Center Smoothing: Certified Robustness for Networks with Structured Outputs
This addresses the need for certifiable robustness in diverse machine learning applications such as image segmentation and object detection, representing a novel extension rather than an incremental improvement.
The paper tackles the problem of extending provable adversarial robustness beyond classification to models with structured outputs like sets and images, by introducing center smoothing, which guarantees that output changes remain small under norm-bounded perturbations, and shows it yields meaningful certificates without significantly degrading base model performance.
The study of provable adversarial robustness has mostly been limited to classification tasks and models with one-dimensional real-valued outputs. We extend the scope of certifiable robustness to problems with more general and structured outputs like sets, images, language, etc. We model the output space as a metric space under a distance/similarity function, such as intersection-over-union, perceptual similarity, total variation distance, etc. Such models are used in many machine learning problems like image segmentation, object detection, generative models, image/audio-to-text systems, etc. Based on a robustness technique called randomized smoothing, our $\textit{center smoothing}$ procedure can produce models with the guarantee that the change in the output, as measured by the distance metric, remains small for any norm-bounded adversarial perturbation of the input. We apply our method to create certifiably robust models with disparate output spaces - from sets to images - and show that it yields meaningful certificates without significantly degrading the performance of the base model. Code for our experiments is available at: https://github.com/aounon/center-smoothing.