@inproceedings{salman2020denoised,
author = {Salman, Hadi and Sun, Mingjie and Yang, Greg and Kapoor, Ashish and Kolter, J. Zico},
title = {Denoised Smoothing: A Provable Defense for Pretrained Classifiers},
organization = {ACM},
booktitle = {NeurIPS 2020},
year = {2020},
month = {September},
abstract = {We present a method for provably defending any pretrained image classifier against ℓp adversarial attacks. This method, for instance, allows public vision API providers and users to seamlessly convert pretrained non-robust classification services into provably robust ones. By prepending a custom-trained denoiser to any off-the-shelf image classifier and using randomized smoothing, we effectively create a new classifier that is guaranteed to be ℓp-robust to adversarial examples, without modifying the pretrained classifier. Our approach applies to both the white-box and the black-box settings of the pretrained classifier. We refer to this defense as denoised smoothing, and we demonstrate its effectiveness through extensive experimentation on ImageNet and CIFAR-10. Finally, we use our approach to provably defend the Azure, Google, AWS, and ClarifAI image classification APIs. Our code replicating all the experiments in the paper can be found on GitHub.},
url = {http://approjects.co.za/?big=en-us/research/publication/denoised-smoothing-a-provable-defense-for-pretrained-classifiers/},
}