Research Seminar by Yuan Hong | Certifying Trustworthy Machine Learning: From Defenses to Attacks

Certifying Trustworthy Machine Learning: From Defenses to Attacks

In the past decade, adversarial attacks and defenses have been extensively studied to expose vulnerabilities and develop countermeasures for enhancing the robustness of machine learning models. This talk will present our recent advances in certifying both defenses and attacks, with a focus on moving from empirical approaches to provable guarantees. First, we will introduce Text-CRS, the first generalized certified robustness framework for language models against a wide range of word-level adversarial operations, including synonym substitution, word reordering, insertion, and deletion. By leveraging randomized smoothing in both permutation and embedding spaces, Text-CRS improves certified accuracy and robustness. Second, we will shift focus to the attack side by introducing certifiable black-box adversarial attacks. While certified defenses have been well studied, this is the first attack framework that provides provable guarantees for the attack success probability (ASP). It reveals critical weaknesses in machine learning models, even those protected by state-of-the-art defenses. Our attack framework constructs a continuous space of adversarial examples with lower-bounded (high) ASP. Finally, we will discuss the certification in other areas of trustworthy machine learning.

About the Speaker