Paper: Universally Amplifying Randomized Smoothing for Certified Robustness with Anisotropic Noise (ICLR-2024)

Reviewer comment (Novelty):
The paper presents only an incremental improvement on SOTA methods, and in many ways the main Theorem (3.2) is really no more than a simple Corollary from prior work with a simple affine transformation on the variables (which would usually be done anyway in dealing with non-image data with very different means and scales in each data dimension).

Author response:
We respectfully clarify that the derived universal theories are not simple (by covering both strict robustness w.r.t. heterogeneous dimensions and universality), as detailed in Appendix A. Even if its conclusion might be considered as simple, as noted by Reviewer v1kJ, simple-but-effective solutions are not generally considered as ``weakness'', but would be desirable in practice.

Reviewer comment (Evaluation):
The main issues, written in questions to the authors, concern (a) the presentation of the comparison with isotropic SOTA, and (b) the validity of the input-dependent noise (the method introduced in section 4.3). This latter is also used as the basis for the main results in section 5.3. Hence my rating for the paper could be improved significantly in light of any author response/clarification to my questions.

Author response:
Regarding the input-dependent certification, we noticed the discussion in Eiras et al. (2021). We respectfully clarify that our input-dependent noise method is still sound and does not breach certification principles. 

The $x$-dependent classifier is fixed in the certification on $x$, that means with $g(x,\mu(x),\sigma(x))$ and $R$, we are guaranteeing $g(x+\delta,\mu(x),\sigma(x))=g(x,\mu(x),\sigma(x))$ as described in Theorem 3.2 (note that noise is pre-computed and $\mu(x),\sigma(x)$ are actually constants). We do not change the $x$-dependent classifier during the certification, thus we achieve consistent prediction over such a specific classifier. This does not violate the certification of randomized smoothing, instead, it sticks to the inherent characteristics of the RS-based certification, i.e., input-dependence (The RS certification is inherently input-dependent since the radius $R(x)$ only works on the specific input $x$ and a specific classifier). Please also see the detailed explanation in our ``Common Concerns'' response.

Reviewer comment (Evaluation):
The binary case rather than multi-class is used for Cohen. This gives poorer results, of course. Not an issue, as it is done consistently for the proposed and SOTA methods. But it should be at least clarified as the statement of Theorem 3.2 suggests that the p_B value will be used, but then in Table 1 it is not (i.e., it is replaced by p_B = 1 – p_A).

Author response:
Binary Case: We appreciate this observation and have revised the caption of Table 1 accordingly.

Reviewer comment (Theory):
The definition of Acc in the Metrics section has it defined as a function of V’_S. And yet V’_S does not appear on the RHS!! (Instead you have replaced it with the dth root of the product of the sigmas times R).

Author response:
Metrics Clarification: The metric named $V'_S$ is referred to as ALM throughout the paper. We have amended the symbols to ALM for consistency and clarity.

Reviewer comment (Evaluation):
At small radii, the SOTA methods are better (on the graphs) than the proposed method. Some discussion would be welcome on this.

Author response:
Performance at Small Radii: The reason SOTA methods perform better at smaller radii is due to the noise variance-prediction accuracy trade-off. Our method, with single $\lambda\approx 1$, competes with SOTA methods at various $\lambda$ settings. Notably, our Input-dependent method outperforms these trade-offs even with a single setting.

Reviewer comment (Theory):
In section 5.1, it is mentioned that Cohen gives a tight radius. Again, as per above, this is really only in the non-binary form.

Author response:
Cohen's Tight Radius: We have revised the statement about Cohen's method to reflect its application more accurately.

Reviewer comment (Evaluation):
In the experiments, it seems that the results vs {min \sigma_i} R should be presented (per Corollary 3.3) for a fair comparison, i.e. it is not clear to me that the proposed technique certifies a strictly larger L_p ball in the same conditions than SOTA (and what “same conditions” may mean is not clear e.g. it may mean isotropic sigma=1 and \product \sigma_i = 1 in the anisotropic case). That said, the results in section 5.3 apparently include a certified accuracy wrt radius. It is not clear if this may be an answer to my query as it is not clear exactly what is being reported here.

Author response:
In our experimental results, the “certified accuracy w.r.t radius” refers to certified accuracy w.r.t. $\min\{\sigma_i\}R$, which equals to the $\ell_p$ radius (e.g., the Gaussian $\ell_2$ case). Therefore, we did achieve a strictly larger $\ell_2$-ball than other SOTAs. In the entire paper (including Section 5.3), all the “radius” means traditional radius for the $\ell_p$ ball.

Reviewer comment (Theory):
Re section 4.3, I am a bit confused. This input-dependent proposal would give an x-dependent sigma, and hence an x-dependent classifier (i.e., x-dependent noise, over and above the obvious dependence on x). Theorem 3.2 holds assuming the noise is constant in the ball around x. This proposal in 4.3 violates that surely. Hence it is no longer true that Theorem 3.2 guarantees that the classifier gives an unchanged output in the region claimed, and so the proposed classifier is not certified robust in the claimed region around x. I may have misunderstood. Clarification/explanation is welcome. Please see arXiv paper 2110.05365 for an example of work done with input-dependent noise.

Author response:
Regarding the input-dependent certification, we noticed the discussion in Eiras et al. (2021). We respectfully clarify that our input-dependent noise method is still sound and does not breach certification principles. 

The $x$-dependent classifier is fixed in the certification on $x$, that means with $g(x,\mu(x),\sigma(x))$ and $R$, we are guaranteeing $g(x+\delta,\mu(x),\sigma(x))=g(x,\mu(x),\sigma(x))$ as described in Theorem 3.2 (note that noise is pre-computed and $\mu(x),\sigma(x)$ are actually constants). We do not change the $x$-dependent classifier during the certification, thus we achieve consistent prediction over such a specific classifier. This does not violate the certification of randomized smoothing, instead, it sticks to the inherent characteristics of the RS-based certification, i.e., input-dependence (The RS certification is inherently input-dependent since the radius $R(x)$ only works on the specific input $x$ and a specific classifier). Please also see the detailed explanation in our ``Common Concerns'' response.

Reviewer comment (Theory):
"However, its theory is based on assumptions and the universality is relatively limited." What assumptions? Please at least briefly mention them and why they are stringent.

Author response:
Our approach does not need the assumptions in Eiras et al., where the classifier's $L$-Lipschitz continuity is a prerequisite. This assumption imposes limitations on the universality of their theorem. Conversely, our method is designed to work universally with any classifier, thereby offering broader applicability.

Reviewer comment (Presentation):
Please move the definition/review of alternative Lebesgue measure to Section 3.1, where Table 1 appears with Alt. Lebesgue Measure as a column.

Author response:
We appreciate your suggestions for improving the paper's structure and clarity. We have revised the paper accordingly, particularly in relabeling Definition 3.1 as a theorem and relocating the alternative Lebesgue measure definition to Section 3.1, as suggested.

Reviewer comment (Writing):
In Section 4.2, the loss function is solely a function of the NPG parameters $\theta_g$, correct? If so, it would be good to explicitly write $\mathcal{L}(\theta_g)$ to emphasize to the reader what you are optimizing over. Furthermore, $\sigma$ and $\mu$ would be functions of this parameter $\theta_g$, right? If so, it would also be good to write $\sigma(\theta_g)$ and $\mu(\theta_g)$ in the smoothing loss expression.

Author response:
We have updated our paper to clarify that the loss function is optimized over both $\theta_f$ and $\theta_g$. Additionally, we have made it explicit that $\mu$ and $\sigma$ are functions of the parameter $\theta_g$. These revisions should enhance the clarity of our methodology.

Reviewer comment (Novelty):
The contribution in constructing the anisotropic noise measures (the core conceit of the paper) is essentially just a basic modification to extant techniques, with no other modifications being made. While simple modifications can sometimes lead to impactful contributions, this alone is not necessarily a reason for rejection.

Author response:
We would like to respectfully clarify that our core contribution is not on the construction of the ALM measure but on the theoretical analysis of the robustness bound when injecting anisotropic noise, as well as the framework and novel methods for customizing anisotropic noise. ALM is one of our metrics for evaluating the certified robustness with anisotropic noise while we also derive the traditional $\ell_p$ radii (Corollary 3.3) for the robustness region with anisotropic noise.

Reviewer comment (Theory):
There is a misalignment between the chosen area of investigation and the broader problem space. Specifically, there appears to be no framework, either in the literature or in the paper's framework, that would care about the area of the region of certification. From the certifier's perspective, it is unclear what information about the security of a model is gained from knowledge of the Lebesgue measure of the noise region (or any other measure of the area of certification). The primary measure of risk in the literature is the nearest extant adversarial example, as this measures the effort required for an adversary to identify an adversarial example. Any alternative risk measure would need to be well justified and well posed, which is not the case here.

Author response:
The certified $\ell_p$ radius can be seen as a measure for the area of the regular and symmetric robustness region within the overall robustness region (sub-region in $\ell_{1,2,\infty}$ shape). On the other hand, ALM provides a full capture of the overall robustness region (a comprehensive understanding of the theoretical guarantees and boundaries of the certified defense). These two metrics complement each other, and we have provided the results for both $\ell_p$ radius and ALM as well as performed evaluations on both of them in the original submission.

Reviewer comment (Novelty):
Since the certified distances to the nearest possible adversarial example are unchanged by this work, it does not appear to contribute to an improved understanding of adversarial risk. Rather than significantly improving upon SOTA, the paper seems to introduce a new metric that masks the fact that there is no actual outperformance.

Author response:
As discussed before, our method drastically improves the robustness against both the certified distance to the nearest possible AE (please see ``certified accuracy w.r.t. radius'' in Table 2-4 in our original submission) and the average distance measure (ALM).

Reviewer comment (Theory):
Is there any justification for using the Lebesgue Measure as a proxy of adversarial risk?

Author response:
We understand the concern about the guarantee of ALM and would like to provide more information to clarify. The ALM is a measure of the volume of a high-dimensional space, although we don't have the tight certification w.r.t. the ALM measure, the high-dimensional space it measures, i.e., $||\frac{\delta}{\sigma_i}||_p\leq R$, has the tight certification as in Theorem 3.2. Therefore, we admit that the ALM is proportional to the average effort, but not an accurate measure of the exact average effort. When we are evaluating the certified robustness under the same conditions, ALM can serve as an auxiliary metric only for comparison.

Reviewer comment (Evaluation):
My major concern of this paper is the potential unfairness in evaluation on UCAN and existing RS-based methods. If I am not misunderstanding, the evaluation criterion is based on scaled radius, which has different weight in each dimension.

Author response:
Our experimental evaluations are based on both 1) the **$\ell_p$ radius** from Corollary 3.3 ($min  \sigma_i  R$), which is a tight bound for the perturbation in anisotropic RS, and has the same weight in each dimension (please see Table 2-4 in the original submission); 2) the ALM metric ($\sqrt[d]{\prod^d_i \sigma_i} R$), which is a measure on the volume of the irregular asymmetric robust region, and has different weights in each dimension.

Reviewer comment (Evaluation):
I believe this is true because I am surprised to the evaluation results provided in Table 3 that the $l_2$ certification on CIFAR-10 reach over 70% even under radius 1.75. By simple calculation, for commonly-used $L_{\infty}$ norm with budget 8/255, it achieves at most $\sqrt{3072 \times (\frac{8}{255})^2} \approx 1.74$, that means in your UCAN it achieves at least 70% robust accuracy for 8/255 $l_{\infty}$ attacks. This result is unbelievable, because existing SOTA performance of CIFAR-10 robustness may only achieve about 60% if no further data augmentations are conducted (like diffusion model), let alone UCAN is only a certified method based on $l_2$ norm. Therefore, although the paper said they evaluate certified accuracy w.r.t radius, I am doubtful of this claim and I think the authors only consider scaled radius robustness.

Author response:
In Table 3, the **70%** certified accuracy at $R=1.75$ on CIFAR10 is the performance based on the *$\ell_p$ radius* ($min\{\sigma_i\} R$), which is strictly derived in Corollary 3.3. This validates the significant improvement of RS with anisotropic noise over SOTA methods. 

We agree with the reviewer that existing isotropic RS methods can hardly improve their performance to this level. However, we focus on a new dimension of RS (with anisotropic noise) that is orthogonal to existing RS methods, which can boost all the RS methods. Such results are based on $\ell_p$ radius, rather than scaled radius. 

We understand the reviewer's concern as our results drastically outperform the SOTA methods (evaluated on both $\ell_p$ radius and ALM). To address the concern, we are providing our code in the supplemental material for transparency. Please see line 180-182 in certification\_personalized.py for the implementation of our **$\ell_p$ radius** (and corresponding evaluations).

Reviewer comment (Evaluation):
However, scaled radius certification seems not a fair criterion for certified robustness. It is reasonable that in some dimensions, the image is vulnerable to adversarial attacks, e.g., contour of an image. Reversely, in some dimension images are intrinsically robust to perturbations like background of the image. Therefore, I believe the corresponding variance $\sigma$ is small when UCAN performs on these vulnerable dimensions, and gain robustness back in some “unimportant’’ dimensions.

Author response:
We agree with the reviewer that the ALM (scaled radius) may result in some ``weak'' dimension for the adversary, which only provides the certified robustness in a specific shape (depends on $\sigma$).

While working on the paper earlier, we also understood that reviewers may concern that solely evaluating on the ALM might be unfair (though ALM is defined as a full capture of the robustness region). Thus, we have also derived and presented the $\ell_{1,2,\infty}$ radii (derived in Corollary 3.3), and evaluated the performance of our method and SOTA using the ``certified accuracy w.r.t. $\ell_p$ radius'' (please see Table 2-4) in our original submission. We show that by customizing appropriate anisotropic noise, our method achieves significantly boosted performance on both the standard $\ell_p$ radius and the new ALM metric.

Reviewer comment (Evaluation):
Overall, the evaluation setting of this paper seems differently from existing RS methods. It is a consensus that using $l_p$ norm as constraint for images, the authors should provide corresponding evaluation on standard $l_p$ norm, or at least, provide the explanations or practical scenario on why using scaled radius as the evaluation criterion.

Author response:
We agree with the reviewer that the ALM (scaled radius) may result in some ``weak'' dimension for the adversary, which only provides the certified robustness in a specific shape (depends on $\sigma$).

While working on the paper earlier, we also understood that reviewers may concern that solely evaluating on the ALM might be unfair (though ALM is defined as a full capture of the robustness region). Thus, we have also derived and presented the $\ell_{1,2,\infty}$ radii (derived in Corollary 3.3), and evaluated the performance of our method and SOTA using the ``certified accuracy w.r.t. $\ell_p$ radius'' (please see Table 2-4) in our original submission. We show that by customizing appropriate anisotropic noise, our method achieves significantly boosted performance on both the standard $\ell_p$ radius and the new ALM metric.

Reviewer comment (Theory):
In Theorem 3.2, your certification using the p-norm of $\frac{\delta_i}{\sigma_i},$ but it seems that $\frac{\delta_i}{\sigma_i}$, is a one-dimension scalar as $\delta_i$ is the i-th dimension of perturbation $\delta$. Furthermore, this theorem is seemingly a direct corollary from Theorem 3.1, because your certification divides the variance $\simga_i$ for each $\delta_i$ (not anisotropic anymore?).

Author response:
The Hadamard division of $\delta$ over $\sigma$ ($\delta_i/\sigma_i$) is formally defined in Theorem 3.2 and Appendix A. 

We ensure that Theorem 3.2, while appearing to be straightforward, is a unique universal transformation from Definition 3.1, as detailed in Appendix A. We respectfully clarify that the derived theories in the theorem are not a direct corollary from Theorem 3.1 (since it covers both strict robustness w.r.t. heterogeneous dimension and universality). The guarantee in Theorem 3.2 is anisotropic w.r.t. $\delta$, although our focus is not to derive an ``anisotropic radius'', but to extend isotropic noise to anisotropic noise for RS. The guarantee on the perturbation $\delta$ can be either anisotropic (Theorem 3.2) or isotropic (Corollary 3.3).

Reviewer comment (Experiments):
There might be missing of some baselines for $l_1$ [a] and $l_{\infty}$ [b, c] certified robustness. It will be better to compare the UCAN with existing certified $l_1$ and $l_{\infty}$ methods.

[a] Levine et al. Improved, deterministic smoothing for L_1 certified robustness. In ICML 2021.  
[b] Zhang et al. Towards Certifying L_∞ Robustness using Neural Networks with L_∞-dist Neurons. In ICML 2021.  
[c] Zhang et al. Boosting the Certified Robustness of L-infinity Distance Nets. In ICLR 2022.

Author response:
Our method, when benchmarked against $\ell_1$ and $\ell_\infty$ methods, shows significant improvements (see tables provided). This underscores our method's effectiveness across different metrics. We respectfully clarify that RS-based methods and $\ell_\infty$-distance neural network-based methods may not be directly comparable (due to their differences, e.g., RS can certify any classifier). To further address this concern, we still compare with them, and our method also demonstrates superior performance in these scenarios (a huge improvement space brought by the anisotropic noise for RS).

| Methods                  | 0.0  | 0.5  | 1.0  | 1.5  | 2.0  |
|--------------------------|------|------|------|------|------|
| Yang et al. 2020          | 83%  | 43%  | 22%  | 14%  | 7%   |
| Levine et al. 2021        | 79%  | 71%  | 61%  | 54%  | 49%  |
| Ours ($\ell_1$ radius)  | **85%** | **81%** | **77%** | **73%** | **68%** |

*Table 1. Certified accuracy vs. $\ell_1$ perturbation (CIFAR10)*


| Methods                  | 0/255 | 1/255 | 2/255 | 3/255 | 4/255 | 5/255 | 6/255 | 7/255 | 8/255 |
|--------------------------|-------|-------|-------|-------|-------|-------|-------|-------|-------|
| Yang et al. 2020         | 83%   | 63%   | 48%   | 36%   | 27%   | 20%   | 16%   | 13%   | 10%   |
| Zhang et al. 2021         | 51%   | --    | --    | --    | --    | --    | --    | --    | 35%   |
| Zhang et al. 2022         | 61%   | --    | 54%   | --    | --    | --    | --    | --    | 40%   |
| Ours ($\ell_\infty$ radius)  | **85%** | **83%** | **82%** | **80%** | **78%** | **77%** | **75%** | **73%** | **70%** |

*Table 2. Certified accuracy vs. $\ell_\infty$ perturbation (CIFAR10)*

Reviewer comment (Experiments):
Why using 5-layers NN when generating universal/ input-dependent anisotropic noises? Is there some motivations or ablation studies for that?

Author response:
The 5-layer MLP architecture in our Universal method is inspired by GANs (Goodfellow et al., Communications 2020), and the CNN structure in our Input-dependent method is designed per the dense blocks (Huang et al., CVPR 2017).

Reviewer comment (Reproducibility):
Could you provide more details on training of universal anisotropic noise? It seems that the variance loss is to optimize $\sigma$ and smoothing loss containing $\sigma$ when optimizing classifier $\theta_f$. I believe the two losses are optimized alternately but not simultaneously.

Author response:
For the training of NRG and the classifier, we employed simultaneous training, optimizing both for predictive accuracy and noise pattern enhancement. While alternate training is possible, our current approach promotes synergy between the classifier and NRG.

Reviewer comment (Experiments):
The authors said that randomized smoothing achieved great success for certified adversarial robustness. Could RS really make classifier robust? Can you provide comparison of RS based model to the SOTA methods for achieving robustness?

Author response:
Please see the above experimental results and discussion. It is worth noting that RS methods can be universally applied to any classifier with different scales, and it is unfair to compare the robustness performance of different types of classifiers.