SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustness
Year: 2021

Abstract:
Randomized smoothing is currently a state-of-the-art method to construct a certifiably robust classifier from neural networks against l2-adversarial perturbations. Under the paradigm, the robustness of a classifier is aligned with the prediction confidence, i.e., the higher confidence from a smoothed classifier implies the better robustness. This motivates us to rethink the fundamental trade-off between accuracy and robustness in terms of calibrating confidences of a smoothed classifier. In this paper, we propose a simple training scheme, coined SmoothMix, to control the robustness of smoothed classifiers via self-mixup: it trains on convex combinations of samples along the direction of adversarial perturbation for each input. The proposed procedure effectively identifies over-confident, near off-class samples as a cause of limited robustness in case of smoothed classifiers, and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness. Our experimental results demonstrate that the proposed method can significantly improve the certified l2-robustness of smoothed classifiers compared to existing state-of-the-art robust training methods.

text: Randomized smoothing is currently a state-of-the-art method to construct a certifiably robust classifier from neural networks against ℓ2-adversarial perturbations. Under the paradigm, the robustness of a classifier is aligned with the prediction confidence, i.e., the higher confidence from a smoothed classifier implies the better robustness. This motivates us to rethink the fundamental trade-off between accuracy and robustness in terms of calibrating confidences of a smoothed classifier. In this paper, we propose a simple training scheme, coined SmoothMix, to control the robustness of smoothed classifiers via self-mixup: it trains on convex combinations of samples along the direction of adversarial perturbation for each input. The proposed procedure effectively identifies over-confident, near off-class samples as a cause of limited robustness in case of smoothed classifiers, and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness. Our experimental results demonstrate that the proposed method can significantly improve the certified ℓ2-robustness of smoothed classifiers compared to existing state-of-the-art robust training methods.3

heading: 1 Introduction
text: Adversarial examples [53, 17] in deep neural networks clearly highlight that neural networks often generalize differently from humans, at least without an additional prior of local smoothness of predictions with respect to the input space: an adversarially-crafted, yet imperceptible input perturbation can drastically change the prediction of a neural network based classifier. Due to the intrinsic complexity of neural networks, however, the community has noticed that it is extremely hard to directly encode this smoothness prior into neural networks [6, 3, 55], especially without relying on adversarial training [40, 66], i.e., augmenting training data with its adversarial examples. Even with adversarial training, (a) the non-convex, minimax nature of the training introduces many optimization difficulties, often resulting in a harsh over-fitting [51, 47], and (b) it is generally hard to provably guarantee that the learned classifier is indeed smooth.
∗Work done at KAIST. †Work done at Kakao Enterprise. 3Code is available at https://github.com/jh-jeong/smoothmix.
35th Conference on Neural Information Processing Systems (NeurIPS 2021).
Randomized smoothing [33, 11] is relatively a recent idea that aims to indirectly encode the smoothness prior: Cohen et al. [11] have shown that any classifier, regardless of whether it is smooth or not, can be transformed into a certifiably robust classifier via averaging its predictions over Gaussian noise, where the (certified) robustness of the classifier depends on how well the base classifier performs with the noise. Compared to adversarial training, this notion of “indirect” smoothness can be favorable in a sense that (a) it is easier to optimize, and (b) offers a provable guarantee on the robustness. Currently, randomized smoothing is considered as the state-of-the-art approach in the context of building a neural network based classifier that is certifiably robust on ℓ2-perturbations [39].
In this respect, a growing body of research has focused on improving the robustness guarantee that randomized smoothing can give, e.g., via different smoothing measures [34, 62] or improved certification procedures [14, 43]. One of important directions on this line of research is to investigate which training of the base classifier could maximize the certified robustness of smoothed classifiers [49, 65, 23]. In particular, Salman et al. [49] have proposed SmoothAdv, showing that employing adversarial training [40] for smoothed classifiers could further improve the robustness, akin to the standard neural networks. This motivates us to develop a new form of adversarial training, more specialized for smoothed classifiers.
Contribution. In this paper, we propose SmoothMix, a novel adversarial training method designed for improving the certified robustness of smoothed classifiers. One of the key features that smoothed classifiers offer is a direct correspondence from prediction confidence to adversarial robustness: achieving a higher confidence in a smoothed classifier implies that the classifier can give a better certified robustness. Inspired by this, we found that the certified robustness of a given data sample can be significantly decreased by nearby off-class but over-confident [45] inputs: such “harmful” inputs would occupy an unnecessarily large robust radius near the sample of our interest, especially when they do not contain much information to be discriminated by the classifier.
Under the finding, we aim to calibrate the confidence of these off-class inputs to improve the certified robustness at the original input. More specifically, we first observe that such over-confident examples can be efficiently found along the direction of adversarial perturbations for a given input. Then, we suggest to regularize the over-confident predictions along the adversarial direction toward the uniform prediction through a mixup loss [67] (see Figure 1 for an overview). This new approach of incorporating adversarial examples effectively permits more distant examples in training, even when they go off-class, based on the local-smoothness of smoothed classifiers. It also suggests an intuitive way of defining confidence beyond the given data samples to smoothed classifiers.
We evaluate our proposed SmoothMix against with various state-of-the-art robust training methods for smoothed classifiers on a wide range of image classification benchmarks, including MNIST [32], CIFAR-10 [29], and ImageNet [48] datasets. Overall, the results consistently show that our new adversarial training scheme for smoothed classifiers significantly improves the certified robustness compared to existing methods, e.g., one of our CIFAR-10 model could largely outperform an existing state-of-the-art result on the average certified robustness in ℓ2-radius 0.720 → 0.737. Through an extensive ablation study, we also verify that our method is (a) robust to the choice of hyperparameters, and (b) can effectively trade-off between the accuracy and robustness [66] of smoothed classifiers.
Overall, our work suggests that the robustness of a classifier should be set individually per sample considering its nearby inputs: we approach this problem by leveraging the relationship between the
prediction confidence and robustness of smoothed classifiers. Recently, there have been also some initial attempts to incorporate a sample-wise treatment for robustness by allowing input-dependent noise scales in randomized smoothing [1, 58, 10]. However, our theoretical analysis shows that such an approach would eventually suffer from the curse of dimensionality (Theorem 1 in Appendix B), highlighting our approach of focusing on a “better calibration” as a promising alternative.

heading: 2 Preliminaries
text: We assume an i.i.d. dataset D = {(xi, yi)} n i=1 ∼ P , where xi ∈ R d and yi ∈ Y := {1, · · · , C}, and focus on the problem of correctly classifying a given input x into one of C classes. Let f : Rd → Y be a classifier modeled by f(x) := argmaxc∈Y Fc(x) with F : R
d → ∆C−1, where ∆C−1 denotes the probability simplex in RC . For example, F can be a neural network followed by a softmax layer.
In the context of adversarial robustness, we require f not only to correctly classify (x, y) ∼ P , but also to be locally-constant around x, i.e., f should not contain any adversarial examples around x. In this respect, one can measure and attempt to maximize the adversarial robustness of a classifier f by considering the minimum-distance of adversarial perturbation [44, 7, 8], namely:
R(f ;x, y) := min f(x′) 6=y
‖x′ − x‖2. (1)
Randomized smoothing. In cases when f is too complex to control its predictions in practice, e.g., if f is a neural network on high-dimensional data, directly solving and maximizing (1) can be
hard. Randomized smoothing [11] instead constructs a new classifier f̂ from f that is easier to obtain robustness by transforming the base classifier f with a certain smoothing measure, where in this paper we focus on the case of Gaussian distributions N (0, σ2I):
f̂(x) := argmax c∈Y Pδ∼N (0,σ2I) (f(x+ δ) = c) . (2)
For a given (x, y), Cohen et al. [11] have shown that R(f̂ ;x, y) can be lower-bounded by the certified
radius R(f̂ , x, y), which can be derived from the confidence of f̂ at x, namely we denote it by pf (x):
R(f̂ ;x, y) ≥ σ · Φ−1(pf (x)) =: R(f̂ , x, y) where pf (x) := Pδ∼N (0,σ2I)(f(x+ δ) = f̂(x)), (3)
provided that f̂(x) = y, and otherwise R(f̂ ;x, y) := 0.4 This lower bound is known as tight for the ℓ2-minimum distance, e.g., the bound is optimal for linear classifiers [11].
Although randomized smoothing can be applied for any classifier f : Rd → Y , the robustness of smoothed classifiers can vary depending on pf as in (3), i.e., how f performs on a given input under
the presence of Gaussian noise. In this sense, to obtain a robust f̂ , Cohen et al. [11] simply propose to train f using Gaussian augmentation by default:
min F E (x,y)∼P δ∼N (0,σ2I) [L(F (x+ δ), y)] , (4)
where L denotes the standard cross-entropy loss.
Adversarial training for smoothed classifiers. To obtain f that gives a more robust classifier when
smoothed into f̂ , Salman et al. [49] propose SmoothAdv that employs adversarial training [40] on f̂ :
min f̂ max ‖x′−x‖2≤ǫ
L(f̂ ;x′, y). (5)
Due to the intractability of f̂ , however, it is hard to directly optimize the inner maximization of (5) via
gradient methods. To bypass this, SmoothAdv attacks the soft-smoothed classifier F̂ := Eδ[Fy(x+δ)] instead. Specifically, SmoothAdv finds an adversarial example via solving the following:
x̂ = argmax ‖x′−x‖2≤ǫ L(F̂ ;x′, y) ≈ argmax ‖x′−x‖2≤ǫ
(
− log
(
1
m
∑
i
Fy(x ′ + δi)
))
, (6)
using Monte Carlo integration with m samples of δ, namely δ1, · · · , δm ∼ N (0, σ 2I).
4Here, Φ denotes the cumulative distribution function of the standard normal distribution.

heading: 3 Method
text: Our goal in this paper is to develop a more suitable form of adversarial training (AT) for smoothed classifiers, taking into account their unique characteristics on adversarial robustness over standard neural networks. Figure 1 illustrates a motivating example: as shown in Figure 1(a), AT typically assumes a fixed-sized ball of radius ε that each adversarial perturbation must be in, as the goal of the training is to defend the classifier against adversaries under a specific threat model. However, in a case when AT is applied to a smoothed classifier, e.g., as done by SmoothAdv, this assumption may be too restrictive, particularly for inputs where the classifier already certifies robustness of radii larger than ε (e.g., Figure 1(b)). This demands for a new form of AT specially for smoothed classifiers, e.g., that allows more distant adversarial examples, despite its fundamental difficulty in the context of standard neural networks [25, 69].
In this regard, our proposed training method of SmoothMix takes a completely different approach to incorporate adversarial examples during training. More specifically, for a given sample (x, y) ∼ P , our method finds an adversarial example of x without an explicit norm constraint, i.e., “unrestrictively.” This is because our focus is not to find an input for correcting its label to y (as in the standard AT), but to find an input that is over-confident and semantically off-class, i.e., it is not beneficial to the classifier to label this input to y. Once we have such an example, SmoothMix then labels it as the uniform confidence, and considers a mixup training [67] with the original x: by linearly interpolating with the uniform confidence, SmoothMix effectively calibrates the over-confident inputs in between, re-balancing the certified radius at the original sample of x at the end.

heading: 3.1 Exploring over-confident adversarial examples in smoothed classifiers
text: Recall that we have a (base) classifier f of the form f(x) = argmaxc∈Y Fc(x), f̂ is its smoothed counterpart, and we aim to improve the robustness of f̂ by incorporating adversarial examples in
training. In this paper, we are particularly interested in adversarial examples of f̂ that is found without a hard restriction in its perturbation size. More concretely, for a given training sample (x, y) ∼ P , we find adversarial examples by solving the following optimization:
x̃ := argmax x′
(
L(f̂ ;x′, y)− β · ‖x′ − x‖22
)
, (7)
where L is the cross-entropy loss, and β > 0 is to ensure that (7) cannot be arbitrarily far from x.
As proposed by Salman et al. [49] (see Section 2), one can optimize (7) by approximating the
intractable f̂ with the soft-smoothed classifier F̂ := Eδ[F (x+ δ)], in a similar manner to (6). Based on this approximation, we simply perform a T -step gradient ascent from x̃(0) := x with step size α > 0 to solve (7) using m samples of δ, namely δ1, · · · , δm ∼ N (0, σ 2I):5
x̃(t+1) := x̃(t) + α · ∇xJ(x̃
(t))
‖∇xJ(x̃(t))‖2 , where J(x) := − log
(
1
m
∑
i
Fy(x+ δi)
)
. (8)
Figure 2 demonstrates two particular instances of these “unrestricted” adversarial examples found from (8) on x, and plots how the confidence of inputs changes as they are linearly interpolated from the clean input to its adversarial counterpart. From this illustration, we make several remarks those would lead to a more direct motivation to our method:
• We observe that adversarial perturbations found via (8), i.e., from a smoothed classifier, could contain enough amount of semantic changes even in a perceptual sense, in either ways of translating the input to another class (Figure 2(a)), or simply removing some relevant information for the current class (Figure 2(b)). At least for these cases, therefore, it is reasonable for the classifier to keep its low confidence to the original class. Such a “perceptually-aligned” representation is not a unique property of smoothed classifiers, but has been generally observed on adversarially-robust classifiers [50, 15, 26]: in other words, we leverage the provable robustness of smoothed classifiers during training to reasonably obtain a semantically off-class samples, those will be labeled as the uniform confidence.
5Here, we note that the β-term in (7) are omitted in (8). In practice, we do not use nor tune β in our method mainly for simplicity, as the role of β can be replaced by assuming a finite α · T , i.e., by the Lagrangian duality: an unconstrained optimization with ℓ2-regularization implicitly defines a hard constraint in its ℓ2-norm.

heading: 3.2 SmoothMix for confidence-calibrated training of smoothed classifiers
text: Based on the observations from Section 3.1, we hypothesize that the miscalibration of confidences between x and its unrestricted adversarial example x̃ is an important factor that degrades the certified robustness of smoothed classifiers, and propose to penalize the over-confidence by mixing the uniform confidence to them. More concretely, we consider the mixup [67] training between x and x̃, i.e., by augmenting the given training data with the following pairs:
xmix := (1− λ) · x+ λ · x̃(T ), ymix := (1− λ) · F̂ (x) + λ · ✶ C , where λ ∼ U
([ 0, 12 ]) (9)
where F̂ (x) ∈ ∆C−1 is the soft-smoothed prediction of x, U denotes the uniform distribution, λ is a random variable that represents the mixing ratio between (x, F̂ (x)) and (x̃(T ),U(Y)), and ✶ denotes the C-dimensional vector of ones. Here, we notice that λ is sampled only from [0, 12 ], unlike the standard choice [67] of U([0, 1]): recall from Figure 2(a) that x̃ can be often semantically in-class, so that a direct supervision of the uniform confidence on it could harm the classifier. By simply taking only the half part of the mixed samples closer to x, we could reasonably avoid these cases while maintaining its effect to prevent the over-confidence issue. The actual loss to minimize for these new data simply follows the cross-entropy loss with Gaussian augmentation, similarly to (4):
Lmix := Eδ∼N (0,σ2I) [ L(F (xmix + δ), ymix) ] . (10)
6We nevertheless remark that such x̃ is still sufficiently far from x compared to the adversarial examples commonly used in the standard adversarial training (and SmoothAdv), that has a hard ℓ2-norm restriction.
Recall the over-confidence issue observed in Figure 2 as we follow from x to x̃(T ). Minimizing Lmix (10) directly corresponds to calibrating the high confidence at x̃(T ) and the samples in-between, while keeping the original prediction of F̂ (x) at x. Even in cases that x̃(T ) does not have an over-confidence issue, i.e., when its prediction is already close to the uniform confidence, the loss (10) would assign a relatively low value for x̃(T ) so that it can act only if there exists an overconfident x̃(T ) nearby x.
Incorporating SmoothAdv for free. As our method focuses on adversarial examples that are moderately far from the original inputs assuming that the classifier is already locally-smooth, one may still enjoy the effectiveness of SmoothAdv if it could further enforce the local smoothness. We indeed observe that the joint training can be helpful for the robustness of smoothed classifiers, but a naïve combination of them could incur too much costs for finding separate adversarial examples for each method. Instead, we found that simply taking x ← x̃(1) without modifying our current training, i.e., using the single-step adversarial example found during (8) instead of the clean sample, can reasonably bring a similar effect. In this respect, we allow SmoothMix to use (x̃(1), y) instead of (x, y) depending on demand of more robustness at expense of decreased clean accuracy.
Overall training. Combining the proposed loss with the standard Gaussian training (4) gives the full objective to minimize for our training method. For a given sample (x, y) ∼ P , and by letting Lnat := Eδ [L(F (x+ δ), y)], the final loss of SmoothMix is given by:
L := Lnat + η · Lmix (11)
where η > 0 is a hyperparameter to control the trade-off between accuracy and robustness. Algorithm 1 in Appendix A demonstrates a concrete training procedure of SmoothMix using m samples of δ for the Monte Carlo approximation.

heading: 4 Experiments
text: We evaluate the effectiveness of our method extensively on MNIST [32], CIFAR-10 [29], and ImageNet [48]7 classification datasets. Overall, the results consistently highlight that our newly proposed training can significantly improve the certified robustness of smoothed classifiers compared to existing robust training methods. We point out the improvements are especially remarkable on the certified accuracy at larger perturbations, at which SmoothMix mainly focus compared to prior arts. We also conduct an ablation study on the proposed method to convey a detailed analysis on the individual components. The detailed experimental setups, e.g., training details, datasets, and hyperparameters for the baseline methods, are specified in Appendix C.
Baseline methods. We compare our method with a variety of existing techniques proposed for a robust training of smoothed classifiers, as listed in what follows: (a) Gaussian [11]: standard training with Gaussian augmentation; (b) Stability training [38]: a cross-entropy regularization between F (x) and F (x+ δ); (c) SmoothAdv [49]: adversarial training on smoothed classifier; (d) MACER [65]: a regularization that maximizes an approximative form of the certified radius (3); and (e) Consistency [23]: a KL-divergence based regularization that minimizes the variance of F (x + δ) across δ. Whenever possible, we use the pre-trained models released by authors for our evaluation to reproduce the baselines. The more detailed training configurations are specified in Appendix C.2.
Evaluation metrics. Our evaluation of the robustness for a given smoothed classifier f̂ is largely based on the protocol proposed by Cohen et al. [11], similarly to prior works [49, 65, 23]: more concretely, Cohen et al. [11] proposed a practical Monte Carlo based certification procedure, namely
CERTIFY, that returns the prediction of f̂ and a “safe” lower bound of certified radius over the randomness of n samples with probability at least 1− α, or abstains the certification.
From CERTIFY, we consider two evaluation metrics: (a) the approximate certified test accuracy at various radii: the fraction of the test dataset which CERTIFY classifies correctly with radius larger than r without abstaining, and (b) the average certified radius (ACR) [65]: the average of certified radii returned by CERTIFY on the test dataset counting only the correctly classified samples, namely ACR := 1|Dtest| ∑ (x,y)∈Dtest CR(f, σ, x) · 1 f̂(x)=y , where Dtest is the test dataset, and CR denotes the certified radius from CERTIFY(f, σ, x). Here, the latter metric, ACR, is for a better comparison of robustness under trade-off between accuracy and robustness [56, 66]: by its definition, ACR naturally
7Results on the ImageNet dataset can be found in Appendix G.
Table 2: Comparison of approximate certified test accuracy (%) and ACR on MNIST. All the models are trained and evaluated with the same smoothing factor specified by σ. Each value except ACR indicates the fraction of test samples which have ℓ2 certified radius larger than the threshold specified at the top row. We set our results bold-faced whenever the value improves the Gaussian baseline, and underlined whenever the value improves the best among the considered baselines.
σ Models (MNIST) ACR 0.00 0.25 0.50 0.75 1.00 1.25 1.50 1.75 2.00 2.25 2.50 2.75
0.25
Gaussian [11] 0.911 99.2 98.5 96.7 93.3 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 Stability training [38] 0.915 99.3 98.6 97.1 93.8 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 SmoothAdv [49] 0.932 99.4 99.0 98.2 96.8 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 MACER [65] 0.920 99.3 98.7 97.5 94.8 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 Consistency [23] 0.928 99.5 98.9 98.0 96.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
SmoothMix (η = 1.0) 0.931 99.5 98.9 98.2 96.4 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 + One-step adversary 0.933 99.4 99.0 98.2 96.9 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 SmoothMix (η = 5.0) 0.932 99.4 99.0 98.2 96.7 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 + One-step adversary 0.933 99.3 99.0 98.2 97.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
0.50
Gaussian [11] 1.553 99.2 98.3 96.8 94.3 89.7 81.9 67.3 43.6 0.0 0.0 0.0 0.0 Stability training [38] 1.570 99.2 98.5 97.1 94.8 90.7 83.2 69.2 45.4 0.0 0.0 0.0 0.0 SmoothAdv [49] 1.687 99.0 98.3 97.3 95.8 93.2 88.5 81.1 67.5 0.0 0.0 0.0 0.0 MACER [65] 1.594 98.5 97.5 96.2 93.7 90.0 83.7 72.2 54.0 0.0 0.0 0.0 0.0 Consistency [23] 1.657 99.2 98.6 97.6 95.9 93.0 87.8 78.5 60.5 0.0 0.0 0.0 0.0
SmoothMix (η = 1.0) 1.678 99.0 98.4 97.4 95.7 93.0 88.1 80.0 65.6 0.0 0.0 0.0 0.0 + One-step adversary 1.694 98.8 98.1 97.1 95.3 92.7 88.3 81.7 69.5 0.0 0.0 0.0 0.0 SmoothMix (η = 5.0) 1.694 98.7 98.0 97.0 95.3 92.7 88.5 81.8 70.0 0.0 0.0 0.0 0.0 + One-step adversary 1.685 98.2 97.5 96.3 94.5 91.3 87.4 81.0 70.7 0.0 0.0 0.0 0.0
1.00
Gaussian [11] 1.620 96.3 94.4 91.4 86.8 79.8 70.9 59.4 46.2 32.5 19.7 10.9 5.8 Stability training [38] 1.634 96.5 94.6 91.6 87.2 80.7 71.7 60.5 47.0 33.4 20.6 11.2 5.9 SmoothAdv [49] 1.779 95.8 93.9 90.6 86.5 80.8 73.7 64.6 53.9 43.3 32.8 22.2 12.1 MACER [65] 1.598 91.6 88.1 83.5 77.7 71.1 63.7 55.7 46.8 38.4 29.2 20.0 11.5 Consistency [23] 1.740 95.0 93.0 89.7 85.4 79.7 72.7 63.6 53.0 41.7 30.8 20.3 10.7
SmoothMix (η = 1.0) 1.788 95.5 93.5 90.5 86.2 80.6 73.4 64.3 53.7 43.2 33.5 23.9 14.1 + One-step adversary 1.816 94.7 92.4 89.2 84.6 79.4 72.5 64.0 54.5 44.8 36.2 27.4 18.7 SmoothMix (η = 5.0) 1.820 93.7 91.6 88.1 83.5 77.9 70.9 62.7 53.8 44.8 36.6 28.9 21.5 + One-step adversary 1.823 93.3 90.9 87.5 83.0 77.5 70.6 62.7 53.4 44.9 37.1 29.3 22.4
Gaussian Stability SmoothAdv MACER Consistency SmoothMix C e rt if ie d a
c c u
ra c y
0.7
0.8
0.9
1.0
Radius 0 0.2 0.4 0.6 0.8 1.0
(a) σ = 0.25
Gaussian Stability SmoothAdv MACER Consistency SmoothMix C e rt if ie d a
c c u
ra c y
0
0.2
0.4
0.6
0.8
1.0
Radius 0 0.5 1.0 1.5 2.0
(b) σ = 0.50
Gaussian Stability SmoothAdv MACER Consistency SmoothMix
C e
rt if ie
d a
c c u
ra c y
0
0.2
0.4
0.6
0.8
1.0
Radius 0 1 2 3 4
(c) σ = 1.00
Figure 4: Comparison of approximate certified accuracy for various training methods on MNIST. The sharp drop of certified accuracy in each plot is due to that there is a strict upper bound in radius that CERTIFY can output for a given σ and n = 100, 000.
assigns 0 for the incorrectly classified test samples, i.e., when f̂(x) 6= y, so that a decreased clean accuracy of f̂ would negatively affect the value of ACR. We use the official PyTorch implementation8 of CERTIFY, with n = 100, 000, n0 = 100 and α = 0.001, following [11, 49, 23].

heading: 4.1 Results on MNIST
text: For MNIST [32] experiments, we report the approximate certified accuracy and ACR of smoothed classifiers obtained from LeNet [32] with different training methods, including SmoothMix, using the full MNIST test dataset. We consider three different models as varying the noise level σ ∈ {0.25, 0.5, 1.0}. During inference, we apply randomized smoothing with the same σ used in the training. When SmoothMix is used, we consider a fixed hyperparameter value for α = 1.0 and
8https://github.com/locuslab/smoothing
m = 4, the step size and the number of noise samples. We empirically observe that it is beneficial to set α · T to be proportional to σ, the noise level, as there exist different upper bounds on the certified radius statistical achievable in practice depending on σ: in this respect, we set T = 2, 4, 8 for the models with σ = 0.25, 0.5, 1.0, respectively. We apply the same m = 4 for SmoothAdv, i.e., for adversarial training, as well, and T = 10 with an ℓ2-constraint of radius ε = 1.0. Here, notice that SmoothMix and SmoothAdv use the same number of hyperparameters: more specifically, although SmoothMix introduces α compared to SmoothAdv, the step size in (8), it instead does not use the hyperparameter ε of SmoothAdv, i.e., the maximum norm of adversarial perturbations.
The results are presented in Table 2 and Figure 4. Overall, we observe that our proposed SmoothMix loss (10) added to the Gaussian training dramatically improves the certified test accuracy from “Gaussian”. By considering the one-step adversary (Section 3.2) in training, we could further improve the robust accuracy, significantly improving ACRs compared to the previous state-of-the-art training methods: e.g., our method could improve ACRs with σ = 1.0 from 1.779 → 1.823. This shows that improvements from SmoothMix can be orthogonal to those from SmoothAdv. It is also remarkable that even without the one-step adversarial example, one could further improve the certified robustness by simply increasing the relative strength η of the SmoothMix loss, e.g., by 1.0→ 5.0 as presented in Table 2: e.g., “SmoothMix” with η = 5.0 still outperforms “SmoothAdv” by 1.779 → 1.820 at σ = 1.0. Finally, we note that our models could substantially improve the robustness at larger perturbations with less degradation in the clean accuracy, e.g., compared to “MACER” or “Consistency”: considering that they are also regularization based approaches that allow to control the robustness via controlling their regularization strength, the results show that our form of loss could better compensate the trade-off between accuracy and robustness.

heading: 4.2 Results on CIFAR-10
text: For CIFAR-10 [29] experiments, we report the approximate certified accuracy and ACR of smoothed classifiers from ResNet-110 [20] using the full CIFAR-10 test dataset. Again, we consider three different models as varying the noise level σ ∈ {0.25, 0.5, 1.0},9 and apply the same σ for inference as well. When SmoothMix is used, we consider a fixed hyperparameter value for T = 4 and m = 2, the number of steps and the number of noise samples, respectively. We also fix η = 5.0 throughout the experiments, as also used for MNIST (see Table 2). Again, we make sure that α · T to be proportional to σ, so that we set α = 0.5, 1.0, 2.0 for the models with σ = 0.25, 0.5, 1.0, respectively. For SmoothAdv, we report the performance evaluated from the pre-trained models released by the authors10 for a fixed configuration of T = 10, ε = 1.0, and m = 8.
9Due to the space limitation, we defer the CIFAR-10 results with σ = 1.0 to Appendix F, considering that the scenario can be less practical compared to the others: e.g., the clean accuracy in this setup is < 50% in most cases, even for the Gaussian baseline [11].
10https://github.com/Hadisalman/smoothing-adversarial
The results are summarized in Table 3 and Figure 5. Again, we still observe that our method generally exhibits better trade-offs between accuracy and certified robustness compared to other baselines: e.g., at σ = 0.5, “SmoothMix” could improve the previous best result from “Consistency” by a significant margin of 0.720→ 0.737. Without the single-step adversary, “SmoothMix” can effectively preserve the clean accuracy while also improving ACR, e.g., at σ = 0.25, “SmoothMix” could even improve the clean accuracy of “Gaussian”: although “MACER” could improve the clean accuray as well, one could see that their improvements in robust accuracy are relatively limited. It is also notable that the certified test accuracy we report in Table 3 can sometimes complement ACR: although “Consistecny” achieves a competitive ACR with “SmoothMix” at σ = 0.25, one can still confirm the superiority of “SmoothMix” by comparing the certified accuracy r = 0.0 (i.e., the clean accuracy), namely 75.8% vs. 77.1%, given that they both achieve similar certified accuracy at r = 0.75 (i.e., the robust
accuracy). This is because a bare increase in the clean accuracy (i.e., f̂ correctly classifies more test samples but with CR’s closer to 0) often contributes less to the increase in ACR.

heading: 4.3 Ablation study
text: We also conduct an ablation study to investigate the individual effects of the hyperparameters in our method. Unless otherwise noted, we perform experiments on MNIST with σ = 1.0. All the detailed results from this ablation study are reported in Appendix H.
Equal-confidence mixing ratios. Recall from Figure 2 that we are motivated by the problem of miscalibration in smoothed classifiers between clean and its adversarial example. To see how much the proposed SmoothMix could alleviate this issue, we compare the distributions of the minimal mixing ratios that changes its prediction of a given classifier on the CIFAR-10 test samples, namely the equal-confidence mixing ratios, before and after training with SmoothMix. We find the adversarial examples separately from two pre-trained ResNet-110 based (smoothed) classifiers, each trained by Gaussian training and SmoothMix, respectively, assuming σ = 0.25. We optimize each adversarial example assuming only a quite loose norm-bound of ε = 8 to allow more update steps, i.e., via 50-step PGD for both classifiers. Figure 3 shows the result, and it indeed confirms SmoothMix has an effect of improving calibration between clean and adversarial examples.
Effect of η. By design, SmoothMix controls the trade-off between accuracy and robustness by adjusting η, the relative strength of Lmix over Lnat (11). Here, we further examine the effect of η by comparing the certified robustness on varying η ∈ {1, 2, 4, 8, 16}: the results in Figure 6 show that increasing η consistently improves the certified robustness of the classifier, which confirms Lmix, the mixup loss, as an effective term to trade-off the robustness against Lnat for accuracy.
Trade-off between α and T . In practice, SmoothMix can trade-off between the step size α and the number of steps T to compensate between a more accurate optimization of (7) and its computational cost, while maintaining the effective range of the perturbation by α ·T . Figure 7(a) explores this tradeoff, by comparing models trained with different combinations of (α, T ) under control of α · T = 8.0. Interestingly, the results indicate that the choice of α and T does not significantly affect the final performance as long as α · T is constant: all the considered combinations achieve similar robustness, with only a slight degradation in ACR even at (α, T ) = (8.0, 1) (see Table 9 in Appendix H). This
suggests that (a) finding adversarial examples in a smoothed classifier can be simpler than one might expect, and (b) one can effectively reduce the training cost of SmoothMix using small T in practice.
Hard restriction on adversarial attacks. One of key features of SmoothMix is at its unrestricted search of adversarial examples. Here, we examine the case when there is a hard restriction on each search, namely in ℓ2-radius of ε ∈ {2, 4, 6, 8}. The results presented in Figure 7(b) along with the Gaussian baseline (“Gaussian”) and the original unrestricted setup (“ε =∞”) show that SmoothMix indeed works best when there is no such restrictions, although these ablations still reasonably improve the Gaussian baseline, i.e., calibrating with adversarial examples outside the ε-ball can indeed help to improve the certified robustness in our training scheme.
Effect of m. Figure 7(c) (and Table 11 in Appendix H) investigates the effect of using different m ∈ {1, 2, 4, 8}, the number of noise samples to approximate the prediction of smoothed classifier: the larger m, the better approximation of smoothed classifier, which would be beneficial for both natural loss and SmoothMix loss (11). Overall, we observe that SmoothMix can still improve ACR from “Gaussian” even with m = 1, but with a moderate degradation in the clean accuracy: as m is one of the crucial factors related to the total training cost in practice, one is recommended to use smaller m, e.g., m = 2 or 4, considering its little effect to the final ACR.

heading: 5 Discussion and conclusion
text: We observe that adversarial training with an unrestricted adversary can be feasible and even more promising (compared to the restricted ones) when it comes with smoothed classifiers, by showing their effectiveness to improve the certified adversarial robustness with a novel mixup-based training. We address the brittleness of deep neural networks through the lens of smoothed classifiers, which could give us a simpler view on them. We believe our research could be a useful step toward understanding what essentially constitutes adversarial examples in deep neural networks.
Broader impact. Adversarial robustness in deep learning is arguably an essential requirement for AI safety [2], with much impact on various security-concerned systems: e.g., medical diagnosis [9], speech recognition [46] and autonomous driving [64]. Thanks to their certifiable guarantees, we believe a practical success of systems based on randomized smoothing would be fatal for those who maliciously attempt to break down the system via adversarial attacks. Nevertheless, one should also recognize that current techniques for robustness in deep learning, including randomized smoothing as well, indeed have a clear gap to be practically used in real-world, e.g., defending against challenging unrestricted attacks [60, 5], which should be further investigated in the future research. Consequently, it is particularly important for the defense techniques not to be misused in practical systems, as a failure of such systems may lead practitioners to have a biased, false sense of security.
Limitation. While our ultimate goal is to find optimal smoothed classifiers in terms of the accuracy and robustness trade-off, SmoothMix should not be considered as the final solution for the problem; our method is a promising proof-of-concept showing the close relationship between randomized smoothing and confidence-calibrated classifiers [19, 36]. Although our focus in this paper is currently limited only to the over-confidence issue, we believe there are still many rooms to be explored in future for another such connection, e.g., could the recent developments in the literature of uncertainty estimation of deep neural networks [22, 54] help to improve the robustness of smoothed classifiers.
Acknowledgments and Disclosure of Funding
This work was conducted by Center for Applied Research in Artificial Intelligence (CARAI) grant funded by Defense Acquisition Program Administration (DAPA) and Agency for Defense Development (ADD) (UD190031RD). The authors would like to thank Jaeho Lee for helpful discussions.

Review summaries:
This paper looks to improve upon SmoothAdv - a methodology that employs adversarial training on a smoothed classifier to further improve certified robustness. The methodology employed looks to tackling overconfident examples rather than adversarial examples by utilising MixUp. They demonstrate that we can combine MixUp with SmoothAdv to improve certified accuracy.

The paper proposes a new method for training models to achieve better certified L-2 robustness. To this extent, SmoothMix generates adversarial examples by relaxing the perturbation budget and minimizes a mixup loss. The proposed procedure identifies instances classified with high confidence and near-off-class samples as causes of limited robustness in smoothed classifiers and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness. Finally, the method obtains improved certified accuracy for certain radii ε that each adversarial perturbation must be in.

The paper offers a novel training scheme—called SmoothMix—for fitting deep net classifiers with improved adversarial robustness while maintaining accuracy to the extent possible. The key idea is to combine the mixup loss with smooth classifiers. The former interpolates the input sample with its adversarial perturbation, designed to “mislead” the smoothed classifier. The effectiveness of the proposed idea was studied on MNIST, CIFAR10, and ImageNet, showing competitive performance to that of state-of-the-art adversarial defense strategies (Gaussian smoothing, stability training, adversarial smoothing, MACER, and consistency).

The paper observes a connection between the confidence with which a smooth model classifies an input and the robustness radius with which the input's prediction can be certified. In particular, the paper argues that the model's over-confidence on some inputs can be a source for detrimental effects on the certified radius of other (nearby) instances. Inspired by this, the paper proposes to find over-confident near off-class samples (somewhat) near training instances, and conduct mixup training on this pair of instances as a way of improving the certified accuracy of the resulting smoothed classifier. The proposal can be regarded as another way of adversarial training that is better crafted for smoothed classifiers. Experiments conducted on MNIST, CIFAR and ImageNet show marginal but consistent improvements in certified accuracy.