robust machine learning . As in the case of computational complexity , we believe that such reductions can be useful for identifying research questions or areas that are unlikely to bear fruit ( bar a significant breakthrough ) —so that the majority of the community ’ s efforts can be redirected elsewhere . On a technical level , our reduction exposes a natural connection between robustness and error correcting codes , which may be of independent interest . 2 HARDNESS REDUCTIONS BETWEEN ROBUST CLASSIFIERS AND DETECTORS . In this section , we prove our main result : a reduction between robust detectors and robust classifiers , and vice-versa . We first introduce some useful notation and define the ( robust ) risk of classifiers with and without a detection option . 2.1 PRELIMINARIES . We consider a classification task with a distribution D over examples x ∈ Rd with labels y ∈ [ C ] . A classifier is a function f : Rd → [ C ] . A detector is a classifier with an extra “ rejection ” or ” detection ” option ⊥ , that indicates the absence of a classification . We assume for simplicity that classifiers and detectors are deterministic . Our results can easily be extended to randomized functions as well . The binary indicator function 1 { A } is 1 if and only if the predicate A is true . We first define a classifier ’ s risk , i.e. , its classification error on unperturbed samples . Definition 1 ( Risk ) . Let f : Rd → [ C ] ∪ { ⊥ } be a classifier ( optionally with a detection output ⊥ ) . The risk of f is the expected rate at which f fails to correctly classify a sample : R ( f ) : = E ( x , y ) ∼D [ 1 { f ( x ) 6=y } ] ( 1 ) Note that for a detector , rejecting an unperturbed example sampled from the distributionD is counted as an error . For classifiers without a rejection option , we define the robust risk as the risk on worst-case adversarial examples ( Madry et al. , 2018 ) . Given an input x sampled from D , an adversarial example x̂ is constrained to being within distance d ( x , x̂ ) ≤ from x , where d is some distance measure . Definition 2 ( Robust risk ) . Let f : Rd → [ C ] be a classifier . The robust risk at distance is : R adv ( f ) : = E ( x , y ) ∼D [ max d ( x , x̂ ) ≤ 1 { f ( x̂ ) 6=y } ] ( 2 ) Thus , a sample ( x , y ) is robustly classified if and only if every point within distance of x ( including x itself ) is correctly classified as y . For a detector ( a classifier with an extra detection/rejection output ) , we analogously define the robust risk with detection . The classifier is now allowed to reject adversarial examples . Definition 3 ( Robust risk with detection ) . Let f : Rd → [ C ] ∪ { ⊥ } be a classifier with an extra detection output ⊥ . The robust risk with detection at distance is : R adv-det ( f ) : = E ( x , y ) ∼D [ max d ( x , x̂ ) ≤ 1 { f ( x ) 6=y ∨ f ( x̂ ) /∈ { y , ⊥ } } ] ( 3 ) That is , a detector defense f is robust on a natural input x if and only if the defense classifies the natural input x correctly , and the defense either rejects or correctly classifies every perturbed input x̂ within distance from x . The requirement that the defense correctly classify natural examples eliminates pathological defenses that reject all inputs . 2.2 ROBUST DETECTION IMPLIES INEFFICIENT ROBUST CLASSIFICATION . We are now ready to introduce our main result , a reduction from a robust detector for adversarial examples at distance , to an inefficient robust classifier at distance /2 . We later prove that this reduction also holds in the reverse direction , thereby demonstrating the equivalence between robust detection and classification—up to computational hardness . Theorem 4 ( -robust detection implies inefficient /2-robust classification ) . Let d ( · , · ) be an arbitrary metric . Let f be a detector that achieves risk R ( f ) = α , and robust risk with detection R adv-det ( f ) = β . Then , we can construct an explicit ( but inefficient ) classifier g that achieves risk R ( g ) ≤ α and robust risk R /2adv ( g ) ≤ β . The classifier g is constructed as follows on input x : • Run the detector model y ← f ( x ) . If the input is not rejected , i.e. , y 6= ⊥ , then output the label y that was predicted by the detector . • Otherwise , find an input x′ within distance /2 of x that is not rejected , i.e. , d ( x , x′ ) ≤ /2 and f ( x′ ) 6= ⊥ . If such an input x′ exists , output the label y ← f ( x′ ) . Else , output a uniformly random label y ∈ [ C ] . An intuitive illustration for our construction , and for the proof of the theorem ( see below ) is in Figure 1 . Our construction can be viewed as an analog of minimum distance decoding in coding theory . We can view a clean data point sampled from D as a codeword , and an adversarial example x̂ as a noisy message with a certain number of errors ( where the error magnitude is measured using an arbitrary metric on Rd rather than the Hamming distance that is typically used for error correcting codes ) . A standard result in coding theory states that if a code can detect α errors , then it can correct α/2 errors . This result follows from a “ ball-packing ” argument : if α errors can be detected , then any two valid codewords must be at least at distance α from each other , and therefore α/2 errors can be corrected via minimum distance decoding . Proof of Theorem 4 . First , note that the natural accuracy of our constructed classifier g is at least as high as that of the detector f , since g always mimics the output of f whenever f does not reject an input sampled from D. Thus , R ( g ) ≤ R ( f ) = α . Now , for the sake of contradiction , consider an input ( x , y ) ∼ D for which the constructed classifier g is not robust at distance /2 . By construction , this means that there exists some input x̂ at distance /2 from x such that x̂ is misclassified , i.e. , g ( x̂ ) = ŷ 6= y . We will show that the detector f is not robust with detection for x either ( for attacks at distance up to ) . By definition of the classifier g , if g ( x̂ ) = ŷ 6= y then either : • The detector f also misclassifies x̂ , i.e. , f ( x̂ ) = ŷ . So f is not robust with detection for x at distance . • There exists an input x′ within distance /2 of x , such that the detector f misclassifies x′ , i.e . f ( x′ ) = ŷ . Note that by the triangular inequality , d ( x , x′ ) ≤ d ( x , x̂ ) + d ( x̂ , x′ ) ≤ /2 + /2 = , and thus f is not robust with detection for x at distance . • The detector f rejects all inputs x′ within distance /2 of x ( and thus g has output ŷ by sampling a label at random ) . Since d ( x , x̂ ) ≤ /2 , this implies that the detector also rejects the clean input x , i.e. , f ( x ) = ⊥ , and thus f is not robust with detection for x . In summary , whenever the constructed classifier g fails to robustly classify an input x up to distance /2 , the detector f also fails to robustly classify x with detection up to distance . Taking expectations over the entire distribution D concludes the proof . Note that the classifier g constructed in Theorem 4 is computationally inefficient . Indeed , the second step of the defense consists in finding a non-rejected input within some metric ball . If the original detector f is a non-convex function ( e.g. , a deep neural network ) , then this step consists in solving an intractable non-convex optimization problem . Our reduction is thus typically not suitable for building a practical robust classifier . Instead , it demonstrates the existence of an inefficient but explicit robust classifier . We discuss the implications of this result more thoroughly in Section 3 . A corollary to our reduction is that many “ information theoretic ” results about robust classifiers can be directly extended to robust detectors . For example , Tsipras et al . ( 2019 ) prove that there exists a formal tradeoff between a classifier ’ s clean accuracy and robust accuracy for certain natural tasks . Since their result applies to any classifier ( including inefficient ones ) , combining their result with our reduction implies that a similar accuracy-robustness tradeoff exists for detectors . More precisely , Tsipras et al . ( 2019 ) show that for certain classification tasks and suitable choices of parameters α , β , , any classifier g which achieves risk R ( g ) ≤ α must have robust risk at least R adv ( g ) ≥ β against ` ∞-perturbations bounded by . By our reduction , this implies that any detector f with risk at most R ( f ) ≤ α must also have robust risk with detection at least R /2adv-det ( f ) ≥ β against ` ∞-perturbations bounded by /2 . Similar arguments can be applied to show , for instance , that the increased data complexity of robust generalization from Schmidt et al . ( 2018 ) , or the tradeoff between robustness to multiple perturbation types from Tramèr & Boneh ( 2019 ) , also apply to robust detectors . Our reduction does not apply for “ computational ” hardness results that have been shown for robust classification . For example , Garg et al . ( 2020 ) and Bubeck et al . ( 2018 ) show ( “ unnatural ” ) distributions where learning a robust classifier is computationally hard—under standard cryptographic assumptions . We can not use Theorem 4 to conclude that learning a robust detector is hard for these distributions , since the existence of such a detector would only imply an inefficient robust classifier which does not contradict the results of Garg et al . ( 2020 ) or Bubeck et al . ( 2018 ) .

Summary: Adversarial examples are test time attacks in which the input is modified by up to distance \eps (under some metric) and the goal of adversarially robust learning is to have high (generalized) accuracy even under such attacks. One way to make predictions is to always output a label. Another way is to “abstain/detect” when the learner thinks the input is not clean and is perturbed with. The way we evaluate the performance in the detection model is to count detected perturbed inputs as “correctly classified”.  The paper asks a very natural question: is it easier to learn when detection/abstain is allowed or not? The main result of the paper is very clean: For any metric d, and any eps, the existence of a learner that achieves accuracy c under detection model under 2\eps perturbations is (information theoretically) equivalent to the existence of a classifier in the no-detection model with accuracy c and eps perturbation.  The proof is “constructive” but it is not “efficiently constructive”. Namely, given a classifier in either of the two settings above, the paper shows a rather simple (but smart) way of constructing another classifier (with the parameters stated above) in the other model.  The paper then takes this connection to revisit the results of quite a few papers from the literature in which they have claimed defenses that use detection as their key idea. The paper observes that the bounds that (many) of those papers claim would imply classifiers with no detection/abstain that beat the state of the art adversarially robust classifiers. The paper cautiously claims that this indicates that the defenses of those papers are not actually secure, but rather “not broken” under simple attacks tried by the authors.