Filling the Soap Bubbles: Efficient Black-Box Adversarial Certification with Non-Gaussian Smoothing

1 INTRODUCTION . Deep neural networks have achieved state-of-the-art performance on many tasks such as image classification ( He et al. , 2016 ; Lu et al. , 2018 ) and language modeling ( Devlin et al. , 2019 ) . Nonetheless , modern deep learning models have been shown to be highly sensitive to small and adversarially crafted perturbations on the inputs ( Goodfellow et al. , 2015 ) , which means a human-imperceptible changes on inputs could cause the model to make dramatically different predictions . Although many robust training algorithms have been developed to overcome adversarial attacking , most heuristically developed methods can be shown to be broken by more powerful adversaries eventually , ( e.g. , Athalye et al. , 2018 ; Madry et al. , 2018 ; Zhang et al. , 2019 ; Wang et al. , 2019 ) . This casts an urgent demand for developing robust classifiers with provable worst case guarantees . One promising approach for certifiably robustness is the recent randomized smoothing method ( e.g. , Cohen et al. , 2019 ; Salman et al. , 2019 ; Lee et al. , 2019 ; Li et al. , 2019 ; Lecuyer et al. , 2018 ) , which constructs smoothed classifiers with certifiable robustness by introducing noise on the inputs . Compared with the other more traditional verification approaches ( e.g . Wong & Kolter , 2017 ; Jordan et al. , 2019 ; Dvijotham et al. , 2018 ) that exploits special structures of the neural networks ( such as the properties of ReLU ) , the randomized smoothing methods work more flexibly on general blackbox classifiers and is shown to be more scalable and provide tighter bounds on challenging datasets such as ImageNet ( Deng et al. , 2009 ) . However , the existing randomized smoothing methods can only work against ` 2 attack , in which the perturbations are allowed within an ` 2 ball of certain radius . A stronger type of attack , such as the ` ∞ attacks , is much more challenging to defense and verify due to the larger set of perturbations , but is more relevant in practice . In addition , all the existing randomized smoothing methods use Gaussian noise for smoothing . Although appearing to be a natural choice , one of our key observations is that Gaussian distributions is in fact a rather sub-optimal choice in high dimensional spaces , even for ` 2 attack . This is due to a counter-intuitive phenomenon in high dimensional spaces ( Vershynin , 2018 ) that almost all of the probability mass of standard Gaussian distribution concentrates around the sphere of radius one ( and hence “ soap bubble ” in the title ) , instead of the center point ( which corresponds to the original input ) . As a result , the variance of the Gaussian noise needs to be sufficiently small to yield good approximation to the original classifiers ( by squeezing the “ soap bubble ” towards the center point ) , which , however , makes it difficult to verify due to the small noise . Further , for the more challenging ` ∞ attack , Gaussian smoothing provably degenerates in high dimensions . Our contribution We propose a general framework of adversarial certification using nonGaussian smoothing noises , based on a new perspective from variational optimization . Our framework re-derives the method of Cohen et al . ( 2019 ) as a special case , and is applicable to more general families of non-Gaussian smoothing distributions and more types of attacks beyond ` 2 norm . Importantly , our new framework reveals a fundamental trade-off between accuracy and robustness for guiding better choices of smoothing distributions . Leveraging our insight , we develop two new families of distributions for better certification results on ` 2 and ` ∞ attacks , respectively . Efficient computational approaches are developed to enable our method in practice . Empirical results show that our new framework and smoothing distributions significantly outperform the existing approaches for both ` 2 and ` ∞ attacking , on challenging datasets such as CIFAR-10 and ImageNet . 2 RELATED WORKS . Empirical Defenses Since Szegedy et al . ( 2013 ) and Goodfellow et al . ( 2015 ) , many previous works have focused on utilizing small perturbation δ under certain constraint , e.g . in a ` p norm ball , to attack a neural network . Adversarial training ( Madry et al. , 2018 ) and its variants ( Kannan et al. , 2018 ; Zhang & Wang , 2019 ; Zhai et al. , 2019 ) are the most successful defense methods to date , in which the network is forced to solve a mini-max game between the defender and attacker with adversarial examples as data augmentation . However , these empirical defense methods are still easy to be broken and can not provide provable defense . Certified Defenses Unlike the empirical defense methods , once a classifier can guarantee a constant classification within a local region , it is called a robust certificate . Exact certification methods provide the minimal perturbation condition which leads to a different classification result . This line of work focus on deep neural networks with ReLU-like activation that makes the classifier a piece-wise linear function . This enables researchers to introduce satisfiability modulo theories ( Carlini et al. , 2017 ; Ehlers , 2017 ) or mix integer linear programming ( Cheng et al. , 2017 ; Dutta et al. , 2018 ) . Sufficient certification methods take a conservative way and try to bound the Lipschitz constant or other information of the network ( Jordan et al. , 2019 ; Wong & Kolter , 2017 ; Raghunathan et al. , 2018 ; Zhang et al. , 2018 ) . However , these certification strategies share a drawback that they are not feasible on large-scale scenarios , e.g . large enough practical networks , large enough datasets . Randomized Smoothing To mitigate this limitation of previous certifiable defenses , improving network robustness via randomness has been recently discussed ( Xie et al. , 2018 ; Liu et al. , 2018 ) . In certification community , Lecuyer et al . ( 2018 ) first introduced randomization with technique in differential privacy . Li et al . ( 2019 ) improved their work with a bound given by Rényi divergence . In succession , Cohen et al . ( 2019 ) firstly provided a tight bound for arbitrary Gaussian smoothed classifiers based on previous theorems found by Li & Kuelbs ( 1998 ) . Salman et al . ( 2019 ) combined the empirical and certification robustness , by applying adversarial training on randomized smoothed classifiers to achieve a higher certified accuracy . Lee et al . ( 2019 ) focused on ` 0 norm perturbation setting , and proposed a discrete smoothing distribution to beat the Gaussian distribution baseline . Similar to ( Lee et al. , 2019 ) , we also focus on finding a suitable distribution to trade-off accuracy and robustness for different types of adversarial attacks , such as ` 2 and ` ∞ . 3 BLACK-BOX CERTIFICATION WITH VARIATIONAL OPTIMIZATION . We start with introducing the background of adversarial certification problem and and randomized smoothing method . We then introduce in Section 3.1 our general framework of adversarial certification using non-Gaussian smoothing noises , from a new variational optimization perspective . Our framework includes the method of Cohen et al . ( 2019 ) as a special case , and reveals a critical trade-off between accuracy and robustness that provides important guidance for better choices of smoothing distributions in Section 4 . Adversarial Certification We consider binary classification of predicting binary labels y ∈ { 0 , 1 } from feature vectors x ∈ Rd for simplicity . The extension to multi-class cases is straightforward , and is discussed in Appendix D. Assume f ] : Rd → [ 0 , 1 ] is a pre-trained binary classifier ( ] means the classifier is given ) , which maps from the feature space Rd to either the class probability in interval [ 0 , 1 ] or the binary labels in { 0 , 1 } . In the robustness certification problem , a testing data point x0 ∈ Rd is given , and one is asked to verify if the classifier outputs the same prediction when we perturb the input x0 arbitrarily in B , a given neighborhood of x0 . Specifically , let B be a set of possible perturbation vectors , e.g. , B = { δ ∈ Rd : ‖δ‖p ≤ r } for ` p norm with a radius r. If the classifier predicts y = 1 on x0 , i.e . f ] ( x0 ) > 1/2 , we want to verify if f ] ( x0 + δ ) > 1/2 holds for any δ ∈ B . In this paper , we consider two types of attacks , including the ` 2 attack B ` 2 , r def = { δ : ‖δ‖2 ≤ r } , and the ` ∞ attack B ` ∞ , r def = { δ : ‖δ‖∞ ≤ r } . More general ` p attack can also be handled by our framework but is left as future works . Black-box Certification with Randomness Directly verifying f ] heavily relies on the smoothness of f ] , which has been explored in a series of recent works ( Lecuyer et al. , 2018 ; Wong & Kolter , 2017 ) . These methods typically depend on the special structure property ( e.g. , the use of ReLU units ) of f ] , and thus can not serve as general purpose algorithms . We are instead interested in black-box verification methods that could work for arbitrary classifiers . One approach to enable this , as explored in recent works ( Cohen et al. , 2019 ; Lee et al. , 2019 ) , is to replace f ] with a smoothed classifier by convovling with Gaussian noise , and verify the smoothed classifier . Specifically , assume π0 is a smoothing distribution with zero mean and bounded variance , e.g. , π0 = N ( 0 , σ2 ) . The randomized smoothed classifier is defined by f ] π0 ( x0 ) : = Ez∼π0 [ f ] ( x0 + z ) ] , which returns the averaged probability of x0 + z under the perturbation of z ∼ π0 . Assume we replace the original classifier with f ] π0 , then the goal becomes verifying f ] π0 using its inherent smoothness . Specifically , if f ] π0 ( x0 ) > 1/2 , we want to verify that f ] π0 ( x0 + δ ) > 1/2 for every δ ∈ B , that is , min δ∈B f ] π0 ( x0 + δ ) = minδ∈B Ez∼π0 [ f ] ( x0 + z + δ ) ] > 1/2 . ( 1 ) In this case , it is sufficient to obtain a guaranteed lower bound of minδ∈B f ] π0 ( x0 + δ ) and check if it is larger than 1/2 . When π0 is Gaussian N ( 0 , σ2 ) and for ` 2 attack , this problem was studied in Cohen et al . ( 2019 ) , which shows that a lower bound of min z∈B Ez∼π0 [ f ] ( x0 + z ) ] ≥ Φ ( Φ−1 ( f ] π0 ( x0 ) ) − r/σ ) , ( 2 ) where Φ ( · ) is the cumulative density function ( CDF ) of standard Gaussian distribution , and Φ−1 ( · ) represents its inverse function . The proof of this result in Cohen et al . ( 2019 ) uses NeymanPearson lemma ( Li & Kuelbs , 1998 ) , while in the following section another derivation using variational optimization is provided . Note that the bound in Equation ( 2 ) is tractable since it only requires to evaluate the smoothed classifier f ] π0 ( x0 ) at the original image x0 , instead of solving the difficult adversarial optimization over perturbation z in Equation ( 1 ) . In practice , f ] π0 ( x0 ) is approximated by Monte Carlo approximation with a non-asymptotic confidence bound .

Summary: This paper investigates the choice of noise distributions for smoothing an arbitrary classifier for defending against adversarial attacks.  The paper focuses on the two major adversaries: \ell_2 adversaries and \ell_\infty adversaries. Theorem 1 quantifies the tradeoff between the choice of smoothing distribution which (1) has clean accuracy close to the original classifier and (2) promotes the smoothness of smoothed classifier (and hence adversarial accuracy).  For the \ell_2 adversary, the paper argues that Gaussian distribution is not the right choice, because the distribution is concentrated on the spherical shell around the x. Instead, the authors propose using a new family of distributions, with the norm square  (p_{|z|_2^2}) following the scaled \chi^2 distribution with degree d-k (Eq. 8). This allows an extra degree of freedom, and setting k=0 recovers the Gaussian distribution. For \ell_\infty perturbations, the paper suggests another family of distributions combining the \ell_2 and \ell_\infty norm (Eq. 9), and argues that it outperforms the natural choice of \ell_\infty norm-based distributions (Eq. 10).