Denoised Smoothing: A Provable Defense for Pretrained Classifiers

Understand

We present a method for provably defending any pretrained image classifier against $\ell_p$ adversarial attacks.

• This method, for instance, allows public vision API providers and users to seamlessly convert pretrained non-robust classification services into provably robust ones.
• By prepending a custom-trained denoiser to any off-the-shelf image classifier and using randomized smoothing, we effectively create a new classifier that is guaranteed to be $\ell_p$-robust to adversarial examples, without modifying the pretrained classifier.
• Our approach applies to both the white-box and the black-box settings of the pretrained classifier.