Denoised Smoothing: A Provable Defense for Pretrained Classifiers
arXiv:2003.01908
Abstract
We present a method for provably defending any pretrained image classifier against adversarial attacks. This method, for instance, allows public vision API providers and users to seamlessly convert pretrained non-robust classification services into provably robust ones. By prepending a custom-trained denoiser to any off-the-shelf image classifier and using randomized smoothing, we effectively create a new classifier that is guaranteed to be -robust to adversarial examples, without modifying the pretrained classifier. Our approach applies to both the white-box and the black-box settings of the pretrained classifier. We refer to this defense as denoised smoothing, and we demonstrate its effectiveness through extensive experimentation on ImageNet and CIFAR-10. Finally, we use our approach to provably defend the Azure, Google, AWS, and ClarifAI image classification APIs. Our code replicating all the experiments in the paper can be found at: https://github.com/microsoft/denoised-smoothing.
arXiv comment10 pages main text; 29 pages total
References in corpus (25)
- Beyond a Gaussian Denoiser: Residual Learning of Deep CNN for Image Denoising
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Towards Deep Neural Network Architectures Robust to Adversarial Examples
- Certified Adversarial Robustness via Randomized Smoothing
- Certified Defenses against Adversarial Examples
- The Space of Transferable Adversarial Examples
- Countering Adversarial Images using Input Transformations
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
- Efficient Neural Network Robustness Certification with General Activation Functions
- On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
- Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
- Semidefinite relaxations for certifying robustness to adversarial examples
- Certified Adversarial Robustness with Additive Noise
- Efficient Formal Safety Analysis of Neural Networks
- Simple Black-box Adversarial Attacks
- A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks
- On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
- Training verified learners with learned verifiers
- Functional Adversarial Attacks
- MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
- Provable Robustness of ReLU networks via Maximization of Linear Regions
- Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
- Improved Image Wasserstein Attacks and Defenses