Intriguing Properties of Input-dependent Randomized Smoothing

Randomized smoothing is currently considered the state-of-the-art method to obtain certifiably robust classifiers . Despite its remarkable performance , the method is associated with various serious problems such as “ certified accuracy waterfalls ” , certification vs. accuracy trade-off , or even fairness issues . Input-dependent smoothing approaches have been proposed with intention of overcoming these flaws . However , we demonstrate that these methods lack formal guarantees and so the resulting certificates are not justified . We show that the input-dependent smoothing , in general , suffers from the curse of dimensionality , forcing the variance function to have low semi-elasticity . On the other hand , we provide a theoretical and practical framework that enables the usage of input-dependent smoothing even in the presence of the curse of dimensionality , under strict restrictions . We present one concrete design of the smoothing variance and test it on CIFAR10 and MNIST . Our design solves some of the problems of classical smoothing and is formally underlined , yet further improvement of the design is still necessary . 1 INTRODUCTION . Deep neural networks are one of the dominating recently used machine learning methods . They achieve state-of-the-art performance in a variety of applications like computer vision , natural language processing , and many others . The key property that makes neural networks so powerful is their expressivity ( Gühring et al. , 2020 ) . However , as a prize , they possess a weakness - a vulnerability against adversarial attacks ( Szegedy et al. , 2013 ; Biggio et al. , 2013 ) . The adversarial attack on a sample x is a point x′ such that the distance d ( x′ , x ) is small , yet the model f ’ s predictions on x and x′ differ . Such examples are often easy to construct , for example by optimizing for a change in prediction f ( x ) ( Biggio et al. , 2013 ) . Even worse , these attacks are present even if the model ’ s prediction on x is unequivocal . This property is highly undesirable because in several sensitive applications , misclassifying a sample just because it does not follow the natural distribution might lead to serious and harmful consequences . A well-known example would be a sticker placed on a traffic sign , which could possibly confuse the self-driving car and cause an accident ( Eykholt et al. , 2018 ) . To prevent this behaviour , the robustness of classifiers against adversarial examples has begun to be a strongly discussed topic . Though many methods claim to provide robust classifiers , just some of them are certifiably robust , i.e . the robustness is mathematically guaranteed . The certifiability turns out to be essential since more sophisticated attacks can break empirical defenses ( Carlini & Wagner , 2017 ) . Currently , the dominating method to achieve the certifiable robustness is randomized smoothing ( RS ) . This clever idea to get rid of adversarial examples using randomization of input was introduced by Lecuyer et al . ( 2019 ) and Li et al . ( 2019 ) and fully formalized and improved in Cohen et al . ( 2019 ) . Let f be a classifier classifying inputs x ∈ RN as one of the classes C ∈ C. Assume now a random deviation ∼ N ( 0 , σ2I ) . The smoothed classifier g , made of f , is defined as : g ( x ) = arg maxC P ( f ( x+ ) = C ) , for C ∈ C. In other words , the smoothed classifier classifies a class that has the highest probability under the sampling of f ( x + ) . Consequently , an adversarial attack x′ on f is less dangerous for g , because g does not look directly at x′ , but rather at its whole neighborhood , in a weighted manner . This way , we can get rid of local artifacts that f possesses – thus the name “ smoothing ” . It turns out , that g enjoys strong robustness properties against attacks bounded by a specifically computed l2-norm threshold , especially if f is trained under a Gaussian noise augmentation ( Cohen et al. , 2019 ) . Unfortunately , since the introduction of the RS , several serious problems were reported to be connected to the technique . Cohen et al . ( 2019 ) mention two of them . First is the usage of lower confidence bounds to estimate the leading class ’ s probability . With a high probability , this leads to smaller reported certified radiuses in comparison with the true ones . Moreover , it yields a theoretical threshold , which upper-bounds the maximal possible certified radius and causes the “ certified accuracy waterfalls ” , significantly decreasing the certified accuracy . This problem is particularly pronounced for small levels of the used smoothing variance σ2 , which motivates to use larger variance . Second , RS possesses a robustness vs. accuracy trade-off problem . The bigger σ we use as the smoothing variance , the smaller clean accuracy will the smoothed classifier have . This motivates to use rather smaller levels of σ . Third , as pointed out by Mohapatra et al . ( 2020a ) , RS smoothens the decision boundary of f in such a way , that bounded or convex regions begin to shrink as σ increases , while the unbounded and anti-convex regions expand . This , as the authors empirically demonstrate , creates a disbalance in class-wise accuracies of g and causes serious fairness issues . Therefore , again , the smaller values of σ are more preferable . See Appendix A for a detailed discussion . Clearly , the usage of a global , constant σ is suboptimal . For the samples close to the decision boundary , we want to use small σ , so that f and g have similar decision boundaries and the expressivity of f is not lost ( where not necessary ) . On the other hand , far from the decision boundary of f , where the probability of the dominant class is close to 1 , we need bigger σ to avoid the severe under-certification ( see Appendix A ) . Together , using a non-constant σ ( x ) rather than constant σ , a suitable smoothing variance could be used to achieve optimal robustness . Yet there are some works introducing this concept ( see Appendix C ) , most of them lack mathematical reasoning about the correctness of their method , which , as we show , turns out to be critical . To support this argumentation , we present a toy example . We train a network on a 2D dataset of a circular shape with the classes being two complementary sectors , where one is of a very small angle . In Figure 1 we show the difference between constant and input-dependent σ . Using non-constant σ ( x ) defined in Equation 1 , we obtain an improvement both in terms of the certified radiuses as well as clean accuracy . For more details see Appendix A . The main contributions of this work are fourfold . First , we generalize the methodology of Cohen et al . ( 2019 ) ’ s work for the case of input-dependent RS ( IDRS ) , obtaining useful and important insights about how to use the Neyman-Pearson lemma in this , general , case . Second and most importantly , we show that the IDRS suffers from the curse of dimensionality in the sense that the semi-elasticity coefficient r of σ ( x ) ( that is | log ( σ ( x0 ) ) −log ( σ ( x1 ) ) | ≤ r‖x0−x1‖ ∀x0 , x1 ∈ RN ) in a high-dimensional setting is restricted to be very small . This means , that even if we wanted to vary the σ ( x ) significantly with varying x , we can ’ t . The maximal reasonable speed of change of σ ( x ) turns out to be almost too small to handle , especially in high dimensions . Third , in contrast , we also study the conditions on σ ( x ) under which it is applicable in high-dimensional regime and prepare a theoretical framework necessary to build an efficient certification algorithm . We are the first to do so for σ ( x ) functions , which are not locally constant ( as in Wang et al . ( 2021 ) ) . Finally , we provide a concrete design of the σ ( x ) function and test it extensively and compare it to the classical RS on the CIFAR10 and MNIST datasets . We discuss to what extent the method treats the issues mentioned above . 2 INPUT-DEPENDENT RS AND THE CURSE OF DIMENSIONALITY . Let C be the set of classes , f : RN −→ C a classifier ( reffered to as the base classifier ) , σ : RN −→ R a non-negative function and P ( C ) a set of distributions over C. Then we call Gf : RN −→ P ( C ) the smoothed class probability predictor , if Gf ( x ) C = P ( f ( x + ) = C ) , where ∼ N ( 0 , σ ( x ) 2I ) and gf : RN −→ C is called smoothed classifier if gf ( x ) = arg maxC Gf ( x ) C , for C ∈ C. We will omit the subscript f in gf often , since it is usually clear from the context , to which base classifier the g corresponds . Furthermore , let A : = g ( x ) refer to the most likely class under the random variable f ( N ( x , σ2I ) ) , while B denote the second most likely class . Define pA = Gf ( x ) A and pB = Gf ( x ) B as the respective probabilities . It is important to note that in practice , it is impossible to estimate pA and pB precisely . Instead , pA is estimated as a lower confidence bound ( LCB ) of the relative occurence of class A in f ’ s predictions given certain number of Monte-Carlo samples n and a confidence level α and the estimate is denoted as pA. We use the exact Clopper-Pearson interval for estimation of the LCB . Similarly for pB . We work with l2-norms denoted as ‖x‖ . First of all , we summarize the main steps in the derivation of certified radius using any method that relies on a use of Neyman-Pearson lemma . 1 . For a potential adversary x′ specify the worst-case classifier f∗ , such that P ( f∗ ( N ( x , σ2I ) ) = A ) = pA , while P ( f∗ ( N ( x′ , σ2I ) ) = B ) is maximized . 2 . Express the probability Gf∗ ( x′ ) B as a function depending on x ′ . 3 . Determine the conditions on x′ ( possibly related to ‖x− x′‖ ) for which this probability is ≤ 0.5 . From these condtions , derive the certified radius . Cohen et al . ( 2019 ) proceeded in this way to obtain a tight certified radius R = σ2 ( Φ −1 ( pA ) − Φ−1 ( pB ) ) . Unfortunately , their result is not directly applicable to the input-dependent case . The constant σ simplifies the derivation of f∗ that turns out to be a linear classifier . This is not the case for non-constant σ ( x ) anymore . Therefore , we need to generalize the methodology of Cohen et al . ( 2019 ) . We put pB = 1−pA for simplicity ( yet it is not necessary to assume this , see Appendix B.5 ) . Let x0 be the point to certify , x1 the potential adversary point , δ = x1−x0 the noise and σ0 = σ ( x0 ) , σ1 = σ ( x1 ) the standard deviations used in x0 and x1 respectively . Furthermore , let fi be a density and Pi a probability measure corresponding to N ( xi , σ2i I ) , i ∈ { 0 , 1 } . Lemma 1 . Out of all possible classifiers f such that Gf ( x ) B ≤ pB = 1 − pA , the one , for which Gf ( x+ δ ) B is maximized is the one , which predicts classB in a region determined by the likelihood ratio : B = { x ∈ RN : f1 ( x ) f0 ( x ) ≥ 1 r } , where r is fixed , such that P0 ( B ) = pB . Note , that we use B to denote both the class and the region of that class . We use this lemma to compute the decision boundary of the worst-case classifier f∗ . Theorem 2 . If σ0 > σ1 , then B is a N -dimensional ball with the center at S > and radius R > : S > = x+ σ20 σ20 − σ21 δ , R > = √ σ20σ 2 1 ( σ20 − σ21 ) 2 ‖δ‖2 + 2N σ 2 0σ 2 1 σ20 − σ21 log ( σ0 σ1 ) + 2σ20σ 2 1 σ20 − σ21 log ( r ) . If σ0 < σ1 , then B is the complement of a N -dimensional ball with the center at S < and radius R < : S < = x− σ20 σ21 − σ20 δ , R < = √ 2σ40 − σ20σ21 ( σ21 − σ20 ) 2 ‖δ‖2 + 2N σ 2 0σ 2 1 σ21 − σ20 log ( σ1 σ0 ) − 2σ 2 0σ 2 1 σ21 − σ20 log ( r ) . As we depict on Figure 2 , both resulting balls are centered on the line connecting x0 , x1 . Moreover , the centers of the balls are always further from x0 , than x1 is from x0 ( even in the case σ0 < σ1 ) . In both cases , it depends on pA ( since r is fixed such that P0 ( B ) = pB ) and the ball can , but might not cover x0 and/or x1 . Note that if σ0 = σ1 , what can happen even in input-dependent regime , the worst-case classifier is the half-space described by Cohen et al . ( 2019 ) . To compute the probability of a ball under a probability measure with an isotropic Gaussian density is far more challenging than to compute the probability of a half-space . In fact , there is no closedform formula for such probability . However , this probability is connected to the non-central chisquare distribution ( NCCHSQ ) . More precisely , the probability of an N -dimensional ball centered at z with radius r under N ( 0 , I ) can be expressed as a cumulative distribution fucntion ( cdf ) of NCCHSQ with N degrees of freedom , non-centrality parameter ‖z‖2 and argument r2 . With this knowledge , we can express P0 ( B ) and P1 ( B ) in terms of the cdf of NCCHSQ as follows . Theorem 3 . P0 ( B ) = χ2N ( σ20 ( σ20 − σ21 ) 2 ‖δ‖2 , R2 < , > σ20 ) , P1 ( B ) = χ2N ( σ21 ( σ20 − σ21 ) 2 ‖δ‖2 , R2 < , > σ21 ) , where the sign < or > is chosen according to the inequality between σ0 and σ1 . Note , that both Theorem 2 and Theorem 3 work well also for δ = 0 . In this case , we encounter a ball centered at x0 = x1 and all the cdf functions become cdf functions of central chi-squared . We expressed probabilities of the worst-case class B ’ s decision region using the cdf of NCCHCSQ . Now , how do we do the certification ? We start with the certification just for two points , x0 and x1 . We question , under which circumstances can x1 be certified from the point of view of x0 . Having x0 , pA and σ0 > σ1 , we can obtain such R , that P0 ( B ) = χ2N ( ‖δ‖2σ20/ ( σ20 − σ21 ) 2 , R2 ) = 1 − pA = pB simply by putting it into the quantile function : R2 = χ2N , qf ( ‖δ‖2σ20/ ( σ20 − σ21 ) 2 , 1− pA ) . Then , we can substitute into P1 ( B ) = χ2N ( ‖δ‖2σ21/ ( σ20 − σ21 ) 2 , R2σ20/σ21 ) . This way , we obtain P1 ( B ) and can judge , whether P1 ( B ) < 1/2 or not . Similar computation can be done if σ0 < σ1 . Denote a : = ‖δ‖ . We can express the P1 ( B ) more simply for σ0 > σ1 as ξ > ( a ) : = P1 ( B ) = χ2N ( σ21 ( σ20 − σ21 ) 2 a2 , σ20 σ21 χ2N , qf ( σ20 ( σ20 − σ21 ) 2 a2 , 1− pA ) ) and for σ0 < σ1 as ξ < ( a ) : = P1 ( B ) = 1− χ2N ( σ21 ( σ21 − σ20 ) 2 a2 , σ20 σ21 χ2N , qf ( σ20 ( σ21 − σ20 ) 2 a2 , pA ) ) . With this in mind , if we have x0 , x1 , pA , σ0 , σ1 , then we can certify x1 w.r.t x0 simply by choosing the correct sign ( < , > ) and computing ξ < ( ‖x0 − x1‖ ) or ξ > ( ‖x0 − x1‖ ) , comparing them with 0.5 . The sample plots of these ξ functions can be found in Appendix B . Now , we are ready to discuss the curse of dimensionality . The problem that arises is that having a high dimension N and σ0 , σ1 differing a lot from each other , ξ functions are already big at 0 , even for considerably small pB . For fixed ratio σ0/σ1 and probability pB , with increasing dimension , the ξ ( 0 ) increases and soon becomes bigger than 0.5 . This , together with monotonicity of ξ function yields that any x1 can not be certified w.r.t . x0 , if σ0 , σ1 are used . The more dissimilar the σ0 and σ1 are , the smaller the dimension N needs to be for this situation to occur . If we want to certify x1 in a reasonable distance from x0 , we need to use similar σ0 , σ1 . This restricts the variability of σ ( x ) function . We will formalize the curse of dimensionality in the following theorems . More on why the curse of dimensionality is present is in Appendix B.2 . Theorem 4 ( curse of dimensionality ) . Let x0 , x1 , pA , σ0 , σ1 , N be as usual . Then , the following two implications hold : 1 . If σ0 > σ1 and log ( σ21 σ20 ) + 1− σ 2 1 σ20 < 2 log ( 1− pA ) N , then x1 is not certified w.r.t . x0 . 2 . If σ0 < σ1 and log ( σ21 σ20 N − 1 N ) + 1− σ 2 1 σ20 N − 1 N < 2 log ( 1− pA ) N , then x1 is not certified w.r.t . x0 . Corollary 5 ( one-sided simpler bound ) . Let x0 , x1 , pA , σ0 , σ1 , N be as usual and assume now σ0 > σ1 . Then , if σ1 σ0 < √ 1− 2 √ − log ( 1− pA ) N , then x1 is not certified w.r.t x0 . Note , that both Theorem 4 and Corrolary 5 can be adjusted to the case where we have a separate estimate pB and do not put pB = 1− pA ( see Appendix B.5 ) . We must emphasize , that the bounds obtained in Theorem 4 are very tight . In other words , if the ratio σ1σ0 is just slightly bigger than the minimal possible threshold determined in Theorem 4 , ξ > ( 0 ) becomes smaller than 0.5 and similarly for ξ > ( 0 ) . The reason for this is , that the only two estimates used in the proof of Theorem 4 are the estimates on the median , which are very tight and constant with respect to N and the Chernoff bound , which is generally considered to be tight too and improves for larger N . The tightness is depicted on Figure 3 , where we plot the minimal possible threshold σ1/σ0 given by Theorem 4 and minimal threshold for which ξ > ( 0 ) < 0.5 as a function of N . To get a better feeling about the concrete numbers , we provide a simple table , which shows the theoretical threshold values provided by Theorem 4 . If σ1/σ0 is smaller than the threshold , we are not able to certify any pair of x0 , x1 using σ0 , σ1 . Results from Table 1 are very restrictive . Assume we have a CIFAR10 sample with pA = 0.999 . For such a probability , constant σ = 0.5 is more than sufficient to guarantee the certified radius of more than 1 . However , in the non-constant regime , to certify R ≥ 1 , we first need to guarantee that no sample within the distance of 1 from x0 uses σ1 < 0.953σ0 . To even strengthen this statement , note that one needs to guarantee σ1 to be even much closer to σ0 in practice . Why ? The results of Theorem 4 lower-bound the ξ functions at 0 . However , since ξ functions are strictly increasing ( as shown in Appendix F ) , one usually needs σ0 and σ1 to be much closer to each other to guarantee ξ being smaller than 0.5 at a 0 . This not only forces the σ ( x ) function to have really small semielasticity but also makes it problematic to define a stochastic σ ( x ) . For more , see Appendix B.2 . To fully understand , how the curse of dimensionality affects the usage of IDRS , we mention two more significant effects . First , with increasing dimension , the average distance between samples tends to grow as √ N . This enables bigger distance to change σ ( x ) . On the other hand , the average level of σ ( x ) used ( like ∼ 0.12 , 0.25 , . . . ) needs to be adjusted also as √ N with increasing dimension . The bigger average level of σ ( x ) we use , the more is the semi-elasticity of σ ( x ) restricted by Theorem 4 and Theorem 7 . All together , these two effects combine in a final trend that for σ0 and σ1 being variances used in two random test samples , |σ0/σ1 − 1| is restricted to go to 0 as 1/ √ N. For detailed explanation , see Appendix B.4 .

Summary: This paper studies the input-dependent randomized smoothing technique - it adds isotropic Gaussian noise with different variance on different input x to give robustness certificates.  The hope is that this can perform better than applying a uniform noise.  The main theoretical claim in this paper is that when adding input dependent isotropic Gaussian noise, the variance of the noise should not change too much among different inputs. Based on this, the authors propose an input dependent smoothing mechanism based on k-nearest neighbor and evaluate its performance on MNIST and CIFAR datasets.