首个针对DEQ的随机平滑认证方法，大幅加速认证且保持精度
Certified Robustness for Deep Equilibrium Models via Serialized Random Smoothing
- 提出序列化随机平滑（SRS），复用历史信息降低计算冗余
- 在图像识别任务中实现最高7倍加速，认证精度几乎不变
- 适用于大规模数据集，突破传统方法的架构与规模限制
隐式模型如深度平衡模型（DEQ）已成为构建深度神经网络的有前景替代方案。由于安全问题，其可认证鲁棒性受到越来越多关注。现有针对DEQ的确定性认证方法（如区间边界传播和Lipschitz界）无法在大规模数据集上进行认证，且仅适用于特定形式的DEQ。本文首次提出针对DEQ的随机平滑可认证防御，解决上述局限。研究发现，直接对DEQ应用随机平滑虽可推广至大规模数据集并提供可认证鲁棒性，但计算成本极高。为此，我们提出一种新颖的序列化随机平滑（SRS）方法，利用历史信息减少计算冗余，并推导出新的认证半径估计以理论上保证算法正确性。在图像识别任务上的大量实验与消融研究显示，该方法可将DEQ的认证速度提升高达7倍，几乎不牺牲认证准确率。代码已开源。
原文摘要 · Abstract (English)
Implicit models such as Deep Equilibrium Models (DEQs) have emerged as promising alternative approaches for building deep neural networks. Their certified robustness has gained increasing research attention due to security concerns. Existing certified defenses for DEQs employing deterministic certification methods such as interval bound propagation and Lipschitz-bounds can not certify on large-scale datasets. Besides, they are also restricted to specific forms of DEQs. In this paper, we provide the first randomized smoothing certified defense for DEQs to solve these limitations. Our study reveals that simply applying randomized smoothing to certify DEQs provides certified robustness generalized to large-scale datasets but incurs extremely expensive computation costs. To reduce computational redundancy, we propose a novel Serialized Randomized Smoothing (SRS) approach that leverages historical information. Additionally, we derive a new certified radius estimation for SRS to theoretically ensure the correctness of our algorithm. Extensive experiments and ablation studies on image recognition demonstrate that our algorithm can significantly accelerate the certification of DEQs by up to 7x almost without sacrificing the certified accuracy. Our code is available at https://github.com/WeizhiGao/Serialized-Randomized-Smoothing.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。