Randomized smoothing is the current state-of-the-art method for producing
provably robust classifiers. While randomized smoothing typically yields robust
$\ell_2$-ball certificates, recent research has generalized provable robustness
to different norm balls as well as anisotropic regions. This work considers a
classifier architecture that first projects onto a low-dimensional
approximation of the data manifold and then applies a standard classifier. By
performing randomized smoothing in the low-dimensional projected space, we
characterize the certified region of our smoothed composite classifier back in
the high-dimensional input space and prove a tractable lower bound on its
volume. We show experimentally on CIFAR-10 and SVHN that classifiers without
the initial projection are vulnerable to perturbations that are normal to the
data manifold and yet are captured by the certified regions of our method. We
compare the volume of our certified regions against various baselines and show
that our method improves on the state-of-the-art by many orders of magnitude.

通过在低维投影空间中执行随机平滑，我们能够表征在高维输入空间中的平滑复合分类器的认证区域并证明其体积的可行下界。我们在 CIFAR-10 和 SVHN 上进行了实验证明分类器在没有初始投影时容易受到正常与数据流形法线相交的扰动，并且这些扰动被我们的方法的认证区域捕捉到。我们将我们认证区域的体积与各种基准进行比较，并证明我们的方法在数量级上优于现有技术。

投影随机平滑实现认证对抗鲁棒性

Projected Randomized Smoothing for Certified Adversarial Robustness

Training generative adversarial networks is unstable in high-dimensions as
the true data distribution tends to be concentrated in a small fraction of the
ambient space. The discriminator is then quickly able to classify nearly all
generated samples as fake, leaving the generator without meaningful gradients
and causing it to deteriorate after a point in training. In this work, we
propose training a single generator simultaneously against an array of
discriminators, each of which looks at a different random low-dimensional
projection of the data. Individual discriminators, now provided with restricted
views of the input, are unable to reject generated samples perfectly and
continue to provide meaningful gradients to the generator throughout training.
Meanwhile, the generator learns to produce samples consistent with the full
data distribution to satisfy all discriminators simultaneously. We demonstrate
the practical utility of this approach experimentally, and show that it is able
to produce image samples with higher quality than traditional training with a
single discriminator.

本文提出了一种针对高维度情况下 GAN 训练不稳定的方法，即使用一个生成器同时生成多个不同低维度投影数据的判别器来提供连续的梯度，实验结果表明该方法能够生成较高质量的图像样本。