Top-k predictions are used in many real-world applications such as machine
learning as a service, recommender systems, and web searches. β0β-norm
adversarial perturbation characterizes an attack that arbitrarily modifies some
features of an input such that a classifier makes an incorrect prediction for
the perturbed input. β0β-norm adversarial perturbation is easy to
interpret and can be implemented in the physical world. Therefore, certifying
robustness of top-k predictions against β0β-norm adversarial
perturbation is important. However, existing studies either focused on
certifying β0β-norm robustness of top-1 predictions or β2β-norm
robustness of top-k predictions. In this work, we aim to bridge the gap. Our
approach is based on randomized smoothing, which builds a provably robust
classifier from an arbitrary classifier via randomizing an input. Our major
theoretical contribution is an almost tight β0β-norm certified robustness
guarantee for top-k predictions. We empirically evaluate our method on
CIFAR10 and ImageNet. For instance, our method can build a classifier that
achieves a certified top-3 accuracy of 69.2\% on ImageNet when an attacker can
arbitrarily perturb 5 pixels of a testing image