Certified Adversarial Robustness via Randomized Smoothing

Abstract

We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the ${\ell }_2$ norm. This "randomized smoothing" technique has been proposed recently in the literature, but existing guarantees are loose. We prove a tight robustness guarantee in ${\ell }_2$ norm for smoothing with Gaussian noise. We use randomized smoothing to obtain an ImageNet classifier with e.g. a certified top-1 accuracy of 49% under adversarial perturbations with ${\ell }_2$ norm less than 0.5 (=127/255). No certified defense has been shown feasible on ImageNet except for smoothing. On smaller-scale datasets where competing approaches to certified ${\ell }_2$ robustness are viable, smoothing delivers higher certified accuracies. Our strong empirical results suggest that randomized smoothing is a promising direction for future research into adversarially robust classification. Code and models are available at http://github.com/locuslab/smoothing.

ICML 2019

Cited by in corpus (257)

• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Fast is better than free: Revisiting adversarial training
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• Hardware and Software Optimizations for Accelerating Deep Neural Networks: Survey of Current Trends, Challenges, and the Road Ahead
• Measuring Robustness to Natural Distribution Shifts in Image Classification
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• The Origins and Prevalence of Texture Bias in Convolutional Neural Networks
• RobustBench: a standardized adversarial robustness benchmark
• The Butterfly Effect in Artificial Intelligence Systems: Implications for AI Bias and Fairness
• A Review of Adversarial Attack and Defense for Classification Methods
• Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• Adversarial Self-Supervised Contrastive Learning
• Stabilizing Differentiable Architecture Search via Perturbation-based Regularization
• A Closer Look at Accuracy vs. Robustness
• Certified Defenses for Adversarial Patches
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• Unlabeled Data Improves Adversarial Robustness
• (De)Randomized Smoothing for Certifiable Defense against Patch Attacks
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• DropMessage: Unifying Random Dropping for Graph Neural Networks
• On the (In)fidelity and Sensitivity for Explanations
• InfoBERT: Improving Robustness of Language Models from An Information Theoretic Perspective
• Security and Privacy Issues in Deep Learning
• On Certifying Robustness against Backdoor Attacks via Randomized Smoothing
• Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
• Adversarial Explanations for Understanding Image Classification Decisions and Improved Neural Network Robustness
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• A survey of algorithmic recourse: definitions, formulations, solutions, and prospects
• Towards Stable and Efficient Training of Verifiably Robust Neural Networks
• Defense Methods Against Adversarial Examples for Recurrent Neural Networks
• Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies
• Are Perceptually-Aligned Gradients a General Property of Robust Classifiers?
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking
• Explicit Regularisation in Gaussian Noise Injections
• On the Loss Landscape of Adversarial Training: Identifying Challenges and How to Overcome Them
• Do Wider Neural Networks Really Help Adversarial Robustness?
• Theoretical evidence for adversarial robustness through randomization
• Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing
• Adversarial purification with Score-based generative models
• Triple Wins: Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inference
• Adversarial Distributional Training for Robust Deep Learning
• Channel-Aware Adversarial Attacks Against Deep Learning-Based Wireless Signal Classifiers
• Defense against Adversarial Attacks in NLP via Dirichlet Neighborhood Ensemble
• Geometry-aware Instance-reweighted Adversarial Training
• HYDRA: Pruning Adversarially Robust Neural Networks
• Randomized Smoothing of All Shapes and Sizes
• Globally-Robust Neural Networks
• Boosting Adversarial Transferability through Enhanced Momentum
• Adversarial Robustness via Fisher-Rao Regularization
• Enhancing the Transferability of Adversarial Attacks through Variance Tuning
• Learning Security Classifiers with Verified Global Robustness Properties
• How does Heterophily Impact the Robustness of Graph Neural Networks? Theoretical Connections and Practical Implications
• On the Resilience of Biometric Authentication Systems against Random Inputs
• RP2K: A Large-Scale Retail Product Dataset for Fine-Grained Image Classification
• Towards Frequency-Based Explanation for Robust CNN
• Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Efficient Certified Defenses Against Patch Attacks on Image Classifiers
• Morphence: Moving Target Defense Against Adversarial Examples
• Boundary thickness and robustness in learning models
• Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attacks
• Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases
• Handcrafted Backdoors in Deep Neural Networks
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• Backdoor Attack through Frequency Domain
• Consistency Regularization for Certified Robustness of Smoothed Classifiers
• If a Human Can See It, So Should Your System: Reliability Requirements for Machine Vision Components
• Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness
• More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models
• Certified Robustness to Label-Flipping Attacks via Randomized Smoothing
• PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier
• Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates
• Adversarial training in communication constrained federated learning
• Percival: Making In-Browser Perceptual Ad Blocking Practical With Deep Learning
• Fairness Through Robustness: Investigating Robustness Disparity in Deep Learning
• Membership Leakage in Label-Only Exposures
• Random Smoothing Might be Unable to Certify ${\ell }_{\infty }$ Robustness for High-Dimensional Images
• ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies
• Exploring Memorization in Adversarial Training
• Poisoned classifiers are not only backdoored, they are fundamentally broken
• VSMask: Defending Against Voice Synthesis Attack via Real-Time Predictive Perturbation
• ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layers
• Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency
• Provably Efficient Black-Box Action Poisoning Attacks Against Reinforcement Learning
• Attacking Adversarial Attacks as A Defense
• A Research Agenda: Dynamic Models to Defend Against Correlated Attacks
• Defending Against Physically Realizable Attacks on Image Classification
• Deep Partition Aggregation: Provable Defense against General Poisoning Attacks
• Backdoor Attacks to Graph Neural Networks
• Bag of Tricks for Adversarial Training
• SoK: Machine Learning Governance
• Adversarial Machine Learning for 5G Communications Security
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• Orthogonalizing Convolutional Layers with the Cayley Transform
• Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance
• Efficient Adversarial Training with Transferable Adversarial Examples
• Adversarial Attacks and Defenses for Speech Recognition Systems
• Calibrated Surrogate Losses for Adversarially Robust Classification
• Adversarial Token Attacks on Vision Transformers
• Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Models
• Adversarial Feature Augmentation and Normalization for Visual Recognition
• Certifying Confidence via Randomized Smoothing
• Adversarial Visual Robustness by Causal Intervention
• Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks
• PRECAD: Privacy-Preserving and Robust Federated Learning via Crypto-Aided Differential Privacy
• Boosting Adversarial Attacks on Neural Networks with Better Optimizer
• Efficient Robustness Certificates for Discrete Data: Sparsity-Aware Randomized Smoothing for Graphs, Images and More
• Certifiably-Robust Federated Adversarial Learning via Randomized Smoothing
• Robust Encodings: A Framework for Combating Adversarial Typos
• Fantastic Four: Differentiable Bounds on Singular Values of Convolution Layers
• Defending against Machine Learning based Inference Attacks via Adversarial Examples: Opportunities and Challenges
• On the Certified Robustness for Ensemble Models and Beyond
• Random Noise Defense Against Query-Based Black-Box Attacks
• Mask-GVAE: Blind Denoising Graphs via Partition
• Quantifying and Improving Transferability in Domain Generalization
• Detection Defense Against Adversarial Attacks with Saliency Map
• Transferred Discrepancy: Quantifying the Difference Between Representations
• Interpretable Graph Capsule Networks for Object Recognition
• Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
• Temporal Shuffling for Defending Deep Action Recognition Models against Adversarial Attacks
• Boosting the Certified Robustness of L-infinity Distance Nets
• Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?
• Fast Certified Robust Training with Short Warmup
• Robust Models Are More Interpretable Because Attributions Look Normal
• Improving Certified Robustness via Statistical Learning with Logical Reasoning
• TSS: Transformation-Specific Smoothing for Robustness Certification
• Evaluating Robustness of Predictive Uncertainty Estimation: Are Dirichlet-based Models Reliable?
• Certified Adversarial Defenses Meet Out-of-Distribution Corruptions: Benchmarking Robustness and Simple Baselines
• Provable Robustness Against a Union of ${\ell }_0$ Adversarial Attacks
• Adversarial robustness via robust low rank representations
• Tailoring: encoding inductive biases by optimizing unsupervised objectives at prediction time
• Towards the Unification and Robustness of Perturbation and Gradient Based Explanations
• On the Sample Complexity of Adversarial Multi-Source PAC Learning
• Higher-Order Certification for Randomized Smoothing
• Enhancing Certified Robustness via Smoothed Weighted Ensembling
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations
• Local Reweighting for Adversarial Training
• Data-Dependent Randomized Smoothing
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• Towards Robust Waveform-Based Acoustic Models
• Understanding Adversarial Examples from the Mutual Influence of Images and Perturbations
• BUZz: BUffer Zones for defending adversarial examples in image classification
• Adversarial Training Helps Transfer Learning via Better Representations
• Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbation
• Improved Autoregressive Modeling with Distribution Smoothing
• Towards Evaluating the Robustness of Neural Networks Learned by Transduction
• Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective
• CROP: Certifying Robust Policies for Reinforcement Learning through Functional Smoothing
• Adversarial Robustness with Non-uniform Perturbations
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• Training Certifiably Robust Neural Networks with Efficient Local Lipschitz Bounds
• DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks
• A PAC-Bayes Analysis of Adversarial Robustness
• Random Transformation of Image Brightness for Adversarial Attack
• Where is the Bottleneck of Adversarial Learning with Unlabeled Data?
• Policy Smoothing for Provably Robust Reinforcement Learning
• Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networks
• Learning Diverse-Structured Networks for Adversarial Robustness
• Statistically Robust Neural Network Classification
• Tight Second-Order Certificates for Randomized Smoothing
• A Game Theoretic Analysis of Additive Adversarial Attacks and Defenses
• Adversarial Robustness of Stabilized NeuralODEs Might be from Obfuscated Gradients
• Certifying Joint Adversarial Robustness for Model Ensembles
• Weight-Covariance Alignment for Adversarially Robust Neural Networks
• Connecting Interpretability and Robustness in Decision Trees through Separation
• Auditing AI models for Verified Deployment under Semantic Specifications
• Analyzing Accuracy Loss in Randomized Smoothing Defenses
• On the Tightness of Semidefinite Relaxations for Certifying Robustness to Adversarial Examples
• A unified view on differential privacy and robustness to adversarial examples
• PreGIP: Watermarking the Pretraining of Graph Neural Networks for Deep Intellectual Property Protection
• Rethinking Image-Scaling Attacks: The Interplay Between Vulnerabilities in Machine Learning Systems
• Selective Ensembles for Consistent Predictions
• Smoothness Analysis of Adversarial Training
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Certifiably Robust Variational Autoencoders
• Asymmetric Heavy Tails and Implicit Bias in Gaussian Noise Injections
• Relaxing Local Robustness
• Towards Adversarial Robustness via Transductive Learning
• Multi-stage Optimization based Adversarial Training
• Adversarial Feature Desensitization
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• Provably Robust Metric Learning
• RoMA: Robust Model Adaptation for Offline Model-based Optimization
• Adversarial Robustness Guarantees for Random Deep Neural Networks
• Towards Deep Learning Models Resistant to Large Perturbations
• Fast Geometric Projections for Local Robustness Certification
• Adversarially Robust Learning with Unknown Perturbation Sets
• Mixed Nash Equilibria in the Adversarial Examples Game
• Perceptually Constrained Adversarial Attacks
• Smoothed Inference for Adversarially-Trained Models
• Provable Robust Classification via Learned Smoothed Densities
• Universal Approximation with Certified Networks
• Understanding and Diagnosing Vulnerability under Adversarial Attacks
• ANCER: Anisotropic Certification via Sample-wise Volume Maximization
• Exploiting the Sensitivity of $L_2$ Adversarial Examples to Erase-and-Restore
• Immuno-mimetic Deep Neural Networks (Immuno-Net)
• Dynamic Defense Approach for Adversarial Robustness in Deep Neural Networks via Stochastic Ensemble Smoothed Model
• Practical Convex Formulation of Robust One-hidden-layer Neural Network Training
• HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attacks
• 10 Security and Privacy Problems in Large Foundation Models
• Provable Robustness of Adversarial Training for Learning Halfspaces with Noise
• Learning Robust Variational Information Bottleneck with Reference
• Building Compact and Robust Deep Neural Networks with Toeplitz Matrices
• Domain Invariant Adversarial Learning
• Network Moments: Extensions and Sparse-Smooth Attacks
• Robust Generalization of Quadratic Neural Networks via Function Identification
• Robust and Information-theoretically Safe Bias Classifier against Adversarial Attacks
• A Multiclass Boosting Framework for Achieving Fast and Provable Adversarial Robustness
• Adversarial Attacks on ML Defense Models Competition
• Adversarial Purification through Representation Disentanglement
• Recent Advances in Large Margin Learning
• Privacy Preserving Recalibration under Domain Shift
• Improving the Certified Robustness of Neural Networks via Consistency Regularization
• Certified Robustness of Graph Classification against Topology Attack with Randomized Smoothing
• Constant Random Perturbations Provide Adversarial Robustness with Minimal Effect on Accuracy
• Adversarial Training with Stochastic Weight Average
• Semantics-Preserving Adversarial Training
• Towards Optimal Randomized Strategies in Adversarial Example Game
• Federated Learning without Revealing the Decision Boundaries
• Constructing a provably adversarially-robust classifier from a high accuracy one
• Hard-label Manifolds: Unexpected Advantages of Query Efficiency for Finding On-manifold Adversarial Examples
• Stochastic-HMDs: Adversarial Resilient Hardware Malware Detectors through Voltage Over-scaling
• Improved Estimation of Concentration Under ${\ell }_p$-Norm Distance Metrics Using Half Spaces
• Improving Zero-Shot Cross-Lingual Transfer Learning via Robust Training
• Training Provably Robust Models by Polyhedral Envelope Regularization
• Adversarial Boot Camp: label free certified robustness in one epoch
• Towards Assessment of Randomized Smoothing Mechanisms for Certifying Adversarial Robustness
• MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks
• Countering Adversarial Examples: Combining Input Transformation and Noisy Training
• Robustifying ${\ell }_{\infty }$ Adversarial Training to the Union of Perturbation Models
• Leave-one-out Unfairness
• Deep Adversarially-Enhanced k-Nearest Neighbors
• Identifying and Exploiting Structures for Reliable Deep Learning
• When Should You Defend Your Classifier -- A Game-theoretical Analysis of Countermeasures against Adversarial Examples
• Improving Adversarial Robustness for Free with Snapshot Ensemble
• Calibrated Adversarial Training
• Adaptive Perturbation for Adversarial Attack
• Simpler Certified Radius Maximization by Propagating Covariances
• Intriguing Properties of Input-dependent Randomized Smoothing
• ε-weakened Robustness of Deep Neural Networks
• Affine-Invariant Robust Training
• Training Efficiency and Robustness in Deep Learning
• Boosting Certified Robustness for Time Series Classification with Efficient Self-Ensemble
• Towards Robustness against Unsuspicious Adversarial Examples
• Combining Diverse Feature Priors
• Luring of transferable adversarial perturbations in the black-box paradigm
• Defense-friendly Images in Adversarial Attacks: Dataset and Metrics for Perturbation Difficulty
• Extreme Value Preserving Networks
• Deterministic Certification to Adversarial Attacks via Bernstein Polynomial Approximation
• Learning to Separate Clusters of Adversarial Representations for Robust Adversarial Detection
• Adaptive Verifiable Training Using Pairwise Class Similarity
• Certified Robustness to Programmable Transformations in LSTMs
• Adversarial Machine Learning in Text Analysis and Generation