论文标题
平滑减少：利用补丁以改善认证的鲁棒性
Smooth-Reduce: Leveraging Patches for Improved Certified Robustness
论文作者
论文摘要
随机平滑（RS）已被证明是一种快速，可扩展的技术，用于证明深神经网络分类器的鲁棒性。但是，基于RS的方法需要大量噪声的增强数据，这会导致准确性显着下降。我们提出了一种无训练的，修改的平滑方法，平滑降低，以利用修补和聚合来提供改进的分类器证书。我们的算法对从输入图像提取的重叠补丁进行了分类，并汇总了预测的logits以证明输入周围较大的半径。我们研究了两个汇总方案 - 最大和平均值 - 并表明两种方法都可以根据经过认证的准确性，平均认证的半径和弃权率提供了更好的证书，与并发方法相比。我们还为此类证书提供了理论保证，并且在经验上比其他需要昂贵的重新训练的随机平滑方法显示出显着的改进。此外，我们扩展了视频的方法，并为视频分类器提供有意义的证书。可以在https://nyu-dice-lab.github.io/smoothreduce/上找到一个项目页面
Randomized smoothing (RS) has been shown to be a fast, scalable technique for certifying the robustness of deep neural network classifiers. However, methods based on RS require augmenting data with large amounts of noise, which leads to significant drops in accuracy. We propose a training-free, modified smoothing approach, Smooth-Reduce, that leverages patching and aggregation to provide improved classifier certificates. Our algorithm classifies overlapping patches extracted from an input image, and aggregates the predicted logits to certify a larger radius around the input. We study two aggregation schemes -- max and mean -- and show that both approaches provide better certificates in terms of certified accuracy, average certified radii and abstention rates as compared to concurrent approaches. We also provide theoretical guarantees for such certificates, and empirically show significant improvements over other randomized smoothing methods that require expensive retraining. Further, we extend our approach to videos and provide meaningful certificates for video classifiers. A project page can be found at https://nyu-dice-lab.github.io/SmoothReduce/
