Research map / Adversarial robustness and security / Certified and empirical robustness
PROSAC: Provably Safe Certification for Machine Learning Models under Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PROSAC, a hypothesis-testing certification framework with GP-UCB Bayesian optimization that certifies (alpha, zeta)-safety of vision models (ViT, ResNet) against adversarial attacks with population-level guarantees over all attacker hyper-parameters.
Problem
Certifying the adversarial robustness of machine learning models with population-level, statistically guaranteed risk bounds that hold for any attacker hyper-parameter configuration, rather than only the empirical risk for one configuration.
Approach
Define (alpha, zeta)-safety via a max adversarial population risk over attacker hyper-parameters, convert it into a hypothesis test whose p-value is the max over hyper-parameters of a Hoeffding-Bentkus p-value, and approximate that max efficiently with GP-UCB Bayesian optimization using a more conservative threshold to keep guarantees.
Key results
- Smaller models showed lower safety than larger ones across ResNet and ViT families, e.g. p*_ResNet18 > p*_ResNet50 > p*_ResNet101 in the reported p-values, indicating larger models are more robust.
- ViT family consistently showed superior adversarial safety compared to ResNet family across attacks.
- On ResNet18 under GenAttack, GP-UCB gave more conservative p-values than grid search after enough iterations (p*_gpu-cb > p*_grid-search).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Increase the attack budget ε | Models under adversarial attacks · ImageNet-1k | adversarial safety | Hurt |
| Use larger models instead of smaller models | ResNet and ViT model families · ImageNet-1k | max adversarial risk p-value | Helped |
| Use ViT instead of ResNet | Supervised vision models · ImageNet-1k | adversarial safety | Helped |
| Add adversarial training | ResNet18, ResNet50, and ViT-Base · ImageNet-1k | adversarial safety | Helped |
| Add adversarial training | ResNet18, ResNet50, and ViT-Base · ImageNet-1k | classification accuracy | Hurt |
| Use white-box instead of black-box attacks | Attacks against the evaluated models · ImageNet-1k | adversarial safety | Hurt |
| Use GP-UCB instead of grid search to estimate the maximum p-value | ResNet18 under GenAttack · ImageNet-1k | estimated maximum p-value | Mixed |
| Use CLIP-ViT instead of a supervised-trained ViT | ViT models · Adversarial robustness | adversarial safety | Hurt |
Surprising findings
- Smaller models exhibited lower safety than larger models, contrary to the authors' initial hypothesis that larger models would be more vulnerable.
- CLIP-ViT models appear more vulnerable to adversarial attacks than supervised ViTs.
Limitations
- Controls only Type-I error; Type-II error not controlled, so the framework can be over-conservative.
- GP-UCB guarantees rely on a more conservative threshold zeta' that only approaches zeta as rounds T grow.
- Experiments limited to image classification on ImageNet-1k with 1,000 calibration images.
Experimental setup
Datasets: ImageNet-1k
Benchmarks: ImageNet-1k
Metrics: adversarial population risk p-value attack success rate ImageNet top-1 accuracy
Baselines: GridSearch
Builds on: Learn-then-Test Hoeffding-Bentkus p-value GP-UCB advertorch
Closest papers by meaning
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.88)
- On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · similarity 0.87)
- Enhancing Adversarial Robustness with Conformal Prediction: A Framework for Guaranteed Model Reliability (ICML 2025 · similarity 0.87)
- Statistical Estimation of Adversarial Risk in Large Language Models under Best-of-N Sampling (NeurIPS 2026 · similarity 0.87)
- Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.87)
- Probably Approximately Global Robustness Certification (ICML 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.