Adaptive Randomized Smoothing: Certifying Multi-Step Defences against Adversarial Examples
arXiv preprint arXiv:2406.10427, 2024•arxiv.org
We propose Adaptive Randomized Smoothing (ARS) to certify the predictions of our test-
time adaptive models against adversarial examples. ARS extends the analysis of
randomized smoothing using f-Differential Privacy to certify the adaptive composition of
multiple steps. For the first time, our theory covers the sound adaptive composition of
general and high-dimensional functions of noisy input. We instantiate ARS on deep image
classification to certify predictions against adversarial examples of bounded $ L_ {\infty} …
time adaptive models against adversarial examples. ARS extends the analysis of
randomized smoothing using f-Differential Privacy to certify the adaptive composition of
multiple steps. For the first time, our theory covers the sound adaptive composition of
general and high-dimensional functions of noisy input. We instantiate ARS on deep image
classification to certify predictions against adversarial examples of bounded $ L_ {\infty} …
We propose Adaptive Randomized Smoothing (ARS) to certify the predictions of our test-time adaptive models against adversarial examples. ARS extends the analysis of randomized smoothing using f-Differential Privacy to certify the adaptive composition of multiple steps. For the first time, our theory covers the sound adaptive composition of general and high-dimensional functions of noisy input. We instantiate ARS on deep image classification to certify predictions against adversarial examples of bounded norm. In the threat model, our flexibility enables adaptation through high-dimensional input-dependent masking. We design adaptivity benchmarks, based on CIFAR-10 and CelebA, and show that ARS improves accuracy by to points. On ImageNet, ARS improves accuracy by to points over standard RS without adaptivity.
arxiv.org