Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy

• URL: http://arxiv.org/abs/2605.21780v1
• Date: Wed, 20 May 2026 22:17:29 GMT
• Title: Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy
• Abstract summary: Randomized smoothing is a powerful tool for certifying robustness to adversarial perturbations.<n>We propose a framework for certification of complex, composed mechanisms.<n>We provide a principled and general framework for using composite mechanisms to certify robustness under complex threat models.
• Score: 51.758416625168
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: Randomized smoothing is a powerful tool for certifying robustness to adversarial perturbations, including poisoning attacks via randomized training and evasion attacks via randomized inference. Extending these guarantees to backdoor attacks, where training and test data are jointly perturbed, remains challenging because training- and test-time randomized mechanisms must be analyzed within a single robustness certificate. We address this by connecting randomized smoothing to the dual view of differential privacy through privacy profiles, which provide a numerical procedure for composing heterogeneous mechanisms. The resulting framework enables tight, modular, end-to-end certification of complex, composed mechanisms while leveraging existing analyses of differentially private mechanisms. We instantiate the framework for DP-SGD and Deep Partition Aggregation with inference-time smoothing, deriving joint robustness guarantees against both training-time and inference-time attacks. Experiments on MNIST and CIFAR-10 demonstrate the effectiveness of our framework. Overall, we provide a principled and general framework for using composite mechanisms to certify robustness under complex threat models that better capture the capabilities of real-world adversaries.

Related papers

• Privacy-Preserving and Verifiable Approximate Distributed Coded Computing [2.0415910628419063]
  We present a model-agnostic framework for adversary-resistant distributed learning.<n>Our approach combines paradigm-specific defense mechanisms with GPBACC, a privacy-enhancing coded computing technique.<n>We empirically demonstrate that the combination of GPBACC with robust aggregation and verification mechanisms significantly reduces privacy leakage.
  arXiv  Detail & Related papers  (2026-07-02T13:57:32Z)
• CEAR: Certified Ensemble Adversarial Robustness in DNNs [1.5492759608308866]
  State-of-the-art empirical defense mechanisms improve the robustness of Deep Neural Networks through the training phase.<n> certified defenses offer provable guarantees of robustness within a specified perturbation bound.<n>We propose CEAR, an ensemble-based robust method that utilizes a hybrid of empirical and certified defense mechanisms.
  arXiv  Detail & Related papers  (2026-05-31T20:17:13Z)
• Quantifiable Uncertainty: A Stochastic Consensus Multi-Agent RAG Framework for Robust Malware Detection [1.2183405753834562]
  We present MAGMA, a framework that decouples malware analysis into semantic code retrieval and probabilistic verification.<n>We show that MAGMA achieves a 98.4% detection rate, substantially exceeding existing solutions.
  arXiv  Detail & Related papers  (2026-05-08T18:46:24Z)
• Multimodal Learning on Low-Quality Data with Conformal Predictive Self-Calibration [72.0672328514289]
  Multimodal learning often grapples with the challenge of low-quality data.<n>We propose a unified framework, termed Conformal Predictive Self-Calibration.<n>Our framework consistently outperforms existing state-of-the-art methods.
  arXiv  Detail & Related papers  (2026-05-05T14:48:52Z)
• GuardFed: A Trustworthy Federated Learning Framework Against Dual-Facet Attacks [56.983319121358555]
  Federated learning (FL) enables privacy-preserving collaborative model training but remains vulnerable to adversarial behaviors.<n>We introduce the Dual-Facet Attack (DFA), a novel threat model that concurrently undermines predictive accuracy and group fairness.<n>We propose GuardFed, a self-adaptive defense framework that maintains a fairness-aware reference model using a small amount of clean server data.
  arXiv  Detail & Related papers  (2025-11-12T13:02:45Z)
• Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification [31.38942054994932]
  Federated Learning (FL) systems are susceptible to adversarial attacks.<n>RedJasper is a two-staged anomaly detection method specifically designed for real-world FL deployments.<n>It identifies suspicious activities in the first stage, then activates the second stage conditionally to further scrutinize the suspicious local models.
  arXiv  Detail & Related papers  (2023-10-06T07:09:05Z)
• Augment then Smooth: Reconciling Differential Privacy with Certified Robustness [32.49465965847842]
  We show that standard differentially private model training is insufficient for providing strong certified robustness guarantees.<n>We present DP-CERT, a simple and effective method that achieves both privacy and robustness guarantees simultaneously.
  arXiv  Detail & Related papers  (2023-06-14T17:52:02Z)
• Combating Exacerbated Heterogeneity for Robust Models in Federated Learning [91.88122934924435]
  Combination of adversarial training and federated learning can lead to the undesired robustness deterioration. We propose a novel framework called Slack Federated Adversarial Training (SFAT) We verify the rationality and effectiveness of SFAT on various benchmarked and real-world datasets.
  arXiv  Detail & Related papers  (2023-03-01T06:16:15Z)
• FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learning [66.56240101249803]
  We study how hardening benign clients can affect the global model (and the malicious clients) We propose a trigger reverse engineering based defense and show that our method can achieve improvement with guarantee robustness. Our results on eight competing SOTA defense methods show the empirical superiority of our method on both single-shot and continuous FL backdoor attacks.
  arXiv  Detail & Related papers  (2022-10-23T22:24:03Z)
• Certifiably-Robust Federated Adversarial Learning via Randomized Smoothing [16.528628447356496]
  In this paper, we incorporate smoothing techniques into federated adversarial training to enable data-private distributed learning. Our experiments show that such an advanced federated adversarial learning framework can deliver models as robust as those trained by the centralized training.
  arXiv  Detail & Related papers  (2021-03-30T02:19:45Z)
• Trust but Verify: Assigning Prediction Credibility by Counterfactual Constrained Learning [123.3472310767721]
  Prediction credibility measures are fundamental in statistics and machine learning. These measures should account for the wide variety of models used in practice. The framework developed in this work expresses the credibility as a risk-fit trade-off.
  arXiv  Detail & Related papers  (2020-11-24T19:52:38Z)
• Towards Robust Deep Learning with Ensemble Networks and Noisy Layers [2.2843885788439793]
  We provide an approach for deep learning that protects against adversarial examples in image classification-type networks. The approach relies on two mechanisms:1) a mechanism that increases robustness at the expense of accuracy, and, 2) a mechanism that improves accuracy but does not always increase robustness.
  arXiv  Detail & Related papers  (2020-07-03T06:04:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.