Question: Can you provide more discussion to explain the reason behind the effectiveness of the proposed method?
Evidence: In recent years, there has been a significant amount of work that studies and improves both adversarial and certified robustness of neural networks. However, currently, there are two key limitations that hinder the wider adoption of robust models in practice.
Existing Models are Robustly Inaccurate First, despite substantial progress in training robust models, existing works usually only report robust accuracy, i.e., samples for which the model robustly predicts the correct label. Meanwhile, the issue of robust inaccuracy, i.e., samples that are robustly misclassified with a wrong label, is usually not even reported (we formally define robust inaccuracy in Equation). This is especially problematic for safety-critical models, where the robustness can be mistakenly used as a safety argument. We quantify the severity of this issue in Table, by evaluating recent state-of-the-art robust models. As can be seen, recent models contain up to 15% of robust inaccurate samples and the ratio of such samples worsens with smaller perturbation regions. Table: Percentage of robust and inaccurate samples for various recent robust models and datasets, which we describe in more detail in Section 7. Each model is trained for the indicated threat model and evaluated using 40-step APGD ., and our training L ERA (Equation). In this case, our training achieves the same robust accuracy as L TRADES but avoids all robust inaccurate samples by making them non-robust. Note that all three models predict over all three classes, however, the decision regions for class 2 of the L TRADES and L ERA trained models happen to be too small to be visible. The considered model architecture and the training hyperparameters are provided in Appendix A.2.
Robustness vs Accuracy Tradeoff Second, existing robust training methods improve the model robustness, but they also typically degrade the standard accuracy on unperturbed inputs. To address this limitation, a number of recent works study this issue in detail and propose new methods to mitigate it.
In this work, we advance the line of work that aims to boost robustness without sacrificing accuracy, but we approach the problem from a new perspective -by avoiding robust inaccuracy.
Concretely, we propose a new training method that jointly maximizes robust accuracy while minimizing robust inaccuracy. We illustrate the effect of our training on a synthetic dataset (described in Appendix A.2) in Figure, showing the decision boundaries of three models, trained using standard training L std , adversarial training L TRADES, and our training L ERA (Equation). First, observe that while the L std trained model achieves 100% accuracy, only 91.1% of these samples are robust (and accurate). When using L TRADES , we can observe the robustness vs accuracy tradeoffthe robust accuracy improves to 98.4% at the expense of 1.6% (robust) inaccuracy. In contrast, using our L ERA , we retain the high robust accuracy of 98.4% but avoid all robust inaccurate samples by appropriately shifting the decision boundary, rendering them non-robust.
Second, since our models are trained to be robust only if they are accurate, we leverage robustness as a principled abstain mechanism. This abstain mechanism then allows us to combine models in a compositional architecture that significantly boosts overall robustness without sacrificing accuracy. Concretely, in Figure, we would define a selector model that abstains on all non-robust samples. Then, the abstained (non-robust) samples are evaluated by the standard trained model L std , while the selected samples are evaluated using the robust model L ERA . This allows us to achieve the best of both models -high robust accuracy (98.4%), high natural accuracy (100%), and no robust inaccuracy.
We show the practical effectiveness of our approach by instantiating over several datasets and existing robust models for both empirical and certified robustness. Our evaluations show that our method effectively reduces robust and inaccurate samples by up to 97.28%. Further, our approach significantly improves robustness for CIFAR-10, CIFAR-100, MTSD and SBB datasets by 60.3%, 38.8%, 29.2% and 37.7%, respectively, while simultaneously decreasing natural accuracy by only 0.2%.
Figure 1: Decision regions for models trained via standard training Lstd, adversarial training LTRADES (Zhang et al., 2019a), and our training LERA (Equation 5). In this case, our training achieves the same robust accuracy as LTRADES but avoids all robust inaccurate samples by making them non-robust. Note that all three models predict over all three classes, however, the decision regions for class 2 of the LTRADES and LERA trained models happen to be too small to be visible. The considered model architecture and the training hyperparameters are provided in Appendix A.2.
Answer: We have included some intuition behind our method in Figure 1. It shows a synthetic example that illustrates deficiencies of both standard training and adversarial training. The effectiveness of our work lies in combining the strengths of both by ensembling natural and robust models into one, with the goal of retaining the accuracy while improving the robustness. The key challenge lies in how these models should be combined, which we address by using robustness as a principled selection (abstain) mechanism. We hypothesize that empirically, the robust inaccurate samples lie in regions that are close by in the learned manifold, thus regularizing them to become even slightly non-robust generalizes well.