2019

Certified Adversarial Robustness via Randomized Smoothing

Cohen, Jeremy M, Rosenfeld, Elan, Kolter, J. Zico

Understand

We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the $\ell_2$ norm.

This "randomized smoothing" technique has been proposed recently in the literature, but existing guarantees are loose.
We prove a tight robustness guarantee in $\ell_2$ norm for smoothing with Gaussian noise.
We use randomized smoothing to obtain an ImageNet classifier with e.g.

Built on

On the problem of the most efficient tests of statistical hypotheses
Neyman, J. and Pearson, E. S · 1933
Earlier work this paper cites.
The use of confidence or fiducial limits illustrated in the case of the binomial
Clopper, C. J. and Pearson, E. S · 1934
Earlier work this paper cites.
Lecture Notes, 2007
Blanchard, G · 2007
Earlier work this paper cites.
ImageNet: A Large-Scale Hierarchical Image Database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L · 2009
Earlier work this paper cites.
Learning multiple layers of features from tiny images
Krizhevsky, A · 2009
Earlier work this paper cites.
Evasion attacks against machine learning at test time
Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndić, N., Laskov, P., Giacinto, G., and Roli, F · 2013
Earlier work this paper cites.
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R · 2014
Earlier work this paper cites.
Explaining and harnessing adversarial examples
Goodfellow, I. J., Shlens, J., and Szegedy, C · 2015
Earlier work this paper cites.
Robustness of classifiers: from adversarial to random noise
Fawzi, A., Moosavi-Dezfooli, S.-M., and Frossard, P · 2016
Earlier work this paper cites.
Deepfool: A simple and accurate method to fool deep neural networks
Moosavi-Dezfooli, S.-M., Fawzi, A., and Frossard, P · 2016
Earlier work this paper cites.
Mitigating evasion attacks to deep neural networks via region-based classification
Cao, X. and Gong, N. Z · 2017
Earlier work this paper cites.
Adversarial examples are not easily detected: Bypassing ten detection methods
Carlini, N. and Wagner, D · 2017
Earlier work this paper cites.
Provably minimally-distorted adversarial examples
Carlini, N., Katz, G., Barrett, C., and Dill, D. L · 2017
Earlier work this paper cites.
Maximum resilience of artificial neural networks
Cheng, C.-H., Nührenberg, G., and Ruess, H · 2017
Earlier work this paper cites.
Parseval networks: Improving robustness to adversarial examples
Cisse, M., Bojanowski, P., Grave, E., Dauphin, Y., and Usunier, N · 2017
Earlier work this paper cites.
A study and comparison of human and deep learning recognition performance under visual distortions
Dodge, S. and Karam, L · 2017
Earlier work this paper cites.
Output range analysis for deep neural networks
Original
Dutta, S., Jha, S., Sanakaranarayanan, S., and Tiwari, A · 2017
Earlier work this paper cites.
Formal verification of piece-wise linear feed-forward neural networks
Ehlers, R · 2017
Earlier work this paper cites.
Formal guarantees on the robustness of a classifier against adversarial manipulation
Hein, M. and Andriushchenko, M · 2017
Earlier work this paper cites.

Similar

Safety verification of deep neural networks
Huang, X., Kwiatkowska, M., Wang, S., and Wu, M · 2017
Cited alongside, same era.
Reluplex: An efficient smt solver for verifying deep neural networks
Katz, G., Barrett, C., Dill, D. L., Julian, K., and Kochenderfer, M. J · 2017
Cited alongside, same era.
Adversarial machine learning at scale
Original
Kurakin, A., Goodfellow, I. J., and Bengio, S · 2017
Cited alongside, same era.
An approach to reachability analysis for feed-forward relu neural networks, 2017
Lomuscio, A. and Maganti, L · 2017
Cited alongside, same era.
Smoothgrad: removing noise by adding noise
Original
Smilkov, D., Thorat, N., Kim, B., Viégas, F., and Wattenberg, M · 2017
Cited alongside, same era.
Efficient defenses against adversarial attacks
Zantedeschi, V., Nicolae, M.-I., and Rawat, A · 2017
Cited alongside, same era.
On the robustness of the cvpr 2018 white-box adversarial example defenses
Athalye, A. and Carlini, N · 2018
Cited alongside, same era.
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Athalye, A., Carlini, N., and Wagner, D · 2018
Cited alongside, same era.
A unified view of piecewise linear neural network verification
Bunel, R. R., Turkaslan, I., Torr, P., Kohli, P., and Mudigonda, P. K · 2018
Cited alongside, same era.
Deep neural networks and mixed integer linear optimization
Fischetti, M. and Jo, J · 2018
Cited alongside, same era.
Robustness of classifiers to uniform ℓ _ p \ell\_p and gaussian noise
Franceschi, J.-Y., Fawzi, A., and Fawzi, O · 2018
Cited alongside, same era.
AI2: safety and robustness certification of neural networks with abstract interpretation
Gehr, T., Mirman, M., Drachsler-Cohen, D., Tsankov, P., Chaudhuri, S., and Vechev, M. T · 2018
Cited alongside, same era.

Then

Towards deep learning models resistant to adversarial attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A · 2018
Later among the works it cites.
Differentiable abstract interpretation for provably robust neural networks
Mirman, M., Gehr, T., and Vechev, M · 2018
Later among the works it cites.
Fast and effective robustness certification
Singh, G., Gehr, T., Mirman, M., Püschel, M., and Vechev, M · 2018
Later among the works it cites.
Lipschitz-margin training: Scalable certification of perturbation invariance for deep neural networks
Tsuzuku, Y., Sato, I., and Sugiyama, M · 2018
Later among the works it cites.
Adversarial risk and the dangers of evaluating against weak attacks
Uesato, J., O’Donoghue, B., Kohli, P., and van den Oord, A · 2018
Later among the works it cites.
Provable defenses against adversarial examples via the convex outer adversarial polytope
Wong, E. and Kolter, J. Z · 2018
Later among the works it cites.
Scaling provable adversarial defenses
Wong, E., Schmidt, F., Metzen, J. H., and Kolter, J. Z · 2018
Later among the works it cites.
Efficient neural network robustness certification with general activation functions
Zhang, H., Weng, T.-W., Chen, P.-Y., Hsieh, C.-J., and Daniel, L · 2018
Later among the works it cites.
Sorting out lipschitz function approximation
Anil, C., Lucas, J., and Grosse, R. B · 2019
Closest in time.
Provable robustness of relu networks via maximization of linear regions
Croce, F., Andriushchenko, M., and Hein, M · 2019
Closest in time.
Adversarial examples are a natural consequence of test error in noise
Ford, N., Gilmer, J., and Cubuk, E. D · 2019
Closest in time.
Rank verification for exponential families
Hung, K. and Fithian, W · 2019
Closest in time.
Certified robustness to adversarial examples with differential privacy
Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., and Jana, S · 2019
Closest in time.
Certifiably robust interpretation in deep learning
Original
Levine, A., Singla, S., and Feizi, S · 2019
Closest in time.
Provably robust deep learning via adversarially trained smoothed classifiers
Original
Salman, H., Yang, G., Li, J., Zhang, P., Zhang, H., Razenshteyn, I., and Bubeck, S · 2019
Closest in time.
Evaluating robustness of neural networks with mixed integer programming
Tjeng, V., Xiao, K. Y., and Tedrake, R · 2019
Closest in time.
Robustness may be at odds with accuracy
Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., and Madry, A · 2019
Closest in time.
Statistical verification of neural networks
Webb, S., Rainforth, T., Teh, Y. W., and Kumar, M. P · 2019
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…