Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Framework

Abstract

Randomized classifiers have been shown to provide a promising approach for achieving certified robustness against adversarial attacks in deep learning. However, most existing methods only leverage Gaussian smoothing noise and only work for ${\ell }_2$ perturbation. We propose a general framework of adversarial certification with non-Gaussian noise and for more general types of attacks, from a unified functional optimization perspective. Our new framework allows us to identify a key trade-off between accuracy and robustness via designing smoothing distributions, helping to design new families of non-Gaussian smoothing distributions that work more efficiently for different ${\ell }_p$ settings, including ${\ell }_1$, ${\ell }_2$ and ${\ell }_{\infty }$ attacks. Our proposed methods achieve better certification results than previous works and provide a new perspective on randomized smoothing certification.

arXiv commentAccepted by NeurIPS 2020

References in corpus (12)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Efficient Neural Network Robustness Certification with General Activation Functions
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Semidefinite relaxations for certifying robustness to adversarial examples
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• Provably Minimally-Distorted Adversarial Examples
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness
• Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing
• Randomized Smoothing of All Shapes and Sizes
• Provable Certificates for Adversarial Examples: Fitting a Ball in the Union of Polytopes
• Random Smoothing Might be Unable to Certify ${\ell }_{\infty }$ Robustness for High-Dimensional Images

Cited by in corpus (8)

• Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness
• SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions
• On the Certified Robustness for Ensemble Models and Beyond
• TSS: Transformation-Specific Smoothing for Robustness Certification
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations
• Enhancing Certified Robustness via Smoothed Weighted Ensembling
• NLP Verification: Towards a General Methodology for Certifying Robustness
• Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neurons