(C ERTIFIED !
) A DVERSARIAL R OBUSTNESS FOR F REE !
Anonymous authors
Paper under double-blind review
A BSTRACT
In this paper we show how to achieve state-of-the-art certiﬁed adversarial robustness to (cid:96) 2 -norm bounded perturbations by relying exclusively on off-the-shelf pretrained models.
To do so, we instantiate the denoised smoothing approach of
Salman et al.
(2020) by combining a pretrained denoising diffusion probabilistic model and a standard high-accuracy classiﬁer.
This allows us to certify 71% accuracy on ImageNet under adversarial perturbations constrained to be within an (cid:96) 2 norm of ε = 0 .
5 , an improvement of 14 percentage points over the prior certiﬁed SoTA using any approach, or an improvement of 30 percentage points over denoised smoothing.
We obtain these results using only pretrained diffusion models and image classiﬁers, without requiring any ﬁne tuning or retraining of model parameters.
I NTRODUCTION
Evaluating the robustness of deep learning models to norm bounded adversarial perturbations has been shown to be difﬁcult (Athalye et al., 2018; Uesato et al., 2018).
Certiﬁed defenses—such as those based on bound propagation (Gowal et al., 2018; Mirman et al., 2018) or randomized smoothing (Lecuyer et al., 2019; Cohen et al.,
2019)—offer provable guarantees that a model’s predictions are robust to norm-bounded adversarial perturbations, for a large fraction of examples in the test set.
The current state-of-the-art approaches to certify robustness to adversarial perturbations bounded in the (cid:96) 2 norm rely on randomized smoothing (Lecuyer et al., 2019; Cohen et al., 2019).
By taking a majority vote over the labels predicted by a “base classiﬁer” under random Gaussian perturbations of the input, if the correct class is output sufﬁciently often, then the defense’s output on the original un-noised input is guaranteed to be robust to (cid:96) 2 norm bounded adversarial perturbations.
Denoised smoothing (Salman et al., 2020) is a certiﬁed defense that splits this one-step process into two.
After randomly perturbing an input, the defense ﬁrst applies a denoiser model that aims to remove the added noise, followed by a standard classiﬁer that guesses a label given this noisedthen-denoised input.
This enables applying randomized smoothing to pretrained black-box base classiﬁers, as long as the denoiser can produce clean images close to the base classiﬁer’s original training distribution.
We observe that the recent line of work on denoising diffusion probabilistic models (Sohl-Dickstein et al., 2015; Ho et al., 2020; Nichol & Dhariwal, 2021)—which achieve state-of-the-art results on image generation—are a perfect match for the denoising step in a denoised smoothing defense.
A forward diffusion process takes a source data distribution (e.g., images from some data distribution) and then adds Gaussian noise until the distribution converges to a high-variance isotropic Gaussian.
Denoising diffusion models are trained to invert this process.
Thus, we can use a diffusion model as a denoiser that recovers high quality denoised inputs from inputs perturbed with Gaussian noise.
In this paper, we combine state-of-the-art, publicly available diffusion models as denoisers with standard pretrained state-of-the-art classiﬁers.
We show that the resulting denoised smoothing defense obtains signiﬁcantly better certiﬁed robustness results—for perturbations of (cid:96) 2 norm of (cid:15)
≤on ImageNet and (cid:15) ≤ 0 .
5 on CIFAR-10—compared to the “custom” denoisers trained in prior work (Salman et al., 2020), or in fact with any certiﬁably robust defense (even those that do not rely on denoised smoothing).
B ACKGROUND
Adversarial examples (Biggio et al., 2013; Szegedy et al., 2014) are inputs x (cid:48)
=
x + δ constructed by taking some input x (with true label y ∈ Y ) and adding a perturbation δ (that is assumed to be imperceptible and hence label-preserving)
so that a given classiﬁer f misclassiﬁes the perturbed input, i.e., f ( x + δ ) (cid:54) = y .
The “smallness” of δ is quantiﬁed by its Euclidean norm, and we constrain (cid:107) δ (cid:107) 2 ≤ ε .
Even when considering exceptionally small perturbation budgets (e.g., ε = 0 . 5 ) modern classiﬁers often have near-0% accuracy (Carlini & Wagner, 2017).
Randomized smoothing (Lecuyer et al., 2019;
Cohen et al., 2019) is a technique to certify the robustness of arbitrary classiﬁers against adversarial examples under the (cid:96) 2 norm.
Given an input x and base classiﬁer f , randomized smoothing considers a smooth version of f deﬁned as:
[Equation]
Cohen et al.
(2019) prove that the smooth classiﬁer g is robust to perturbations of (cid:96) 2 radius R , where the radius R grows with the classiﬁer’s “margin” (i.e., the difference in probabilities assigned to the most likely and second most-likely classes).
As the probability in Equation 1 cannot be efﬁciently computed when the base classiﬁer f is a neural network, Cohen et al.
(2019) instantiate this defense by sampling a small number m of noise instances (e.g., m = 10 ) and taking a majority vote over the outputs of the base classiﬁer f on m noisy versions of the input.
To compute a lower-bound on this defense’s robust radius R , they estimate the probabilities Pr[ f ( x + δ )
=
c ] for each class label c by sampling a large number N of noise instances δ (e.g., N = 100 , 000 ).
See Cohen et al.
for details.
Denoised smoothing (Salman et al., 2020) is an instantiation of randomized smoothing, where the base classiﬁer f is composed of a denoiser denoise followed by a standard classiﬁer f clf :
[Equation]
Given a very good denoiser (i.e., denoise ( x + δ ) ≈ x with high probability for δ ∼ N (cid:0) 0 , σ 2 I (cid:1) ), we can expect the base classiﬁer’s accuracy on noisy images to be similar to the clean accuracy of the standard classiﬁer f clf .
Salman et al.
(2020) instantiate their denoised smoothing technique by training custom denoiser models with Gaussian noise augmentation, combined with off-the-shelf pretrained classiﬁers.
Denoising Diffusion Probabilistic Models (Sohl-Dickstein et al., 2015; Ho et al., 2020; Nichol & Dhariwal, 2021) are a form of generative model that work by learning a model that can reverse time on a diffusion process of the form x t ∼ √ 1 − β t · x t − 1 + β t · ω t , ω t ∼ N (0 , I ) with x 0 coming from the data distribution, and the β t being ﬁxed (or learned) variance parameters.
The diffusion process transforms images from the target data distribution to purely random noise over time.
The reverse process then synthesizes images from the data distribution starting with random Gaussian noise.
In this paper we will not make use of diffusion models in the typical way; instead it sufﬁces to understand just one single property about how they are trained.
Given a clean training image x ∈ [ − 1 , 1] w · h · c , a diffusion model selects a timestep t ∈ N + from some ﬁxed schedule and then samples a noisy image x t of the form x t
[Equation]
where the factor α t is a constant derived from the timestamp t that determines the amount of noise to be added to the image (the noise magnitude increases monotonically with t ).
The diffusion model is then trained (loosely speaking) to minimize the discrepancy between x and denoise ( x t ; t ) ; that is, to predict what the original (un-noised) image should look like after applying the noising step at timestep t .
1: N OISE A ND C LASSIFY
( x, σ ): 2: t (cid:63) , α t (cid:63) ← G ET T IMESTEP ( σ ) 3: x t (cid:63) ← √ α t (cid:63) ( x + N (0 , σ 2 I )) 4: ˆ x ← denoise ( x t (cid:63) ; t (cid:63) ) 5: y ← f clf (ˆ x ) 6: return y 7: 8: G ET T IMESTEP ( σ ): 9: t (cid:63) ← ﬁnd t s.t.
− α t α t = σ10: return t (cid:63) , α t (cid:63)
1: P REDICT ( x, σ, N, η ): 2: counts ←3: for i ∈ { 1 , 2 , . . .
, N } do 4: y ← N OISE A ND C LASSIFY ( x, σ ) 5: counts [ y ] ← counts [ y ]
+6: ˆ y A , ˆ y B ← top two labels in counts 7: n A , n B ← counts [ˆ y A ] , counts [ˆ y B ] 8: if B INOM PT EST ( n A , n A + n B , 1 / 2 ) ≤ η then 9: return ˆ y A 10: else 11: return Abstain
D IFFUSION D ENOISED S MOOTHING
Our approach, Diffusion Denoised Smoothing (DDS), requires no new technical ideas on top of what was introduced in the section above.
Denoised smoothing via a diffusion model.
The only minor technicality required for our method is to map between the noise model required by randomized smoothing and the noise model used within diffusion models.
Speciﬁcally, randomized smoothing requires a data point augmented with additive Gaussian noise x rs ∼ N ( x, σ 2 I ) , whereas diffusion models assume the noise model x t ∼
N ( √ α t x, (1 − α t ) I ) .
Scaling x rs by √ α t and equating the variances yields the relationship
[Equation]
Thus, in order to employ a diffusion model for randomized smoothing at a given noise level σ , we ﬁrst ﬁnd the timestep t (cid:63) such that σ 2 = 1 − α t(cid:63) α t(cid:63) ; the precise formula for this equation will depend on the schedule of the α t terms used by the diffusion model, but this can typically be computed in closed form, even for reasonably complex diffusion schedules.
2 Next, we compute
[Equation]
and apply the diffusion denoiser on x t (cid:63) to obtain an estimate of the denoised sample
[Equation]
And ﬁnally, we classify the estimated denoised image with an off-the-shelf classiﬁer y
[Equation]
clf
[Equation]
The entirety of this algorithmic approach is shown in Figure 1.
solution for t
[Equation]
The actual formula here is unimportant and only shown as an illustration of how such computation can look in practice.
Even when such a closed form solution does not exist, because the schedules for α t are monotonic decreasing, one can always ﬁnd a solution via 1D root-ﬁnding methods if necessary.
To obtain a robustness certiﬁcate, we repeat the above denoising process many times (e.g., 100,000) and compute the certiﬁcation radius using the approach of Cohen et al.
(note that since our diffusion models expects inputs in [ − 1 , 1] d , we then divide the certiﬁed radius by 2 to obtain a certiﬁed radius for inputs in [0 , 1] as assumed in all prior work).
One-shot denoising.
Readers familiar with diffusion models may recall that the standard process repeatedly applies a “single-step” denoising operation x t − 1 =
d ( x t ; t ) that aims to convert a noisy image at some timestep t to a (slightly less) noisy image at the previous timestep t − 1 .
The full diffusion process would then be deﬁned by the following iterative procedure:
[Equation]
In fact, each application of the one-step denoiser d consists of two steps: (1) an estimation of the fully denoised image x from the current timestep t , and (2) computing a (properly weighted, according to the diffusion model) average between this estimated denoised image and the noisy image at the previous timestep t − 1 .
Thus, instead of performing the entire t -step diffusion process to denoise an image, it is also possible to run the diffusion step d once and simply output the best estimate for the denoised image x in one shot.
When a diffusion model generates images from scratch (i.e., the denoiser is applied to pure noise), the iterative process gives higher ﬁdelity outputs than this one-shot approach (Ho et al., 2020).
But here, where we aim to denoise one particular image, a one-shot approach has two advantages:
High accuracy : it turns out that standard pretrained classiﬁers are more accurate on oneshot denoised images compared to images denoised with the full t -steps of denoising.
We hypothesize this is due to the fact that when we ﬁrst apply the single-step denoiser d at timestep t , the denoiser already has all the available information about x .
By applying the denoiser multiple times, we can only destroy information about x as each step adds new (slightly smaller) Gaussian noise.
In fact, by using the iterative t -step denoising strategy, we are in essence pushing part of the classiﬁcation task onto the denoiser, in order to decide how to ﬁll in the image.
Section 5 experimentally validates this hypothesis.
Improved efﬁciency : instead of requiring several hundred (or thousand) forward passes to denoise any given image, we only require one single pass.
This is especially important when we perform many thousand predictions as is required for randomized smoothing to obtain a robustness certiﬁcate.
Related work.
We are not the ﬁrst to observe a connection between randomized smoothing and diffusion models.
The work of Lee (2021) ﬁrst studied this problem—however they do not obtain signiﬁcant accuracy improvements, likely due to the fact that diffusion models available at the time that work was done were not good enough.
Separately, Nie et al.
(2022) suggest that diffusion models might be able to provide strong empirical robustness to adversarial examples, as evaluated by robustness under adversarial attacks computed using existing attack algorithms; this is orthogonal to our results.
E VALUATION
We evaluate diffusion denoised smoothing on two standard datasets, CIFAR-10 and ImageNet, and ﬁnd it gives state-of-the-art certiﬁed (cid:96) 2 robustness on both.
On CIFAR-10, we draw N = 100 ,noise samples and on ImageNet we draw N = 10 , 000 samples to certify the robustness following
Cohen et al.
As is standard in prior work, we perform randomized smoothing for three different noise magnitudes, σ ∈ { 0 .
For a fair comparison to prior work in Table 2 and Table 1, we give the best results reported in each paper across these same three noise magnitudes.
Note that prior work only uses three levels of noise due to the computational overhead; one beneﬁt of using a diffusion model is we could have used other amounts of noise without training a new denoiser model.
CIFAR-10 conﬁguration.
We denoise CIFAR-10 images with the 50M-parameter diffusion model from Nichol & Dhariwal (2021).
The denoised images are classiﬁed with a 87M-parameter improved-
[Table]
ViT-B/16 model (Dosovitskiy et al., 2021) that was pretrained on ImageNet-21k (Deng et al., 2009) (in 224 × 224 resolution) and ﬁnetuned on CIFAR-10.
We use the implementation from HuggingFace 4 which reaches 97 .
9% test accuracy on CIFAR-10.
In addition, we also report results with a standard 36M parameter Wide-ResNet-28-10 model (Zagoruyko & Komodakis, 2016) trained on
CIFAR-10 to 95.2% accuracy.
As is typical, we report results with images normalized to [0 , 1] 32 × 32 × 3 .
We obtain a throughput of 825 images per second through the diffusion model and ViT classiﬁer on an A100 GPU at a batch size of 1 , 000 .
We report robust accuracy results averaged over the entire CIFAR-10 test set.
ImageNet conﬁguration.
We denoise ImageNet images with the 552M-parameter classunconditional diffusion model from Dhariwal & Nichol (2021), and classify images with the 305Mparameter BEiT large model (Bao et al., 2022) which reaches a 88 .
6% top-1 validation accuracy using the implementation from timm (Wightman, 2019).
We report results for our images when normalized to [0 , 1] 224 × 224 × 3 to allow us to compare to prior work.
The overall latency of this joint denoise-then-classify model is 1 . 5 seconds per image on an A100 GPU at a batch size of 32 .
We report results averaged over 1 , 000 images randomly selected from the ImageNet test set.
4. R ESULTS
On both CIFAR-10 and ImageNet we outperform the state-of-the-art denoised smoothing approaches (i.e., Salman et al.
(2020) and Lee (2021))
in every setting; see Table 1 and Table 2, as well as Figure 2 for detailed results.
Perhaps even more impressively, we also outperform models trained with randomized smoothing at low ε distortions ( (cid:15) ≤ 0 .
5 on CIFAR-10, and (cid:15) ≤ 2 on ImageNet), and nearly match them at high ε .
Even though these randomized smoothing techniques train their models end-to-end and speciﬁcally design these models to have high accuracy on Gaussian noise, we ﬁnd that our approach’s use of off-the-shelf models yields superior robustness (and much higher clean accuracy as an added bonus).
Interestingly, we ﬁnd that using a diffusion model to perform the denoising step gives its most signiﬁcant beneﬁts when σ and ε are small: for example, while we reach 71 .
1% top-1 accuracy at ε = 0 .
5 on ImageNet, an improvement over prior work of +14 percentage points, when we reach ε =
our scheme is 7 percentage points worse than state-of-the-art.
Our hypothesis for this effect, which we explore further in Section 5, is that diffusion models are prone to “hallucinate”
[Table]
[Figure]
e r t i f i e d a cc u r a c y =0.25 =0.
=1.
[Figure]
content when denoising extremely noisy images.
Thus, instead of reinforcing the signal from the correct class, the diffusion model instead generates a signal from a different class, thereby fooling the classiﬁer.
CIFAR-10 ablation.
The off-the-shelf classiﬁers we use were pretrained on larger datasets than respectively CIFAR-10 and ImageNet.
It is well known that the use of additional data can boost robustness, both for empirical (Schmidt et al., 2018) and certiﬁed (Salman et al., 2019) defenses.
To investigate the role played by the pretrained model, we repeat our CIFAR-10 experiment using a standard 36M parameter Wide-ResNet-28-10 model (Zagoruyko & Komodakis, 2016) trained solely on CIFAR-10 to 95.2% accuracy.
The results with this classiﬁer (see Table 5a) outperform prior denoised smoothing approaches, and are competitive with prior randomized smoothing results up to (cid:15)
= 0 .
The ViT classiﬁer outperforms the ResNet because it is more robust to the distribution shift introduced by the noising-and-denoising procedure.
To alleviate this, we can further ﬁnetune the classiﬁer on denoised images denoise ( x + δ ) from the CIFAR-10 training set.
This defense is thus not strictly “off-the-shelf” anymore (although ﬁnetuning is negligible compared to the training [Table] time of the diffusion model and classiﬁer).
Table 5b shows that a ﬁnetuned Wide-ResNet achieves comparable-or-better results than a non-ﬁnetuned ViT. Thus, with a minimal amount of training, we also surpass prior randomized smoothing results without relying on any external data .
If we ﬁnetune the ViT model (Table 5d), we further improve our defense’s clean accuracy and certiﬁed robustness at (cid:15) ≤ 0 .
5 by a couple of percentage points.
Our ablation is summarized in Table 3.
A NALYSIS AND D ISCUSSION
We achieve state-of-the-art certiﬁed accuracy using diffusion models despite the fact that we are not using these models as diffusion models but rather trivial denoisers .
That is, instead of leveraging the fact that diffusion models can iteratively reﬁne images across a range of noise levels , we simply apply the diffusion model once for a ﬁxed noise level, to perform one-shot denoising.
In this section we study why this approach outperforms prior work that trained straightforward denoisiers for denoised smoothing (Salman et al., 2020), and why using diffusion models for oneshot denoising performs better than the more involved iterative diffusion process.
5. F ULL DIFFUSION VERSUS ONE - SHOT DENOISING
When used as generative models, diffusion models perform denoising through an iterative process that repeatedly reﬁnes an estimate of the ﬁnal denoised image.
When given an image x t with noise of magnitude corresponding to some diffusion timestep t , the model ﬁrst predicts a one-shot estimate of the denoised image x 0 , and then constructs an estimate x t − 1 of the noised image at timestep t − 1 by interpolating (with appropriate weights) between x 0 , x t and fresh isotropic Gaussian noise
N (0 , I ) .
The diffusion process is then applied recursively at timestep t − 1 .
Intuitively, it may be expected that when using a diffusion model as a denoiser, one-shot denoising will produce more faithful results than the full iterative reverse-diffusion process.
Indeed, each step of the reverse-diffusion process destroys information about the original image, since each step adds fresh Gaussian noise to the image.
Thus, information theoretically at least, it should be easier to denoise an image in one-shot than over multiple iterations.
We ﬁnd that this is indeed the case.
While the full reverse-diffusion process produces denoised images with more ﬁnegrained details (which is a good property for generating photorealistic images from scratch), these details are often not actually faithful to the original image we want to denoise.
Instead, diffusion models are prone to “hallucinate” salient detailed features during the iterative denoise-and-noise process.
We illustrate some examples of this hallucination phenomenon in Figure 3.
Here, we noise an original image (on the left) with large Gaussian noise ( σ = 1 ) and then apply either the full reverse-diffusion process (rightmost image) or a one-shot denoising at the appropriate timestep (2nd image to the right).
As we can see, one-shot denoising produces mostly faithful, but blurry, reconstructions of the original image, with ﬁnegrained details lost due to noise.
In contrast, iterative denoising “invents” new details that result in images that are ultimately more photorealistic but semantically different from the starting image.
Additional examples (with multiple random seeds) are in Figure 4 in the Appendix.
5. T RAINING ON RESTRICTED NOISE LEVELS
Given that one-shot denoising performs better than full multi-shot denoising, we now turn to understanding our next question: if we are just using diffusion models as one-shot denoisers, then why do diffusion models perform better compared to the straightforward denoisers trained in prior work (Salman et al., 2020)?
To investigate this, we train seven new diffusion models on CIFARwith varying levels of Gaussian noise—all the way towards a model trained on a single noise level, i.e., a straightforward denoiser.
Recall that during standard training of a diffusion model, we sample a timestep T uniformly from some range, add noise according to this timestep, and then train the model to predict the noise that has been added.
The only difference between this process and the standard denoised smoothing training process (Salman et al., 2020) is the fact that here we are training on multiple levels of
Gaussian noise simultaneously.
Therefore we now perform a comparative analysis of models trained on more restrictive noise levels.
We select seven different levels of noise:
• Three models are trained exclusively on Gaussian noise of ﬁxed standard deviation of respectively σ = 0 .
25 , σ = 0 .
5 , or σ = 1 . 0 .
This is identical to training a “straightforward” denoiser on noise of a ﬁxed magnitude.
• One model is trained on all three noise levels at the same time.
• Two models are trained on noise uniformly selected from σ ∈ [0 , 0 . 25] , and σ ∈ [0 , 1 . 0] .
• One model is trained using the full range of noise, from σ ∈ [0 , S ] for some S (cid:29) 1 (the exact value of S depends on the chosen noise schedule for the diffusion model).
We then evaluate the clean accuracy of an off-the-shelf ViT model on each image when denoised (in one shot) with each of these diffusion models, where the images are noised with a standard deviation of either σ = 0 .
25 , σ = 0 .
5 , or σ = 1 . 0 .
The results are summarized in Table 4.
Noise at evaluation
[Table]
As expected, training a new model on any one individual noise level, and then using that model to denoise images at that noise level, gives high downstream accuracy: for example, training a diffusion model using σ = 0 .
25 noise and then evaluating at this same noise level gives 79% accuracy.
However if we then try and use this model to denoise images at a different noise level—say σ = 0 .
5 —the accuracy of the classiﬁer drops to just 16% .
If we train the diffusion model directly on σ = 0 .
5 noise, we instead get a much better classiﬁcation accuracy of 60 .
1% , but without good generalization to lower or higher noise levels.
Similarly, training on noise of σ = 1 . 0 only gives good results when denoising images with the same noise level.
More surprisingly, however, is that training on all three noise levels simultaneously gives better accuracy for denoising images at each noise level, compared to a diffusion model trained speciﬁcally and solely for that noise level.
For example, when denoising images with σ = 0 .
5 Gaussian noise, we get a classiﬁcation accuracy of 68 .
1% when the diffusion model is trained on that noise level and additional lower and higher noise levels—a value 8% higher than the accuracy of 60 .
1% we get when training the diffusion model solely on σ = 0 .
5 noise.
If we train on more granular noise levels, either in [0 , 0 . 25] or in the full interval [0 , 1] , the classiﬁcation accuracy on denoised images at the three individual noise levels further increases by a few percentage points.
Quite surprisingly, the standard training regime which trains the diffusion model on noise from a larger range [0 , S ] for some S (cid:29) 1 further improves the denoising capabilities at low noise levels ( σ = 0 .
25 and σ = 0 . 5 ), but slightly harms the accuracy for larger noise ( σ = 1 . 0 ).
From this experiment, we can conclude that the (full) training process of diffusion models leads to much better, and more generalizable, one-shot denoising capabilities than when training a standalone denoiser on a single noise level as in prior work.
C ONCLUSION
At present, training certiﬁed adversarially robust deep learning models requires specialized techniques explicitly designed for the purpose of performing provably robust classiﬁcation (Cohen et al., 2019).
While this has proven effective, these models are extremely difﬁcult to train to high accuracy, and degrade clean accuracy signiﬁcantly.
We suggest an alternative approach is possible.
By exclusively making use of off-the-shelf models designed to be state-of-the-art at classiﬁcation and image denoising, we can leverage the vast resources dedicated to training highly capable models for the new purpose of robust classiﬁcation.