(cid:96)
A DVERSARIAL
R OBUSTNESS C ERTIFICATES : A R ANDOMIZED S MOOTHING A PPROACH
Anonymous authors
Paper under double-blind review
A BSTRACT
Robustness is an important property to guarantee the security of machine learning models.
It has recently been demonstrated that strong robustness certiﬁcates can be obtained on ensemble classiﬁers generated by input randomization.
However, tight robustness certiﬁcates are only known for symmetric norms including (cid:96) 0 and (cid:96) 2 , while for asymmetric norms like (cid:96) 1 , the existing techniques do not apply.
By converting the likelihood ratio into a one dimensional mixed random variable, we derive the ﬁrst tight (cid:96) 1 robustness certiﬁcate under isotropic Laplace distributions in binary case.
Empirically, the deep networks smoothed by Laplace distributions yield the state-of-the-art certiﬁed robustness in (cid:96) 1 norm on CIFAR-10 and ImageNet.
I NTRODUCTION
have done a series of nice works in practical sights or theoretical sights (Zheng et al., 2016; Gouk et al., 2018).
Among them, certiﬁably robustness is valuable, since it can withstand all attacks within a norm ball and has a nice theoretical and practical outcome.
However, most work cannot deal with the case for general neural networks.
Deep networks are ﬂexible models that are widely adopted in various applications.
However, it has been shown that such models are vulnerable against adversary (Szegedy et al., 2014).
Concretely, an unnoticeable small perturbation on the input can cause a typical deep model to change predictions arbitrarily.
The phenomenon raises the concerns of the security of deep models, and hinders its deployment in decision-critical applications.
Indeed, the certiﬁcation of robustness is a pre-requisite when AI-generated decisions may have important consequences.
Certifying the robustness of a machine learning model is challenging, especially for modern deep learning models that are over-parameterized and effectively black-box.
Hence, the existing approaches mainly rely on empirical demonstration against speciﬁc adversarial attack algorithms (Goodfellow et al., 2015; Madry et al., 2018; Finlay et al., 2019).
However, this line of works can give a false sense of security.
Indeed, successful defense against the existing attack algorithms does not guarantee actual robustness against any adversaries that may appear in the future.
Recently, the adversarial robustness community has shifted the focus towards establishing certiﬁcates that prove the robustness of deep learning models.
The certiﬁcate can be either exact or conservative, so long as the certiﬁed region cannot exhibit any adversarial examples.
Given the over-parameterized deep models and modern high-dimensional datasets, scalability becomes a key property for the certiﬁcation algorithms, as many methods are computationally intractable.
Our work is based on the novel modeling scheme that generates ensembles of a ﬁxed black-box classiﬁer based on input randomization (Cohen et al., 2019).
Under this framework, tight robustness certiﬁcates can be obtained with only the ensemble prediction values and randomization parameters.
Given appropriate choices of distributions, the robustness guarantee can be derived for (cid:96) 2 or (cid:96)norms (Cohen et al., 2019; Lee et al., 2019).
The tightness simply implies that any point outside the certiﬁed region is an adversarial example in the worst case.
However, the derivations of the previous results heavily relies on the fact that the target norm ( (cid:96) 2 or (cid:96) 0 ) is symmetric, therefore analyzing any perturbation direction for attacking the model gives the same certiﬁcation guarantee.
In contrast, (cid:96) 1 norm is asymmetric.
That is, for a given (cid:96) 1 ball centered at the origin, if we move another (cid:96) 1 ball also from the origin by a distance δ , where (cid:107) δ (cid:107) 1 is ﬁxed, then the overlapped region between the two (cid:96) 1 balls may have different shapes and sizes (See Figure 1).
The characterization of this overlapped region is the key step for proving tight certiﬁcates, hence the existing techniques do not apply for (cid:96) 1 norm.
In this work, we derive a tight (cid:96) 1 robustness guarantee under isotropic Laplace distributions.
The Laplace distribution can be interpreted as an inﬁnite mixture of uniform distributions over (cid:96) 1 -norm balls, which is a natural “conjugate” distribution for (cid:96) 1 norm.
Due to asymmetry, we ﬁrst identiﬁed the tight robustness certiﬁcate for attacking the model in one particular direction, δ =
( (cid:107) δ (cid:107) 1 , 0 , · · · , 0) . To show that other perturbation directions cannot lead to worse results, we convert the d dimensional likelihood function into an one dimensional function, where we apply relaxation for various δ and show that the worst case result is bounded by the speciﬁc direction ( (cid:107) δ (cid:107) 1 , 0 , · · · , 0) .
Theoretically, our certiﬁcate is tight in the binary classiﬁcation setting.
In the multi-class classiﬁcation setting, our certiﬁcate is always tighter than the previous certiﬁcate proposed by Lecuyer et al.
The theoretical improvement always leads to superior empirical results on certifying the same model, where we demonstrate the result on CIFAR-10 and ImageNet with ResNet models.
Moreover, the proposed robustness certiﬁcate on models smoothed by Laplace distributions also outperforms the same models trained and certiﬁed using Gaussian distributions (Cohen et al., 2019) in (cid:96) 1 certiﬁed robustness, where the Gaussian-based robustness certiﬁcate is adapted from (cid:96) 2 norm.
R ELATED W ORK
Robustness of a model can be deﬁned in various aspects.
For example, Feynman-Kac Formalism can be used to improve robustness (Wang et al., 2018).
In this paper, we focus on the classiﬁcation setting, where the goal is to provide guarantee of a constant prediction among a small region speciﬁed via some metric.
The robustness certiﬁcate can be either exact or conservative, so long as a constant prediction is guaranteed in the certiﬁed region.
Note that the certiﬁcation of a completely black-box model requires checking the prediction values at every point around the point of interest, which is clearly infeasible.
A practical certiﬁcation algorithm inevitably has to specify and leverage the functional structure of the classiﬁer in use to reduce the required computation.
Exact certiﬁcates.
The exact certiﬁcate of deep networks is typically derived for the networks with a piecewise linear activation function such as ReLU.
Such networks have an equivalent mixed integer linear representation (Cheng et al., 2017; Lomuscio & Maganti, 2017; Dutta et al., 2017;
Bunel et al., 2018).
Hence, one may apply mixed integer linear programming to ﬁnd the worst case adversary within any convex polyhedron such as an (cid:96) 1 -ball or (cid:96) ∞ -ball.
Despite the elegant solution, the complexity is, in general, NP-hard and the algorithms are not scalable to large problems(Tjeng et al., 2017).
Conservative certiﬁcates.
A conservative certiﬁcate can be more scalable than the exact methods, since one can trade-off the accuracy of certiﬁcation with efﬁciency (Gouk et al., 2018; Tsuzuku et al., 2018; Cisse et al., 2017; Anil et al., 2018; Hein & Andriushchenko, 2017).
For example, one can relax the search of the worst case adversary as a simpler optimization problem that only bounds the effect of such adversary.
Alternatively, people also consider the robustness problem in a modular way, where the robustness guarantee can be derived iteratively for each layer in the deep networks by considering the feasible values for each hidden layer (Gowal et al., 2018;
Weng et al., 2018; Zhang et al., 2018; Mirman et al., 2018; Singh et al., 2018).
However, this line of works have not yet been demonstrated to be feasible to realistic networks in high dimensional problems like ImageNet.
Randomized smoothing.
Randomized smoothing has been proved to be closely related to robustness.
Although similar techniques have been tried by (Liu et al., 2018; Cao & Gong, 2017), no corresponding proofs have been given; Li et al.
and Cohen et al.
(2019) have proved certiﬁed robustness of (cid:96) 2 norm under isotropic Gaussian noise, and Lee et al.
(2019) proved robustness for (cid:96) 0 form.
Lecuyer et al. (2019) use techniques from differential privacy to prove (cid:96) 1 robustness under
Gaussian and Laplace noise respectively, but the bounds are not tight. Li et al.
; Pinot et al.
(2019) use R´enyi divergence framework without tightness proof.
Our results synthesize the ideas in (Cohen et al., 2019; Lee et al., 2019; Lecuyer et al., 2019; Li et al., 2018; Pinot et al., 2019) and prove the tight robustness radius under the binary classiﬁcation setting.
P RELIMINARIES
Deﬁnition 1 (Laplace distribution)
Given λ ∈ R + , d ∈ Z + , we use L ( λ ) to denote the Laplace distribution in dimension d with parameter λ .
The p.d.f.
of L ( λ ) is denoted as L ( x ; λ ) (cid:44)
[Equation]
As we will see in Lemma 3.1, in smoothing analysis, we are interested in the likelihood ratio of two random variables
X = (cid:15) and Y
=
δ + (cid:15) (here (cid:15) ∼ L ( λ ) and δ ∈ R d is a ﬁxed vector).
Speciﬁcally, µ
[Equation]
[Equation] Therefore, the likelihood ratio between two d dimensional random variables is controlled by a one dimensional random variable T ( x ) (cid:44) [Equation] 1 −
[Equation] x (cid:107) 1 , where x ∼ L ( λ ) . This transformation is crucial in our analysis, and it is easy to see that T ( x ) is a mixed random variable, since P x ( T ( x ) = (cid:107) δ (cid:107) 1 ) > 0 .
In our analysis, we need to calculate the inverse of c.d.f.
of T ( x ) .
However, since T ( x ) is a mixed random variable, sometimes the inverse may not exist.
See Figure 3 for illustration, where the inverse of the probability 0 .
85 does not exist.
To deal with this case, we have the following modiﬁed version of Neyman-Pearson Lemma, with the proof in Appendix A.
Lemma 3.1 ( Neyman-Pearson Lemma for mixed random variables ).
Let X ∼ L ( λ ) and Y ∼
L ( λ ) + δ .
Let h : R d → { 0 , 1 } be any deterministic or random function.
Given any β ∈ R , and
S (cid:48) ⊆ (cid:8)
z ∈ R d : (cid:107) z − δ (cid:107) 1 − (cid:107) z (cid:107) 1 = β (cid:9) : 1.
If S = (cid:8) z ∈ R
d : (cid:107) z − δ (cid:107) 1 − (cid:107) z (cid:107) 1 > β (cid:9) ∪ S (cid:48) , and P ( h ( X ) = 1) ≥ P ( X ∈ S ) then P ( h ( Y ) = 1) ≥ P ( Y ∈ S ) 2.
If S = (cid:8) z ∈ R
d : (cid:107) z − δ (cid:107) 1 − (cid:107) z (cid:107) 1 < β (cid:9) ∪ S (cid:48) , and P ( h ( X ) = 1) ≤ P ( X ∈ S ) , then P ( h ( Y ) = 1) ≤ P ( Y ∈ S )
M AIN R ESULTS
In this paper, we apply the randomized smoothing technique (Cohen et al., 2019) for getting robustness certiﬁcates, which works as follows.
Given an input x , we perturb it with (cid:15) , s.t.
(cid:15) ∼ L ( λ ) .
Then instead of evaluating the robustness of the original function f ( x ) , we evaluate g ( x ) (cid:44) arg max c P (cid:15) ( f ( x + (cid:15) )
=
c ) , which is effectively the smoothed version of f ( x ) . [Figure]
4. R OBUSTNESS CERTIFICATES FOR GENERAL CASES
Our ﬁrst theorem proves that for the smoothed classiﬁer g , and a given input x , there always exists a robust radius R , such that any perturbation δ s.t.
(cid:107) δ (cid:107) 1 ≤ R , does not alter the prediction of g ( x ) .
Theorem 1 Let f : R d → Y be deterministic or random function, and let (cid:15) ∼ L ( λ ) .
Let g ( x ) =
arg max c P (cid:15) ( f ( x + (cid:15) ) =
c ) .
Suppose P A , P B ∈ [0 , 1] are such that
[Equation]
Then g ( x + δ ) =
g ( x ) , ∀(cid:107) δ (cid:107) 1 ≤ R , where
[Equation]
Some Remarks:
When P A → 1 or P B → 0 , we can get R → ∞ .
It is reasonable since the Laplace distribution is supported over R d , P A → 1 is equivalent to f
= c
A almost everywhere.
Compared with (Lecuyer et al., 2019) where they have R = λ 2 log( P A /P B ) , our bound is better if [Equation] 2 P
[Equation]
1 − P [Equation] See Figure 4 for illustration, where we use baseline to denote the bound R = λ 2 log( P A /P B ) .
Proof sketch:
(The full proof is in Appendix B) For arbitrarily classiﬁer f , we can transform it into a random smoothing classiﬁer g using random smoothing technique, where g returns class c A with probability no less than P A , and class c B with probability no more than P B .
Below we list the three main ideas we used in our proof:
How to deal with an arbitrary f with P A and P B ?
Following Cohen et al.
(2019), we use Neyman-Pearson Lemma to transform the relation between
P ( f ( X ) =
c A ) and P ( f ( Y ) =
c A ) into the relation between P ( X ∈ A ) and P ( Y ∈ A ) .
From
Lemma 3.1, Neyman-Pearson Lemma still holds for mixed random variables.
How to deal with the relation between X = (cid:15) and Y = (cid:15) + δ ?
Inspired by Lecuyer et al.
(2019), we use the DP-form inequality ( P ( Y ∈ A ) ≤ e (cid:15) P ( X ∈ A ) ) to deal with the relation between P ( X ∈ A ) and P ( Y ∈ A ) .
In Laplace distribution, (cid:15) = (cid:107) δ (cid:107) 1 λ .
Take
When P A or B < 1 / 2 , the above DP-form inequality gets tighter.
Therefore, we analyze A c when
P A ≥ 1 / 2 to get a new bound, and compare it with the baseline expression.
We derive this bound by Neyman-Pearson Lemma in this work, but an alternative approach is using
R´enyi Divergence (Li et al., 2018).
4. T IGHT ROBUSTNESS CERTIFICATES FOR BINARY CASE
Although we get improved result over Lecuyer et al.
(2019), the bound in Theorem 1 is not tight since it considers the general case with multiple categories.
In this section, we ﬁrst present our result for binary classiﬁcation (Theorem 2), which further improves over Theorem 1.
Theorem 2 (binary case) Let f : R d → Y be deterministic or random function, and let (cid:15) ∼ L ( λ ) .
Let g ( x ) =
arg max c P (cid:15) ( f ( x + (cid:15) ) =
c ) .
Suppose there are only two classes c A and c B , and
P A ∈ [ 12 , 1] s.t.
[Equation]
Then g ( x + δ ) =
g ( x ) , ∀(cid:107) δ (cid:107) 1 ≤ R , for
[Equation]
Scretch of the proof: (The full proof is in Appendix C)
Theorem 2 is a special binary case of
Theorem 1.
We can use a method similar to Theorem 1 to get the results.
However, it is worth noting that in binary cases, our new improved bound in Theorem 1 always dominates the bound by
Lecuyer et al.
Moreover, our bound in Eqn.
(2) is tight, as shown below.
Theorem 3 (tight bound in binary case)
In the same setting as Theorem 2, assume P A + P B ≤and P A ≥ 12 .
∀ R (cid:48) > − λ log[2(1 − P A )] , ∃ base classiﬁer f ∗ and perturbation δ ∗ with g ∗ ( x ) =
arg max c P (cid:15) ( f ∗ ( x + (cid:15) )
=
c ) and (cid:107) δ (cid:107)
=
R (cid:48) , s.t.
g ∗ ( x ) (cid:54) =
g ∗ ( x + δ ∗ ) .
Scretch of the proof: (The full proof is in Appendix C)
For Theorem 3, we prove that the bound in Theorem 2 is tight by calculating the results in one-dimensional case, where δ =
( (cid:107) δ (cid:107) 1 , 0 , . . . , 0) .
By calculating, we show that when δ = ( (cid:107) δ (cid:107) 1 , 0 , . . . , 0)
[Equation]
Therefore, when (cid:107) δ (cid:107) 1 ≤ − λ log[2 P B ] , the DP-inequality is tight.
The worst-case δ appears in the one-dimension case.
[Figure] [Figure]
Figure 5 shows the reason why the inequality is tight.
When δ is small, for P ( X ∈ B ) , the set B we selected satisﬁes ∀ x ∈ B, T ( x ) = −(cid:107) δ (cid:107) 1 (red part).
When P ( Y ∈ B ) is considered, it moves set
S towards left by step δ .
However, due to the small δ , S after moving still satisﬁes the requirement of ∀ x ∈ S, T ( x ) = −(cid:107) δ (cid:107) 1 (blue part).
Therefore, the inequality is tight.
4. M ETHOD C OMPARISON
We compared our method with Cohen et al.’s and Lecuyer et al.’s
in binary case, see Table 1.
We plot the curves in Figure 6.
As we can see, under the same variance of each noise, our method can reach better robustness radius.
Below we show simple derivations of the bounds in Table 1.
[Table]
Our
[Table]
Robustness radius of Lecuyer et al.
Using the basic inequality from differential privacy, we have:
[Equation]
where β = (cid:107) δ (cid:107) 1 /λ .
The above two inequalities show that to guarantee P ( f ( Y ) =
c A ) >
P ( f ( Y ) =
c B ) , it sufﬁces to show that:
[Equation]
So plug in β = (cid:107) δ (cid:107) 1 /λ , we have (cid:107) δ (cid:107) 1 ≤ λ 2 log( P A /P B ) .
Furthermore, in binary case, we can plug in P B = 1 − P A , and get the robustness radius: R = λ 2 log( P A / 1 − P A ) .
Robustness radius of Cohen et al.
Denote B p,r ( c ) = { x : (cid:107) x − c (cid:107) p ≤ r } .
Since we know that B 1 ,r ( c ) ⊂ B 2 ,r ( c ) , so the radius in (Cohen et al., 2019) can be directly used in (cid:96) 1 form, which is σ Φ − 1 ( P A ) .
Besides, since B 1 ,r + (cid:15) ( c ) (cid:54)⊂ B 2 ,r ( c ) whatever (cid:15) > 0 is.
And (Cohen et al., 2019) is an exact robustness guarantee, so we have that the best (cid:96) 1 form that isotropic Gaussian noise random smoothing can get is σ Φ − 1 ( P A ) .
Finally we will prove that − λ log[2(1 − P A )] ≥ λ 2 log( P A / 1 − P A ) .
For simple denotion, we just set P A = p ≥ 0 .
So it is sufﬁcient to show that − λ log[2(1 − p )] ≥ λ 2 log( p/ (1 − p )) .
By applying exponential operation, it sufﬁces to show that 1 2(1 − p ) ≥ (cid:113) p 1 − p , which is simply p (1 − p ) ≤ 14 .
E XPERIMENTS 5. I MPLEMENTATION DETAILS
Monte Carlo.
Since we cannot get the exact value of P A , we have to use Monte Carlo method to get the approximate value of P A .
More speciﬁcally, we take multiple random samples from the
Laplace distribution to estimate P A .
One way to do it is grouping the samples and get P A using non-parametric estimation.
In our experiments, we applied two different types of training, as described below.
Type1-Training:
The ﬁrst method is intuitive, and was applied in (Cohen et al., 2019).
In the training process, we add into inputs:
[Equation]
where the noise is sampled from isotropic Laplace distribution.
Type2-Training: The second method was recently proposed by Salman et al.
The idea is to use adversarial noise samples instead of the raw noise samples in a neighborhood to train the base classiﬁer.
Each training sample can be decomposed to
[Equation]
where the noise comes from an isotropic Laplace distribution, and the perturbation is found approximately by the gradient of loss with respect to the input.
Concretely, if we denote the loss as L and the input as x , the perturbation ∆ can be calculated by ∆ = a ∗ sign( ∇ x L ( θ, x, y )) , where a is a constant.
Evaluation Index.
In this paper, we choose certiﬁed accuracy as our evaluation index.
Robustness certiﬁed accuracy at radius r refers to the proportion of correctly classiﬁed samples with at least robustness radius r .
Speciﬁcally, if a group of samples with capacity n is { x i } , i = 1 , 2 , . . .
, n , its corresponding certiﬁed robustness radius is R i .
An index x i represent if the sample is classiﬁed correctly.
If the sample is correctly classiﬁed, x i = 1 , otherwise x i = 0 .
For a given r , the corresponding robustness certiﬁed accuracy is deﬁned as α = (cid:80) ni
=1 x i 1 ( R i ≥ r ) /n , where 1 ( · ) is an indicator function.
However, from Section 5.1 we know that we cannot calculate the exact robustness radius R , so we use its ˆ R to approximate R , which leads to a “approximate robustness certiﬁed accuracy”( ˆ α ), which is calculated by
[Equation]
Cohen et al.
(2019) demonstrates that when signiﬁcance level of ˆ R is small, the difference between these two quantities is negligible.
In practice, we plot approximate certiﬁed accuracy ˆ α as a function of radius r .
From Eqn.
(3), we know that ˆ α is non-increasing w.r.t.
r .
And when r → ∞ , ˆ α → 0 .
Hyperparameters.
In our paper, we set all our hyperparameters following Cohen et al.
Speciﬁcally, we set signiﬁcance level to 0.001.
n 0 = 100 in Monte Carlo simulation (used to get bound for ˆ α ) and n = 100 , 000 in estimation part (used to estimate ˆ α ).
Moreover, we test three parameters in CIFAR-10 dataset and ImageNet dataset ( σ = 0 .
Since (Cohen et al., 2019) use Gaussian noise and we use Laplace noise, they should have the same standard deviation during comparison.
This requires that σ = √ 2 λ .
E XPERIMENTAL RESULTS
Results on ImageNet and CIFAR-10.
We applied random smoothing on CIFAR-10 (Krizhevsky (2009)) and ImageNet (Deng et al.
(2009)) respectively.
On each data set, we trained several random smoothing models with differential standard deviation σ for Laplace noise.
In order to keep in line with Cohen et al.’s method and make a comparison, we select σ = 0 .
on CIFAR-10, and ImageNet, corresponding parameter λ = σ/ √ 2 .
Figure 6 draws the certiﬁed accuracy achieved by smoothing with each sigma.
For the ImageNet dataset, we only use the most basic training method (Type1 Training).
For the CIFAR-10 data set, we use two training methods (Type 1 and Type 2 Training).
We can see that the smaller sigma performs better when the radius is smaller.
As the noise gets bigger, the accuracy becomes lower, but the robustness guarantee becomes higher.
The dashed black line shows the empirical robust accuracy of an undefended classiﬁer from Cohen et al.
[Figure]
Comparison with baseline.
We will show our comparison results in the following.
Based on Table.
1, we will test our method on
CIFAR-10 with the ResNet110 architecture as well as Type1 and Type2 training, and ImageNet with
ResNet50 architecture as well as Type1 training.
We will compare our results with (Cohen et al., 2019) and (Lecuyer et al., 2019) under the same standard deviation σ .
For base classiﬁers, ours and
Lecuyer et al.
’s share the same base classiﬁer with Laplace training noise, and Cohen et al.
’s uses the base classiﬁer with Gaussian training noise.
[Figure] [Figure]
t i f i e d a
[Figure]
u r a c y
[Figure]
C ONCLUSION
In this paper, we combine the inequality from differential privacy and the classic Neyman-Pearson
Lemma to resolve the challenging asymmetry of (cid:96) 1 metric and the mixed discrete-continuous property of the likelihood ratios under isotropic Laplace distributions.
In addition, by comparing the high-dimensional case with a special edge case, we prove the tight (cid:96) 1 robustness guarantee for binary classiﬁcation problems, and obtain the state-of-the-art certiﬁed accuracy in large scale experiments.
The establishment of (cid:96) 1 certiﬁcate via Laplace distributions and the prior result of (cid:96) 2 certiﬁcate via Gaussian distributions may be extended to a generic theorem for a general (cid:96) p norm robustness certiﬁcate via the associated realization of the generalized Gaussian distribution, where the aforementioned results are special cases of the general scheme.
The introduction of the mixed random variable analysis and (cid:96) p geometry analysis may serve as a valuable extension of existing works towards such general goal.
A P ROOF OF L EMMA
In this section, we will prove that Neyman-Pearson Lemma holds with mixed random variable.
WLOG, x = 0 , X ∼ L ( λ ) and Y ∼ L ( λ ) + δ .
We will ﬁrstly introduce Neyman-Pearson Lemma, which plays an important role in our proof.
Lemma 3.1 (restated) .Let
X ∼ L ( λ ) and Y ∼ L ( λ )+ δ .
Let h : R d → { 0 , 1 } be any deterministic or random function.
Given any β ∈ R , and S (cid:48) ⊆
(cid:8)
z ∈ R
d : (cid:107) z − δ (cid:107) 1 − (cid:107) z (cid:107) 1 = β (cid:9) :
If S = (cid:8) z ∈ R
d : (cid:107) z − δ (cid:107) 1 − (cid:107) z (cid:107) 1 > β (cid:9) ∪ S (cid:48) , and P ( h ( X ) = 1) ≥ P ( X ∈ S ) then P ( h ( Y ) = 1) ≥ P ( Y ∈ S ) 2.
If S = (cid:8) z ∈ R
d : (cid:107) z − δ (cid:107) 1 − (cid:107) z (cid:107) 1 < β (cid:9) ∪ S (cid:48) , and P ( h ( X ) = 1) ≤ P ( X ∈ S ) , then P ( h ( Y ) = 1) ≤ P ( Y ∈ S )
Proof of Lemma 3.1 First, notice that P ( X ∈ S ) can be regarded as a mixed random variable.
We want to prove that as long as we can choose a S (cid:48) that satisﬁes P ( X ∈ S ) ≤ P ( h ( X ) = 1) ,
Neyman-Pearson Lemma can always hold.
Let’s ﬁrst see what happens in the proof of Neyman-Pearson Lemma.
Notice that X and Y are continuous variables, but X ∈ S and Y ∈ S can be regarded as mixed continuous-discrete event.
Then we can choose a reasonable S (cid:48) for X and Y .
We will prove case 1 and the other one can be proved with similar method.
[Equation]
The ﬁrst inequality holds due to the construction of mixed deﬁnition S .
If z ∈ S , µ Y ( z ) µ X ( z ) ≥ t .
If z ∈ S c , µ Y ( z ) µ X ( z ) ≤ t .
Compared with continuous set, the only difference appears in the equal sign.
It should be noted that P ( X ∈ S ) and P ( Y ∈ S ) should keep consistent, which means that they should have the same S (cid:48) .
In this derivation, we can ﬁnd that P ( X ∈ S ) and P ( Y ∈ S ) use the same set S (cid:48) in Eqn.
Next, we will plug in the condition that X and Y are isotropic Laplaces.
Then we just need to prove that
[Equation]
When X and Y are isotropic Laplaces, the likelihood ratio turns out to be:
[Equation]
By choosing β = − λ log( t ) , we can derive that
[Equation]
B P ROOF OF T HEOREM
Theorem 1(restated)
Let f : R d → Y be deterministic or random function, and let (cid:15) ∼ L ( λ ) .
Let g ( x ) =
arg max c P (cid:15) ( f ( x + (cid:15) ) =
c ) .
Suppose P A , P B ∈ [0 , 1] are such that
[Equation]
Then g ( x + δ ) =
g ( x ) , ∀(cid:107) δ (cid:107) 1 ≤ R , where
[Equation]
=
[Equation] [Equation]
Proof of Theorem 1 Denote T ( x ) =
(cid:107) x − δ (cid:107) 1 − (cid:107) x (cid:107) 1 .
Use Triangle Inequality we can derive a bound for T ( x ) :
[Equation]
Pick β 1 , β 2 such that there exists A (cid:
) ⊆
{ z : T ( z ) = β 1 } , B (cid:48) ⊆
{ z : T ( z ) = β 2 } , and
P
[Equation]
z
[Equation]
X
[Equation]
Deﬁne
[Equation]
Thus, apply Lemma 3.1, we have
[Equation]
Then consider P ( Y ∈ A ) and P ( Y ∈ B )
[Equation]
The inequality is derived by Eqn.
Similarly, we can get
[Equation]
First, we would like to show that robustness can be guaranteed when R ≤ λ 2 log( P A /P B ) .
If (cid:107) δ (cid:107) 1 ≤ λ 2 log( P A /P B ) , by Eqn.
(7, 8, 9), we have
[Equation]
Then, we would like to show that robustness can be guaranteed when R ≤ − λ log(1 − P A + P B ) .
From Eqn.
(9), we know that P ( Y ∈ B ) ≤ exp( (cid:107) δ (cid:107) 1 λ ) P B .
Besides, by applying Eqn.
(9) in set
A c , we can get that P ( Y ∈ A ) ≥ 1 − exp( (cid:107) δ (cid:107) 1 λ )(1 − P A ) .
So we can calculate that if (cid:107) δ (cid:107) 1 ≤ − λ log(1 − P A + P B ) , we have
[Equation]
Moreover, by simple algebraic operation, we can derive that − λ log(1 − P A + P B ) ≥ λ 2 log( P A /P B ) requires
[Equation]
The proof for Theorem 1 is ﬁnished.
C P ROOF OF T HEOREM 2 AND T HEOREM
Theorem 2(restated) (binary case) Let f : R d → Y be deterministic or random function, and let (cid:15) ∼ L ( λ ) .
Let g ( x ) =
arg max c P (cid:15) ( f ( x + (cid:15) ) =
c ) .
Suppose there are only two classes c A and c B , and P A ∈ [ 12 , 1] s.t.
[Equation]
Then g ( x + δ ) =
g ( x ) , ∀(cid:107) δ (cid:107) 1 ≤ R , for
R = − λ log[
[Equation]
1 − P
[Equation] [Equation]
Proof of Theorem
It is similar to the proof of Theorem 1.
Pick β 3 such that there exists B (cid:48) ⊆
{ z : T ( z ) = β 3 } , and
[Equation]
Deﬁne
[Equation]
So we also have P ( X (cid:54)∈ S ) =
P A = P ( f ( X )
=
c A ) .
Plug into Lemma 3.1, we can get
[Equation] [Equation]
P
[Equation]
Using a similar method as Eqn.
(9), we can get that
[Equation]
Since we have
[Equation]
Thus, if (cid:107) δ (cid:107) 1 ≤ R = − λ log[2(1 − P A )] , it holds that
[Equation]
That is to say, P ( f ( Y ) =
c A ) ≥ P ( Y (cid:54)∈ S ) ≥ 12 ≥ P ( Y ∈ S ) ≥ P ( f ( Y ) =
c B ) .
The proof for Theorem 2 is ﬁnished.
Theorem 3(restated) (tight bound in binary case)
In the same setting as Theorem 2, assume
P A + P B ≤ 1 and P A ≥ 12 .
∀ R (cid:48) > − λ log[2(1 − P A )] , ∃ base classiﬁer f ∗ and perturbation δ ∗ with g ∗ ( x ) =
arg max c P (cid:15) ( f ∗ ( x + (cid:15) )
=
c ) and (cid:107) δ (cid:107)
=
R (cid:48) , s.t.
g ∗ ( x ) (cid:54) =
g ∗ ( x + δ ∗ ) .
Proof of Theorem 3: Here, we ﬁrst set δ =
( (cid:107) δ (cid:107) 1 , 0 , . . . , 0) .
For simpliﬁcation, we denote δ = (cid:107) δ (cid:107) 1 .And deﬁne
A
[Equation]
Then, we can calculate that
[Equation]
where x ∼ 12 λ exp ( − | x | λ ) , δ = (cid:107) δ (cid:107) 1 .
Notice that if δ + 2 λ log[2(1 − P A )] ≤ − δ , we will get the integral equation by choosing S (cid:48) .
With Eqn.
(11), we have
[Equation]
Thus, plug Eqn.
(12) into the results of Lem.
3.1, we have
[Equation]
Also, since Y = X + δ , it can be derived that
[Equation]
Here we use the consistency of X ∈ A and Y ∈ A .
Since Y can be regarded as an offset of X , the integral limit should be translated into the same length.
So, if (cid:107) δ (cid:107) 1 = δ ≤ − λ log[2(1 − P A )] , by
Eqn.
(7) and Eqn.
(14), we have
[Equation]
This means that the results we get in binary case is a tight bound, and the worst-case δ appears when δ = ( δ , 0, ..., 0).
Furthermore, if we slightly enlarge δ , there would be a case that the robustness is destroyed.
The proof for Theorem 3 is ﬁnished.
D W HY L APLACE N OISE INSTEAD OF G AUSSIAN
In this section, we theoretically analyze the certiﬁcation capabilities of Gaussian and Laplace noises.
We will show that, given the same base classiﬁer f the parameter of Laplace distributions λ is less sensitive than the parameter of Gaussian distributions σ .
Given a base classiﬁer f , where
[Equation]
[Equation]
we aim to prove that Laplace noises will better protect the original prediction than Gaussian noises.
Formally, we compare their Rectiﬁed Optional Parameter Space (ROPS) , deﬁned as Λ = {√ 2 λ : g 1 ( x ; λ ) =
f ( x ) } and Σ = { σ : g 2 ( x ; σ ) =
f ( x ) } .
Note that the rectiﬁed term √ 2 is due to the fact that σ = √ 2 λ yield the same variance.
Essentially, ROPS indicates the feasible region where the smoothing distribution does not negatively impact the base classiﬁer, thus measuring the sensitivity of the smoothing distribution (the larger the better).
First, we would like to compare its prediction on a given point ( x, f ( x ))
= (0 , c A ) .
We have
[Equation]
log 2 ,
[Equation]
[Equation]
Since √ 2 log2 >
[Equation]
[Equation]
[Equation]
) , Laplace noises have a larger ROPS than Gaussian noises at the point x = 0 .
The analysis can be further extended in two cases.
First, if we have x (cid:54) = 0 , what is the corresponding ROPS that leads to the desired result ( g ( x ) = f
( x ) )?
We show in Fig.
10 that we will have a larger ROPS under Laplace noises.
Second, if we have a ﬁxed x but ﬁxed a desired certiﬁed radius, what is the corresponding ROPS?
We show in Fig.
11 that Laplace noises again have a larger ROPS.
We empirically validate this ﬁnding with ResNet110 on CIFAR-10.
The resulting smoothed model has 24 .
8% clean accuracy under a Laplace noise, and 23 .
7% clean accuracy under a Gaussian noise (with the same variance as the Laplace noise).
Here the accuracy is computed with respect to predictions of the base classiﬁer instead of the labels (to illustrate how the smoothing impacts the predictions).
[Figure]
Laplace noises are less sensitive than Gaussian noises in terms of ROPS.
[Figure]
x yields similar results).
Laplace noises are less sensitive than Gaussian noises in terms of
ROPS