Abstract:Deep neural networks have proven to be extremely powerful, however, they are also vulnerable to adversarial attacks which can cause hazardous incorrect predictions in safety-critical applications. Certified robustness via randomized smoothing gives a probabilistic guarantee that the smoothed classifier's predictions will not change within an $\ell_2$-ball around a given input. On the other hand (uncertainty) score-based rejection is a technique often applied in practice to defend models against adversarial attacks. In this work, we fuse these two approaches by integrating a classifier that abstains from predicting when uncertainty is high into the certified robustness framework. This allows us to derive two novel robustness guarantees for uncertainty aware classifiers, namely (i) the radius of an $\ell_2$-ball around the input in which the same label is predicted and uncertainty remains low and (ii) the $\ell_2$-radius of a ball in which the predictions will either not change or be uncertain. While the former provides robustness guarantees with respect to attacks aiming at increased uncertainty, the latter informs about the amount of input perturbation necessary to lead the uncertainty aware model into a wrong prediction. Notably, this is on CIFAR10 up to 20.93% larger than for models not allowing for uncertainty based rejection. We demonstrate, that the novel framework allows for a systematic robustness evaluation of different network architectures and uncertainty measures and to identify desired properties of uncertainty quantification techniques. Moreover, we show that leveraging uncertainty in a smoothed classifier helps out-of-distribution detection.

Robustness Verification of $\Boldsymbol~k$-Nn Classifiers Via Constraint Relaxation and Randomized Smoothing

Evaluating the Robustness of Nearest Neighbor Classifiers: A Primal-Dual Perspective.

Robustness Verification of Classification Deep Neural Networks Via Linear Programming.

Robustness verification of k-nearest neighbors by abstract interpretation

Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers

Certified Adversarial Robustness Under the Bounded Support Set.

Regularized Training and Tight Certification for Randomized Smoothed Classifier with Provable Robustness

Robust Regularized Kernel Regression.

Tight Verification of Probabilistic Robustness in Bayesian Neural Networks

RS-Reg: Probabilistic and Robust Certified Regression Through Randomized Smoothing

Adversarial Robustness Certification for Bayesian Neural Networks

Certifying Robustness of Convolutional Neural Networks with Tight Linear Approximation

Integrating uncertainty quantification into randomized smoothing based robustness guarantees

Center Smoothing: Certified Robustness for Networks with Structured Outputs

Automated Design of Linear Bounding Functions for Sigmoidal Nonlinearities in Neural Networks

Measuring Robustness of Deep Neural Networks from the Lens of Statistical Model Checking.

Towards Assessment of Randomized Smoothing Mechanisms for Certifying Adversarial Robustness

Projected Randomized Smoothing for Certified Adversarial Robustness

Robustness Verification of Support Vector Machines

Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustness

Improving the Tightness of Convex Relaxation Bounds for Training Certifiably Robust Classifiers