Poster
Certified Adversarial Robustness via Randomized Smoothing
Jeremy Cohen · Elan Rosenfeld · Zico Kolter

Wed Jun 12th 06:30 -- 09:00 PM @ Pacific Ballroom #64
in Posters Wed »

We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the L2 norm. While this "randomized smoothing" technique has been proposed before in the literature, we are the first to provide a tight analysis, which establishes a close connection between L2 robustness and Gaussian noise. We use the technique to train an ImageNet classifier with e.g. a certified top-1 accuracy of 49% under adversarial perturbations with L2 norm less than 0.5 (=127/255). Smoothing is the only approach to certifiably robust classification which has been shown feasible on full-resolution ImageNet. On smaller-scale datasets where competing approaches to certified L2 robustness are viable, smoothing delivers higher certified accuracies. The empirical success of the approach suggests that provable methods based on randomization at prediction time are a promising direction for future research into adversarially robust classification.

Keywords: Adversarial Examples

Author Information

Jeremy Cohen (Carnegie Mellon University)
Elan Rosenfeld (Carnegie Mellon University)
Zico Kolter (Carnegie Mellon University / Bosch Center for AI)

Related Events (a corresponding poster, oral, or spotlight)

More from the Same Authors