We present a novel statistical certification method that generalizes prior work based on smoothing to handle richer perturbations. Concretely, our method produces a provable classifier which can establish statistical robustness against geometric perturbations (e.g., rotations, translations) as well as volume changes and pitch shifts on audio data. The generalization is non-trivial and requires careful handling of operations such as interpolation. Our method is agnostic to the choice of classifier and scales to modern architectures such as ResNet-50 on ImageNet.
Summary:
This paper introduces a new smoothing algorithm which produces classifiers with certified robustness against adversarial perturbations. In particular, the authors are interested in settings where the input vectors need not be robust simply to \ell_2 perturbations, for which previous authors (e.g., Cohen et al.) have already introduced a "randomized smoothing" classifier which possesses the desired properties. Instead, motivated by the desire to certify robustness to other families of transformations, the authors propose to introduce a smoothing transform that operates in an additive way on the underlying parameter space (rather than on the raw input vectors, as in the case of \ell_2 randomized smoothing). The authors provide details for a few examples from image and audio data processing, and then show experimental results on ImageNet data.
Comments:
My assessment of this paper is that the level of novelty is relatively low. On the technical side, I do not believe this paper makes any significant contributions. The authors themselves note that the proof of the main result, Theorem 3.2, closely parallels the proof of Cohen et al. Algorithmically, the proposals of the authors are also minor tweaks of the algorithms in Cohen et al., since the types of perturbations considered in this paper are essentially single-parameter problems. (As a question: The authors prove Theorem 3.2 where the randomized smoothing operation adds possible nonisotropic Gaussian noise in the parameter space. However, it seems that in the examples, the noise added is isotropic -- it is not clear how the authors are choosing \sigma_i in relation to \sigma_r for the interpolation example. Can the authors clarify this, and give examples where smoothing with nonisotropic noise would actually be useful?)
The only real tweak that the authors introduce when presenting their smoothing algorithm is to introduce a small correction term in order to deal with interpolation/rounding errors. However, I do not think that this change is particularly novel.
As a final comment, I think it would have been interesting for the authors to include some simulations with audio data as well, since this constitutes one of the main motivating applications discussed by the authors.