Smooth-Reduce: Leveraging Patches for Improved Certified Robustness
Not on the map. Why?
Abstract (arXiv)
Randomized smoothing (RS) has been shown to be a fast, scalable technique for certifying the robustness of deep neural network classifiers. However, methods based on RS require augmenting data with large amounts of noise, which leads to significant drops in accuracy. We propose a training-free, modified smoothing approach, Smooth-Reduce, that leverages patching and aggregation to provide improved classifier certificates. Our algorithm classifies overlapping patches extracted from an input image, and aggregates the predicted logits to certify a larger radius around the input. We study two aggregation schemes -- max and mean -- and show that both approaches provide better certificates in terms of certified accuracy, average certified radii and abstention rates as compared to concurrent approaches. We also provide theoretical guarantees for such certificates, and empirically show significant improvements over other randomized smoothing methods that require expensive retraining. Further, we extend our approach to videos and provide meaningful certificates for video classifiers. A project page can be found at https://nyu-dice-lab.github.io/SmoothReduce/
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 31 of its 40 references that are in the map. First posted on arXiv 12 May 2022.
Builds on
31 of 40 references.
References · 31
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
19 more
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
- 2018Certified Defenses against Adversarial Examplescited by 305
- 2016Safety Verification of Deep Neural Networkscited by 262
- 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
- 2022Patches Are All You Need?cited by 201
- 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 178
- 2020Randomized Smoothing of All Shapes and Sizescited by 146
- 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
- 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
- 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
- 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
- 2021Improved, Deterministic Smoothing for L_1 Certified Robustnesscited by 39
- 2020Data-Dependent Randomized Smoothingcited by 37
- 2017Towards Proving the Adversarial Robustness of Deep Neural Networkscited by 26
- 2021Intriguing Properties of Input-dependent Randomized Smoothingcited by 24
- 2017Provably Minimally-Distorted Adversarial Examplescited by 12
- 2018Defense Against the Dark Arts: An overview of adversarial example security research and future research directionscited by 11
- 2020Enhancing Certified Robustness via Smoothed Weighted Ensemblingcited by 7
- 2021Improving Adversarial Robustness for Free with Snapshot Ensemblecited by 1
Built on by
Citing papers per year: 2023: 1.
1 paper.