论文标题
浮点算术中的声音随机平滑
Sound Randomized Smoothing in Floating-Point Arithmetics
论文作者
论文摘要
使用无限精度时，随机平滑是合理的。但是，我们表明，对于有限的浮点精度，随机平滑不再是声音。我们提出了一个简单的示例，即随机平滑的$ 1.26 $在某个点附近的半径为$ 1.26 $，即使距离$ 0.8 $中有一个对抗性示例，并进一步扩展了此示例以提供CIFAR10的虚假证书。我们讨论了随机平滑的隐性假设，并表明它们不适用于通常经过认证的平滑版本的通用图像分类模型。为了克服这个问题，我们提出了一种使用浮点精度的合理方法来进行随机平滑的方法，其速度基本上相等，并匹配标准的标准分类器的标准练习证书，用于迄今为止测试的标准分类器。我们唯一的假设是我们可以使用公平的硬币。
Randomized smoothing is sound when using infinite precision. However, we show that randomized smoothing is no longer sound for limited floating-point precision. We present a simple example where randomized smoothing certifies a radius of $1.26$ around a point, even though there is an adversarial example in the distance $0.8$ and extend this example further to provide false certificates for CIFAR10. We discuss the implicit assumptions of randomized smoothing and show that they do not apply to generic image classification models whose smoothed versions are commonly certified. In order to overcome this problem, we propose a sound approach to randomized smoothing when using floating-point precision with essentially equal speed and matching the certificates of the standard, unsound practice for standard classifiers tested so far. Our only assumption is that we have access to a fair coin.
