Abstract:As a certified defensive technique, randomized smoothing has received considerable attention due to its scalability to large datasets and neural networks. However, several important questions remain unanswered, such as (i) whether the Gaussian mechanism is an appropriate option for certifying $\ell_2$-norm robustness, and (ii) whether there is an appropriate randomized (smoothing) mechanism to certify $\ell_\infty$-norm robustness. To shed light on these questions, we argue that the main difficulty is how to assess the appropriateness of each randomized mechanism. In this paper, we propose a generic framework that connects the existing frameworks in \cite{lecuyer2018certified, li2019certified}, to assess randomized mechanisms. Under our framework, for a randomized mechanism that can certify a certain extent of robustness, we define the magnitude of its required additive noise as the metric for assessing its appropriateness. We also prove lower bounds on this metric for the $\ell_2$-norm and $\ell_\infty$-norm cases as the criteria for assessment. Based on our framework, we assess the Gaussian and Exponential mechanisms by comparing the magnitude of additive noise required by these mechanisms and the lower bounds (criteria). We first conclude that the Gaussian mechanism is indeed an appropriate option to certify $\ell_2$-norm robustness. Surprisingly, we show that the Gaussian mechanism is also an appropriate option for certifying $\ell_\infty$-norm robustness, instead of the Exponential mechanism. Finally, we generalize our framework to $\ell_p$-norm for any $p\geq2$. Our theoretical findings are verified by evaluations on CIFAR10 and ImageNet.

Enhancing Certified Robustness via Smoothed Weighted Ensembling

Enhancing Certified Robustness of Smoothed Classifiers via Weighted Model Ensembling

Promoting Robustness of Randomized Smoothing: Two Cost-Effective Approaches

On Multi-head Ensemble of Smoothed Classifiers for Certified Robustness

Regularized Training and Tight Certification for Randomized Smoothed Classifier with Provable Robustness

On the Certified Robustness for Ensemble Models and Beyond

Boosting Certified Robustness for Time Series Classification with Efficient Self-Ensemble

Projected Randomized Smoothing for Certified Adversarial Robustness

Certified Distributional Robustness on Smoothed Classifiers

GSmooth: Certified Robustness against Semantic Transformations via Generalized Randomized Smoothing

Certified PEFTSmoothing: Parameter-Efficient Fine-Tuning with Randomized Smoothing

(De-)Randomized Smoothing for Decision Stump Ensembles

Certified Adversarial Robustness Within Multiple Perturbation Bounds

Randomized Smoothing Under Attack: How Good is it in Practice?

Towards Bridging the gap between Empirical and Certified Robustness against Adversarial Examples

Towards Assessment of Randomized Smoothing Mechanisms for Certifying Adversarial Robustness

Certified Adversarial Robustness Under the Bounded Support Set.

RS-Reg: Probabilistic and Robust Certified Regression Through Randomized Smoothing

DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothing

On Certifying Robustness against Backdoor Attacks via Randomized Smoothing

Provably Robust Cost-Sensitive Learning via Randomized Smoothing