AI
New Dual Randomized Smoothing Method Breaks Trade-off Between Small and Large Adversarial Perturbations
Researchers introduce an input-dependent noise approach that achieves strong robustness certification across both small and large adversarial attack radii simultaneously.
Randomized Smoothing (RS) is a well-established approach for proving that neural networks can withstand adversarial attacks—small, carefully crafted perturbations designed to fool AI models. However, the technique has a fundamental constraint: no single global noise level works well across both small and large attack radii simultaneously. Smaller noise variance improves performance against modest perturbations, while larger variance is needed to handle bigger attacks.
The Central Problem#
Standard RS uses the same noise variance applied uniformly to all inputs. This creates an unavoidable trade-off: optimizing for robustness at small radii (say, a perturbation of 0.5 pixels) requires one noise level, while achieving strong certified robustness at larger radii (e.g., 1.5 pixels) demands a different one. No single global choice satisfies both requirements well.
A New Framework for Adaptive Noise#
To overcome this limitation, researchers have proposed a dual RS framework that employs input-dependent noise variances—different noise levels tailored to individual inputs. The approach rests on a theoretical finding: randomized smoothing remains mathematically valid when noise variance varies by input, provided the variance stays locally constant in the neighborhood around each input point.
The framework operates in two stages:
- A variance estimator predicts the optimal noise level for each input
- A standard RS classifier applies that estimated variance to certify robustness
Crucially, the variance estimator itself is also smoothed via randomized smoothing, ensuring the required local constancy property.
Experimental Gains#
On CIFAR-10, the dual RS method shows substantial improvements over prior input-dependent approaches:
- 15.6% accuracy gain at a perturbation radius of 0.5
- 20.0% accuracy gain at radius 0.75
- 15.7% accuracy gain at radius 1.0
The method maintains effectiveness on larger datasets too: ImageNet experiments demonstrate advantages of 8.6% at radius 0.5, 17.1% at radius 1.0, and 9.1% at radius 1.5. The computational cost is modest—only a 60% inference overhead compared to standard RS.
