(Certified!!) Adversarial Robustness for Free!
Nicholas Carlini∗1 Florian Tramèr∗1 Krishnamurthy (Dj) Dvijotham1 Leslie Rice2 Mingjie Sun2 J. Zico Kolter2,3 1Google 2Carnegie Mellon University 3Bosch Center for AI Joint first authors
Abstract
In this paper we show how to achieve state-of-the-art certified adversarial robustness to $\ell_{2}$ -norm bounded perturbations by relying exclusively on off-the-shelf pretrained models. To do so, we instantiate the denoised smoothing approach of Salman et al. (2020) by combining a pretrained denoising diffusion probabilistic model and a standard high-accuracy classifier. This allows us to certify 71% accuracy on ImageNet under adversarial perturbations constrained to be within an $\ell_{2}$ norm of $\varepsilon=0.5$ , an improvement of 14 percentage points over the prior certified SoTA using any approach, or an improvement of 30 percentage points over denoised smoothing. We obtain these results using only pretrained diffusion models and image classifiers, without requiring any fine tuning or retraining of model parameters.
中文速览
想象一下，如果你把一张图片稍微改动几个像素，就能让人工智能系统认不出来——这种"对抗样本"攻击长期困扰着深度学习模型，而如何在数学上证明模型能抵御这类攻击更是难题。研究者发现，只需将现成的扩散去噪模型（denoising diffusion probabilistic model）与高精度图像分类器组合起来，就能在"随机平滑"（randomized smoothing）这一可认证防御框架下大幅提升抗攻击能力：具体做法是把加了高斯噪声的输入先用扩散模型做一次性去噪，再交给分类器打标签，整个过程无需任何重新训练或微调。在ImageNet上，新方法在扰动半径ε=0.5的ℓ₂约束下达到了71%的可认证准确率，比此前最佳方案高出14个百分点，比原始去噪平滑方法高出30个百分点。这项工作意义在于：它证明了"组合即可达到最优"，用户完全可以直接复用公开预训练模型来构建强有力的可认证鲁棒防御，无需从头定制任何组件。
原文 arXiv:2206.10550;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2206.10550v2