论文标题
通过各向异性随机平滑进行认证的对抗鲁棒性
Certified Adversarial Robustness via Anisotropic Randomized Smoothing
论文作者
论文摘要
随机平滑为对抗性扰动的认证鲁棒性取得了巨大的成功。考虑到任何任意分类器，随机平滑可以保证分类器对被扰动输入的预测，并通过将噪声注入分类器中可证明的鲁棒性。但是，所有现有方法都依赖于固定的I.I.D.为数据的所有维度（例如，图像中的所有像素）生成噪声的概率分布，该差异忽略了输入和数据维度的异质性。因此，现有的随机平滑方法无法为所有输入提供最佳保护。为了解决这一限制，我们提出了一种新型各向异性随机平滑方法，该方法可确保基于像素噪声分布的可证明的鲁棒性保证。此外，我们设计了一个新型的基于CNN的噪声发生器，以有效地对每个输入中所有像素的像素噪声分布进行有效调整。实验结果表明，我们的方法显着优于最先进的随机平滑方法。
Randomized smoothing has achieved great success for certified robustness against adversarial perturbations. Given any arbitrary classifier, randomized smoothing can guarantee the classifier's prediction over the perturbed input with provable robustness bound by injecting noise into the classifier. However, all of the existing methods rely on fixed i.i.d. probability distribution to generate noise for all dimensions of the data (e.g., all the pixels in an image), which ignores the heterogeneity of inputs and data dimensions. Thus, existing randomized smoothing methods cannot provide optimal protection for all the inputs. To address this limitation, we propose a novel anisotropic randomized smoothing method which ensures provable robustness guarantee based on pixel-wise noise distributions. Also, we design a novel CNN-based noise generator to efficiently fine-tune the pixel-wise noise distributions for all the pixels in each input. Experimental results demonstrate that our method significantly outperforms the state-of-the-art randomized smoothing methods.
