(Certified!!) Adversarial Robustness for Free! (2206.10550v2)

Abstract: In this paper we show how to achieve state-of-the-art certified adversarial robustness to 2-norm bounded perturbations by relying exclusively on off-the-shelf pretrained models. To do so, we instantiate the denoised smoothing approach of Salman et al. 2020 by combining a pretrained denoising diffusion probabilistic model and a standard high-accuracy classifier. This allows us to certify 71% accuracy on ImageNet under adversarial perturbations constrained to be within an 2-norm of 0.5, an improvement of 14 percentage points over the prior certified SoTA using any approach, or an improvement of 30 percentage points over denoised smoothing. We obtain these results using only pretrained diffusion models and image classifiers, without requiring any fine tuning or retraining of model parameters.

Overview of "Certified Adversarial Robustness for Free"

The paper at hand addresses a critical challenge in the domain of deep learning—ensuring certified adversarial robustness against $\ell_2$-norm bounded perturbations without the computational overhead typically required for retraining or fine-tuning. The authors propose a novel method utilizing off-the-shelf pretrained denoising diffusion probabilistic models in combination with standard classifiers, resulting in significant improvements in adversarial robustness on benchmark datasets like ImageNet.

Core Contributions

The primary contribution of this work is the instantiation of a new denoised smoothing approach that achieves state-of-the-art-certified adversarial robustness improvements. Specifically, this method leverages pretrained diffusion models and high-accuracy classifiers to enhance robustness without necessitating further model-specific training.

• Denoised Smoothing: The authors implement this scheme by combining pretrained denoising diffusion probabilistic models to tackle the noise and a classifier that provides the final prediction. This two-step process is well-suited for adapting the robustness afforded by randomized smoothing techniques in a computationally efficient manner.
• Robustness as a Byproduct: By utilizing the already existing capabilities of powerful diffusion models, their approach does not require the computational cost associated with training or fine-tuning models. This facilitates broader applicability and ease of deployment of the method in practical scenarios.

Numerical Results

Empirically, the authors demonstrate a certified 71% accuracy on ImageNet against adversarial perturbations constrained within an $\ell_2$ norm of $\varepsilon=0.5$. This marks an improvement of 14 percentage points over state-of-the-art certified defenses relying on any approach and a 30-point increase over previously denoised smoothing tactics. These results underline the effectiveness of combining diffusion models with standard classifiers to achieve substantial gains in adversarial robustness while also maintaining impressive clean accuracy on the datasets examined.

Discussion on Implications

The implications of this research are notable in both theoretical exploration and practical deployment of adversarial defenses. Theoretically, it provides insight into how leveraging the intrinsic properties of pretrained diffusion models can yield robust model predictions without additional computational largesse. Practically, it implies that organizations can deploy more secure AI systems without incurring the high costs associated with further training and without compromising accuracy.

The paper provides a foundation upon which future research may expand, particularly with regard to potentially leveraging other generative models to enhance robustness across different normed threat models. Moreover, it may spur exploration into other machine learning tasks where pretrained models can be similarly applied.

Future Directions

The unique approach that this paper introduces raises questions about the other potential uses of pretrained diffusion models and similar techniques in achieving adversarial robustness. The success of this method prompts future investigations into robust defense mechanisms that utilize pretrained components for efficiency. Moreover, tests across additional datasets and adversarial constraints could expand the breadth of understanding regarding the efficacy and scalability of diffusion-based smoothing defenses.

In conclusion, this work contributes a pivotal advancement in adversarial defense strategies by achieving highly certified performance improvements using adaptable, pretrained components—a promising direction for both academia and industry seeking reliable AI models.