Randomized smoothing is a method to make a classifier robust against adversarial attacks. I introduce two papers to improve the performance of a method using randomized smoothing technique.

1. 1

2. 2

3. 3

4. 4

5. 5

6. 6
l2 l∞

7. 7

8. 8

9. 9
f f : ℝN
→ {1,2, . . . , K} K
g : ℝN
→ {1,2, . . . , K}
g(x) = argmaxc∈{1,2, ..., K} ℙϵ∼𝒩(0,δIN)[f(x + ϵ) = c]
f
g
g
f

10. 10

11. 11

12. 12
ℙ[f(x + ϵ) = cA] ≥ pA ≥ pB ≥ maxc≠cA
ℙ[f(x + ϵ) = c]
g(x) R l2
R =
σ
2
(Φ−1
(pA) − Φ−1
(pB))
cA, cB
pA, pB
pA, pB pA pB
Φ

13. 13
cA cB
pA pB
f
pA pA ϵ

14. 14
f
σ pA pB g
pA → 1 R → ∞ pA → 1 f
cA g
R =
σ
2
(Φ−1
(pA) − Φ−1
(pB))

15. 15
l2 R =
σ
2
(Φ−1
(pA) − Φ−1
(pB))
f f g
f
g
R l2
p ≠ 2 lp
l1

16. 16
f δ
g(x) = cA ℙϵ∼𝒩(0,σI)[f(x + δ + ϵ) = cA] f
δ
ℙϵ∼𝒩(0,σI)[f(x + δ + ϵ) = cA]
g
R
R

17. 17
(g(x), pA, pB)
pB = 1 − pA
Φ−1
(p) = − Φ−1
(1 − P)
g(x)
pA
pA

18. 18
pA

19. 19
l2

20. 20

21. 21
l2 l1
p ≤ q lp lq lp
ϵ lq ϵ
lq lp
l0, l1, l2, l∞

22. l1
22
ℒ(x; λ) =
1
(2λ)d
exp(−
∥x∥1
λ
) l1
l2
max
ℒ(x; λ)
g(x) = argmaxc∈{1,2, ..., K} ℙϵ∼ℒ(λ)[f(x + ϵ) = c]

23. 23
ℙ[f(x + ϵ) = cA] ≥ pA ≥ pB ≥ maxc≠cA
ℙ[f(x + ϵ) = c]
g(x) R l1
R = max{
λ
2
log(pA/pB), − λ log(1 − pA + pB)}
cA, cB
pA, pB
pA, pB pA pB

24. 24

25. 25
l1