Randomized smoothing has been shown to provide good certified-robustness
guarantees for high-dimensional classification problems. It uses the
probabilities of predicting the top two most-likely classes around an input
point under a smoothing distribution to generate a certified radius for a
classifier's prediction. However, most smoothing methods do not give us any
information about the confidence with which the underlying classifier (e.g.,
deep neural network) makes a prediction. In this work, we propose a method to
generate certified radii for the prediction confidence of the smoothed
classifier. We consider two notions for quantifying confidence: average
prediction score of a class and the margin by which the average prediction
score of one class exceeds that of another. We modify the Neyman-Pearson lemma
(a key theorem in randomized smoothing) to design a procedure for computing the
certified radius where the confidence is guaranteed to stay above a certain
threshold. Our experimental results on CIFAR-10 and ImageNet datasets show that
using information about the distribution of the confidence scores allows us to
achieve a significantly better certified radius than ignoring it. Thus, we
demonstrate that extra information about the base classifier at the input point
can help improve certified guarantees for the smoothed classifier. Code for the
experiments is available at this https URL

本文提出了一种针对随机平滑后的分类器预测置信度的证明半径计算方法，利用平滑分布下预测置信度的概率分布信息，基于 Neyman-Pearson 引理，设计了一种计算置信度会高于某一阈值的证明半径估计方法，并在 CIFAR-10 和 ImageNet 数据集上实验表明，利用预测置信度的概率分布信息能够明显提升分类器的可证明鲁棒性。