Certified Distributional Robustness via Smoothed Classifiers 

1 INTRODUCTION . Deep neural networks ( DNNs ) have been known to be vulnerable to adversarial example attacks : by feeding the DNN with slightly perturbed inputs , the attack alters the prediction output . The attack can be fatal in performance-critical systems such as autonomous vehicles or automated tumor diagnosis . A DNN is robust when it can resist such an attack that , as long as the range of the perturbation is not too large ( usually invisible by human ) , the model produces an expected output despite of the specific perturbation . Various approaches have been proposed for improving the robustness of DNNs , with or without a performance guarantee . Although a number of approaches have been proposed for certified robustness , it is vague how robustness should be defined . For example , works including Cohen et al . ( 2019 ) ; Pinot et al . ( 2019 ) ; Li et al . ( 2019 ) ; Lecuyer et al . ( 2019 ) propose smoothed classifiers to ensure the inputs with adversarial perturbation to be classified into the same class as the inputs without . However , since both inputs are inserted randomized noise , it can not be guaranteed that the inputs are classified into the correct class . It is possible that the adversarially perturbed input has the same label as the original one which is wrongly classified by the DNN . In this case , the robustness guarantee does not make sense any more . Further , the robustness guarantee is provided at the instance level , i.e. , within a certain perturbation range , the modification of an input instance can not affect the prediction output . But a DNN is a statistical model to be evaluated on the input distribution , rather than a single instance . Instead of counting the number of input instances meeting the robustness definition , it is desired to evaluate the robustness of a DNN over the input distribution . We introduce the distributional risk as a DNN robustness metric , and propose a noisy adversarial learning ( NAL ) procedure based on distributional robust optimization , which provides a provable guarantee . Assume a base classifier f trying to map instance x0 to corresponding label y . It is found that when fed with the perturbed instance x ( within a l2 ball centered at x0 ) , a smoothed classifier g ( x ) = EZ [ f ( x + z ) ] with z ∼ Z = N ( 0 , σ2I ) can provably return the same label as g ( x0 ) does . However , we think such a robustness guarantee can not ensure g ( x0 ) to be correctly classified as y , resulting in unsatisfying performance in practice . Instead , we evaluate robustness as the worst-case loss over the distribution of noisy inputs . For simplicity , we jointly express the input instance and the label as x0 ∼ P0 where P0 is the distribution of the original input . By using ` ( · ) as the loss function , we evaluate DNNs by the worst-case distributional risk : supS ES [ ` ( θ ; s ) ] . The classifier is parameterized by θ ∈ Θ , and s = x+ z ∼ S where S is a distribution within a certain distance from P0 . We prove such a loss is upper bounded by a data-dependent certificate , which can be optimized by the noisy adversarial training procedure : minimize θ∈Θ sup S ES [ ` ( θ ; s ) ] . ( 1 ) Compared to previous robustness certificates via smoothed classifiers , our method provides a provable guarantee w.r.t . the ground truth input distribution . Letting the optimized θ be the parameter of g ( · ) and f ( · ) respectively , we further show that the smoothed classifier g ( · ) provides an improved robustness certificate than that of f ( · ) , due to a tighter bound on the worst-case loss . The key is that , for mild perturbations , we adopt a Lagrangian relaxation for the usual loss ` ( θ ; x+z ) as the robust surrogate , and the surrogate is strongly concave in x and hence easy to optimize . Our approach enjoys convergence guarantee similar to the method in Sinha et al . ( 2018 ) , but different from Sinha et al . ( 2018 ) , our approach does not require ` to be smooth , and thus can be applied to arbitrary neural networks . The advantage of the smoothed classifier also lies in a tighter robustness certificate than the base classifier . The intuition is that , in the inner maximization step , instead of seeking one direction which maximizes the loss , our approach performs gradient ascent along the direction which maximizes the total loss of examples sampled from the neighborhood of the original input . The noisy adversarial training procedure produces smoothed classifiers robust against the neighborhood of the worst-case adversarial examples with a certified bound . Highlights of our contribution are as follows . First , we review the drawbacks in the previous definition of robustness , and propose to evaluate robustness by the worst-case loss over the input distribution . Second , we derive a data-dependent upper bound for the worst-case loss , constituting a robustness certificate . Third , by minimizing the robustness certificate in the training loop , we propose noisy adversarial learning for enhancing model robustness , in which the smoothness property entails the computational tractability of the certificate . Through both theoretical analysis and experimental results , we verify that our certified DNNs enjoy better accuracies compared with the state-of-the-art defending adversarial example attacks . 2 RELATED WORK . Works proposed to defend against adversarial example attacks can be categorized into the following categories . In empirical defences , there is no guarantee how the DNN model would perform against the adversarial examples . Stability training ( Zheng et al . ( 2016 ) ; Zantedeschi et al . ( 2017 ) ; Liu et al . ( 2018 ) ) improves model robustness by adding randomized noise to the input during training but shows limited performance enhancement . Adversarial training ( Goodfellow et al . ( 2015 ) ; Kurakin et al . ( 2018 ) ; Madry et al . ( 2017 ) ; Kannan et al . ( 2018 ) ; Zhang et al . ( 2019 ) ; He et al . ( 2019 ) ; Wang et al . ( 2019 ) ) trains over adversarial examples found at each training step but unfortunately does not guarantee the performance over unseen adversarial inputs . Although without a guarantee , adversarial training has excellent performance in empirical defences against adversarial attacks . Certified defences are certifiably robust against any adversarial input within an ` p-norm perturbation range from the original input . A line of works construct a computationally tractable relaxation for computing an upper bound on the worst-case loss over all valid attacks . The relaxations include linear programming ( Wong & Kolter ( 2018 ) ) , mixed integer programming ( Tjeng et al . ( 2018 ) ) , semidefinite programming ( Raghunathan et al . ( 2018 ) ) , and convex relaxation ( Namkoong & Duchi ( 2017 ) ; Salman et al . ( 2019b ) ) . But those deterministic methods are not scalable . Some works such as Dvijotham et al . ( 2018 ) formulate the search for the largest perturbation range as an optimization problem and solve its dual problem . Sinha et al . ( 2018 ) also propose a robustness certificate based on a Lagrangian relaxation of the loss function , and it is provably robust against adversarial input distributions within a Wasserstein ball centered around the original input distribution . The certificate of our work is constructed on a Lagrangian relaxation form of the worst-case loss , but has a broader applicability than Sinha et al . ( 2018 ) with a tighter loss bound due to the smoothness property . An alternative line of works propose to select appropriate surrogates for each neuron activation layer by layer ( Weng et al . ( 2018 ) ; Zhang et al . ( 2018 ) ) to facilitate the search for a certified lower bound . By integrating with interval bound propagation ( Gowal et al . ( 2018 ) ) , Zhang et al . ( 2020 ) make the search computationally efficient and scalable . Other works ( Mirman et al . ( 2018 ) ; Singh et al . ( 2018 ) ) apply the abstract interpretation to train provably robust neural networks . Our work is orthogonal to these works . Randomized smoothing introduces randomized noise to the neural network , and tries to provide a statistically certified robustness guarantee . Pinot et al . ( 2020 ) have demonstrated by game theory that no deterministic classifier can claim to be more robust than all others against any possible adversarial attack . But such a question remains open in the randomized regime , where randomized smoothing can be considered as a contributing effort . The smoothing method does not depend on a specific neural network , or a type of relaxation , but can be generally applied to arbitrary neural networks . The idea of adding randomized noise was first proposed by Lecuyer et al . ( 2019 ) , given the inspiration of the differential privacy property , and then Li et al . ( 2019 ) improve the certificate with Rényi divergence . Cohen et al . ( 2019 ) obtain a larger certified robustness bound through the smoothed classifier based on Neyman-Pearson theorem . Phan et al . ( 2020 ) extend the noise addition mechanism to large-scale parallel algorithms . By extending the randomized noise to the general family of exponential distributions , Pinot et al . ( 2019 ) unify previous approaches to preserve robustness to adversarial attacks . Lee et al . ( 2019 ) offer adversarial robustness guarantees for ` 0-norm attacks . Both Salman et al . ( 2019a ) ; Jia et al . ( 2019 ) employ adversarial training to improve the performance of randomized smoothing . Following a similar principle , our work trains over adversarial data with randomized noise . But we provide a more practical robustness certificate and a training method achieving higher empirical accuracy than theirs . 3 PROPOSED APPROACH . We first define the closeness between distributions , based on which we constrain how far the input distribution is perturbed . Then we introduce our definition of robustness on smoothed classifiers . Our main theorem gives a tractable robustness certificate which is easy to optimize . Our algorithm for improving the robustness of the smoothed classifiers is provided . All proofs are collected in the appendices for conciseness . 3.1 A DISTRIBUTIONAL ROBUSTNESS CERTIFICATE . Definition 1 ( Wasserstein distance ) . Wasserstein distances define a notion of closeness between distributions . Let ( X ⊂ Rd , A , P ) be a probability space and the transportation cost c : X × X → [ 0 , ∞ ) be nonnegative , lower semi-continuous , and c ( x , x ) = 0 . P and Q are two probability measures supported on X . Let Π ( P , Q ) denotes the collection of all measures on X × X with marginals P and Q on the first and second factors respectively , i.e. , it holds that π ( A , X ) = P ( A ) and π ( X , A ) = Q ( A ) , ∀A ∈ A and π ∈ Π ( P , Q ) . The Wasserstein distance between P and Q is Wc ( P , Q ) : = inf π∈Π ( P , Q ) Eπ [ c ( x , y ) ] . ( 2 ) For example , the ` 2-norm c ( x , x0 ) = ‖x− x0‖22 satisfies the aforementioned conditions . Distributional robustness . Assume the original input x0 is drawn from the distribution P0 , and the perturbed input x is drawn from the distribution P . Each input is added randomized Gaussian noise z ∼ Z = N ( 0 , σ2I ) before being fed to the classifier . Instead of regarding the noise as a part of the smoothed classifier , we treat s = x + z as a noisy input coming from the distribution S in the analysis . Since z ∈ Rd , we need to set X = Rd to admit s ∈ X as Lecuyer et al . ( 2019 ) ; Cohen et al . ( 2019 ) ; Salman et al . ( 2019a ) do . Since the perturbed input should be visually indistinguishable from the original one , we define the robustness region as P = { P : Wc ( P , P0 ) ≤ ρ , P ∈ P ( X ) } , where ρ > 0 . Within such a region , we evaluate the robustness as a worst-case population loss over noisy inputs : supS∈P ES [ ` ( θ ; s ) ] . Essentially , we evaluate the robustness of a smoothed classifer based on its performance on the worst-case adversarial example distribution . A smaller loss indicates a higher level of robustness . We will compare the definition against others in the next section . However , such a robustness metric is impossible to measure in practice as we have no idea about P . Even if P can be acquired , it can be a non-convex region which renders the constrained optimization objective intractable . Hence we resort to the Lagrangian relaxation of the problem by assuming a dual variable γ . As the main theorem of this work , we provide an upper bound for the worst-case population loss for any level of robustness ρ . We further show that for small enough ρ , the upper bound is tractable and easy to optimize . Theorem 1 . Let ` : Θ × X → R and transportation cost function c : X × X → R+ be continuous . Let x0 be an input drawn from the input distribution P0 , x be the adversarial example which follows the distribution P and z ∼ Z = N ( 0 , σ2I ) be the additive noise of the same shape as x . The sum of x and z is denoted as s = x + z ∼ S and we let φγ ( θ ; x0 ) = supx∈X EZ { ` ( θ ; x+ z ) − γc ( x+ z , x0 ) } be the robust surrogate . For any γ , ρ > 0 and σ , we have sup S : Wc ( S , P0 ) ≤ρ ES [ ` ( θ ; s ) ] ≤ γρ+ EP0 [ φγ ( θ ; x0 ) ] . ( 3 ) The proof is given in Appendix A.1 . It is notable that the right-hand side take the expectation over P0 and Z respectively , and given a particular input x0 and a noise sample z , we seek an adversarial example which maximizes the surrogate loss . Typically , P0 is impossible to obtain and thus we use an empirical distribution , such as the training data distribution , to approximate P0 in practice . Since Thm . 1 provides an upper bound for the worst-case population loss , it offers a principled adversarial training approach which minimizes the upper bound instead of the actual loss , i.e. , minimize θ∈Θ EP0 [ φγ ( θ ; x0 ) ] . ( 4 ) In the following we show the above loss function has a form which is tractable for arbitrary neural networks , due to a smoothed loss function . Hence Thm . 1 provides a tractable robustness certificate depending on the data . Properties of the smoothed classifier . We show the optimization objective of Eq . 4 has a form which is tractable for any neural network , particular for the non-smooth ones with ReLU activation layers . More importantly , the smoothness of the classifier enables the adversarial training procedure to converge as we want by using the common optimization techniques such as stochastic gradient descent . The smoothness of the loss function comes from the smoothed classifier with randomized noise . Specifically , Theorem 2 . Assume ` : Θ × X → [ 0 , M ] is a bounded loss function . The loss function on the smoothed classifier can be expressed as ˆ̀ ( θ ; x ) : = EZ [ ` ( θ ; x+ z ) ] , z ∼ Z = N ( 0 , σ2I ) . Then we have ˆ̀ is 2Mσ2 -smooth w.r.t . ` 2-norm , i.e. , ˆ̀satisfies∥∥∥∇x ˆ̀ ( θ ; x ) −∇x ˆ̀ ( θ ; x′ ) ∥∥∥ 2 ≤ 2M σ2 ‖x− x′‖2 . ( 5 ) The proof is in Appendix A.2 . It mainly takes advantage of the randomized noise which has a smoothing effect on the loss function . For DNNs with non-smooth layers , the smoothed classifier makes it up and turns the loss function to a smoothed one , which contributes as an important property to the strong concavity of EZ [ ` ( θ ; x+ z ) − γc ( x+ z , x0 ) ] and therefore ensures the tractability of the robustness certificate . Corollary 1 . For any c : X × X → R+ ∪ { ∞ } 1-strongly convex in its first argument , and ˆ̀ : x 7→ EZ [ ` ( θ ; x+ z ) ] being 2Mσ2 -smooth , the function EZ { ` ( θ ; x+ z ) − γc ( x+ z , x0 ) } is strongly concave in x for any γ ≥ 2Mσ2 . The proof is in Appendix A.3 . Note that here we specify the requirement on the transportation cost c to be 1-strongly convex in its first argument . The ` 2-norm cost satisfies the condition . Before showing how the strong concavity plays a part in the convergence , we illustrate our algorithm first .

Summary: This paper studies the problem of certified robustness in adversarial learning. In a nutshell, they apply the randomized smoothing technique to the distributional robustness certificate proposed by Sinha et al. (2018), thereby relaxing the smoothness assumption required therein so that the ReLU network can be applied. Based on this new formulation, they derive the upper bound on the worst-case population loss and develop an algorithm with convergence guarantees. The results on tested on MNIST, CIFAR-10 and Tiny ImageNet.