[Paper Review] GSmooth: Certified Robustness against Semantic Transformations via Generalized Randomized Smoothing

Zhongkai Hao, Chengyang Ying+4 more|arXiv (Cornell University)|Jun 9, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

GSmooth proposes a generalized randomized smoothing framework to certify robustness against general semantic transformations, including non-resolvable ones like blur and pixelation, by using a surrogate image-to-image network to model transformations and applying dimension-augmented noise for theoretical certification. It achieves state-of-the-art certified and empirical accuracy on multiple corruption types, including zoom blur and pixelate, outperforming existing methods.

ABSTRACT

Certified defenses such as randomized smoothing have shown promise towards building reliable machine learning systems against $\ell_p$-norm bounded attacks. However, existing methods are insufficient or unable to provably defend against semantic transformations, especially those without closed-form expressions (such as defocus blur and pixelate), which are more common in practice and often unrestricted. To fill up this gap, we propose generalized randomized smoothing (GSmooth), a unified theoretical framework for certifying robustness against general semantic transformations via a novel dimension augmentation strategy. Under the GSmooth framework, we present a scalable algorithm that uses a surrogate image-to-image network to approximate the complex transformation. The surrogate model provides a powerful tool for studying the properties of semantic transformations and certifying robustness. Experimental results on several datasets demonstrate the effectiveness of our approach for robustness certification against multiple kinds of semantic transformations and corruptions, which is not achievable by the alternative baselines.

Motivation & Objective

• To address the lack of certified robustness against general semantic transformations, especially non-resolvable ones like defocus blur and pixelate, which lack closed-form expressions.
• To develop a unified theoretical framework that enables provable robustness certification for both resolvable and non-resolvable semantic transformations.
• To improve upon existing randomized smoothing methods that fail to scale or certify robustness for complex, real-world image corruptions.
• To demonstrate that a surrogate neural network can effectively approximate complex semantic transformations while preserving theoretical certification guarantees.
• To validate the method’s effectiveness on standard benchmarks, showing tight certified bounds and strong empirical performance.

Proposed method

• Introduce a generalized randomized smoothing framework (GSmooth) that extends certified robustness to general semantic transformations through dimension augmentation.
• Use a deep image-to-image translation network as a surrogate model to approximate complex, non-resolvable semantic transformations such as zoom blur and pixelate.
• Apply augmented noise in the semantic layers of the surrogate model to derive a certified robustness radius, enabling theoretical guarantees.
• Theoretical analysis shows that the approximation error from the surrogate model has negligible impact on the certified bound in practice.
• Use a two-stage noise variance strategy: one for the resolvable component and another for the residual non-resolvable part, optimizing the trade-off between robustness and clean accuracy.
• Leverage the surrogate model’s output to compute certified robustness regions, where the model prediction remains unchanged under any transformation within the certified radius.

Experimental results

Research questions

• RQ1 Can certified robustness be achieved for non-resolvable semantic transformations such as pixelation and zoom blur, which lack closed-form mathematical expressions?
• RQ2 How can a surrogate neural network be used to model complex semantic transformations while preserving theoretical certification guarantees?
• RQ3 What is the impact of different noise distributions (e.g., Gaussian, uniform, exponential) on certified robustness in the context of semantic transformations?
• RQ4 How does the choice of noise variance in the surrogate model affect the certified accuracy and robustness radius?
• RQ5 Can the proposed method achieve both high certified accuracy and strong empirical robustness across diverse image corruptions?

Key findings

• GSmooth achieves state-of-the-art certified accuracy on CIFAR-10 for defocus blur (82.4%), zoom blur (77.1%), and pixelate (76.7%), significantly outperforming baselines.
• For adaptive attacks, GSmooth maintains a certified radius of 0.5 with 72.1% certified accuracy on defocus blur, demonstrating tightness of the certification bound.
• On CIFAR-10-C, GSmooth improves empirical accuracy across most corruption types, indicating strong generalization and robustness.
• Abllation studies show that the exponential noise distribution performs best for large-radius certification, while uniform noise is better for small radii.
• The augmented noise in the semantic layers preserves holistic semantic features better than standard image-level noise, as shown in visualization comparisons.
• The method achieves a certified radius of 0.3 and 0.5 for snow transformations, with the model correctly predicting despite severe corruption, demonstrating practical safety guarantees.