Certified Defense to Image Transformations via Randomized Smoothing

Authors: Marc Fischer, Maximilian Baader, Martin Vechev
Published: 2020-02-27 | Updated: 2021-08-25

Source: https://arxiv.org/abs/2002.12463

PDF: https://arxiv.org/pdf/2002.12463

AIにより推定されたラベル

ロバスト性評価 防御手法 計算の整合性

※ こちらのラベルはAIによって自動的に追加されました。そのため、正確でないことがあります。
詳細は文献データベースについてをご覧ください。

Abstract

We extend randomized smoothing to cover parameterized transformations (e.g., rotations, translations) and certify robustness in the parameter space (e.g., rotation angle). This is particularly challenging as interpolation and rounding effects mean that image transformations do not compose, in turn preventing direct certification of the perturbed image (unlike certification with ℓ^p norms). We address this challenge by introducing three different kinds of defenses, each with a different guarantee (heuristic, distributional and individual) stemming from the method used to bound the interpolation error. Importantly, we show how individual certificates can be obtained via either statistical error bounds or efficient online inverse computation of the image transformation. We provide an implementation of all methods at https://github.com/eth-sri/transformation-smoothing.