Along with recent diffusion models, randomized smoothing has become one of a
few tangible approaches that offers adversarial robustness to models at scale,
e.g., those of large pre-trained models. Specifically, one can perform
randomized smoothing on any classifier via a simple "denoise-and-classify"
pipeline, so-called denoised smoothing, given that an accurate denoiser is
available - such as diffusion model. In this paper, we investigate the
trade-off between accuracy and certified robustness of denoised smoothing: for
example, we question on which representation of diffusion model would maximize
the certified robustness of denoised smoothing. We consider a new objective
that aims collective robustness of smoothed classifiers across multiple noise
levels at a shared diffusion model, which also suggests a new way to compensate
the cost of accuracy in randomized smoothing for its certified robustness. This
objective motivates us to fine-tune diffusion model (a) to perform consistent
denoising whenever the original image is recoverable, but (b) to generate
rather diverse outputs otherwise. Our experiments show that this fine-tuning
scheme of diffusion models combined with the multi-scale smoothing enables a
strong certified robustness possible at highest noise level while maintaining
the accuracy closer to non-smoothed classifiers.

通过多尺度平滑和扩散模型，本论文研究了平滑方法的准确性和认证鲁棒性之间的平衡，以实现对大规模模型的对抗性稳健性。

多尺度扩散去噪平滑

Multi-scale Diffusion Denoised Smoothing

In this paper we show how to achieve state-of-the-art certified adversarial
robustness to 2-norm bounded perturbations by relying exclusively on
off-the-shelf pretrained models. To do so, we instantiate the denoised
smoothing approach of Salman et al. 2020 by combining a pretrained denoising
diffusion probabilistic model and a standard high-accuracy classifier. This
allows us to certify 71% accuracy on ImageNet under adversarial perturbations
constrained to be within an 2-norm of 0.5, an improvement of 14 percentage
points over the prior certified SoTA using any approach, or an improvement of
30 percentage points over denoised smoothing. We obtain these results using
only pretrained diffusion models and image classifiers, without requiring any
fine tuning or retraining of model parameters.

本文介绍了一个基于离线预训练模型，通过组合去噪扩散概率模型和高性能分类器等手段实现了对于 2 - 范数边界扰动的认证敌对鲁棒性，并在 ImageNet 数据集上得到了 71% 的分类准确率，显著优于之前的相关研究。

认证的免费对抗鲁棒性

(Certified!!) Adversarial Robustness for Free!

The lack of adversarial robustness has been recognized as an important issue
for state-of-the-art machine learning (ML) models, e.g., deep neural networks
(DNNs). Thereby, robustifying ML models against adversarial attacks is now a
major focus of research. However, nearly all existing defense methods,
particularly for robust training, made the white-box assumption that the
defender has the access to the details of an ML model (or its surrogate
alternatives if available), e.g., its architectures and parameters. Beyond
existing works, in this paper we aim to address the problem of black-box
defense: How to robustify a black-box model using just input queries and output
feedback? Such a problem arises in practical scenarios, where the owner of the
predictive model is reluctant to share model information in order to preserve
privacy. To this end, we propose a general notion of defensive operation that
can be applied to black-box models, and design it through the lens of denoised
smoothing (DS), a first-order (FO) certified defense technique. To allow the
design of merely using model queries, we further integrate DS with the
zeroth-order (gradient-free) optimization. However, a direct implementation of
zeroth-order (ZO) optimization suffers a high variance of gradient estimates,
and thus leads to ineffective defense. To tackle this problem, we next propose
to prepend an autoencoder (AE) to a given (black-box) model so that DS can be
trained using variance-reduced ZO optimization. We term the eventual defense as
ZO-AE-DS. In practice, we empirically show that ZO-AE- DS can achieve improved
accuracy, certified robustness, and query complexity over existing baselines.
And the effectiveness of our approach is justified under both image
classification and image reconstruction tasks. Codes are available at
this https URL.

本文提出了一种针对黑盒模型的防御式操作，通过基于降噪平滑和零阶优化的方法，将自编码器与模型结合，并在此基础上设计了 ZO-AE-DS，该方法在图像分类和重建任务上表现出更好的准确性、可靠性和查询复杂度。

如何提高黑盒机器学习模型的鲁棒性？零阶优化视角

How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspective

We present a method for provably defending any pretrained image classifier
against $\ell_p$ adversarial attacks. This method, for instance, allows public
vision API providers and users to seamlessly convert pretrained non-robust
classification services into provably robust ones. By prepending a
custom-trained denoiser to any off-the-shelf image classifier and using
randomized smoothing, we effectively create a new classifier that is guaranteed
to be $\ell_p$-robust to adversarial examples, without modifying the pretrained
classifier. Our approach applies to both the white-box and the black-box
settings of the pretrained classifier. We refer to this defense as denoised
smoothing, and we demonstrate its effectiveness through extensive
experimentation on ImageNet and CIFAR-10. Finally, we use our approach to
provably defend the Azure, Google, AWS, and ClarifAI image classification APIs.
Our code replicating all the experiments in the paper can be found at:
this https URL

本文提出了一种名为 'denoised smoothing' 的方法，通过添加定制训练的去噪器和使用随机平滑，可以将现有的图像分类器转化为 Robust 分类器以防御 'adversarial attacks'，针对 ImageNet 和 CIFAR-10 数据集进行了广泛实验，并成功对 Azure，Google，AWS 和 ClarifAI 的图像分类 API 进行了 'robustness' 测试。