Provable Robustness Beyond Bound Propagation
summary
Proposes that randomized smoothing — classifying by majority vote over Gaussian-noised inputs — yields a provable certified L2 radius (r = sigma Phi^{-1}(p)) for the smoothed classifier, with p estimated by Monte Carlo estimation*. Shows this outperforms ReLU dual/LP relaxations on CIFAR and crucially scales to ImageNet, certifying 37% top‑1 accuracy at L2 ≤ 1. Caveats: the guarantee applies to the smoothed classifier only, uses Monte Carlo confidence, and addresses L2 perturbations, not arbitrary norms.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:40Adversarial attacks on deep learning
- 3:49Why should we care?
- 7:13Adversarial robustness
- 13:52How to we strictly upper bound the maximization?
- 22:55This talk
- 23:49What causes adversarial examples?
- 24:51Randomization as a defense?
- 28:08Visual intuition of randomized smoothing
- 30:15The randomized smoothing guarantee
- 37:09Proof of certified robustness (cont)
- 41:34Caveats (a.k.a. the fine print)
- 43:31Comparison to previous SOTA on CIFAR10
- 44:23Performance on ImageNet
related talks
59mStudying Failure Modes of Deep Learning and Ways To Fix Them
01h 01mRobustness, Stochastics, Uncertainty 2
34mDistributional Robustness, Learning, and Empirical Likelihood
01h 24mAdversarial Examples
37mEfficient Algorithms for Reliable Machine Learning
09mConvex Programs, Computational Phase Transitions, and Robust Algorithms
01h 04mAlgorithmic High Dimensional Robust Statistics II
01h 01mRobustness, Stochastics, Uncertainty 1