Tight Certificates of Adversarial Robustness
for Randomly Smoothed Classifiers

Abstract

Strong theoretical guarantees of robustness can be given for ensembles of classifiers generated by input randomization. Specifically, an L2 bounded adversary cannot alter the ensemble prediction generated by an additive isotropic Gaussian noise, where the radius for the adversary depends on both the variance of the distribution as well as the ensemble margin at the point of interest. We build on and considerably expand this work across broad classes of distributions. In particular, we offer adversarial robustness guarantees and associated algorithms for the discrete case where the adversary is L0 bounded. Moreover, we exemplify how the guarantees can be tightened with specific assumptions about the function class of the classifier such as a decision tree. We empirically illustrate these results with and without functional restrictions across image and molecule datasets.

• Keywords: adversarial robustness, certified robustness.
• Summary:
  1. A general approach to deriving tight certificates of robustness for randomly smoothed classifiers.
  2. We focus on L0-robustness in discrete spaces.
  3. We show how certificates can be tightened with additional assumptions about the classifier.
• Code: GitHub repo
• Poster

Publication

• Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
  Guang-He Lee, Yang Yuan, Shiyu Chang,and Tommi S. Jaakkola
  NeurIPS 2019 arXiv BibTeX

Related Publication

• Towards Robust, Locally Linear Deep Networks
  Guang-He Lee, David Alvarez Melis, and Tommi S. Jaakkola
  ICLR 2019 Paper Project page Code BibTeX
  • Keywords: robust derivatives, transparency, interpretability.
  • TL;DR: a scalable algorithm to establish robust derivatives of deep networks w.r.t. the inputs.