Consider patch attacks, where at test-time an adversary manipulates a test image with a patch in order to induce a targeted misclassification. We consider a recent defense to patch attacks, Patch-Cleanser (Xiang et al. [2022]). The Patch-Cleanser algorithm requires a prediction model to have a ``two-mask correctness'' property, meaning that the prediction model should correctly classify any image when any two blank masks replace portions of the image. Xiang et al. learn a prediction model to be robust to two-mask operations by augmenting the training set with pairs of masks at random locations of training images and performing empirical risk minimization (ERM) on the augmented dataset. However, in the non-realizable setting when no predictor is perfectly correct on all two-mask operations on all images, we exhibit an example where ERM fails. To overcome this challenge, we propose a different algorithm that provably learns a predictor robust to all two-mask operations using an ERM oracle, based on prior work by Feige et al. [2015]. We also extend this result to a multiple-group setting, where we can learn a predictor that achieves low robust loss on all groups simultaneously.

翻译：考虑局部补丁攻击场景：测试阶段的攻击者通过在图像中添加补丁区域来诱导目标分类错误。我们针对近期提出的防御方法Patch-Cleanser（Xiang等，2022）展开研究。该算法要求预测模型具备"双掩码正确性"属性，即当任意两个空白掩码替换图像局部区域时，模型仍能正确分类任意图像。Xiang等人通过向训练数据中随机位置添加成对掩码进行数据增强，并基于增强数据集执行经验风险最小化（ERM）来训练模型对双掩码操作保持鲁棒。然而，在非可实现场景（即不存在可在所有图像的成对掩码操作中均保持完全正确的预测器）中，我们证明了ERM策略的失效案例。为解决该问题，我们基于Feige等（2015）的先前工作，提出一种可证明使用ERM预言机学习对全部成对掩码操作具有鲁棒性的预测器的新型算法。进一步将该结果扩展至多组场景，实现同时对所有组别保持低鲁棒损失的预测器学习。