Author name cluster

Marc Fischer

Possible papers associated with this exact author name in Arrow. This page groups case-insensitive exact name matches and is not a full identity disambiguation profile.

9 papers

1 author row

TMLR Journal 2025 Journal Article

Gaussian Loss Smoothing Enables Certified Training with Tight Convex Relaxations

Stefan Balauca
Mark Niklas Mueller
Yuhao Mao
Maximilian Baader
Marc Fischer
Martin Vechev

Training neural networks with high certified accuracy against adversarial examples remains an open challenge despite significant efforts. While certification methods can effectively leverage tight convex relaxations for bound computation, in training, these methods, perhaps surprisingly, can perform worse than looser relaxations. Prior work hypothesized that this phenomenon is caused by the discontinuity, non-smoothness, and perturbation sensitivity of the loss surface induced by tighter relaxations. In this work, we theoretically show that Gaussian Loss Smoothing (GLS) can alleviate these issues. We confirm this empirically by instantiating GLS with two variants: a zeroth-order optimization algorithm, called PGPE, which allows training with non-differentiable relaxations, and a first-order optimization algorithm, called RGS, which requires gradients of the relaxation but is much more efficient than PGPE. Extensive experiments show that when combined with tight relaxations, these methods surpass state-of-the-art methods when training on the same network architecture for many settings. Our results clearly demonstrate the promise of Gaussian Loss Smoothing for training certifiably robust neural networks and pave a path towards leveraging tighter relaxations for certified training.

PDF Details

ISIPTA Conference 2025 Conference Paper

Precise and imprecise Bayesianism applied to gas-solid reactions

Marc Fischer
Lo\"\ic Favergeon

Gas–solid reactions play a crucial role in sustainability, yet very few studies have focused on the uncertainty of their chemical kinetic parameters and its propagation. In this pioneering work, based on a numerically generated synthetic dataset of conversion profiles, we address the uncertainty arising from variations in powder particle size between any two small powder samples, which impacts experimental conversion profiles. This variation is assumed to follow a log-normal distribution and is propagated into the uncertainty of the activation energy, which subsequently affects the uncertainty of the delay time at which the chemical conversion reaches a desired value under other conditions. Both precise and imprecise Bayesian approaches were compared. The results indicate that precise Bayesian methods struggle to differentiate effectively between varying levels of knowledge. In contrast, the imprecise Bayesian method based on a set of truncated normal distributions proved efficient and significantly more useful than the one based on uniform priors for this purpose. Finally, we provide suggestions on how to apply this methodology to more realistic settings.

PDF Details

ISIPTA Conference 2025 Conference Paper

Time-slice Bayesianism as a potential solution to the problem of dilation and reflection for imprecise probabilities

Marc Fischer

One of the main objections against an imprecise probabilistic framework is the apparent absurdity of dilation when seemingly irrelevant evidence makes your belief in a proposition much less certain than it intuitively ought to be. In this work, after critically analysing an argument by White and refined by Topey, as well as responses by imprecise probabilists, I argue that one way to greatly alleviate the tension this type of case poses is to adopt a form of ’time-slice’ Bayesianism. In the form I envision it, it means that our degrees of belief in A at time $t_i$ are no longer ontologically defined as the result of updating our degrees of belief at time $t_i-1$ with the evidence $E_i-1, i$ we obtained in between, but as a function of our total evidence available at time $t_i$ and a fundamental prior set of credences. I explain why this move, which forces us to regard all probabilities as conditional probabilities outside time, greatly diminishes the intuitive appeal of dilation-based counterexamples to the soundness of imprecise Bayesianism.

PDF Details

NeurIPS Conference 2024 Conference Paper

AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents

Edoardo Debenedetti
Jie Zhang
Mislav Balunovic
Luca Beurer-Kellner
Marc Fischer
Florian Tramèr

AI agents aim to solve complex tasks by combining text-based reasoning with external tool calls. Unfortunately, AI agents are vulnerable to prompt injection attacks where data returned by external tools hijacks the agent to execute malicious tasks. To measure the adversarial robustness of AI agents, we introduce AgentDojo, an evaluation framework for agents that execute tools over untrusted data. To capture the evolving nature of attacks and defenses, AgentDojo is not a static test suite, but rather an extensible environment for designing and evaluating new agent tasks, defenses, and adaptive attacks. We populate the environment with 97 realistic tasks (e. g. , managing an email client, navigating an e-banking website, or making travel bookings), 629 security test cases, and various attack and defense paradigms from the literature. We find that AgentDojo poses a challenge for both attacks and defenses: state-of-the-art LLMs fail at many tasks (even in the absence of attacks), and existing prompt injection attacks break some security properties but not all. We hope that AgentDojo can foster research on new design principles for AI agents that solve common tasks in a reliable and robust manner.

PDF Details DOI

NeurIPS Conference 2023 Conference Paper

Automated Classification of Model Errors on ImageNet

Momchil Peychev
Mark Müller
Marc Fischer
Martin Vechev

While the ImageNet dataset has been driving computer vision research over the past decade, significant label noise and ambiguity have made top-1 accuracy an insufficient measure of further progress. To address this, new label-sets and evaluation protocols have been proposed for ImageNet showing that state-of-the-art models already achieve over 95% accuracy and shifting the focus on investigating why the remaining errors persist. Recent work in this direction employed a panel of experts to manually categorize all remaining classification errors for two selected models. However, this process is time-consuming, prone to inconsistencies, and requires trained experts, making it unsuitable for regular model evaluation thus limiting its utility. To overcome these limitations, we propose the first automated error classification framework, a valuable tool to study how modeling choices affect error distributions. We use our framework to comprehensively evaluate the error distribution of over 900 models. Perhaps surprisingly, we find that across model architectures, scales, and pre-training corpora, top-1 accuracy is a strong predictor for the portion of all error types. In particular, we observe that the portion of severe errors drops significantly with top-1 accuracy indicating that, while it underreports a model's true performance, it remains a valuable performance metric. We release all our code at https: //github. com/eth-sri/automated-error-analysis.

PDF Details

NeurIPS Conference 2023 Conference Paper

Connecting Certified and Adversarial Training

Yuhao Mao
Mark Müller
Marc Fischer
Martin Vechev

Training certifiably robust neural networks remains a notoriously hard problem. While adversarial training optimizes under-approximations of the worst-case loss, which leads to insufficient regularization for certification, sound certified training methods, optimize loose over-approximations, leading to over-regularization and poor (standard) accuracy. In this work, we propose TAPS, an (unsound) certified training method that combines IBP and PGD training to optimize more precise, although not necessarily sound, worst-case loss approximations, reducing over-regularization and increasing certified and standard accuracies. Empirically, TAPS achieves a new state-of-the-art in many settings, e. g. , reaching a certified accuracy of $22$% on TinyImageNet for $\ell_\infty$-perturbations with radius $\epsilon=1/255$. We make our implementation and networks public at https: //github. com/eth-sri/taps.

PDF Details

NeurIPS Conference 2022 Conference Paper

(De-)Randomized Smoothing for Decision Stump Ensembles

Miklós Horváth
Mark Müller
Marc Fischer
Martin Vechev

Tree-based models are used in many high-stakes application domains such as ﬁnance and medicine, where robustness and interpretability are of utmost importance. Yet, methods for improving and certifying their robustness are severely under-explored, in contrast to those focusing on neural networks. Targeting this important challenge, we propose deterministic smoothing for decision stump ensembles. Whereas most prior work on randomized smoothing focuses on evaluating arbitrary base models approximately under input randomization, the key insight of our work is that decision stump ensembles enable exact yet efﬁcient evaluation via dynamic programming. Importantly, we obtain deterministic robustness certiﬁcates, even jointly over numerical and categorical features, a setting ubiquitous in the real world. Further, we derive an MLE-optimal training method for smoothed decision stumps under randomization and propose two boosting approaches to improve their provable robustness. An extensive experimental evaluation on computer vision and tabular data tasks shows that our approach yields signiﬁcantly higher certiﬁed accuracies than the state-of-the-art for tree-based models. We release all code and trained models at https: //github. com/eth-sri/drs.

PDF Details

NeurIPS Conference 2020 Conference Paper

Certified Defense to Image Transformations via Randomized Smoothing

Marc Fischer
Maximilian Baader
Martin Vechev

We extend randomized smoothing to cover parameterized transformations (e. g. , rotations, translations) and certify robustness in the parameter space (e. g. , rotation angle). This is particularly challenging as interpolation and rounding effects mean that image transformations do not compose, in turn preventing direct certification of the perturbed image (unlike certification with $\ell^p$ norms). We address this challenge by introducing three different defenses, each with a different guarantee (heuristic, distributional and individual) stemming from the method used to bound the interpolation error. Importantly, in the individual case, we show how to efficiently compute the inverse of an image transformation, enabling us to provide individual guarantees in the online setting. We provide an implementation of all methods at https: //github. com/eth-sri/transformation-smoothing.

PDF Details

NeurIPS Conference 2020 Conference Paper

Learning Certified Individually Fair Representations

Anian Ruoss
Mislav Balunovic
Marc Fischer
Martin Vechev

Fair representation learning provides an effective way of enforcing fairness constraints without compromising utility for downstream users. A desirable family of such fairness constraints, each requiring similar treatment for similar individuals, is known as individual fairness. In this work, we introduce the first method that enables data consumers to obtain certificates of individual fairness for existing and new data points. The key idea is to map similar individuals to close latent representations and leverage this latent proximity to certify individual fairness. That is, our method enables the data producer to learn and certify a representation where for a data point all similar individuals are at l-infinity distance at most epsilon, thus allowing data consumers to certify individual fairness by proving epsilon-robustness of their classifier. Our experimental evaluation on five real-world datasets and several fairness constraints demonstrates the expressivity and scalability of our approach.

PDF Details