SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustness

Randomized smoothing is currently a state-of-the-art method to construct a certifiably robust classifier from neural networks against ℓ2-adversarial perturbations . Under the paradigm , the robustness of a classifier is aligned with the prediction confidence , i.e. , the higher confidence from a smoothed classifier implies the better robustness . This motivates us to rethink the fundamental trade-off between accuracy and robustness in terms of calibrating confidences of a smoothed classifier . In this paper , we propose a simple training scheme , coined SmoothMix , to control the robustness of smoothed classifiers via self-mixup : it trains on convex combinations of samples along the direction of adversarial perturbation for each input . The proposed procedure effectively identifies over-confident , near off-class samples as a cause of limited robustness in case of smoothed classifiers , and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness . Our experimental results demonstrate that the proposed method can significantly improve the certified ℓ2-robustness of smoothed classifiers compared to existing state-of-the-art robust training methods.3 1 Introduction . Adversarial examples [ 53 , 17 ] in deep neural networks clearly highlight that neural networks often generalize differently from humans , at least without an additional prior of local smoothness of predictions with respect to the input space : an adversarially-crafted , yet imperceptible input perturbation can drastically change the prediction of a neural network based classifier . Due to the intrinsic complexity of neural networks , however , the community has noticed that it is extremely hard to directly encode this smoothness prior into neural networks [ 6 , 3 , 55 ] , especially without relying on adversarial training [ 40 , 66 ] , i.e. , augmenting training data with its adversarial examples . Even with adversarial training , ( a ) the non-convex , minimax nature of the training introduces many optimization difficulties , often resulting in a harsh over-fitting [ 51 , 47 ] , and ( b ) it is generally hard to provably guarantee that the learned classifier is indeed smooth . ∗Work done at KAIST . †Work done at Kakao Enterprise . 3Code is available at https : //github.com/jh-jeong/smoothmix . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . Randomized smoothing [ 33 , 11 ] is relatively a recent idea that aims to indirectly encode the smoothness prior : Cohen et al . [ 11 ] have shown that any classifier , regardless of whether it is smooth or not , can be transformed into a certifiably robust classifier via averaging its predictions over Gaussian noise , where the ( certified ) robustness of the classifier depends on how well the base classifier performs with the noise . Compared to adversarial training , this notion of “ indirect ” smoothness can be favorable in a sense that ( a ) it is easier to optimize , and ( b ) offers a provable guarantee on the robustness . Currently , randomized smoothing is considered as the state-of-the-art approach in the context of building a neural network based classifier that is certifiably robust on ℓ2-perturbations [ 39 ] . In this respect , a growing body of research has focused on improving the robustness guarantee that randomized smoothing can give , e.g. , via different smoothing measures [ 34 , 62 ] or improved certification procedures [ 14 , 43 ] . One of important directions on this line of research is to investigate which training of the base classifier could maximize the certified robustness of smoothed classifiers [ 49 , 65 , 23 ] . In particular , Salman et al . [ 49 ] have proposed SmoothAdv , showing that employing adversarial training [ 40 ] for smoothed classifiers could further improve the robustness , akin to the standard neural networks . This motivates us to develop a new form of adversarial training , more specialized for smoothed classifiers . Contribution . In this paper , we propose SmoothMix , a novel adversarial training method designed for improving the certified robustness of smoothed classifiers . One of the key features that smoothed classifiers offer is a direct correspondence from prediction confidence to adversarial robustness : achieving a higher confidence in a smoothed classifier implies that the classifier can give a better certified robustness . Inspired by this , we found that the certified robustness of a given data sample can be significantly decreased by nearby off-class but over-confident [ 45 ] inputs : such “ harmful ” inputs would occupy an unnecessarily large robust radius near the sample of our interest , especially when they do not contain much information to be discriminated by the classifier . Under the finding , we aim to calibrate the confidence of these off-class inputs to improve the certified robustness at the original input . More specifically , we first observe that such over-confident examples can be efficiently found along the direction of adversarial perturbations for a given input . Then , we suggest to regularize the over-confident predictions along the adversarial direction toward the uniform prediction through a mixup loss [ 67 ] ( see Figure 1 for an overview ) . This new approach of incorporating adversarial examples effectively permits more distant examples in training , even when they go off-class , based on the local-smoothness of smoothed classifiers . It also suggests an intuitive way of defining confidence beyond the given data samples to smoothed classifiers . We evaluate our proposed SmoothMix against with various state-of-the-art robust training methods for smoothed classifiers on a wide range of image classification benchmarks , including MNIST [ 32 ] , CIFAR-10 [ 29 ] , and ImageNet [ 48 ] datasets . Overall , the results consistently show that our new adversarial training scheme for smoothed classifiers significantly improves the certified robustness compared to existing methods , e.g. , one of our CIFAR-10 model could largely outperform an existing state-of-the-art result on the average certified robustness in ℓ2-radius 0.720 → 0.737 . Through an extensive ablation study , we also verify that our method is ( a ) robust to the choice of hyperparameters , and ( b ) can effectively trade-off between the accuracy and robustness [ 66 ] of smoothed classifiers . Overall , our work suggests that the robustness of a classifier should be set individually per sample considering its nearby inputs : we approach this problem by leveraging the relationship between the prediction confidence and robustness of smoothed classifiers . Recently , there have been also some initial attempts to incorporate a sample-wise treatment for robustness by allowing input-dependent noise scales in randomized smoothing [ 1 , 58 , 10 ] . However , our theoretical analysis shows that such an approach would eventually suffer from the curse of dimensionality ( Theorem 1 in Appendix B ) , highlighting our approach of focusing on a “ better calibration ” as a promising alternative . 2 Preliminaries . We assume an i.i.d . dataset D = { ( xi , yi ) } n i=1 ∼ P , where xi ∈ R d and yi ∈ Y : = { 1 , · · · , C } , and focus on the problem of correctly classifying a given input x into one of C classes . Let f : Rd → Y be a classifier modeled by f ( x ) : = argmaxc∈Y Fc ( x ) with F : R d → ∆C−1 , where ∆C−1 denotes the probability simplex in RC . For example , F can be a neural network followed by a softmax layer . In the context of adversarial robustness , we require f not only to correctly classify ( x , y ) ∼ P , but also to be locally-constant around x , i.e. , f should not contain any adversarial examples around x . In this respect , one can measure and attempt to maximize the adversarial robustness of a classifier f by considering the minimum-distance of adversarial perturbation [ 44 , 7 , 8 ] , namely : R ( f ; x , y ) : = min f ( x′ ) 6=y ‖x′ − x‖2 . ( 1 ) Randomized smoothing . In cases when f is too complex to control its predictions in practice , e.g. , if f is a neural network on high-dimensional data , directly solving and maximizing ( 1 ) can be hard . Randomized smoothing [ 11 ] instead constructs a new classifier f̂ from f that is easier to obtain robustness by transforming the base classifier f with a certain smoothing measure , where in this paper we focus on the case of Gaussian distributions N ( 0 , σ2I ) : f̂ ( x ) : = argmax c∈Y Pδ∼N ( 0 , σ2I ) ( f ( x+ δ ) = c ) . ( 2 ) For a given ( x , y ) , Cohen et al . [ 11 ] have shown that R ( f̂ ; x , y ) can be lower-bounded by the certified radius R ( f̂ , x , y ) , which can be derived from the confidence of f̂ at x , namely we denote it by pf ( x ) : R ( f̂ ; x , y ) ≥ σ · Φ−1 ( pf ( x ) ) = : R ( f̂ , x , y ) where pf ( x ) : = Pδ∼N ( 0 , σ2I ) ( f ( x+ δ ) = f̂ ( x ) ) , ( 3 ) provided that f̂ ( x ) = y , and otherwise R ( f̂ ; x , y ) : = 0.4 This lower bound is known as tight for the ℓ2-minimum distance , e.g. , the bound is optimal for linear classifiers [ 11 ] . Although randomized smoothing can be applied for any classifier f : Rd → Y , the robustness of smoothed classifiers can vary depending on pf as in ( 3 ) , i.e. , how f performs on a given input under the presence of Gaussian noise . In this sense , to obtain a robust f̂ , Cohen et al . [ 11 ] simply propose to train f using Gaussian augmentation by default : min F E ( x , y ) ∼P δ∼N ( 0 , σ2I ) [ L ( F ( x+ δ ) , y ) ] , ( 4 ) where L denotes the standard cross-entropy loss . Adversarial training for smoothed classifiers . To obtain f that gives a more robust classifier when smoothed into f̂ , Salman et al . [ 49 ] propose SmoothAdv that employs adversarial training [ 40 ] on f̂ : min f̂ max ‖x′−x‖2≤ǫ L ( f̂ ; x′ , y ) . ( 5 ) Due to the intractability of f̂ , however , it is hard to directly optimize the inner maximization of ( 5 ) via gradient methods . To bypass this , SmoothAdv attacks the soft-smoothed classifier F̂ : = Eδ [ Fy ( x+δ ) ] instead . Specifically , SmoothAdv finds an adversarial example via solving the following : x̂ = argmax ‖x′−x‖2≤ǫ L ( F̂ ; x′ , y ) ≈ argmax ‖x′−x‖2≤ǫ ( − log ( 1 m ∑ i Fy ( x ′ + δi ) ) ) , ( 6 ) using Monte Carlo integration with m samples of δ , namely δ1 , · · · , δm ∼ N ( 0 , σ 2I ) . 4Here , Φ denotes the cumulative distribution function of the standard normal distribution . 3 Method . Our goal in this paper is to develop a more suitable form of adversarial training ( AT ) for smoothed classifiers , taking into account their unique characteristics on adversarial robustness over standard neural networks . Figure 1 illustrates a motivating example : as shown in Figure 1 ( a ) , AT typically assumes a fixed-sized ball of radius ε that each adversarial perturbation must be in , as the goal of the training is to defend the classifier against adversaries under a specific threat model . However , in a case when AT is applied to a smoothed classifier , e.g. , as done by SmoothAdv , this assumption may be too restrictive , particularly for inputs where the classifier already certifies robustness of radii larger than ε ( e.g. , Figure 1 ( b ) ) . This demands for a new form of AT specially for smoothed classifiers , e.g. , that allows more distant adversarial examples , despite its fundamental difficulty in the context of standard neural networks [ 25 , 69 ] . In this regard , our proposed training method of SmoothMix takes a completely different approach to incorporate adversarial examples during training . More specifically , for a given sample ( x , y ) ∼ P , our method finds an adversarial example of x without an explicit norm constraint , i.e. , “ unrestrictively. ” This is because our focus is not to find an input for correcting its label to y ( as in the standard AT ) , but to find an input that is over-confident and semantically off-class , i.e. , it is not beneficial to the classifier to label this input to y . Once we have such an example , SmoothMix then labels it as the uniform confidence , and considers a mixup training [ 67 ] with the original x : by linearly interpolating with the uniform confidence , SmoothMix effectively calibrates the over-confident inputs in between , re-balancing the certified radius at the original sample of x at the end .

Summary: The paper proposes a new method for training models to achieve better certified L-2 robustness. To this extent, SmoothMix generates adversarial examples by relaxing the perturbation budget and minimizes a mixup loss. The proposed procedure identifies instances classified with high confidence and near-off-class samples as causes of limited robustness in smoothed classifiers and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness. Finally, the method obtains improved certified accuracy for certain radii ε that each adversarial perturbation must be in.