Efficient randomized smoothing by denoising with learned score function
Authors: Kyungmin Lee
Seyoon Oh
Venue:  (2021)
Keywords: Adversarial Robustness
Provable Adversarial Defense
Randomized Smoothing
Image Denoising
Score Estimation

Abstract: The randomized smoothing with various noise distributions is a promising approach to protect classifiers from $\ell_p$ adversarial attacks. However, it requires an ensemble of classifiers trained with different noise types and magnitudes, which is computationally expensive. In this work, we present an efficient method for randomized smoothing that does not require any re-training of classifiers. We built upon denoised smoothing, which prepends denoiser to the pre-trained classifier. We investigate two approaches to the image denoising problem for randomized smoothing and show that using the score function suits for both. Moreover, we present an efficient algorithm that can scale to randomized smoothing and can be applied regardless of noise types or levels. To validate, we demonstrate the effectiveness of our methods through extensive experiments on CIFAR-10 and ImageNet, under various $\ell_p$ adversaries.

Under review as a conference paper at ICLR 2021
EFFICIENT RANDOMIZED SMOOTHING BY DENOISING WITH LEARNED SCORE FUNCTION
Anonymous authors Paper under double-blind review
ABSTRACT
The randomized smoothing with various noise distributions is promising ap- proach to protect classifiers from lg adversarial attacks. However, requires an ensemble of classifiers trained with different noise types and magnitudes, which is computationally expensive. In this work, we present an efficient method for ran- domized smoothing that does not require any re-training of classifiers. We built upon denoised smoothing, which prepends denoiser to the pre-trained classifier. We investigate two approaches to the image denoising problem for randomized smoothing and show that using the score function suits for both. Moreover, we present an efficient algorithm that can scale to randomized smoothing and be applied regardless of noise types or levels. To validate, we demonstrate the effectiveness of our methods through extensive experiments CIFAR-10 and ImageNet, under various lp adversaries.
INTRODUCTION
The deep image classifiers are susceptible to deliberate noises as known as adversarial at- tacks (Szegedy et al., 2013 Goodfellow al.) 2014) Carlini & Wagner 2017). Even though many works proposed heuristics that can annul or mitigate adversarial attacks, most of them were broken by stronger attacks (Athalye al. 2018 Athalyy & Carlini 2018). The vulnerability of empirical defenses had led the researchers to scrutinize on certified defenses, which ensure the models to have constant output within the allowed set around given input. Unfortunately, many provable defenses are not feasible to large-scale neural networks because of their constraints on the architecture.
On the other hand, randomized smoothing practical method that does not restrain the choice of neural networks. The randomized smoothing converts any base classifier to a smoothed clas- sifier by making predictions over randomly perturbed samples. Then the smoothed classifiers are guaranteed to have a lp certified radius, which is theoretically derived by the noise type used for smoothing. Since Cohen et al. (2019) derived tight &2 certified radius for Gaussian randomized smoothing, sequential works studied the certification bounds for various distributions (Teng al.) 2020 Yang et al.) 2020). As base classifiers are required to predict randomly perturbed samples, natural classifiers are not sufficient for randomized smoothing. Therefore, many works proposed training ensemble of base classifiers accustomed for randomized smoothing. However, since each trained classifier only applies specific noise distribution and level, it expensive to protect against various E, adversaries and robustness strength.
In this work, tackle the inefficiency of training random-ensemble of base classifiers by using one universal image denoiser to the pre-trained classifier. The idea of using denoiser for randomized smoothing was first introduced by Salman al. (2020) and is refer to denoised smoothing. One step further, we study general image denoising problem for randomized smoothing with two different approaches: 1) direct training of image denoiser, and 2) solve the optimization problem by using a generative model to project to the learned data manifold. Then, we show that the score function, which is the gradient of log-density, is crucial for both approaches. We exploit multi-scale denois- ing score matching (Song & Ermon 2019) for score estimation, and propose an efficient algorithm simulated annealing for image denoising. Remark that we only require one score network to certify various noise distributions and levels. We provide experimentations datasets to show the efficacy of our methods. Specifically, our denoisers perform better than original denoised smoothing, while can be applied various noise types without any re-training. Further-
ImageNet and CIFAR- 10

---

Under review as a conference paper at ICLR 2021
more, compare with the and show that our method works are comparable to them. In sum, we list our contributions:
based method, which we refer to white-box smoothing,
We propose novel score- score-based image denoisers for randomized smoothing.
We improve denoised smoothing, which was originally proposed by |Salman al. (2020)
and generalize to other distributions without training any neural networks.
2 RANDOMIZED SMOOTHING AND DENOISED SMOOTHING
2.1 BACKGROUNDS ON RANDOMIZED SMOOTHING
Let f IR + 3/ be a classifier and g be distribution on R. Then the randomized smoothing with q is method that converts the base classifier f to the associated smoothed classifier where g(x) returns the class which is most likely to be predicted by the base classifier f when is perturbed by a random noise sampled from i.e.,
g(x arg max cEy
Pr u
[)(x+
The noise distribution is usually symmetric log-concave distribution, i.c. q(u) exp(-o(u)) for some even and convex Φ. Note that to control the robustness/accuracy tradeoff, we embed the noise level À to q, then we have gx (u) = o( x) We mix the notations q and qy throughout the paper.
Robustness guarantee for smoothed classifiers Suppose adversary can perturb the input inside the allowed set B3 which usually an lp ball centered at x. For the case when is & ball and q is Gaussian distribution ((0, ofooo I). g(x) is robust within the radius
R
+ (pi) 8p22
(2)
where & is inverse cumulative distribution function, and Pi max, Pr[f(x + uu = c] and P2 = maxeff((x) Pr[ʃ(x= + u) c]. Cohen et al. (2019) first derived the certified radius by us- ing Sryyman-Pearson lemma, and later Salman et al. 2019a) showed alternative derivation using the Lipschitz property of smoothed classifier. Furthermore when q is a centered Laplace distribution, the robustness certificate for & radius was derived by Teng al. (2020). Later, the proof methods are generalized to various distributions (may not be log-concave) that can certify various ép radius Yang et al. (2020). Remark that the robustness guarantee depends on the noise distribution QA and the performance of base classifier f under random perturbation with Qx.
2.2 RANDOMIZED SMOOTHING VIA IMAGE DENOISING
Even though the randomized smoothing convert any classifier provably robust classifier, the smoothed classifier from natural classifiers are below the standard as they are not capable of predict- ing randomly perturbed samples. Many previous studies focused on training classifiers accustomed
to randomized smoothing, which spans from noisy data augmentation (Cohen et al. 2019 Li et al.,
2019) its variants such adversarial training (Salman al.) (019a) or stability training (Lee)
et al. 2019 Zhai et al. 2019). However, such methods are computationally expensive and require massive number classifiers per noise types and levels.
The idea of prepending denoiser to the classifier was first introduced by Salman et al. (2020). By training denoiser Dø : _Rd + Rdd the smoothed classifier converted from f D3 outperforms "noddnnoisrr' bascline. They proposed training denoisers with mean squared error (MSE) loss or classification (CLF) loss, or combining both methods. Formally, they are
LMSE(0) E Ex-p,u-yl11 DI Da (x u) 1
(3)
(e = Ex-p.ugg (Cee (F( + u)). f(x)))
(4)
where LCE is the cross-entropy loss and F' is soft version of hard classifier f. They showed that training with CLF loss makes perform better than denoiser with only MSE loss. Alternatively, Saremi & Srivastava (2020) trained neural empirical bayes estimator that can refine the white noise.
Nonetheless, those methods still suffer from expensive training of numerous denoisers with respect to each noise types and levels.
2

---

Under review as a conference paper at ICLR 2021
3 SCORE-BASED IMAGE DENOISING
3.1 FORMULATION OF IMAGE DENOISING PROBLEM
The image denoising is example of linear inverse problem, which can be formulated as following: given an observation y = x + u with u r ((u) finds x(y) that is close to original x. Let x ~ p(x) then the distribution of y is (y
ply, x)dx = p(y x)p(x)dx = q(y x)p(x)dx
(p* * (y).
One-step denoiser Like equation the most common approach achieve denoiser is to train denoising autoencoder (DAE) Do with MSE loss (Zhang et al. 2017; ?). Suppose is a Gaussian distribution N (0, o²T] | and let the distribution of y by pa2. Then the following proposition (Robbins,
1956 Lu & Stephens 2019,
2019 Saremi & Hyvarinen 2020) reveals the relationship between the optimal
denoiser Dg- and pga.
Proposition 3.1. Assume 0* arg ming (0), then the following equation holds:
Dy. (y) = y + V logP>>
(5)
The proof of proposition 3.1 is in Appendix A. Let us define the score function of density p(x) by Vx log p(x), then the optimal DAE can be obtained by estimating the score of p,a. Let sø (:( o)) be score network that estimates score of smoothed density Pa2. Then the denoiser from So is given by
x(y y + o o)su(y;o).
(6)
Remark that it is only valid when q is Gaussian distribution.
Multi-step denoiser Consider the maximum a posteriori (MAP) estimator that maximizes the conditional distribution p(xly). Formally the MAP loss is given by,
arg min LMAP(x;;) arg min (xly)
x
x
arg min log pxx - log logp(y(x) + logp(y) (8)
arg min log p(x) log x)
arg min p(x) + øly - -x).
(10)
Note that we simply remove density term ply) and rewrite with q. Lastly, rewrite q with d. Since the density p(x) is usually intractable for high- high-dimensional dataset, one may use approximation to make the MAP loss tractable. Many recent works focused on using cutting edge generative models such as generative adversarial network (GAN) or invertible neural networks to approximate p(x) in equation ( (Ulynoov al. 2018 Whang al. 2020 Asim al.) 2020). However, GAN suffer from mode collapse, and invertible neural networks require extremely long steps to reach local minima, which are not sufficient for randomized smoothing.
Instead, we aim to approximate the gradient of LMAP by the score of Gaussian smooth densities. Let the approximate MAP loss with ā by
LMAP,a (x:y) log + d(y x).
(11)
Then we can approximate the gradient of IMAP,E (x; by score network and perform gradient descent initialized with X y as following:
X++1 x ax LMAP, (x:;)) R x4 + a(so(xi:ō) Vx, o - xx)).
(12)
Remark that the proposed method can be applied to any log-concave noise distributions. Following theorem shows the recovery guarantee of our methods when is a Gaussian distribution.
Theorem 3.2. Let x" be local optimum of p(x), and y x* + where u (0, o²1). Assume
-logp is μ-strongly convex within the neighborhood Bx(x) = {z : |z x|| I r). Then, the
gradient descent method on approximate loss LMAP, 52 (x: y) initialized by Xa = y converges to its local minima *(y; ō) E arg min LMAP aa ax(:)) (x:y) that satisfies:
ovd(1 + nO²) H
E| 0) x 112 <
1+ pz² + 2 + +āvd
(13)
3

---

Under review as a conference paper at ICLR 2021
The proof of theorem 3.2 is in Appendix A. Remark that the upper bound in equation I increases as a increases, which shows that the recovery becomes harder as a becomes larger. Also the upper bound is strictly increasing function of o, and has the minimum when ő 0.
3.2 EFFICIENT IMAGE DENOISING WITH SIMULATED ANNEALING
From theorem 3.2, for small o the error bound is tight but the approximation is inaccurate at nascent steps. Otherwise, when ō is large, the error bound is too large. To arbiter the tradeoff, and to make the method scalable, we propose simulated annealing for score-based image denoising. Let (oi)/=1 be decreasing sequence of noise levels, then simulated annealing runs 7 steps of approx- imate gradient descent for each oge The algorithm for simulated annealing for image denoising is in Algorithm !
Algorithm Simulated Annealing for denoising
Require: y, Vo T
1: initialize X0) = y
2: for +- 1: do
3: a; f a 0.
4: f 1: do
5: X++1 t x + og (50, (xt) + Vx, - y))
6: end for
7: Xg f- XT
8:
end for
9:
return X/r
Note that Song & Ermon (2019 2020) used annealed Langevin dynamics for generative modeling. Our approach is similar to them, but consider the image denoising problem instead. Also, note that Kingma & Cun (2000) trained score network for image denoising, but they used primitive neural networks where exact more-matching was possible.
3.3
SCORE ESTIMATION SCORE MATCHING
Score estimation has been studied through various topics such as generative modeling (Song et al., 2020 [Song& Ermon 2019) and reinforcement learning (Sutton et al. 2000). Score matching is
method that trains a score network So (x) to estimate score. The original score matching objective is given by
Ex-p(xx tr( (r(VxSe(x)) + |s (x)
(14)
However, due to heavy computation of tr( (r(Vsp(() and since we are only interested in score of smoothed densities, we use different approach.
Denoising Score Matching Denoising score matching is a method that learns the score of
smooth densities. More concretely, the score network So estimates the score of density p,=(y)
[N(x, (pxx)xx The objective was proved to be equivalent to the following (Vincent) 201
E Ey-g, (ylx) xx)))))p( a) V, log 4== [1])
(15)
Remark that the optimal score network satisfies Sø- (x; σ) = V log p. (x) for each a, and as a + 0, Sgr.o (x) V logp(x))
Multi-Scale Denoising Score Matching Recently, training score network with multi-scale de- noising score matching has been proposed (Song & Ermon 2019). Multi-scale denoising score
matching trains one score network with various noise magnitudes. Given a sequence of noise levels (ox) which the variance of centered Gaussian distribution, by rewriting the denoising score matching objective for each o;, we have
((0:a.)
- _F
1
y-x x soly:a.)
(16)
2
0
4

---

Under review as a conference paper at ICLR 2021
(d)
Figure (a) the original image sampled from ImageNet dataset, (b) the perturbed image with Gaussian noise(a 1.0), (c) the denoised image with one-step denoiser, (d) the progress of multi- step denoiser, the last image the final denoised image.
Then the total loss is
1 Σ
C(0; (o:)
of C(0:
(17)
note that each loss is weighted by a, which allows the loss of each noise level has the same order of magnitude. It worth to notify that our method is unsupervised, and classifier-free.
Here we demonstrate some advantages of multi-scale denoising score matching. First, through learning various noise magnitudes at once, it suffices to train only one neural network to apply image denoising. Therefore, we can do randomized smoothing regardless of the noise level. Second, the noise makes the support of the score function to be whole space, making score estimation more consistent. Moreover, large amount of noise fills the low-density region, which helps estimate the score of the non-Gause non-Gaussian or off-the-manifold samples. Empirically, we found out that multi- scale learning helps the denoising performance. See Appendix C for details.
EXPERIMENTS
We study the performance of proposed denoiser applied for randomized smoothing. We perimented on ImageNet (Deng et al. 2009) and CIFAR-10 Krizhevsky et al.] (2009) datasets. For comparison, we measured the certified accuracy Rt which is the fraction of test for which the smoothed classifier correctly predicts and certifies robust at an L, radius bigger than R. Due to com- putational issue, we conducted our experiments with N 10, 000 samples and failure probability = 0.001. Everything besides, we follow the same experimental procedures as in Cohen et al. 2019). At first, we depict the perceptual performance of our proposed denoisers.
4.1 VISUAL PERFORMANCE OF PROPOSED DENOISERS.
We demonstrate the visual performance of our denoiser. For an image sampled from the ImageNet dataset, we perturbed the image with Gaussian noise (a = 1.0), and denoised images from each one-step and multi-step methods are different. Note that the result from the one-step denoiser is more blurry, but the multi-step denoiser produces sharper edge. We refer to Appendix D for more examples of CIFAR-10 10 and ImageNet under various noise types.
4.2 CERTIFICATION WITH ONE-STEP DENOISER
We experimented the performance of one-step denoiser for Gaussian randomized smoothing. We compare with 1) white-box smoothing, which is canonical approach that trains base classifiers with
5

---

Under review as a conference paper at ICLR 2021
l radius (CIFAR-10)
0.25
0.50
0.75
1.00
1.25
1.50
white-box smoothing (Cohen et al. 2019
59
45
31
21
18
13
denoised smoothing (Query Access) (Salman al.
2020
20
13
10
denoised smoothing (Full Access) (Salman et al. 2020
56
41
28
19
16
13
denoised smoothing (Our method)
60
42
28
19
11
6
Table I: Certified accuracy of ResNet-110 110 CIFAR-10 10 various & radii.
8 radius (ImageNet)
0.25
0.50
0.75
1.00
1.25
1.50
white-box smoothing (Cohen et 2019 denoised smoothing (Query Access) (Saman et al.
62
52
45
39
34
29
2020
48
31
19
12
7
4
denoised smoothing (Full Access) Access)(Salman (Salman et al. 2020)
50
33
20
14
11
6
denoised smoothing (Our method)
56
41
30
24
17
11
Table 2: Certified accuracy of ResNet-50 on ImageNet at various &g radii.
Gaussian data augmentation (Cohen et al., 2019), and the denoised smoothing with denoisers trained by Salman et al. (2020). As Salman et al. (2020) trained denoisers with various methods, we just compare with their best values. Note that they assumed query access full access, which are discriminated based on how much information on the base classifier is provided. Remark that our method is no access' that we don't need any classifier information. For all experiments on denoised smoothing, used same ResNet1 10 classifier for CIFAR-10 and pytorch pretrained ResNet50 classifier for ImageNet. In addition, as our method is unbiased to the base classifiers, we found that using stronger classifier results in better certified accuracy. See Appendíx C for additional experiments.
The results for CIFAR-10 10 are shown in Table Remark that even without using clas- sifier loss, our method outperforms the query access baseline, and slightly better than the full access baseline. Also, the results are comparable white-box smoothing, which an upper bound on our framework. We suspect two reasons for the performance boost: the use of better architecture and the effect of multi-scale training. We conducted additional experiments on the effect of multi-scale training, and found out that multi-scale training helps learning the score estimation and therefore helps denoised smoothing. The results for additional experiments are in Appendix C. However, note that using classifier loss helps for large radii certification because the images denoised from large-scale noise is too blurry that conventional classifiers can't predict it.
CIFAR-10
The results for ImageNet are shown Table Note that our method outperforms previous denoised smoothing baselines. We believe the same reason in CIFAR-10. However, there is still a large gap between denoised smoothing and white-box smoothing, which is due difficulty of learning score function of high-resolution images.
ImageNet
4.3 CERTIFICATION WITH MULTI-STEP DENOISER
We demonstrate the effectiveness of our multi-step denoiser on denoised smoothing using various noise types. For baseline, we compare with white-box smoothing which is training classifiers with noisy data augmentation. We experimented on Gaussian noise (Cohen et al. 2019), Laplace noise (Teng et al. 2020), and uniform noise (Yang et al. 2020) for both CIFAR- 10 and ImageNet. For all experiments, geNet. See Appendix B for more details. It is important to claim that all experiments are done with the only
used ResNetl10 classifiers for CIFAR- 10 and ResNet50 classifiers for Ima-
ecore-network for each CIFAR-10 10 and ImageNet.
Note that for CIFAR-10 10, the denoised smoothing with our denoiser is slightly worse than white-box smoothing except for uniform distribution. As Yang et al. (2020) reported, the uniform distribution well-fitted to the convolutional neural network, therefore the white-box smoothing achieves higher performance. For ImageNet, we' ve found out that score estimation ImageNet difficult, and the

---

Under review as a conference paper at ICLR 2021
(a)
Derosed Broodiing (ours. mull sop dencbet)
denobud amootinng (bura) whileboc rmoothnn (Ting al)
duroked smoolinng lou%)
Deno and Sireotingg 10um one-dee tre-dae dernterr)
whiee toe smooting (Targ ml)
Deno sed Simetiing man at all
white oae encotinng (Dohwn wiw)
Aecitee
0.2
3.5
08
ret LB
Ft 1.16AA
(d)
(c)
(f)
smooting (ours)
Browthing
densioo))
smoothing (Teng atal)
amoothng (Ying ai)
Donased Brootiing /Buiman
smootting (Dahee ctul)
0.2
02
01
08
32
24
0.6
0.0
1.0
1.2
1.4 3.0
0.2
0.4
066
0.
10
12
14 3.5
0.2
0.4
08
08
1.0
12
14
Figure 2: The performance of multi-step denoiser for denoised smoothing. The blue lines are our methods, and red lines are white-box smoothing which are experimented by each authors. (a) & certified accuracy with Gaussian smoothing on CIFAR-10, 10, (b) l certified accuracy with Laplace smoothing CIFAR-10, (c) & certified accuracy with uniform smoothing CIFAR-10, (d) & certified accuracy with Gaussian smoothing on ImageNet, (e) & certified accuracy with Laplace smoothing ImageNet, (f) l certified accuracy with uniform smoothingon ImageNet,
denoising algorithm takes too long time be certify with myriad of samples. However, we found out that our approach can stack up against white-box smoothing.
RELATED WORKS
5.1 DEFENSE AGAINST ADVERSARIAL ATTACKS
Empirical Defense methods The empirical defenses include erasing adversarial perturbation and
making models predict well in the presence of adversarial examples. The former defenses similar
to our approach that they use trained denoiser (Meng & Chen 2017 Liao et al. 2018). or project the adversarial examples to the learned data manifold using generative models (Sog et al. [207]] Samangouei et al.] 2018). However, all these methods are broken by adaptive attacks (Athalye et al.,
2018 Athalyy Carfini 2018 Tramer et al., 2020). while our method has provable robustness. The latter detenses are referred to adversarial training (Madry et al. 2017; Kurakin et al., 20016] Zhang et al., 2019), which augments adversarial examples at training. Although the adversarial
training methods are shown to have great empirical robustness against various adversarial attacks,
they suffer from the undiscovered attacks.
Certified Defense methods provides provable guarantees that the classifier's prediction remains unchanged within neighborhood of an input. Those methods are mainly based on certification methods that are either exact or conservative. The exact certification methods are based on Satisfi- ability Modulo theories solvers (Katz al. 2017 Ehlers] 2017) or mixed-integer linear program- ming (Fischetti & Jo, 2018 TTeng et al. 2019 Lomuscio & Maganti, 2017). However, those meth- ods have the computational burden and depend on the architecture of the neural network. Otherwise, conservative methods are based on Lipschitz bound of the neural network, which is more compu- tationally efficient (Jordan et al. 2019; Salman et al. 2019b Wong & Kolter 2018 Raghunathan et al. 2018). However, the above methods aren't 't scaled for practical neural networks. Instead, ran- domized smoothing which is the Weierstrass transformation of a classifier is shown to be scalable with architecture independence.
7

---

Under review as a conference paper at ICLR 2021
Randomized smoothing was first presented with guarantee derived from differential privacy per- spective (Lecuyer et al. 2019). Then using Li et al. (2019) showed tighter certificates using a- divergence minimization of original and smoothed distributions. Recently, (Cohen et al. (2019) pro- posed the tightest &2 robust guarantee with Gaussian distribution. Furthermore, series of works derived certification bounds for various L, adversaries including fı-adversary (Teng et al. 2020)
Loo (Zhang et al., 2020) and to (Lee et al. 20192 Levine Levine & Feizi). Later. Yang et al. 2020) showed generic proof methods for certification with Wulff Crystal theory.
Even though randomized smoothing does not constrain the base classifier, to achieve non-trivial ro- bustness, several works have proposed custom- -oriined methods for randomized smoothing [Leeuyer) et al. [019] Cohen et al.] 2019 [Salman et al.] [019a] [2200] Yang et al., (2200). Alternatively,
Lecuyer et al. (2019) trained denoising autoencoders to promote to scale PixelDP to practical neural
networks. Our work is based on [Salman et al. (2020), with some improvements and generalizations.
Note that 1) our approach does not require any information on the base classifier, and we propose
general image denoising that doesn't 't require training denoisers per noise types or levels.
5.2 IMAGE DENOISING
The image denoising had huge development by exploiting deep neural networks (Zhang et al. 2017] Din et al., 2017; Tai et al., 2017). Moreover, inverse imaging using generative models have been studied. Ulyanov et al. (2018) showed that GAN can act as an image prior and be used for various inverse imaging problems. On the other hand, Asim et al. (2019) claimed that GAN suf- fers from mode collapse, and is biased toward the dataset that isn I sufficient for general image denoising. Instead, several studies (Asim et al. 2019 Whang et al. (020) showed that invertible neural networks such as Glow (Kingma & Dhariwal 2018) or RealNVP (Dinh et 2016), can be used for the deep image before various inverse imaging applications. Our work is based on score function, where using score function for inverse imaging is less studied. Note that KKngmm & Cun (201)) used regularized score matching for image denoising, but their neural network is primeval, and regularized score matching is hard to be scale to practical neural networks.
6 CONCLUSION
In this work, we presented a score-based image denoising methods for randomized smoothing. Our method does not require any re-training of classifiers, and trains only one score network that can be used for denoising of any noise type and level. We empirically found out that our denoiser performs better than conventional image denoisers and denoisers trained with the classification loss, while comparable to the random ensemble approach.
We believe that current randomized smoothing is theoretically well-designed but needs to be scalable to be deployed for real world applications. On that perspective, our approach is a good initial point that can endow robustness to any classifier without any re- re-training. However, the hardness of estimating score function of high-dimensional data should be compromised. We believe using better architecture or devising faster optimization algorithm might help.
REFERENCES
Muhammad Asim, Ali Ahmed, and Paul Hand. Invertible generative models for inverse problems: mitigating representation error and dataset bias. arXiv preprini 1905 2019.
Muhammad Asim, Ali Ahmed, and Paul Hand. Invertible generative models for inverse problems:
mitigating representation eтror and dataset bias, 2020. URL Eorum??d--JJkkyyiKDD
Anish Athalye and Nicholas Carlini. On the robustness of the evpr 2018 white-box adversarial example defenses. arXiv preprint 10Xxv:8804.033 2018.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of curity: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, pp. 274-282 2018.
8

---

Under review as a conference paper at ICLR 2021
N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 39-57, 2017.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. International Conference on Machine Learning, pp. 1310-1320, 2019.
J. Deng. W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. ImageNet: A Large-Scale Scale Hierarchical Image Database. In CVPR09, 2009.
Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. Density estimation using real nvp. arXiv preprint arXiv: 08803, 2016.
Ruediger Ehlers.
Formal verification of piece-wise linear feed-forward neural networks. In Interna- tional Symposium on Automated Technology for Verification and Analysis, pp. 269-286. Springer, 2017.
Matteo Fischetti and Jason Jo. Deep neural networks and mixed integer linear optimization. Con- straints, 23(3):296-3333 2018.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, 2014.
Kyong Hwan Jin, Michael T McCann, Emmanuel Froustey, and Michael Unser. Deep convolutional neural network for inverse problems imaging. IEEE Transactions on Image Processing, 26(9): 4500-45225 2017.
Matt Jordan, Justin Lewis, and Alexandros Dimakis. Provable certificates for adversarial exam- ples: Fitting ball in the union of polytopes. In Advances in Neural Information Processing Systems, pp. 14082-14092, 2019.
Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel Kochenderfer. Reluplex: An efficient smt solver for verifying deep neural networks. In International Conference on Computer Aided Verification, pp. 97-117. Springer, 2017.
Durk P Kingma and Yann L. Cun. Regularized estimation of image statistics by score matching. In J. D. Lafferty, C. K. I. Williams, J. Shawe-Taylor, R. S. Zemel, and A. Culotta (eds.), Advances in Neural Information Processing Systems 23, pp. 1126 1134. Curran Associates, Inc., 2010. URL http: http::/raaerrs.nissscco///gs
pdf
Durk P Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible 1x1 convolutions, In Advances in neural information processing systems, pp. 10215-10224, 2018.
Alex Krizhevsky et al. Learning multiple layers of features from tiny images. 2009,
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning scale. arXiv preprint 1xXiv:161..01266 2016.
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 656-672. IEEE, 2019.
Guang-He Lee, Yang Yuan, Shiyu Chang, and Tommi Jaakkola. Tight certificates of adversarial robustness for randomly smoothed classifiers. In Advances in Neural Information Processing Systems, pp. 4910-4921, 2019.
Alexander Levine and Soheil Feizi. Robustness certificates for sparse adversarial attacks by ran- domized ablation.
Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with additive noise. In Advances in Neural Information Processing Systems, pp. 9464-9474, 2019.

---

Under review as a conference paper at ICLR 2021
Fangzhou Liao, Ming Liang. Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE Conference Computer Vision and Pattemn Recognition, pp. 1778-1787, 2018.
Alessio Lomuscio and Lalit Maganti. An approach reachability analysis for feed-forward relu neural networks. arXiv preprint arXiv: 2017.
Mengyin Lu and Matthew Stephens. Empirical bayes estimation of normal means, accounting for uncertainty in estimated standard errors, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.00883, 2017.
Dongyu Meng and Hao Chen. Magnet: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC conference computer and communications security, pp. 135-147, 2017.
Aditi Raghunathan, Jacob Steinhardt, and Percy S Liang. Semidefinite relaxations for certifying robustness adversarial examples. In Advances in Neural Information Processing Systems, pp- 10877-10887, 2018
Herbert Robbins. An empirical bayes approach to statistics. In Proceedings of the Third Berkeley Symposium on Mathematical Statisties and Probubility, Volume 1: Contributions to the Theory of Statistics, pp. 157-163, Berkeley, Calif,, 1956. University of California Press. URL https: htt.://cc....cre.......a..aaaaas
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and
Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In Advances in Neural Information Processing Systems, pp. 11292-1 11033, 2019a.
Hadi Salman, Greg Yang, Huan Zhang, Cho-Jui Hsieh, and Pengchuan Zhang. A convex relaxation barrier tight robustness verification of neural networks. In Advances Neural Information Processing Systems, pp. 9835-9846, 2019b.
Hadi Salman, Mingjee Sun, Greg Yang, Ashish Kapoor, and J. Zico Kolter. Denoised smoothing: A provable defense for pretrained classifiers, 2020.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models. In International Conference Learning Represen- tations, 2018.
Saced Saremi and Aapo Hyvarinen. Neural empirical bayes, 2020.
Saeed Saremi and Rupesh Srivastava. Provable robust classification via learned smoothed densities, 2020.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. In Advances in Neural Information Processing Systems, pp. 11918-1 11930, 2019.
Yang Song and Stefano Ermon. Improved techniques for training score-based generative models. arXiv preprint arXiv:2006.09//, 2020.
Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv: 17100.1116.,,6 2017.
Yang Song, Sahaj Garg, Jiaxin Shi, and Stefano Ermon. Sliced score matching: A scalable approach to density and score estimation. Uncertainty Artificial Intelligence, pp. 574 PMLR, 2020.
Richard S Sutton, David A McAllester, Satinder P Singh, and Yishay Mansour. Policy gradient methods for reinforcement learning with function approximation. In Advances in neural informa- fion processing systems, pp. 1057-1063, 2000.
10

---

Under review as a conference paper at ICLR 2021
Christian Szegedy, Wojeiech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
Ying Tai, Jian Yang, Xiaoming Liu, and Chunyan Xu. Memnet: A persistent memory network for image restoration. In Proceedings of the IEEE international conference on computer vision, pp.
4539-4547, 2017.
Jiaye Teng, Guang-He Lee, and Yang Yuan. S|ell_1 adversarial robustmess certificates:
randomized smoothing approach, 2020. URL http:://openreview..eee http://wwweeeeeeeererrrree
H1 H1
Vincent Tjeng, Kai Y. Xiao, and Russ Tedrake. Evaluating robustness of neural networks with mixed integer programming. In International Conference on Learning Representations, 2019.
URL/https://ppperee/// https///pppppeeeeeeeeeeeeccoccct
net htt.:/oummmnnHCcCIditttttt
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. arXiv preprint 2001v:2002.083477 2020.
Dmitry Ulyanov, Andrea Vedaldi, and Victor Lempitsky. Deep image prior. In Proceedings of the IEÉE Conference on Computer Vision and Puttern Recognition, pp. 9446-9454, 2018.
Pascal Vincent. connection between score matching and denoising autoencoders. Neural compu- tation, 23(7):1661-1674 2011. 2011.
Jay Whang, Qi Lei, and Alexandros G Dimakis. Compressed sensing with invertible generative models and dependent noise. arXiv preprint arXiv:2003 08089, 2020.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pp. 5286-5295, PMLR, 2018.
Greg Yang, Tony Duan, Edward Hu, Hadi Salman, Ilya Razenshteyn, and Jerry Li. Randomized smoothing all shapes and sizes. arXiv preprint arXiv:2002.08/ 2020.
Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. Macer: Attack-free and scalable robust training via maximizing certified radius. In International Conference on Learning Representations, 2019.
Dinghuai Zhang, Mao Ye, Chengyue Gong, Zhanxing Zhu, and Qiang Liu. Black-box certifica- tion with randomized smoothing: functional optimization based framework. arXiv preprint arXiv:2002.09169, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Erie P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. arXiv preprint arXiv: (rXiv:/901008777 2019.
Kai Zhang, Wangmeng Zuo, Yunjin Chen, Deyu Meng. and Lei Zhang. Beyond gaussian denoiser: Residual learning of deep enn for image denoising. IEEE Transactions on Image Processing. 26 17)-314233155 2017.


Reviews:
[{"review_id": "yDeA0JWWNA5", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary & contribution: \n\nin this paper the authors propose an improved method for randomized smoothing (for provable defense) which performs better and is less computationally expensive than previous work. More specifically the authors propose two image denoising algorithms (based on score estimation) that can be applied regardless of noise level/type. In fact, the paper is mainly an improvement of Salman et al. (2020) with a blind denoiser. Therefore, it is not needed to train different models for different kind of attacks. Another advantage of the method is that one does not need to retrain the classifier and does not even need information from the pretrained classifier while the method from Salman et al.  requires access to the classifier.\n\n\nStrengths: \n\n-strong quantitative results. Experimental section is promising. The gap with white box smoothing is small on cifar. The method outperforms Salman et al.\n\n-Only need to train one score network to handle various types of noise type/level \n\n-Denoiser doesn't need access to the pretrained classifier.\n\nWeaknesses:\n\n-In my opinion writing can be improved. I am not very familiar with the literature and it took me some time to understand section 3. More specifically I did not understand the motivation for using score based denoisers rather than a more \"standard\" algorithm for blind denoising. \n\n-Method seems to be effective for low-resolution images only. The gap with white box increases on Imagenet.\n\nQuestions for the authors:\n\n-If I understand well, one-step denoiser can only handle gaussian noise whereas multi-step can be applied to any log concave distribution? What is the advantage of one-step denoiser over multistep, does it perform better for gaussian noise? \n\n-It is not clear to me why the method does not make use of the pretrained classifier but still outperforms Salman et al. which can acess the classifier? Is it only due to the denoiser's performance?\n\n-I do not understand well the motivation for using score-based methods. Why scored based denoising in particular and not other blind denoising models? The current method is impacted by the size of the images, while most of the existing blind denoising algorithms are not affected by the size of the image. Actually, why even focus on learning base methods? Cannot simpler methods with handcrafted priors do the job? I might also be wrong. Could you please elaborate?\n\n-Qualitatively speaking it seems to me that the visual performances are not very good when compared to existing denoising algorithms (maybe a quantitative comparison in term of PSNR with other algorithms would be relevant, rather than only showing qualitative results). Also the multi step denoiser seems to give a lot of artefacts in figure 1. \n\n-Aren't there missing reference in the related work regarding blind denoising ? \n\n-p5 \"the noise makes the support of the score function to be whole space, [...] non-Gaussian or off-the-manifold samples\". I don't understand that part. \n\n\nAt this stage I give a weak accept, but I would consider raising my score if authors answer my concerns.\n\nTypos:\n\np8 \"without any re-trianing.\"\n\np7 \"smoothingon\" \n\np4 \" matching obejctiv\" ", "extra_scores": {}, "extra_text": {}}, {"review_id": "rV1pv8kEVg", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 1, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a method based on denoising to protect classifiers from adversarial attacks. Unlike existing methods based on randomized smoothing with various noise distributions to retrain several classifiers, the proposed one uses denoising as the preprocess of the classifier. The experimental results demonstrate the proposed method has good performance.", "extra_scores": {}, "extra_text": {}}, {"review_id": "dC2KRx4w1jh", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper presents a denoising-based method for randomized smoothing that converts a base classifier into a smoothed one with p-robustness to adversarial examples. It considers a practical setting where the retraining/finetuning of the base classifier is largely inapplicable (e.g. the commercial classification service with only API provided to users).  To do this, it adopts a recently proposed methodology termed denoised smoothing [1] by prepending a custom-trained denoiser to the pretrained classifier. The major novelty of this work lies at the proposed denoising method using learned score function. The new denoising method only requires training one score network and is readily applicable to defend various $l_p$ adversaries, which is a key feature not available in [1].  The experiments show the proposed method outperforms the previous denoising-based approach, and is sometimes on par with the white-box approach [2] that manipulates the classifier. \n\nBasically, this is an incremental work over [1] but the contributions claimed are perceived myself (though I have to admit I'm an expert on image denoising, instead of adversarial defense) \nHowever, I do have some concerns about the method and the experiments, listed as follows:\n\n- The major advantage of the score-function-based denoiser is the flexibility to handle various noise types and levels.  I don't expect it can beat the specialized Gaussian denoiser [1] under Gaussian perturbation setting.  As it is the case on Table 1/2, I'm wondering what's the benefit of  the proposed denoiser over the state-of-the-art Gaussian denoisers (as used in [1]) under Gaussian noise setting?\n- The flexibility to tackle various $l_p$ adversary, the key feature of the proposed method is not thoroughly evaluated. In Table 2, I suggest the authors to add comparisons to [1] with denoiser trained on Gaussian noise setting, as well as ones trained with noise type aligned with the test setting. \n\n[1] Denoised Smoothing: A Provable Defense for Pretrained Classifiers, Arxiv 2020  \n[2] Certified Adversarial Robustness via Randomized Smoothing, ICML 2019\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "83YOTFFuxiH", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Update: I have read the author's response and decided to keep my review, confidence, and score.\n\n---\n\nSummary: randomized smoothing is a method to construct provably robust classifiers via additive Gaussian noises on the input. The authors propose to learn score functions as a means to denoise the randomized image prior to a trained classification model. As the denoising + pre-trained classifier architecture is already proposed, the contribution is only limited to the choice of using a score function. The justification and realization of the method is limited for two main reasons. See below. \n\n1. Efficiency: one of the most critical bottleneck of randomized smoothing methods is the slow prediction time. The score-function based generative / denoising models are known for their slow sampling time, so the proposed method undermines randomized smoothing in efficiency. \n\n2. Many design choices in this paper is not well justified. \n\n2-1) How good does the RHS of Eq. (12) approximates the gradient descent procedure? \n\n2-2) Even if the true gradient descent can be executed, the bound in Eq. (13) seems very bad in high dimension, thus the smoothed classifier will not be accurate unless the pre-trained classifier is already robust in the local region. \n\n2-3) Clearly using the same score function for multiple $\\sigma$ is suboptimal. Although the authors mentioned this part as an advantage, but it is not clearly compared to existing methods. Would existing methods fail if they use the same denoising function for multiple $\\sigma$?\n\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper proposes an improved method for randomized smoothing, reducing computationally complexity compared with some previous works. The authors propose to learn score functions to denoise the randomized image prior to feeding it to a trained classification model. More specifically,  two image denoising algorithms based on score estimation are proposed to be applied regardless of noise level/type.


Strengths:
- The paper shows strong quantitative results. The gap with white box smoothing is small on cifar, outperforming Salman et al. However according to the authors, the performance advantage could be mainly attributed to (1)  the use of better network architecture and (2) the multi-scale training, not the major contribution of a score-based denoiser. 
- The denoiser doesn't require access to the pre-trained classifiers.
- The proposed method only requires training of one score network to handle various types of noise type/level, although reviewers have raised concerns about motivation to having a method that only needs one denoiser for multiple noise levels -  the computational bottleneck of randomized smoothing is the prediction time rather than training time and  using the same score function for multiple noise levels could be suboptimal.

Weaknesses:
- There are some concerns about the significance of the contribution as well as novelty of the work, as the denoising + pre-trained classifier architecture is already proposed. Specifically, the work can be seen as incremental to [1], although the work uses a score-based image denoiser whereas [1] uses a CNN based image denoiser and this work is more efficient as it requires only one score network, while [1] trained multiple denoisers with respect to each noise levels. 
- Reviewers have expressed concerns on the prediction efficiency of score-function based generative / denoising models.  The proposed method might exacerbate the weakness of randomized smoothing (i.e., slow prediction), especially in high-dimensions. 
-The reviewers are curious to see the benefit of the proposed denoiser over the state-of-the-art Gaussian denoisers (as used in [1]) under Gaussian noise setting.
-Method seems to be effective for low-resolution images only. The gap with white box increases on Imagenet.

[1]. Salman, Hadi, et al. "Denoised Smoothing: A Provable Defense for Pretrained Classifiers." Advances in Neural Information Processing Systems 33 (2020).

Decision: Reject