Year: 2021

Abstract:
Existing defense models against adversarial examples typically provide either empirical or certified robustness. Adversarially trained models empirically demonstrate state-of-the-art defense while providing no robustness guarantees for large classifiers or higher-dimensional inputs. In contrast, a randomized smoothing framework provides state-of-the-art certification while significantly degrades the empirical performance against adversarial attacks. In this work, we propose a novel certification through adaptation technique that transforms an adversarially trained model into a randomized smoothing classifier during inference to provide certified robustness for `2 norm without affecting their empirical robustness against adversarial attacks. One advantage of our proposed technique is that it allows us to separately choose the appropriate noise level for certifying each test example during inference. It also leads to outperform the existing randomized smoothing models for `2 certification on CIFAR-10. Therefore, our work is a step towards bridging the gap between the empirical and certified robustness against adversarial examples by achieving both using the same classifier for the first time.

heading: 1 INTRODUCTION
text: Deep neural network (DNN) based models are found to be brittle to minor, adversarially-chosen perturbations for their inputs that remain undetectable to human eyes. A DNN classifier that correctly classifies an image x, can be easily fooled by an adversarial attack to misclassify x + δ (Szegedy et al., 2014; Goodfellow et al., 2015; Madry et al., 2018). Here, δ is a minor adversarial perturbation such that the change between x and x+ δ remains imperceptible.
Among the existing successful defense frameworks, adversarial training (AT) produces the best empirical robustness against the known adversarial attacks without providing any guarantee (Madry et al., 2018; Tramèr & Boneh, 2019; Zhang et al., 2019; Rice et al., 2020; Gowal et al., 2020). It trains a DNN classifier using strong adversaries from a specific class of perturbation (e.g., a small `p-norm) to provide robustness for the same perturbation types. Several certification techniques are proposed that can be applied to adversarially trained models to certifiably verify if the prediction of a test example, x remains constant within its neighborhood (Wong & Kolter, 2018; Wang et al., 2018; Salman et al., 2019b; Dvijotham et al., 2018; Gehr et al., 2018; Sheikholeslami et al., 2021). However, these certification techniques typically do not scale for larger networks (e.g., ResNet50) and datasets (e.g., IMAGENET). Hence, currently, we cannot guarantee that a more powerful, not yet known attack can not break these adversarially trained models. In fact, several recently proposed empirical defense models are later broken by stronger adaptive adversarial attacks, indicating the importance of investigating certified defenses with suitable robustness guarantees.
In contrast to adversarial training, randomized smoothing provides a scalable `2-certification framework for any classification model, which is robust against large isotropic Gaussian noise (Cohen et al., 2019; Salman et al., 2019a). However, the existing randomized smoothing-based certified models produce significantly lower empirical robustness compared to the AT models. On the other hand, this technique cannot be applied for AT models as they are not robust against such large random Gaussian noises in the standard settings. Towards this, we investigate to bridge the gap between the state-of-the-art empirical and certifiable robust models against adversarial examples.
In this paper, we present a novel certification through adaptation framework to transform an AT model into a randomized smoothing framework during inference, providing `2 certification without
any additional training or architectural modification. Our proposed certification technique consists of two steps: we first apply a covariate shift adaptation to a classifier against Gaussian noise during inference for each test example (Cariucci et al., 2017; Li et al., 2016). For our paper, we use the wellknown batch normalization adaptation. This process significantly boosts the performance of the AT models against the random isotropic Gaussian noises compared to the standard non-robust models. Hence, we can now directly apply the randomized smoothing based certification technique to provide `2 certification in the next step. Further, the existing randomized smoothing models require selecting the noise level at training time. In contrast, our proposed framework can separately choose the appropriate noise levels for different test examples during inference (Figure 4). Furthermore, we can also evaluate the input test examples without transforming the AT models to a randomized smoothing model, ensuring that their empirical performance remains unaffected. Therefore, we are the first to provide the test-time flexibility to obtain empirically robust predictions as well as certify their predictions using the same classifier for high-dimensional datasets to the best of our knowledge. Hence, we improve the reliability of AT models sensitive real-world applications.
Contributions:-
1. We propose a novel certification through adaptation framework that can adapt an AT model during inference to provide certified robustness. Our experimental results on CIFAR-10 and IMAGENET demonstrate that the proposed certification framework can transform any AT model into a randomized smoothing classifier to provide certification for `2 norm, even when the model is learned using `∞-bounded adversaries (Table 1 & Figure 2).
2. One main advantage of our proposed framework is that it allows us to select appropriate noise levels for different test examples during inference. This leads to outperforming the existing state-of-the-art randomized smoothing models for `2 certification on CIFAR-10 using AT models (Table 1 & Figure 4). Further, we can provide certification at larger `2 radii for existing randomized smoothing models, improving their overall average certified radius (ACR).
3. Our results also indicate a strong correlation between empirical and certified robustness than previously believed (Cohen et al., 2019; Salman et al., 2019a; Tramèr & Boneh, 2019). In particular, we observe that the empirically stronger AT models lead to better `2 certification performance (Figure 5).

heading: 2 RELATED WORK
text: Empirical Defenses and Adversarial Training. Existing defense models against adversarial attacks can be broadly classified into empirical and certified defenses. Empirical defenses demonstrate empirical robustness against adversarial attacks (Schott et al., 2019; Moosavi Dezfooli et al., 2019; Nandy et al., 2020; Mao et al., 2021). Adversarial training achieves the state-of-the-art empirical defense (Madry et al., 2018). It optimizes the following loss function for a DNN classifier, f , to provide robustness within an -bounded threat model for an `p norm, where the perturbations, δ ∈ ∆ are constrained as ∆ = {δ : ||δ||p ≤ }:
min θ E(x,y)[max δ∈∆ L(fθ(x+ δ), y)] (1)
where, θ denotes the model parameters. L is the classification loss. The inner maximization in Eq. 1 is solved by producing adversarial examples using strong iterative adversaries, e.g., projected gradient descent (PGD) attack (Kurakin et al., 2016; Madry et al., 2018). Wong et al. (2020) found that even a single-step fast gradient sign method (FGSM) attack-based AT models also achieves high empirical robustness (Goodfellow et al., 2015). Zhang et al. (2020) proposed to use the least adversaries for training. Recently Trades (Zhang et al., 2019), Adv-LLR (Qin et al., 2019) introduced additional regularizers to achieve higher empirical robustness by smoothing the loss surface. However, Rice et al. (2020) showed that the standard PGD based AT model with early-stopping criteria provides one of the best empirical defenses for a given perturbation type. Recent works also explored the importance of different hyper-parameters for adversarial training (Gowal et al., 2020; Pang et al., 2021) as well as incorporating additional data in a semi-supervised fashion (Carmon et al., 2019; Uesato et al., 2019) to further improve their empirical robustness.
Certified Defenses. Empirical defenses demonstrate robustness only against the known adversaries without providing any guarantees. In fact, most empirical defenses proposed in the literature were later broken by stronger adversaries, highlighting the importance of certified defenses to provide robustness guarantees (Athalye et al., 2018; Uesato et al., 2018; Jalal et al., 2019).
Several recent works proposed to train neural network models with provable robustness guarantees. These works include methods based on semi-definite relaxations (Raghunathan et al., 2018), linear relaxations and duality (Wong & Kolter, 2018; Wong et al., 2018), abstract interpretation (Mirman et al., 2018), and interval bound propagation (Gowal et al., 2018). Parallel to training a certified defense, several works also focus on certifying the already trained models (Tjeng et al., 2017; Gehr et al., 2018; Weng et al., 2018; Wang et al., 2018; Bunel et al., 2018). Recently Mueller et al. (2021) combined a small certification network with a large, empirically robust AT model using some selection criteria to boost overall benign accuracy along with empirical robustness for the certified framework. However, none of these techniques scale for large networks (e.g., ResNet50) or higher-dimensional datasets (e.g., IMAGENET).
Randomized Smoothing for Certification. A randomized smoothing classifier is not a neural network. It uses a neural network as its base for classification. Randomized smoothing was initially proposed as a heuristic defense (Cao & Gong, 2017; Liu et al., 2018) and later shown to be certifiable (Lecuyer et al., 2019; Li et al., 2019). Recently, Cohen et al. (2019) and Salman et al. (2019a) separately provided a tight robustness guarantee for `2-norm. Salman et al. (2019a) provides the current state-of-the-art `2 certification robustness by adversarially choosing the noise using an adaptive attack to train their base classifier. This framework is also analyzed for other `p norms using different noise distributions as well (Li et al., 2019; Lee et al., 2019; Dvijotham et al., 2020; Yang et al., 2020). Salman et al. (2020) proposed to incorporate an additional denoising module as a preprocessing unit to convert a standard DNN classifier into a randomized smoothing model to provide non-trivial certified robustness. Notably, randomized smoothing is the only scalable certification framework. Further, it also achieves superior performance for different perturbation types.
While achieving the state-of-the-art certification performance, randomized smoothing significantly degrades the empirical robustness against adversarial attacks (Lecuyer et al., 2019; Salman et al., 2019a; Cohen et al., 2019). Towards this, our proposed technique transforms an AT model into a randomized smoothing classifier without any additional training or architectural modification. Since AT models already provide the state-of-the-art empirical defense, we achieve both empirical and certified robustness against adversarial examples using the same classifier.

heading: 3 PROPOSED METHODOLOGY
text: In this section, we first present the background of the randomized smoothing technique and explain why it is not directly effective for AT models. Next, we present the existing test-time co-variate shift adaptation for domain adaptations and corruption robustness. Then, we present our proposed certification through adaptation framework that adapts a DNN model during inference to provide certified robustness without additional training or architectural modification.

heading: 3.1 BACKGROUND ON RANDOMIZED SMOOTHING
text: Consider a classifier f that maps inputs in Rd to Y classes. The randomized smoothing framework transforms the original base classifier f into a new, smoothed classifier g. In particular, for an
input x ∈ Rd, the smoothed classifier g returns the most probable class to be predicted by the base classifier f under isotropic Gaussian noises of x. That is,
g(x) = argmax y∈Y
P(f(x+ δ) == y) where, δ ∼ N (0, σ2I). (2)
The noise level, σ controls the trade-off between robustness and accuracy: Increasing σ would improve the robustness of g at higher `2 radii. However, it degrades the robustness at lower `2 radii as well as the benign accuracy.
Cohen et al. (2019) presented a tight robustness guarantee based on the Neyman-Pearson lemma for the smoothed classifier g and gave an efficient algorithm using Monte Carlo sampling for certifying of g. We can also obtain this guarantee alternatively by explicitly computing the Lipschitz constant of the smoothed classifier as shown in (Salman et al., 2019a; Yang et al., 2020). The certification procedure is as follows: Suppose a base classifier f classifies N (x, σ2I) to return the “most probable” class, cA with probability pA = P(f(x + δ) == cA) and the “runner-up” class cB with probability pB = maxy 6=cA P(f(x + δ) == y). Then, the smooth classifier, g is certifiably robust around x within an `2 radius of R:
R = σ
2
( Φ−1(pA)− Φ−1(pB) ) (3)
where, Φ−1 is the inverse of the standard Gaussian CDF.
However, computing the exact values of pA and pB is not possible in practice when f is a DNN. Cohen et al. (2019) addressed this problem using Monte Carlo sampling to estimate some pA and pB such that pA ≤ pA and pB ≥ pB with arbitrarily high probability. The certified radius for input x is then computed by replacing pA and pB with pA and pB respectively in Eq. 3.
As we can see in Equation 2 that the original base classifier, f needs to be robust against large Gaussian noises to provide non-trivial robustness certification results. Otherwise, it leads to lower pA and hence a lower certification of R for the test examples. Existing randomized smoothing-based models applies custom-trained using explicit Gaussian noises to learn their original base classifier (Lecuyer et al., 2019; Cohen et al., 2019; Salman et al., 2019a; Zhai et al., 2020; Jeong & Shin, 2020). However, these models produce significantly lower empirical robustness compared to the AT models. Consequently, AT models are not robust against large Gaussian noises in the standard inference settings (see Table 2). Hence, we cannot directly use them as the base classifier for randomized smoothing.

heading: 3.2 BACKGROUND ON COVARIATE SHIFT ADAPTATION
text: Recent works on (Sun et al., 2017; Roy et al., 2019; Huang et al., 2018; Li et al., 2016) and corruption robustness (Schneider et al., 2020; Nado et al., 2020; Benz et al., 2021) demonstrate the importance of unsupervised covariate shift adaptation. We use adaptive batch-normalization (BN), one of the most popular and effective unsupervised covariate shift adaptation mechanisms.
A BN layer computes the mean and variance of the hidden activation maps across the channels to normalize these activations to N (0, 1) before feeding into the next hidden layer (Ioffe & Szegedy, 2015). It reduces the dependencies among different hidden layers, improving the training efficiency for deep architectures. Hence, most of the recent DNN architectures frequently incorporate BN layers for complex machine learning tasks. However, the distributional shifts in the test examples lead to different activation statistics compared to the training examples. Hence, impacted by the covariate shift, the statistics estimated during training fail to normalize the activation tensors to N (0, 1). As a result, it breaks the crucial assumption for the subsequent hidden layers to work. More formally, let PT : X × Y → R+ as the training distribution and Pt : X × Y → R+ as the test distribution; where x ∈ X are inputs and y ∈ Y are the corresponding class labels. There exists covariate shift between training and test distribution iff: PT (y|x)=Pt(y|x) and PT (x) 6= Pt(x) (Sugiyama & Kawanabe, 2012; Schölkopf et al., 2012). If the covariate shift only affects the first and second-order moments of the hidden layer feature activations, fh(x), we can remove it using normalization (Schneider et al., 2020):
PT (fh(x)− ET [fh(x)]√
VT [fh(x)]
) PT (x) ≈ Pt (fh(x)− Et[fh(x)]√ Vt[fh(x)] ) Pt(x). (4)
Covariate shift adaptation using adaptive BN computes the BN statistics from the feature activations, µt, s2t , of the test batch. We can adapt them with the existing training statistics, µT , s 2 T , obtained using the training batches as (Cariucci et al., 2017; Li et al., 2016; Schneider et al., 2020):
µ = ρ · µt + (1− ρ) · µT s = ρ · st + (1− ρ) · sT (5)
where, ρ ∈ [0, 1] is the momentum. The choice of ρ = 0 is equivalent to the standard inference setup with a deterministic DNN classifier in the IID settings. We should choose ρ = 1 when receiving larger test batches as it can provide a better estimation of the test distributions.
Assumptions for BN adaptation. It is noteworthy that these existing adaptive BN-based frameworks require a large set of test images from the same covariate shift to estimate the BN parameters. However, this assumption may not hold for several real-world applications, e.g., stateless web APIs. Also, these test images should be semantically diverse, preferably over multiple classes, to effectively estimate the test distributions. Hence, it further limits the practical usability of these frameworks for real-world applications, e.g., autonomous cars.
In contrast to these models for domain adaptation and corruption robustness, our proposed certification framework against adversarial examples does not make any such assumptions. In this case, we already know the perturbation type on which we need to adapt the model to provide the certification. Hence, we can explicitly pre-select a diverse set of clean images, Xbatch and control the perturbations to adapt the models, addressing both of these limitations.
Algorithm 1: Steps for CERTIFICATION THROUGH ADAPTATION Algorithm Input: f : classifier, xtest: test example, σ: desired noise-level, Xbatch: set of clean images (preselected from validation data or test stream). Output: Certifiably robust `2 radius of R for xtest. /* Step 1: Adapt BN parameters using Xbatch with ρ = 1 (Eqn 5). */ 1 X̃batch = [x+N (0, σI) ∀ x ∈ Xbatch] // perturb Xbatch with desired noise. 2 fadapt = CLONE(f.train()) // clone f with train-mode. 3 = fadapt(X̃batch) // forward pass for BN parameter adaptation. 4 fadapt.eval() // fix the parameters.
/* Step 2: Certify xtest using Randomized Smoothing framework. */ 5 g = GETRANDOMIZEDMODEL(fadapt) // Convert fadapt to randomized-smoothing
classifier g (Eqn 2). 6 R = CERTIFY(g, xtest, σ) // Execute 3 for `2 certification. 7 return R

heading: 3.3 PROPOSED CERTIFICATION THROUGH ADAPTATION
text: The robustness guarantee in Eq. 3 suggests that randomized smoothing gives a framework for certifying any classifier f that is robust against large Gaussian noises. Previous works proposed customized training using explicit Gaussian noise augmentation for their training (Section 3.1). Subsequently, in Section 3.2 we note that robustness against random Gaussian noises of any classifier, f can be improved by applying covariate shift adaptation using adaptive BN technique without any additional training. However, it modifies the original base classifier f at each forward pass by recomputing the BN parameters. Since the certification guarantee in Eq. 3 is provided only for a fixed base classifier f , we cannot directly apply adaptive BN to provide `2 certification using the randomized smoothing framework. This motivates us to propose a novel certification framework that applies the covariate shift adaptation using adaptive BN as an offline pre-processing step to improve the robustness against random Gaussian noises, addressing the above problem.
Our proposed certification through adaptation framework consists of two steps: Given test image xtest, we first apply the adaptive BN technique to achieve robustness against Gaussian perturbations. Recall that adaptive BN requires a large set of diverse test images to correctly re-estimate the batch-normalization statistics. However, to provide certification for `2-norm, we only need to adapt our model against Gaussian perturbations. Hence, we can pre-select a sufficiently large set of diverse clean images, Xbatch and apply Gaussian perturbations to adapt our classifier, f , as an offline pre-processing step to obtain fadapt. Alternatively, when a large set of diverse test examples
are available, we can also use them for our BN adaptation. The Gaussian noise samples should be drawn from the same isotropic Gaussian distribution N (0, σ2I) as we need to use for the certification process. Then, we freeze the model parameters and use the adapted model, fadapt, as our base classifier to certify the test example, xtest. Hence, the base classifier fadapt remains fixed during calculating the certification radius R (Equation 3). Our proposed certification through adaptation technique is presented in Algorithm 1.
Advantages. The main advantage of our proposed framework is that we can adapt the classifier, f at any noise level σ as an offline pre-processing step, without any additional training (see Figure 4). As we can see in Equation 3, that we should select a large σ to certify at a bigger `2 radius of R. However, a test image that does not remain robust at higher σ produces a lower value of pA. It leads to reducing the overall certification radius, R. Hence, providing the flexibility of choosing appropriate noise levels for different test examples allows us to improve the certification radius, R.
In contrast to our proposed framework, existing randomized smoothing frameworks cannot choose a different σ at test-time since it typically degrades their overall certification performance. Hence, they need to fix σ during training their base models or its components.
Applicability. Our proposed certification through adaptation technique can be applied to any classification model, f with batch-normalization layers. However, note that achieving high accuracy against large random Gaussian perturbations is only a necessary condition: a randomized smoothing classifier, g requires to consistently predict the correct class to provide higher certification guarantees at larger radii. Hence, we achieve non-trivial `2 certification guarantees at very small `2 radii for standard non-robust DNN classifiers (see Appendix B.1).
On the other hand, for existing randomized smoothing models, we achieve higher certification at larger `2 radii by adapting their base models with larger σ, improving their overall average certified radius (ACR) (Table 6 and 5 (Appendix)). However, we could not find any σ to obtain a significant improvement at lower `2 radii. In contrast, AT models with our proposed offline adaptation technique significantly improve their performance against large Gaussian perturbations, providing non-trivial certification robustness. Experimentally we find that our proposed technique outperforms the state-of-the-art certification models for the `2 norm.
Finally, while we focus on adaptive BN, there also exists other unsupervised covariate shift adaptation techniques such as self-supervised domain adaptation on single test examples (Sun et al., 2020), pseudo-labeling (French et al., 2017; Xie et al., 2020) etc. Wang et al. (2020) also proposed to update the normalization parameters by entropy minimization to improve the corruption robustness. Future studies may also explore these techniques for the offline pre-processing step.

heading: 4 EXPERIMENTS
text: Experimental setup. We use CIFAR-10 (Krizhevsky et al., 2009) and IMAGENET (Deng et al., 2009) datasets for our experiments. For CIFAR-10, we use pre-activation ResNet18 and ResNet50 for IMAGENET (He et al., 2016a;b). Our AT models are trained using early stopping criteria (Rice et al., 2020) as follows: For IMAGENET, we use two AT models, Adv∞[`∞ ≤ 4/255] and Adv2[`2 ≤ 3], learned at `∞ and `2 threat models with threat boundaries of 4/255 and 3 respectively. For CIFAR-10, we train multiple AT models with different threat boundaries. For example, we denote Adv∞[`∞ ≤ 8/255] and Adv2[`2 ≤ 1] as the AT models for `∞ and `2 threat models, trained with threat boundaries of 8/255 and 1, respectively. We compare with Baseline and Randσ=0.5 models. Baseline models are trained using clean images. Randσ=0.5 models are trained by augmenting random noise, sampled from isotropic Gaussian distribution, N (0, σ2I) with σ = 0.5. We also compare with the current state-of-the-art certification models, SmoothAdv for CIFAR-10 (Salman et al., 2019a). Please refer to Appendix A for more details. 1

heading: 4.1 PERFORMANCE UNDER GAUSSIAN NOISE.
text: We first investigate the performance of different classification models under significantly larger Gaussian perturbations. It is a necessary condition to provide `2 robustness certification. In Table 2,
1For IMAGENET, we obtain Adv∞ and Adv2 from https://github.com/locuslab/robust overfitting and Baseline and Randσ=0.5 models from https://github.com/locuslab/smoothing.
we present the performance. We observe that when the test examples are sampled from IID settings as training distributions (i.e., σ = 0 for Baseline, Adv∞, and Adv2 and σ = 0.5 for Randσ=0.5), these models produces the best results regardless of whether BN adaptation is applied. However, as we move away from the IID settings by increasing (or decreasing) σ, the performance of all these models significantly degrades in the standard inference setup. In contrast, covariate shift adaptation using adaptive BN improves the performance for all models. In particular, AT models achieve significantly higher performance gain using adaptive BN than the non-robust baseline models at higher noise levels. For example, at σ = 0.5, Baseline, Adv2[`2 ≤ 3] and Adv∞[`∞ ≤ 4/255] respectively achieve top-1 accuracy of 0.3%, 0.4%, and 0.9% for IMAGENET without using BN adaptation (Table 2 (a)). However, adaptive BN for Adv2[`2 ≤ 3] and Adv∞[`∞ ≤ 4/255] significantly improves the top-1 accuracy to 47.3% and 44.9% respectively. In contrast, the baseline model only achieves 7.7% accuracy. We observe similar results for CIFAR-10 in Table 2 (b).
Loss Gradients under Gaussian Noises. To further investigate the performance of AT models, we visualize the loss gradients for individual pixels of an image as we increase the Gaussian noise (i.e., σ) (Figure 1). Loss-gradients reflect the most relevant input pixels for classification predictions. Here, we scale, translate and clip the loss-gradient values without using any sophisticated techniques (as suggested in Tsipras et al. (2019)). At σ = 0 (i.e., for clean images), the loss-gradients from AT models align properly with perceptually relevant features (as observed previously (Tsipras et al., 2019; Etmann et al., 2019)). However, as we choose higher noise using σ=0.5 and σ=0.75, the overall loss gradients become noisier. Specifically, AT models without adaptation produce sharper loss gradients (i.e., greater importance) even for background pixels. In contrast, test-time BN adaptation produces gradients for the pixels from the object of interest and suppress the gradients for background pixels (see Figure 1(c) and Figure 1(d)). Hence, they extract the required semantic information for correct classifications. It is interesting to note that Adv2 produces significantly more human-aligned loss gradients compared to Adv∞. This behavior is also reflected in their classifica-
tion (Table 2) and overall certification (Table 1) as we note that Adv2 overall produces much better performance compared to Adv∞.

heading: 4.2 CERTIFICATION USING RANDOMIZED SMOOTHING
text: We now present the `2 certification results using the randomized smoothing framework as the backbone, as proposed in our Algorithm 1. We certify the test images with 99.9% probability. We estimate the class label probabilities of g (in Equation 3) using Monte-Carlo sampling with 100, 000 noisy samples for each test image, as in Cohen et al. (2019); Salman et al. (2019a). We use the full test-set for CIFAR-10 and a sub-sample of 500 test images for IMAGENET (as in Cohen et al. (2019)). We provide the detailed results of certified accuracy along with average certified radius (ACR) for several models, trained using different specifications and adapting with different σ in Table 5 and 6 (Appendix).
Certifying AT models. In Figure 2, we first demonstrate that AT models can provide non-trivial `2 certified robustness using our proposed framework for both IMAGENET and CIFAR-10 datasets. Here, we use Adv∞[`∞ ≤ 4/255] and Adv2[`2 ≤ 3] for ImageNet and Adv∞[`∞ ≤ 8/255] and Adv2[`2 ≤ 1] for CIFAR-10 and use σ = 0.5 for adaptation and certification using Algorithm 1. We compare with the certification results of Baseline, Adv∞ and Adv2 models in the standard settings, without using any adaptation and certified at σ = 0.25. We can see a significant boost of `2 certification results for
both Adv∞ and Adv2 models using our proposed framework. Further, Adv2 models consistently achieve better performance compared to Adv∞ in terms of certified accuracy. For CIFAR-10, both Adv∞[`∞ ≤ 8/255] and Adv2[`2 ≤ 1] outperform the standard randomized smoothing framework i.e., Randσ=0.5, certified using σ = 0.5 (Cohen et al., 2019). For IMAGENET, Adv2[`2 ≤ 3] achieves better certified accuracy compared to Randσ=0.5 beyond `2-radii of 1.5.
Larger Threat Boundary for Better Certified Robustness. Learning AT models at a higher threat boundary improves the certification accuracy at higher `2 radii. We demonstrate this phenomena for both Adv∞ and Adv2 models in Figure 3(a) and 3(b) respectively for CIFAR-10.
Figure 3(c) also compares the certified accuracy of Adv2 models with the existing state-of-the-art SmoothAdv models (Salman et al., 2019a). SmoothAdv utilizes adversarial training using an adaptive attack with `2 threat boundary of and Gaussian noises,N (0, σ2I) (See details in Appendix A). We set the noise to σ = 0.5 and vary for their training to compare with different SmoothAdv models in Figure 3(c). By adapting Adv2 models with σ = 0.5 at test-time using our proposed Algorithm 1, we already achieve similar performance as SmoothAdv. Moreover, unlike existing frameworks,
we also provide test-time flexibility to adapt the same models using different σ, without retraining, to improve their certification, as shown below. 2
Flexibility of choosing different noise-level σ for certification at test-time. Figure 4 presents the certification results as we vary σ = {0.25, 0.5, 0.75} for test-time adaptation of the same models using our Algorithm 1. We note that the choice of large σ degrades certification at lower `2 radii while providing better performance for higher `2 radii. For each test example, we adapt the models with appropriate σ that provides the maximum certified radius to obtain the upper envelope of the certification accuracy curves in Figure 4. This leads to the state-of-the-art certification performance for Adv2 models, outperforming the existing SmoothAdv models for CIFAR-10 (Table 1). Further for randomized smoothing models (Figure 4(c)), we consistently provide certification at larger `2 radii by adapting using larger σ values, improving their overall ACR scores (see Table 6 and 5 (Appendix)). Additional results using several models with different training setups are provided in Figure 7 and 8 (Appendix).
Over-fitting reduces Certification. Rice et al. (2020) demonstrate that AT models overfit as we train without early stopping criteria. It degrades their empirical robustness against adversarial attacks. In Figure 5, we compare with the certification accuracy of such overfitted AT models, denoted as Advoverfit. We observe that Advoverfit models also degrade the certified robustness, in particular, at higher `2 radii, compared to their corresponding AT models with early
stopping criteria. These results also indicate that the empirical and certified robustness are closely related: improving empirical robustness also improves the certified robustness.

heading: 5 CONCLUSION
text: We propose a novel certification through adaptation algorithm that transforms adversarially trained models into a randomized smoothing classifier using test-time covariate shift adaptation to provide certified robustness for `2 norm. Unlike existing models using BN adaptation for different applications, our certification framework does not make any assumptions on the test examples. One main advantage of our proposed certification algorithm is to separately choose appropriate noise levels σ during inference for each test example. We achieve the state-of-the-art `2 certification using Adv2 models for CIFAR-10. Finally, while we mainly focus on `2 certification using Gaussian noise, we can also extend this framework for other types of perturbations as long as randomized smoothing works (e.g., uniform noise for `1 norm (Yang et al., 2020)) for different applications without any additional training.
2Since adversarial training for IMAGENET is still at a nascent stage, we did not compare with Salman et al. (2019a) in this paper.

heading: 6 CODE OF ETHICS AND REPRODUCIBILITY
text: Code of Ethics. Existing defense models can only provide either empirical or certified robustness against adversarial attacks for higher dimensional input domains. In this paper, we propose a solution to provide high performance to achieve both empirical or certified robustness. It allows us to improve the reliability and trustworthiness for large AI models for sensitive real-world applications.
Reproducibility. The key results of our paper are presented using adversarially trained models. For CIFAR-10, we train the models using the codes provided in https://github.com/locuslab/robust overfitting (Rice et al., 2020). For IMAGENET, we obtained the already trained AT models from https://github.com/locuslab/robust overfitting (Rice et al., 2020). Please refer to Appendix A for more details. We have provided the codes for our certification algorithms in the supplementary materials for reproducing the results of our paper.

heading: APPENDIX ORGANIZATION
text: • Section A: Experimental setup.
• Section B: Additional Results on Certification.
• Section C:Performance against different corruptions

heading: A EXPERIMENTAL SETUP
text: A.1 IMPLEMENTATION DETAILS
We present our experimental results on CIFAR-10 (Krizhevsky et al., 2009) and IMAGENET (Deng et al., 2009) datasets. The descriptions of different models and training hyper-parameters are provided in the following:
A.1.1 CIFAR-10.
We use pre-activation ResNet18 architecture (He et al., 2016b) for our experiments on CIFAR-10. We apply the SGD optimizer with a batch size of 128. We execute a total of 200 training epochs and apply a step-wise learning rate decay set initially at 0.1 and divided by 10 at 100 and 150 epochs, and weight decay 5× 10−4. AT models (Madry et al., 2018; Rice et al., 2020): Unless and otherwise specified, our AT models are learned using early stopping criteria as described in (Rice et al., 2020). We learn several AT models with different threat boundaries for our experiments. We denote them by specifying their corresponding threat model and threat boundaries. For example, Adv2[`2 ≤ 1.5] denotes an AT model that is learned using PGD adversary with `2 threat model and a threat boundary of = 1.5, along with early-stopping criteria (Rice et al., 2020). We also learn AT models without using earlystopping criteria, as in (Madry et al., 2018) for our comparison in Figure 5. These models are denoted as Advoverfit.
We use projected gradient descent (PGD) adversarial attack (Madry et al., 2018) to train these AT models as follows: For Adv∞, we use 10 iterations and an `∞ step size of /4. For Adv2, we use 10 iterations and an `2 step size of /8.5. This is the same experimental setup as in (Rice et al., 2020)). We choose a small set of 1, 000 images from the CIFAR-10 test set for our validation. We apply the PGD attack with the same hyper-parameters for our validation during training. We save the best model using the early-stopping criteria (Rice et al., 2020).
Randomized smoothing model by Cohen et al. (2019): We also train Randσ=0.5 by training with augmented random noise, sampled from an isotropic Gaussian distributionN (0, σ2I) with σ = 0.5. Here, we keep the same model architecture, learning rates, batch sizes, and other hyper-parameters as used to learn the AT models.
Randomized smoothing model by Salman et al. (2019a): We also compare with the state-ofthe-art certification models, called ‘SmoothAdv’, by Salman et al. (2019a) for our experiments on `2 certification We train the SmoothAdv models by choosing random noise vectors followed by an adaptive adversarial attack with specified `2 threat boundary of at each iteration. The noise vectors are sampled from an isotropic Gaussian distribution N (0, σ2I). We note that the training hyper-parameter has the most significant impact on the certification curve for a SmoothAdv model (please refer to Table 7-15 of (Salman et al., 2019a) for more details). For our experiments, we train 4 different SmoothAdv models with = {0.25, 0.5, 1, 2} and σ = 0.5 using adaptive PGD attack with 10 steps. We denote them as SmoothAdvσ=0.5, =0.25, SmoothAdvσ=0.5, =0.5, SmoothAdvσ=0.5, =1 and SmoothAdvσ=0.5, =2 respectively. We use the same training set-up and other hyper-parameters as specified in their Github: https://github.com/Hadisalman/smoothing-adversarial.
A.1.2 IMAGENET.
We use ResNet50 architecture (He et al., 2016a) for IMAGENET. We obtain the Baseline and Randσ=0.5 models from (Cohen et al., 2019)3. These models are trained using Gaussian augmented noises, sampled from isotropic Gaussian distribution N (0, σ2I) with σ = 0.0 (i.e., no noise) and σ = 0.5 respectively.
The AT models i.e., Adv∞[`∞ ≤ 4/255] and Adv2[`2 ≤ 3] are learned for `∞ and `2 threat models with threat boundary of 4/255 and 3, respectively. We use the publicly available models provided by Rice et al. (2020) 4. These models are fine-tuned using PGD-based adversarial training with early stopping criteria, originally provided by Engstrom et al. (2019) 5.
We resize the input images to 256× 265 pixels and crop 224× 224 pixels from the center. For our experiments on certification, we use a set of 500 test images by choosing at most 1 sample for each class.
A.2 CHOICE OF TEST-TIME ADAPTIVE BN HYPER-PARAMETERS
BN adaptation technique is controlled by two hyper-parameters, i.e., the test batch-size and momentum (ρ) (see Equation 5) to update the statistics of the batch-normalization layers. Assuming that the test images are obtained independently from the same test distribution, we can efficiently compute the BN statistics from these images. The hyper-parameter ρ ∈ [0, 1] controls the tread-off between pre-computed training statistics and test statistics. We can obtain a better estimation of the test distribution from a large test batch. Hence, we can choose a higher value of ρ.
Here, we compare the top-1 test accuracy of AT models under Gaussian augmented noise with σ = 0.5 for different choices of ρ and the batch size. We skip the standard baseline models from our analysis and refer to the previous works (Schneider et al., 2020; Nado et al., 2020) that analyzed the effects of these hyper-parameters for the standard baseline DNN classifiers.
Momentum (ρ). We first investigate the effect of momentum (ρ) as we choose a large batch size of 512. In Table 3, we present the performance of AT models for different values of ρ. Recall that, ρ = 1 denotes full adaptation (Equation 5). Here, we completely ignore the training statistics and recompute the BN statistics using the test batches. In contrast, ρ = 0 represents no adaptation, i.e., the same as the standard ‘deterministic’ inference setup. In this case, we use the previously computed BN statistics obtained during training.
We observe that for IMAGENET (Table 3 [Left]) the performance started converging at ρ = 0.7. For CIFAR-10 (Table 3 [Right]), the convergence started even earlier at ρ = 0.5.
Batch Size. Next, we investigate the minimum size of the test batches to choose ρ = 1 (i.e., fulladaptation). In Table 4, we fix ρ = 1 and vary the test batch sizes as we evaluate these AT models. We observe that the performance of these models started improving even when we are using the
3https://github.com/locuslab/smoothing 4https://github.com/locuslab/robust overfitting 5https://github.com/MadryLab/robustness
test batches of size 8. The performance further improves as we choose larger sizes of test batches. We can see that their performance started converging as we choose the test batches of size 64 for IMAGENET. On the other hand, the convergence started much earlier for CIFAR-10.

heading: B ADDITIONAL RESULTS ON CERTIFICATION
text: B.1 `2 CERTIFICATION FOR STANDARD NON-ROBUST CLASSIFIERS
In Figure 6, we present the `2 certification results for standard non-robust classification models using our proposed Algorithm 1. In Table 2, we note that the adaptive BN technique can also significantly improve the performance of a non-robust model at lower noise levels, σ. In particular, for CIFAR-10 dataset, Baseline models using adaptation achieve similar performance as Adv2[`2 ≤ 1] without BN adaptation, while produces significantly lower `2 certification robustness. This is because, Baseline models, even after adaptation cannot consistently predict the same class to provide higher certified robustness at larger `2 radii. As a result, we can only improve the certified robustness at smaller `2 radii.

heading: C PERFORMANCE AGAINST DIFFERENT CORRUPTIONS
text: We mainly focus on `2 certification using Gaussian noise in this paper. However, we note that randomized smoothing techniques have been also applied to provide certifications for other perturbation
types as well (e.g., random uniform noise for `1 norm (Yang et al., 2020)). Consequently, we can apply our proposed Algorithm 1 to adapt an AT model for any given perturbation types without any additional training for different applications.
Further, Hendrycks & Dietterich (2019) recently introduced ImageNet-C and CIFAR10-C datasets by algorithmically generated random corruptions from noise, blur, weather, and digital categories with 5 different severity levels for each corruption. Several recent works demonstrated that adaptive BN techniques can significantly improve the performance of any classifier (including AT models) against different random corruptions. Further, – also demonstrated the effectiveness of AT models even without applying any adaptation. Hence, our proposed certification framework for AT models is a step forward towards further improving the reliability of sensitive real-world applications.

Review summaries:
The paper shows that test-time adaptation of BatchNorm layers to Gaussian noise can induce a base classifier for randomized smoothing as good as those trained from scratch with Gaussian noise. Specifically, the method adapts the running statistics in each BN layers (following the test-time adaptation literature) with Gaussian-augmented samples in the training (or validation / test) set to make a classifier perform well under Gaussian noise, and use the adapted classifier for randomized smoothing. Experimental results on CIFAR-10 and ImageNet show that the adapted classifier achieve comparable (or marginally better) certified robustness compared to existing method for training smoothed classifiers. 

The paper proposes to use adaptive batch normalization to strengthen the adversarial training's model ability to counter gaussian random noise so that it could be better used in the random smoothing certification. Specifically, it first samples batches of data to achieve the adaptive BN's parameters and then uses random smoothing to achieve the certification. The experiments show it could achieve a better certified radius and better accuracy. 

This paper proposes a certification through an adaptation algorithm that transforms adversarially trained models into a randomized smoothing classifier using test-time covariate shift adaptation to provide L2 certification. Random smoothing can certify robustness, but it also decreases accuracy. This paper then updates at test-time to adapt to the additive Gaussian Noise, so that some accuracy is recovered. Experiment shows that the approach is effective. It is effective for CIFAR-10, and is partially effective on ImageNet.