Many defenses against adversarial attacks (\eg robust classifiers, randomization, or image purification) use countermeasures put to work only after the attack has been crafted. We adopt a different perspective to introduce $A^5$ (Adversarial Augmentation Against Adversarial Attacks), a novel framework including the first certified preemptive defense against adversarial attacks. The main idea is to craft a defensive perturbation to guarantee that any attack (up to a given magnitude) towards the input in hand will fail. To this aim, we leverage existing automatic perturbation analysis tools for neural networks. We study the conditions to apply $A^5$ effectively, analyze the importance of the robustness of the to-be-defended classifier, and inspect the appearance of the robustified images. We show effective on-the-fly defensive augmentation with a robustifier network that ignores the ground truth label, and demonstrate the benefits of robustifier and classifier co-training. In our tests, $A^5$ consistently beats state of the art certified defenses on MNIST, CIFAR10, FashionMNIST and Tinyimagenet. We also show how to apply $A^5$ to create certifiably robust physical objects. Our code at https://github.com/NVlabs/A5 allows experimenting on a wide range of scenarios beyond the man-in-the-middle attack tested here, including the case of physical attacks.

翻译：许多针对对抗性攻击的防御手段（例如鲁棒分类器、随机化或图像净化）仅在攻击被构造后才采取对策。我们采用不同的视角，提出了$A^5$（针对对抗性攻击的对抗性增强），这是一个新颖的框架，包含了首个经认证的对抗性攻击先发制人防御机制。核心思想是构造一种防御性扰动，确保针对当前输入的任何攻击（幅度不超过给定值）都将失败。为此，我们利用了现有的神经网络自动扰动分析工具。我们研究了有效应用$A^5$的条件，分析了待防御分类器鲁棒性的重要性，并检查了鲁棒化图像的外观。我们展示了利用忽略真实标签的鲁棒化网络进行高效的实时防御增强，并证明了鲁棒化器与分类器联合训练的优势。在实验中，$A^5$在MNIST、CIFAR10、FashionMNIST和Tinyimagenet数据集上持续击败了最先进的经认证防御方法。我们还展示了如何应用$A^5$创建经认证的物理鲁棒物体。我们的代码位于https://github.com/NVlabs/A5，允许在比测试中的中间人攻击更广泛的场景中进行实验，包括物理攻击的情况。