Random Smoothing Might be Unable to Certify _ Robustness for High-Dimensional Images

Code

• github.com/hongyanz/TRADES-smoothing
  OfficialIn paperpytorch★ 14

Abstract

We show a hardness result for random smoothing to achieve certified adversarial robustness against attacks in the _p ball of radius when p>2. Although random smoothing has been well understood for the _2 case using the Gaussian distribution, much remains unknown concerning the existence of a noise distribution that works for the case of p>2. This has been posed as an open problem by Cohen et al. (2019) and includes many significant paradigms such as the _ threat model. In this work, we show that any noise distribution D over R^d that provides _p robustness for all base classifiers with p>2 must satisfy E_i^2=(d^1-2/p^2(1-)/^2) for 99% of the features (pixels) of vector D, where is the robust radius and is the score gap between the highest-scored class and the runner-up. Therefore, for high-dimensional images with pixel values bounded in [0,255], the required noise will eventually dominate the useful information in the images, leading to trivial smoothed classifiers.

Tasks

Reproductions