论文标题
在攻击下随机平滑：在Pratice中它的表现如何？
Randomized Smoothing under Attack: How Good is it in Pratice?
论文作者
论文摘要
随机平滑是一种最近闻名的解决方案，可以证明任何分类器的鲁棒性。尽管它确实提供了针对对抗性攻击的理论鲁棒性，但当前分类器的维度必然会在实践中采用蒙特卡洛的方法。本文质疑随机平滑作为防御的有效性，以抵御最先进的黑盒攻击状态。这是一种新颖的观点，因为先前的研究工作将认证视为毫无疑问的保证。我们首先正式强调了理论认证与对分类器的攻击实践之间的不匹配。然后，我们对随机平滑的攻击作为防御。我们的主要观察结果是，在RS的设置中，有一个重大的不匹配，以获得高认证的鲁棒性或在保留分类器准确性的同时击败黑匣子攻击时。
Randomized smoothing is a recent and celebrated solution to certify the robustness of any classifier. While it indeed provides a theoretical robustness against adversarial attacks, the dimensionality of current classifiers necessarily imposes Monte Carlo approaches for its application in practice. This paper questions the effectiveness of randomized smoothing as a defense, against state of the art black-box attacks. This is a novel perspective, as previous research works considered the certification as an unquestionable guarantee. We first formally highlight the mismatch between a theoretical certification and the practice of attacks on classifiers. We then perform attacks on randomized smoothing as a defense. Our main observation is that there is a major mismatch in the settings of the RS for obtaining high certified robustness or when defeating black box attacks while preserving the classifier accuracy.
