Avoiding Robust Misclassifications for Improved Robustness without Accuracy Loss

While current methods for training robust deep learning models optimize robust accuracy , in practice , the resulting models are often both robust and inaccurate on numerous samples , providing a false sense of safety for those . Further , they significantly reduce natural accuracy , which hinders the adoption in practice . In this work , we address both of these challenges by extending prior works in three main directions . First , we propose a new training method that jointly maximizes robust accuracy and minimizes robust inaccuracy . Second , since the resulting models are trained to be robust only if they are accurate , we leverage robustness as a principled abstain mechanism . Finally , this abstain mechanism allows us to combine models in a compositional architecture that significantly boosts overall robustness without sacrificing accuracy . We demonstrate the effectiveness of our approach to both empirical and certified robustness on six recent state-of-the-art models and using several datasets . For example , on CIFAR-10 with ε∞ = 1/255 , it successfully enhanced the robust accuracy of a state-of-the-art standard trained model from 26 % to 86 % while only marginally reducing its natural accuracy from 97.8 % to 97.6 % . 1 INTRODUCTION . In recent years , there has been a significant amount of work that studies and improves both adversarial ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ; Croce & Hein , 2020 ; Madry et al. , 2018 ) and certified robustness ( Balunovic & Vechev , 2019 ; Cohen et al. , 2019 ; Salman et al. , 2019 ; Xu et al. , 2020 ; Zhai et al. , 2020 ; Zhang et al. , 2019b ) of neural networks . However , currently , there are two key limitations that hinder the wider adoption of robust models in practice . Existing Models are Robustly Inaccurate First , despite substantial progress in training robust models , existing works usually only report robust accuracy , i.e. , samples for which the model robustly predicts the correct label . Meanwhile , the issue of robust inaccuracy , i.e. , samples that are robustly misclassified with a wrong label , is usually not even reported ( we formally define robust inaccuracy in Equation 3 ) . This is especially problematic for safety-critical models , where the robustness can be mistakenly used as a safety argument . We quantify the severity of this issue in Table 1 , by evaluating recent state-of-the-art robust models . As can be seen , recent models contain up to 15 % of robust inaccurate samples and the ratio of such samples worsens with smaller perturbation regions . x1 x2 0 12 rob ( ( F , SERI ) , D ) = 91.1 % rob ( ( F , SERI ) , D ) = 100.0 % std 0 1 2 x1 x2 0 1 rob ( ( F , SERI ) , D ) = 100.0 % rob ( ( F , SERI ) , D ) = 98.4 % TRADES 0 1 2 x1 x2 0 1 rob ( ( F , SERI ) , D ) = 98.4 % rob ( ( F , SERI ) , D ) = 100.0 % ERA ( ours ) 0 1 2 robust & accurate non-robust & accurate robust & inaccurate non-robust & inaccurate robust & accurate non-robust & accurate robust & inaccurate non-robust & inaccurate Lstd LTRADES ( ours ) LERA Figure 1 : Decision regions for models trained via standard trainingLstd , adversarial trainingLTRADES ( Zhang et al. , 2019a ) , and our training LERA ( Equation 5 ) . In this case , our training achieves the same robust accuracy as LTRADES but avoids all robust inaccurate samples by making them non-robust . Note that all three models predict over all three classes , however , the decision regions for class 2 of the LTRADES and LERA trained models happen to be too small to be visible . The considered model architecture and the training hyperparameters are provided in Appendix A.2 . Robustness vs Accuracy Tradeoff Second , existing robust training methods improve the model robustness , but they also typically degrade the standard accuracy on unperturbed inputs . To address this limitation , a number of recent works study this issue in detail and propose new methods to mitigate it ( Mueller et al. , 2020 ; Raghunathan et al. , 2020 ; Yang et al. , 2020 ; Stutz et al. , 2019 ) . Our Work In this work , we advance the line of work that aims to boost robustness without sacrificing accuracy , but we approach the problem from a new perspective – by avoiding robust inaccuracy . Concretely , we propose a new training method that jointly maximizes robust accuracy while minimizing robust inaccuracy . We illustrate the effect of our training on a synthetic dataset ( described in Appendix A.2 ) in Figure 1 , showing the decision boundaries of three models , trained using standard training Lstd , adversarial training LTRADES ( Zhang et al. , 2019a ) , and our training LERA ( Equation 5 ) . First , observe that while the Lstd trained model achieves 100 % accuracy , only 91.1 % of these samples are robust ( and accurate ) . When using LTRADES , we can observe the robustness vs accuracy tradeoff – the robust accuracy improves to 98.4 % at the expense of 1.6 % ( robust ) inaccuracy . In contrast , using our LERA , we retain the high robust accuracy of 98.4 % but avoid all robust inaccurate samples by appropriately shifting the decision boundary , rendering them non-robust . Second , since our models are trained to be robust only if they are accurate , we leverage robustness as a principled abstain mechanism . This abstain mechanism then allows us to combine models in a compositional architecture that significantly boosts overall robustness without sacrificing accuracy . Concretely , in Figure 1 , we would define a selector model that abstains on all non-robust samples . Then , the abstained ( non-robust ) samples are evaluated by the standard trained model Lstd , while the selected samples are evaluated using the robust model LERA . This allows us to achieve the best of both models – high robust accuracy ( 98.4 % ) , high natural accuracy ( 100 % ) , and no robust inaccuracy . We show the practical effectiveness of our approach by instantiating over several datasets and existing robust models for both empirical and certified robustness . Our evaluations show that our method effectively reduces robust and inaccurate samples by up to 97.28 % . Further , our approach significantly improves robustness for CIFAR-10 , CIFAR-100 , MTSD and SBB datasets by 60.3 % , 38.8 % , 29.2 % and 37.7 % , respectively , while simultaneously decreasing natural accuracy by only 0.2 % . 2 RELATED WORK . There is a growing body of work that extends models with an abstain option , either by training a selector mechanism separately or jointly together with the model . The existing approaches include various selection mechanisms such as entropy selection ( Mueller et al. , 2020 ) , selection function ( Cortes et al. , 2016 ; Mueller et al. , 2020 ; Geifman & El-Yaniv , 2019 ) , softmax response ( Stutz et al. , 2020 ; Geifman & El-Yaniv , 2017 ) , or explicit abstain class ( Laidlaw & Feizi , 2019 ; Liu et al. , 2019 ) . In our work , we explore an alternative selector mechanism that uses model robustness . The advantage of this formulation is that the selector provides strong guarantees for each sample and can never produce false-positive selections . The disadvantage is that it introduces a significant runtime overhead , compared to many other methods that require only a single forward pass . At the same time , several recent works investigated the robustness and accuracy tradeoff both theoretically ( Yang et al. , 2020 ; Dobriban et al. , 2020 ) and practically by proposing new methods to mitigate it . For example , Raghunathan et al . ( 2020 ) proposes robust self-training that leverages unlabeled data to regularize the model . Stutz et al . ( 2019 ) considers a new method based on onmanifold adversarial examples , which are more aligned with the true data distribution than the ` p-norm noise models . Mueller et al . ( 2020 ) focuses on deterministic certification and also proposes using compositional models to control the robustness and accuracy tradeoff . In our work , we also take advantage of compositional models , but we focus on both empirical and probabilistic certified robustness . Further , our selector formulation is based on a new training that minimizes robust inaccuracy and can be used to fine-tune any existing robust model . Finally , we provide individual robustness at inference time , rather than distributional robustness considered in prior works . 3 PRELIMINARIES . Let fθ : Rd→Rk be a neural network which classifies inputs x∈X ⊆Rd to outputs Rk ( e.g. , logits or probabilities ) . The hard classifier induced by the network is given as Fθ ( x ) = arg maxi∈Y fθ ( x ) i , where fθ ( x ) i is the network output for the i-th class and Y , |Y| = k is the finite set of discrete labels . Natural Accuracy Given a distribution over input-label pairs D and a classifier Fθ : X → Y , an input-label pair ( x , y ) is considered accurate iff the classifier Fθ predicts the correct label y for x : Rnat ( Fθ ) = E ( x , y ) ∼D 1 { Fθ ( x ) = y } ( 1 ) Robust Accuracy Given an input-label pair ( x , y ) , we say that the classifier Fθ is robust and accurate iff it predicts the correct label y for all samples from a predefined region Bpε ( x ) , such as a ` p-norm ball centered at x with radius ε , i.e. , Bpε ( x ) .. = { x′ : ||x′ − x||p ≤ ε } . Formally : Raccrob ( Fθ ) = E ( x , y ) ∼D 1 { Fθ ( x ) = y } ∧ 1 { ∀x′ ∈ Bpε ( x ) . Fθ ( x′ ) = Fθ ( x ) } ( 2 ) Robust Inaccuracy Similarly to robust accuracy , an input-label pair ( x , y ) is considered robustly inaccurate iff the classifier Fθ predicts an incorrect label Fθ ( x ) 6= y and Fθ is robust towards that misprediction for all inputs in Bpε ( x ) . Formally , the robust inaccuracy is defined as : R¬accrob ( Fθ ) = E ( x , y ) ∼D 1 { Fθ ( x ) 6= y } ∧ 1 { ∀x′ ∈ Bpε ( x ) . Fθ ( x′ ) = Fθ ( x ) } ( 3 ) 4 REDUCING ROBUST INACCURACY : ADVERSARIAL & CERTIFIED TRAINING . In this section , we present our training method that extends existing robust training approaches by also considering samples that are robust but inaccurate . We start by describing a high-level problem statement which we then instantiate for both empirical robustness as well as certified robustness . Problem Statement Given a distribution over input-label pairs D , our goal is to find model parameters θ such that the resulting model maximizes robust accuracy , while at the same time minimizing robust inaccuracy . Concretely , this translates to the following optimization objective : arg min θ E ( x , y ) ∼D β · Lrob ( x , y ) ︸ ︷︷ ︸ optimize robust accuracy + 1 { Fθ ( x ) 6= y } · L¬accrob ( x , y ) ︸ ︷︷ ︸ penalize robust inaccuracy ( 4 ) where β ∈ R+ is a regularization term , 1 { Fθ ( x ) 6= y } is an indicator function denoting samples for which the model is inaccurate , and Lrob ( x , y ) with L¬accrob ( x , y ) are loss functions that optimize robust accuracy and penalize robust inaccuracy , respectively . Here , the first loss function Lrob ( x , y ) is standard and can be directly instantiated using existing approaches ( see next ) . The main challenge comes in defining the second loss term , as well as ensuring that the resulting formulation is easy to optimize , e.g. , by defining a smooth approximation of the non-differentiable indicator function .

Summary: This well presented work is motivated by the relevant issue that improving model robustness while maintaining high accuracy can result in robust inaccuracy, i.e. a non-negligible amount of samples get classified incorrectly, but the category remains consistent for their perturbations. Supporting this observation empirically, this work proposes an approach to address this issue.  There are two main technical contributions. The first complements the standard robustness objectives from the literature with a regularisation term penalising robust inaccuracy. The paper provides specific implementations of this term under two setups: empirical (adversarial) and certified robustness. The second contribution is an abstain model: a learned indicator function that decides which samples are to be processed by the robust (but less accurate) classifier, and which ones should default to the non-robust (but accurate) baseline. As a result, this two-stage approach achieves high robustness without compromising the classification accuracy. The experiments on standard benchmarks further confirm, that the robust model consistently decreases the fraction of robust inaccurate samples (albeit at the expense to robust accuracy).