Research map / Adversarial robustness and security / Certified and empirical robustness
Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes cost-sensitive certified radii on top of randomized smoothing, with a Monte Carlo certification algorithm and a margin-based cost-sensitive training method (Margin-CS) that improves certified cost-sensitive robustness on CIFAR-10, Imagenette, and HAM10k.
Problem
Adversarial robustness treats all misclassifications equally, but in many applications some adversarial class transitions are much more costly; existing cost-sensitive robustness methods are heuristic or do not scale to deep networks and large perturbations.
Approach
Defines groupwise and pairwise cost-sensitive certified radii under randomized smoothing that are at least as large as the standard certified radius, uses union-bound-based confidence bounds to tighten certificates for cost-sensitive target sets, and trains with a margin loss that applies thresholded radius maximization to sensitive and non-sensitive subpopulations.
Key results
- On CIFAR-10 S-Pair (sigma=0.5), Margin-CS reaches 92.4% certified cost-sensitive robustness versus 50.4% for Gaussian and 58.0% for SmoothMix, with 67.3% certified accuracy.
- On Imagenette M-Seed, Margin-CS achieves 72.0% Rob_cs versus 58.9% for Gaussian, with a lower robust cost (2.46 vs 3.86).
- On HAM10k, Margin-CS raises certified cost-sensitive robustness to 34.4% from 21.1% for MACER while keeping 83.2% accuracy.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Margin-CS instead of SmoothAdv-CS | CIFAR-10 S-Seed · CIFAR-10 S-Seed | certified cost-sensitive robustness (%): 53.5 -> 54.8 | Helped |
| Use Margin-CS instead of SmoothAdv-CS | CIFAR-10 M-Seed · CIFAR-10 M-Seed | certified cost-sensitive robustness (%): 43.3 -> 46.8 | Helped |
| Use Margin-CS instead of Gaussian-CS | CIFAR-10 S-Pair · CIFAR-10 S-Pair | certified cost-sensitive robustness (%): 72.3 -> 92.4 | Helped |
| Use Margin-CS instead of Gaussian-CS | CIFAR-10 M-Pair · CIFAR-10 M-Pair | certified cost-sensitive robustness (%): 64.3 -> 80.4 | Helped |
| Use Margin-CS instead of Gaussian-CS | Imagenette S-Seed · Imagenette S-Seed | certified cost-sensitive robustness (%): 73.3 -> 81.1 | Helped |
| Use Margin-CS instead of SmoothAdv-CS | Imagenette S-Pair · Imagenette S-Pair | certified cost-sensitive robustness (%): 90.7 -> 94.7 | Helped |
| Use Margin-CS instead of Gaussian-CS | Imagenette M-Pair · Imagenette M-Pair | certified cost-sensitive robustness (%): 83.0 -> 86.3 | Helped |
| Use Margin-CS instead of SmoothAdv-CS | HAM10k · HAM10k | certified cost-sensitive robustness (%): 21.7 -> 34.4 | Helped |
| Use Margin-CS instead of [cite] | CIFAR-10 S-Pair (σ=0.25) · CIFAR-10 S-Pair (σ=0.25) | certified cost-sensitive robustness (%): 92.4 -> 93.5 | Helped |
| Use Margin-CS instead of [cite] | CIFAR-10 M-Pair (1,1,10) (σ=0.25) · CIFAR-10 M-Pair (1,1,10) (σ=0.25) | certified robustness cost: 2.78 -> 2.39 | Helped |
| Use Margin-CS instead of Gaussian-CS | CIFAR-10 M-Pair (1,1,2) (σ=0.25) · CIFAR-10 M-Pair (1,1,2) (σ=0.25) | certified robustness cost: 1.27 -> 0.93 | Helped |
| Optimize certified radius with targeted subgroup thresholding rather than using baseline training | Margin-CS on benchmark and medical datasets · CIFAR-10, Imagenette, HAM10k | certified cost-sensitive robustness | Helped |
Surprising findings
- Standard randomized smoothing radius can occasionally exceed the cost-sensitive group radius when the cost set includes the runner-up class (less than 20% of cases in the reported table).
Limitations
- Worst-case certification cost scales quadratically with the number of classes.
- Convex relaxation baseline is more precise but does not scale to large datasets; the proposed method is conservative due to randomized smoothing.
- Cost-sensitive baselines are adapted via reweighting, which the authors note is restricted.
Experimental setup
Datasets: CIFAR-10 Imagenette ImageNet HAM10k
Benchmarks: CIFAR-10 Imagenette HAM10k
Metrics: certified cost-sensitive robustness certified robust cost certified overall accuracy precision recall
Baselines: Gaussian SmoothAdv SmoothMix MACER Gaussian-CS SmoothAdv-CS SmoothMix-CS convex relaxation cost-sensitive certification method
Builds on: randomized smoothing MACER SmoothAdv SmoothMix Gaussian data augmentation
Closest papers by meaning
- Cost-Sensitive Robustness against Adversarial Examples (ICLR 2019 · similarity 0.94)
- Certified Adversarial Robustness with Additive Noise (NeurIPS 2019 · similarity 0.92)
- Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Framework (NeurIPS 2020 · similarity 0.91)
- On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · similarity 0.90)
- Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustness (NeurIPS 2024 · similarity 0.89)
- Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.