Intriguing Properties of Input-dependent Randomized Smoothing

arXiv:2110.05365v3 Announce Type: replace
Abstract: Randomized smoothing is currently considered the state-of-the-art method to obtain certifiably robust classifiers. Despite its remarkable performance, the method is associated with various serious problems such as "certified accuracy waterfalls", certification vs.\ accuracy trade-off, or even fairness issues. Input-dependent smoothing approaches have been proposed with intention of overcoming these flaws. However, we demonstrate that these methods lack formal guarantees and so the resulting certificates are not justified. We show that in general, the input-dependent smoothing …

abstract accuracy art arxiv certification classifiers cs.ai cs.lg fairness performance robust state stat.ml trade trade-off type