改进扩散去噪平滑，解决噪声误估导致的鲁棒性下降问题。
Robustifying Diffusion-Denoised Smoothing Against Covariate Shift
- 设计新对抗目标函数，针对扩散模型添加噪声的误估问题
- 在MNIST、CIFAR-10、ImageNet上显著提升认证准确率
- 适合关注图像分类鲁棒性与扩散模型应用的研究者
随机平滑是实现对l2对抗扰动认证鲁棒性的成熟方法。通过在基础分类器前引入去噪器，可无缝集成预训练分类器，且性能损失较小。现有方法中，使用预训练扩散去噪模型作为去噪器的扩散去噪平滑（Diffusion Denoised Smoothing）已达到最先进水平。然而，我们发现采用扩散去噪模型会因噪声估计错误引入协变量偏移，最终降低平滑分类器性能。为此，我们提出一种新的对抗目标函数，聚焦于扩散去噪模型所添加噪声的误差。该方法基于对协变量偏移来源的理解，旨在训练基础分类器以抵御去噪器带来的偏移影响。实验在三个标准分类基准（MNIST、CIFAR-10、ImageNet）上验证了该方法的有效性，显著提升了认证准确率，达到新的最先进水平。代码已公开于https://github.com/ahedayat/Robustifying-DDS-Against-Covariate-Shift。
原文摘要 · Abstract (English)
Randomized smoothing is a well-established method for achieving certified robustness against l2-adversarial perturbations. By incorporating a denoiser before the base classifier, pretrained classifiers can be seamlessly integrated into randomized smoothing without significant performance degradation. Among existing methods, Diffusion Denoised Smoothing - where a pretrained denoising diffusion model serves as the denoiser - has produced state-of-the-art results. However, we show that employing a denoising diffusion model introduces a covariate shift via misestimation of the added noise, ultimately degrading the smoothed classifier's performance. To address this issue, we propose a novel adversarial objective function focused on the added noise of the denoising diffusion model. This approach is inspired by our understanding of the origin of the covariate shift. Our goal is to train the base classifier to ensure it is robust against the covariate shift introduced by the denoiser. Our method significantly improves certified accuracy across three standard classification benchmarks - MNIST, CIFAR-10, and ImageNet - achieving new state-of-the-art performance in l2-adversarial perturbations. Our implementation is publicly available at https://github.com/ahedayat/Robustifying-DDS-Against-Covariate-Shift
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。