SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Jongheon Jeong Jinwoo Shin
{jongheonj, jinwoos}@kaist.ac.kr
Along with recent diffusion models, randomized smoothing has become one of a few tangible approaches that offers adversarial robustness to models at scale, e.g., those of large pre-trained models. Specifically, one can perform randomized smoothing on any classifier via a simple "denoise-and-classify" pipeline, so-called denoised smoothing, given that an accurate denoiser is available – such as diffusion model. In this paper, we present scalable methods to address the current trade-off between certified robustness and accuracy in denoised smoothing. Our key idea is to "selectively" apply smoothing among multiple noise scales, coined multi-scale smoothing, which can be efficiently implemented with a single diffusion model. This approach also suggests a new objective to compare the collective robustness of multi-scale smoothed classifiers, and questions which representation of diffusion model would maximize the objective. To address this, we propose to further fine-tune diffusion model (a) to perform consistent denoising whenever the original image is recoverable, but (b) to generate rather diverse outputs otherwise. Our experiments show that the proposed multi-scale smoothing scheme, combined with diffusion fine-tuning, not only allows strong certified robustness at high noise scales but also maintains accuracy close to non-smoothed classifiers. Code is available at https://github.com/jh-jeong/smoothing-multiscale.
Arguably, one of the important lessons in modern deep learning is the effectiveness of massive data and model scaling [38, 74], which enabled many breakthroughs in recent years [8, 53, 55, 7]. Even with the largest amount of data available on the web and computational budgets, however, the worst-case behaviors of deep learning models are still challenging to regularize. For example, large language models often leak private information in training data [10], and one can completely fool superhuman-level Go agents with few meaningless moves [40]. Such unintentional behaviors can be of critical concerns in deploying deep learning into real-world systems, and the risk has been increasing as the capability of deep learning continues to expand.
In this context, adversarial robustness [61, 9] has been a seemingly-close milestone towards reliable deep learning. Specifically, neural networks are even fragile to small, "imperceptible" scales of noise when it comes to the worst-case, and consequently there have been many efforts to obtain neural networks that are robust to such noise [47, 3, 75, 15, 65]. Although it is a reasonable premise that we humans have an inherent mechanism to correct against adversarial examples [21, 26], yet so far the threat still persists in the context of deep learning, e.g., even in recent large vision-language models [48], and is known as hard to avoid without a significant reduction in model performance [66, 64].
Randomized smoothing [41, 15], the focus in this paper, is currently one of a few techniques that has been successful in obtaining adversarial robustness from neural networks. Specifically, it constructs a smoothed classifier by taking a majority vote from a "base" classifier, e.g., a neural network, over random Gaussian input noise. The technique is notable for its provable guarantees on adversarial
(a) Cascaded smoothing
(b) Diffusion calibration
Figure 1: An overview of the proposed approaches, (a) cascaded randomized smoothing (Section 3.2) and (b) diffusion calibration (Section 3.3) to attain a better trade-off between accuracy and certified robustness in randomized smoothing, upon on the recent diffusion denoised smoothing scheme [11].
robustness, i.e., it is a certified defense [44], and its scalability to arbitrary model architectures. For example, it was the first certified defense that could offer adversarial robustness on ImageNet [56]. The scalability of randomized smoothing has further expanded by Salman et al. [58], which observed that randomized smoothing can be applied to any pre-trained classifiers by prepending a denoiser model, dubbed denoised smoothing. Combined with the recent diffusion-based models [31], denoised smoothing could provide the current state-of-the-arts in  $\ell_2$ -certified robustness [11, 69, 44].
Despite its desirable properties, randomized smoothing in practice is also at odds with model accuracy [15], similarly to other defenses [47, 76], which makes it burdening to be applied in the real-world. For example, the variance of Gaussian noise, or smoothing factor, is currently a crucial hyperparameter to increase certified robustness at the cost of accuracy. The fundamental trade-off between accuracy and adversarial robustness has been well-evidenced in the literature [66, 75, 64], but it has been relatively under-explored whether they may or may not be applicable in the context of randomized smoothing. For example, Tramér et al. [64] demonstrate that pursuing  $\varepsilon$ -uniform adversarial robustness in neural networks may increase their vulnerability against invariance attacks, i.e., some semantics-altering perturbations possible inside the  $\varepsilon$ -ball: yet, it is still unclear whether such a vulnerability would be inevitable at non-uniformly robust models such as smoothed classifiers.
In attempt to understand the accuracy-robustness trade-off in randomized smoothing, efforts have been made to increase the certified robustness a given smoothed classifier can provide, e.g., through a better training method [58, 73, 35-37]. For example, Salman et al. [57] have employed adversarial training [47] in the context of randomized smoothing, and Jeong and Shin [35] have proposed to train a classifier with consistency regularization. Motivated by the trade-off among different smoothing factors, some works have alternatively proposed to perform smoothing with input-dependent factors [1, 13, 67]: unfortunately, subsequent works [60, 36] have later shown that such schemes do not provide valid robustness certificates, reflecting its brittleness in overcoming the trade-off.
Contribution. In this paper, we develop a practical method to overcome the current frontier of accuracy-robustness trade-off in randomized smoothing, particularly upon the architectural benefits that the recent diffusion denoised smoothing [11] can offer. Specifically, we first propose to aggregate multiple smoothed classifiers of different smoothing factors to obtain their collective robustness (see Figure 1(a)), which leverages the scale-free nature of diffusion denoised smoothing. In this way, the model can decide which smoothed classifier to use for each input, maintaining the overall accuracy. Next, we fine-tune a diffusion model for randomized smoothing through the "denoise-and-classify" pipeline (see Figure 1(b)), as an efficient alternative of the full fine-tuning of (potentially larger) pretrained classifiers. Here, we identify the over-confidence of diffusion models, e.g., to a specific class given certain backgrounds, as a major challenge towards accurate-yet-robust randomized smoothing, and design a regularization objective to mitigate the issue.
In our experiments, we evaluate our proposed schemes on CIFAR-10 [39] and ImageNet [56], two of standard benchmarks for certified  $\ell_2$ -robustness, particularly considering practical scenarios of applying diffusion denoised smoothing to large pre-trained models such as CLIP [53]. Overall, the
results consistently highlight that (a) the proposed multi-scale smoothing scheme upon the recent diffusion denoised smoothing [11] can significantly improve the accuracy of smoothed inferences while maintaining their certified robustness at larger radii, and (b) our fine-tuning scheme of diffusion models can additively improve the results - not only in certified robustness but also in accuracy - by simply replacing the denoiser model without any further adaptation. For example, we could improve certifications from a diffusion denoised smoothing based classifier by  $30.6\% \rightarrow 72.5\%$  in clean accuracy, while also improving its certified robustness at  $\varepsilon = 2.0$  by  $12.6\% \rightarrow 14.1\%$ . We observe that the collective robustness from our proposed multi-scale smoothing does not always correspond to their individual certified robustness, which has been a major evaluation in the literature, but rather to their "calibration" across models: which opens up a new direction to pursue for a practical use of randomized smoothing.
Adversarial robustness and randomized smoothing. For a given classifier  $f: \mathcal{X} \to \mathcal{Y}$ , where  $\mathbf{x} \in \mathcal{X} \subseteq \mathbb{R}^d$  and  $y \in \mathcal{Y} := \{1, \dots, K\}$ , adversarial robustness refers to the behavior of  $f$  in making consistent predictions at the worst-case perturbations under semantic-preserving restrictions. Specifically, for samples from a data distribution  $(\mathbf{x}, y) \sim p_{\mathrm{data}}(\mathbf{x}, y)$ , it requires  $f(\mathbf{x} + \boldsymbol{\delta}) = y$  for every perturbation  $\boldsymbol{\delta}$  that a threat model defines, e.g., an  $\ell_2$ -ball  $\| \boldsymbol{\delta} \|_2 \leq \varepsilon$ . One of ways to quantify adversarial robustness is to measure the following average minimum-distance of adversarial perturbations [9], i.e.,  $R(f; p_{\mathrm{data}}) := \mathbb{E}_{(\mathbf{x}, y) \sim p_{\mathrm{data}}} \left[ \min_{f(\mathbf{x}') \neq y} \| \mathbf{x}' - \mathbf{x} \|_2 \right]$ .
The essential challenge in achieving adversarial robustness stems from that evaluating this (and further optimizing on it) is usually infeasible. Randomized smoothing [41, 15] bypasses this difficulty by constructing a new classifier  $\hat{f}$  from  $f$  instead of letting  $f$  to directly model the robustness: specifically, it transforms the base classifier  $f$  with a certain smoothing measure, where in this paper we focus on the case of Gaussian distributions  $\mathcal{N}(0,\sigma^2\mathbf{I})$ :
$$
\hat {f} (\mathbf {x}) := \underset {c \in \mathcal {Y}} {\arg \max } \mathbb {P} _ {\delta \sim \mathcal {N} (0, \sigma^ {2} \mathbf {I})} [ f (\mathbf {x} + \boldsymbol {\delta}) = c ]. \tag {1}
$$
Then, the robustness of  $\hat{f}$  at  $(\mathbf{x},y)$ , namely  $R(\hat{f};\mathbf{x},y)$ , can be lower-bounded in terms of the certified radius  $\underline{R} (\hat{f},\mathbf{x},y)$ , e.g., Cohen et al. [15] showed that the following bound holds, which is tight for  $\ell_2$ -adversarial threat models:
$$
R (\hat {f}; \mathbf {x}, y) \geq \sigma \cdot \Phi^ {- 1} \left(p _ {\hat {f}} (\mathbf {x}, y)\right) =: \underline {{R}} (\hat {f}, \mathbf {x}, y), \quad \text {w h e r e} \quad p _ {\hat {f}} (\mathbf {x}, y) := \mathbb {P} _ {\delta} [ f (\mathbf {x} + \boldsymbol {\delta}) = y ], \tag {2}
$$
provided that  $\hat{f} (\mathbf{x}) = y$ , otherwise  $R(\hat{f};\mathbf{x},y)\coloneqq 0$ .<sup>1</sup> Here, we remark that the formula for certified radius is essentially a function of  $p_{\hat{f}}$ , which is the accuracy of  $f(\mathbf{x} + \boldsymbol {\delta})$  over  $\boldsymbol{\delta}$ .
Denoised smoothing. Essentially, randomized smoothing requires  $f$  to make accurate classification of Gaussian-corrupted inputs. A possible design of  $f$  in this regard is to concatenate a Gaussian denoiser, say denoise(\cdot), with any standard classifier  $f_{\mathrm{std}}$ , so-called denoised smoothing [58]:
$$
f (\mathbf {x} + \boldsymbol {\delta}) := f _ {\mathrm {s t d}} (\operatorname {d e n o i s e} (\mathbf {x} + \boldsymbol {\delta})). \tag {3}
$$
Under this design, an ideal denoiser denoise  $(\cdot)$  should "accurately" recover  $\mathbf{x}$  from  $\mathbf{x} + \delta$ , i.e.,  $\mathrm{denoise}(\mathbf{x} + \delta) \approx \mathbf{x}$  (in terms of their semantics to perform classification) with high probability of  $\delta \sim \mathcal{N}(0, \sigma^2 \mathbf{I})$ . Denoised smoothing offers a more scalable framework for randomized smoothing, considering that (a) standard classifiers (rather than those specialized to Gaussian noise) are nowadays easier to obtain in the paradigm of large pre-trained models, and (b) the recent developments in diffusion models [31] has supplied denoisers strong enough for the framework. In particular, Lee [42] has firstly explored the connection between diffusion models and randomized smoothing; Carlini et al. [11] has further observed that latest diffusion models combined with a pre-trained classifier provides a state-of-the-art design of randomized smoothing.
Diffusion models. In principle, diffusion models [59, 31] aims to generate a given data distribution  $p_{\mathrm{data}}(\mathbf{x})$  via an iterative denoising process from a Gaussian noise  $\hat{\mathbf{x}}_T \sim \mathcal{N}(0,T^2\mathbf{I})$  for a certain  $T > 0$ . Specifically, it first assumes the following diffusion process which maps  $p_{\mathrm{data}}$  to  $\mathcal{N}(0,T^2\mathbf{I})$ :  $\mathrm{d}\mathbf{x}_t = \boldsymbol {\mu}(\mathbf{x}_t,t)\mathrm{d}t + \sigma (t)\mathrm{d}\mathbf{w}_t$ , where  $t \in [0,T]$ , and  $\mathbf{w}_t$  denotes the standard Brownian motion. Based
${}^{1}\Phi$  denotes the cumulative distribution function of  $\mathcal{N}(0,1^2)$ .
on this, diffusion models first train a score model  $\mathbf{s}_{\phi}(\mathbf{x},t)\approx \nabla \log p_t(\mathbf{x})$  via score matching [34], and use the model to solve the probabilistic flow from  $\hat{\mathbf{x}}_T\sim \mathcal{N}(0,T^2\mathbf{I})$  to  $\mathbf{x}_0$  for sampling. The score estimator  $\mathbf{s}_{\phi}(\mathbf{x},t)$  is often parametrized by a denoiser  $D(\mathbf{x};\sigma (t))$  in practice, viz.,  $\nabla \log p_{t}(\mathbf{x}) = (D(\mathbf{x};\sigma (t)) - \mathbf{x}) / \sigma (t)^{2}$ , which establishes its close relationship with denoised smoothing.
Consider a classification task from  $\mathcal{X}$  to  $\mathcal{Y}$  where training data  $\mathcal{D} = \{(\mathbf{x}_i, y_i)\} \sim p_{\mathrm{data}}(\mathbf{x}, y)$  is available, and let  $f: \mathcal{X} \to \mathcal{Y}$  be a classifier. We denote  $\hat{f}_{\sigma}$  to be the smoothed classifier of  $f$  with respect to the smoothing factor  $\sigma > 0$ , as defined by (1). In this work, we aim to better understand how the accuracy-robustness trade-off of  $\hat{f}_{\sigma}$  occurs, with a particular consideration of the recent denoised smoothing scheme. Generally speaking, the trade-off implies the following: for a given model, there exists a sample that the model gets "wrong" as it is optimized for (adversarial) robustness on another sample. In this respect, we start by taking a closer look at what it means by a model gets wrong, particularly when it is from randomized smoothing.
3.1 Over-smoothing and over-confidence in randomized smoothing
Consider a smoothed classifier  $\hat{f}_{\sigma}$ , and suppose there exists a sample  $(\mathbf{x},y)$  where  $\hat{f}_{\sigma}$  makes an error: i.e.,  $\hat{f}_{\sigma}(\mathbf{x}) \neq y$ . Our intuition here is to separate possible scenarios of  $\hat{f}_{\sigma}(\mathbf{x})$  making an error into two distinct cases, based on the prediction confidence of  $\hat{f}_{\sigma}(\mathbf{x})$ . Specifically, we define the confidence of a smoothed classifier  $\hat{f}_{\sigma}$  at  $\mathbf{x}$  based on the definition of randomized smoothing (1) and (2):
$$
p _ {\hat {f} _ {\sigma}} (\mathbf {x}) := \max  _ {y} p _ {\hat {f} _ {\sigma}} (\mathbf {x}, y) = \max  _ {y} \mathbb {P} _ {\delta \sim \mathcal {N} (0, \sigma^ {2} \mathbf {I})} [ f (\mathbf {x} + \delta) = y ]. \tag {4}
$$
Intuitively, this notion of "smoothed" confidence measures how consistent the base classifier  $f$  is in classifying  $\mathbf{x} + \delta$  over Gaussian noise  $\delta \sim \mathcal{N}(0, \sigma^2\mathbf{I})$ . In cases when  $f$  is modeled by denoised smoothing, achieving high confidence requires the denoiser  $D$  to accurately "bounce-back" a given noisy image  $\mathbf{x} + \delta$  into one that falls into class  $y$  with high probability over  $\delta$ .
Given a smoothed confidence  $p \coloneqq p_{\hat{f}_{\sigma}}(\mathbf{x})$ , we propose to distinguish two cases of model errors, which are both peculiar to randomized smoothing, by considering a certain threshold  $p_0$  on  $p$ . Namely, we interpret an error of  $\hat{f}_{\sigma}$  at  $\mathbf{x}$  either as (a)  $p \leq p_0$ : the model is over-smoothing, or (b)  $p > p_0$ : the model is having an over-confidence on the input:
1. Over-smoothing  $(p \leq p_0)$ : On one hand, it is unavoidable that the mutual information  $I(\mathbf{x} + \boldsymbol{\delta}; y)$  between input and its class label absolutely decrease from smoothing with larger variance  $\sigma^2$ , although using larger  $\sigma$  can increase the maximum certifiable radius of  $\hat{f}_{\sigma}$  in practice (2). Here, a "well-calibrated" smoothed classifier should output a prediction close to the uniform distribution across  $\mathcal{V}$ , leading to a low prediction confidence. In terms of denoised smoothing, the expectation is clearer: as  $\mathbf{x} + \boldsymbol{\delta}$  gets closer to the pure Gaussian noise, the denoiser  $\bar{D}$  should generate more diverse outputs hence in  $\mathcal{V}$  as well. Essentially, this corresponds to an accuracy-robustness trade-off from choosing a specific  $\sigma$  for a given (e.g., information-theoretic) capacity of data.
2. Over-confidence  $(p > p_0)$ : On the other hand, it is also possible for a model  $\hat{f}_{\sigma}$  to be incorrect but with a high confidence. Compared to the over-smoothing case, this scenario rather signals a "miscalibration" and corresponds to a trade-off from model biases: even across smoothed models with a fixed  $\sigma$ , the balance between accuracy and robustness can be different depending on how each model assigns robustness in its decision boundary per-sample basis. When viewed in terms of denoised smoothing, this occurrence can reveal an implicit bias of the denoiser function  $D$ , e.g., that of diffusion models. For example, a denoiser might be trained to adapt to some spurious cues in training data, e.g., their backgrounds, as also illustrated in Figure 1(b).
In the subsequent sections, Section 3.2 and 3.3, we introduce two methods to exhibit better accuracy-robustness trade-off in randomized smoothing, each of which focuses on the individual scenarios of over-smoothing and over-confidence, respectively. Specifically, Section 3.2 proposes to use a cascaded inference of multiple smoothed classifiers across different smoothing factors to mitigate the limit of using a single smoothing factor. Next, in Section 3.3, we propose to calibrate diffusion models to reduce its over-confidence particularly in denoised smoothing.
3.2 Cascaded randomized smoothing
To overcome the trade-off between accuracy and certified robustness from over-smoothing, i.e., from choosing a specific  $\sigma$ , we propose to combine multiple smoothed classifiers with different  $\sigma$ 's. In a nutshell, we design a pipeline of smoothed inferences that each input (possibly with different noise resilience) can adaptively select which model to use for its prediction. Here, the primary challenge is to make it "correct", so that the proposed pipeline does not break the existing statistical guarantees on certified robustness that each smoothed classifier makes.
Specifically, we now assume  $K$  distinct smoothing factors, say  $0 < \sigma_{1} < \dots < \sigma_{K}$ , and their corresponding smoothed classifiers of  $f$ , namely  $\hat{f}_{\sigma_1}, \dots, \hat{f}_{\sigma_K}$ . For a given input  $\mathbf{x}$ , our desiderata is (a) to maximize robustness certification at  $\mathbf{x}$  based on the smoothed inferences available from the individual models, say  $p_{\hat{f}_{\sigma_1}}(\mathbf{x}), \dots, p_{\hat{f}_{\sigma_K}}(\mathbf{x})$ , while (b) minimizing the access to each of the models those require a separate Monte Calro integration in practice. In these respects, we propose a simple "predict-or-abstain" policy, coined cascaded randomized smoothing:2
$$
\operatorname {c a s c} \left(\mathbf {x}; \left\{\hat {f} _ {\sigma_ {i}} \right\} _ {i = 1} ^ {K}\right) := \left\{ \begin{array}{l l} \hat {f} _ {\sigma_ {K}} (\mathbf {x}) & \text {i f} p _ {\hat {f} _ {\sigma_ {K}}} (\mathbf {x}) > p _ {0}, \\ \operatorname {c a s c} \left(\mathbf {x}; \left\{\hat {f} _ {\sigma_ {i}} \right\} _ {i = 1} ^ {K - 1}\right) & \text {i f} p _ {\hat {f} _ {\sigma_ {K}}} (\mathbf {x}) \leq p _ {0} \text {a n d} K > 1, \\ \text {A B S T A I N} & \text {o t h e r w i s e ,} \end{array} \right. \tag {5}
$$
where ABSTRACT  $\notin \mathcal{V}$  denotes an artificial class to indicate "undecidable". Intuitively, the pipeline starts from computing  $\hat{f}_{\sigma_K}(\mathbf{x})$ , the model with highest  $\sigma$ , but takes its output only if its (smoothed) confidence  $p_{\hat{f}_{\sigma_K}}(\mathbf{x})$  exceeds a certain threshold  $p_0$ :<sup>3</sup> otherwise, it tries a smaller noise scale, say  $\sigma_{K-1}$  and so on, applying the same abstention policy of  $p_{\hat{f}_\sigma}(\mathbf{x}) \leq p_0$ . In this way, it can early-stop the computation at higher  $\sigma$  if it is confident enough, so it can maintain higher certified robustness, while avoiding unnecessary accesses to other models of smaller  $\sigma$ .
Next, we ask whether this pipeline can indeed provide a robustness certification: i.e., how much one can ensure  $\operatorname{casc}(\mathbf{x} + \boldsymbol{\delta}) = \operatorname{casc}(\mathbf{x})$  in its neighborhood  $\boldsymbol{\delta}$ . Theorem 3.1 below shows that one can indeed enjoy the most certified radius from  $\hat{f}_{\sigma_k}$  where  $\operatorname{casc}(\mathbf{x}) \eqqcolon \hat{y}$  halts, as long as the preceding models are either keep abstaining or output  $\hat{y}$  over  $\boldsymbol{\delta}$ :<sup>4</sup>
Theorem 3.1. Let  $\hat{f}_{\sigma_1}, \dots, \hat{f}_{\sigma_K}: \mathcal{X} \to \mathcal{Y}$  be smoothed classifiers with  $0 < \sigma_1 < \dots < \sigma_K$ . Suppose  $\operatorname{casc}(\mathbf{x}; \{\hat{f}_{\sigma_i}\}_{i=1}^K) =: \hat{y} \in \mathcal{Y}$  halts at  $\hat{f}_{\sigma_k}$  for some  $k$ . Consider any  $\underline{p}$  and  $\overline{p}_{i,c} \in [0,1]$  that satisfy the following: (a)  $\underline{p} \leq p_{\hat{f}_{\sigma_k}}(\mathbf{x}, \hat{y})$ , and (b)  $\overline{p}_{k',c} \geq p_{\hat{f}_{\sigma_{k'}}}(\mathbf{x}, c)$  for  $k' > k$  and  $c \in \mathcal{Y}$ . Then, it holds that  $\operatorname{casc}(\mathbf{x} + \delta; \{\hat{f}_{\sigma_i}\}_{i=1}^K) = \hat{y}$  for any  $\|\delta\| < R$ , where:
$$
R := \min  \left\{\sigma_ {k} \cdot \Phi^ {- 1} (\underline {{p}}), \min  _ {\substack {y \neq \bar {y} \\ k ^ {\prime} > k}} \left\{\sigma_ {k ^ {\prime}} \cdot \Phi^ {- 1} \left(1 - \bar {p} _ {k ^ {\prime}, y}\right) \right\} \right\}. \tag{6}
$$
Overall, the proposed multi-scale smoothing scheme (and Theorem 3.1) raise the importance of "abstaining well" in randomized smoothing: if a smoothed classifier can perfectly detect and abstain its potential errors, one could overcome the trade-off between accuracy and certified robustness by joining a more accurate model afterward. The option to abstain in randomized smoothing was originally adopted to make its statistical guarantees correct in practice. Here, we extend this usage to also rule out less-confident predictions for a more conservative decision making. As discussed in Section 3.1, now the over-confidence becomes a major challenge in this matter: e.g., such samples can potentially bypass the abstention policy of cascaded smoothing, which motivates our fine-tuning scheme presented in Section 3.3.
Certification. We implement our proposed cascaded smoothing to make "statistically consistent" predictions across different noise samples, considering a certain significance level  $\alpha$  (e.g.,  $\alpha = 0.001$ ): in a similar fashion as Cohen et al. [15]. Roughly speaking, for a given input  $\mathbf{x}$ , it makes predictions only when the  $(1 - \alpha)$ -confidence interval of  $p_f(\mathbf{x})$  does not overlap with  $p_0$  upon  $n$  i.i.d. noise samples (otherwise it abstains). The more details can be found in Appendix D.2.