[Paper Review] Denoised Smoothing: A Provable Defense for Pretrained Classifiers

Hadi Salman, Mingjie Sun+3 more|arXiv (Cornell University)|Mar 4, 2020

Adversarial Robustness in Machine LearningComputer Science52 references37 citations

TL;DR

A method to turn any pretrained image classifier into a provably robust classifier against L2 adversarial perturbations by prepending a custom-trained denoiser and applying randomized smoothing, usable in white-box and black-box settings and demonstrated on ImageNet, CIFAR-10, and public APIs.

ABSTRACT

We present a method for provably defending any pretrained image classifier against $\ell_p$ adversarial attacks. This method, for instance, allows public vision API providers and users to seamlessly convert pretrained non-robust classification services into provably robust ones. By prepending a custom-trained denoiser to any off-the-shelf image classifier and using randomized smoothing, we effectively create a new classifier that is guaranteed to be $\ell_p$-robust to adversarial examples, without modifying the pretrained classifier. Our approach applies to both the white-box and the black-box settings of the pretrained classifier. We refer to this defense as denoised smoothing, and we demonstrate its effectiveness through extensive experimentation on ImageNet and CIFAR-10. Finally, we use our approach to provably defend the Azure, Google, AWS, and ClarifAI image classification APIs. Our code replicating all the experiments in the paper can be found at: https://github.com/microsoft/denoised-smoothing.

Motivation & Objective

• Enable provable L2-robustness for pretrained image classifiers without retraining the underlying model.
• Apply and certify robustness in white-box and black-box scenarios, including public vision APIs.
• Demonstrate effectiveness on large-scale datasets (ImageNet) and CIFAR-10 with pretrained models.
• Show that denoised smoothing can wrap commercial APIs to provide certifiable robustness.

Proposed method

• Prepend a trained denoiser D_theta to a pretrained classifier f to form f∘D_theta.
• Apply randomized smoothing to the composite classifier, outputting the most likely class under Gaussian perturbations.
• Train denoisers using either mean-squared error (MSE) or a stability objective (Stab); optionally combine MSE with Stab (Stab+MSE).
• Compute certified radius R using R = (sigma/2)[Phi^{-1}(p_A) - Phi^{-1}(p_B)], with p_A and p_B estimated by Monte Carlo sampling.
• In white-box settings, backpropagate through f to train the denoiser; in black-box settings, use surrogate classifiers to train and transfer the denoiser.
• Demonstrate applicability to public APIs by wrapping Azure, Google Cloud Vision, AWS Rekognition, and ClarifAI with the denoiser before querying the API.

Experimental results

Research questions

• RQ1 Can pretrained classifiers be made provably robust without retraining the underlying model?
• RQ2 How should a denoiser be trained to enable effective randomized smoothing on pretrained classifiers?
• RQ3 What is the impact of white-box versus black-box access on certifiable robustness when using a denoised smoothing pipeline?
• RQ4 Can the approach certify robustness for commercial vision APIs as black-box systems?
• RQ5 How do different denoiser training objectives (MSE vs Stab vs Stab+MSE) affect certified accuracy?

Key findings

• Attaching a Stab-trained denoiser substantially improves certified accuracy over the No denoiser baseline on CIFAR-10 (e.g., 49% improvement at ℓ2<64/255).
• For ImageNet with ResNet-50, white-box and black-box settings yield meaningful gains in certified accuracy at ℓ2 radii around 127/255 (e.g., 33% and 31% improvements, respectively).
• Black-box certification on CIFAR-10 using surrogate models achieves notable gains (e.g., 38% improvement over baseline at ℓ2<64/255).
• On ImageNet, Stab+MSE denoisers outperform MSE alone and No denoiser, with substantial gains across ResNet-18/34/50 attestations.
• The method enables certifiable robustness for four major public APIs (Azure, Google Cloud Vision, AWS Rekognition, ClarifAI) with denoisers outperforming the baseline randomized smoothing on API outputs.
• Transferability of denoisers via surrogate models enables effective black-box certification across different pretrained architectures.