Timezone: »

 
Poster
Certified Defense to Image Transformations via Randomized Smoothing
Marc Fischer · Maximilian Baader · Martin Vechev

Tue Dec 08 09:00 AM -- 11:00 AM (PST) @ Poster Session 1 #314
in Poster Session 2 »
We extend randomized smoothing to cover parameterized transformations (e.g., rotations, translations) and certify robustness in the parameter space (e.g., rotation angle). This is particularly challenging as interpolation and rounding effects mean that image transformations do not compose, in turn preventing direct certification of the perturbed image (unlike certification with $\ell^p$ norms). We address this challenge by introducing three different defenses, each with a different guarantee (heuristic, distributional and individual) stemming from the method used to bound the interpolation error. Importantly, in the individual case, we show how to efficiently compute the inverse of an image transformation, enabling us to provide individual guarantees in the online setting. We provide an implementation of all methods at https://github.com/eth-sri/transformation-smoothing.

Author Information

Marc Fischer (ETH Zurich)
Maximilian Baader (ETH Zürich)
Martin Vechev (ETH Zurich, Switzerland)

More from the Same Authors