论文标题
随机平滑可能无法证明$ \ ell_ \ infty $ robustness for高维图像
Random Smoothing Might be Unable to Certify $\ell_\infty$ Robustness for High-Dimensional Images
论文作者
论文摘要
对于随机平滑，我们显示出硬度的结果，以实现对$ \ ell_p $ radius $ε$ $ p> 2 $的攻击的经过认证的对抗性鲁棒性。尽管使用高斯分布的$ \ ell_2 $案例对随机平滑性的理解已经充分理解，但对于存在适用于$ p> 2 $的噪声分布的存在，尚不清楚。 Cohen等人已经将其作为一个公开问题。 （2019年），包括许多重要的范式，例如$ \ ell_ \ infty $威胁模型。在这项工作中，我们证明了$ \ m athbb {r}^d $上的任何噪声分布$ \ nathcal {d} $，可为所有基本分类器提供$ p> 2 $必须满足的所有基本分类器提供$ \ ell_p $ rostness，必须满足$ \ mathbb {e} e}η_i^η_i^2 =Ω （像素）向量$η\ sim \ Mathcal {d} $的（$ε$是强大的半径，$δ$是得分最高的类和亚军之间的得分差距。因此，对于以$ [0,255] $界定的具有像素值的高维图像，所需的噪声最终将主导图像中的有用信息，从而导致琐碎的平滑分类器。
We show a hardness result for random smoothing to achieve certified adversarial robustness against attacks in the $\ell_p$ ball of radius $ε$ when $p>2$. Although random smoothing has been well understood for the $\ell_2$ case using the Gaussian distribution, much remains unknown concerning the existence of a noise distribution that works for the case of $p>2$. This has been posed as an open problem by Cohen et al. (2019) and includes many significant paradigms such as the $\ell_\infty$ threat model. In this work, we show that any noise distribution $\mathcal{D}$ over $\mathbb{R}^d$ that provides $\ell_p$ robustness for all base classifiers with $p>2$ must satisfy $\mathbb{E}η_i^2=Ω(d^{1-2/p}ε^2(1-δ)/δ^2)$ for 99% of the features (pixels) of vector $η\sim\mathcal{D}$, where $ε$ is the robust radius and $δ$ is the score gap between the highest-scored class and the runner-up. Therefore, for high-dimensional images with pixel values bounded in $[0,255]$, the required noise will eventually dominate the useful information in the images, leading to trivial smoothed classifiers.
