Intriguing Properties of Input-dependent Randomized Smoothing

2021/10/11 by Peter Súkeník, Súkeník, Peter, Aleksei Kuvshinov +3 · 3 citations
Computer Science · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Artificial Intelligence (cs.AI) #Domain Adaptation and Few-Shot Learning #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML)

paper · pdf · doi:10.48550/arxiv.2110.05365

openalex publication_date 2021/10/11 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Randomized smoothing is currently considered the state-of-the-art method to obtain certifiably robust classifiers. Despite its remarkable performance, the method is associated with various serious problems such as "certified accuracy waterfalls", certification vs. accuracy trade-off, or even fairness issues. Input-dependent smoothing approaches have been proposed with intention of overcoming these flaws. However, we demonstrate that these methods lack formal guarantees and so the resulting certificates are not justified. We show that in general, the input-dependent smoothing suffers from the curse of dimensionality, forcing the variance function to have low semi-elasticity. On the other hand, we provide a theoretical and practical framework that enables the usage of input-dependent smoothing even in the presence of the curse of dimensionality, under strict restrictions. We present one concrete design of the smoothing variance function and test it on CIFAR10 and MNIST. Our design mitigates some of the problems of classical smoothing and is formally underlined, yet further improvement of the design is still necessary.

Citations

• Intriguing properties of neural networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Certified Adversarial Robustness via Randomized Smoothing
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• Analyzing Accuracy Loss in Randomized Smoothing Defenses
• Data-Dependent Randomized Smoothing
• Learning Multiple Layers of Features from Tiny Images
• Insta-RS: Instance-wise Randomized Smoothing for Improved Robustness and Accuracy
• ANCER: Anisotropic Certification via Sample-wise Volume Maximization

Cited by

• Dual Randomized Smoothing: Beyond Global Noise Variance
• AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness
• Towards Strong Certified Defense with Universal Asymmetric Randomization

Related

• Extensions and limitations of randomized smoothing for robustness\n guarantees
• Boosting Randomized Smoothing with Variance Reduced Classifiers
• Towards Evading the Limits of Randomized Smoothing: A Theoretical Analysis
• Projected Randomized Smoothing for Certified Adversarial Robustness
• Data-Dependent Randomized Smoothing