Certified Adversarial Robustness via Randomized Smoothing

By Jeremy M. Cohen, Elan Rosenfeld, J. Kolter. 2019

2,573 citations recorded by the source corpus.

We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the $\ell_2$ norm. This "randomized smoothing" technique has been proposed recently in the literature, but existing guarantees are loose. We prove a tight robustness guarantee in $\ell_2$ norm for smoothing with Gaussian noise. We use randomized smoothing to obtain an ImageNet classifier with e.g. a certified top-1 accuracy of 49% under adversarial perturbations with $\ell_2$ norm less than 0.5 (=127/255). No certified defense has been shown feasible on ImageNet except for smoothing. On smaller-scale datasets where competing approaches to certified $\ell_2$ robustness are viable, smoothing delivers higher certified accuracies. Our strong empirical results suggest that randomized smoothing is a promising direction for future research into adversarially robust classification. Code and models are available at this http URL.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Measuring Robustness to Natural Distribution Shifts in Image Classification (2020, methodology): “[13] Cohen, J.”
Adversarial Examples Are Not Bugs, They Are Features (2019, background): “While there might exist such fundamental barriers to robustly classifying standard datasets, this model cannot fully explain the situation observed in practice, where one can train (reasonably) robust classiﬁers on standard datasets [Mad+18; RSL18; WK18; Xia+19; CRK19].”
Unsolved Problems in ML Safety (2021, background): “Researchers could improve adversarial robustness certifications [144, 116, 37], so that models have verifiable adversarial robustness.”
Privacy Risks of Securing Machine Learning Models against Adversarial Examples (2019, background): “Several recent papers [9, 29] propose to add a noise layer into the model for adversarial robustness.”
Adversarial Training for Free! (2019, background): “Cohen et al. [2019] prove a tight robustness guarantee under the (cid:96) 2 norm for smoothing with Gaussian noise.”
Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness (2019, background): “…even remotely close to being solved (Schott et al., 2019) and researchers working on (provable) robustness to adversarial examples have moved on to other, larger vision datasets such as CIFAR-10 (Madry et al., 2017; Wong et al., 2018) or ImageNet (Lecuyer et al., 2018; Cohen et al., 2019).”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “, 2019a) and certified (Cohen et al., 2019) white-box defenses to ImageNet-scale tasks.”
Theoretical evidence for adversarial robustness through randomization: the case of the Exponential family (2019, background): “Initial results from [24] have been refined in [25], and [9].”
Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims (2020, background): “not generalizing well to unseen data [66] [67] [68]).”
Towards neural networks that provably know when they don't know (2019, positive): “Empirically, adversarial training (Madry et al., 2018) performs well and provably robust models have been developed (Hein & Andriushchenko, 2017; Wong & Kolter, 2018; Raghunathan et al., 2018; Mirman et al., 2018; Cohen et al., 2019).”
Unlabeled Data Improves Adversarial Robustness (2019, methodology): “[9] prove that robustness of f✓ to large random perturbations (the goal of stability training) implies certified `2 adversarial robustness of the smoothed classifier g✓.”
Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers (2019, methodology): “As shown in [6], one can derive certifiable robustness for such smoothed classifiers via the NeymanPearson lemma.”
Fast is better than free: Revisiting adversarial training (2020, background): “have been scaled to reasonably sized networks (Wong et al., 2018; Mirman et al., 2018; Gowal et al., 2018; Cohen et al., 2019; Salman et al., 2019), the guarantees don’t match the empirical robustness obtained through adversarial training.”
Robust fine-tuning of zero-shot models (2021, neutral): “, 2020) or adversarially robust models (Madry et al., 2017; Cohen et al., 2019; Salman et al., 2019; Shafahi et al., 2019).”
Jailbreaking Black Box Large Language Models in Twenty Queries (2023, positive): “Among such schemes, approaches such as randomized smoothing [7, 18, 29], which employ random perturbations to smooth out the boundaries of deep classifiers, have been shown to be effective against adversarial examples.”
Truth or Backpropaganda? An Empirical Investigation of Deep Learning Theory (2019, background): “For example, certifiably robust classifiers may allow users to ensure security against adversarial attacks (Raghunathan et al., 2018; Cohen et al., 2019), and Wasserstein GANs avoid many of the notorious training difficulties of generative adversarial networks (Arjovsky et al.”
Do Adversarially Robust ImageNet Models Transfer Better? (2020, background): “, [Lec+19; Wen+18; WK18; RSL18; CRK19; Sal+19; Yan+20])— significantly increase model resilience to adversarial examples [Big+13; Sze+14].”