Randomized smoothing is the current state-of-the-art method for producing
provably robust classifiers. While randomized smoothing typically yields robust
$\ell_2$-ball certificates, recent research has generalized provable robustness
to different norm balls as well as anisotropic regions. This work considers a
classifier architecture that first projects onto a low-dimensional
approximation of the data manifold and then applies a standard classifier. By
performing randomized smoothing in the low-dimensional projected space, we
characterize the certified region of our smoothed composite classifier back in
the high-dimensional input space and prove a tractable lower bound on its
volume. We show experimentally on CIFAR-10 and SVHN that classifiers without
the initial projection are vulnerable to perturbations that are normal to the
data manifold and yet are captured by the certified regions of our method. We
compare the volume of our certified regions against various baselines and show
that our method improves on the state-of-the-art by many orders of magnitude.

通过在低维投影空间中执行随机平滑，我们能够表征在高维输入空间中的平滑复合分类器的认证区域并证明其体积的可行下界。我们在 CIFAR-10 和 SVHN 上进行了实验证明分类器在没有初始投影时容易受到正常与数据流形法线相交的扰动，并且这些扰动被我们的方法的认证区域捕捉到。我们将我们认证区域的体积与各种基准进行比较，并证明我们的方法在数量级上优于现有技术。