(Certified!!) Adversarial Robustness for Free!
This work provides a significant advancement in adversarial robustness for machine learning systems, particularly in computer vision, by enabling strong certified defenses without the need for retraining or fine-tuning, though it builds incrementally on existing denoised smoothing approaches.
The paper tackles the problem of achieving certified adversarial robustness for image classifiers against 2-norm bounded perturbations by using only off-the-shelf pretrained models, resulting in a 71% accuracy on ImageNet under perturbations with an 2-norm of 0.5, which is a 14 percentage point improvement over prior state-of-the-art methods.
In this paper we show how to achieve state-of-the-art certified adversarial robustness to 2-norm bounded perturbations by relying exclusively on off-the-shelf pretrained models. To do so, we instantiate the denoised smoothing approach of Salman et al. 2020 by combining a pretrained denoising diffusion probabilistic model and a standard high-accuracy classifier. This allows us to certify 71% accuracy on ImageNet under adversarial perturbations constrained to be within an 2-norm of 0.5, an improvement of 14 percentage points over the prior certified SoTA using any approach, or an improvement of 30 percentage points over denoised smoothing. We obtain these results using only pretrained diffusion models and image classifiers, without requiring any fine tuning or retraining of model parameters.