Abstract
Security-critical machine-learning (ML) systems, such as face-recognition systems, are susceptible to adversarial examples, including real-world physically realizable attacks. Various means to boost ML's adversarial robustness have been proposed; however, they typically induce unfair robustness: It is often easier to attack from certain classes or groups than from others. Several techniques have been developed to improve adversarial robustness while seeking perfect fairness between classes. Yet, prior work has focused on settings where security and fairness are less critical. Our insight is that achieving perfect parity in realistic fairness-critical tasks, such as face recognition, is often infeasible -- some classes may be highly similar, leading to more misclassifications between them. Instead, we suggest that seeking symmetry -- i.e., attacks from class $i$ to $j$ would be as successful as from $j$ to $i$ -- is more tractable. Intuitively, symmetry is a desirable because class resemblance is a symmetric relation in most domains. Additionally, as we prove theoretically, symmetry between individuals induces symmetry between any set of sub-groups, in contrast to other fairness notions where group-fairness is often elusive. We develop Sy-FAR, a technique to encourage symmetry while also optimizing adversarial robustness and extensively evaluate it using five datasets, with three model architectures, including against targeted and untargeted realistic attacks. The results show Sy-FAR significantly improves fair adversarial robustness compared to state-of-the-art methods. Moreover, we find that Sy-FAR is faster and more consistent across runs. Notably, Sy-FAR also ameliorates another type of unfairness we discover in this work -- target classes that adversarial examples are likely to be classified into become significantly less vulnerable after inducing symmetry.
Abstract (translated)
关键安全的机器学习（ML）系统，如面部识别系统，容易受到对抗性样本的影响，包括现实世界中可实现的实际攻击。已经提出了各种方法来增强ML系统的对抗鲁棒性；然而，它们通常会产生不公平的稳健性：从某些类或群体发起攻击往往比从其他类或群体更容易。为提高对抗鲁棒性同时寻求不同类别间的完美公平性，开发了几种技术。然而，先前的研究主要集中在安全和公平性相对不重要的场景中。 我们的见解是，在如面部识别等现实中的关键任务上实现完美的公平性往往是不可行的——某些类可能非常相似，导致它们之间更容易发生误分类。相反，我们建议寻求对称性——即从类别i到j发起的攻击与从类别j到i发起的成功程度相同——是更可行的目标。直观地说，对称性是可取的，因为在大多数领域中，类别之间的类似性是对称的关系。 此外，我们理论证明，在个体之间诱导出的对称性会导致任何子组集合之间的对称性，这与公平性的其他概念不同，后者往往难以实现群体间的公平性。为此，我们开发了一种名为Sy-FAR的技术，旨在促进这种对称性的同时优化对抗鲁棒性，并通过使用五个数据集和三种模型架构（包括针对目标攻击和非目标实际攻击）进行了广泛的评估。 实验结果显示，与现有的最先进的方法相比，Sy-FAR显著提高了公平的对抗鲁棒性。此外，我们发现Sy-FAR运行速度更快且结果更一致。值得注意的是，Sy-FAR还改善了我们在工作中发现的一种不公平现象——被分类为某些目标类别的对抗样本，在诱导对称性后变得明显不那么脆弱。
URL
https://arxiv.org/abs/2509.12939
