论文标题
随机平滑的扩展和局限性以保证鲁棒性
Extensions and limitations of randomized smoothing for robustness guarantees
论文作者
论文摘要
随机平滑是一种证明分类器对输入的决定的方法，在对抗噪声下是不变的，比其他认证方法具有有吸引力的优势。它在黑框中运行，因此认证不受分类器体系结构的大小来限制。在这里，我们扩展了Li等人的工作。 \ cite {li2018秒}，研究平滑度量之间的分歧选择如何影响最终的鲁棒性保证，以及平滑度量的选择本身如何导致不同的威胁模型的保证。为此，我们开发了一种证明与任何$ \ ell_p $（$ p \ in \ at \ mathbb {n} _ {> 0} $）的鲁棒性的方法。然后，我们证明了一个负面的结果，即随机平滑遭受了维数的诅咒。随着$ p $的增加，围绕输入的有效半径可以证明证明消失。
Randomized smoothing, a method to certify a classifier's decision on an input is invariant under adversarial noise, offers attractive advantages over other certification methods. It operates in a black-box and so certification is not constrained by the size of the classifier's architecture. Here, we extend the work of Li et al. \cite{li2018second}, studying how the choice of divergence between smoothing measures affects the final robustness guarantee, and how the choice of smoothing measure itself can lead to guarantees in differing threat models. To this end, we develop a method to certify robustness against any $\ell_p$ ($p\in\mathbb{N}_{>0}$) minimized adversarial perturbation. We then demonstrate a negative result, that randomized smoothing suffers from the curse of dimensionality; as $p$ increases, the effective radius around an input one can certify vanishes.
