Feature-Space Smoothing: Certified Robustness of Deep Representations

TL;DR

This paper introduces Feature-space Smoothing (FS), a framework that certifies robustness of deep representations against adversarial perturbations, and a module called GSB to enhance this robustness without retraining.

Contribution

The paper proposes FS for certified feature-space robustness, extends it to prediction-level certification, and introduces GSB to improve Gaussian robustness scores without retraining models.

Findings

FS provides certified lower bounds on cosine similarity under l_2 perturbations.

Integrating FS improves robustness and task performance under strong adversarial attacks.

GSB enhances encoder robustness scores, boosting overall model resilience.

Abstract

Modern deep learning models exhibit strong capabilities across diverse applications, yet remain vulnerable to malicious inputs that induce erroneous predictions via feature-space distortion. To address this vulnerability, we propose Feature-space Smoothing (FS), a general defense framework that provides certified robustness at the feature representation level. We show that FS converts a given feature encoder into a smoothed variant that is guaranteed to maintain a certified lower bound on the cosine similarity between clean and adversarial features under l_2-bounded perturbations. We then establish that this Feature Cosine Similarity Bound (FCSB) can be extended to the prediction-wise certification under the cosine similarity measure, and the value of FCSB is determined by the encoder intrinsic Gaussian robustness score. Building on those insights, we introduce the Gaussian Smoothness Booster (GSB), a plug-and-play module to improve the encoder Gaussian robustness score. Specifically, the GSB module is plugged to enhance the feature-space consistency and maintain the feature utility for downstream tasks under Gaussian perturbations. This design enables seamless integration of FS on the protected model, e.g., Multimodal Large Language Models (MLLMs), without additional model retraining or alignment, improving its robustness while preserving the performance for downstream task-oriented decoding. Extensive experiments demonstrate that integrating FS consistently provides non-trivial certified robustness and significantly improves task-oriented performance under strong white-box adversarial attacks across diverse models and applications.