A FRAMEWORK  FOR ROBUSTNESS CERTIFICATION  OF SMOOTHED CLASSIFIERS USING  F-DIVERGENCES

1 INTRODUCTION . Predictors obtained from machine learning algorithms have been shown to be vulnerable to making errors when the inputs are perturbed by carefully chosen small but imperceptible amounts ( Szegedy et al. , 2014 ; Biggio et al. , 2013 ) . This has motivated significant amount of research in improving adversarial robustness of a machine learning model ( see , e.g . Goodfellow et al. , 2015 ; Madry et al. , 2018 ) . While significant advances have been made , it has been shown that models that were estimated to be robust have later been broken by stronger attacks ( Athalye et al. , 2018 ; Uesato et al. , 2018 ) . This has led to the need for methods that offer provable guarantees that the predictor can not be forced to misclassify an example by any attack algorithm restricted to produce perturbations within a certain set ( for example , within an ` p norm ball ) . While progress has been made leading to methods that are able to compute provable guarantees for several image and text classification tasks ( Wong & Kolter , 2018 ; Wong et al. , 2018 ; Raghunathan et al. , 2018 ; Dvijotham et al. , 2018 ; Katz et al. , 2017 ; Huang et al. , 2019 ; Jia et al. , 2019 ) , these methods require extensive knowledge of the architecture of the predictor and are not easy to extend to new models or architectures , requiring specialized algorithms for each new class of models . Furthermore , the computational complexity of these methods grows significantly with input dimension and model size . To deal with these obstacles , recent work has proposed the randomized smoothing strategy for verifying the robustness of classifiers . Specifically , Lecuyer et al . ( 2019 ) and Cohen et al . ( 2019 ) ∗Work done during an internship at DeepMind . have shown that robustness properties can be more easily verified for the smoothed version of a base classifier h producing labels in some set Y : hs ( x ) = arg max y∈Y P X∼µ ( x ) [ h ( X ) = y ] , ( 1 ) where the labels returned by the smoothed classifier hs are obtained by taking a “ majority vote ” over the predictions of the original classifier h on random inputs drawn from a probability distribution µ ( x ) , called the smoothing measure . Lecuyer et al . ( 2019 ) showed that verifying the robustness of this smoothed classifier is significantly simpler than verifying the original classifier h and only requires estimating the distribution of outputs of the classifier under random perturbations of the input , but does not require access to the internals of the classifier h. We refer to this as black-box verification . In this work , we develop a general framework for black-box verification that recovers prior work as special cases , and improves upon previous results in various ways . Contributions Our contributions are summarized as follows : 1 . We formulate the general problem of black-box verification via a generalized randomized smoothing procedure , which extends existing approaches to allow for arbitrary smoothing measures . Specifically , we show that robustness certificates for smoothed classifiers can be obtained by solving a small convex optimization problem when allowed adversarial perturbations can be characterized via divergence-based bounds on the smoothing measure . 2 . We prove that our certificates generalize previous results obtained in related work ( Lecuyer et al. , 2019 ; Cohen et al. , 2019 ; Li et al. , 2019 ) , and vastly extend the class of perturbations and smoothing measures that can be used while still allowing certifiable guarantees . 3 . We introduce the notion of full-information and information-limited settings , and show that the information-limited setting that has been the main focus of prior work leads to weaker certificates for smoothed probabilistic classifiers , and can be improved by using additional information ( the distribution of label scores under randomized smoothing ) . 4 . We evaluate our framework experimentally on image and classification tasks , obtaining robustness certificates that improve upon other black-box methods either in terms of certificate tightness or computation time on robustness to ` 0 , ` 1 or ` 2 perturbations on MNIST , CIFAR-10 and ImageNet . ` 2 perturbations result from worst-case realizations of white noise that is common in many image , speech and video processing . ` 0 perturbations can model missing data ( missing pixels in an image , or samples in a time-domain audio signal ) while ` 1 perturbations can be used to model convex combinations of discrete perturbations in text classification ( Jia et al. , 2019 ) . We also obtain the first , to the best of our knowledge , certifiably robust model for an audio classification task , Librispeech ( Panayotov et al. , 2015 ) , with variable-length inputs . 2 BLACK-BOX VERIFICATION FOR SMOOTHED CLASSIFIERS . Consider a binary classifier h : X → { ±1 } given to us as a black box , so we can only access the inputs and outputs of h but not its internals . We are interested in investigating the robustness of the smoothed classifier hs ( defined in Eq . 1 ) against adversarial perturbations of size at most with respect to a given norm ‖·‖ . To determine whether a norm-bounded adversarial attack on a fixed input x ∈ X with hs ( x ) = +1 could be successful , we can solve the optimization problem min ‖x′−x‖≤ P X′∼µ ( x′ ) [ h ( X ′ ) = +1 ] , ( 2 ) and check whether the minimum value can be smaller than 12 . This is a non-convex optimization problem for which we may not even be able to compute gradients since we only have black-box access to h. While techniques have been developed to address this problem , obtaining provable guarantees on whether these algorithms actually find the worst-case adversarial perturbation is difficult since we do not know anything about the nature of h. Motivated by this difficulty , we take a different approach : Rather than studying the adversarial attack in the input space X , we study it in the space of probability measures over inputs , denoted by P ( X ) . Formally , this amounts to rewriting Eq . 2 as min ν∈ { µ ( x′ ) : ‖x′−x‖≤ } P X′∼ν [ h ( X ′ ) = +1 ] . ( 3 ) This is an infinite dimensional optimization problem over the space of probability measures ν ∈ P ( X ) subject to the constraint ν ∈ D = { µ ( x′ ) : ‖x′ − x‖ ≤ } . While this set is still intractable to deal with , we can consider relaxations of this set defined by divergence constraints between ν and ρ = µ ( x ) , i.e. , D ⊆ { ν : D ( ν‖ρ ) ≤ D } where D denotes some divergence between probability distributions . We will show in Section 3 that for several commonly used divergences ( in fact , for any f -divergence ; cf . Ali & Silvey , 1966 ) , the relaxed problem can be solved efficiently . 2.1 A GENERAL FRAMEWORK FOR ROBUSTNESS CERTIFICATION . To formulate the general verification problem , consider a specification φ : X → Z ⊆ R : a generic function over the input space ( that typically is a function of the classifier output ) that we want to verify has certain properties . Unless otherwise specified , we will assume that X ⊆ Rd ( we work in a d dimensional input space ) . Our framework also involves a reference measure ρ ( in the above example we would take ρ = µ ( x ) ) and a collection of perturbed distributions D ( in the above example we would take D = Dx , = { µ ( x′ ) : ‖x′ − x‖ ≤ } ) . Verifying that a given specification φ is robustly certified is equivalent to checking whether the optimal value of the optimization problem OPT ( φ , ρ , D ) : = min ν∈D E X∼ν [ φ ( X ) ] , ( 4 ) is non-negative . Solving problems of this form is the key workhorse of our general framework for black-box certification of adversarial robustness for smoothed classifiers . Using these ingredients we introduce two closely related certification problems : information-limited robust certification and full-information robust certification . In the former case , we assume that we are given only given access to PX∼ρ [ φ ( X ) = +1 ] , PX∼ν [ φ ( X ) = +1 ] . In the latter case , we are given full-access to specification φ . The definitions are below . Definition 2.1 ( Information-limited robust certification ) . Given reference distribution ρ ∈ P ( X ) , probabilities θa , θb that satisfy θa , θb ≥ 0 , θa + θb ≤ 1 and collection of perturbed distributions D ⊂ P ( X ) containing ρ , define the class of specifications S as S = { φ : X → { −1 , 0 , +1 } s.t . P X∼ρ [ φ ( X ) = +1 ] ≥ θa , P X∼ρ [ φ ( X ) = −1 ] ≤ θb } We say that S is information-limited robustly certified at ρ with respect toD if the following condition holds : EX∼ν [ φ ( X ) ] ≥ 0 for all ν ∈ D , φ ∈ S. Note since we don ’ t have access to φ , we need to prove that EX∼ν [ φ ( X ) ] ≥ 0 ∀ν ∈ D is satisfied for all specifications in set S. Although the information-limited case may seem challenging because we need to provide guarantees that hold simultaneously over a whole class of specifications , it turns out that , for perturbation sets D specified by an f -divergence bound , this certification task can be solved efficiently using convex optimization . Definition 2.2 ( Full-information robust certification ) . Given a reference distribution ρ ∈ P ( X ) , a specification φ : X → Z ⊆ R and a collection of perturbed distributions D ⊂ P ( X ) containing ρ , we say that φ is full-information robustly certified at ρ with respect to D if the following condition holds : EX∼ν [ φ ( X ) ] ≥ 0 for all ν ∈ D. Most often we are dealing with the case where we have full access to the specification φ , thus we should be able to certify using full-information robust certification . However , prior works , Cohen et al . ( 2019 ) and Lecuyer et al . ( 2019 ) , have only provided solutions to certify with respect to the information-limited case where we can not use all of the information about φ . The framework we develop is a more general method that can be used in both information-limited and full-information scenarios . We will demonstrate that our framework recovers certificates provided by Cohen et al . ( 2019 ) , Li et al . ( 2019 ) and dominates Lecuyer et al . ( 2019 ) in the information-limited setting ( see section 5 ) . Further , it can utilize full-information about the specification φ to provide tighter certificates for smoothed probabilistic classifiers ( see section 6 ) . 2.1.1 ROBUSTNESS SPECIFICATION FOR SMOOTHED HARD CLASSIFIERS . We first note that the definitions above are sufficient to capture the standard usage of randomized smoothing as it has been used in past work ( e.g . Lecuyer et al. , 2019 ; Cohen et al. , 2019 ) to verify the robustness of smoothed multi-class classifiers . Specifically , consider smoothing a classifier h : X → Y with a finite set of labels Y using a smoothing measure µ : X 7→ P ( X ) . The resulting randomly smoothed classifier hs is defined in Eq . 1 . Our goal is to certify that the prediction hs ( x ) is robust to perturbations of size at most measured by distance function1 d : X × X 7→ R+ , i.e. , hs ( x ′ ) = hs ( x ) ∀x′ such that d ( x , x′ ) ≤ . ( 5 ) To pose this question within our framework , we choose the reference distribution ρ = µ ( x ) , the set of perturbed distributions Dx , = { µ ( x′ ) : d ( x , x′ ) ≤ } , and the following specifications . Let c = hs ( x ) . For every c′ ∈ Y \ { c } , we define the specification φc , c′ : X 7→ { −1 , 0 , +1 } as follows : φc , c′ ( x ) = +1 if h ( x ) = c , −1 if h ( x ) = c′ , 0 otherwise . Then , Eq . 5 holds if and only if every φc , c′ , c′ 6= c , is robustly certified at µ ( x ) with respect to Dx , ( see Appendix A.1 ) .

Summary: This submission proposes a unified framework for black-box adversarial certification. Based on cohen's and lee's result, it extends the \lambda_TV distance to more general f-divergence. Besides, some other techniques, e.g. reference distribution, are also included in the framework. For L_0 and L_1 perturbation, the proposed framework comes to better results than all the related methods.