ePrints@IIScePrints@IISc Home | About | Browse | Latest Additions | Advanced Search | Contact | Help

Certified Adversarial Robustness Within Multiple Perturbation Bounds

Nandi, S and Addepalli, S and Rangwani, H and Babu, RV (2023) Certified Adversarial Robustness Within Multiple Perturbation Bounds. In: 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, CVPRW 2023, 18 - 22 June 2023, Vancouver, BC, Canada, pp. 2298-2305.

IEEE-CVF_CVPRW2023_2023_2298-2305_2023.pdf - Published Version

Download (1MB) | Preview
Official URL: https://doi.org/10.1109/CVPRW59228.2023.00225


Randomized smoothing (RS) is a well known certified defense against adversarial attacks, which creates a smoothed classifier by predicting the most likely class under random noise perturbations of inputs during inference. While initial work focused on robustness to ℓ2 norm perturbations using noise sampled from a Gaussian distribution, subsequent works have shown that different noise distributions can result in robustness to other ℓp norm bounds as well. In general, a specific noise distribution is optimal for defending against a given ℓp norm based attack. In this work, we aim to improve the certified adversarial robustness against multiple perturbation bounds simultaneously. Towards this, we firstly present a novel certification scheme, that effectively combines the certificates obtained using different noise distributions to obtain optimal results against multiple perturbation bounds. We further propose a novel training noise distribution along with a regularized training scheme to improve the certification within both ℓ1 and ℓ2 perturbation norms simultaneously. Contrary to prior works, we compare the certified robustness of different training algorithms across the same natural (clean) accuracy, rather than across fixed noise levels used for training and certification. We also empirically invalidate the argument that training and certifying the classifier with the same amount of noise gives the best results. The proposed approach achieves improvements on the ACR (Average Certified Radius) metric across both ℓ1 and ℓ2 perturbation bounds. Code available at https://github.com/valiisc/NU-Certified-Robustness © 2023 IEEE.

Item Type: Conference Paper
Publication: IEEE Computer Society Conference on Computer Vision and Pattern Recognition Workshops
Publisher: IEEE Computer Society
Additional Information: The copyright for this article belongs to the Authors.
Keywords: Most likely; Multiple perturbations; Noise distribution; Noise levels; Noise perturbation; Optimal results; Perturbation bounds; Random noise; Training algorithms; Training schemes
Department/Centre: Division of Interdisciplinary Sciences > Computational and Data Sciences
Date Deposited: 24 Nov 2023 10:29
Last Modified: 24 Nov 2023 10:29
URI: https://eprints.iisc.ac.in/id/eprint/83215

Actions (login required)

View Item View Item