ADVREPAIR:Provable Repair of Adversarial Attack
Zhiming Chi Jianan Ma Pengfei Yang Cheng-Chao Huang Renjue Li Xiaowei Huang Lijun Zhang
Deep neural networks (DNNs) are increasingly deployed in safety-critical
domains, but their vulnerability to adversarial attacks poses serious safety
risks. Existing neuron-level methods using limited data lack efficacy in fixing
adversaries due to the inherent complexity of adversarial attack mechanisms,
while adversarial training, leveraging a large number of adversarial samples to
enhance robustness, lacks provability. In this paper, we propose ADVREPAIR, a
novel approach for provable repair of adversarial attacks using limited data.
By utilizing formal verification, ADVREPAIR constructs patch modules that, when
integrated with the original network, deliver provable and specialized repairs
within the robustness neighborhood. Additionally, our approach incorporates a
heuristic mechanism for assigning patch modules, allowing this defense against
adversarial attacks to generalize to other inputs. ADVREPAIR demonstrates
superior efficiency, scalability and repair success rate. Different from
existing DNN repair methods, our repair can generalize to general inputs,
thereby improving the robustness of the neural network globally, which
indicates a significant breakthrough in the generalization capability of
ADVREPAIR.