Accelerated Robustness Certification for Diffusion Denoised Smoothing Based on Image Super-Resolution

While diffusion denoised smoothing (DDS) achieves excellent certified defense performance under <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$l_{2}$</tex> norm bounded perturbations, we find that DDS is vulnerable to image up-sampling. The bicubic interpolation used in DDS reduces the classification accuracy of the base classifier, thereby weakening its certified robustness. As an alternative, we introduce image super-resolution technology to compensate for the loss of detail or unrealistic content generated by interpolated images, thereby improving the classification accuracy while adapting to the input size required by classifier, but with some additional time cost. Therefore, in this paper, we propose an accelerated certified defense for enhancing DDS based on image super-resolution. By adaptively reducing the certified sample size according to input features to achieve cost-effectiveness for robustness certification, and as the base classifier's predictions are more accurate on super-resolution images than on interpolated images, our proposed method can quickly and effectively enhance certified defense performance based on DDS. Experimental results show that we achieve a top-1 certified accuracy of 56.2% on ImageNet under <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$l_{2}$</tex> bounded perturbation <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\delta=1.0, \mathbf{which}$</tex> is at least 4% higher than the previous diffusion denoised smoothing, and saves nearly 1/3 of the total certified time compared to before.