Filling the Soap Bubbles: Efficient Black-Box Adversarial Certification with Non-Gaussian Smoothing

1 INTRODUCTION . Deep neural networks have achieved state-of-the-art performance on many tasks such as image classification ( He et al. , 2016 ; Lu et al. , 2018 ) and language modeling ( Devlin et al. , 2019 ) . Nonetheless , modern deep learning models have been shown to be highly sensitive to small and adversarially crafted perturbations on the inputs ( Goodfellow et al. , 2015 ) , which means a human-imperceptible changes on inputs could cause the model to make dramatically different predictions . Although many robust training algorithms have been developed to overcome adversarial attacking , most heuristically developed methods can be shown to be broken by more powerful adversaries eventually , ( e.g. , Athalye et al. , 2018 ; Madry et al. , 2018 ; Zhang et al. , 2019 ; Wang et al. , 2019 ) . This casts an urgent demand for developing robust classifiers with provable worst case guarantees . One promising approach for certifiably robustness is the recent randomized smoothing method ( e.g. , Cohen et al. , 2019 ; Salman et al. , 2019 ; Lee et al. , 2019 ; Li et al. , 2019 ; Lecuyer et al. , 2018 ) , which constructs smoothed classifiers with certifiable robustness by introducing noise on the inputs . Compared with the other more traditional verification approaches ( e.g . Wong & Kolter , 2017 ; Jordan et al. , 2019 ; Dvijotham et al. , 2018 ) that exploits special structures of the neural networks ( such as the properties of ReLU ) , the randomized smoothing methods work more flexibly on general blackbox classifiers and is shown to be more scalable and provide tighter bounds on challenging datasets such as ImageNet ( Deng et al. , 2009 ) . However , the existing randomized smoothing methods can only work against ` 2 attack , in which the perturbations are allowed within an ` 2 ball of certain radius . A stronger type of attack , such as the ` ∞ attacks , is much more challenging to defense and verify due to the larger set of perturbations , but is more relevant in practice . In addition , all the existing randomized smoothing methods use Gaussian noise for smoothing . Although appearing to be a natural choice , one of our key observations is that Gaussian distributions is in fact a rather sub-optimal choice in high dimensional spaces , even for ` 2 attack . This is due to a counter-intuitive phenomenon in high dimensional spaces ( Vershynin , 2018 ) that almost all of the probability mass of standard Gaussian distribution concentrates around the sphere of radius one ( and hence “ soap bubble ” in the title ) , instead of the center point ( which corresponds to the original input ) . As a result , the variance of the Gaussian noise needs to be sufficiently small to yield good approximation to the original classifiers ( by squeezing the “ soap bubble ” towards the center point ) , which , however , makes it difficult to verify due to the small noise . Further , for the more challenging ` ∞ attack , Gaussian smoothing provably degenerates in high dimensions . Our contribution We propose a general framework of adversarial certification using nonGaussian smoothing noises , based on a new perspective from variational optimization . Our framework re-derives the method of Cohen et al . ( 2019 ) as a special case , and is applicable to more general families of non-Gaussian smoothing distributions and more types of attacks beyond ` 2 norm . Importantly , our new framework reveals a fundamental trade-off between accuracy and robustness for guiding better choices of smoothing distributions . Leveraging our insight , we develop two new families of distributions for better certification results on ` 2 and ` ∞ attacks , respectively . Efficient computational approaches are developed to enable our method in practice . Empirical results show that our new framework and smoothing distributions significantly outperform the existing approaches for both ` 2 and ` ∞ attacking , on challenging datasets such as CIFAR-10 and ImageNet . 2 RELATED WORKS . Empirical Defenses Since Szegedy et al . ( 2013 ) and Goodfellow et al . ( 2015 ) , many previous works have focused on utilizing small perturbation δ under certain constraint , e.g . in a ` p norm ball , to attack a neural network . Adversarial training ( Madry et al. , 2018 ) and its variants ( Kannan et al. , 2018 ; Zhang & Wang , 2019 ; Zhai et al. , 2019 ) are the most successful defense methods to date , in which the network is forced to solve a mini-max game between the defender and attacker with adversarial examples as data augmentation . However , these empirical defense methods are still easy to be broken and can not provide provable defense . Certified Defenses Unlike the empirical defense methods , once a classifier can guarantee a constant classification within a local region , it is called a robust certificate . Exact certification methods provide the minimal perturbation condition which leads to a different classification result . This line of work focus on deep neural networks with ReLU-like activation that makes the classifier a piece-wise linear function . This enables researchers to introduce satisfiability modulo theories ( Carlini et al. , 2017 ; Ehlers , 2017 ) or mix integer linear programming ( Cheng et al. , 2017 ; Dutta et al. , 2018 ) . Sufficient certification methods take a conservative way and try to bound the Lipschitz constant or other information of the network ( Jordan et al. , 2019 ; Wong & Kolter , 2017 ; Raghunathan et al. , 2018 ; Zhang et al. , 2018 ) . However , these certification strategies share a drawback that they are not feasible on large-scale scenarios , e.g . large enough practical networks , large enough datasets . Randomized Smoothing To mitigate this limitation of previous certifiable defenses , improving network robustness via randomness has been recently discussed ( Xie et al. , 2018 ; Liu et al. , 2018 ) . In certification community , Lecuyer et al . ( 2018 ) first introduced randomization with technique in differential privacy . Li et al . ( 2019 ) improved their work with a bound given by Rényi divergence . In succession , Cohen et al . ( 2019 ) firstly provided a tight bound for arbitrary Gaussian smoothed classifiers based on previous theorems found by Li & Kuelbs ( 1998 ) . Salman et al . ( 2019 ) combined the empirical and certification robustness , by applying adversarial training on randomized smoothed classifiers to achieve a higher certified accuracy . Lee et al . ( 2019 ) focused on ` 0 norm perturbation setting , and proposed a discrete smoothing distribution to beat the Gaussian distribution baseline . Similar to ( Lee et al. , 2019 ) , we also focus on finding a suitable distribution to trade-off accuracy and robustness for different types of adversarial attacks , such as ` 2 and ` ∞ . 3 BLACK-BOX CERTIFICATION WITH VARIATIONAL OPTIMIZATION . We start with introducing the background of adversarial certification problem and and randomized smoothing method . We then introduce in Section 3.1 our general framework of adversarial certification using non-Gaussian smoothing noises , from a new variational optimization perspective . Our framework includes the method of Cohen et al . ( 2019 ) as a special case , and reveals a critical trade-off between accuracy and robustness that provides important guidance for better choices of smoothing distributions in Section 4 . Adversarial Certification We consider binary classification of predicting binary labels y ∈ { 0 , 1 } from feature vectors x ∈ Rd for simplicity . The extension to multi-class cases is straightforward , and is discussed in Appendix D. Assume f ] : Rd → [ 0 , 1 ] is a pre-trained binary classifier ( ] means the classifier is given ) , which maps from the feature space Rd to either the class probability in interval [ 0 , 1 ] or the binary labels in { 0 , 1 } . In the robustness certification problem , a testing data point x0 ∈ Rd is given , and one is asked to verify if the classifier outputs the same prediction when we perturb the input x0 arbitrarily in B , a given neighborhood of x0 . Specifically , let B be a set of possible perturbation vectors , e.g. , B = { δ ∈ Rd : ‖δ‖p ≤ r } for ` p norm with a radius r. If the classifier predicts y = 1 on x0 , i.e . f ] ( x0 ) > 1/2 , we want to verify if f ] ( x0 + δ ) > 1/2 holds for any δ ∈ B . In this paper , we consider two types of attacks , including the ` 2 attack B ` 2 , r def = { δ : ‖δ‖2 ≤ r } , and the ` ∞ attack B ` ∞ , r def = { δ : ‖δ‖∞ ≤ r } . More general ` p attack can also be handled by our framework but is left as future works . Black-box Certification with Randomness Directly verifying f ] heavily relies on the smoothness of f ] , which has been explored in a series of recent works ( Lecuyer et al. , 2018 ; Wong & Kolter , 2017 ) . These methods typically depend on the special structure property ( e.g. , the use of ReLU units ) of f ] , and thus can not serve as general purpose algorithms . We are instead interested in black-box verification methods that could work for arbitrary classifiers . One approach to enable this , as explored in recent works ( Cohen et al. , 2019 ; Lee et al. , 2019 ) , is to replace f ] with a smoothed classifier by convovling with Gaussian noise , and verify the smoothed classifier . Specifically , assume π0 is a smoothing distribution with zero mean and bounded variance , e.g. , π0 = N ( 0 , σ2 ) . The randomized smoothed classifier is defined by f ] π0 ( x0 ) : = Ez∼π0 [ f ] ( x0 + z ) ] , which returns the averaged probability of x0 + z under the perturbation of z ∼ π0 . Assume we replace the original classifier with f ] π0 , then the goal becomes verifying f ] π0 using its inherent smoothness . Specifically , if f ] π0 ( x0 ) > 1/2 , we want to verify that f ] π0 ( x0 + δ ) > 1/2 for every δ ∈ B , that is , min δ∈B f ] π0 ( x0 + δ ) = minδ∈B Ez∼π0 [ f ] ( x0 + z + δ ) ] > 1/2 . ( 1 ) In this case , it is sufficient to obtain a guaranteed lower bound of minδ∈B f ] π0 ( x0 + δ ) and check if it is larger than 1/2 . When π0 is Gaussian N ( 0 , σ2 ) and for ` 2 attack , this problem was studied in Cohen et al . ( 2019 ) , which shows that a lower bound of min z∈B Ez∼π0 [ f ] ( x0 + z ) ] ≥ Φ ( Φ−1 ( f ] π0 ( x0 ) ) − r/σ ) , ( 2 ) where Φ ( · ) is the cumulative density function ( CDF ) of standard Gaussian distribution , and Φ−1 ( · ) represents its inverse function . The proof of this result in Cohen et al . ( 2019 ) uses NeymanPearson lemma ( Li & Kuelbs , 1998 ) , while in the following section another derivation using variational optimization is provided . Note that the bound in Equation ( 2 ) is tractable since it only requires to evaluate the smoothed classifier f ] π0 ( x0 ) at the original image x0 , instead of solving the difficult adversarial optimization over perturbation z in Equation ( 1 ) . In practice , f ] π0 ( x0 ) is approximated by Monte Carlo approximation with a non-asymptotic confidence bound .

Summary: This paper presents a new method for adversarial certification using non-Gaussian noise. A new framework for certification is proposed, which allows to use different distributions compared to previous work based on Gaussian noise. From this framework, a trade-off between accuracy and robustness is identified and new distributions are proposed to obtain a better trade-off than with Gaussian noise. Using these new distributions, they re-certify models obtained in previous work.