$\ell_1$ Adversarial Robustness Certificates: a Randomized Smoothing Approach

1 INTRODUCTION . have done a series of nice works in practical sights or theoretical sights ( Zheng et al. , 2016 ; Gouk et al. , 2018 ) . Among them , certifiably robustness is valuable , since it can withstand all attacks within a norm ball and has a nice theoretical and practical outcome . However , most work can not deal with the case for general neural networks . Deep networks are flexible models that are widely adopted in various applications . However , it has been shown that such models are vulnerable against adversary ( Szegedy et al. , 2014 ) . Concretely , an unnoticeable small perturbation on the input can cause a typical deep model to change predictions arbitrarily . The phenomenon raises the concerns of the security of deep models , and hinders its deployment in decision-critical applications . Indeed , the certification of robustness is a pre-requisite when AI-generated decisions may have important consequences . Certifying the robustness of a machine learning model is challenging , especially for modern deep learning models that are over-parameterized and effectively black-box . Hence , the existing approaches mainly rely on empirical demonstration against specific adversarial attack algorithms ( Goodfellow et al. , 2015 ; Madry et al. , 2018 ; Finlay et al. , 2019 ) . However , this line of works can give a false sense of security . Indeed , successful defense against the existing attack algorithms does not guarantee actual robustness against any adversaries that may appear in the future . Recently , the adversarial robustness community has shifted the focus towards establishing certificates that prove the robustness of deep learning models . The certificate can be either exact or conservative , so long as the certified region can not exhibit any adversarial examples . Given the over-parameterized deep models and modern high-dimensional datasets , scalability becomes a key property for the certification algorithms , as many methods are computationally intractable . Our work is based on the novel modeling scheme that generates ensembles of a fixed black-box classifier based on input randomization ( Cohen et al. , 2019 ) . Under this framework , tight robustness certificates can be obtained with only the ensemble prediction values and randomization parameters . Given appropriate choices of distributions , the robustness guarantee can be derived for ` 2 or ` 0 norms ( Cohen et al. , 2019 ; Lee et al. , 2019 ) . The tightness simply implies that any point outside the certified region is an adversarial example in the worst case . However , the derivations of the previous results heavily relies on the fact that the target norm ( ` 2 or ` 0 ) is symmetric , therefore analyzing any perturbation direction for attacking the model gives the same certification guarantee . In contrast , ` 1 norm is asymmetric . That is , for a given ` 1 ball centered at the origin , if we move another ` 1 ball also from the origin by a distance δ , where ‖δ‖1 is fixed , then the overlapped region between the two ` 1 balls may have different shapes and sizes ( See Figure 1 ) . The characterization of this overlapped region is the key step for proving tight certificates , hence the existing techniques do not apply for ` 1 norm . In this work , we derive a tight ` 1 robustness guarantee under isotropic Laplace distributions . The Laplace distribution can be interpreted as an infinite mixture of uniform distributions over ` 1-norm balls , which is a natural “ conjugate ” distribution for ` 1 norm . Due to asymmetry , we first identified the tight robustness certificate for attacking the model in one particular direction , δ = ( ‖δ‖1 , 0 , · · · , 0 ) . To show that other perturbation directions can not lead to worse results , we convert the d dimensional likelihood function into an one dimensional function , where we apply relaxation for various δ and show that the worst case result is bounded by the specific direction ( ‖δ‖1 , 0 , · · · , 0 ) . Theoretically , our certificate is tight in the binary classification setting . In the multi-class classification setting , our certificate is always tighter than the previous certificate proposed by Lecuyer et al . ( 2019 ) . The theoretical improvement always leads to superior empirical results on certifying the same model , where we demonstrate the result on CIFAR-10 and ImageNet with ResNet models . Moreover , the proposed robustness certificate on models smoothed by Laplace distributions also outperforms the same models trained and certified using Gaussian distributions ( Cohen et al. , 2019 ) in ` 1 certified robustness , where the Gaussian-based robustness certificate is adapted from ` 2 norm . 2 RELATED WORK . Robustness of a model can be defined in various aspects . For example , Feynman-Kac Formalism can be used to improve robustness ( Wang et al. , 2018 ) . In this paper , we focus on the classification setting , where the goal is to provide guarantee of a constant prediction among a small region specified via some metric . The robustness certificate can be either exact or conservative , so long as a constant prediction is guaranteed in the certified region . Note that the certification of a completely black-box model requires checking the prediction values at every point around the point of interest , which is clearly infeasible . A practical certification algorithm inevitably has to specify and leverage the functional structure of the classifier in use to reduce the required computation . Exact certificates . The exact certificate of deep networks is typically derived for the networks with a piecewise linear activation function such as ReLU . Such networks have an equivalent mixed integer linear representation ( Cheng et al. , 2017 ; Lomuscio & Maganti , 2017 ; Dutta et al. , 2017 ; Bunel et al. , 2018 ) . Hence , one may apply mixed integer linear programming to find the worst case adversary within any convex polyhedron such as an ` 1-ball or ` ∞-ball . Despite the elegant solution , the complexity is , in general , NP-hard and the algorithms are not scalable to large problems ( Tjeng et al. , 2017 ) . Conservative certificates . A conservative certificate can be more scalable than the exact methods , since one can trade-off the accuracy of certification with efficiency ( Gouk et al. , 2018 ; Tsuzuku et al. , 2018 ; Cisse et al. , 2017 ; Anil et al. , 2018 ; Hein & Andriushchenko , 2017 ) . For example , one can relax the search of the worst case adversary as a simpler optimization problem that only bounds the effect of such adversary . Alternatively , people also consider the robustness problem in a modular way , where the robustness guarantee can be derived iteratively for each layer in the deep networks by considering the feasible values for each hidden layer ( Gowal et al. , 2018 ; Weng et al. , 2018 ; Zhang et al. , 2018 ; Mirman et al. , 2018 ; Singh et al. , 2018 ) . However , this line of works have not yet been demonstrated to be feasible to realistic networks in high dimensional problems like ImageNet . Randomized smoothing . Randomized smoothing has been proved to be closely related to robustness . Although similar techniques have been tried by ( Liu et al. , 2018 ; Cao & Gong , 2017 ) , no corresponding proofs have been given ; Li et al . ( 2018 ) and Cohen et al . ( 2019 ) have proved certified robustness of ` 2 norm under isotropic Gaussian noise , and Lee et al . ( 2019 ) proved robustness for ` 0 form . Lecuyer et al . ( 2019 ) use techniques from differential privacy to prove ` 1 robustness under Gaussian and Laplace noise respectively , but the bounds are not tight . Li et al . ( 2018 ) ; Pinot et al . ( 2019 ) use Rényi divergence framework without tightness proof . Our results synthesize the ideas in ( Cohen et al. , 2019 ; Lee et al. , 2019 ; Lecuyer et al. , 2019 ; Li et al. , 2018 ; Pinot et al. , 2019 ) and prove the tight robustness radius under the binary classification setting . 3 PRELIMINARIES . Definition 1 ( Laplace distribution ) Given λ ∈ R+ , d ∈ Z+ , we use L ( λ ) to denote the Laplace distribution in dimension d with parameter λ . The p.d.f . of L ( λ ) is denoted as L ( x ; λ ) , 1 ( 2λ ) d exp ( −‖x‖1λ ) . As we will see in Lemma 3.1 , in smoothing analysis , we are interested in the likelihood ratio of two random variables X = and Y = δ + ( here ∼ L ( λ ) and δ ∈ Rd is a fixed vector ) . Specifically , µY ( x ) µX ( x ) = exp ( − 1 λ ( ‖x− δ‖1 − ‖x‖1 ) ) Therefore , the likelihood ratio between two d dimensional random variables is controlled by a one dimensional random variable T ( x ) , ‖x − δ‖1 − ‖x‖1 , where x ∼ L ( λ ) . This transformation is crucial in our analysis , and it is easy to see that T ( x ) is a mixed random variable , since Px ( T ( x ) = ‖δ‖1 ) > 0 . In our analysis , we need to calculate the inverse of c.d.f . of T ( x ) . However , since T ( x ) is a mixed random variable , sometimes the inverse may not exist . See Figure 3 for illustration , where the inverse of the probability 0.85 does not exist . To deal with this case , we have the following modified version of Neyman-Pearson Lemma , with the proof in Appendix A. Lemma 3.1 ( Neyman-Pearson Lemma for mixed random variables ) . Let X ∼ L ( λ ) and Y ∼ L ( λ ) + δ . Let h : Rd → { 0 , 1 } be any deterministic or random function . Given any β ∈ R , and S′ ⊆ { z ∈ Rd : ‖z − δ‖1 − ‖z‖1 = β } : 1 . If S = { z ∈ Rd : ‖z − δ‖1 − ‖z‖1 > β } ∪ S′ , and P ( h ( X ) = 1 ) ≥ P ( X ∈ S ) then P ( h ( Y ) = 1 ) ≥ P ( Y ∈ S ) 2 . If S = { z ∈ Rd : ‖z − δ‖1 − ‖z‖1 < β } ∪S′ , and P ( h ( X ) = 1 ) ≤ P ( X ∈ S ) , then P ( h ( Y ) = 1 ) ≤ P ( Y ∈ S ) 4 MAIN RESULTS . In this paper , we apply the randomized smoothing technique ( Cohen et al. , 2019 ) for getting robustness certificates , which works as follows . Given an input x , we perturb it with , s.t . ∼ L ( λ ) . Then instead of evaluating the robustness of the original function f ( x ) , we evaluate g ( x ) , arg maxc P ( f ( x+ ) = c ) , which is effectively the smoothed version of f ( x ) .

Summary: The authors propose a new certified classifier in \ell_1 norm that is tight. That is to say, upon smoothing a given classifier f with Laplacian noise, a smoothed version of that classifier (probabilistic maximum majority vote) is certified with a radius measured in \ell_1 norm. The authors show that this bound is tight for binary classifiers. These results are complementary to Cohen et al. results.