Localized Randomized Smoothing for Collective Robustness Certification

1 INTRODUCTION . There is a wide range of tasks that require models making multiple predictions based on a single input . For example , semantic segmentation requires assigning a label to each pixel in an image . When deploying such multi-output classifiers in practice , their robustness should be a key concern . After all – just like simple classifiers ( Szegedy et al. , 2014 ) – they can fall victim to adversarial attacks ( Xie et al. , 2017 ; Zügner & Günnemann , 2019 ; Belinkov & Bisk , 2018 ) . Even without an adversary , random noise or measuring errors could cause one or multiple predictions to unexpectedly change . In the following , we derive a method that provides provable guarantees on how many predictions can be changed by an adversary . Since all outputs operate on the same input , they also have to be attacked simultaneously by choosing a single perturbed input . While attacks on a single prediction may be easy , attacks on different predictions may be mutually exclusive . We have to explicitly account for this fact to obtain a proper collective robustness certificate that provides tight bounds . There already exists a dedicated collective robustness certificate for multi-output classifiers ( Schuchardt et al. , 2021 ) , but it is only benefical for models we call strictly local , where each output depends only on a small , well-defined subset of the input . One example are graph neural networks that classify each node in a graph based only on its neighborhood . Multi-output classifiers used in practice , however , are often only softly local . While – unlike strictly local models – all of their predictions are in principle dependent on the entire input , each output may assign different importance to different components . For example , deep convolutional networks used for image segmentation can have very small effective receptive fields ( Luo et al. , 2016 ; Liu et al. , 2018b ) , i.e . primarily use a small region of the input in labeling each pixel . Many models used in node classification are based on the homophily assumption that connected nodes are mostly of the same class . Thus , they primarily use features from neighboring nodes to classify each node . Even if an architecture is not inherently softly local , a model may learn a softly local mapping through training . For example , a transformer ( Vaswani et al. , 2017 ) can in principle attend to any part of an input sequence . However , in practice the learned attention maps may be ” sparse ” , with the prediction for each token being determined primarily by a few ( not necessarily nearby ) tokens ( Shi et al. , 2021 ) . While an adversarial attack on a single prediction of a softly local model is conceptually no different from that on a single-output classifier , attacking multiple predictions simultaneously can be much more challenging . By definition , adversarial attacks have to be unnoticeable , meaning the adversary only has a limited budget for perturbing the input . When each output is focused on a different part of the input , the adversary has to decide on where to allocate their adversarial budget and may be unable to attack all outputs at once . Our collective robustness certificate explicitly accounts for this budget allocation problem faced by the adversary and can thus provide stronger robustness guarantees . Our certificate is based on randomized smoothing ( Liu et al. , 2018a ; Lécuyer et al. , 2019 ; Cohen et al. , 2019 ) . Randomized smoothing is a versatile black-box certification method that has originally been proposed for single-output classifiers . Instead of directly analysing a model , it constructs a smoothed classifier that returns the most likely prediction of the model under random perturbations of its input . One can then use statistical methods to certify the robustness of this smoothed classifier . We discuss more details in Section 2 . Randomized smoothing is typically used with i.i.d . noise : Each part of the input ( e.g . each pixel ) independently undergoes random perturbations sampled from the same noise distribution . One can however also use non-i.i.d . noise ( Eiras et al. , 2021 ) . This results in a smoothed classifier that is certifiably more robust to parts of the input that are smoothed with higher noise levels ( e.g . larger standard deviation ) . We apply randomized smoothing to softly-local multi-output classifiers in a scheme we call localized randomized smoothing : Instead of using the same smoothing distribution for all outputs , we randomly smooth each output ( or set of outputs ) using a different non-i.i.d . distribution that matches its inherent soft locality . Using a low noise level for the most relevant parts of the input allows us to retain a high prediction quality ( e.g . accuracy ) . Less relevant parts of the input can be smoothed with a higher noise level . The resulting certificates ( one per output ) explicitly quantify how robust each prediction is to perturbations of which section of the input – they are certificates of soft locality . After certifying each prediction independently using localized randomized smoothing , we construct a ( mixed-integer ) linear program that combines these per-prediction base certificates into a collective certificate that provably bounds the number of simultaneously attackable predictions . This linear program explicitly accounts for soft locality and the budget allocation problem it causes for the adversary . This allows us to prove much stronger guarantees of collective robustness than simply certifying each prediction independently . Our core contributions are : • Localized randomized smoothing , a novel smoothing scheme for multi-output classifiers . • A variance smoothing method for efficiently certifying smoothed models on discrete data . • A collective certificate that leverages our identified common interface for base certificates . 2 BACKGROUND AND RELATED WORK . Randomized smoothing . Randomized smoothing is a flexible certification technique that can be used for various data types , perturbation models and tasks . For simplicity , we focus on a classification certificate for l2 perturbations ( Cohen et al. , 2019 ) . Assume we have a continuous D-dimensional input space RD , a label set Y and a classifier g : RD → Y . We can use isotropic Gaussian noise with standard deviation σ ∈ R+ to construct the smoothed classifier f = argmaxy∈Y Prz∼N ( x , σ ) [ g ( z ) = y ] that returns the most likely prediction of base classifier g under the input distribution 1 . Given an input x ∈ RD and the smoothed prediction y = f ( x ) , we want to determine whether the prediction is robust to all l2 perturbations of magnitude , i.e . whether ∀x′ : ||x′−x||2 ≤ : f ( x′ ) = y . Let q = Prz∼N ( x , σ ) [ g ( x ) = y ] be the probability of g predicting label y . The prediction of our smoothed classifier is robust if < σΦ−1 ( q ) ( Cohen et al. , 2019 ) . This result showcases a trade-off we alluded to in the previous section : The certificate can become stronger if the noise-level ( here σ ) is increased . But doing so could also lower the accuracy of the smoothed classifier or reduce q and thus weaken the certificate . White-box certificates for multi-output classifiers . There are multiple recent methods for certifying the robustness of specific multi-output models ( see , for example , ( Tran et al. , 2021 ; Zügner & Günnemann , 2019 ; Bojchevski & Günnemann , 2019 ; Zügner & Günnemann , 2020 ; Ko et al. , 2019 ; Ryou et al. , 2021 ; Shi et al. , 2020 ; Bonaert et al. , 2021 ) ) by analyzing their specific architecture and weights . They are however not designed to certify collective robustness . They can only determine independently for each prediction whether or not it can be adversarially attacked . Collective robustness certificates . Most directly related to our work is the certificate of Schuchardt et al . ( 2021 ) . Like ours , it combines many per-prediction certificates into a collective certificate . But , unlike our novel localized smoothing approach , their certification procedure is only beneficial for strictly local models , i.e . models whose outputs operate on small subsets of the input . Furthermore , their certificate assumes binary data , while our certificate defines a common interface for various data types and perturbation models . A more detailed comparison can be found in Section D. Recently , Fischer et al . ( 2021 ) proposed a certificate for semantic segmentation . They consider a different notion of collective robustness : They are interested in determining whether all predictions are robust . In Section C.4 we discuss their method in detail and show that , when used for certifying our notion of collective robustness ( i.e . the number of robust predictions ) , their method is no better than certifying each output independently using the certificate of Cohen et al . ( 2019 ) . Furthermore , our certificate can be used to provide equally strong guarantees for their notion of collective robustness by checking whether the number of certified predictions equals the overall number of predictions . Another method that can be used for certifying collective robustness is center smoothing ( Kumar & Goldstein , 2021 ) . Center smoothing bounds how much a vector-valued prediction changes w.r.t to a distance function under adversarial perturbations . With the l0 pseudo-norm as the distance function , center smoothing bounds how many predictions of a classifier can be simultaneously changed . Randomized smoothing with non-i.i.d . noise . While not designed for certifying collective robustness , two recent certificates for non-i.i.d . Gaussian ( Fischer et al. , 2020 ) and uniform smoothing ( Eiras et al. , 2021 ) can be used as a component of our collective certification approach : They can serve as per-prediction base certificates , which can then be combined into our stronger collective certificate ( more details in Section 4 ) . Note that we do not use the procedure for optimizing the smoothing distribution proposed by Eiras et al . ( 2021 ) , as this would enable adversarial attacks on the smoothing distribution itself and invalidate the certificate ( see discussion by Wang et al . ( 2021 ) ) . 3 COLLECTIVE THREAT MODEL . Before certifying robustness , we have to define a threat model , which specifies the type of model that is attacked , the objective of the adversary and which perturbations they are allowed to use . We assume that we have a multi-output classifier f : XDin → YDout , that maps from a Din-dimensional vector space to Dout labels from label set Y . We further assume that this classifier f is the result of randomly smoothing a base classifier g , as discussed in Section 2 . To simplify our notation , we write fn to refer to the function x 7→ f ( x ) n that outputs the n-th label . Given this multi-output classifier f , an input x ∈ XDin and the resulting vector of predictions y = f ( x ) , the objective of the adversary is to cause as many predictions from a set of targeted indices T ⊆ { 1 , . . . , Dout } to change . That is , their objective is minx′∈Bx ∑ n∈T I [ fn ( x ′ ) = yn ] , where Bx ⊆ XDin is the perturbation model . Importantly , note that the minimization operator is outside the sum , meaning the predictions have to 1In practice , all probabilities have to be estimated using Monte Carlo sampling ( see discussion in Section C ) . be attacked using a single input . As is common in robustness certification , we assume a norm-bound perturbation model . That is , given an input x ∈ XDin , the adversary is only allowed to use perturbed inputs from the set Bx = { x′ ∈ XDin | ||x′ − x||p ≤ } with p , ≥ 0 .

Summary: The paper makes three contributions in particular: - A local version of randomized smoothing for multi-output classifiers. The authors suggest using a customized smoothing distribution for certifying each output of the multi-output classifier. The custom distributions allow them to produce tighter guarantees for each output. - A new analysis method of variance smoothing for discrete data uses the average softmax value instead of the majority vote as the prediction rule. The authors use the first and second-order statistics (mean and variance) to provide robustness guarantees in this method. - A collective certification strategy for multi-output classifiers using a common interface ($\ell_p$ norm ellipsoids) for base certificates for every output. The authors describe a common way of stating the base certified regions for every output. Then the multi-output certification problem can be expressed as a mixed-integer linear program to find a point inside the perturbation model that lies outside the base certified regions for the maximum number of outputs.