Hierarchical Randomized Smoothing

Real-world data is complex and often consists of objects that can be decomposed into multiple entities (e.g. images into pixels, graphs into interconnected nodes). Randomized smoothing is a powerful framework for making models provably robust against small changes to their inputs - by guaranteeing robustness of the majority vote when randomly adding noise before classification. Yet, certifying robustness on such complex data via randomized smoothing is challenging when adversaries do not arbitrarily perturb entire objects (e.g. images) but only a subset of their entities (e.g. pixels). As a solution, we introduce hierarchical randomized smoothing: We partially smooth objects by adding random noise only on a randomly selected subset of their entities. By adding noise in a more targeted manner than existing methods we obtain stronger robustness guarantees while maintaining high accuracy. We initialize hierarchical smoothing using different noising distributions, yielding novel robustness certificates for discrete and continuous domains. We experimentally demonstrate the importance of hierarchical smoothing in image and node classification, where it yields superior robustness-accuracy trade-offs. Overall, hierarchical smoothing is an important contribution towards models that are both - certifiably robust to perturbations and accurate.

Paper

Similar papers

Peer review

Reviewer BgsW6/10 · confidence 4/52023-06-16

Summary

The paper proposes a new threat model for the adversarial robustness - intersection of $\ell_0$ and $\ell_2$ ones where the $\ell_0$ is measured as the number of modified rows of a matrix. To certify robustness to this threat models, the authors propose a variant of randomized smoothing - hierarchical smoothing scheme. First, some rows are selected at random and then they are smoothed with Gaussian smoothing. Robustness certificate is provided for this kind of smoothing distribution and the superiority over baselines is demonstrated on some graph-network tasks.

Strengths

* The paper proposes a new threat model that makes sense for modeling adversaries on graphs. * The proposed certification method on this threat model (actually intersection of threat models) outperforms the baselines (methods designed for the individual threat models). In general, this would be enough for me to vote for acceptance, however there are some problems as I list below.

Weaknesses

* The technical novelty of the paper is limited; the paper focuses on a new threat model - an intersection of two standard threat models $\ell_0$ and $\ell_2$ - and the provided certification method is randomized smoothing where the smoothing distribution is essentially a product of the distribution used for $\ell_0$ (random mask) and $\ell_2$ (Gaussian noise). The certification is then analogical to (Cohen et al.). * Please check all the claims if they actually say what you want to say. There are two main problems here - you consider a fixed $\hat{X}$ and provide certificate with respect to this particular point (e.g., in Coro 1 and also in the text.) whereas you obviously want to certify robustness to all points within this distance. And second, you assume that the perturbed point is at $\ell_0$ distance $r$ while it should be at a distance at most $r$ (e.g., lines 142-144 and from this point on). These things should be very easy to fix to make it correct, but now it is just lax and wrong at places and it is the reason for the rejection at this point. **If this is fixed, then the paper becomes borderline acceptable for me**. * The exposition is maybe unnecessarily complicated. The actual mathematical machinery performed in the paper boils down to decomposing the smoothing distribution as a mixture of two distributions (over $R_1, R_2$ or $R_2,R_3$ respectively in Propo 2) and then the NP lemma to two Gaussians is used for the distributions over $R_2$ (This is the standard NP-certification of (Cohen et al.)). It takes quite some effort to even understand "what is done" in the paper before I can focus on "why does it work". I suggest the authors to provide a pseudocode (e.g., as in (Cohen et al.)). ### minor * The method has some parameters, but there is no suggestion on how to select them. They are selected randomly here and one can see a huge variance in the performance. * The datasets are not explained. E.g., their dimensionality and rande of values. The discrete dataset contain some new parameters here but they are unexplained ($r_d, r_a, p_d, p_a..$)

Questions

-

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

2 fair

Presentation

2 fair

Contribution

2 fair

Limitations

-

Reviewer u4ou4/10 · confidence 2/52023-07-06

Summary

A randomized smoothing based robust certification approach is presented for machine learning under test-time/inference attacks, when only a subset of data is under attack e.g. a subset of nodes in graphical data. Robustness certificates are derived for discrete and continuous domains, and empirically certified and clean accuracies are computed and compared with prior work for certified robustness for graph neural networks (GNNs).

Strengths

- The studied GNN model where only a subset of nodes of the graph may be attacked by the adversary is interesting and of practical significance. - The proposed robust certification approach could achieve better trade-off of clean and certified accuracy than existing approaches.

Weaknesses

- The overall approach seems like a simple extension to (Cohen et al. 2019), with a suitable adjustment factor $1-\Delta$ in the analysis corresponding to selecting a subset of rows. The theoretical analysis also follows similar arguments and it is not clear if any novel insights are obtained. - A key tuning parameter for the approach is $p$, it is not clear how to set $p$ in a principled way. - Missing several closely related prior research works e.g. [1] and [2]. - Results seem specific to bounded $\ell_2$ norm attacks. [1] Wang, Binghui, Jinyuan Jia, Xiaoyu Cao, and Neil Zhenqiang Gong. "Certified robustness of graph neural networks against adversarial structural perturbation." In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp. 1645-1653. 2021. [2] Gao, Zhidong, Rui Hu, and Yanmin Gong. "Certified robustness of graph classification against topology attack with randomized smoothing." In GLOBECOM 2020-2020 IEEE Global Communications Conference, pp. 1-6. IEEE, 2020.

Questions

- What is $\alpha$ in line 82? How is its value related to the certificates? - Why is the noise applied independently to all matrix entries (e.g. line 97)? - How do the theoretical results compare to Scholten et al. 2022? - If $r=N$, i.e. all rows are under attack, how do current certificates compare to previously known certificates?

Rating

4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

2 fair

Presentation

2 fair

Contribution

2 fair

Limitations

The authors could investigate further the limitations of the proposed approach and add a discussion.

Reviewer 7yDS7/10 · confidence 4/52023-07-06

Summary

The paper introduces a new variant of the randomized smoothing algorithm for certified robustness. The paper considers the setting where the input data is split into multiple parts or sites (e.g., a graph) and an adversary can perturb at most $r$ sites at the same time. To obtain robustness certificates for this setting, the authors introduce hierarchical randomized smoothing. In standard randomized smoothing (Gaussian) noise is added to the input, a classification model is evoked on the noisy input, and the lost likely output class is taken as the final prediction. In practice this is done via Monte Carlo estimate: Noise is sampled multiple times and the majority vote is returned. Hierarchical randomized smoothing mimics this process but splits the sampling of the noise into two steps: i) first a random indicator variable determining the affected sites is sampled, ii) noise is added to those sites as before. To obtain a guarantee in this setting, the theoretical derivation combines the standard form for randomized smoothing for continuous (Gaussian) with a variant for discrete noise. Ultimately, this approach recovers the same certificate as the standard randomized smoothing algorithm, up to a scaling factor depending on the number of sites that can be perturbed at the same time, thus allowing for improvements.

Strengths

- Strong and original contribution - Well written - Rigorous mathematical derivation - Good empirical results

Weaknesses

I have no major concerns, other than maybe the applicability of the threat model considered in the paper (see questions). However, I have some minor comments mostly on the presentation of the paper: - In the example around line 153, I found the set $\mathcal{R}_0$ confusing as the explanation only comes on the next page. - Similarly the construction of Propositions 1 and 2 might be easier to follow if it was visualized.

Questions

- Does row selection $p$ need to be uniform? What is the impact on the certificate if it is used to encode a prior on the likelihood of change/attack for different part.s - Can you further comment on the threat model? Not mathematically, but rather on the settings in which the proposed combination of LP-constraints over $r$ site changes is applicable.

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

4 excellent

Presentation

3 good

Contribution

3 good

Limitations

Limitations and broader impact are adequately discussed in the paper.

Reviewer FfTs6/10 · confidence 4/52023-07-07

Summary

This paper proposes hierarchical randomized smoothing, a variant of randomized smoothing that not only randomly perturbs input data at test time but also randomly selects which rows of the input to perturb. This is motivated by a threat model in which an adversary only selects a subset of rows of matrix-valued data to attack. The authors show that their hierarchical smoothing scheme inherits certified robustness by the lower-level smoothing scheme used (i.e., the randomization method on the rows to be perturbed), and also show that the hierarchical scheme generalizes randomized ablation (random masking of elements rather than random additive noise). Experiments are conducted on benchmark node classification datasets that show the increased certification power over prior smoothing methods that do not account for the row-selection limitations of the adversary.

Strengths

1. The paper is easy to follow, well-written, and appears to have some nice novel ideas for exploiting the structure of adversarial attacks on graph neural networks and related "hierarchical" models in order to get tighter robustness certificates than structure-blind methods. 2. It is interesting that the proposed approach generalizes both conventional additive noise certificates as well as ablation (masking) certificates. 3. The proposed hierarchical approach seems to be quite modular, allowing for new lower-level certification methods to be incorporated as they are developed in the future.

Weaknesses

See below "Questions."

Questions

1. In my opinion, the overarching structure of the paper could be improved. I'd recommend moving the Discussion section to the end of the paper with the Conclusion, and also moving at least the more "general" parts of the Related Work section to the end of the Introduction. 2. Line 276: "discrete, binary features: $\mathcal{X} = [0,1]$." Do you mean $\mathcal{X} = \\{0,1\\}$? 3. Line 302: Should "(2) evaluating certificates" be "(3)"? 4. The experimental comparisons seem a bit misleading. In particular, you are not making an entirely fair comparison to conventional RS, since those certificates are tailored to threat models where the adversary has access to perturb every entry in your input data. It is therefore no surprise that your certified radii are larger, since you are considering a weaker adversary altogether. How do your certificates perform in the extreme case where the adversary does have access to all entries in the matrix? Do your certificates still outperform conventional RS?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

N/A.

Reviewer 7yDS2023-08-11

Reply

I thank the authors for their rebuttal. I greatly appreciate the new Figure. With regards to Question 1: My suggestion was not (necessarily) to make the distribution data-dependent, which I few as quite problematic, but rather have a non-uniform a-priory p for all notes depending on some key property of the graph/nodes that the adversary does not control. Especially in a distributed setting (as might be realistic for many of the discussed scenarios), certain nodes may depend more or less on external input and therefore might be exposed to differing levels of attacks.

Authorsrebuttal2023-08-14

Response to Reviewer 7yDS

Thank you for your response! Regarding question 1 $-$ In general we can use a non-uniform $p$: Let $p_i$ denote a node-specific (non-uniform) selection probability for node $i$ that the adversary does not control. To get robustness certificates we have to make the worst-case assumption, i.e. the nodes with lowest selection probability will be attacked first by the adversary. For the certificate this means we have to find the largest possible $\Delta$ (compare Theorem 1). Specifically, we have to choose $\Delta = 1-\prod_{i\in\mathcal{I}} p_i$ where $\mathcal{I}$ contains the indices $i$ of the $r$ smallest probabilities $p_i$. Then we can proceed as in our paper to compute certificates for the smoothing distribution with non-uniform $p$. If we additionally know that certain nodes will be attacked before other nodes, we do not have to consider the first $r$ nodes with smallest $p_i$ but rather the first $r$ nodes with smallest $p_i$ under an attack order. This can be useful for example if one cluster of nodes is attacked before another, then we can increase the selection probability for nodes in the first cluster and obtain stronger certificates. As you suggested in your response, some nodes might be exposed to different levels of attacks than others. Here, making the lower-level smoothing distribution node-specific might also be beneficial: This would allow us to add less noise for nodes that are less exposed to attacks, potentially leading to even better robustness-accuracy trade-offs. We will add this discussion to the paper. Please let us know if you have any additional comments or questions.

Reviewer FfTs2023-08-12

I thank the authors for their responses and updates to the paper. To better motivate your threat model, you should consider citing [3] in the paper, which I did not see in the original submission. Given the unsurprising comparison to conventional RS (which is designed for a more general threat model), I maintain my original score. Are there no other certification techniques (perhaps even non-smoothing based ones) that directly consider your specific threat model?

Authorsrebuttal2023-08-14

Response to Reviewer FfTs

Thank you for your response, we will add the citation to the revised paper. So far there are no robustness certificates specifically designed against our threat model, which again motivates the need for our certificates and the novelty of our method. Please consider that there are also no non-smoothing certificates against our threat model. We therefore demonstrate Pareto-optimality of our method when compared to the three existing state-of-the-art baselines for robustness certification of graph neural networks.

Reviewer u4ou2023-08-14

Reply to rebuttal

Thank you for the detailed response. In particular, thanks for providing the clarifications for my questions. Overall, there are a lot of edits needed to improve the readability of the theoretical results and make the paper ready for publication in my opinion. Also further related work needs to be discussed (e.g. [4] and [6] in the rebuttal) and compared with. This is particularly important since the work proposes a new attack model for GNNs.

Authorsrebuttal2023-08-16

Response to Reviewer u4ou

Thank you for your response! For the revised version of our manuscript, we would be grateful if you could clarify which further edits are needed based on your original review. In response to your questions, we suggested in our rebuttal: - Adding a few clarifications regarding the background of randomized smoothing, and - Including the related work from our discussion. Regarding the works [4] and [6], we are happy to include them in the related work section. However, it is important to point out that these are orthogonal to our core research question. Specifically, [4] represents a negative result concerning input-dependent randomized smoothing (which we do not work on), and [6] proposes an adversarial attack. In contrast, we develop novel robustness certificates.

Reviewer BgsW2023-08-15

Thanks for the response. Regarding the generality of p-norms - I have read the paper two months ago, so I might not recall stuff precisely, but from what I remember, the method basically masks out something and then applies standard $\ell_p$ certification to the rest. Thus, I can use a smoothing distribution of my choice (and the certificates are straightforward as everything is just NP-lemma in one way or the other) in order to provide guarantees I want. If you do something more general than this, I would stress it out in the text. I did not realize that there is no updated pdf, so these changes would be good. With coro 1 I still have the problem that it is stated as a certificate for one point with some failure probability so in order to have a certificate for all the points uniformly, using this corollary I would need to union bound over all points that I clearly don't want; but clearly we can lower bound the probability once and that would work for all the points uniformly (which is exactly what everyone in randomized smoothing does), so I would consider rewriting coro 1 in the way that you don't fix the perturbation, but you state that the result holds for every perturbation. The $r_a, r_b, p_a, p_b$ thing - I checked the pdf again and I could find $r_a, r_b$, but could not find $p_a, p_b$. I am not familiar with the datasets so it is pretty hard to interpret the figures; maybe if there would be link from the captions to description/notation, it would be clearer. Anyway, thanks again for the response, I update me score and the things I wrote are some suggestions that you need not to reflect.

Program Chairsdecision2023-09-21

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC