🤖 AI Summary
To address the insufficient robustness of preprocessing defenses against white-box PGD attacks, this paper proposes two stochastic discretization defense methods based on high-dimensional vector quantization: pRD and swRD. We are the first to integrate learnable vector quantization into a stochastic discretization framework, enhancing both certified robustness and empirical performance without modifying the original classifier. Our approach provides theoretical guarantees on certified accuracy while supporting end-to-end training and joint fine-tuning with downstream classifiers. On standard benchmarks—including CIFAR-10 and ImageNet—our methods achieve or surpass state-of-the-art (SOTA) performance in both certified accuracy and empirical robustness, significantly outperforming conventional preprocessing defenses. Moreover, they avoid the substantial computational overhead associated with adversarial training.
📝 Abstract
Building upon Randomized Discretization, we develop two novel adversarial defenses against white-box PGD attacks, utilizing vector quantization in higher dimensional spaces. These methods, termed pRD and swRD, not only offer a theoretical guarantee in terms of certified accuracy, they are also shown, via abundant experiments, to perform comparably or even superior to the current art of adversarial defenses. These methods can be extended to a version that allows further training of the target classifier and demonstrates further improved performance.
