Abstract:As machine learning (ML) systems become pervasive, safeguarding their security is critical. However, recently it has been demonstrated that motivated adversaries are able to mislead ML systems by perturbing test data using semantic transformations. While there exists a rich body of research providing provable robustness guarantees for ML models against Lp bounded adversarial perturbations, guarantees against semantic perturbations remain largely underexplored. In this paper, we provide TSS-a unified framework for certifying ML robustness against general adversarial semantic transformations. First, depending on the properties of each transformation, we divide common transformations into two categories, namely resolvable (e.g., Gaussian blur) and differentially resolvable (e.g., rotation) transformations. For the former, we propose transformation-specific randomized smoothing strategies and obtain strong robustness certification. The latter category covers transformations that involve interpolation errors, and we propose a novel approach based on stratified sampling to certify the robustness. Our framework TSS leverages these certification strategies and combines with consistency-enhanced training to provide rigorous certification of robustness. We conduct extensive experiments on over ten types of challenging semantic transformations and show that TSS significantly outperforms the state of the art. Moreover, to the best of our knowledge, TSS is the first approach that achieves nontrivial certified robustness on the large-scale ImageNet dataset. For instance, our framework achieves 30.4% certified robust accuracy against rotation attack (within ±30°) on ImageNet. Moreover, to consider a broader range of transformations, we show TSS is also robust against adaptive attacks and unforeseen image corruptions such as CIFAR-10-C and ImageNet-C.

Robustness Certification for Structured Prediction with General Inputs Via Safe Region Modeling in the Semimetric Output Space.

Center Smoothing: Certified Robustness for Networks with Structured Outputs

Probabilistic Safety Regions Via Finite Families of Scalable Classifiers

Towards Certified Probabilistic Robustness with High Accuracy

It's Simplex! Disaggregating Measures to Improve Certified Robustness

Robust safe semi-supervised learning framework for high-dimensional data classification

TSS - Transformation-Specific Smoothing for Robustness Certification.

Certifying Semantic Robustness of Deep Neural Networks

Regularized Training and Tight Certification for Randomized Smoothed Classifier with Provable Robustness

Certified Adversarial Robustness Under the Bounded Support Set.

Efficient Global Robustness Certification of Neural Networks via Interleaving Twin-Network Encoding

CC-CERT: A Probabilistic Approach to Certify General Robustness of Neural Networks

Certified Robustness against Sparse Adversarial Perturbations via Data Localization

How robust accuracy suffers from certified training with convex relaxations

One Ring to Rule Them All: Certifiably Robust Geometric Perception with Outliers

PointCert: Point Cloud Classification with Deterministic Certified Robustness Guarantees

A Recipe for Improved Certifiable Robustness

Certified Adversarial Robustness Within Multiple Perturbation Bounds

Provably Robust Conformal Prediction with Improved Efficiency

STR-Cert: Robustness Certification for Deep Text Recognition on Deep Learning Pipelines and Vision Transformers

Provably Robust Cost-Sensitive Learning via Randomized Smoothing