Source-linked AI summary
(Certified!!) Adversarial Robustness for Free!
Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, Mingjie Sun, J. Zico Kolter
TL;DR
Certified robustness to ℓ2-bounded adversarial perturbations is difficult to achieve with high accuracy. The paper instantiates denoised smoothing by combining pretrained diffusion models with standard classifiers, reaching 71.1% top-1 accuracy on ImageNet at ε = 0.5 and improving prior work by 14 percentage points, while benefits diminish at larger perturbation levels.
Problem
Certified robustness to norm-bounded adversarial perturbations remains difficult to evaluate and achieve accurately.
Method
The paper combines pretrained diffusion models as denoisers with standard pretrained classifiers within denoised smoothing.
Results
71.1% top-1 accuracy at ε = 0.5 on ImageNet improves prior work by +14 percentage points.
Takeaways & Limitations
Off-the-shelf models can achieve state-of-the-art certified accuracy when diffusion models are used as one-shot denoisers.
Abstract
from arXiv · showhide
In this paper we show how to achieve state-of-the-art certified adversarial robustness to 2-norm bounded perturbations by relying exclusively on off-the-shelf pretrained models. To do so, we instantiate the denoised smoothing approach of Salman et al. 2020 by combining a pretrained denoising diffusion probabilistic model and a standard high-accuracy classifier. This allows us to certify 71% accuracy on ImageNet under adversarial perturbations constrained to be within an 2-norm of 0.5, an improvement of 14 percentage points over the prior certified SoTA using any approach, or an improvement of 30 percentage points over denoised smoothing. We obtain these results using only pretrained diffusion models and image classifiers, without requiring any fine tuning or retraining of model parameters.
1 INTRODUCTION
The paper combines diffusion-model denoising with randomized smoothing and pretrained classifiers to improve certified robustness against ℓ2-bounded adversarial perturbations. It reports stronger certification than prior denoised-smoothing and other certified defenses on ImageNet and CIFAR-10.
- Certified defenses provide provable robustness guarantees for norm-bounded adversarial perturbations on a large fraction of test examples.
- Denoised smoothing first removes Gaussian noise with a denoiser, then classifies the resulting image with a standard classifier.This enables randomized smoothing with pretrained black-box base classifiers when denoising restores images near the classifier’s training distribution.
- Diffusion models are suited to denoising because they learn to reverse a Gaussian-noising process and can recover high-quality inputs from noisy images.
- The approach combines publicly available diffusion denoisers with pretrained classifiers and improves certified robustness for ℓ2 perturbations up to 2 on ImageNet and 0.5 on CIFAR-10.The comparison includes prior custom-denoiser methods and other certifiably robust defenses.
2 BACKGROUND
The background introduces adversarial perturbations, randomized smoothing, denoised smoothing, and diffusion models as the components of the paper’s certified-defense pipeline. The resulting base classifier applies a pretrained classifier after denoising Gaussian-perturbed inputs.
- Adversarial examples add a label-preserving perturbation δ to an input, with robustness evaluated under the constraint ∥δ∥2 ≤ ε.Even at ε = 0.5, modern classifiers can have near-0% accuracy.
- Randomized smoothing certifies ℓ2 robustness by defining a smoothed classifier from predictions under Gaussian noise.The certified radius grows with the probability margin between the most likely and second most-likely classes, estimated by sampling.
- Denoised smoothing composes a denoiser with a standard classifier before applying randomized smoothing.A sufficiently effective denoiser can make noisy-input accuracy resemble the clean accuracy of the pretrained classifier.
- Diffusion models learn to reverse a process that transforms data images into Gaussian noise, but this paper uses them as one-step denoisers rather than typical generators.
- The diffusion model is trained using noisy images generated at scheduled timesteps, with noise magnitude increasing monotonically with the timestep.Its training objective is to recover the original image, although modern models commonly predict the added noise instead.
- The approach can be implemented in under 15 lines using an off-the-shelf classifier and diffusion model, while its prediction procedure inherits Cohen et al.’s robustness certificate.
3 DIFFUSION DENOISED SMOOTHING
Diffusion Denoised Smoothing maps randomized-smoothing noise to a diffusion timestep, denoises once, and classifies the result with an off-the-shelf classifier. One-shot denoising is chosen for higher classifier accuracy and lower certification cost.
- Diffusion Denoised Smoothing combines a diffusion denoiser with an off-the-shelf classifier without introducing new technical ideas.
- Denoised smoothing via a diffusion model: The method matches randomized-smoothing Gaussian noise to the diffusion model by selecting a timestep t⋆ whose noise variance corresponds to σ².
- Denoised smoothing via a diffusion model: After adding Gaussian noise and applying the diffusion denoiser, the method classifies the estimated denoised image with an off-the-shelf classifier.
- Certification: Certification repeats denoising and classification many times, then computes a robustness radius using the randomized-smoothing method of Cohen et al. (2019).
- One-shot denoising: One-shot denoising uses a single denoising pass instead of the full iterative diffusion process.
- One-shot denoising: One-shot denoising improves classifier accuracy and efficiency because iterative denoising can destroy information and requires many forward passes.
4 EVALUATION
The evaluation combines pretrained diffusion models and classifiers on CIFAR-10 and ImageNet, finding state-of-the-art certified ℓ2 robustness. Gains are strongest at small perturbation bounds, while extreme noise can cause diffusion denoising to hallucinate content.
- Evaluation setup: The evaluation tests diffusion denoised smoothing on CIFAR-10 and ImageNet using randomized-smoothing certification with 100,000 and 10,000 noise samples, respectively.
- Evaluation setup: The approach uses publicly available diffusion models and pretrained classifiers, including a 552M-parameter ImageNet diffusion model with a 305M-parameter BEiT large classifier.
- Results: On both datasets, the method outperforms prior denoised-smoothing approaches in every evaluated setting and exceeds randomized-smoothing models at low perturbation bounds.
- Results: At ε = 3 on ImageNet, the method is 7 percentage points below the state of the art.
- Limitations: The proposed benefit is constrained at high noise because diffusion models may hallucinate content from another class, fooling the classifier.
- Ablation: Finetuning classifiers on noised-then-denoised CIFAR-10 images improves clean accuracy and certified robustness at ε ≤ 0.5 by a couple of percentage points.
5 ANALYSIS AND DISCUSSION
The analysis finds that one-shot denoising preserves image identity better than iterative diffusion for classification, while diffusion training across diverse noise levels improves one-shot denoising generalization. A deterministic multi-step sampler can nevertheless outperform one-shot denoising.
- One-shot versus multi-step denoising: One-shot denoising achieves state-of-the-art certified accuracy by using diffusion models as fixed-noise denoisers rather than iterative generators.The approach applies the diffusion model once at a selected noise level.
- One-shot versus multi-step denoising: Iterative reverse diffusion adds fresh Gaussian noise at each step, which can destroy information about the original image.This makes faithful reconstruction theoretically easier in one shot than across multiple iterations.
- One-shot versus multi-step denoising: One-shot denoising produces mostly faithful but blurry reconstructions, whereas iterative denoising hallucinates detailed features that can make images semantically different.The paper illustrates this behavior with noisy images and pretrained BEiT predictions in Figures 3–5.
- Training on restricted noise levels: Training on diverse Gaussian-noise ranges improves one-shot denoising accuracy beyond training solely at the evaluation noise level.For σ = 0.5, multi-level training reaches 68.1% accuracy versus 60.1% when training solely at σ = 0.5.
- Training on restricted noise levels: The full diffusion training process yields better and more generalizable one-shot denoising than standalone single-noise-level denoisers.Broader training ranges further improve low-noise performance but can slightly harm accuracy at larger noise.
- Advanced deterministic multi-step sampler: A deterministic EDM sampler with 18 reverse steps and 35 model evaluations can outperform one-shot denoising on CIFAR-10.The comparison uses off-the-shelf classifiers and averages clean accuracy over five runs.
6 CONCLUSION
The paper addresses the difficulty of training highly accurate certified robust models by proposing an alternative based exclusively on off-the-shelf classification and denoising models.
- Motivation: Certified robust models are difficult to train to high accuracy and significantly reduce clean accuracy.This motivates alternatives to specialized robust-training techniques.
- Proposed alternative: The paper proposes using off-the-shelf state-of-the-art classification and image-denoising models for robust classification.The approach leverages models trained for their original tasks without describing specialized robust-model training.
A APPENDIX
The appendix reports certified-accuracy evaluations across classifiers and Gaussian-noise levels, alongside qualitative comparisons of one-shot and multi-step denoising.
- Certified accuracy: Table 6 reports certified accuracy for four classifiers on CIFAR-10 across varying Gaussian-noise levels.All four classifiers use the same diffusion model.
- Certified accuracy: Table 7 reports certified accuracy on ImageNet across varying Gaussian-noise levels.The table organizes results by noise level σ.
- Qualitative denoising comparisons: The qualitative comparisons mark correctly classified denoised images with green borders and misclassified images with red borders.The comparison covers one-shot and multi-step denoising under random Gaussian noise with σ = 1.00.
- Qualitative denoising comparisons: Additional examples compare clean, noisy, one-step denoised, and multi-step denoised images using pretrained BEiT predictions.These examples further illustrate recognition differences between denoising procedures.