Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing

Abstract

It is well-known that classifiers are vulnerable to adversarial perturbations. To defend against adversarial perturbations, various certified robustness results have been derived. However, existing certified robustnesses are limited to top-1 predictions. In many real-world applications, top-$k$ predictions are more relevant. In this work, we aim to derive certified robustness for top-$k$ predictions. In particular, our certified robustness is based on randomized smoothing, which turns any classifier to a new classifier via adding noise to an input example. We adopt randomized smoothing because it is scalable to large-scale neural networks and applicable to any classifier. We derive a tight robustness in ${\ell }_2$ norm for top-$k$ predictions when using randomized smoothing with Gaussian noise. We find that generalizing the certified robustness from top-1 to top-$k$ predictions faces significant technical challenges. We also empirically evaluate our method on CIFAR10 and ImageNet. For example, our method can obtain an ImageNet classifier with a certified top-5 accuracy of 62.8\% when the ${\ell }_2$-norms of the adversarial perturbations are less than 0.5 (=127/255). Our code is publicly available at: \url{https://github.com/jjy1994/Certify_Topk}.

arXiv commentICLR 2020, code is available at this: https://github.com/jjy1994/Certify_Topk

References in corpus (15)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Evaluating Robustness of Neural Networks with Mixed Integer Programming
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• An approach to reachability analysis for feed-forward ReLU neural networks
• Towards the first adversarially robust neural network model on MNIST
• On Detecting Adversarial Perturbations
• Semidefinite relaxations for certifying robustness to adversarial examples
• Efficient Formal Safety Analysis of Neural Networks
• A Unified View of Piecewise Linear Neural Network Verification
• Provably Minimally-Distorted Adversarial Examples
• Training verified learners with learned verifiers
• Output Range Analysis for Deep Neural Networks
• Provable Robustness of ReLU networks via Maximization of Linear Regions

Cited by in corpus (21)

• On Certifying Robustness against Backdoor Attacks via Randomized Smoothing
• Learning Security Classifiers with Verified Global Robustness Properties
• Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Framework
• Random Smoothing Might be Unable to Certify ${\ell }_{\infty }$ Robustness for High-Dimensional Images
• Backdoor Attacks to Graph Neural Networks
• CIFS: Improving Adversarial Robustness of CNNs via Channel-wise Importance-based Feature Selection
• Efficient Robustness Certificates for Discrete Data: Sparsity-Aware Randomized Smoothing for Graphs, Images and More
• Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferability
• Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothing
• PointGuard: Provably Robust 3D Point Cloud Classification
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations
• Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbation
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• Relaxing Local Robustness
• A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attacks
• 10 Security and Privacy Problems in Large Foundation Models
• Adaptive Image Transformations for Transfer-based Adversarial Attack
• Exploiting the Sensitivity of $L_2$ Adversarial Examples to Erase-and-Restore
• Hidden Cost of Randomized Smoothing
• ε-weakened Robustness of Deep Neural Networks
• Adaptive Perturbation for Adversarial Attack