Localized Randomized Smoothing for Collective Robustness Certification

Jan Schuchardt, Tom Wollschläger, Aleksandar Bojchevski, Stephan Günnemann

Keywords: Adversarial robustness, Robustness certification, Robust machine learning, Randomized smoothing, Verification

Abstract: Models for image segmentation, node classification and many other tasks map a single input to multiple labels. By perturbing this single shared input (e.g. the image) an adversary can manipulate several predictions (e.g. misclassify several pixels). A recent collective robustness certificate provides strong guarantees on the number of predictions that are simultaneously robust. This method is however limited to strictily models, where each prediction is associated with a small receptive field. We propose a more general collective certificate for the larger class of softly local models, where each output is dependent on the entire input but assigns different levels of importance to different input regions (e.g. based on their proximity in the image). The certificate is based on our novel localized randomized smoothing approach, where the random perturbation strength for different input regions is proportional to their importance for the outputs. The resulting locally smoothed model yields strong collective guarantees while maintaining high prediction quality on both image segmentation and node classification tasks.

Community Implementations: [ 1 code implementation](https://www.catalyzex.com/paper/arxiv:2210.16140/code)