The study of provable adversarial robustness has mostly been limited to
classification tasks and models with one-dimensional real-valued outputs. We
extend the scope of certifiable robustness to problems with more general and
structured outputs like sets, images, language, etc. We model the output space
as a metric space under a distance/similarity function, such as
intersection-over-union, perceptual similarity, total variation distance, etc.
Such models are used in many machine learning problems like image segmentation,
object detection, generative models, image/audio-to-text systems, etc. Based on
a robustness technique called randomized smoothing, our $\textit{center
smoothing}$ procedure can produce models with the guarantee that the change in
the output, as measured by the distance metric, remains small for any
norm-bounded adversarial perturbation of the input. We apply our method to
create certifiably robust models with disparate output spaces - from sets to
images - and show that it yields meaningful certificates without significantly
degrading the performance of the base model. Code for our experiments is
available at: this https URL

本研究将证明对抗鲁棒性的研究扩展到具有更一般和结构化输出的问题，并将输出空间建模为度量空间，利用距离 / 相似函数等技术应用于图像分割，物体检测和生成模型等机器学习问题。本研究中的中心平滑程序使用随机平滑技术产生确保在输入的任何有界范数对抗扰动时，由距离度量测量的输出变化保持较小的模型。并应用于创建具有不同输出空间的可证明的强鲁棒模型，展示此方法可以产生有意义的证书，同时不会过度降低模型的性能。