Adaptive Randomized Smoothing: Certifying Multi-Step Defences against Adversarial Examples
<|reference_start|>Adaptive Randomized Smoothing: Certifying Multi-Step Defences against Adversarial Examples: We propose Adaptive Randomized Smoothing (ARS) to certify the predictions of our test-time adaptive models against adversarial examples. ARS extends the analysis of randomized smoothing using f-Differential Privacy to certify the adaptive composition of multiple steps. For the first time, our theory covers the sound adaptive composition of general and high-dimensional functions of noisy input. We instantiate ARS on deep image classification to certify predictions against adversarial examples of bounded $L_{\infty}$ norm. In the $L_{\infty}$ threat model, our flexibility enables adaptation through high-dimensional input-dependent masking. We design adaptivity benchmarks, based on CIFAR-10 and CelebA, and show that ARS improves accuracy by $2$ to $5\%$ points. On ImageNet, ARS improves accuracy by $1$ to $3\%$ points over standard RS without adaptivity.<|reference_end|>
@article{lyu2024adaptive,
    title={Adaptive Randomized Smoothing: Certified Adversarial Robustness for
  Multi-Step Defences},
    author={Saiyue Lyu, Shadab Shaikh, Frederick Shpilevskiy, Evan Shelhamer,
  Mathias L'ecuyer},
    journal={arXiv preprint arXiv:2406.10427},
    year={2024},
    archivePrefix={arXiv},
    eprint={2406.10427},
    primaryClass={cs.LG cs.CR}
}