Smooth-Reduce: Leveraging Patches for Improved Certified Robustness

TL;DR

Smooth-Reduce is a training-free method that improves the certified robustness of neural networks by patch-based aggregation, outperforming existing randomized smoothing techniques in accuracy and certified radius, and extending to video classifiers.

Contribution

We introduce a novel patch-based aggregation method, Smooth-Reduce, that enhances certified robustness without retraining, with theoretical guarantees and applicability to videos.

Findings

Achieves higher certified accuracy and radii compared to existing methods.

Provides theoretical guarantees for robustness certificates.

Extends robustness certification to video classifiers.

Abstract

Randomized smoothing (RS) has been shown to be a fast, scalable technique for certifying the robustness of deep neural network classifiers. However, methods based on RS require augmenting data with large amounts of noise, which leads to significant drops in accuracy. We propose a training-free, modified smoothing approach, Smooth-Reduce, that leverages patching and aggregation to provide improved classifier certificates. Our algorithm classifies overlapping patches extracted from an input image, and aggregates the predicted logits to certify a larger radius around the input. We study two aggregation schemes -- max and mean -- and show that both approaches provide better certificates in terms of certified accuracy, average certified radii and abstention rates as compared to concurrent approaches. We also provide theoretical guarantees for such certificates, and empirically show significant improvements over other randomized smoothing methods that require expensive retraining. Further, we extend our approach to videos and provide meaningful certificates for video classifiers. A project page can be found at https://nyu-dice-lab.github.io/SmoothReduce/