Enhanced Estimation Techniques for Certified Radii in Randomized Smoothing

TL;DR

The paper tackles the challenge of certifying neural network robustness under adversarial perturbations by advancing radius estimation in randomized smoothing. It develops discrete and continuous estimation methods that tighten lower bounds on the certified radii through refined Monte Carlo sampling, confidence intervals, and novel approximations (including signomial programming and Taylor-based inverses). Key contributions include Bonferroni-corrected exact intervals, empirical Bernstein and confidence-sequence approaches, and betting-based strategies for continuous monitoring, evaluated on CIFAR-10 and ImageNet to demonstrate tighter certified test-set accuracy and reduced radii estimation discrepancies. The work also analyzes hyperparameters such as sample size $n$, noise level $\sigma$, and temperature $T$ (for tempered softmax), highlighting practical trade-offs between robustness guarantees and computational cost. Overall, the proposed techniques advance scalable, tighter, and more reliable probabilistic certificates for randomized smoothing with directions for future theoretical and empirical refinement.

Abstract

This paper presents novel methods for estimating certified radii in randomized smoothing, a technique crucial for certifying the robustness of neural networks against adversarial perturbations. Our proposed techniques significantly improve the accuracy of certified test-set accuracy by providing tighter bounds on the certified radii. We introduce advanced algorithms for both discrete and continuous domains, demonstrating their effectiveness on CIFAR-10 and ImageNet datasets. The new methods show considerable improvements over existing approaches, particularly in reducing discrepancies in certified radii estimates. We also explore the impact of various hyperparameters, including sample size, standard deviation, and temperature, on the performance of these methods. Our findings highlight the potential for more efficient certification processes and pave the way for future research on tighter confidence sequences and improved theoretical frameworks. The study concludes with a discussion of potential future directions, including enhanced estimation techniques for discrete domains and further theoretical advancements to bridge the gap between empirical and theoretical performance in randomized smoothing.

Figures (11)

• Figure 1: Randomized smoothing: Left, original image $x$ (panda). Right, image with Gaussian noise ($\sigma = 0.5$). The smoothed classifier predicts based on majority voting over noisy samples, mitigating smaller adversarial attacks.
• Figure 2: Robustness radius: Left, decision boundaries with perturbation radii around $x$. Right, class probabilities vs. radius. $\underline{p_A}$ and $\overline{p_B}$ denote bounds for top-two class probabilities.
• Figure 3: Certified accuracies' comparison on the CIFAR-10 dataset in the discrete case for different standard deviations (displayed on the columns) with a sample size of $100$. The legend and row conventions are the same as in Figure \ref{['fig:discrete_num']}.
• Figure 4: Certified accuracies' comparison on the CIFAR-10 dataset in the discrete case for different numbers of samples (displayed on the columns) with $\sigma = 0.12$. CP + Bonferroni means Clopper-Pearson interval with Bonferroni correction, and Ours means our new approach in section \ref{['sec:discrete']}. The first row compares the certified accuracies using the first margin and the second row compares the certified accuracies using the second margin.
• Figure 5: Certified accuracies' comparison on the CIFAR-10 dataset in the continuous case for different sample sizes (displayed on the columns) with $\sigma = 0.5$ and a temperature equal to $1$. CS/Bernstein + Bonferroni stands for the Bonferroni approach with either the empirical Bernstein interval (Proposition \ref{['prop:empirical-bernstein-inequality']}) or the confidence sequence (Proposition \ref{['prop:confidence-sequence']}), and CS/Bernstein + Ours stands for the new approach in section \ref{['sec:continuous']}, where the interval used is either the empirical Bernstein interval or the confidence sequence as before. The first row compares the certified accuracies using the first margin and the second row compares the certified accuracies using the second margin.

Theorems & Definitions (4)

• Proposition 1: Empirical Bernstein Inequality, maurer2009empirical
• Proposition 2: smith2022estimating
• proof
• proof