ANCER: Anisotropic Certification via Sample-wise Volume Maximization

Abstract

Randomized smoothing has recently emerged as an effective tool that enables certification of deep neural network classifiers at scale. All prior art on randomized smoothing has focused on isotropic ${\ell }_p$ certification, which has the advantage of yielding certificates that can be easily compared among isotropic methods via ${\ell }_p$-norm radius. However, isotropic certification limits the region that can be certified around an input to worst-case adversaries, i.e., it cannot reason about other "close", potentially large, constant prediction safe regions. To alleviate this issue, (i) we theoretically extend the isotropic randomized smoothing ${\ell }_1$ and ${\ell }_2$ certificates to their generalized anisotropic counterparts following a simplified analysis. Moreover, (ii) we propose evaluation metrics allowing for the comparison of general certificates - a certificate is superior to another if it certifies a superset region - with the quantification of each certificate through the volume of the certified region. We introduce ANCER, a framework for obtaining anisotropic certificates for a given test set sample via volume maximization. We achieve it by generalizing memory-based certification of data-dependent classifiers. Our empirical results demonstrate that ANCER achieves state-of-the-art ${\ell }_1$ and ${\ell }_2$ certified accuracy on CIFAR-10 and ImageNet in the data-dependence setting, while certifying larger regions in terms of volume, highlighting the benefits of moving away from isotropic analysis. Our code is available in https://github.com/MotasemAlfarra/ANCER.

arXiv commentFirst two authors and the last one contributed equally to this work

References in corpus (16)

• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• Certified Adversarial Robustness via Randomized Smoothing
• The Space of Transferable Adversarial Examples
• Evaluating Robustness of Neural Networks with Mixed Integer Programming
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• An approach to reachability analysis for feed-forward ReLU neural networks
• Semidefinite relaxations for certifying robustness to adversarial examples
• Certified Adversarial Robustness with Additive Noise
• A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks
• A Unified View of Piecewise Linear Neural Network Verification
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
• Characterizing the Decision Boundary of Deep Neural Networks
• Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness
• Improved, Deterministic Smoothing for L_1 Certified Robustness
• Data-Dependent Randomized Smoothing

Cited by in corpus (1)

• Intriguing Properties of Input-dependent Randomized Smoothing