Recent work has shown that any classifier which classifies well under Gaussian noise can be leveraged to create a new classifier that is provably robust to adversarial perturbations in 2 norm. However, existing guarantees for such classifiers are suboptimal. In this work we provide the first tight analysis of this "randomized smoothing" technique. We then demonstrate that this extremely simple method outperforms by a wide margin all other provably 2 -robust classifiers proposed in the literature. Furthermore, we train an ImageNet classifier with e.g. a provable top-1 accuracy of 49% under adversarial perturbations with 2 norm less than 0.5 (=127/255). No other provable adversarial defense has been shown to be feasible on Im-ageNet. While randomized smoothing with Gaussian noise only confers robustness in 2 norm, the empirical success of the approach suggests that provable methods based on randomization at test time are a promising direction for future research into adversarially robust classification. Code and trained models are available at http: //github.com/locuslab/smoothing.
Recently, REF provided a tight 2 robustness guarantee for randomized smoothing.
Certified Adversarial Robustness via Randomized Smoothing
ArXiv
ArXiv
Computer Science Mathematics