[論文レビュー] Denoised Smoothing: A Provable Defense for Pretrained Classifiers

Hadi Salman, Mingjie Sun+3 more|arXiv (Cornell University)|Mar 4, 2020

Adversarial Robustness in Machine Learning参考文献 52被引用数 37

ひとこと要約

事前学習済みの画像分類器を、カスタム訓練済みデノイザーを前置してランダム化平滑化を適用することで、L2の敵対的摂動に対して証明可能なロバスト性を持つ分類器へ変換する手法。白箱・黒箱設定での利用が可能で、ImageNet、CIFAR-10、公開APIでデモンストレーションされている。

ABSTRACT

We present a method for provably defending any pretrained image classifier against $\ell_p$ adversarial attacks. This method, for instance, allows public vision API providers and users to seamlessly convert pretrained non-robust classification services into provably robust ones. By prepending a custom-trained denoiser to any off-the-shelf image classifier and using randomized smoothing, we effectively create a new classifier that is guaranteed to be $\ell_p$-robust to adversarial examples, without modifying the pretrained classifier. Our approach applies to both the white-box and the black-box settings of the pretrained classifier. We refer to this defense as denoised smoothing, and we demonstrate its effectiveness through extensive experimentation on ImageNet and CIFAR-10. Finally, we use our approach to provably defend the Azure, Google, AWS, and ClarifAI image classification APIs. Our code replicating all the experiments in the paper can be found at: https://github.com/microsoft/denoised-smoothing.

研究の動機と目的

• Enable provable L2-robustness for pretrained image classifiers without retraining the underlying model.
• Apply and certify robustness in white-box and black-box scenarios, including public vision APIs.
• Demonstrate effectiveness on large-scale datasets (ImageNet) and CIFAR-10 with pretrained models.
• Show that denoised smoothing can wrap commercial APIs to provide certifiable robustness.

提案手法

• Prepend a trained denoiser D_theta to a pretrained classifier f to form f∘D_theta.
• Apply randomized smoothing to the composite classifier, outputting the most likely class under Gaussian perturbations.
• Train denoisers using either mean-squared error (MSE) or a stability objective (Stab); optionally combine MSE with Stab (Stab+MSE).
• Compute certified radius R using R = (sigma/2)[Phi^{-1}(p_A) - Phi^{-1}(p_B)], with p_A and p_B estimated by Monte Carlo sampling.
• In white-box settings, backpropagate through f to train the denoiser; in black-box settings, use surrogate classifiers to train and transfer the denoiser.
• Demonstrate applicability to public APIs by wrapping Azure, Google Cloud Vision, AWS Rekognition, and ClarifAI with the denoiser before querying the API.]
• research_questions: ["Can pretrained classifiers be made provably robust without retraining the underlying model?","How should a denoiser be trained to enable effective randomized smoothing on pretrained classifiers?","What is the impact of white-box versus black-box access on certifiable robustness when using a denoised smoothing pipeline?","Can the approach certify robustness for commercial vision APIs as black-box systems?","How do different denoiser training objectives (MSE vs Stab vs Stab+MSE) affect certified accuracy?"]
• key_findings: ["Attaching a Stab-trained denoiser substantially improves certified accuracy over the No denoiser baseline on CIFAR-10 (e.g., 49% improvement at ℓ2<64/255).","For ImageNet with ResNet-50, white-box and black-box settings yield meaningful gains in certified accuracy at ℓ2 radii around 127/255 (e.g., 33% and 31% improvements, respectively).","Black-box certification on CIFAR-10 using surrogate models achieves notable gains (e.g., 38% improvement over baseline at ℓ2<64/255).","On ImageNet, Stab+MSE denoisers outperform MSE alone and No denoiser, with substantial gains across ResNet-18/34/50 attestations.","The method enables certifiable robustness for four major public APIs (Azure, Google Cloud Vision, AWS Rekognition, ClarifAI) with denoisers outperforming the baseline randomized smoothing on API outputs.","Transferability of denoisers via surrogate models enables effective black-box certification across different pretrained architectures."]
• table_headers: [],

実験結果

リサーチクエスチョン

• RQ1 Can pretrained classifiers be made provably robust without retraining the underlying model?
• RQ2 How should a denoiser be trained to enable effective randomized smoothing on pretrained classifiers?
• RQ3 What is the impact of white-box versus black-box access on certifiable robustness when using a denoised smoothing pipeline?
• RQ4 Can the approach certify robustness for commercial vision APIs as black-box systems?
• RQ5 How do different denoiser training objectives (MSE vs Stab vs Stab+MSE) affect certified accuracy?

主な発見

• Attaching a Stab-trained denoiser substantially improves certified accuracy over the No denoiser baseline on CIFAR-10 (e.g., 49% improvement at ℓ2<64/255).
• For ImageNet with ResNet-50, white-box and black-box settings yield meaningful gains in certified accuracy at ℓ2 radii around 127/255 (e.g., 33% and 31% improvements, respectively).
• Black-box certification on CIFAR-10 using surrogate models achieves notable gains (e.g., 38% improvement over baseline at ℓ2<64/255).
• On ImageNet, Stab+MSE denoisers outperform MSE alone and No denoiser, with substantial gains across ResNet-18/34/50 attestations.
• The method enables certifiable robustness for four major public APIs (Azure, Google Cloud Vision, AWS Rekognition, ClarifAI) with denoisers outperforming the baseline randomized smoothing on API outputs.
• Transferability of denoisers via surrogate models enables effective black-box certification across different pretrained architectures.