Statistical Verification of General Perturbations by Gaussian Smoothing
Authors: Marc Fischer
Maximilian Baader
Martin Vechev
Venue:  (2020)
Keywords: adversarial robustness
certified network
randomised smoothing
geometric perturbations

Abstract: We present a novel statistical certification method that generalizes prior work based on smoothing to handle richer perturbations. Concretely, our method produces a provable classifier which can establish statistical robustness against geometric perturbations (e.g., rotations, translations) as well as volume changes and pitch shifts on audio data. The generalization is non-trivial and requires careful handling of operations such as interpolation. Our method is agnostic to the choice of classifier and scales to modern architectures such as ResNet-50 on ImageNet.

Under review as a conference paper at ICLR 2020
STATISTICAL VERIFICATION OF GENERAL PERTURBATIONS BY GAUSSIAN SMOOTHING
Anonymous authors Paper under double-blind review
ABSTRACT
We present a novel statistical certification method that generalizes prior work based on smoothing to handle richer perturbations. Concretely, our method pro- duces a provable classifier which can establish statistical robustness against geo- metric perturbations (e.g.. rotations, translations) as well as volume changes and pitch shifts on audio data. The generalization is non-trivial and requires careful handling of operations such as interpolation. Our method is agnostic to the choice of classifier and scales to modern architectures such as ResNet-50 on ImageNet.
INTRODUCTION
The success of deep neural networks (Krizhevsky et al., 2012 Silver et al. 2017) and their use
in various application domains has triggered a concern to the sensitivity of these models to small, imperceptible perturbations, known as adversarial examples (Szegedy et al.) 2014). Over the last few years there has been substantial interest in finding adversarial examples (Carlini & Waanner 2017]. empirically (Madry et al., 2018) and provably (Wong & Kolter 2018 Mirman et al. 2018 defending against them as well as proving the neural network is robust to these (Gehr et al. 2018 Much of the focus so far has been on restricted, norm-based perturbations and while these cover important attacker models, has been shown that natural perturbations, e.g., image rotation, can trigger adversarial behaviors not covered by norm norm-based attacks (Engstrom et al. 2017).
In this work we focus on certifying a neural network against a wider class of perturbations, by generalizing a recently presented statistical technique (Lecuyer et al.) 2018 Cohen et al.. 2019), called smoothing, for creating classifiers that are provably robust against certain norm-based attacks. The basic idea behind smoothing is to sample many possible perturbations of the input, classify each of them, and use the aggregate information to make a final robust classification. Overall, the method provides statistical guarantees for 12-norm robustness around given input (e.g., image). In our work, we generalize this method to also handle perturbations of the parameters a given transformation (e.g., the angle of rotation). This generalization means that study the effectiveness of smoothing across a wider range of interesting perturbations (e.g.. image rotation and translation), not previously possible. The generalization is non-trivial and requires careful handling of operations such as interpolation.
now apply and
Our main contributions are:
A generalization of the Gaussian smoothing framework richer class of perturbations, with local robustness guarantee on the parameters of the perturbation.
The first statistical verifier able to certify rotations and translations images. The system scales to large input sizes and networks such as ImageNet classification. Concretely among other results we are the first to create and certify provable ImageNet classifier (with high confidence) for image translation and rotation.
An evaluation showing the strengths and limitations of the smoothing approach across a richer class of perturbations than previously possible.

---

Under review as a conference paper at ICLR 2020
2 RELATED WORK
We now survey the most closely related work in exact and statistical certification as well as richer perturbations beyond norm-based attacks.
complete and incomplete methods To defend against Ip norm bound ad- versarial examples, many techniques have been developed to verify that classification is stable in the presence of an attacker. These techniques include complete methods which guarantee a proof of robustness or provide counter example, such as SMT solvers (Ehlers) 2017 Katz et al. 2017 Bunel et al., 2018), as well as incomplete methods which are sound but may suffer from false pOsi- tives due to too much approximation error. Examples of these include abstract interpretation based methods (Gehr et al. (2018) Gowal et al.) 2018: (Singh et al. 2201)), linear relaxations (Zhang et al.)
Exact Certification:
2018 Weng et al. 2018) and semi definite programming (Raghunathan et al. 2018). Kurakin et al. 2017) Madry et al. (2018 8 train empirically robust networks by inc including ad adversarial examples in the training set. Wang et al. (2018a)b) replace the softmax layer to increase adversarial robustness. While both methods improve empirical robustness, the method does not provide a formal certificate. Provable defenses (which use incomplete methods) aim to address the issue to some degree by train- ing networks in way where they are more provable (Mirman et al.] 2018 Wong & Kolter] 2018). However, because complete methods are not scalable and incomplete methods lose precision (by de- sign), exact formal certification and training of large-scale networks with good absolute guarantees is a challenging task and remains an active area of research.
Statistical Certification via Smoothing One can trade the absolute (exact) guarantees for proba-
bilistic ones by using smoothed classifiers that scale to much larger networks (Lecuyer et al. 2018 Li et al. 2018: Cohen et al., 2019 (Salman et al.. 2019). A smoothed classifier g can be built out of an ordinary classifier f by taking the majority vote among perturbed inputs i.e., f( + 5) where d drawn from a probability distribution. Smoothing has the advantage that it scales to large models, however, it can suffer from added overhead during inference time, and currently only provides l2 robustness statistical certification on limited input perturbations (e.g., pixels of an image). In this space, Lecuyer al. (2018) presented the first certified robustness method based randomized smoothing. Later, Li et al. (218)) improved these bounds, which where further improved by Cohen ett al. (2019). [Salman et al. (2019) improved the results of Cohen al. (2019) by performing ad- versarial training on the smoothed classifier, [Wang et al. (2019) similarly inject Gaussian noise into ResNet architectures to increase adversarial robustness.
Certification of geometric transformations Beyond Ip norm bound attacks, more realistic at- tacker model includes perturbations such as geometric attacks, i.e., rotations, translations and shear- ing (Engstrom et al. 2017, Kanbak et al., 2018). Work on certification against geometric attacks was performed by (Pei et al. 2017) using enumeration and (Singh et al., 2019) using abstract in- terpretation. Neither work scales to large networks and images. Thus, an interesting question is whether we can handle more complex perturbations (e.g., rotations) on larger networks. Towards this, in the rest of the paper, show generalization of the smoothing method to this richer class of transformations.
3 SMOOTHED CLASSIFIER
In this work we consider parameterized transformations of data points x E R". We denote the smoothing transformation with parameter E Rd by t/s IR" - RR". Further we denote the atlucker transformation Φ6 Ra - R" with E Rd as the perturbation that the adversary can apply. We require that v and é compose as v. ob v.+6. Examples of attacker transformations are image rotations and translations as discussed Section
Using this notion of transformation now define a smoothed classifier:
Definition 3.1 (Smoothed Classifier). Given a base classifier f : RD -> {1,..., k}} and a transfor- mation Uh : Ra + RD with E Rd we define smoothed classifier 9f. Rm - f1.....e) k):
[0(x)) arg max Pa (f())(())) = =c) 8 N(0
2

---

Under review as a conference paper at ICLR 2020
for covariance matrix Σ (symmetric positive definite matrix).
Algorithm for prediction
Algorithm for certification
evaluate at a function PREDICT(f. Σ, x. a, 1b)
# certify the robustness of around x
function CERTIFY(J, Σ, x. no. aG v
counts +- SAMPLE(S, 2, n, v
counts0 & SAMPLE( 2; Ri; 2, č + top index in counts(
CA. čg + top two indices in counts
AA RB & coal counts(ea if PVAL.U nA nB, 0.5) S a
counts < SAMPLE(f. n, E, 10)
PΛ f- LBouND(count (( n1,
return čд
if PA > Y return éд and else return ABSTAIN
else return ABSTAIN
As it is usually clear from the context, we drop sub- and super- script and just write
Given this definition we state our main theorem on the robustness of the smoothed classifier w.r. attacks Φ. This is an adapted version of the main theorem presented in Cohen et al. (2019):
Theorem 3.2. We assume fixed but arbitrary data point E RR, base classifier R" {I....,k, k) and transformation V. IR" + Rm Further we allow an attacker to choose ā and apply
(s(x), v. 05 1/+55-
Then: If (()( = CA) = PA M PA 2
PB =
PB =
max P(f(os(x) = -c) then
g(bs(z)) for all 5 such that V Σ- 18
(p
(PB)
2
Proof. The proof similar the one given by Cohen 2019 and is stated in Appendix A
(pa) (pp)
Throughout the paper we refer to
as the certification radius R.
(2019) are: (i) we allow general transformations & rather than only additive noise, and (ii) we consider a full covariance matrix Σ rather than an isotropic one. Specifically for (ar) = æ + 8 and = In, our theorem exactly recovers the statement from Cohen et al. (2019). These two additions enable to tackle many interesting transformations. Due to the similarity of Theorem 3.2 to their main theorem we can also use very similar versions their algorithms, shown in Algorithms [ and 2] Theorem 3.2 is deterministic statement, as the only involved random variable is integrated out. However in practice, the theorem only holds with a have finite amount of samples estimate PA (or PA) and pg (or PB). The
The key differences to Cohen et al.
certain probability function SAMPLE(S. I, Σ, 1)) returns n samples of (x));
(0, Σ). These samples are then used statistical test to determine Pa or test it is > wwith certainty - a for a given a. both algorithms Pø - PA- The probability that Algorithm| returns a class other than g(x) most a and with probability of at least Algorithm 2 does abstain.
4 EXAMPLE PERTURBATIONS
We now discuss several practical perturbations v which are important and can be handled by generalization. Specifically, we will consider low parameter image transformations such as changes in contrast and brightening well geometric transformations such rotation and translation, which require special attention to deal with interpolation. Further, we describe low parameter audio transformations such changes in volume pitch.
4.1 IMAGE PERTURBATIONS & INTERPOLATIONS
Interpolation A major issue with image transformations such as rotation and translation (for non- integer offsets) is interpolation. A pixel in the transformed image maps location in the original image (not necessarily on the pixel grid) where the pixel value taken from. To obtain the value, we need interpolate it. Typical interpolations for images are nearest-neighhor interpolation, bilinear
3

---

Under review as a conference paper at ICLR 2020
interpolation and bicubic interpolation. Further, if the transformation moves coordinate outside of the original image, the pixel value is commonly set 00) (black).
We explore the issues created by interpolation using the example of rotation, the same method applies other geometric transformations. We denote the rotation and subsequent interpolation of an image x E IR" by an an angle 3 as (a:) ). In general rotateg o rotale, * rotates+7 due to interpolation. Thus, we choose b3 == rotates, this does not compose with an angle y chosen by an attacker Φ.. To formalize this problem we write (rotateg o rotate,, (x) rotates+, (x) + 68,y(2) where 6,,> (2)) denotes the interpolation error.
Modeling Interpolation We address this by modeling the composition of two rotations single rotation together with addition of lg noise. The smoothing operation against an attacker utilizing rotation is (.,(()) 1 (()) (x) == rotates(x)) + 17. For ease of notation we write 22..
We will let the attacker choose ö = (ō) but in truth apply 8 (2) for a yet be determined to offset the interpolation error. Thus we can model the overall attacking and smoothing process as:
(V3,, o @r,w ()thwtto())
= =rotate3+ (x) + 17 + w = rotate; o rotate, -3,, + + w.
(1)
Now choosing w Eg,, (x) we can get rid of the introduced interpolation errors. Thus, our overall
transformation v),,,, 6,,- recovers the semantic of the, , 07.0 without interpolation. Instantiating
where Ln denotes the n x n Identity Theorem 3.2 with this transformation and 2 ( o matrix, we obtain the bound:
1 < R
R30 S Σ 8 < R2
22 2 wT R² 72 o -
-R, (1)1)1
or
hl ar V R2 =
(2)
When Approach Using Eq. (2), we can derive an algorithm that certifies range of rotation angles and extend CERTIFY to return [y| rather than R. There are four ways one can proceed here:
with E upper bounding (=))l2 < E. In the first step we also need to assume that R > R is negative (or term under the root is negative) we take the bound hy| = 0.
Per-Ipuut Global Optimization: we are given fixed image æ and range l'minn Ymmx] we can calculate the worst case interpolation error by performing global optimization over y E [Timins Ymax] and B 180, 180). In CERTIFY we would first calculate before proceeding with the rest of the procedure. This procedure can be improved by only considering 3 E [-30,, -3,,, which likely simplifies the optimization problem and still covers 99.7% of possible angles.
Per-Input Sampling: Similar to the global optimization approach, we can, for given and range [Timin: 7max] sample different interpolation errors and obtain a probabilistic guarantee on E.
Training Set Global Optimization: If we assume that our will come from the data distribution we can already pre-compute the maximal E over the training set.
Training Set Sampling: Again assuming that follows the data distribution we can sample different E over the training set and rotation angles and take the maximum.
There are two major downsides here: (i) the global maximum of the error norm might be quite large even though the majority of values is actually quite small and (ii) approaches based on the training set sampling might not find the correct maxima and only provide probabilistic guarantees.
In practice (see Fig. [ discussed later) most error norms are small under certain assumptions. How- ever, some are vast outliers. This effectively rules taking the maximum of E (either for specific a or over the whole dataset) as it becomes essentially impossible to obtain a bound in Eq. 2 This rules out taking the global maxima of the error E.
Further, we need to consider that sampling many interpolation errors for a specific image can be done but is expensive. Rotating
I color image with bilinear interpolation requires around
4

---

Under review as a conference paper at ICLR 2020
74 11-1- 1. floating point operations which quickly becomes a bottleneck. This rules out creating new set of samples for every image.
For these two reasons offline as the only viable way. We treat each sample as a boolean random variable and obtain the Clopper-Pearson upperbound (Clopper & Pearson 1934) with confidence 1 p.
computing probabilistic bound (P S t) S over the training set
Probabilistic Guarantees Assume that in CERTIFY or PREDICT we observe ñ and ö examples of classes сл and en when taking n. în samples. As in Cohen et al. (2019), we estimate PA. the probability that we observe CA. and lower bound it by PA with confidence 1 a.
Due to probabilistic guarantee E, there subsequently the bound on 5 in Theorem 3.2 is not satisfied. When estimating and Pg we must account for these bad samples. Specifically we can assume that in the worst case all of these samples would have counted towards class сд and construct conservative lower bound. We can model the real chance of observing clean samples from сΛ, denoted PA by using the union bound:
samples that not be trusted as Eq. (2) and
Pa P(samlle from CΛ V sample is bad)
I (sample from C.) + (sample bad)
PA S PA + PA P
Since we had confidence 1-a and 1-p for PA and E the confidence PA for 1 In Cohen et al. (2019) the authors note that the probability that PREDICT returns wrong class and that CERTIFY abstains are both at most a, when PA was estimated with confidence a. The same applies to our probabilistic approach, but the failure rate becomes a + p. Fig. shows the overall bound on ln|-
Finally, obtained our probabilistic guarantec on E with sampling from y E U([[~minn Ymux I), we need in order to be sound mention that we do not guarantee robustness for all ry covered by Theorem 3.2 but only those intersecting with Yminy Yanax
4.2 INTERPOLATION-FRER PIXEL TRANSFORMATION
While we mainly focus on dealing with image perturbations that introduce interpolation error, there many that do not. A simple class here are perturbations that are additive operations in some color space (RGB, HSV, HSL, etc.). For example, to model brightness we consider the perturbation ()((x) x + 3
in RGB space where the vector of ones with the same dimensions as the image The equation can easily be adapted to have different 3 per color channel or even per region of the image. We can also model multiplicative changes, by bounding them the exp domain. As an example, we consider changes in contrast, 1/2 (a) = 128 + e (xc 128)
1/ (x) 128 e e (x: 128) = 128 + 8+7 (x: 128) = ()))((r))
However we can not combine additive and multiplicative perturbations into linear transformations without additional assumptions about the order in which perturbations are applied.
The perturbation of the attacker is likely applied to the image in integer space (i.e., each pixel intensity value is an integer in (O...., 255}). Thus after applying additive or multiplicative scaling the value might be rounded. Hence, to show that perturbations with value |8] are safe, we have to verify that fact |/ 1| is safe (depending on the exact rounding behavior adding 1 might be sufficient). For multiplicative changes, corresponding safety margin can be calculated.
4.3 AUDIO PERTURBATIONS
The domain of audio data has similar challenges as the one for image processing. As before, we handle low parameter attacks like shifts in pitch or changes in volume:
Volume The volume of an audio signal can be changed by multiplying the signal with a constant. The smoothing operation is ( == el x and similarly the adversary operation is (x) e.. We see that the composition additive in the parameter space:
3/ (x) = e e e . th (x),
where we clip values exceeding the range of the values of x back when needed.
5

---

Under review as a conference paper at ICLR 2020
M
count
80000
2.0
60000
1.5
40000
1.0
20000
0.5-
1
1-0.0
EMi 1225
2-0.0
EMA 166
... 0.00
10.0, 3220
10.25, 0.5)
10.5, 0.75)
10.75, 1.0)
11.25, 1.5)
11.s 1.75)
11.75, 2.0)
2.0
o. 1.25)
0.0
0
5000
10000
15000
20000
samples
Iél2
Figure 1: Bound for Iy| in the case where the base classifier f returns the class сΛ for all sam- ples for o, 1. Different values of o, scale the bound multiplicatively.
Figure 2: Histogram of (x)]l for bilinear interpolation after preprocessing for a sampled from the training set, s.t. its shorter side is at least 2000 pixels.
Pitch shifts We let DFT denote the discrete Fourier transform and IDFT is its inverse. The trans- formation that shifts an audio signal by 33 is v (xx) := IDFT + DFT(x)). Further, for an attacker o, = IDFT(> + DF)( the composition of these two is again additive in the parameter space:
IDFT + 7 DFT(x)) = (x),, where we again neglected the frequencies exceeding the frequency range of the applied DFT. Fur- ther, 33 and y are rounded to the frequency steps of the DFT, requiring bound similar to Section 4.2
o o (x) IDFT (3 (F + DFT()))))
EVALUATION
Setup We evaluated our algorithm on machine with 16 CPU cores running 3.5GHz and GeForce RTX 2080 Ti. We run the perturbation on the images in parallel on CPU and evaluate the network the GPU with a batch size of 64 in PyTorch (Paskke al., 2017).
ImageNet Pipeline and Interpolation Error In our evaluation we use the ImageNet classification dataset (Russakovsky al.) 2015). While our algorithm works for general image datasets (with few restrictions, discussed later in this section) we will specifically discuss this dataset as we require the specifics of the image classification pipleline images in the ImageNet training dataset range in size from 20 x 17 to 7056 x 4488. Some classifiers are adaptive in the input size, but most neural network based methods are fixed to take images of size 224 x 224 (Krizhevsky et al. 2012) He et al., 2016). Thus the standard procedure is to first resize the image such that the shorter side has length 256 and then take the 224 224 center of the image and run the classifier on this image. We denote all of this preprocessing as preprocess (x).. side effect of this preprocessing that rotation of less than |>| S 8.13 degrees is applied to an image, then the preprocessed image will not have black corners, as tan tan-1 ( (256 222 8.13 gives
precisely model and discuss perturbations. The
224
the largest angle for which this holds based on the resizing and cropping size.
Further, many image pipeline implementations can perform these perturbations on floating point images or 8- b-bit-integer-basel images. In the integer case the result of the interpolation is rounded to the closest value (O..... ... 255). In this work we assume the transformations are performed in integer space as this models more realistic attacker. We let r denote the function that maps images from the integer domain to the [0, 1] floating point domain, by dividing by 255. When adding noise, the pixel values might exceed their bounds, thus they clamped to 0 and 255 to 0 and respectively, by the clamping function clamp. To facilitate faster training (Simonyan & Zisserman, 2013) the pixel intensities have their mean subtracted and are scaled to have standard deviation of 1. This is known as normalization (normalize).
In general can ignore all preprocessing and replace the base classifier f with f' normalize clampo o o preprocess, but in this section we need to specifically look at the inter- actions between this and the smoothing procedure.

---

Under review as a conference paper at ICLR 2020
Table from samples via Clopper Pearson Interval bounds with 99.9% confidence.
interpolation
P(E 1.00)
P(E 1.25)
P(E < 1.50)
nearest
0.51
0.71
0.83
rotation
bilinear
0.21
0.96
0.97
bicubic
0.09
0.96
0.96
nearest
0.56
0.55
0.60
translation
bilinear
0.21
0.99
0.99
bicubic
0.07
0.90
0.99
Table 2: Certification results for translation and rotation with 99.8% confidence.
Transformation
Model
Abstained
Verified
Accurately verified
Correctly verified
rotation
So.5
23 (35%)
10 (15%)
8 (12%)
6 9%)
rotation
S1.0
16 (25%)
10 (15%)
5 8%)
3 5%)
translation
So.5
15 (23%)
20 (31%)
11 (17%)
9 (14%)
Table 3: Certification for brightness changes and rotation with 99.9% confidence.
Model
Abstained
Verified
Accurately Verified
Correctly Verified
8
R
20 (20%)
80 (80%)
70 (70%)
64 (64%)
20.37 + 14.59
So.5
47 (47%)
53 (53%)
47 (47%)
25 (25%)
15.65 + 12.61
Table Certification for contrast changes and rotation with 99.9% confidence.
Model
Abstained
Verified
Accurately Verified
Correctly Verified
44 (44%)
56 (56%)
49 (49%)
45 (45%)
0.21 + 0.17
R
0.4
73 (73%)
27 (27%)
22 (22%)
19 (19%)
0.27 + 0.21
So.5
0.2
77 (77%)
23 (23%)
14 (14%)
14 (14%)
0.15 + 0.10
So.5
0.4
90 (90%)
10 (10%)
6 (6%)
5 (5%)
0.23 + 0.18
While would, based everyday experience assume that interpolation errors small, the la norm can be surprisingly large. For a large sample of images æ from the training and pairs of angles of 3.9
3, 7 measure the norm of the interpolation error ||eg,n [==]]- We observed mean with a standard deviation of 3.3 and maximum of 60. A key observation is, that larger images have lower errors. For example, taking random 250 250 image æ from the ImageNet training set and calculating 5.5, but still a very similar image. For comparison the largest la perturbations considered in provable robustness are around 3.8 (Cohen et al. 2019 Salman et al. 2019).
preprocess) (ax) (()))((roo (7 preppoocss rotate-g o rotates) (a+)]l ll2 yields value of
(x)))
Scaling the image up by a factor before performing this routine reduces the error norm already to 1.49. This is not merely an artifact of scaling up the images, but that larger images in general have a quite low error, as can be seen for example in Fig. 2 which shows interpolation errors ||ě| for images such that the shorter side is at least 2000 pixels long.
Rotation & Translation To apply rotation and translation we use the framework developed in Section 4 However, in practice we apply the rotation before any preprocessing (as this is where the real attacker would do), and the error-offsetting noise after, as preprocessing operations such as down-scaling and cropping tend reduce it. This does not weaken the attacker, but is only a techni- cal detail of the implementation. So specifically we consider classifier f" fonormalize clamp and a perturbation (w = (r o preprocess rotate, rotate, (x)) - ê + + w. where ? (r preprocess rotates rotate,)(x)) (r preprocess rotateg+;)

---

Under review as a conference paper at ICLR 2020
Replacing the perturbation and с in Eq. ① with these ultimately yields to smaller bound on E in Eq. 2. Due to the size issues outlined before, we consider only images from ImageNet where the shorter side has at least 2000 pixels. Fig. shows the distribution over ||e]| over sample of these images and different angles 33 ~ (O 5²) E ( 8)). We chose these distributions to model the errors, actually observed during the smoothing procedure: Here we assume an attacker choose E [-8, 8] and σr = 5. Based on these samples we derive IP P(E < t) listed in Table [ More details, including histograms for translations are given in Fig. 3 in the Appendix.
We now evaluate our algorithm on the images of the ImageNet test set, where the shorter side is least 2000 pixels, of which there are 65, Since we are largely bound by the l2 robustness of the classifier we use two classifiers from Salman et al.) (2019). which were trained to be robust base classifiers for 1a Gaussian smoothing: So.5 denotes a ResNet-50 (He et al. (016) trained with = 0.5, c = 1.0, which had the best approximate certified test accuracy for noise levels of 1.0 and 1.5 and 110 denotes the same model trained with = 1.0. While this has slightly worse performance it was trained with higher (robustness to l2 noise, allowing to use a larger n. On our data the base classifier Sp.s was correct on 36 samples and S1.0 on 19. Further, are using E = 1.25, on 0.75, or 5, 0.001, p 0.001, no = 100, n 10000, and bilinear interpolation.
SMOOTHADV
The results shown in Table where consider the following evaluation metries: (i) Abstained shows how often the classifier did not return a certified classification, (ii) Verified is how often a radius larger than O was proven to be correct for a class (note that the verification is approximate with the stated confidence), (iii) Accurately Verified shows how many samples could be verified for the same class as the base classifier predicted, and (iv) Correctly Verified shows how many samples were verified and also had the correct label to the dataset.
The biggest trade-off in these experiments is choosing on as large as possible, to obtain a good bound in Eq. (2). However, at the same time this lowers the accuracy and thus decreases the bound. Interestingly more samples don't io necessarily help us as much as they do in Cohen et al. (2019) as our estimate of P. is fundamentally limited by Eq. (
dar For rotation with Su.s the mean standardd deviation is 3.24 degrees for the verified examples and 3.56 + 0.50 degrees for S1.0. For transformation on Su.s. dy 1/2 S 10.70 + 3.60, where dr and dy denotes the offset in x and y direction respectively. To be sound we would need to limit de and dy to at most 22 as this was our assumption when obtaining E, but the distribution for larger changes is similar to the one obtained for #2 so an argument for the full range can be made. The average run time to certify rotations with 10000 is 256.27s and for translations 250.02s.
We conclude that the main bottlenecks are the inequality Eq. 33, the accuracy of the base classifier and its robustness to l2 allowing us choose larger o..
Brightness and Contrast In contrast to the perturbations that perform interpolation we do not need use Eq. 2 but can directly use Theorem 3.2 So for brightness changes and contrast changes we use Σ = a (a scalar), and since for this task we don't 't specifically need an 42 robust network, we use standard R5 (He et al. 2016) from Py PyTorch Torchvsion (Paszke et al., 2017 denoted as R, as well as So.s from before. The results are shown in Tables 3 and 4 For brightness we use
a = 12 and for contrast a = 0.2 as well as a = 0.4. For both we use rio = 100, n 10000 and = 0.001 and observe an average evaluation time for n 10000 of 24.01 To be sound w.r.t. integer rounding we need to subtract 1 and 0.0008 from the ,3 in Table and Table respectively. The results highlight how much the accuracy and robustness of the base classifier aid verification. R is much more accurate than So.5 allowing us to certify large ranges of brightness changes.
6 CONCLUSION
We presented a way to extend the Gaussian Smoothing framework (Cohen et al., 2019) to interesting perturbations in application domains such image and audio classification. In our evaluation showed that the approach is applicable to complex tasks such as ImageNet classification, although we believe that improvements to classifiers and application domain specific insights can strongly improve the results. We believe that this work makes Gaussian Smoothing applicable outside the often considered ball and will trigger further work in this direction.
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
Rudy Bunel, Iiker Turkaslan, Philip H. S. Torr, Pushmeet Kohli, and Pawan Kumar Mudigonda. A unified view of piecewise linear neural network verification. In Samy Bengio, Hanna M. Wal- lach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa-Bianchi, and Roman Garnett (eds.), Ad- vances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurlPS 2018, 3-8 December 2018, Montréal, Canada., pp. 4795- 4804, 2018. URL wow.-aaeeoooaaaa-aooooo-----ee-- piecewised wee i weninnnnnr-i.
Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22 22-26, 2017, pp. 39-57. IEEE Computer Society, 2017. doi: 10.1109/SP.2017.499 URL https:
//doi. org/1.00r/10... 1109/SP. 2017.201....
Charles J Clopper and Egon Pearson. The use of confidence or fiducial limits illustrated in the case of the binomial. Biometrika, 26(4):404 413, 1934.
Jeremy M. Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via random- ized smoothing. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, Cali- fornia, USA, volume 97 of Proceedings of Machine Learning Research, pp. 1310--320.. PMLR, 2019. URL http::tpppp://o
ml www...rrr...s.....mmmmm..mmmm... / 97 cohen 9c html
Rüdiger Ehlers. Formal verification of piece-wise linear forwafo neural networks, In Deepak D' Souza and K. Narayan Kumar (eds.). Automated Technology for Verification and Analysis 15th International Symposium, ATVA 2017, Pune, India, October 3-6, 2017, Proceedings, volume 10482 of Lecture Notes in Computer Science, pp. 269 286. Springer, 2017. doi: 10.1007/978-3 319-68167-2) URL https: /ww. org/ / 1 0. 1000 978 3- 31 9 11-8866621119
Logan Engstrom. Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry. A rotation and translation suffice: Fooling cnns with simple transformations. CoRR, abs/1712.02779, 2017.
URL
org/ abs 02779
Timon Gehr, Matthew Mirman, Dana Drachsler-Cohen. Petar Tsankov, Swarat Chaudhuri, and Martin T. Vechev. AI2: safety and robustness certification of neural networks with abstract interpretation. In 2018 IEEE Symposiun on Security and Privacy, SP 2018, Proceedings, 21- 23 May 2018 San Fruncisco, Califorria, USA, pp. 3-18. IEEE Computer Society, 2018. doi: 00058. StRl:htts:://ett
www.ooggo10... 1109/SP 201 8 00058
Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Ue- sato, Relja Arandjelovie, Timothy A. Mann, and Pushmeet Kohli. On the effectiveness of interval bound propagation for training verifiably robust models. CoRR, Abs/1810.12715, 2018. URL 12715
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pp. 770-778. IEBE Computer Society, 2016. doi: 10.1109/CVPR.2016.90
WRRLhhtss://dii.ooo
10. 1109//VPRR 2016....006.9
Can Kanbak, Seyed-Mohsen Moosavi-Dezfoolli and Pascal Frossard. Geometric robustness of deep networks: Analysis and improvement. In 2018 IEEE Conference on Computer Vi- sion and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018, pp.
4441-4449. IEEE Computer Society, 2018 doi: 10. 109//1/P 2018. 8.0487. URL http:
//cpenaccess. thecvf. wtt.:/ommcccccee content cvpr 2018/ //tmm////////mmmmm///e//t/ KKanaaKaaaak.. Gecmetric Robustness CVPR__CR__2___ 2018 wwwpppp.......
Guy Katz, Clark W. Barrett, David L. Dill, Kyle Julian, and Mykel J. Kochenderfer. Reluplex: An efficient SMT solver for verifying deep neural networks. In Rupak Majumdar and Viktor Kuncak (eds.), Computer Aided Verification 29th International Conference, CAV 2017, Hei- delberg, Germany, July 24-28, 2017, Proceedings. Part I, volume 10426 of Lecture Notes in Computer Science, pp. 97- Springer, 2017. doi: 10.1007/978-3 319-63387-9) 5. URL 31 63387-9
https://dos org 0000000.0000000

---

Under review as a conference paper at ICLR 2020
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep volutional neural networks. In Peter L. Bartlett, Fernando C. N. Pereira, Christopher J. C. Burges, Léon Bottou, and Kilian Q. Weinberger (eds.), Advances in Neural Information Pro- cessing Systems 25: 26th Annual Conference on Neural Information Processing Systems 2012. Proceedings of meeting held December 3-6, 2012, Lake Tahoo, Nevada, United States., nips. cc cC wccppappr/450 4824
pp. 1106-1114, 2012. URL bttp:://pappie classification with teath-deep-re wonvolutionss
imagenet
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017. URL htt.s:://openrevieee
Bet/Fozum?id=3Jn.
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. 2019 IEEE Symposium on Security and Privacy (SP), pp. 656-672, 2018.
Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Second-order adversarial attack and certifiable robustness. CoRR, (bs//189.00311,, 2018. URL htttp://arxiv org aabs/ 18C9903113
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Con- ference Track Proceedings. OpenReview.net, 2018. URL https: / //openrevii neww net.
Forum?id-rJzI3ER
Matthew Mirman, Timon Gehr, and Martin T. Vechev. Differentiable abstract interpretation for provably robust neural networks. In Jennifer G. Dy and Andreas Krause (eds.), Proceedings of the 35th International Conference on Machine Learning. ICML 2018, Stockholmsmüsssan, Stockholm, Sweden, July 10-15, 15, 2018, volume 80 of Proceedings of Machine Learning Research, pp. 3575- 3583. PMLR, 2018. URL
wwwppressvvve v80/mim0m rman 8b. html
Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in pytorch. 2017.
Kexin Pei, Yinzhi Cao, Junfeng Yang, and Suman Jana. Towards practical verification of machine learning: The case of computer vision systems. CoRR, abs/1712.01185, 2017. URL http:
//arxiv.crg/abs//112...
Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Semidefinite relaxations for certifying robustness to adversarial examples. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa-Bianchi, and Roman Garnett (eds.), Advances in Neural Infor- mation Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, 3-8 December 2018, Montréal, Canada, pp. 10900-10910, 2018. URL http://paper nips cc cc/ httpe//aper/eee 8285 semidefinite relaxations for
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV, 115(3):111-522 2015. doi: (0.1007/s11220 1263-015-08166 16-y.
Hadi Salman, Greg Yang, Jerry Li, Pengchuan Zhang, Huan Zhang, Ilya Razenshteyn, and Sébastien Bubeck. Provably robust deep learning via adversarially trained smoothed classifiers. CoRR, abss/190.00458, 2019. URL httLhht://// //tti:://axxv....// wwwiv.iiiivv///aa//aaaaa/aaaaava org/ abs 19t0 04584
David Silver, Julian Schrittwieser, Karen Simonyan, Ioannis Antonoglou, Aja Huang, Arthur Guez, Thomas Hubert, Lucas Baker, Matthew Lai, Adrian Bolton, et al. Mastering the game of go without human knowledge. Nature, 550(7676):354, 2017.
10

---

Under review as a conference paper at ICLR 2020
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recogmition. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA. USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL http:://arxw...rg/aassssss 1409. 1556
Gagandeep Singh, Timon Gehr, Markus Püschel, and Martin T. Vechev. An abstract domain for certifying neural networks. PACMPL. 3(POPL):4111-41 2019. doi: 10.1145/3290354. URL https::/ wtt.o//0....1//2255555.1311
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference Learning Representations, ICLR 2014, Banff. AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL http: //arxiv. abs 1122. .199
Bao Wang, Alex Tong Lin, Zuoqiang Shi, Wei Zhu, Penghang Yin, Andrea L. Bertozzi, and Stan- ley J. Osher. Adversarial defense via data dependent activation function and total variation mini- mization. CoRR, abs/1809.0855 0801,, 2018a. /ttt:tt:://aattt
org/ abs/ 1 18596
Bao Wang, Xiyang Luo, Zhen Li, Wei Zhu, Zuoqiang Shi, and Stanley Osher. Deep neu- ral nets with interpolating function as output activation. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa- -Bianhi,, and Roman Garnett (eds.). Advances in Neural Information Processing Systems 31: Annual Conference Neural Information Pro- cessing Systems 2018, NeurlPS 2018, 3-8 December 2018, Montréal, Canada, pp. 751-761, mips cc http:pppsc.cpppppp//aae/ httpp/appprrr//// 7eee--3e5---eeeeeee netts with- Interpolati function
2018b. os wutp::nnn---uuuuuuuuutu-uuuu
Bao Wang, Binjie Yuan, Zuoqiang Shi, and Stanley J. Osher. Enresnet: Resnet ensemble via the feynman-kac formalism. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 2019, Vancouver, Canada, 2019.
httpttppp/aax..orrrp/goo ht/p//b///11111 10745.
Tsui- Wei Weng, Huan Zhang, Hongge Chen, Zhao Song. Cho-Jui Hsich, Luca Daniel, Duane S. Boning, and Inderjit S. Dhillon. Towards fast computation of certified robustness for relu net- works. In Jennifer G. Dy and Andreas Krause (eds.), Proceedings of the 35th International Con- ference Machine Learning, ICML 2018, Stockholmsmässann Stockholm, Sweden, July 10-15, 2018, volume 80 of Proceedings of Machine Learning Research, pp. 5273-5282. PMLR, 2018. URL
m.r. F. wwwppreesssese v80 werr8//wegg8a...t.... html
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In Jennifer G. Dy and Andreas Krause (eds.), Proceedings of the 35th Inter- national Conference on Machine Leurning, ICML 2018, Stockhoinsmüssan. Stockholm, Sweden, July 10-15, 2018, volume 80 of Proceedings of Machine Learning Research, pp. 5283-5292. PMLR, 2018. URL
mlr. wwwppeeeevvvee. v80/ wong html
Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neu- ral network robustness certification with general activation functions. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa-Bianchi, and Roman Gar- nett (eds.), Advances Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, 3-8 December 2018, Montréal, Canada., pp. 4944-4953. 2018. URL http: /atprrspppppp.peee nips cc pappr/7742 on general
efficient.nenee -ntreentttttaaaen -feccent-nnerrrll-nttwrrrrr activation functiiioooo
robust ctttsstteeeessererereeee orffeaacc....aaaaaaeeeeooooooonn
11

---

Under review as a conference paper at ICLR 2020
A
PROOF OF THEOREM 3.2
The assumption is
PP ((S o ()) = Pc Pe 2 2
By the definition of g we need show that
P (U vo o 08) (z) = 2 P o(s)
Using tha o Ø5 = V848. we get
P P([ 18+8)) (z) c) ((ʃ a )ot8) (a) = d')-
We define the set = {z Σ 2-1225- VoTI-1 pe) }. We claim that
o ((fowa()) = c) 2 P(s E A) P(f o (0+6(2) c) P(s+ A)
(4)
(5)
holds. First, we show that Eq. 44 holds.
P(s E A)
P(6 Σ V
=P(6"E-\N(0,E) = (
F(V(0, & k(p.))
④ (pe))
Pe
Thus Eq. 44 holds. Next we show that Eq. ( holds
/ [ʃ vo c)pa4o(2)d2 /, (ano(2)ddz
JRd
JAMA (f) = c)poto(2)d2 + / ()) = -c-- (z)
= I If (f))((I= c)o45(2)dz
+
(If (2)2 c| - If o
1 (z() = c) If (2()) # c))p+o(22dz
(f0)(()) clpot5(2)dz / (x) + c)po+5(3)d2
RAA
Lemmo
(x)) = c)po(2)dz / ())
(1) # c)po(2)dz [ (x)) = ())d - - po(=)d=
RAYA
Eq. 0.
Thus also Eq. (5) holds.
Lemma A.I. There exists t. > 0 such that p=) S Pa(z) - for all E A.
12

---

Under review as a conference paper at ICLR 2020
Proof.
Pa)o(2) Pa(z) = - (=
2 --)))
exx
exp (2"E-18- 1 3
What is the lowest if exists such that Pol
S t?
pa(2)
Pa+s(z)
51
(z(
exp x2 د 1 18 - 2 -/0² St
2 - 8 - 2 E-6
logt
1'
logt + 10-
Because 2 E A, we know that
'' VOVV -50 (pcc.
Does there exist & such that both upper bound coincide? Yes, namely
(pe) - x 1)) t= exp (V5TE-156 (pe))
Next, we claim that for B (=15'=--222 2 -5TE-160-1 (1 Fo) holds that
P(f c P(SE
(6)
( < P
(7)
The proof for Eq. (6 and Eq. are analogous to the proofs for Eq. and Eq. (
Now we derive the conditions that lead to P(s + A) > P(s+ B):
P(s 8 A) P 8''E V
= 56 -0 (pc)
P (FT ( 106 (pe)
V
(#VE-NN00.1+ S VOTE 184 (pe)
(VTT--5NN...)+'''' '55 VOTE 100 1 (pe)
= P + (o001))+
= -P (N(0.11 00) - VOTE-
= VoTE-18)
Similarly, we have
P( = (N(0, 1) 2 x- (1 po. V
= = 18 क Φ-1(1 pc))
13

---

Under review as a conference paper at ICLR 2020
Thus, get
P(s+ > P(s
8 (p)) - VoTE-18) > 1'VVV'''--8 (1 -1-p))
(pe) V8-Σ-18
-V 18 1- Pe'
① (pe (pe) 1 (1 pe: > 22
& Pc Φ x (par)
> v V
B FURTHER FIGURES
80303
50000
53300
E2023
3000
20303
20839
Ruo 6251
nu. 7.
n... 1200
1.35 1s)
290 F.S. Li%
fax acn
m.P. Li)
Ba 1200
1.25
R..9 20: R.S. (MM)
rex
(o Lo)
R.3. 20) n.S. 176)
iil
(a) Rotation with nearest- neighbor interpolation.
(b) Rotation with bilinear inter- polation.
(c) Rotation with bicubic interpo- lation.
count
coint
court
30000
83200
83620
40000
43300
42020
to. ln
U.o. 11.2. Lts
ILS. 1e 620
oo Lay
Un Lith
U. Lit
fo u. L
422
t uco Lab
dux Lan
020 tn do U.S. L
t
tir
(d) Translation with nearest- neighbor interpolation.
(e) Translation with bilinear in- Translation with bicubic inter-
terpolation.
polation.
Figure 3: Histogram of [|č3,, (z) la for translation and roation after preprocessing for B ~ _N(0, 5²), E u[[-8, 8)) and æ from the training set conditioned on the fact that the shorter side of x is at least 2000 pixels.
14


Reviews:
[{"review_id": "r1x1Xg40tH", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\n\nThis paper introduces a new smoothing algorithm which produces classifiers with certified robustness against adversarial perturbations. In particular, the authors are interested in settings where the input vectors need not be robust simply to \\ell_2 perturbations, for which previous authors (e.g., Cohen et al.) have already introduced a \"randomized smoothing\" classifier which possesses the desired properties. Instead, motivated by the desire to certify robustness to other families of transformations, the authors propose to introduce a smoothing transform that operates in an additive way on the underlying parameter space (rather than on the raw input vectors, as in the case of \\ell_2 randomized smoothing). The authors provide details for a few examples from image and audio data processing, and then show experimental results on ImageNet data.\n\nComments:\n\nMy assessment of this paper is that the level of novelty is relatively low. On the technical side, I do not believe this paper makes any significant contributions. The authors themselves note that the proof of the main result, Theorem 3.2, closely parallels the proof of Cohen et al. Algorithmically, the proposals of the authors are also minor tweaks of the algorithms in Cohen et al., since the types of perturbations considered in this paper are essentially single-parameter problems. (As a question: The authors prove Theorem 3.2 where the randomized smoothing operation adds possible nonisotropic Gaussian noise in the parameter space. However, it seems that in the examples, the noise added is isotropic -- it is not clear how the authors are choosing \\sigma_i in relation to \\sigma_r for the interpolation example. Can the authors clarify this, and give examples where smoothing with nonisotropic noise would actually be useful?)\n\nThe only real tweak that the authors introduce when presenting their smoothing algorithm is to introduce a small correction term in order to deal with interpolation/rounding errors. However, I do not think that this change is particularly novel.\n\nAs a final comment, I think it would have been interesting for the authors to include some simulations with audio data as well, since this constitutes one of the main motivating applications discussed by the authors.", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "SkeL435jtB", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper applied the framework of randomized smoothing classifier proposed by Cohen et al. to certify the adversarial attacks other than pixel change, including image rotating, brightness change in RGB space, Volume and pitch shifts for audio.\n\nCertifying general adversarial attack is an interesting direction. However, I do not believe this paper is qualified for publishing in ICLR. Below please find my comments:\n\nDifferent from change-pixel attack, the certification for rotation/brightness change in image classification, volume and pitch change in audio perturbations is much easier. The studied perturbation can be parameterized by a very low dimension vector (i.e. one dimension (angle and volume) for image rotation and volume change, 3 dimensions (brightness for each channel) for brightness perturbation). To certify this attack, given a base classifier, we can simply do, for example, grid search, on the low dimensional space to find the worst case with very good accuracy. And it should be able to give much better than the randomized smoothing method.\n\nOne contribution of this paper is in that: Theorem 3.2 is valid for random smoothing using gaussian with general covariance matrix. However, the effectiveness of using a general covariance matrix is not studied. In the experiment section, I find only isotropic ones are used.", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}, {"review_id": "S1l6RuK2Kr", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, the authors generalize the randomized smoothing type of robustness certification to handle many types of attacks beyond norm-based attacks, e.g., geometric perturbation, volume change, pitch shifts on audio data. At the core of the proposed generalization is using some interpolation which I think is quite straightforward.\n\n1. How about the scenario when both rotation and translation exist?\n\n2. In experiments, can the authors consider the accuracy of the certified model under the adversarial setting, i.e., find the transformation that makes the deep nets performs worst?\n\n3. Besides randomized smoothing on the input images, recently Wang et al showed that randomize the deep nets can\nalso improve the deep nets and they gave it a nice theoretical interpretation. Here is the reference: Bao Wang, Binjie Yuan, Zuoqiang Shi, Stanley J. Osher. ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies, arXiv:1811.10745, NeurIPS, 2019\n\n4. Interpolation idea has been used in improving robustness of deep nets, for example:\n1). Bao Wang, Xiyang Luo, Zhen Li, Wei Zhu, Zuoqiang Shi, Stanley J. Osher. Deep Neural Nets with Interpolating Function as Output Activation, NeurIPS, 2018 \n2). Bao Wang, Alex T. Lin, Zuoqiang Shi, Wei Zhu, Penghang Yin, Andrea L. Bertozzi, Stanley J. Osher. Adversarial Defense via Data Dependent Activation Function and Total Variation Minimization, arXiv:1809.08516, 2018 \n3). B. Wang, S. Osher. Graph Interpolating Activation Improves Both Natural and Robust Accuracies in Data-Efficient Deep Learning, arXiv:1907.06800\n\nIn sum, this paper studies the problem of certifying a broad class of adversarial attacks which is decent, however, the novelty is quite limited. Please address my questions during rebuttal.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a smoothing-based certification against various forms of transformations, such as  rotations, translations. The reviewers have concerns on the novelty of the work and several technical issues. The authors have made efforts to address some of issues, but the work may still significantly benefit from a throughout improvement in both presentation and technical contribution.
Decision: Reject