Smooth-Reduce: Leveraging Patches for Improved Certified Robustness
This work addresses the need for more efficient and accurate certified robustness in image and video classifiers, offering an incremental improvement over randomized smoothing methods.
The paper tackles the problem of certified robustness for deep neural network classifiers by proposing Smooth-Reduce, a training-free method that uses patching and aggregation to improve certificates, resulting in better certified accuracy, average certified radii, and abstention rates compared to existing approaches.
Randomized smoothing (RS) has been shown to be a fast, scalable technique for certifying the robustness of deep neural network classifiers. However, methods based on RS require augmenting data with large amounts of noise, which leads to significant drops in accuracy. We propose a training-free, modified smoothing approach, Smooth-Reduce, that leverages patching and aggregation to provide improved classifier certificates. Our algorithm classifies overlapping patches extracted from an input image, and aggregates the predicted logits to certify a larger radius around the input. We study two aggregation schemes -- max and mean -- and show that both approaches provide better certificates in terms of certified accuracy, average certified radii and abstention rates as compared to concurrent approaches. We also provide theoretical guarantees for such certificates, and empirically show significant improvements over other randomized smoothing methods that require expensive retraining. Further, we extend our approach to videos and provide meaningful certificates for video classifiers. A project page can be found at https://nyu-dice-lab.github.io/SmoothReduce/