Localized Randomized Smoothing for Collective Robustness Certification

1 INTRODUCTION . There is a wide range of tasks that require models making multiple predictions based on a single input . For example , semantic segmentation requires assigning a label to each pixel in an image . When deploying such multi-output classifiers in practice , their robustness should be a key concern . After all – just like simple classifiers ( Szegedy et al. , 2014 ) – they can fall victim to adversarial attacks ( Xie et al. , 2017 ; Zügner & Günnemann , 2019 ; Belinkov & Bisk , 2018 ) . Even without an adversary , random noise or measuring errors could cause one or multiple predictions to unexpectedly change . In the following , we derive a method that provides provable guarantees on how many predictions can be changed by an adversary . Since all outputs operate on the same input , they also have to be attacked simultaneously by choosing a single perturbed input . While attacks on a single prediction may be easy , attacks on different predictions may be mutually exclusive . We have to explicitly account for this fact to obtain a proper collective robustness certificate that provides tight bounds . There already exists a dedicated collective robustness certificate for multi-output classifiers ( Schuchardt et al. , 2021 ) , but it is only benefical for models we call strictly local , where each output depends only on a small , well-defined subset of the input . One example are graph neural networks that classify each node in a graph based only on its neighborhood . Multi-output classifiers used in practice , however , are often only softly local . While – unlike strictly local models – all of their predictions are in principle dependent on the entire input , each output may assign different importance to different components . For example , deep convolutional networks used for image segmentation can have very small effective receptive fields ( Luo et al. , 2016 ; Liu et al. , 2018b ) , i.e . primarily use a small region of the input in labeling each pixel . Many models used in node classification are based on the homophily assumption that connected nodes are mostly of the same class . Thus , they primarily use features from neighboring nodes to classify each node . Even if an architecture is not inherently softly local , a model may learn a softly local mapping through training . For example , a transformer ( Vaswani et al. , 2017 ) can in principle attend to any part of an input sequence . However , in practice the learned attention maps may be ” sparse ” , with the prediction for each token being determined primarily by a few ( not necessarily nearby ) tokens ( Shi et al. , 2021 ) . While an adversarial attack on a single prediction of a softly local model is conceptually no different from that on a single-output classifier , attacking multiple predictions simultaneously can be much more challenging . By definition , adversarial attacks have to be unnoticeable , meaning the adversary only has a limited budget for perturbing the input . When each output is focused on a different part of the input , the adversary has to decide on where to allocate their adversarial budget and may be unable to attack all outputs at once . Our collective robustness certificate explicitly accounts for this budget allocation problem faced by the adversary and can thus provide stronger robustness guarantees . Our certificate is based on randomized smoothing ( Liu et al. , 2018a ; Lécuyer et al. , 2019 ; Cohen et al. , 2019 ) . Randomized smoothing is a versatile black-box certification method that has originally been proposed for single-output classifiers . Instead of directly analysing a model , it constructs a smoothed classifier that returns the most likely prediction of the model under random perturbations of its input . One can then use statistical methods to certify the robustness of this smoothed classifier . We discuss more details in Section 2 . Randomized smoothing is typically used with i.i.d . noise : Each part of the input ( e.g . each pixel ) independently undergoes random perturbations sampled from the same noise distribution . One can however also use non-i.i.d . noise ( Eiras et al. , 2021 ) . This results in a smoothed classifier that is certifiably more robust to parts of the input that are smoothed with higher noise levels ( e.g . larger standard deviation ) . We apply randomized smoothing to softly-local multi-output classifiers in a scheme we call localized randomized smoothing : Instead of using the same smoothing distribution for all outputs , we randomly smooth each output ( or set of outputs ) using a different non-i.i.d . distribution that matches its inherent soft locality . Using a low noise level for the most relevant parts of the input allows us to retain a high prediction quality ( e.g . accuracy ) . Less relevant parts of the input can be smoothed with a higher noise level . The resulting certificates ( one per output ) explicitly quantify how robust each prediction is to perturbations of which section of the input – they are certificates of soft locality . After certifying each prediction independently using localized randomized smoothing , we construct a ( mixed-integer ) linear program that combines these per-prediction base certificates into a collective certificate that provably bounds the number of simultaneously attackable predictions . This linear program explicitly accounts for soft locality and the budget allocation problem it causes for the adversary . This allows us to prove much stronger guarantees of collective robustness than simply certifying each prediction independently . Our core contributions are : • Localized randomized smoothing , a novel smoothing scheme for multi-output classifiers . • A variance smoothing method for efficiently certifying smoothed models on discrete data . • A collective certificate that leverages our identified common interface for base certificates . 2 BACKGROUND AND RELATED WORK . Randomized smoothing . Randomized smoothing is a flexible certification technique that can be used for various data types , perturbation models and tasks . For simplicity , we focus on a classification certificate for l2 perturbations ( Cohen et al. , 2019 ) . Assume we have a continuous D-dimensional input space RD , a label set Y and a classifier g : RD → Y . We can use isotropic Gaussian noise with standard deviation σ ∈ R+ to construct the smoothed classifier f = argmaxy∈Y Prz∼N ( x , σ ) [ g ( z ) = y ] that returns the most likely prediction of base classifier g under the input distribution 1 . Given an input x ∈ RD and the smoothed prediction y = f ( x ) , we want to determine whether the prediction is robust to all l2 perturbations of magnitude , i.e . whether ∀x′ : ||x′−x||2 ≤ : f ( x′ ) = y . Let q = Prz∼N ( x , σ ) [ g ( x ) = y ] be the probability of g predicting label y . The prediction of our smoothed classifier is robust if < σΦ−1 ( q ) ( Cohen et al. , 2019 ) . This result showcases a trade-off we alluded to in the previous section : The certificate can become stronger if the noise-level ( here σ ) is increased . But doing so could also lower the accuracy of the smoothed classifier or reduce q and thus weaken the certificate . White-box certificates for multi-output classifiers . There are multiple recent methods for certifying the robustness of specific multi-output models ( see , for example , ( Tran et al. , 2021 ; Zügner & Günnemann , 2019 ; Bojchevski & Günnemann , 2019 ; Zügner & Günnemann , 2020 ; Ko et al. , 2019 ; Ryou et al. , 2021 ; Shi et al. , 2020 ; Bonaert et al. , 2021 ) ) by analyzing their specific architecture and weights . They are however not designed to certify collective robustness . They can only determine independently for each prediction whether or not it can be adversarially attacked . Collective robustness certificates . Most directly related to our work is the certificate of Schuchardt et al . ( 2021 ) . Like ours , it combines many per-prediction certificates into a collective certificate . But , unlike our novel localized smoothing approach , their certification procedure is only beneficial for strictly local models , i.e . models whose outputs operate on small subsets of the input . Furthermore , their certificate assumes binary data , while our certificate defines a common interface for various data types and perturbation models . A more detailed comparison can be found in Section D. Recently , Fischer et al . ( 2021 ) proposed a certificate for semantic segmentation . They consider a different notion of collective robustness : They are interested in determining whether all predictions are robust . In Section C.4 we discuss their method in detail and show that , when used for certifying our notion of collective robustness ( i.e . the number of robust predictions ) , their method is no better than certifying each output independently using the certificate of Cohen et al . ( 2019 ) . Furthermore , our certificate can be used to provide equally strong guarantees for their notion of collective robustness by checking whether the number of certified predictions equals the overall number of predictions . Another method that can be used for certifying collective robustness is center smoothing ( Kumar & Goldstein , 2021 ) . Center smoothing bounds how much a vector-valued prediction changes w.r.t to a distance function under adversarial perturbations . With the l0 pseudo-norm as the distance function , center smoothing bounds how many predictions of a classifier can be simultaneously changed . Randomized smoothing with non-i.i.d . noise . While not designed for certifying collective robustness , two recent certificates for non-i.i.d . Gaussian ( Fischer et al. , 2020 ) and uniform smoothing ( Eiras et al. , 2021 ) can be used as a component of our collective certification approach : They can serve as per-prediction base certificates , which can then be combined into our stronger collective certificate ( more details in Section 4 ) . Note that we do not use the procedure for optimizing the smoothing distribution proposed by Eiras et al . ( 2021 ) , as this would enable adversarial attacks on the smoothing distribution itself and invalidate the certificate ( see discussion by Wang et al . ( 2021 ) ) . 3 COLLECTIVE THREAT MODEL . Before certifying robustness , we have to define a threat model , which specifies the type of model that is attacked , the objective of the adversary and which perturbations they are allowed to use . We assume that we have a multi-output classifier f : XDin → YDout , that maps from a Din-dimensional vector space to Dout labels from label set Y . We further assume that this classifier f is the result of randomly smoothing a base classifier g , as discussed in Section 2 . To simplify our notation , we write fn to refer to the function x 7→ f ( x ) n that outputs the n-th label . Given this multi-output classifier f , an input x ∈ XDin and the resulting vector of predictions y = f ( x ) , the objective of the adversary is to cause as many predictions from a set of targeted indices T ⊆ { 1 , . . . , Dout } to change . That is , their objective is minx′∈Bx ∑ n∈T I [ fn ( x ′ ) = yn ] , where Bx ⊆ XDin is the perturbation model . Importantly , note that the minimization operator is outside the sum , meaning the predictions have to 1In practice , all probabilities have to be estimated using Monte Carlo sampling ( see discussion in Section C ) . be attacked using a single input . As is common in robustness certification , we assume a norm-bound perturbation model . That is , given an input x ∈ XDin , the adversary is only allowed to use perturbed inputs from the set Bx = { x′ ∈ XDin | ||x′ − x||p ≤ } with p , ≥ 0 .

Summary: **Summary**  The paper proposes a localized smoothing approach for certifying structured output models. The threat model of interest in this setting is the bounded input perturbation that results in the highest number of prediction flips per pixel. The paper proposes to utilize the idea that when certifying pixel predictions at location (i,j), one can smooth the input pixels (k,l) far away from (i,j) by larger noise magnitude (standard deviation) resulting in a higher certified radii as they perhaps may not play a significant role in predicting the label of (i,j). The paper formulates the problem of finding worst cases adversaries that result in misprediction to the task of finding adversaries outside the certified region with anisotropic smoothing over the input. The paper then lower bounds the binary objective with a box constraints and solve the problem using linear  programs. Experiments are conducted on image segmentation tasks along with node classification.