Skip to yearly menu bar Skip to main content


In-Person Poster presentation / poster accept

(Certified!!) Adversarial Robustness for Free!

Nicholas Carlini · Florian Tramer · Krishnamurthy Dvijotham · Leslie Rice · Mingjie Sun · Zico Kolter

MH1-2-3-4 #140

Keywords: [ Deep Learning and representational learning ]


Abstract:

In this paper we show how to achieve state-of-the-art certified adversarial robustness to 2-norm bounded perturbations by relying exclusively on off-the-shelf pretrained models. To do so, we instantiate the denoised smoothing approach of Salman et al. by combining a pretrained denoising diffusion probabilistic model and a standard high-accuracy classifier. This allows us to certify 71% accuracy on ImageNet under adversarial perturbations constrained to be within a 2-norm of 0.5, an improvement of 14 percentage points over the prior certified SoTA using any approach, or an improvement of 30 percentage points over denoised smoothing. We obtain these results using only pretrained diffusion models and image classifiers, without requiring any fine tuning or retraining of model parameters.

Chat is not available.