We extend randomized smoothing to cover parameterized transformations (e.g., rotations, translations) and certify robustness in the parameter space (e.g., rotation angle). This is particularly challenging as interpolation and rounding effects mean that image transformations do not compose, in turn preventing direct certification of the perturbed image (unlike certification with lp-norms). We address this challenge by introducing three different kinds of defenses, each with a different guarantee (heuristic, distributional and individual) stemming from the method used to bound the interpolation error. Importantly, we show how individual certificates can be obtained via either statistical error bounds or efficient online inverse computation of the image transformation. We provide an implementation of all methods at this https URL.
Certified Defense to Image Transformations via Randomized Smoothing
Marc Fischer, Maximilian Baader, Martin Vechev
NeurIPS 2020
@incollection{fischer2020transformationsmoothing, title = {Certified Defense to Image Transformations via Randomized Smoothing}, author = { Fischer, Marc and Baader, Maximilian and Vechev, Martin}, booktitle = {Advances in Neural Information Processing Systems 33}, year = {2020} }