TSS: Transformation-Specific Smoothing for Robustness Certification

Abstract

As machine learning (ML) systems become pervasive, safeguarding their security is critical. However, recently it has been demonstrated that motivated adversaries are able to mislead ML systems by perturbing test data using semantic transformations. While there exists a rich body of research providing provable robustness guarantees for ML models against ${\ell }_p$ norm bounded adversarial perturbations, guarantees against semantic perturbations remain largely underexplored. In this paper, we provide TSS -- a unified framework for certifying ML robustness against general adversarial semantic transformations. First, depending on the properties of each transformation, we divide common transformations into two categories, namely resolvable (e.g., Gaussian blur) and differentially resolvable (e.g., rotation) transformations. For the former, we propose transformation-specific randomized smoothing strategies and obtain strong robustness certification. The latter category covers transformations that involve interpolation errors, and we propose a novel approach based on stratified sampling to certify the robustness. Our framework TSS leverages these certification strategies and combines with consistency-enhanced training to provide rigorous certification of robustness. We conduct extensive experiments on over ten types of challenging semantic transformations and show that TSS significantly outperforms the state of the art. Moreover, to the best of our knowledge, TSS is the first approach that achieves nontrivial certified robustness on the large-scale ImageNet dataset. For instance, our framework achieves 30.4% certified robust accuracy against rotation attack (within $\pm 30^{\circ }$) on ImageNet. Moreover, to consider a broader range of transformations, we show TSS is also robust against adaptive attacks and unforeseen image corruptions such as CIFAR-10-C and ImageNet-C.

2021 ACM SIGSAC Conference on Computer and Communications Security (CCS '21)

References in corpus (16)

• DeepStack: Expert-Level Artificial Intelligence in No-Limit Poker
• Certified Adversarial Robustness via Randomized Smoothing
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Spatially Transformed Adversarial Examples
• Semidefinite relaxations for certifying robustness to adversarial examples
• Certified Adversarial Robustness with Additive Noise
• RobustBench: a standardized adversarial robustness benchmark
• Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness
• Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Framework
• Consistency Regularization for Certified Robustness of Smoothed Classifiers
• Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates
• Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming
• Attribute-Guided Adversarial Training for Robustness to Natural Perturbations