REaaS: Enabling Adversarially Robust Downstream Classifiers via Robust Encoder as a Service
REaaS: Enabling Adversarially Robust Downstream Classifiers via Robust Encoder as a Service
复制标题
DOI：
10.48550/arxiv.2301.02905
复制
发表时间：
2023-01
期刊：
影响因子：
--
通讯作者：
Wenjie Qu;Jinyuan Jia;N. Gong
中科院分区：
文献类型：
--
作者：
Wenjie Qu;Jinyuan Jia;N. Gong
编码器即服务是一种新兴的云服务。具体地，服务提供商首先预训练编码器（即，通用特征提取器），然后将其部署为云服务API。当训练/测试其分类器（称为下游分类器）时，客户端查询云服务API以获得用于其训练/测试输入的特征向量。下游分类器容易受到对抗性示例的影响，这些示例是带有精心设计的扰动的测试输入，下游分类器会错误分类。因此，在安全和安全关键应用中，客户端的目标是构建一个强大的下游分类器，并证明其对对抗性示例的鲁棒性保证。云服务应该提供哪些API，以便客户端可以使用任何认证方法来证明其下游分类器对对抗性示例的鲁棒性，同时最大限度地减少对API的查询数量？服务提供商如何预训练编码器，以便客户端可以构建更可靠的下游分类器？我们的目标是回答这两个问题在这项工作中。对于第一个问题，我们表明，云服务只需要提供两个API，我们精心设计，使客户端能够证明其下游分类器的鲁棒性与最少数量的查询API。对于第二个问题，我们证明了使用谱范数正则化项预训练的编码器使客户端能够构建更强大的下游分类器。
Encoder as a service is an emerging cloud service. Specifically, a service provider first pre-trains an encoder (i.e., a general-purpose feature extractor) via either supervised learning or self-supervised learning and then deploys it as a cloud service API. A client queries the cloud service API to obtain feature vectors for its training/testing inputs when training/testing its classifier (called downstream classifier). A downstream classifier is vulnerable to adversarial examples, which are testing inputs with carefully crafted perturbation that the downstream classifier misclassifies. Therefore, in safety and security critical applications, a client aims to build a robust downstream classifier and certify its robustness guarantees against adversarial examples. What APIs should the cloud service provide, such that a client can use any certification method to certify the robustness of its downstream classifier against adversarial examples while minimizing the number of queries to the APIs? How can a service provider pre-train an encoder such that clients can build more certifiably robust downstream classifiers? We aim to answer the two questions in this work. For the first question, we show that the cloud service only needs to provide two APIs, which we carefully design, to enable a client to certify the robustness of its downstream classifier with a minimal number of queries to the APIs. For the second question, we show that an encoder pre-trained using a spectral-norm regularization term enables clients to build more robust downstream classifiers.