论文标题
通过随机平滑进行认证的防御对图像转换的辩护
Certified Defense to Image Transformations via Randomized Smoothing
论文作者
论文摘要
我们将随机平滑延长至覆盖参数化转换（例如旋转，翻译），并在参数空间（例如旋转角度）中证明鲁棒性。这尤其具有挑战性，因为插值和舍入效果意味着图像转换不构成，进而阻止了扰动图像的直接认证（与$ \ ell^p $ Norms的认证不同）。我们通过引入三种不同类型的防御措施来应对这一挑战，每种防御能力具有不同的保证（启发式，分布和个体），这些防御能力源于绑定插值误差的方法。重要的是，我们展示了如何通过统计误差界限或有效的在线逆计算获得图像转换的单个证书。我们在https://github.com/eth-sri/transformation-smoothing上提供了所有方法的实现。
We extend randomized smoothing to cover parameterized transformations (e.g., rotations, translations) and certify robustness in the parameter space (e.g., rotation angle). This is particularly challenging as interpolation and rounding effects mean that image transformations do not compose, in turn preventing direct certification of the perturbed image (unlike certification with $\ell^p$ norms). We address this challenge by introducing three different kinds of defenses, each with a different guarantee (heuristic, distributional and individual) stemming from the method used to bound the interpolation error. Importantly, we show how individual certificates can be obtained via either statistical error bounds or efficient online inverse computation of the image transformation. We provide an implementation of all methods at https://github.com/eth-sri/transformation-smoothing.
