Intriguing Properties of Input-dependent Randomized Smoothing

Randomized smoothing is currently considered the state-of-the-art method to obtain certifiably robust classifiers . Despite its remarkable performance , the method is associated with various serious problems such as “ certified accuracy waterfalls ” , certification vs. accuracy trade-off , or even fairness issues . Input-dependent smoothing approaches have been proposed with intention of overcoming these flaws . However , we demonstrate that these methods lack formal guarantees and so the resulting certificates are not justified . We show that the input-dependent smoothing , in general , suffers from the curse of dimensionality , forcing the variance function to have low semi-elasticity . On the other hand , we provide a theoretical and practical framework that enables the usage of input-dependent smoothing even in the presence of the curse of dimensionality , under strict restrictions . We present one concrete design of the smoothing variance and test it on CIFAR10 and MNIST . Our design solves some of the problems of classical smoothing and is formally underlined , yet further improvement of the design is still necessary . 1 INTRODUCTION . Deep neural networks are one of the dominating recently used machine learning methods . They achieve state-of-the-art performance in a variety of applications like computer vision , natural language processing , and many others . The key property that makes neural networks so powerful is their expressivity ( Gühring et al. , 2020 ) . However , as a prize , they possess a weakness - a vulnerability against adversarial attacks ( Szegedy et al. , 2013 ; Biggio et al. , 2013 ) . The adversarial attack on a sample x is a point x′ such that the distance d ( x′ , x ) is small , yet the model f ’ s predictions on x and x′ differ . Such examples are often easy to construct , for example by optimizing for a change in prediction f ( x ) ( Biggio et al. , 2013 ) . Even worse , these attacks are present even if the model ’ s prediction on x is unequivocal . This property is highly undesirable because in several sensitive applications , misclassifying a sample just because it does not follow the natural distribution might lead to serious and harmful consequences . A well-known example would be a sticker placed on a traffic sign , which could possibly confuse the self-driving car and cause an accident ( Eykholt et al. , 2018 ) . To prevent this behaviour , the robustness of classifiers against adversarial examples has begun to be a strongly discussed topic . Though many methods claim to provide robust classifiers , just some of them are certifiably robust , i.e . the robustness is mathematically guaranteed . The certifiability turns out to be essential since more sophisticated attacks can break empirical defenses ( Carlini & Wagner , 2017 ) . Currently , the dominating method to achieve the certifiable robustness is randomized smoothing ( RS ) . This clever idea to get rid of adversarial examples using randomization of input was introduced by Lecuyer et al . ( 2019 ) and Li et al . ( 2019 ) and fully formalized and improved in Cohen et al . ( 2019 ) . Let f be a classifier classifying inputs x ∈ RN as one of the classes C ∈ C. Assume now a random deviation ∼ N ( 0 , σ2I ) . The smoothed classifier g , made of f , is defined as : g ( x ) = arg maxC P ( f ( x+ ) = C ) , for C ∈ C. In other words , the smoothed classifier classifies a class that has the highest probability under the sampling of f ( x + ) . Consequently , an adversarial attack x′ on f is less dangerous for g , because g does not look directly at x′ , but rather at its whole neighborhood , in a weighted manner . This way , we can get rid of local artifacts that f possesses – thus the name “ smoothing ” . It turns out , that g enjoys strong robustness properties against attacks bounded by a specifically computed l2-norm threshold , especially if f is trained under a Gaussian noise augmentation ( Cohen et al. , 2019 ) . Unfortunately , since the introduction of the RS , several serious problems were reported to be connected to the technique . Cohen et al . ( 2019 ) mention two of them . First is the usage of lower confidence bounds to estimate the leading class ’ s probability . With a high probability , this leads to smaller reported certified radiuses in comparison with the true ones . Moreover , it yields a theoretical threshold , which upper-bounds the maximal possible certified radius and causes the “ certified accuracy waterfalls ” , significantly decreasing the certified accuracy . This problem is particularly pronounced for small levels of the used smoothing variance σ2 , which motivates to use larger variance . Second , RS possesses a robustness vs. accuracy trade-off problem . The bigger σ we use as the smoothing variance , the smaller clean accuracy will the smoothed classifier have . This motivates to use rather smaller levels of σ . Third , as pointed out by Mohapatra et al . ( 2020a ) , RS smoothens the decision boundary of f in such a way , that bounded or convex regions begin to shrink as σ increases , while the unbounded and anti-convex regions expand . This , as the authors empirically demonstrate , creates a disbalance in class-wise accuracies of g and causes serious fairness issues . Therefore , again , the smaller values of σ are more preferable . See Appendix A for a detailed discussion . Clearly , the usage of a global , constant σ is suboptimal . For the samples close to the decision boundary , we want to use small σ , so that f and g have similar decision boundaries and the expressivity of f is not lost ( where not necessary ) . On the other hand , far from the decision boundary of f , where the probability of the dominant class is close to 1 , we need bigger σ to avoid the severe under-certification ( see Appendix A ) . Together , using a non-constant σ ( x ) rather than constant σ , a suitable smoothing variance could be used to achieve optimal robustness . Yet there are some works introducing this concept ( see Appendix C ) , most of them lack mathematical reasoning about the correctness of their method , which , as we show , turns out to be critical . To support this argumentation , we present a toy example . We train a network on a 2D dataset of a circular shape with the classes being two complementary sectors , where one is of a very small angle . In Figure 1 we show the difference between constant and input-dependent σ . Using non-constant σ ( x ) defined in Equation 1 , we obtain an improvement both in terms of the certified radiuses as well as clean accuracy . For more details see Appendix A . The main contributions of this work are fourfold . First , we generalize the methodology of Cohen et al . ( 2019 ) ’ s work for the case of input-dependent RS ( IDRS ) , obtaining useful and important insights about how to use the Neyman-Pearson lemma in this , general , case . Second and most importantly , we show that the IDRS suffers from the curse of dimensionality in the sense that the semi-elasticity coefficient r of σ ( x ) ( that is | log ( σ ( x0 ) ) −log ( σ ( x1 ) ) | ≤ r‖x0−x1‖ ∀x0 , x1 ∈ RN ) in a high-dimensional setting is restricted to be very small . This means , that even if we wanted to vary the σ ( x ) significantly with varying x , we can ’ t . The maximal reasonable speed of change of σ ( x ) turns out to be almost too small to handle , especially in high dimensions . Third , in contrast , we also study the conditions on σ ( x ) under which it is applicable in high-dimensional regime and prepare a theoretical framework necessary to build an efficient certification algorithm . We are the first to do so for σ ( x ) functions , which are not locally constant ( as in Wang et al . ( 2021 ) ) . Finally , we provide a concrete design of the σ ( x ) function and test it extensively and compare it to the classical RS on the CIFAR10 and MNIST datasets . We discuss to what extent the method treats the issues mentioned above . 2 INPUT-DEPENDENT RS AND THE CURSE OF DIMENSIONALITY . Let C be the set of classes , f : RN −→ C a classifier ( reffered to as the base classifier ) , σ : RN −→ R a non-negative function and P ( C ) a set of distributions over C. Then we call Gf : RN −→ P ( C ) the smoothed class probability predictor , if Gf ( x ) C = P ( f ( x + ) = C ) , where ∼ N ( 0 , σ ( x ) 2I ) and gf : RN −→ C is called smoothed classifier if gf ( x ) = arg maxC Gf ( x ) C , for C ∈ C. We will omit the subscript f in gf often , since it is usually clear from the context , to which base classifier the g corresponds . Furthermore , let A : = g ( x ) refer to the most likely class under the random variable f ( N ( x , σ2I ) ) , while B denote the second most likely class . Define pA = Gf ( x ) A and pB = Gf ( x ) B as the respective probabilities . It is important to note that in practice , it is impossible to estimate pA and pB precisely . Instead , pA is estimated as a lower confidence bound ( LCB ) of the relative occurence of class A in f ’ s predictions given certain number of Monte-Carlo samples n and a confidence level α and the estimate is denoted as pA. We use the exact Clopper-Pearson interval for estimation of the LCB . Similarly for pB . We work with l2-norms denoted as ‖x‖ . First of all , we summarize the main steps in the derivation of certified radius using any method that relies on a use of Neyman-Pearson lemma . 1 . For a potential adversary x′ specify the worst-case classifier f∗ , such that P ( f∗ ( N ( x , σ2I ) ) = A ) = pA , while P ( f∗ ( N ( x′ , σ2I ) ) = B ) is maximized . 2 . Express the probability Gf∗ ( x′ ) B as a function depending on x ′ . 3 . Determine the conditions on x′ ( possibly related to ‖x− x′‖ ) for which this probability is ≤ 0.5 . From these condtions , derive the certified radius . Cohen et al . ( 2019 ) proceeded in this way to obtain a tight certified radius R = σ2 ( Φ −1 ( pA ) − Φ−1 ( pB ) ) . Unfortunately , their result is not directly applicable to the input-dependent case . The constant σ simplifies the derivation of f∗ that turns out to be a linear classifier . This is not the case for non-constant σ ( x ) anymore . Therefore , we need to generalize the methodology of Cohen et al . ( 2019 ) . We put pB = 1−pA for simplicity ( yet it is not necessary to assume this , see Appendix B.5 ) . Let x0 be the point to certify , x1 the potential adversary point , δ = x1−x0 the noise and σ0 = σ ( x0 ) , σ1 = σ ( x1 ) the standard deviations used in x0 and x1 respectively . Furthermore , let fi be a density and Pi a probability measure corresponding to N ( xi , σ2i I ) , i ∈ { 0 , 1 } . Lemma 1 . Out of all possible classifiers f such that Gf ( x ) B ≤ pB = 1 − pA , the one , for which Gf ( x+ δ ) B is maximized is the one , which predicts classB in a region determined by the likelihood ratio : B = { x ∈ RN : f1 ( x ) f0 ( x ) ≥ 1 r } , where r is fixed , such that P0 ( B ) = pB . Note , that we use B to denote both the class and the region of that class . We use this lemma to compute the decision boundary of the worst-case classifier f∗ . Theorem 2 . If σ0 > σ1 , then B is a N -dimensional ball with the center at S > and radius R > : S > = x+ σ20 σ20 − σ21 δ , R > = √ σ20σ 2 1 ( σ20 − σ21 ) 2 ‖δ‖2 + 2N σ 2 0σ 2 1 σ20 − σ21 log ( σ0 σ1 ) + 2σ20σ 2 1 σ20 − σ21 log ( r ) . If σ0 < σ1 , then B is the complement of a N -dimensional ball with the center at S < and radius R < : S < = x− σ20 σ21 − σ20 δ , R < = √ 2σ40 − σ20σ21 ( σ21 − σ20 ) 2 ‖δ‖2 + 2N σ 2 0σ 2 1 σ21 − σ20 log ( σ1 σ0 ) − 2σ 2 0σ 2 1 σ21 − σ20 log ( r ) . As we depict on Figure 2 , both resulting balls are centered on the line connecting x0 , x1 . Moreover , the centers of the balls are always further from x0 , than x1 is from x0 ( even in the case σ0 < σ1 ) . In both cases , it depends on pA ( since r is fixed such that P0 ( B ) = pB ) and the ball can , but might not cover x0 and/or x1 . Note that if σ0 = σ1 , what can happen even in input-dependent regime , the worst-case classifier is the half-space described by Cohen et al . ( 2019 ) . To compute the probability of a ball under a probability measure with an isotropic Gaussian density is far more challenging than to compute the probability of a half-space . In fact , there is no closedform formula for such probability . However , this probability is connected to the non-central chisquare distribution ( NCCHSQ ) . More precisely , the probability of an N -dimensional ball centered at z with radius r under N ( 0 , I ) can be expressed as a cumulative distribution fucntion ( cdf ) of NCCHSQ with N degrees of freedom , non-centrality parameter ‖z‖2 and argument r2 . With this knowledge , we can express P0 ( B ) and P1 ( B ) in terms of the cdf of NCCHSQ as follows . Theorem 3 . P0 ( B ) = χ2N ( σ20 ( σ20 − σ21 ) 2 ‖δ‖2 , R2 < , > σ20 ) , P1 ( B ) = χ2N ( σ21 ( σ20 − σ21 ) 2 ‖δ‖2 , R2 < , > σ21 ) , where the sign < or > is chosen according to the inequality between σ0 and σ1 . Note , that both Theorem 2 and Theorem 3 work well also for δ = 0 . In this case , we encounter a ball centered at x0 = x1 and all the cdf functions become cdf functions of central chi-squared . We expressed probabilities of the worst-case class B ’ s decision region using the cdf of NCCHCSQ . Now , how do we do the certification ? We start with the certification just for two points , x0 and x1 . We question , under which circumstances can x1 be certified from the point of view of x0 . Having x0 , pA and σ0 > σ1 , we can obtain such R , that P0 ( B ) = χ2N ( ‖δ‖2σ20/ ( σ20 − σ21 ) 2 , R2 ) = 1 − pA = pB simply by putting it into the quantile function : R2 = χ2N , qf ( ‖δ‖2σ20/ ( σ20 − σ21 ) 2 , 1− pA ) . Then , we can substitute into P1 ( B ) = χ2N ( ‖δ‖2σ21/ ( σ20 − σ21 ) 2 , R2σ20/σ21 ) . This way , we obtain P1 ( B ) and can judge , whether P1 ( B ) < 1/2 or not . Similar computation can be done if σ0 < σ1 . Denote a : = ‖δ‖ . We can express the P1 ( B ) more simply for σ0 > σ1 as ξ > ( a ) : = P1 ( B ) = χ2N ( σ21 ( σ20 − σ21 ) 2 a2 , σ20 σ21 χ2N , qf ( σ20 ( σ20 − σ21 ) 2 a2 , 1− pA ) ) and for σ0 < σ1 as ξ < ( a ) : = P1 ( B ) = 1− χ2N ( σ21 ( σ21 − σ20 ) 2 a2 , σ20 σ21 χ2N , qf ( σ20 ( σ21 − σ20 ) 2 a2 , pA ) ) . With this in mind , if we have x0 , x1 , pA , σ0 , σ1 , then we can certify x1 w.r.t x0 simply by choosing the correct sign ( < , > ) and computing ξ < ( ‖x0 − x1‖ ) or ξ > ( ‖x0 − x1‖ ) , comparing them with 0.5 . The sample plots of these ξ functions can be found in Appendix B . Now , we are ready to discuss the curse of dimensionality . The problem that arises is that having a high dimension N and σ0 , σ1 differing a lot from each other , ξ functions are already big at 0 , even for considerably small pB . For fixed ratio σ0/σ1 and probability pB , with increasing dimension , the ξ ( 0 ) increases and soon becomes bigger than 0.5 . This , together with monotonicity of ξ function yields that any x1 can not be certified w.r.t . x0 , if σ0 , σ1 are used . The more dissimilar the σ0 and σ1 are , the smaller the dimension N needs to be for this situation to occur . If we want to certify x1 in a reasonable distance from x0 , we need to use similar σ0 , σ1 . This restricts the variability of σ ( x ) function . We will formalize the curse of dimensionality in the following theorems . More on why the curse of dimensionality is present is in Appendix B.2 . Theorem 4 ( curse of dimensionality ) . Let x0 , x1 , pA , σ0 , σ1 , N be as usual . Then , the following two implications hold : 1 . If σ0 > σ1 and log ( σ21 σ20 ) + 1− σ 2 1 σ20 < 2 log ( 1− pA ) N , then x1 is not certified w.r.t . x0 . 2 . If σ0 < σ1 and log ( σ21 σ20 N − 1 N ) + 1− σ 2 1 σ20 N − 1 N < 2 log ( 1− pA ) N , then x1 is not certified w.r.t . x0 . Corollary 5 ( one-sided simpler bound ) . Let x0 , x1 , pA , σ0 , σ1 , N be as usual and assume now σ0 > σ1 . Then , if σ1 σ0 < √ 1− 2 √ − log ( 1− pA ) N , then x1 is not certified w.r.t x0 . Note , that both Theorem 4 and Corrolary 5 can be adjusted to the case where we have a separate estimate pB and do not put pB = 1− pA ( see Appendix B.5 ) . We must emphasize , that the bounds obtained in Theorem 4 are very tight . In other words , if the ratio σ1σ0 is just slightly bigger than the minimal possible threshold determined in Theorem 4 , ξ > ( 0 ) becomes smaller than 0.5 and similarly for ξ > ( 0 ) . The reason for this is , that the only two estimates used in the proof of Theorem 4 are the estimates on the median , which are very tight and constant with respect to N and the Chernoff bound , which is generally considered to be tight too and improves for larger N . The tightness is depicted on Figure 3 , where we plot the minimal possible threshold σ1/σ0 given by Theorem 4 and minimal threshold for which ξ > ( 0 ) < 0.5 as a function of N . To get a better feeling about the concrete numbers , we provide a simple table , which shows the theoretical threshold values provided by Theorem 4 . If σ1/σ0 is smaller than the threshold , we are not able to certify any pair of x0 , x1 using σ0 , σ1 . Results from Table 1 are very restrictive . Assume we have a CIFAR10 sample with pA = 0.999 . For such a probability , constant σ = 0.5 is more than sufficient to guarantee the certified radius of more than 1 . However , in the non-constant regime , to certify R ≥ 1 , we first need to guarantee that no sample within the distance of 1 from x0 uses σ1 < 0.953σ0 . To even strengthen this statement , note that one needs to guarantee σ1 to be even much closer to σ0 in practice . Why ? The results of Theorem 4 lower-bound the ξ functions at 0 . However , since ξ functions are strictly increasing ( as shown in Appendix F ) , one usually needs σ0 and σ1 to be much closer to each other to guarantee ξ being smaller than 0.5 at a 0 . This not only forces the σ ( x ) function to have really small semielasticity but also makes it problematic to define a stochastic σ ( x ) . For more , see Appendix B.2 . To fully understand , how the curse of dimensionality affects the usage of IDRS , we mention two more significant effects . First , with increasing dimension , the average distance between samples tends to grow as √ N . This enables bigger distance to change σ ( x ) . On the other hand , the average level of σ ( x ) used ( like ∼ 0.12 , 0.25 , . . . ) needs to be adjusted also as √ N with increasing dimension . The bigger average level of σ ( x ) we use , the more is the semi-elasticity of σ ( x ) restricted by Theorem 4 and Theorem 7 . All together , these two effects combine in a final trend that for σ0 and σ1 being variances used in two random test samples , |σ0/σ1 − 1| is restricted to go to 0 as 1/ √ N. For detailed explanation , see Appendix B.4 .

Summary: The authors study input-dependent adversarial smoothing i.e. the setting where the smoothing distribution has noise level $\sigma$ dependent on $x$. They begin by deriving the robustness certificate in this setting, and show that it suffers from the curse of dimensionality -- in order to maintain non-vacuous certificates in high dimensions, $\sigma(x)$ must be prohibitively smooth. They then provide empirical experiments using an example function $\sigma(x)$ on CIFAR-10 and MNIST and show that performance is more or less the same compared to the fixed noise level baseline (Cohen et al. 2019).