Adversarial Boot Camp: label free certified robustness in one epoch

1 Introduction . Neural networks are very accurate on image classification tasks , but they are vulnerable to adversarial perturbations , i.e . small changes to the model input leading to misclassification ( Szegedy et al. , 2014 ) . Adversarial training ( Madry et al. , 2018 ) improves robustness , at the expense of a loss of accuracy on unperturbed images ( Zhang et al. , 2019 ) . Model certification ( Lécuyer et al. , 2019 ; Raghunathan et al. , 2018 ; Cohen et al. , 2019 ) is complementary approach to adversarial training , which provides a guarantee that a model prediction is invariant to perturbations up to a given norm . Given an input x , the model f is certified to ` 2 norm r at x if it gives the same classification on f ( x+ η ) for all perturbation η with norm up to r , arg max f ( x+ η ) = arg max f ( x ) , for all ‖η‖2 ≤ r ( 1 ) Cohen et al . ( 2019 ) and Salman et al . ( 2019 ) certify models by defining a “ smoothed ” model , fsmooth , which is the expected Gaussian average of our initial model f at a given input example x , fsmooth ( x ) ≈ Eη [ f ( x+ η ) ] ( 2 ) where the perturbation is sampled from a Gaussian , η ∼ N ( 0 , σ2I ) . Cohen et al . ( 2019 ) used a probabilistic argument to show that models defined by ( 2 ) can be certified to a given radius by making a large number of stochastic model evaluations . Certified models can classify by first averaging the model , ( Salman et al. , 2019 ) , or by taking the mode , the most popular classification given by the ensemble ( Cohen et al. , 2019 ) . Cohen et al . and Salman et al . approximate the model fsmooth stochastically , using a Gaussian ensemble , which consists of evaluating the base model f multiple times on the image perturbed by noise . Like all ensemble models , these stochastic models require multiple inferences , which is more costly than performing inference a single time . In addition , these stochastic models require training the base model f from scratch , by exposing it to Gaussian noise , in order to improve the accuracy of fsmooth . Salman et al . ( 2019 ) additionally expose the model to adversarial attacks during training . In the case of certified models , there is a trade-off between certification and accuracy : the certified models lose accuracy on unperturbed images . Model CIFAR-10 ImageNet-1k CPU GPU CPU GPU Deterministic ( ours ) 0.0049 0.0080 0.0615 0.0113 Stochastic ( Cohen et al. , 2019 ) 0.0480 0.0399 0.1631 0.0932 2 Related work . The issue of adversarial vulnerability arose in the works of Szegedy et al . ( 2014 ) and Goodfellow et al . ( 2015 ) , and has spawned a vast body of research . The idea of training models to be robust to adversarial attacks was widely popularized in Madry et al . ( 2018 ) . This method , known as adversarial training , trains a model on images corrupted by gradientbased adversarial attacks , resulting in robust models . In terms of certification , early work by Cheng et al . ( 2017 ) provided a method of computing maximum perturbation bounds for neural networks , and reduced to solving a mixed integer optimization problem . Weng et al . ( 2018a ) introduced non-trivial robustness bounds for fully connected networks , and provided tight robustness bounds at low computational cost . Weng et al . ( 2018b ) proposed a metric that has theoretical grounding based on Lipschitz continuity of the classifier model and is scaleable to state-of-the-art ImageNet neural network classifiers . Zhang et al . ( 2018 ) proposed a general framework to certify neural networks based on linear and quadratic bounding techniques on the activation functions , which is more flexible than its predecessors . Training a neural network with Gaussian noise has been shown to be equivalent to gradient regularization ( Bishop , 1995 ) . This helps improve robustness of models ; however , recent work has used additive noise during training and evaluation for certification purposes . Lécuyer et al . ( 2019 ) first considered adding random Gaussian noise as a certifiable defense in a method called PixelDP . In their method , they take a known neural network architecture and add a layer of random noise to make the model ’ s output random . The expected classification is in turn more robust to adversarial perturbations . Furthermore , their defense is a certified defense , meaning they provide a lower bound on the amount of adversarial perturbations for which their defence will always work . In a following work , Li et al . ( 2018 ) provided a defence with improved certified robustness . The certification guarantees given in these two papers are loose , meaning the defended model will always be more robust than the certification bound indicates . In contrast , Cohen et al . ( 2019 ) provided a defence utilizing randomized Gaussian smoothing that leads to tight robustness guarantees under the ` 2 norm . Moreover Cohen et al . used Monte Carlo sampling to compute the radius in which a model ’ s prediction is unchanged ; we refer to this method as RandomizedSmoothing . In work building on Cohen et al. , Salman et al . ( 2019 ) developed an adversarial training framework called SmoothAdv and defined a Lipschitz constant of averaged models . Yang et al . ( 2020 ) generalize previous randomized smoothing methods by providing robustness guarantees in the ` 1 , ` 2 , and ` ∞ norms for smoothing with several non-Gaussian distributions . 3 Deterministic Smoothing . Suppose we are given a dataset consisting of paired samples ( x , y ) ∈ X × Y where x is an example with corresponding true classification y . The supervised learning approach trains a model f : X −→ RNc which maps images to a vector whose length equals the number of classes . Suppose f is the initial model , and let fsmooth be the averaged model given by equation ( 2 ) . Cohen et al . ( 2019 ) find a Gaussian smoothed classification model fsmooth by sampling η ∼ N ( 0 , σ2I ) independently n times , performing n classifications , and then computing the most popular classification . In the randomized smoothing method , the initial model f is trained on data which is augmented with Gaussian noise to improve accuracy on noisy images . We take a different approach to Gaussian smoothing . Starting from an accurate pretrained model f , we now discard the training labels , and iteratively retrain a new model , fsmooth using a quadratic loss between the model f and the new model ’ s predictions , with an additional gradient regularization term . We have found that discarding the original one-hot labels and instead using model predictions helps make the model smoother . To be precise , our new models is a result of minimizing the loss which we call HeatSmoothing , Ex [ 1 2 ∥∥softmax ( fsmooth ( x ) ) − softmax ( f ( x ) ) ∥∥22 + σ22 ∥∥∇xfsmooth ( x ) ∥∥22 ] ( 3 ) The smoothing achieved by the new models is illustrated schematically in Figure 5 . 3.1 Related regularized losses . Gradient regularization is known to be equivalent to Gaussian smoothing ( Bishop , 1995 ; LeCun et al. , 1998 ) . Our deterministic smoothed model arises by training using the HeatSmoothing loss ( 3 ) , which is designed so to ensure that ( 2 ) holds for our model . Our results is related to the early results on regularized networks ( Bishop , 1995 ; LeCun et al. , 1998 ) : that full gradient regularization is equivalent to Gaussian smoothing . Formally this is stated as follows . Theorem 1 . ( Bishop , 1995 ) Training a feed-forward neural-network model using the quadratic ( or mean-squared error ) loss , with added Gaussian noise of mean 0 and variance σ2 to the inputs , is equivalent to training with Ex [ ‖f ( x ) − y‖2 + σ2‖∇f ( x ) ‖2 ] ( 4 ) up to higher order terms . The equivalence is normally used to go from models augmented with Gaussian noise to regularized models . In our case , we use the result in the other direction : we train a regularized model in order to produce a model which is equivalent to evaluating with noise . In practice , this means that rather than adding noise to regularize models for certifiable robustness , we explicitly perform a type of gradient regularization , in order to produce a model which performs as if Gaussian noise was added . See Figure 4 in Appendix D for an illustration of the effect of this gradient regularization . The gradient regularization term in the HeatSmoothing loss ( 3 ) , is also related to adversarial training . Tikhonov regularization is used to produced adversarially robust models ( Finlay and Oberman , 2019 ) . However in adversarial training , the gradient of the loss is used , rather that the gradient of the full model . Also , our loss does not use information from the true labels . The reason for these differences is due to the fact that we wish to have a model that approximates the Gaussian average of our initial model f ( see Appendix A ) . Furthermore , minimizing the gradient-norm of the loss of the output gives us a smooth model in all directions , rather than being robust to only adversarial perturbations . 3.2 Algorithmic Details . We have found that early on in training , the value 12 ∥∥fsmooth ( x ) − fk ( x ) ∥∥22 may be far greater than the σ 2 2 ∥∥∇xfsmooth ( x ) ∥∥22 term . So we introduced a softmax of the vectors in the distance-squared term to reduce the overall magnitude of this term . We perform the training minimization of ( 3 ) for one epoch . The pseudo-code for our neural network weight update is given by Algorithm 1 1 Note that the ∥∥∇xfsmooth ( x ) ∥∥22 term in ( 3 ) requires the computation of a Jacobian matrix norm . In high dimensions this is computationally expensive . To approximate this term , we make use of the Johnson-Lindenstrauss lemma ( Johnson and Lindenstrauss , 1984 ; Vempala , 2005 ) followed by the finite difference approximation from Finlay and Oberman ( 2019 ) . We are able to approximate ∥∥∇xfsmooth ( x ) ∥∥22 by taking the average of the product of the Jacobian matrix and Gaussian noise vectors . Jacobian-vector products can be easily computed via reverse mode automatic differentiation , by moving the noise vector w inside : w · ( ∇xv ( x ) ) = ∇x ( w · v ( x ) ) ( 5 ) Further computation expense is reduced by using finite-differences to approximate the norm of the gradient . Once the finite-difference is computed , we detach this term from the automatic differentiation computation graph , further speeding training . More details of our implementation of these approximation techniques , and the definition of the term ĝ which is a regularization of the gradient , are presented in Appendix B. Algorithm 1 : HeatSmoothing Neural Network Weight Update Input : Minibatch of input examples x ( mb ) = ( x ( 1 ) , . . . , x ( Nb ) ) A model v set to “ train ” mode Current model f set to “ eval ” mode σ , standard deviation of Gaussian smoothing κ , number of Gaussian noise replications ( default= 10 ) δ , finite difference step-size ( default= 0.1 ) Update : learning-rate according to a pre-defined scheduler . for i ∈ { 1 , . . . Nb } do Compute : fsmooth ( x ( i ) ) , f ( x ( i ) ) ∈ RNc Ji = 12 ∥∥fsmooth ( x ( i ) ) − f ( x ( i ) ) ∥∥22 ∈ R for j ∈ { 1 , . . . κ } do Generate w = 1√ Nc ( w1 , . . . , wNc ) , w1 , . . . , wNc ∈ N ( 0 , 1 ) Compute the normalized gradient ĝ via ( 18 ) Detach x ( i ) from the computation graph Ji ← Ji + σ2 2δ2 ( w · fsmooth ( x ( i ) + δĝ ) − w · fsmooth ( x ( i ) ) ) 2 end J ← 1Nb Nb∑ i=1 Ji end Update the weights of v by running backpropagation on J at the current learning rate .

Summary: Randomized smoothing is the major way to certify the robustness of large scale networks, however, it requires sampling from Gaussian distribution many times, which is not fast enough for real-time inference. This paper uses a regularized loss to get deterministic Gaussian averaged results. This paper points out an interesting direction for certifying robustness, the method is simple and effective.