REVIEW 2 cited by
(Certified!!) Adversarial Robustness for Free!
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
In this paper we show how to achieve state-of-the-art certified adversarial robustness to 2-norm bounded perturbations by relying exclusively on off-the-shelf pretrained models. To do so, we instantiate the denoised smoothing approach of Salman et al. 2020 by combining a pretrained denoising diffusion probabilistic model and a standard high-accuracy classifier. This allows us to certify 71% accuracy on ImageNet under adversarial perturbations constrained to be within an 2-norm of 0.5, an improvement of 14 percentage points over the prior certified SoTA using any approach, or an improvement of 30 percentage points over denoised smoothing. We obtain these results using only pretrained diffusion models and image classifiers, without requiring any fine tuning or retraining of model parameters.
Forward citations
Cited by 2 Pith papers
-
How Do Diffusion Models Improve Adversarial Robustness?
Diffusion models improve adversarial robustness mainly by compressing the input space, while the large gains reported earlier mostly come from evaluation randomness.
-
Robustifying Diffusion-Denoised Smoothing Against Covariate Shift
Adversarially perturbing the noise term of a diffusion denoiser during training improves the certified l2 robustness of denoised randomized smoothing on MNIST, CIFAR-10, and ImageNet, with the largest gains at large p...
Discussion (0). Continue with ORCID to comment.