[Paper Review] Certified Adversarial Robustness via Randomized Smoothing

Jeremy M. Cohen, Elan Rosenfeld+1 more|arXiv (Cornell University)|Feb 8, 2019

Adversarial Robustness in Machine Learning620 citations

TL;DR

The paper proves a tight l2 robustness guarantee for a smoothed classifier built from any base classifier by adding Gaussian noise, enabling provably robust accuracy on ImageNet and other datasets.

ABSTRACT

We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the $\ell_2$ norm. This "randomized smoothing" technique has been proposed recently in the literature, but existing guarantees are loose. We prove a tight robustness guarantee in $\ell_2$ norm for smoothing with Gaussian noise. We use randomized smoothing to obtain an ImageNet classifier with e.g. a certified top-1 accuracy of 49% under adversarial perturbations with $\ell_2$ norm less than 0.5 (=127/255). No certified defense has been shown feasible on ImageNet except for smoothing. On smaller-scale datasets where competing approaches to certified $\ell_2$ robustness are viable, smoothing delivers higher certified accuracies. Our strong empirical results suggest that randomized smoothing is a promising direction for future research into adversarially robust classification. Code and models are available at http://github.com/locuslab/smoothing.

Motivation & Objective

• Motivate certifiable robustness for large-scale classifiers beyond neural networks.
• Introduce randomized smoothing to convert any base classifier into a provably robust smoothed classifier.
• Derive a tight, dimension-independent l2 robustness bound for smoothing with Gaussian noise.
• Demonstrate high certified accuracy on ImageNet and smaller datasets using large base models.

Proposed method

• Define the smoothed classifier g(x) as the most probable label of the base classifier f under Gaussian noise N(x, sigma^2 I).
• Prove a tight l2 robustness guarantee: R = (sigma/2) (Phi^{-1}(p_A) - Phi^{-1}(p_B)) under probabilities p_A and p_B from f on noisy inputs.
• Show that g is robust within an l2 ball around x up to radius R, given bounds on p_A and p_B.
• Provide Monte Carlo procedures (Predict and Certify) to estimate g(x) and certify robustness with high probability.
• Train the base classifier f with Gaussian data augmentation to ensure f classifies noisy inputs consistently.
• Compare to prior certified defenses and demonstrate scalability to ImageNet with ResNet-50 as base classifier.

Experimental results

Research questions

• RQ1 Can randomized smoothing with Gaussian noise provide provable l2 robustness guarantees for any base classifier?
• RQ2 What is the exact certified l2 radius achievable given the top-class probability p_A and runner-up probability p_B?
• RQ3 How does the approach scale to large datasets (e.g., ImageNet) and large base networks?
• RQ4 How do the proposed Monte Carlo estimation procedures perform in practice for prediction and certification?

Key findings

• Theorem 1 gives a tight l2 certified radius R = (sigma/2)(Phi^{-1}(p_A) - Phi^{-1}(p_B)) under verifiable bounds on p_A and p_B.
• Experiments show ImageNet certified top-1 accuracy of 49% at radius 0.5 (127/255) and 37% at radius 1.0.
• CIFAR-10 and ImageNet experiments demonstrate improved certified accuracies with randomized smoothing compared to baselines.
• Smoothing enables the use of large, expressive base networks, and achieves certified robustness where other defenses struggle to scale.
• Prediction with smoothing (Predict) is fast but may abstain; certification (Certify) provides high-probability robustness guarantees.
• The approach yields provable robustness for large-scale models, including ImageNet-classification tasks.