论文标题
旨在评估随机平滑机制，以证明对抗性鲁棒性
Towards Assessment of Randomized Smoothing Mechanisms for Certifying Adversarial Robustness
论文作者
论文摘要
作为一种认证的防御技术，由于其对大型数据集和神经网络的可扩展性，随机平滑受到了很大的关注。但是，几个重要的问题仍然没有解决，例如（i）高斯机制是否是证明$ \ ell_2 $ -norm鲁棒性的合适选择，以及（ii）是否有适当的随机（平滑）机制来证明$ \ ell_ \ ell_ \ ell_ \ elfty $ infty $ - norm-norm-norm稳健性。为了阐明这些问题，我们认为主要困难是如何评估每个随机机制的适当性。在本文中，我们提出了一个通用框架，该框架在\ cite {lecuyer2018certifiend，li2019certifiend}中连接现有框架，以评估随机机制。在我们的框架下，对于可以在一定程度上证明鲁棒性的随机机制，我们将其所需的添加噪声的大小定义为评估其适当性的指标。对于$ \ ell_2 $ -norm和$ \ ell_ \ infty $ -Norm案例，我们还证明了该指标的下限，作为评估标准。基于我们的框架，我们通过比较这些机制和下限（标准）所需的添加噪声的大小来评估高斯和指数机制。我们首先得出的结论是，高斯机制确实是证明$ \ ell_2 $ - norm稳健性的合适选择。令人惊讶的是，我们证明高斯机制也是证明$ \ ell_ \ infty $ norm稳健性的合适选择，而不是指数机制。最后，我们将框架推广到任何$ p \ geq2 $的$ \ ell_p $ -norm。通过对CIFAR10和Imagenet的评估，我们的理论发现得到了验证。
As a certified defensive technique, randomized smoothing has received considerable attention due to its scalability to large datasets and neural networks. However, several important questions remain unanswered, such as (i) whether the Gaussian mechanism is an appropriate option for certifying $\ell_2$-norm robustness, and (ii) whether there is an appropriate randomized (smoothing) mechanism to certify $\ell_\infty$-norm robustness. To shed light on these questions, we argue that the main difficulty is how to assess the appropriateness of each randomized mechanism. In this paper, we propose a generic framework that connects the existing frameworks in \cite{lecuyer2018certified, li2019certified}, to assess randomized mechanisms. Under our framework, for a randomized mechanism that can certify a certain extent of robustness, we define the magnitude of its required additive noise as the metric for assessing its appropriateness. We also prove lower bounds on this metric for the $\ell_2$-norm and $\ell_\infty$-norm cases as the criteria for assessment. Based on our framework, we assess the Gaussian and Exponential mechanisms by comparing the magnitude of additive noise required by these mechanisms and the lower bounds (criteria). We first conclude that the Gaussian mechanism is indeed an appropriate option to certify $\ell_2$-norm robustness. Surprisingly, we show that the Gaussian mechanism is also an appropriate option for certifying $\ell_\infty$-norm robustness, instead of the Exponential mechanism. Finally, we generalize our framework to $\ell_p$-norm for any $p\geq2$. Our theoretical findings are verified by evaluations on CIFAR10 and ImageNet.
