Certified Patch Robustness via Smoothed Vision Transformers

TL;DR

This paper introduces a method using vision transformers to improve certified patch robustness in image classifiers, achieving better robustness and efficiency without sacrificing standard accuracy.

Contribution

The paper presents a novel approach leveraging vision transformers for certified patch defenses, enhancing robustness and computational efficiency over existing methods.

Findings

Significantly improved certified patch robustness.

More computationally efficient than previous methods.

Maintains high standard accuracy.

Abstract

Certified patch defenses can guarantee robustness of an image classifier to arbitrary changes within a bounded contiguous region. But, currently, this robustness comes at a cost of degraded standard accuracies and slower inference times. We demonstrate how using vision transformers enables significantly better certified patch robustness that is also more computationally efficient and does not incur a substantial drop in standard accuracy. These improvements stem from the inherent ability of the vision transformer to gracefully handle largely masked images. Our code is available at https://github.com/MadryLab/smoothed-vit.