A Unified framework for randomized smoothing based certified defenses

√ d ) , where d is the dimensionality of the data . This theoretical finding sug- gests that certifying ` ∞-normed robustness by randomized smoothing may not be scalable to high-dimensional data . The veracity of our framework and analysis is verified by extensive evaluations on CIFAR10 and ImageNet . 1 INTRODUCTION . The past decade has witnessed tremendous success of deep learning in handling various learning tasks like image classification ( Krizhevsky et al. , 2012 ) , natural language processing ( Cho et al. , 2014 ) , and game playing ( Silver et al. , 2016 ) . Nevertheless , a major unresolved issue of deep learning is its vulnerability to adversarial samples that are almost indistinguishable from natural samples to humans but can mislead deep neural networks ( DNNs ) to make wrong predictions with high confidence ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ) . This phenomenon , referred to as adversarial attack , is considered to be one of the biggest threats to the deployment of many deep learning systems . Thus , a great deal of effort has been devoted to developing defensive techniques for it . However , the majority of the existing defenses are of heuristic nature ( i.e. , without any theoretical guarantees ) , implying that they may be ineffective against stronger attacks . Recent works ( He et al. , 2017 ; Athalye et al. , 2018 ; Uesato et al. , 2018 ) have confirmed this concern , and showed that most of those heuristic defenses actually fail to defend stronger adaptive attacks . This forces us to shift our attentions to certifiable defenses as they can classify all the samples in a predefined neighborhood of the natural samples with a theoretically-guaranteed error bound . Among all existing certifiable defensive techniques , randomized smoothing emerges as the most popular one due to its scalability to large datasets and arbitrary networks . Remarkably , using the Gaussian mechanism for randomized smoothing , Cohen et al . ( 2019 ) successfully certify 49 % accuracy on the original ImageNet dataset under adversarial perturbations with ` 2 norm less than 0.5 . Despite these successes , there are still several unanswered questions regarding randomized smoothing based certified defenses . One of such questions is , why should Gaussian noise be used for randomized smoothing to certify ` 2-normed robustness , and is Gaussian mechanism the best option ? Another important question is regarding the generalizability of this method to other norms , especially the ` ∞ norm . If randomized smoothing can be used to certify ` ∞-normed robustness , what mechanism is the optimal choice ? To shed light on the above questions , we propose in this paper a unified and self-contained framework for randomized smoothing-based certified defenses . We look at the problem from a differential privacy ’ s point of view and present two types of robustness in this framework . One is motivated by -differential privacy ( -DP ) , which uses∞-divergence to measure the distance between the probabilities of predictions on randomized natural samples and randomized adversarial samples and is therefore called D∞ robustness . The other is inspired by -zero concentrated differential privacy ( -zCDP ) that uses the Maximal Relative Rényi ( MR ) divergence as the probability distance measurement and is called DMR robustness . For both of them , we focus on certifying robustness in either ` 2 or ` ∞ norm by randomized smoothing . Specifically , our contributions are five-fold : 1 . We propose a unified and self-contained framework for certifyingD∞ and/orDMR robustness in ` 2 and ` ∞ norms by randomized smoothing . 2 . In our framework , we demonstrate that the Gaussian mechanism is a near optimal choice for certifying DMR robustness in ` 2 norm , and the robust radius is O ( 1 ) . 3 . We also prove that an exponential mechanism is the optimal choice for certifying D∞ robustness in ` ∞ norm , but the robust radius is only O ( 1/d ) , making it unscalable to highdimensional data . 4 . We show that the Gaussian mechanism is also a near optimal choice for certifyingDMR robustness in ` ∞ norm , but the robust radius isO ( 1/ √ d log d ) , making it also hardly scalable to high-dimensional data . 5 . The largest robust ` ∞ radius that can be certified by randomized smoothing to achieve DMR robustness is upper bounded by O ( 1/ √ d ) . Table 1 summarizes the ( near ) optimal mechanisms of our framework for certifying the ` 2 and ` ∞- normed robustness . 2 RELATED WORK . There are three main approaches for certified defenses . The first approach formulates the task of adversarial verification as an optimization problem and solves it by relaxations ( Dvijotham et al. , 2018 ; Raghunathan et al. , 2018 ; Wong & Kolter , 2018 ) . The second approach uses different techniques , such as interval analysis and abstract interpretations , to maintain an outer approximation of the output at each layer through the network . ( Mirman et al. , 2018 ; Wang et al. , 2018 ; Gowal et al. , 2018 ) . The third approach uses randomized smoothing to certify robustness , and is gaining popularity recently due to its strong scalability ( Lecuyer et al. , 2018 ; Li et al. , 2018 ; Cohen et al. , 2019 ) to large datasets and arbitrary networks . For this approach , Lecuyer et al . ( 2018 ) showed that randomized smoothing can certify the ` 2 and ` 1-normed robustness by using inequalities from differential privacy . Li et al . ( 2018 ) achieved a stronger guarantee on the ` 2-normed robustness using tools from information theory . Cohen et al . ( 2019 ) further obtained a tight guarantee on the ` 2-normed robustness using Gaussian noise . A remaining issue in all of these works is that they did not give answers to questions like why Gaussian noise is used to certify the ` 2-normed robustness and what is the best mechanism to certify the ` ∞-normed robustness . To answer these questions , we present in this paper a new general framework to study randomized smoothing based certified defenses . 3 ROBUSTNESS MOTIVATED BY DIFFERENTIAL PRIVACY . In this section , we introduce our framework . Let x be a data sample and y ∈ Y be its label , where Y is the label set . We denote by f ( · ) a deterministic classifier with prediction f ( x ) for any data sample x . If there exists an x′ in a small lp ball centered at x and with f ( x′ ) 6= f ( x ) , x′ is viewed as an adversarial sample . Definition 1 ( Randomized Classifier ( Cohen et al. , 2019 ) ) . Given an input x , the prediction of a randomized classifier g ( · ) is defined as argmax c∈Y P ( g ( x ) = c ) . Specifically , for a randomized smoothing classifier g ( x ) = f ( x + Z ) , where Z is a random vector and f ( · ) is a deterministic classifier , the prediction of x is the class of c whose region S , { x̃ ∈ Rd , f ( x̃ ) = c } has the largest probability measure in the distribution of x+ Z ( x̃ ∼ p ( x+ Z ) ) . Before introducing our framework , we first recall the definition of robustness for a deterministic classifier in ( Diochnos et al. , 2018 ) . Definition 2 ( Robustness ( Diochnos et al. , 2018 ) ) . For a given classifier f , a sample x and some norm ‖ · ‖ . f is ( r , ‖ · ‖ ) - ( error-region ) robust on the sample x if ∀x′ ∈ B ( x , r ) , f ( x ) = f ( x′ ) , ( 1 ) where B ( x , r ) is the ball centered at x and with norm ‖ · ‖ and radius r. Note that in Definition 2 , the classifier is assumed to be deterministic . To generalize the concept of robustness to randomized classifiers ( see Definition 1 ) , we define a relaxed version of the ( errorregion ) robustness . Since g ( x ) is a random value , instead of using equality , we measure the difference between g ( x ) and g ( x′ ) by a certain divergence . This leads us to the following definition , which is a basic concept in our framework that will be used throughout the paper . Definition 3 ( Relaxed Robustness ) . For a given ( randomized ) classifier g ( · ) , a sample x and some norm ‖ · ‖ , the classifier g is ( r , D , ‖ · ‖ , ) - ( error-region ) robust on x if ∀x′ ∈ B ( x , r ) , max { D ( g ( x ) , g ( x′ ) ) , D ( g ( x′ ) , g ( x ) ) } ≤ . ( 2 ) where D is some divergence metric between two probability distributions . The max function is used to ensure that the measurement is symmetric . Compared with Definition 2 , there are two additional terms in Definition 3 : represents the “ distance ” or difference between the distributions of g ( x ) and g ( x′ ) . When is small , we expect that the distributions of predictions on x and x′ , i.e. , g ( x ) and g ( x′ ) , are almost the same , which is just a generalization of the equality in Definition 2 . D is some divergence measurement between two probability distributions . In this paper , we use two types of divergence , ∞-Divergence and Maximal Relative Rényi Divergence , to measure the distance between two probability distributions . Correspondingly , we have two types of robustness called D∞ and DMR robustness . Definition 4 ( ∞-Divergence ) . The∞-Divergence D∞ of distributions P and Q is defined as D∞ ( P‖Q ) = sup x∈supp ( Q ) log P ( x ) Q ( x ) , where supp ( Q ) is the support of the distribution Q . Definition 5 ( Maximal Relative Rényi Divergence ) . The Maximal Relative Rényi Divergence DMR ( P‖Q ) of distributions P and Q is defined as DMR ( P‖Q ) = max α∈ ( 1 , ∞ ) Dα ( P‖Q ) α , where Dα ( P‖Q ) is the Rényi divergence between P and Q , which is defined as Dα ( P‖Q ) = 1 α− 1 logEx∼Q ( P ( x ) Q ( x ) ) α . Definition 6 ( D∞ Robustness ) . A randomized smoothing mechanism A ( · ) ( including classifiers ) is a ( r , D∞ , ‖ · ‖ , ) -robust mechanism if ∀x′ ∈ B ( x , r ) , max { D∞ ( A ( x ) , A ( x′ ) ) , D ( A ( x′ ) , A ( x ) ) } ≤ , ( 3 ) where ‖ · ‖ is the norm of the ball B ( x , r ) . If a randomized smoothing classifier g ( · ) satisfies Eq . ( 3 ) , it is a ( r , D∞ , ‖ · ‖ , ) -robust classifier or it certifies D∞ Robustness . D∞ Robustness is motivated by the notion of -differential privacy ( -DP ) ( Dwork et al. , 2006 ) . To achieve -DP for a randomized algorithm , we can use several mechanisms such as Laplacian mechanism or Exponential mechanism ( see ( Dwork et al. , 2014 ) for details ) . However , it is known that adding Gaussian noise often does not lead to -DP , but rather ( , δ ) -DP ( Dwork et al. , 2014 ) which has an additional parameter δ and thus is harder to be incorporated in our framework . To alleivate this issue , we employ Maximal Relative Rényi Divergence as the the probability distance measurement to define another type of robustness , namely DMR robustness . Definition 7 ( DMR Robustness ) . A randomized smoothing mechanism A ( · ) is a ( r , DMR , ‖ · ‖ , ) - robust mechanism if ∀x′ ∈ B ( x , r ) , max { DMR ( A ( x ) , A ( x′ ) ) , DMR ( A ( x′ ) , A ( x ) ) } ≤ . ( 4 ) If a randomized smoothing classifier g ( · ) satisfies Eq . ( 4 ) , it is a ( r , DMR , ‖ · ‖ , ) -robust classifier or it certifies DMR Robustness . DMR Robustness is inspired by the notion of zero-Concentrated Differential Privacy ( zCDP ) ( Bun & Steinke , 2016 ) , whose connection to DP is shown in the following theorem . Theorem 8 ( ( Bun & Steinke , 2016 ) ) . Let P and Q be two probability distributions satisfying the conditions of D∞ ( P‖Q ) ≤ and D∞ ( Q‖P ) ≤ . Then , DMR ( P‖Q ) ≤ 12 2 . Theorem 8 indicates that DMR-robustness is a relaxed version of D∞-robustness . Remark ( Connections between D∞ & DMR Robustness and Standard Definitions ) . Although D∞ & DMR Robustness are seemingly new concepts defined in this paper , they actually have several connections with the existing frameworks Lecuyer et al . ( 2018 ) and Cohen et al . ( 2019 ) . Specifically , as long as D∞ robustness is certified , the expected output stability bound in Lecuyer et al . ( 2018 ) will be guaranteed with δ′ = 0 . And if DMR robustness is certified , the expected output stability bound in Lecuyer et al . ( 2018 ) will be guaranteed with ′ = ( c + 1 ) √ and δ′ = exp ( − c 2 4 ) , according to Theorem 10 . Besides , the “ scale ” of the robust radius certified by our framework is similar the “ scale ” of the robust radius in Cohen et al . ( 2019 ) , according to Corollary 11 . Theorem 9 ( Postprocessing Property ) . Let g ( x ) = f ( A ( x ) ) be a randomized classifier , where f ( · ) is any deterministic function ( classifier ) . g ( · ) is ( r , D , ‖ · ‖ , ) -robust if A ( · ) is ( r , D , ‖ · ‖ , ) -robust ( where D includes D∞ and DMR ) . The above theorem is derived from the post-processing properties of DP and zCDP . A detailed proof ( explanation ) is given in Appendix B . This property allows us to concentrate only on the randomized smoothing mechanism A without needing to consider the specific form of the deterministic function ( classifier ) f ( · ) . Next , we consider the cases of certifying D∞ or DMR robustness using ` 2 and ` ∞-norm . 3.1 CERTIFYING ` 2-NORMED ROBUSTNESS The following theorem shows that randomized smoothing by the Gaussian mechanism is ( r , DMR , ‖ · ‖ , ) -robust . Theorem 10 . Let f be any classifier and g ( x ) = f ( x+z ) be its corresponding randomized classifier for samples x ∈ Rd , where z ∼ N ( 0 , σ2Id ) . Then , g ( · ) is ( r , DMR , ‖ · ‖2 , r 2 2σ2 ) -robust on any x . Moreover , let denote r 2 2σ2 . Then , for any λ > 0 and any measurable set S 6= ∅ , the following holds with probability at least 1− exp ( −λ 2 4 ) , log P ( g ( x ) ∈ S ) P ( g ( x′ ) ∈ S ) ≤ λ+ √ . ( 5 ) That is , when λ = c √ , log P ( g ( x ) ∈S ) P ( g ( x′ ) ∈S ) ≤ ( c + 1 ) √ with probability 1 − exp ( − c 2 4 ) . In practice , c = 3 is enough to achieve a high probability . Corollary 11 . Adding Gaussian noise z ∈ N ( 0 , σ2Id ) can defend any x′ ∈ B ( x , r = √ 2 σ ) that satisfies the condition of DMR ( g ( x ) ‖g ( x′ ) ) ≤ with probability at least 1 − exp ( − c 2 4 ) . Furthermore , √ can be calculated ( bounded ) by ( log pa − log pb ) /2 ( 1 + c ) or ( log pa/ ( 1− pa ) ) /2 ( 1 + c ) ( binary case ) , where pa and pb are respectively the probabilities of the randomized classifier g ( · ) returning the most probable class ca and the runner-up class cb on input x . Detailed proofs for Theorem 10 , Corollary 11 , and all the following theorems are provided in Appendix B . From Theorem 9 , we can see that for classifiers like g ( x ) = f ( x + z ) , we only need to prove that the randomized mechanism A ( x ) = x+ z ( z ∼ N ( 0 , σ2Id ) ) is ( r , DMR , ‖ · ‖2 , r 2 2σ2 ) - robust . Also , the connection between and pa , pb can be derived for all or √ ( in the certified radii ) as in Corollary 11 . Note that a similar theorem has also been proved by Cohen et al . ( 2019 ) . But there are some major differences between our framework and theirs ( Cohen et al. , 2019 ) . Specifically , our framework certifies the robustness with a probability of failure , and the certified radius r depends on c that controls the probability of failure . A smaller c yields a larger r compared to those in Cohen et al . ( 2019 ) , and vice versa . Moreover , in our framework , we show that the Gaussian mechanism is a near optimal option , by providing a lower bound below for all possible noises that can certify the ` 2-normed DMR robustness . Next , we consider the following unanswered question ( i.e. , the first question ) . Since there are infinite ways of sampling z , a natural problem is to determine whether Gaussian mechanism is the optimal option to certify the ` 2-normed DMR robustness . To answer this question , we first give a lower bound on the magnitude of the noise z added in the randomized smoothing mechanismA ( x ) = x+z to ensure that A ( x ) , as well as f ( A ( x ) ) , is ( r , DMR , ‖ · ‖2 , ) -robust . If the magnitude of Gaussian noise is close to the lower bound , then Gaussian mechanism is considered as “ near optimal ” . Theorem 12 ( Lower Bound of the Noise ) . For any ≤ O ( 1 ) , if there is a ( 2r , DMR , ‖ · ‖2 , 2 ) - robust randomized smoothing mechanism A ( x ) = x + z : [ 0 , r√ d ] d 7→ [ 0 , r√ d ] d such that for all x ∈ [ 0 , r√ d ] d , E [ ‖z‖∞ ] = EA‖A ( x ) − x‖∞ ≤ α , for some α ≤ O ( 1 ) , then it must be true that α ≥ Ω ( r√ ) . In another word , Ω ( r√ ) is the lower bound of the expected ` ∞ norm of the random noise . Theorem 12 indicates that the expected ` ∞ norm of the added random noise should be at least Ω ( r√ ) to guarantee ( r , DMR , ‖ ·‖2 , ) -robustness . For Gaussian mechanism , the expected ` ∞ norm is O ( σ √ log d ) ( ( Orabona & Pál , 2015 ) ) , which is O ( r√ √ log d ) according to Corollary 11 . This means that Gaussian mechanism is near optimal ( i.e. , up to an O ( √ log d ) factor ) here . Equivalently , if we fix the magnitude of the expected ` ∞-norm of the added noise as α , the largest radius r that can be certified by any ( r , DMR , ‖ · ‖2 , ) -robust randomized smoothing mechanisms is upper bounded by O ( α √ ) , which is also close to the robust radius guaranteed by Gaussian mechanism ( up to an O ( √ log d ) factor ) .

Summary: This work examines the recently proposed randomized smoothing method for certifying the robustness of neural networks. The authors explain a theoretical framework for analyzing randomized smoothing as a certification method, propose two alternative definitions of robustness (D_MR and D_inf), and prove that using Gaussian noise for smoothing is near “optimal” for L2 robustness, while using exponential noise for smoothing is optimal for L_inf robustness (the authors do this by establishing a lower bound on the noise necessary for smoothing to work). This also leads the authors to the interesting conclusion that randomized smoothing may not be scalable to high dimensional data for L_inf robustness.