Hidden Cost of Randomized Smoothing
arXiv:2003.01249
Abstract
The fragility of modern machine learning models has drawn a considerable amount of attention from both academia and the public. While immense interests were in either crafting adversarial attacks as a way to measure the robustness of neural networks or devising worst-case analytical robustness verification with guarantees, few methods could enjoy both scalability and robustness guarantees at the same time. As an alternative to these attempts, randomized smoothing adopts a different prediction rule that enables statistical robustness arguments which easily scale to large networks. However, in this paper, we point out the side effects of current randomized smoothing workflows. Specifically, we articulate and prove two major points: 1) the decision boundaries of smoothed classifiers will shrink, resulting in disparity in class-wise accuracy; 2) applying noise augmentation in the training process does not necessarily resolve the shrinking issue due to the inconsistent learning objectives.
arXiv commentJeet Mohapatra and Ching-Yun Ko contributed equally. To appear in AISTATS 2021
References in corpus (12)
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Certified Defenses against Adversarial Examples
- Efficient Neural Network Robustness Certification with General Activation Functions
- Evaluating Robustness of Neural Networks with Mixed Integer Programming
- Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
- Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
- Certified Adversarial Robustness with Additive Noise
- Efficient Formal Safety Analysis of Neural Networks
- Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach
- Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
- Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness
- Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing