Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences

2024/06/14 by Lyu, Saiyue, Shaikh, Shadab, Shpilevskiy, Frederick +2 · 4 citations
#Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · doi:10.48550/arxiv.2406.10427

Abstract

We propose Adaptive Randomized Smoothing (ARS) to certify the predictions of our test-time adaptive models against adversarial examples. ARS extends the analysis of randomized smoothing using f-Differential Privacy to certify the adaptive composition of multiple steps. For the first time, our theory covers the sound adaptive composition of general and high-dimensional functions of noisy inputs. We instantiate ARS on deep image classification to certify predictions against adversarial examples of bounded L_∞ norm. In the L_∞ threat model, ARS enables flexible adaptation through high-dimensional input-dependent masking. We design adaptivity benchmarks, based on CIFAR-10 and CelebA, and show that ARS improves standard test accuracy by 1 to 15% points. On ImageNet, ARS improves certified test accuracy by up to 1.6% points over standard RS without adaptivity. Our code is available at https://github.com/ubc-systopia/adaptive-randomized-smoothing .

Cited by

• Dual Randomized Smoothing: Beyond Global Noise Variance
• AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness
• Position: Human Factors Reshape Adversarial Analysis in Human-AI Decision-Making Systems
• Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusion

Related

• Towards Bridging the gap between Empirical and Certified Robustness against Adversarial Examples
• Improved, Deterministic Smoothing for L₁ Certified Robustness
• Analyzing Accuracy Loss in Randomized Smoothing Defenses
• Certified Adversarial Robustness via Randomized Smoothing
• Extensions and limitations of randomized smoothing for robustness\n guarantees