Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusion

Frederick Shpilevskiy, Saiyue Lyu, Krishnamurthy Dj Dvijotham, Mathias Lécuyer, Pierre-Andre Noel

Keywords: input adaptivity, test time adaptivity, adversarial robustness, diffusion, differential privacy, guided diffusion, f-DP, randomized smoothing, adversarial attacks, DP composition

TL;DR: Analyze guided diffusion as a sequence of f-DP mechanisms to certify models against adversarial attacks with input adaptive randomized smoothing

Abstract: We propose Adaptive Diffusion Denoised Smoothing, a method for certifying the predictions of a vision model against adversarial examples, while adapting to the input. Our key insight is to reinterpret a guiding denoising diffusion model as a long sequence of adaptive Gaussian Differentially Private (GDP) mechanisms refining a pure noise sample into an image. We show that these adaptive mechanisms can be composed through a GDP privacy filter to analyze the end-to-end robustness of the guided denoising process, yielding a provable certification that extends the adaptive randomized smoothing analysis. We demonstrate that our design, under a specific guided strategy, can improve both certified accuracy and standard accuracy on ImageNet for an $\ell_2$ threat model.

Submission Number: 59