Statistical Verification of General Perturbations by Gaussian Smoothing

We present a novel statistical certification method that generalizes prior work based on smoothing to handle richer perturbations . Concretely , our method produces a provable classifier which can establish statistical robustness against geometric perturbations ( e.g. , rotations , translations ) as well as volume changes and pitch shifts on audio data . The generalization is non-trivial and requires careful handling of operations such as interpolation . Our method is agnostic to the choice of classifier and scales to modern architectures such as ResNet-50 on ImageNet . 1 INTRODUCTION . The success of deep neural networks ( Krizhevsky et al. , 2012 ; Silver et al. , 2017 ) and their use in various application domains has triggered a concern to the sensitivity of these models to small , imperceptible perturbations , known as adversarial examples ( Szegedy et al. , 2014 ) . Over the last few years there has been substantial interest in finding adversarial examples ( Carlini & Wagner , 2017 ) , empirically ( Madry et al. , 2018 ) and provably ( Wong & Kolter , 2018 ; Mirman et al. , 2018 ) defending against them as well as proving the neural network is robust to these ( Gehr et al. , 2018 ) . Much of the focus so far has been on restricted , norm-based perturbations and while these cover important attacker models , it has been shown that natural perturbations , e.g. , image rotation , can trigger adversarial behaviors not covered by norm-based attacks ( Engstrom et al. , 2017 ) . In this work we focus on certifying a neural network against a wider class of perturbations , by generalizing a recently presented statistical technique ( Lecuyer et al. , 2018 ; Cohen et al. , 2019 ) , called smoothing , for creating classifiers that are provably robust against certain norm-based attacks . The basic idea behind smoothing is to sample many possible perturbations of the input , classify each of them , and use the aggregate information to make a final robust classification . Overall , the method provides statistical guarantees for l2-norm robustness around a given input ( e.g. , an image ) . In our work , we generalize this method to also handle perturbations of the parameters of a given transformation ( e.g. , the angle of a rotation ) . This generalization means that we can now apply and study the effectiveness of smoothing across a wider range of interesting perturbations ( e.g. , image rotation and translation ) , not previously possible . The generalization is non-trivial and requires careful handling of operations such as interpolation . Our main contributions are : • A generalization of the Gaussian smoothing framework to a richer class of perturbations , with a local robustness guarantee on the parameters of the perturbation . • The first statistical verifier able to certify rotations and translations of images . The system scales to large input sizes and networks such as ImageNet classification . Concretely – among other results – we are the first to create and certify a provable ImageNet classifier ( with high confidence ) for image translation and rotation . • An evaluation showing the strengths and limitations of the smoothing approach across a richer class of perturbations than previously possible . 2 RELATED WORK . We now survey the most closely related work in exact and statistical certification as well as richer perturbations beyond norm-based attacks . Exact Certification : complete and incomplete methods To defend against lp norm bound adversarial examples , many techniques have been developed to verify that a classification is stable in the presence of an attacker . These techniques include complete methods which guarantee a proof of robustness or provide a counter example , such as SMT solvers ( Ehlers , 2017 ; Katz et al. , 2017 ; Bunel et al. , 2018 ) , as well as incomplete methods which are sound but may suffer from false positives due to too much approximation error . Examples of these include abstract interpretation based methods ( Gehr et al. , 2018 ; Gowal et al. , 2018 ; Singh et al. , 2019 ) , linear relaxations ( Zhang et al. , 2018 ; Weng et al. , 2018 ) and semi definite programming ( Raghunathan et al. , 2018 ) . Kurakin et al . ( 2017 ) ; Madry et al . ( 2018 ) train empirically robust networks by including adversarial examples in the training set . Wang et al . ( 2018a ; b ) replace the softmax layer to increase adversarial robustness . While both methods improve empirical robustness , the method does not provide a formal certificate . Provable defenses ( which use incomplete methods ) aim to address the issue to some degree by training networks in a way where they are more provable ( Mirman et al. , 2018 ; Wong & Kolter , 2018 ) . However , because complete methods are not scalable and incomplete methods lose precision ( by design ) , exact formal certification and training of large-scale networks with good absolute guarantees is a challenging task and remains an active area of research . Statistical Certification via Smoothing One can trade the absolute ( exact ) guarantees for probabilistic ones by using smoothed classifiers that scale to much larger networks ( Lecuyer et al. , 2018 ; Li et al. , 2018 ; Cohen et al. , 2019 ; Salman et al. , 2019 ) . A smoothed classifier g can be built out of an ordinary classifier f by taking the majority vote among perturbed inputs x , i.e. , f ( x+ δ ) where δ is drawn from a probability distribution . Smoothing has the advantage that it scales to large models , however , it can suffer from an added overhead during inference time , and currently only provides l2 robustness statistical certification on limited input perturbations ( e.g. , pixels of an image ) . In this space , Lecuyer et al . ( 2018 ) presented the first certified robustness method based on randomized smoothing . Later , Li et al . ( 2018 ) improved these bounds , which where further improved by Cohen et al . ( 2019 ) . Salman et al . ( 2019 ) improved the results of Cohen et al . ( 2019 ) by performing adversarial training on the smoothed classifier . Wang et al . ( 2019 ) similarly inject Gaussian noise into ResNet architectures to increase adversarial robustness . Certification of geometric transformations Beyond lp norm bound attacks , a more realistic attacker model includes perturbations such as geometric attacks , i.e. , rotations , translations and shearing ( Engstrom et al. , 2017 ; Kanbak et al. , 2018 ) . Work on certification against geometric attacks was performed by ( Pei et al. , 2017 ) using enumeration and ( Singh et al. , 2019 ) using abstract interpretation . Neither work scales to large networks and images . Thus , an interesting question is whether we can handle more complex perturbations ( e.g. , rotations ) on larger networks . Towards this , in the rest of the paper , we show a generalization of the smoothing method to this richer class of transformations . 3 SMOOTHED CLASSIFIER . In this work we consider parameterized transformations of data points x ∈ Rn . We denote the smoothing transformation with parameter s ∈ Rd by ψs : Rn → Rn . Further we denote the attacker transformation φδ : Rn → Rn with δ ∈ Rd as the perturbation that the adversary can apply . We require that ψ and φ compose as ψs ◦ φδ = ψs+δ . Examples of attacker transformations are image rotations and translations as discussed in Section 4 . Using this notion of transformation we now define a smoothed classifier : Definition 3.1 ( Smoothed Classifier ) . Given a base classifier f : Rn → { 1 , . . . , k } and a transformation ψs : Rn → Rn with s ∈ Rd we define a smoothed classifier gfψ : Rn → { 1 , . . . , k } : gfψ ( x ) = arg max c Ps ( f ( ψs ( x ) ) = c ) , s ∼ N ( 0 , Σ ) for a covariance matrix Σ ( symmetric positive definite matrix ) . Algorithm 1 for prediction # evaluate g at x function PREDICT ( f , Σ , x , n , α , ψ ) counts← SAMPLE ( f , x , n , Σ , ψ ) ĉA , ĉB ← top two indices in counts nA , nB ← counts [ ĉA ] , counts [ ĉB ] if PVALUETEST ( nA , nA + nB , 0.5 ) ≤ α return ĉA else return ABSTAIN Algorithm 2 for certification # certify the robustness of g around x function CERTIFY ( f , Σ , x , n0 , n , α , ψ ) counts0← SAMPLE ( f , x , n0 , Σ , ψ ) ĉA ← top index in counts0 counts← SAMPLE ( f , x , n , Σ , ψ ) pA ← LBOUND ( counts [ ĉA ] , n , 1− α ) if pA > 12 return ĉA and R else return ABSTAIN As it is usually clear from the context , we drop sub- and super- script and just write g. Given this definition we state our main theorem on the robustness of the smoothed classifier w.r.t attacks φ . This is an adapted version of the main theorem presented in Cohen et al . ( 2019 ) : Theorem 3.2 . We assume a fixed but arbitrary data point x ∈ Rn , base classifier f : Rn → { 1 , . . . , k } and transformation ψs : Rn → Rn . Further we allow an attacker to choose δ and apply φδ ( x ) , s.t . ψs ◦ φδ = ψs+δ . Then : If P ( f ( φs ( x ) = cA ) = pA ≥ pA ≥ pB = pB = maxcB 6=cA P ( f ( φs ( x ) = cB ) then g ( ψδ ( x ) ) = cA for all δ such that √ δTΣ−1δ < Φ−1 ( pA ) −Φ−1 ( pB ) 2 . Proof . The proof is similar to the one given by Cohen et al . ( 2019 ) and is stated in Appendix A . Throughout the paper we refer to Φ−1 ( pA ) −Φ−1 ( pB ) 2 as the certification radius R. The key differences to Cohen et al . ( 2019 ) are : ( i ) we allow general transformations ψ rather than only additive noise , and ( ii ) we consider a full covariance matrix Σ rather than an isotropic one . Specifically for ψs ( x ) = x + s and Σ = σ2In , our theorem exactly recovers the statement from Cohen et al . ( 2019 ) . These two additions enable us to tackle many interesting transformations . Due to the similarity of Theorem 3.2 to their main theorem we can also use very similar versions of their algorithms , shown in Algorithms 1 and 2 . Theorem 3.2 is a deterministic statement , as the only involved random variable s is integrated out . However in practice , the theorem only holds with a certain probability as we have finite amount of samples to estimate pA ( or pA ) and pB ( or pB ) . The function SAMPLE ( f , x , n , Σ , ψ ) returns n samples of f ( ψs ( x ) ) , s ∼ N ( 0 , Σ ) . These samples are then used in a statistical test to determine pA or test if it is > 12 with certainty 1− α for a given α . In both algorithms pB = 1−pA . The probability that Algorithm 1 returns a class other than g ( x ) is at most α and with probability of at least 1− α Algorithm 2 does not abstain .

Summary: This paper introduces a new smoothing algorithm which produces classifiers with certified robustness against adversarial perturbations. In particular, the authors are interested in settings where the input vectors need not be robust simply to \ell_2 perturbations, for which previous authors (e.g., Cohen et al.) have already introduced a "randomized smoothing" classifier which possesses the desired properties. Instead, motivated by the desire to certify robustness to other families of transformations, the authors propose to introduce a smoothing transform that operates in an additive way on the underlying parameter space (rather than on the raw input vectors, as in the case of \ell_2 randomized smoothing). The authors provide details for a few examples from image and audio data processing, and then show experimental results on ImageNet data.