Towards Assessment of Randomized Smoothing Mechanisms for Certifying Adversarial Robustness

by   Tianhang Zheng, et al.

As a certified defensive technique, randomized smoothing has received considerable attention due to its scalability to large datasets and neural networks. However, several important questions remain unanswered, such as (i) whether the Gaussian mechanism is an appropriate option for certifying ℓ_2-norm robustness, and (ii) whether there is an appropriate randomized (smoothing) mechanism to certify ℓ_∞-norm robustness. To shed light on these questions, we argue that the main difficulty is how to assess the appropriateness of each randomized mechanism. In this paper, we propose a generic framework that connects the existing frameworks in <cit.>, to assess randomized mechanisms. Under our framework, for a randomized mechanism that can certify a certain extent of robustness, we define the magnitude of its required additive noise as the metric for assessing its appropriateness. We also prove lower bounds on this metric for the ℓ_2-norm and ℓ_∞-norm cases as the criteria for assessment. Based on our framework, we assess the Gaussian and Exponential mechanisms by comparing the magnitude of additive noise required by these mechanisms and the lower bounds (criteria). We first conclude that the Gaussian mechanism is indeed an appropriate option to certify ℓ_2-norm robustness. Surprisingly, we show that the Gaussian mechanism is also an appropriate option for certifying ℓ_∞-norm robustness, instead of the Exponential mechanism. Finally, we generalize our framework to ℓ_p-norm for any p≥2. Our theoretical findings are verified by evaluations on CIFAR10 and ImageNet.


Towards Assessment of Randomized Mechanisms for Certifying Adversarial Robustness

As a certified defensive technique, randomized smoothing has received co...

Improved, Deterministic Smoothing for L1 Certified Robustness

Randomized smoothing is a general technique for computing sample-depende...

Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness

Randomized smoothing, using just a simple isotropic Gaussian distributio...

Rethinking Randomized Smoothing for Adversarial Robustness

The fragility of modern machine learning models has drawn a considerable...

Tight Second-Order Certificates for Randomized Smoothing

Randomized smoothing is a popular way of providing robustness guarantees...

GSmooth: Certified Robustness against Semantic Transformations via Generalized Randomized Smoothing

Certified defenses such as randomized smoothing have shown promise towar...

Impartial Selection with Additive Approximation Guarantees

Impartial selection has recently received much attention within the mult...

Please sign up or login with your details

Forgot password? Click here to reset