GS MOOTH : C ERTIFIED R OBUSTNESS AGAINST S EMANTIC T RANSFORMATIONS VIA G ENERALIZED R ANDOMIZED S MOOTHING
Anonymous authors
Paper under double-blind review
A BSTRACT
The vulnerability of deep learning models to adversarial examples and semantic transformations has limited the applications in risk-sensitive areas.
The recent development of certiﬁed defense approaches like randomized smoothing provides a promising direction towards building reliable machine learning systems.
However, current certiﬁed defenses cannot handle complex semantic transformations like rotational blur and defocus blur which are common in practical applications.
In this paper, we propose a generalized randomized smoothing framework (GSmooth) for certiﬁed robustness against semantic transformations.
We provide both a uniﬁed and rigorous theoretical framework and scalable algorithms for certiﬁed robustness on complex semantic transformations.
Speciﬁcally, our key idea is to use a surrogate image-to-image neural network to approximate a transformation which provides a powerful tool for studying the properties of semantic transformations and certify the transformation based on this neural network.
Experiments on multiple types of semantic perturbations and corruptions using multiple datasets demonstrate the effectiveness of our approach.
I NTRODUCTION
Although deep learning models have achieved remarkable success on various applications (LeCun et al., 2015), they are vulnerable to adversarial examples (Biggio et al., 2013; Szegedy et al., 2013;
Goodfellow et al., 2014) and semantic transformations (Hendrycks & Dietterich, 2019).
The vulnerability of deep learning models can limit their applications on many important tasks.
For example, the autonomous driving system can be misled even by a small adversarial patch on the road mark (Jing et al., 2021).
Compared with the maliciously crafted adversarial examples, semantic transformations are more practical in real-world scenarios, such as rotation, translation, blur, bad weather, and so on.
Such transformations do not damage the semantic features of images and can be easily recognized by humans, but they also degrade the performance of deep learning models.
Therefore, it is imperative to improve model robustness against semantic transformations.
To develop more reliable machine learning systems, many efforts have been made to design defense techniques against adversarial attacks or semantic transformations.
The existing defense methods can be categorized into empirical defenses and certiﬁed defenses.
Adversarial training (AT) (Madry et al., 2017; Zhang et al., 2019a) is one of the most effective empirical defenses against (cid:96) p -norm bounded adversarial examples.
Moreover, methods based on data augmentation (Hendrycks et al., 2019; Wang et al., 2019; Calian et al., 2021) have been proposed to empirically improve the performance under semantic transformations.
However, the performance of empirical defenses is difﬁcult to be fully justiﬁed and these defenses can be further broken by new adaptive attacks (Athalye et al., 2018; Tramer et al., 2020).
In contrast, the certiﬁed defenses aim to theoretically provide a certiﬁed region where the model is theoretically safe under any attack or perturbation (Wong & Kolter, 2018;
Cohen et al., 2019; Gowal et al., 2018; Zhang et al., 2019b).
Along this line, developing certiﬁed defense methods is a crucial step towards reliable machine learning systems.
Although certiﬁed defenses have achieved great success, most of them are limited to defend against (cid:96) p -norm bounded attacks.
However, the (cid:96) p distance between the original image and its corrupted counterpart by a semantic transformation (e.g., translation, rotation) would be large even when the corruption is slight.
Therefore, the current methods are incapable of certifying robustness against such semantic perturbations.
To solve this problem, several recent works (Fischer et al., 2020;
Mohapatra et al., 2020; Li et al., 2021) attempt to extend the certiﬁed defenses to several simple semantic corruptions, including translation, rotation, and Gaussian blur.
However, these works are not scalable to certify robustness against complex and general semantic perturbations.
First, deterministic certiﬁed defenses (Mohapatra et al., 2020) based on convex relaxation for the activation function require solving a complex optimization problem for computing bound which is computationally expensive.
Second, probabilistic approaches based on randomized smoothing also demand a handcrafted Lipschitz bound (Li et al., 2021), which is intractable for complicated semantic transformations.
For example, many semantic transformations such as glass blur and pixelate do not have a closed form expression or they are black boxes and hard to be analyzed theoretically, but they are common in real-world scenarios.
Therefore, it is still highly challenging to certify robustness against these complex and realistic semantic transformations.
To address the aforementioned challenges, we propose a generalized randomized smoothing framework (GSmooth).
First, we provide a uniﬁed framework of GSmooth for certifying general semantic transformations.
Then we categorize the transformations into resolvable transformations (e.g., translation) and non-resolvable transformations (e.g., rotational blur) similar with Li et al.
As mentioned above, most non-resolvable transformations are complex and the existing methods cannot provide their certiﬁed radius.
To handle the challenge, we propose to use an image-to-image translation neural network to approximate all these transformations.
Due to the strong capacity of neural networks, our method is ﬂexible and scalable to model these complex semantic transformations.
By introducing an augmented noise in the layers of the surrogate model, we can theoretically provide the certiﬁed radius for the proxy neural networks which can be used for certifying the original transformations.
Next, we provide theoretical analysis and error bounding for the approximation.
Finally, we validate the effectiveness of our methods on several publicly available datasets.
Extensive experimental results demonstrate that our methods are effective for certifying complex semantic transformations including different types of blur or image quality corruptions.
R ELATED WORK 2. A TTACKS AND DEFENSES FOR SEMANTIC TRANSFORMATIONS
Unlike (cid:96) p perturbation which adds small noise to every pixel of an image, semantic attacks or physical attacks are usually unrestricted.
Brown et al.
; Song et al.
(2018) use a small patch added to the image to mislead the classiﬁer or the object detector.
Engstrom et al.
(2019; 2018); Xiao et al.
(2018) construct adversarial examples using spatial transformations like rotation or translation.
Hendrycks & Dietterich (2019) show that a wide variety of semantic perturbations degrade the performance for many deep learning models.
Many works (Cubuk et al., 2019; Hendrycks et al., 2019; 2020; Robey et al., 2020) propose diverse data augmentation techniques to enhance robustness under semantic perturbations.
Calian et al.
(2021) propose adversarial data augmentation that can be viewed as adversarial training for defending semantic perturbations.
Beyond empirical defenses, several works (Mohapatra et al., 2020; Madry et al., 2017; Singh et al., 2019; Balunovi´c et al., 2019) attempt to certify some simple geometric transformations.
However, all of them belong to deterministic certiﬁcation approaches and their performance on realistic datasets are unsatisfactory.
2. R ANDOMIZED SMOOTHING
Randomized smoothing is a novel certiﬁcation method originated from differential privacy (Lecuyer et al., 2019).
Cohen et al.
(2019) then improve the certiﬁed bound and apply it to large scale deep neural networks and datasets.
Yang et al.
(2020) exhaustively analyze the robust radius by using different noise distribution and norms.
Hayes (2020); Yang et al.
(2020) point out that randomized smoothing suffers from curse of dimensionality for the l ∞ norm.
Salman et al.
(2019) adopt adversarial training to train smoothed classiﬁers to obtain better robustness guarantees.
Li et al.
Fischer et al.
(2020) extend randomized smoothing to certify some simple semantic transformations, e.g., image translation and rotation.
It shows that randomized smoothing could be generalized to certify more diverse attacks or corruptions.
However, their methods are limited to simple semantic transformations, which are easy to analyze their mathematical properties.
P ROPOSED METHOD
In this section, we present the framework and theoretical analyses of our Generalized Randomized
Smoothing (GSmooth).
We ﬁrst introduce the basic notations.
Then we divide the semantic transformations into resolvable transformations and non-resolvable transformations similar with Li et al.
Next we introduce the details of our GSmooth for these two types of semantic transformations, respectively.
Finally, we show the theoretical insight and proof sketch of our main results.
3. N OTATIONS
We ﬁrst introduce the notations and formulation of the task.
Given the input of x ∈ R n and the labels of Y = { 1 , 2 , . . . p } , we denote the classiﬁer as f ( x ) :
R n → [0 , 1] p , which outputs predicted probabilities over all p classes.
The prediction of f is arg max i ∈Y f ( x ) i , where f ( · ) i denotes the i -th element of f ( · ) .
Let τ ( θ, x ) : R m × R n → R n be a semantic transformation of raw input x with parameter θ ∈ R m .
We deﬁne the smoothed classiﬁer as
[Equation]
which is the average prediction for the samples under a smoothing distribution g ( θ ) where g ( θ ) =
exp( − ψ ( θ )) and ψ ( θ ) is a smooth function from R m → R .
Let ||
u
||
= 1 be any vector with unit norm and a random variable γ u = (cid:104) u, ∇ ψ
( δ ) (cid:105) where δ ∼ g and ∇ is the gradient operator of a function.
The complementary CDF is ϕ u ( c ) =
P [ γ u > c ] and the inverse complementary CDF is ϕ − 1 u ( p )
=
inf { c | P ( γ u > c ) (cid:54) p } .
Following Yang et al.
(2020), we deﬁne a function Φ as
[Equation]
which will be used to represent the certiﬁed radius.
Let y A = arg max i ∈Y G ( x ) i be the predicted label by the smoothed classiﬁer G ( x ) and y B = arg max i ∈Y\
y
A G ( x ) i is the runner-up class.
Without causing confusion, we use G ( x ) A to denote the probability of the top class G ( x ) y A ; likewise for
G ( x ) B .
3. C ERTIFIED BOUND FOR RESOLVABLE SEMANTIC TRANSFORMATIONS
We ﬁrst discuss a class of transformations that are resolvable — the composition of two transformations with parameters belonging to a perturbation set θ, ξ ∈ P ⊂ R m is still a transformation with a new parameter γ ( θ, ξ ) ∈ P ⊂ R m , where γ ( · , · ) : P × P → P is a function depending on these parameters.
For resolvable semantic transformations, we have the following theorem.
Theorem 1.
Let f ( x ) be any classiﬁer and G ( x ) be the smoothed classiﬁer deﬁned in Eq.
If there exists a function M ( · , · ) : P × P → R , the transformation τ ( · , · ) satisﬁes
[Equation]
and there exist two constants p A , p B satisfying
[Equation]
then y A = arg max i ∈Y G ( τ ( ξ, x ))
i holds for any (cid:107) ξ (cid:107) (cid:54) R where
[Equation]
and M ∗ = max ξ,θ ∈ P || M ( ξ, θ ) || .
Remark.
The settings of Theorem 1 are similar with Li et al.
(2021) for resolvable semantic transformations.
But here we adopt a different presentation and proof for the theorem which could be easier to extend to our GSmooth framework for general semantic transformations.
Speciﬁcally, we show two examples of the theorem which are additive transformations and commutable transformations.
A transformation is additive if τ ( θ, τ ( ξ, x ))
=
τ ( ξ + θ, x ) for any θ, ξ ∈ P ; or it is commutable if τ ( θ, τ ( ξ, x ))
=
τ ( ξ, τ ( θ, x )) for any θ, ξ ∈ P .
For these two types of transformations, it is straightforward to verify that they satisfy the property proposed in Theorem 1.
As an example, we simply apply Theorem 1 for isotropic Gaussian distribution g ( θ ) =
N (0 , σ 2 I ) and get the certiﬁed radius
[Equation]
[Figure]
F ( ) θ
F ( ) x H ( ) . [Figure] where Ψ is the inverse CDF of the standard Gaussian distribution.
These two kinds of transformations include image translation and Gaussian blur, which are basic semantic transformations and widely discussed in previous works (Li et al., 2021;
Fischer et al., 2020).
The certiﬁcation of these simple transformations only requires applying translation or Gaussian blur to the sample and gets the average classiﬁcation score under the noise distribution.
3. C ERTIFIED BOUND FOR GENERAL SEMANTIC TRANSFORMATIONS
Translation and Gaussian blur are two speciﬁc cases of semantic transformations.
In practice, most semantic transformations are not commutable or even not resolvable.
Therefore, we need to develop better methods for certifying more types of semantic transformations.
However, the existing methods like Semanify-NN (Mohapatra et al., 2020) based on convex relaxation and TSS (Li et al., 2021) based on randomized smoothing require to develop a speciﬁc algorithm or bound for each individual semantic transformation.
This is not scalable and might be infeasible for more complicated transformations without explicit mathematical forms.
To address the challenge, we draw inspiration from the fact that neural networks are able to approximate functions including a complex and unknown semantic transformation (Zhu et al., 2017).
First, we propose to use a surrogate image-to-image translation model to accurately ﬁt the semantic transformation.
Then we theorectially show that by introducing an augmented noise in the layers of the surrogate model, as shown in Fig 1, randomized smoothing can be extended to handle these transformations.
Speciﬁcally, we deﬁne the surrogate model as the following form that will lead to a simple certiﬁcation bound as we shall see:
[Equation]
where F 1 ( · ) :
R m → R d , F 2 ( · ) : R n → R d , and H ( · ) : R d → R n are three individual neural networks.
F 1 ( · ) and F 2 ( · ) are the encoders for transformation parameters and images respectively, and their encodings are added together in the semantic space which is critical for its theoretical certiﬁcation.
We ﬁnd that the surrogate neural network is much easier to analyze and can be certiﬁed by introducing a dimensional augmentation strategy for both noise parameters and input images.
As illustrated in Fig.
1, an augmented noise is added to the semantic layers H ( · ) in the surrogate model.
Our key insight is that the transformation could be viewed as the superposition of a resolvable part and a non-resolvable residual part in the augmented semantic space.
Then we could use the augmented noise to control the non-resolvable residual part if the augmented dimension d (cid:62) m + n .
This dimension augmentation is the key step of our technique.
The augmentation for noise is from R m to R d .
To keep the dimension consistent, we also augment data x to R d by padding 0 entries.
By certifying the transformation based on the surrogate model, we are able to certify the original transformation if the approximation error is within an acceptable region (detailed analysis is in Theorem 3).
Our method is ﬂexible and scalable since the surrogate neural network has a uniform mathematical form for theoretical analysis and they are trained automatically.
Next, we discuss the details of GSmooth.
Speciﬁcally, we introduce the augmented data ˜ x ∈ R d and the augmented parameter ˜ θ ∈ R d as
[Equation]
where the additional parameters θ (cid:48) ∈ R n are sampled from g (cid:48)
( θ (cid:48) ) , and the joint distribution of θ (cid:48) and θ is ˜ θ ∼ ˜ g where ˜ g
(˜ θ )
=
g (cid:48)
( θ (cid:48) )
g ( θ ) .
Moreover, the augmented data x (cid:48) ∈
R m .
We deﬁne the generalized smoothed classiﬁer as
[Equation]
[Equation]
where ˜ f is the “augmented target classiﬁer” that equals the original classiﬁer when constrained on the original input x , which means ˜ f
(˜ x ) = f
( x ) .
This can be achieved by setting the weights of additional dimensions to 0.
Note that now all the functions are augmented for a d dimensional input.
We further augment our surrogate neural network to represent the augmented transformation ˜ τ [Equation] d →
[Equation]
d [Equation] (8) where ˜ H ( · ) , ˜ F 1 ( · ) , ˜ F 2 ( · ) : R d → R d are parts of the augmented surrogate model.
By carefully designing the interaction between the augmented parameters and the original parameters, we could turn the transformation to a resolvable one and it does not change the original surrogate model when constraining to the original input x and θ .
Speciﬁcally, we design the function ˜ F 1 and ˜ F 2 as follows:
[Equation]
Before stating our main theorem, we introduce several notations ˜ z ξ = ˜ F 1 (˜ ξ [Equation] + ˜ F 2 (˜ x ) , ˜
z θ = ˜
F 1 (˜ θ )+ ˜ F 2 (˜ x ) , ˜ y ξ =
( y (cid:48) ξ , y ξ ) T =
˜ H
( ˜ F 1 (˜ ξ )+ ˜ F 2 (˜ x )) and ˜ y
θ =
( y (cid:48)
θ , y θ ) T =
˜ H
( ˜ F 1 (˜ θ )
+ ˜ F 2 (˜ x )) for simplicity.
Then we theoretically prove that the GSmooth classiﬁer is certiﬁably robust within a given range:
Theorem 2.
Suppose f ( x ) is a classiﬁer and ˜ G (˜ x ) is the smoothed classiﬁer deﬁned in Eq.
(7), if there exist p A and p B satisfying
[Equation]
then y A = arg max i ∈Y ˜ G
(˜ τ (˜ ξ, ˜ x ))
i for any (cid:107) ξ {+(cid:107) 
+}
(cid:54) R , where
[Equation]
(10) and the coefﬁcient M ∗ is deﬁned as
[Equation]
As the main result of our GSmooth, we have several observations about it.
First, we see that the certiﬁed radius is similar to the result in Theorem 1.
Second, compared with resolvable transformations, we need to add a new type of noise when constructing the GSmooth classiﬁer.
This isotropic noise has the same dimension as the data and is added to the intermediate layers of surrogate neural networks.
The theoretical explanation behind this is that this isotropic noise makes the Jacobian matrix of the semantic transformation to be invertible which is crucial for the proof.
Third, we observe that the coefﬁcient M ∗ depends on the norm of the difference of two Jacobian matrices and is independent with the target classiﬁer, later we will discuss the meaning of this term in detail.
Before diving into our theoretical insight and proof of the theorem, we introduce a speciﬁc case of Theorem 2 which is more convenient for practical usage.
We empirically found that taking a linear transformation as F 1 ( θ ) =
A 1 θ + b 1 where A 1 ∈ R n × m , b 1 ∈ R n does not sacriﬁce the precision of the surrogate network and we have ∂F 1 ( θ )
∂θ
=
A 1 .
After substituting the term in Eq.
(44) we only need to optimize ξ for calculating M ∗ and we make the bound tighter.
Additionally, we use two gaussian distributions for the noise distribution and the augmented noise distribution, i.e. g ( θ ) =
N (0 , σ 21 I ) and g (cid:48)
( θ (cid:48) )
=
N (0 , σ 22 I ) .
Formally, we have the following corollary,
Corollary 1.
Suppose f ( x ) is a classiﬁer and ˜ G (˜ x ) is the smoothed classiﬁer deﬁned in Eq.
(7), if the layer F 1 ( θ ) in the surrogate neural network has the following form:
[Equation]
where A 1 ∈ R n × m , b 1 ∈ R n are the parameters; and if there exists p A and p B satisfying
[Equation]
then y A = arg max i ∈Y ˜ G
[Equation]
˜ τ
[Equation]
˜ ξ, ˜ x ))
i for any (cid:107) ξ (cid:107)
(cid:54) R where
[Equation]
(13) where Ψ( · ) is the inverse CDF of standard Gaussian distribution, and the coefﬁcient M ∗ is deﬁned as,
[Equation]
P ROOF SKETCH AND THEORETICAL ANALYSIS 4. P ROOF SKETCH OF OUR MAIN THEOREM
In this section, we brieﬂy summarize the main idea for proving the Theorem 2 and the theoretical insight of our GSmooth.
The key idea is to prove that the gradient of the smoothed classiﬁer can be bounded by a function of the classiﬁcation conﬁdence and the parameters of the noise distribution.
Formally, we calculate the gradient to the perturbation parameter ξ for our augmented smoothed classiﬁer as
[Equation]
[Equation]
We expand the expectation into integral and see that
[Equation]
[Equation]
The key step is to eliminate the gradient of ∂ ˜ F (˜ τ
(˜ θ, ˜ y ξ ))
∂
˜ ξ and replace it with ∂ ˜ f
(˜ τ
(˜ θ, ˜ y ξ ))
∂
˜ θ .
Then we integrate it by parts to get the following obejective,
[Equation]
After that, we could bound the gradient of the GSmooth classiﬁer using the technique similar to randomized smoothing (Yang et al., 2020).
More details of the proof can be found in Appendix A.
4. T HEORETICAL INSIGHT
Next, we provide the theoretical insight for our augmentation scheme on transformation parameters and data.
First, the key is to expand the transformation space by adding additional dimensions to form a closed space.
In the augmented space, the Jacobian matrix of the semantic transformation became invertible which is crucial for our proof.
Second, as we can see in Eq.
(14) that M ∗ is inﬂuenced by two factors.
One is the standard deviation of two noise distributions.
The other is the norm of the Jacobian matrix ∂F 2 ( y ξ ) ∂ξ − A 1 .
It can be viewed as the residual of the non-resolvable part of the transformation.
Along this line, our method decomposes the unknown semantic transformation into a resolvable part and a residual part.
The non-resolvable residual part could be handled by introducing additional noise with standard deviation σ 2 .
4. E RROR ANALYSIS FOR SURROGATE MODEL APPROXIMATION
In this subsection, we theoretically analyze the effectiveness of certifying real semantic transformation due to the existence of approximation error of surrogate neural networks.
Theorem 3.
Suppose the simulation of the semantic transformation has an small enough error
[Equation]
Then there exists a constant ratio A
= A ( (cid:107) F (cid:48) 1 (˜ ξ ) (cid:107) 2 , (cid:107) F (cid:48)
(˜ y ξ ) (cid:107) 2 , (cid:107) F (cid:48)
(˜ z ξ ) (cid:107) 2 ) > 0 does not depend on the target classiﬁer, we have the certiﬁed radius for the real semantic transformation satisﬁes that
[Equation]
where R is the certiﬁed radius for surrogate the neural network in Theorem 2 and
[Equation]
We ﬁnd that the reduction of the certiﬁed radius is inﬂuenced by two factors.
The ﬁrst one is the approximation error (cid:15) between the surrogate transformation and the real semantic transformation.
The second one the ratio A is about the norm of the Jacobian matrix for some layers of the surrogate model which is also an inherent property of the semantic transformation itself and does not depend on the target classiﬁer.
E XPERIMENTS 5. E XPERIMENTAL SETUP AND EVALUATION METRICS
In this section, we conduct extensive experiments to show the effectiveness of our GSmooth on various types of semantic transformations.
We use MNIST, CIFAR-10 and CIFAR-100 (Krizhevsky et al., 2009) datasets to verify our methods.
We train a resnet with 110 layers (He et al., 2016a) from scratch.
Similar to prior works, we apply moderate data augmentation (Cohen et al., 2019) to improve the generalization of the classiﬁer.
For the surrogate image-to-image translation model for simulating semantic transformations, we adopt the U-Net architecture (Ronneberger et al., 2015) for ˜ H ( · ) layers and several simple convolutional or linear layers for ˜ F 1 ( · ) and ˜ F 2 ( · ) .
All models are trained using Adam optimizer with an initial learning rate of 0.001 that decays every 50 epochs until convergence.
The algorithms for calculating M ∗ and other details in our experiments are listed in Appendix B due to limited space.
The evaluation metric is the certiﬁed accuracy, which is the percentage of samples that are correctly classiﬁed and has a larger certiﬁed radius than the given range.
We use (cid:107) α (cid:107) to indicate the preset certiﬁed radius.
5. M AIN RESULTS
To demonstrate the effectiveness of our GSmooth on certifying complex semantic transformations, we measure the certiﬁed correct accuracy for different semantic transformations on different datasets in Table 1.
We compare the results of our GSmooth with several baselines, including randomized smoothing for some simple semantic transformation of TSS (Li et al., 2021) and IndivSPT/distSPT
(Fischer et al., 2020), and our GSmooth is a natural and powerful extension of their methods.
We also compare our method with the deterministic certiﬁcation approaches, including
DeepG (Balunovi´c et al., 2019) that uses linear relaxations similar to Wong & Kolter (2018), Interval (Singh et al., 2019) that is based on interval bound propagation, VeriVis (Pei et al., 2017) that enumerates all possible outcomes for semantic transformations with ﬁnite values of parameters, and
Semanify-NN (Mohapatra et al., 2020) which uses a new preprocessing layer to turn the problem into a (cid:96) p norm certiﬁcation.
We have the following observations for the experimental results.
First, only our method achieves non-zero accuracy on certifying some complex semantic transformations and the results verify
our
Theorem 2.
This is a breakthrough that greatly extends the boundary of randomized smoothing based methods.
Second, we see the performance of GSmooth is similar to the state-of-the-art randomized smoothing approaches like TSS on several simple semantic transformations like Gaussian
[Table]
blur, translation.
This is a natural result since our method works similarly for resolvable transformations.
For two speciﬁc non-resolvable transformations, i.e. rotation and scaling, our accuracy is slightly lower.
The possible reason is that in TSS (Li et al., 2021) they derive more elaborate
Lipschitz bound for rotation which is better than us.
Third, those inherently non-resolvable transformations like image blurring (except Gaussian blur) and pixelate are more difﬁcult than resolvable or approximately resolvable (rotation) transformations.
Thus their certiﬁed accuracy is also lower.
5. A BLATION STUDY
Ablation study on the inﬂuence of noise distribution.
The choice of noise distribution is important for randomized smoothing based methods.
Since our GSmooth could certify different types of semantic transformations that exhibit different properties.
Understanding the inﬂuence of different smoothing distributions for different semantic transformations is necessary.
We choose (folded)
Gaussian, uniform, and exponential distribution and compare the certiﬁed accuracy on zoom blur transformation for both CIFAR-10 and CIFAR-100 datasets.
As shown in Fig.
2, We found that
[Table]
the impact of smoothing distributions depends on datasets.
Uniform distribution is better for small radius certiﬁcation while exponential distribution is more suitable for certifying large radius on
Ablation study on the inﬂuence of noise variance for certiﬁcation.
Since our GSmooth contains two different variances for controlling the resolvable part and the residual part for a non-resolvable semantic transformation.
Here we investigate the effect of different noise variance on the certiﬁed accuracy.
The results are shown in Table 2.
We found that using medium transformation noise and augmented noise achieves the best certiﬁed accuracy.
The fact is consistent with results in (Cohen et al., 2019).
An explanation is that there is a trade-off since higher the noise variance decreases the coefﬁcient M ∗
but it might also degrade the clean accuracy.
Visulization experiments: comparsion between augmented semantic noise and image noise.
Our GSmooth needs to add a new noise in the semantic layers of the surrogate model.
Here we compare the difference between these two types of noise and visualize them.
We random sample images from CIFAR-10 and add gaussian noise with σ = 0 .
2 to both the semantic layer of the surrogate model simulating zoomed blur transformation and raw images.
Results are shown in Fig.
Both two types of noise severely blur the images.
But we found that the augmented semantic noise is more placid which can therefore keep the holistic semantic features better, e.g., shapes.
C ONCLUSIONS
In this paper, we proposed a generalized randomized smoothing framework (GSmooth) for certifying robustness against general semantic transformations.
We proposed a novel idea that using a surrogate neural network to ﬁt semantic transformations.
Then we prove tight certiﬁed robustness bound for the surrogate model and use it for certifying semantic transformations.
Extensive experiments verify the effectiveness of our method and we achieved state-of-the-art performance on various types of semantic transformations.
In the future, we plan to extend our method to real-world scenarios on more diverse semantic transformations.
R EPRODUCIBILITY STATEMENT
We ensure the reproducibility of our paper from three aspects.
(1) Experiment: The implementation of our experiment is described in Sec. 5.1.
Ablation study for our experiments is in Sec.
Further details are in Appendix B. (2) Code: Our code is included in supplementary materials.
(3) Theory and Method: A complete proof of the theoretical results described is provided in Appendix A
E THICS STATEMENT
Machine learning models are easily attacked by adversarial examples and semantic transformations.
Thus it is fundamental problem to develop certiﬁed robust machine learning methods.
This paper proposed GSmooth to certify against semantic transformations.
It may promote the development of safe and reliable machine learning models in the future.
A P ROOF OF T HEOREMS
In this section
[Equation]
we will provide detailed proofs of theorems in our paper.
First, we restate the theorem of randomized smoothing for additive noise and binary classiﬁers f
[Equation] [Equation]
[Equation] [Equation]
Theorem 4.
Let f ( x ) be any classiﬁer and G ( x ) be the smoothed classiﬁer deﬁned in Eq.
(18), if
G ( x ) < 12 , then G ( x + δ ) < 12 for any
[Equation]
where Φ( · ) is a function about smoothing distribution deﬁned in Eq.
[Equation]
Proof.
We ﬁrst calculate the gradient of the smoothed classiﬁer
[Equation]
Then we multiple any vector with unit norm u ∈ B n (1) =
{ u : (cid:107) u (cid:107) = 1 , u ∈ R n } ,
[Equation]
i
[Equation]
(cid:12)(cid:12)(cid:12)(cid:12)(cid:88) i
[Equation]
(cid:12)(cid:12)(cid:12)(cid:12)
[Equation]
(cid:12)(cid:12)(cid:12)(cid:12)(cid:90)
[Equation]
To bound the gradient of the smoothed classiﬁer, we use the following inequality,
[Equation]
As shown in Yang et al.
[Equation]
the optimal ˆ f ( x ) achieves at,
[Equation] [Equation]
Then,
E
[Equation] [Equation]
which means that,
[Equation] [Equation]
and this is true for all u ∈ B n (1) , so we have,
[Equation]
Consider a path from ξ t : [0 , (cid:107) δ (cid:107) ]
→ R d with ξ 0 = x and ξ (cid:107) δ (cid:107) = x + δ and ξ (cid:48) t = δ (cid:107) δ (cid:107) , we have
[Equation] [Equation]
If the norm of δ satisﬁes that,
[Equation]
if right hand side exists, we name it (cid:107) δ 0 (cid:107) =
(cid:82) 12 G ( x ) 1 / Φ( p )d p .
Without loss of generality, we assume that G ( ξ t ) is increasing in t , then we cound calculate the minimal t when G ( ξ t ) increase to 12 ,
[Equation]
By the generality of δ we have,
[Equation]
(29) for any δ < (cid:107) δ 0 (cid:107) .
This theorem is naturally extended to problems with p > 2 classes by considering the two top classes which are G ( x ) A and G ( x ) B .
This turns the problem into a binary classiﬁcation problem.
A. T HE P ROOF OF T HEOREM
Theorem 1.
Let f ( x ) be any classiﬁer and G ( x ) be the smoothed classiﬁer deﬁned in Eq.
(1), if there exists a function M ( · ) , and the transformation τ ( · , · ) satisﬁes that
[Equation]
and there exists two constants p A , p B that satisﬁes that
[Equation]
then y A = arg max i ∈Y G ( τ ( ξ, x ))
i holds for any (cid:107) ξ (cid:107) (cid:54) R where
[Equation]
30) here M ∗ = max ξ,θ || M ( ξ, θ ) || .
Proof.
WLOG
[Equation]
we only prove it for binary cases that f ( · ) : R n → [0 , 1] .
[Equation]
For u ∈ R d and (cid:107) u (cid:107) = 1 , we have:
[Equation]
[Equation] [Equation]
35) here M ∗ = max θ,ξ (cid:107) M
[Table]
θ, ξ ) (cid:107) and we assume that g ( θ ) =
exp( − ψ ( θ )) :
|(cid:104)∇ ξ
[Equation]
γ
[Equation] [Equation]
[Equation] [Equation]
[Equation]
Similar with Theorem 4, the optimal ˆ f achieves at
[Equation]
Then we have |
[Equation]
Consider a path from ζ t : [0 , (cid:107) δ (cid:107) ]
→ R d with ζ 0 = x and ζ (cid:107) δ (cid:107) =
τ ( ξ, x ) and ζ (cid:48) t = δ
[Equation]
, we have
[Equation] [Equation]
The last part of proof is the same with Theorem 4.
A. T HE PROOF OF T HEOREM
Theorem 2.
Suppose f ( x ) is any classiﬁer and ˜ G (˜ x ) is the smoothed classiﬁer deﬁned in Eq.
(7), if there exists p A , p B that satisﬁes that
[Equation]
then y A = arg max i ∈Y ˜ G
(˜ τ (˜ ξ, ˜ x ))
i for any (cid:107) ξ (cid:107)
(cid:54) R where
[Equation]
and the coefﬁcient M ∗ is deﬁned as
[Equation]
Proof.
In this part, we will prove Theorem 2, which is the main result in this paper.
WLOG, we prove it for binary cases where f ( · ) : R n → [0 , 1] .
First, we will calculate the gradient of ˜ G
(˜ τ (˜ ξ, ˜ x )) to ˜ ξ :
[Equation]
We expand the expectation into integral and use chain rule to see that
[Equation] [Equation]
The key step is to eliminate the gradient of ∂ ˜ f
(˜ τ
(˜ θ, ˜ y ξ ))
∂
˜ τ
(˜ θ, ˜ y ξ ) and replace it with ∂ ˜ f
(˜ τ
(˜ θ, ˜ y ξ ))
∂
˜ θ .
Since:
[Equation]
We have:
[Equation] [Equation]
here we deﬁne
[Equation]
We consider the Unit enlargement, which means:
[Equation]
thus:
[Equation]
Since θ (cid:48) is the virtual parameter introduced, which can be taken as 0 in case of actual disturbance.
Thus we only need to consider the projection of ∇ ˜ ξ ˜ G
(˜ y ξ )
in the space of ξ .
Thus we set
[Equation]
56) here u ∈ R d and (cid:107) u (cid:107) = 1 .
Assume ˜
g
(˜ θ ) =
exp( − ˜ ψ
(˜ θ ))
[Equation]
57) ∂ ˜ g
( ˜ θ
[Equation]
∂ ˜ θ = − ˜ g
(˜
[Equation]
) · ∇ ˜ ψ
(˜ θ ) .
And we have
[Equation] [Equation]
We bound the right hand side by
[Equation]
sup
[Equation] [Equation]
and the optimal ˆ f is as follows,
[Equation] [Equation]
here
[Equation]
and M ∗ is
[Equation]
Notice that here F 22 ( · ) is the same as F 2 ( · ) the notations in the main text.
Then we could apply the techniques used in Theorem 1 and Theorem
[Equation]
we have:
[Equation]
Thus we have proven this Theorem.
A. T HE P ROOF OF T HEOREM
Theorem 3.
Suppose the simulation of the semantic transformation has an small enough error
[Equation]
Then there exists a constant ratio
A
[Equation]
A
[Equation]
(˜ z ξ ) (cid:107) ) > 0 does not depend on the target classiﬁer, we have the certiﬁed radius for the real semantic transformation satisﬁes that
[Equation]
where R is the certiﬁed radius for surrogate the neural network in Theorem 2 and
[Equation]
Proof.
We set ˜ u
=
[Equation]
(71) here u ∈ R d and (cid:107) u (cid:107) = 1 .
Then we have (cid:68) ∇ ˜ ξ
[Equation]
G (
[Equation]
τ (˜
[Equation]
˜ x )) − ∇ ˜
[Equation]
G (
[Equation]
(cid:32)
[Equation]
∂
[Equation]
−
[Equation]
θ
[Equation]
¯
[Equation]
(˜
[Equation]
˜
[Equation]
∂ ˜ ξ (cid:33) ˜
u ˜ g (˜ θ )d˜
θ =
(cid:90) (cid:16) ˜ τ (˜ ξ, ˜ x )
− ¯ τ (˜ ξ, ˜ x ) (cid:17) ∂ 2 ˜ f
(˜ τ
(˜ θ, ˆ τ (˜ ξ, ˜ x )))
∂
˜ ξ∂ ˆ τ ˜ u
˜ g
(˜ θ )d˜ θ (72)
Set L = ∂ 2 ˜ f
(˜ τ
(˜ θ, ¯ τ (˜ ξ, ˜ x )))
∂
˜ ξ∂ ˆ τ , we have
L = ∂ ∂ ˜ ξ (cid:32) ∂
˜ f
(˜ τ
(˜ θ, ˆ τ (˜ ξ, ˜ x )))
∂
ˆ τ (cid:33) =
∂ ∂ ˜ ξ (cid:32) ∂
˜ f
(˜ τ
(˜ θ, ˆ τ (˜ ξ, ˜ x )))
∂
˜ τ
(˜ θ, ˆ τ (˜ ξ, ˜ x ))
∂
˜ τ
(˜ θ, ˆ τ (˜ ξ, ˜ x ))
∂
ˆ τ (cid:33) .
Set y ˜ ξ =
˜ τ
(˜ θ, ˆ τ ( ˜ ξ, ˜ x )) , we have:
[Equation]
A
[Equation]
74) here A 1 = (cid:20)
I d − F (cid:48)
[Equation]
I
[Equation]
(cid:21) ˜ F 2 (cid:48)
(ˆ τ (˜ ξ, ˜ x )) .
By the proof above
[Equation]
we have ∂ ∂ ˜ ξ = ∂ ∂ ˜
θ A 2 , thus we have:
[Equation]
where ˜ A is a constant depending on (cid:107) F (cid:48)
( ˜ ξ ) (cid:107) , (cid:107) F (cid:48) 
 (˜ y ξ ) (cid:107) , (cid:107) F (cid:48)
(˜ z ξ ) (cid:107) .
Then there exists A and we have
[Equation]
where
[Equation]
B I MPLEMENTATION DETAILS AND EXPERIMENTAL SETTINGS B. P RACTICAL ALGORITHMS FOR CALCULATING M ∗
For resolvable transformations in Theorem 1, the M ∗ is deﬁned as
[Equation]
Since if we have veriﬁed that the semantic transformation is resolvable, most of time we have a closed form of M ∗ like contrast/brightness transformation and we are able to calculate it analytically as shown in Li et al.
For non-resolvable transformations in Corollary 1, M ∗ is deﬁned as
[Equation]
This ratio is similar with the Lipschitz bound for a semantic transformation in Li et al.
(2021).For low dimensional semantic transformations, we are able to interpolate the domain to ﬁnd a maximum M ∗ and corresponding ξ .
But this remains a challenge for high dimensional semantic transformations.
Speciﬁcally, for a given ξ , we need to compute the norm of ∂F 2 ( y ξ ) ∂ξ − A 1 .
The Jacobian matrix is n × n .
Caculating it requires n times of backpropagation.
Thus it is inefﬁcient to store the matrix or directly compute its norm.
To solve the problem, we noitice that
[Equation]
And then we have
[Equation]
Since tranposing a matrix does not change its norm, we could calculate its norm by optimizing u that,
[Table]
Using this formulation, we only need to multiply the output with an unit vector and perform one backpropagation.
This is a simple convex optimization problem.
Then we could use any iterative algorithm to ﬁnd its solution which is very fast to compute.
This trick is crucial and it makes the matrix norm computation to be scalable in practice.
B. O THER DETAILS FOR EXPERIMENTS .
Our GSmooth requires to train two neural networks.
First we randomly generate corrupted images to train a image-to-image neural network.
The training process of classiﬁers and certiﬁcation for semantic transformations are done on 2080Ti GPUs.
We use a U-Net (Ronneberger et al., 2015) for the surrogate model and replace all BatchNorm layers with GroupNorm (Wu & He, 2018) since we might use the model in low bacthsize settings.
The U-Net could be replace by other networks used in image segmentation or superresolution like Res-UNet (Diakogiannis et al., 2020) or EDSR (Lim et al., 2017).
We use L1-loss to train the surrogate model which achieves better accuracy than others which is also reported (Lim et al., 2017).
After train a surrogate model to simulate the semantic transformation.
Then we train the base classiﬁer for certiﬁcation with a moderate data augmentation like (Li et al., 2021; Cohen et al., 2019) to ensure that training and testing of the classiﬁer is performed on the same distribution.
There are two types of data augmentation, one is the semantic transformation and the other is the augmented noise introduced only in our work.
Data augmentation based semantic transformation could be done using both the surrogate model or the raw semantic transformation.
We can only use the surrogate model to add the augmented noise because this noise is a type of semantic noise in the layers of surrogate model.
In our experiments the standard deviation of the augmented noise is chosen from 0 .
1 ∼ 0 .depending on the performance.
The basic network architectures for these datasets are kept the same with (Li et al., 2021).
On CIFAR-100 daatsets, we use a PreResNet (He et al., 2016b) re-implement the method by Li et al.
We also adopt the progressive sampling trick mentioned in TSS (Li et al., 2021) which is useful to reduce computational cost and certify larger radius.
The details could also be found in Li et al.
C S UPPLEMENTARY E XPERIMENTS
In this section, we report the results of our GSmooth under adaptive attacks to verify the tightness of our certiﬁed bound.
The experiments are conducted on CIFAR-10 dataset.
We use expectation of transformation to calculate the gradient of the model.
Then we apply projected gradient descent
[Table]
[Table]
to ﬁnd adversarial examples until it converged.
Then we report the accuracy of our model on the corrupted dataset.
The result is listed in the following table.
We found that the empirical attack is no less than the certiﬁed accuracy.
This shows that the bound for our model is effective.
Additional, some empirical results are much higher than the certiﬁed accuracy, which might indicate the bound still has space for improvement.
We have conducted some experiments under the common benchmark CIFAR-10-C to show the empirical robustness under these corruptions.
We conducted the experiments on some subsets of
CIFAR-10-C.
The corruption types of these subsets are related to the experiments in our paper.
The settings of these experiments and the results of baselines are from TSS(Li et al 2021).