Formal verification techniques that compute provable guarantees on properties of machine learning models, like robustness to norm-bounded adversarial perturbations, have yielded impressive results. Although most techniques developed so far require knowledge of the architecture of the machine learning model and remains hard to scale to complex prediction pipelines, the method of randomized smoothing has been shown to overcome many of these obstacles. By requiring only black-box access to the underlying model, randomized smoothing scales to large architectures and is agnostic to the internals of the network. However, past work on randomized smoothing has focused on restricted classes of smoothing measures or perturbations (like Gaussian or discrete) and has only been able to prove robustness with respect to simple norm bounds. In this paper we introduce a general framework for proving robustness properties of smoothed machine learning models in the black-box setting. Specifically, we extend randomized smoothing procedures to handle arbitrary smoothing measures and prove robustness of the smoothed classifier by using f -divergences. Our methodology improves upon the state of the art in terms of computation time or certified robustness on several image classification tasks and an audio classification task, with respect to several classes of adversarial perturbations.
The paper introduces a generalization of the randomized smoothing approach for certifying robustness of black-box classifiers, allowing the smoothing measure to be an arbitrary distribution (whereas previous work almost exclusively focused on Gaussian noise), and facilitating the certification with respect to different metrics under the same framework.
Given the wide interest in certified robustness based on randomized smoothing, the generalizations considered in this paper could have a high potential. I found the motivation, the definition of the framework and the statement of the main theoretical results, up to Section 3.2, very clear. The following sections were not as well organized, in my opinion, and need improvement. In particular, I found it not very clear how the framework can applied to recover previous results, in particular the results from Cohen et al. (2019). All the ingredients seem to be there, among Theorem 3, the result from Balle & Wang (2018), and Corollary 5, but the arguments could be presented in a better organized way.
What I also found is missing is a clear descriptions of practical algorithms for applying the framework. Again, most of the ingredients seem to be there (e.g. Table 1 in the main body, Lemma 6 as well as the discussion about sampling mechanism in the Appendix), but they are not well organized. Presumably, the same statistical methodology as in Cohen et al. is used to obtain estimates of theta_a and theta_b, but this doesn't seem to be clearly stated anywhere. How is certification practically performed for intersections of contraint sets as introduced at the end of section 2? How the full-information certification can be applied based on empirical estimates is unclear to me, too.
Finally, the description of the experiments need improvements: For instance, in Section 5.1, which smoothing measure was used? Was the ResNet classifier trained using samples from this measure? Which sets of f-divergences were used? What does Figure 3 (a) exactly show? Do the blue points correspond to the 50 data samples? The number of random samples for computing empirical estimates and the confidence bounds are missing.
In Figure 4 (a), as the l_0 norm counts the number of altered pixels I don't understand why the certified accuracy varies e.g. for epsilon *between* 0 and 1.
The experiment on the Librispeech model seems interesting, but the paper does not contain sufficient information to understand and assess the experimental set-up or the results.
In summary, while I believe that the generalizations proposed in this paper have potential, in its present form the manuscript doesn't describe clearly and accurately enough how the framework can be applied to recover previous theoretical results or perform certification in practice.
----------
I acknowledge I have read the authors' response. As it addresses my main concerns I have changed my rating from "weak reject" to "weak accept".