General Lipschitz: Certified Robustness Against Resolvable Semantic Transformations via Transformation-Dependent Randomized Smoothing

TL;DR

This paper introduces General Lipschitz, a framework for certifying neural network robustness against semantic transformations like blurring and translation, extending randomized smoothing techniques to semantic perturbations.

Contribution

We propose a novel framework that certifies neural networks against composable semantic transformations using transformation-dependent Lipschitz continuity analysis.

Findings

Performs comparably to state-of-the-art on ImageNet

Provides robustness certificates for semantic transformations

Extends randomized smoothing to semantic perturbations

Abstract

Randomized smoothing is the state-of-the-art approach to construct image classifiers that are provably robust against additive adversarial perturbations of bounded magnitude. However, it is more complicated to construct reasonable certificates against semantic transformation (e.g., image blurring, translation, gamma correction) and their compositions. In this work, we propose \emph{General Lipschitz (GL),} a new framework to certify neural networks against composable resolvable semantic perturbations. Within the framework, we analyze transformation-dependent Lipschitz-continuity of smoothed classifiers w.r.t. transformation parameters and derive corresponding robustness certificates. Our method performs comparably to state-of-the-art approaches on the ImageNet dataset.