Projected Randomized Smoothing for Certified Adversarial Robustness
Projected Randomized Smoothing for Certified Adversarial Robustness
复制标题
DOI：
10.48550/arxiv.2309.13794
复制
发表时间：
2023-09
期刊：
影响因子：
--
通讯作者：
Samuel Pfrommer;Brendon G. Anderson;S. Sojoudi
中科院分区：
文献类型：
--
作者：
Samuel Pfrommer;Brendon G. Anderson;S. Sojoudi
随机平滑是目前最先进的方法，用于产生可证明的鲁棒分类器。虽然随机平滑通常会产生强大的$\ell_2$-球证书，最近的研究已经推广了可证明的鲁棒性，以不同的规范球以及各向异性区域。这项工作考虑了一个分类器的架构，首先项目到一个低维近似的数据流形，然后应用一个标准的分类器。通过在低维投影空间中进行随机平滑，我们在高维输入空间中表征了我们的平滑复合分类器的认证区域，并证明了其体积上的一个易于处理的下界。我们在CIFAR-10和SVHN上的实验表明，没有初始投影的分类器容易受到正常数据流形的扰动，但我们的方法的认证区域会捕获这些扰动。我们将我们认证区域的体积与各种基线进行比较，并表明我们的方法比最先进的方法提高了许多数量级。
Randomized smoothing is the current state-of-the-art method for producing provably robust classifiers. While randomized smoothing typically yields robust $\ell_2$-ball certificates, recent research has generalized provable robustness to different norm balls as well as anisotropic regions. This work considers a classifier architecture that first projects onto a low-dimensional approximation of the data manifold and then applies a standard classifier. By performing randomized smoothing in the low-dimensional projected space, we characterize the certified region of our smoothed composite classifier back in the high-dimensional input space and prove a tractable lower bound on its volume. We show experimentally on CIFAR-10 and SVHN that classifiers without the initial projection are vulnerable to perturbations that are normal to the data manifold and yet are captured by the certified regions of our method. We compare the volume of our certified regions against various baselines and show that our method improves on the state-of-the-art by many orders of magnitude.