Certified Defense to Image Transformations via Randomized Smoothing

Understand

We extend randomized smoothing to cover parameterized transformations (e.g., rotations, translations) and certify robustness in the parameter space (e.g., rotation angle).

• This is particularly challenging as interpolation and rounding effects mean that image transformations do not compose, in turn preventing direct certification of the perturbed image (unlike certification with $\ell^p$ norms).
• We address this challenge by introducing three different kinds of defenses, each with a different guarantee (heuristic, distributional and individual) stemming from the method used to bound the interpolation error.
• Importantly, we show how individual certificates can be obtained via either statistical error bounds or efficient online inverse computation of the image transformation.