Several recent works have developed methods for training classifiers that are certifiably robust against norm-bounded adversarial perturbations. These methods assume that all the adversarial transformations are equally important, which is seldom the case in real-world applications. We advocate for cost-sensitive robustness as the criteria for measuring the classifier's performance for tasks where some adversarial transformation are more important than others. We encode the potential harm of each adversarial transformation in a cost matrix, and propose a general objective function to adapt the robust training method of Wong & Kolter (2018) to optimize for cost-sensitive robustness. Our experiments on simple MNIST and CIFAR10 models with a variety of cost matrices show that the proposed approach can produce models with substantially reduced cost-sensitive robust error, while maintaining classification accuracy. Despite the exceptional performance of deep neural networks (DNNs) on various machine learning tasks such as malware detection BID24 , face recognition BID22 and autonomous driving BID2 , recent studies BID26 BID9 have shown that deep learning models are vulnerable to misclassifying inputs, known as adversarial examples, that are crafted with targeted but visually-imperceptible perturbations. While several defense mechanisms have been proposed and empirically demonstrated to be successful against existing particular attacks BID21 BID9 , new attacks BID3 BID27 BID1 are repeatedly found that circumvent such defenses. To end this arm race, recent works BID23 BID28 propose methods to certify examples to be robust against some specific norm-bounded adversarial perturbations for given inputs and to train models to optimize for certifiable robustness.However, all of the aforementioned methods aim at improving the overall robustness of the classifier. This means that the methods to improve robustness are designed to prevent seed examples in any class from being misclassified as any other class. Achieving such a goal (at least for some definitions of adversarial robustness) requires producing a perfect classifier, and has, unsurprisingly, remained elusive. Indeed, BID20 proved that if the metric probability space is concentrated, overall adversarial robustness is unattainable for any classifier with initial constant error.We argue that overall robustness may not be the appropriate criteria for measuring system performance in security-sensitive applications, since only certain kinds of adversarial misclassifications pose meaningful threats that provide value for potential adversaries. Whereas overall robustness places equal emphasis on every adversarial transformation, from a security perspective, only certain transformations matter. As a simple example, misclassifying a malicious program as benign results in more severe consequences than the reverse.In this paper, we propose a general method for adapting provable defenses against norm-bounded perturbations to take into account the potential harm of different adversarial class transformations. Inspired by cost-sensitive learning BID5 BID7 ) for non-adversarial contexts, we capture the impact of different adversarial class transformations using a cost matrix C, where each entry represents the cost of an adversary being able to take a natural example from the first class and perturb it so as to be misclassified by the model as the second class. Instead of reducing the overall robust error, our goal is to minimize the cost-weighted robust error (which we define for both binary and real-valued costs in C). The proposed method incorporates the specified cost matrix into the training objective function, which encourages stronger robustness guarantees on cost-sensitive class transformations, while maintaining the overall classification accuracy on the original inputs.Contributions. By encoding the consequences of different adversarial transformations into a cost matrix, we introduce the notion of cost-sensitive robustness (Section 3.1) as a metric to assess the expected performance of a classifier when facing adversarial examples. We propose an objective function for training a cost-sensitive robust classifier (Section 3.2). The proposed method is general in that it can incorporate any type of cost matrix, including both binary and real-valued. We demonstrate the effectiveness of the proposed cost-sensitive defense model for a variety of cost scenarios on two benchmark image classification datasets: MNIST (Section 4.1) and CIFAR10 (Section 4.2). Compared with the state-of-the-art overall robust defense model , our model achieves significant improvements in cost-sensitive robustness for different tasks, while maintaining approximately the same classification accuracy on both datasets.Notation. We use lower-case boldface letters such as x for vectors and capital boldface letters such as A to represent matrices. Let [m] be the index set {1, 2, . . . , m} and A ij be the (i, j)-th entry of matrix A. Denote the i-th natural basis vector, the all-ones vector and the identity matrix by e i , 1 and I respectively. For any vector x ∈ R d , the ∞ -norm of x is defined as DISPLAYFORM0 By focusing on overall robustness, previous robustness training methods expend a large fraction of the capacity of the network on unimportant transformations. We argue that for most scenarios, the actual harm caused by an adversarial transformation often varies depending on the seed and target class, so robust training methods should be designed to account for these differences. By incorporating a cost matrix into the training objective, we develop a general method for producing a cost-sensitive robust classifier. Our experimental results show that our cost-sensitive training method works across a variety of different types of cost matrices, so we believe it can be generalized to other cost matrix scenarios that would be found in realistic applications.There remains a large gap between the small models and limited attacker capabilities for which we can achieve certifiable robustness, and the complex models and unconstrained attacks that may be important in practice. The scalability of our techniques is limited to the toy models and simple attack norms for which certifiable robustness is currently feasible, so considerable process is needed before they could be applied to realistic scenarios. However, we hope that considering cost-sensitive robustness instead of overall robustness is a step towards achieving more realistic robustness goals.
A general method for training certified cost-sensitive robust classifier against adversarial perturbations Calculates and plugs in the costs of adversarial attack into the objective of optimization to get a model that is cost-sensitively robust against adversarial attacks.  Build on semnial work by Dalvi et al. and extends approach to certifiable robustness with a cost matrix that specifies for each pair of source-target classes whether the model should be robust to adversarial examples.