Certified Adversarial Robustness via Randomized Smoothing

Jeremy Cohen, Elan Rosenfeld, Zico Kolter
Proceedings of the 36th International Conference on Machine Learning, PMLR 97:1310-1320, 2019.

Abstract

We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the L2 norm. While this "randomized smoothing" technique has been proposed before in the literature, we are the first to provide a tight analysis, which establishes a close connection between L2 robustness and Gaussian noise. We use the technique to train an ImageNet classifier with e.g. a certified top-1 accuracy of 49% under adversarial perturbations with L2 norm less than 0.5 (=127/255). Smoothing is the only approach to certifiably robust classification which has been shown feasible on full-resolution ImageNet. On smaller-scale datasets where competing approaches to certified L2 robustness are viable, smoothing delivers higher certified accuracies. The empirical success of the approach suggests that provable methods based on randomization at prediction time are a promising direction for future research into adversarially robust classification.

Cite this Paper

BibTeX
@InProceedings{pmlr-v97-cohen19c, title = {Certified Adversarial Robustness via Randomized Smoothing}, author = {Cohen, Jeremy and Rosenfeld, Elan and Kolter, Zico}, booktitle = {Proceedings of the 36th International Conference on Machine Learning}, pages = {1310--1320}, year = {2019}, editor = {Chaudhuri, Kamalika and Salakhutdinov, Ruslan}, volume = {97}, series = {Proceedings of Machine Learning Research}, month = {09--15 Jun}, publisher = {PMLR}, pdf = {http://proceedings.mlr.press/v97/cohen19c/cohen19c.pdf}, url = {https://proceedings.mlr.press/v97/cohen19c.html}, abstract = {We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the L2 norm. While this "randomized smoothing" technique has been proposed before in the literature, we are the first to provide a tight analysis, which establishes a close connection between L2 robustness and Gaussian noise. We use the technique to train an ImageNet classifier with e.g. a certified top-1 accuracy of 49% under adversarial perturbations with L2 norm less than 0.5 (=127/255). Smoothing is the only approach to certifiably robust classification which has been shown feasible on full-resolution ImageNet. On smaller-scale datasets where competing approaches to certified L2 robustness are viable, smoothing delivers higher certified accuracies. The empirical success of the approach suggests that provable methods based on randomization at prediction time are a promising direction for future research into adversarially robust classification.} }
Endnote
%0 Conference Paper %T Certified Adversarial Robustness via Randomized Smoothing %A Jeremy Cohen %A Elan Rosenfeld %A Zico Kolter %B Proceedings of the 36th International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2019 %E Kamalika Chaudhuri %E Ruslan Salakhutdinov %F pmlr-v97-cohen19c %I PMLR %P 1310--1320 %U https://proceedings.mlr.press/v97/cohen19c.html %V 97 %X We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the L2 norm. While this "randomized smoothing" technique has been proposed before in the literature, we are the first to provide a tight analysis, which establishes a close connection between L2 robustness and Gaussian noise. We use the technique to train an ImageNet classifier with e.g. a certified top-1 accuracy of 49% under adversarial perturbations with L2 norm less than 0.5 (=127/255). Smoothing is the only approach to certifiably robust classification which has been shown feasible on full-resolution ImageNet. On smaller-scale datasets where competing approaches to certified L2 robustness are viable, smoothing delivers higher certified accuracies. The empirical success of the approach suggests that provable methods based on randomization at prediction time are a promising direction for future research into adversarially robust classification.
APA
Cohen, J., Rosenfeld, E. & Kolter, Z.. (2019). Certified Adversarial Robustness via Randomized Smoothing. Proceedings of the 36th International Conference on Machine Learning, in Proceedings of Machine Learning Research 97:1310-1320 Available from https://proceedings.mlr.press/v97/cohen19c.html.

Related Material