Hidden Cost of Randomized Smoothing



Published on


The fragility of modern machine learning models has drawn a considerable amount of attention from both academia and the public. While immense interests were in either crafting adversarial attacks as a way to measure the robustness of neural networks or devising worst-case analytical robustness verification with guarantees, few methods could enjoy both scalability and robustness guarantees at the same time. As an alternative to these attempts, randomized smoothing adopts a different prediction rule that enables statistical robustness arguments which easily scale to large networks. However, in this paper, we point out the side effects of current randomized smoothing workflows. Specifically, we articulate and prove two major points: 1) the decision boundaries of smoothed classifiers will shrink, resulting in disparity in class-wise accuracy; 2) applying noise augmentation in the training process does not necessarily resolve the shrinking issue due to the inconsistent learning objectives.

This paper has been published at AISTATS 2021

Please cite our work using the BibTeX below.

      title={Hidden Cost of Randomized Smoothing}, 
      author={Jeet Mohapatra and Ching-Yun Ko and Tsui-Wei and Weng and Sijia Liu and Pin-Yu Chen and Luca Daniel},
Close Modal