Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing
It is well-known that classifiers are vulnerable to adversarial perturbations.To defend against adversarial perturbations, various certified robustness results have been derived.However, existing certified robustnesses are limited to top-1 predictions.In many real-world applications, top- predictions are more relevant.In this work, we aim to derive certified robustness for top- predictions.In particular, our certified robustness is based on randomized smoothing, which turns any classifier to a new classifier via adding noise to an input example.We adopt randomized smoothing because it is scalable to large-scale neural networks and applicable to any classifier.We derive a tight robustness in norm for top- predictions when using randomized smoothing with Gaussian noise.We find that generalizing the certified robustness from top-1 to top- predictions faces significant technical challenges.We also empirically evaluate our method on CIFAR10 and ImageNet.For example, our method can obtain an ImageNet classifier with a certified top-5 accuracy of 62.8% when the-norms of the adversarial perturbations are less than 0.5.Our code is publicly available at: url.
We study the certified robustness for top-k predictions via randomized smoothing under Gaussian noise and derive a tight robustness bound in L_2 norm.This paper extends work on deducing a certified radius using randomized smoothing, and shows the radius at which a smoothed classifier under Gaussian perturbations is certified for the top k predictions.This paper builds upon the random smoothing technique for top-1 prediction, and aims to provide certification on top-k predictions.