A unified Bayesian framework for adversarial robustness
Pablo G. Arce, Roi Naveiro, David Ríos Insua
TL;DR
The paper presents a statistically principled fully Bayesian framework for adversarial robustness by modeling adversarial perturbations as a stochastic channel that links clean inputs to attacked ones. It derives two complementary defenses: a reactive defense that performs robust inference at deployment and a proactive defense that optimizes a robust posterior during training; both strategies generalize and subsume established defenses such as adversarial training and randomized smoothing. Empirical results on classification and regression show that explicitly modeling adversarial uncertainty improves predictive accuracy and calibration under attack, and that diverse or learned adversarial channels can enhance robustness beyond fixed threat models. The framework provides a flexible, uncertainty-aware foundation for robust Bayesian prediction with practical training strategies and directions toward robust decision-making in high-stakes settings.
Abstract
The vulnerability of machine learning models to adversarial attacks remains a critical security challenge. Traditional defenses, such as adversarial training, typically robustify models by minimizing a worst-case loss. However, these deterministic approaches do not account for uncertainty in the adversary's attack. While stochastic defenses placing a probability distribution on the adversary exist, they often lack statistical rigor and fail to make explicit their underlying assumptions. To resolve these issues, we introduce a formal Bayesian framework that models adversarial uncertainty through a stochastic channel, articulating all probabilistic assumptions. This yields two robustification strategies: a proactive defense enacted during training, aligned with adversarial training, and a reactive defense enacted during operations, aligned with adversarial purification. Several previous defenses can be recovered as limiting cases of our model. We empirically validate our methodology, showcasing the benefits of explicitly modeling adversarial uncertainty.