Abstract
We show a hardness result for random smoothing to achieve certified adversarial robustness against attacks in the ℓ_p ball of radius ε when p>2. Although random smoothing has been well understood for the ℓ₂ case using the Gaussian distribution, much remains unknown concerning the existence of a noise distribution that works for the case of p>2. This has been posed as an open problem by Cohen et al. (2019) and includes many significant paradigms such as the ℓ_∞ threat model. In this work, we show that any noise distribution D over R^d that provides ℓ_p robustness for all base classifiers with p>2 must satisfy Eη_i²=Ω(d^1-2/pε²(1-δ)/δ²) for 99% of the features (pixels) of vector η∼D, where ε is the robust radius and δ is the score gap between the highest-scored class and the runner-up. Therefore, for high-dimensional images with pixel values bounded in [0,255], the required noise will eventually dominate the useful information in the images, leading to trivial smoothed classifiers.