论文标题
带有随机平滑的黑盒认证：基于功能优化的框架
Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Framework
论文作者
论文摘要
已证明随机分类器为在深度学习中针对对抗性攻击实现认证的鲁棒性提供了有希望的方法。但是，大多数现有方法仅利用高斯平滑噪声，仅适用于$ \ ell_2 $扰动。从统一的功能优化的角度来看，我们提出了一个具有非高斯噪声的对抗认证的一般框架，并提出了更多一般类型的攻击。我们的新框架使我们能够通过设计平滑分布来确定准确性和鲁棒性之间的关键权衡取舍，从而帮助设计非高斯平滑分布的新家庭，这些分布更有效地适用于不同的$ \ ell_p $设置，包括$ \ ell_1 $，$ \ ell_2 $和$ \ ell_ ell_ ell_ ell_ \ ell_ \ ell_ \ ell_ \ iffty $攻击。我们提出的方法比以前的工作获得更好的认证结果，并提供了关于随机平滑认证的新观点。
Randomized classifiers have been shown to provide a promising approach for achieving certified robustness against adversarial attacks in deep learning. However, most existing methods only leverage Gaussian smoothing noise and only work for $\ell_2$ perturbation. We propose a general framework of adversarial certification with non-Gaussian noise and for more general types of attacks, from a unified functional optimization perspective. Our new framework allows us to identify a key trade-off between accuracy and robustness via designing smoothing distributions, helping to design new families of non-Gaussian smoothing distributions that work more efficiently for different $\ell_p$ settings, including $\ell_1$, $\ell_2$ and $\ell_\infty$ attacks. Our proposed methods achieve better certification results than previous works and provide a new perspective on randomized smoothing certification.
