Certified Defense to Image Transformations via Randomized Smoothing
This work addresses the need for certified defenses in computer vision and security applications, offering incremental improvements by extending randomized smoothing to transformation-based attacks.
The paper tackles the problem of certifying robustness against parameterized image transformations like rotations and translations, which is challenging due to interpolation and rounding effects, and introduces three defense methods with different guarantees, showing how individual certificates can be obtained via statistical bounds or efficient online inverse computation.
We extend randomized smoothing to cover parameterized transformations (e.g., rotations, translations) and certify robustness in the parameter space (e.g., rotation angle). This is particularly challenging as interpolation and rounding effects mean that image transformations do not compose, in turn preventing direct certification of the perturbed image (unlike certification with $\ell^p$ norms). We address this challenge by introducing three different kinds of defenses, each with a different guarantee (heuristic, distributional and individual) stemming from the method used to bound the interpolation error. Importantly, we show how individual certificates can be obtained via either statistical error bounds or efficient online inverse computation of the image transformation. We provide an implementation of all methods at https://github.com/eth-sri/transformation-smoothing.