Deterministic Certification to Adversarial Attacks via Bernstein Polynomial Approximation

Abstract

Randomized smoothing has established state-of-the-art provable robustness against ${\ell }_2$ norm adversarial attacks with high probability. However, the introduced Gaussian data augmentation causes a severe decrease in natural accuracy. We come up with a question, "Is it possible to construct a smoothed classifier without randomization while maintaining natural accuracy?". We find the answer is definitely yes. We study how to transform any classifier into a certified robust classifier based on a popular and elegant mathematical tool, Bernstein polynomial. Our method provides a deterministic algorithm for decision boundary smoothing. We also introduce a distinctive approach of norm-independent certified robustness via numerical solutions of nonlinear systems of equations. Theoretical analyses and experimental results indicate that our method is promising for classifier smoothing and robustness certification.

References in corpus (17)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Detecting Adversarial Samples from Artifacts
• Evaluating Robustness of Neural Networks with Mixed Integer Programming
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Semidefinite relaxations for certifying robustness to adversarial examples
• Certified Adversarial Robustness with Additive Noise
• Efficient Formal Safety Analysis of Neural Networks
• A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks
• Differentiable Convex Optimization Layers
• Towards Proving the Adversarial Robustness of Deep Neural Networks
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• Provable Robustness of ReLU networks via Maximization of Linear Regions
• Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness
• Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates
• Random Smoothing Might be Unable to Certify ${\ell }_{\infty }$ Robustness for High-Dimensional Images