Data-Dependent Randomized Smoothing

Randomized smoothing is a recent technique that achieves state-of-art performance in training certifiably robust deep neural networks . While the smoothing family of distributions is often connected to the choice of the norm used for certification , the parameters of these distributions are always set as global hyper parameters independent from the input data on which a network is certified . In this work , we revisit Gaussian randomized smoothing and show that the variance of the Gaussian distribution can be optimized at each input so as to maximize the certification radius for the construction of the smooth classifier . Since the data dependent classifier does not directly enjoy sound certification with existing approaches , we propose a memory-enhanced data dependent smooth classifier that is certifiable by construction . This new approach is generic , parameter-free , and easy to implement . In fact , we show that our data dependent framework can be seamlessly incorporated into 3 randomized smoothing approaches , leading to consistent improved certified accuracy . When this framework is used in the training routine of these approaches followed by a data dependent certification , we achieve 9 % and 6 % improvement over the certified accuracy of the strongest baseline for a radius of 0.5 on CIFAR10 and ImageNet . 1 INTRODUCTION . Despite the success of Deep Neural Networks ( DNNs ) in various learning tasks ( Krizhevsky et al. , 2012 ; Long et al. , 2015 ) , they were shown to be vulnerable to small carefully crafted adversarial perturbations ( Goodfellow et al. , 2015 ; Szegedy et al. , 2013 ) . For a DNN f that correctly classifies an image x , f can be fooled to produce an incorrect prediction for x+ η even when the adversary η is so small that x and x+ η are indistinguishable to the human eye . To circumvent this nuisance , there have been several works proposing heuristic training procedures to build networks that are robust against such perturbations ( Cisse et al. , 2017 ; Madry et al. , 2018 ) . However , many of these works provided a false sense of security as they were subsequently broken , i.e . shown to be ineffective against stronger adversaries ( Athalye et al. , 2018 ; Tramer et al. , 2020 ; Uesato et al. , 2018 ) . This has inspired researchers to develop networks that are certifiably robust , i.e . networks that provably output constant predictions over a characterized region around every input . Among many certification methods , a probabilistic approach to certification called randomized smoothing has demonstrated impressive state-of-the-art certifiable robustness results ( Cohen et al. , 2019 ; Lecuyer et al. , 2019 ; Li et al. , 2019 ) . In a nutshell , given an input x and a base classifier f , e.g . a DNN , randomized smoothing constructs a “ smooth classifier ” g ( x ) = E ∼D [ f ( x+ ) ] such that , and under some choices of D , g ( x ) = g ( x+ δ ) ∀δ ∈ R. As such , g is certifiable within the certification regionR characterized by x and the smoothing distribution D. While there has been considerable progress in devising a notion of “ optimal ” smoothing distribution D for whenR is characterized by an ` p certificate ( Yang et al. , 2020 ) , a common trait among all works in the literature is that the choice of D is independent from the input x . For example , one of the earliest works on randomized smoothing grants ` 2 certificates under D = N ( 0 , σ2I ) , where σ is a free parameter that is constant for all x ( Cohen et al. , 2019 ) . That is to say , the classifier f is smoothed to a classifier g uniformly ( same variance σ2 ) over the entire input space of x . The choice of σ used for certification is often set either arbitrarily or via cross validation to obtain best certification results ( Salman et al. , 2019a ) . We believe this is suboptimal and that σ should vary with the input x ( data dependent ) , since using a fixed σ may under-certify inputs ( i.e . the constructed smooth classifier g produces smaller certification radii ) , which are far from the decision boundaries as exemplified by x1 in Figure 1 . Moreover , this fixed σ could be large for inputs x close to the decision boundaries resulting in a smooth classifier g that incorrectly classifies x ( refer to x3 in Figure 1 ) . In this paper , we aim to introduce more structure to the smoothing distribution D by rendering its parameters data dependent . That is to say , the base classifier f is smoothed with a family of smoothing distributions to produce : g ( x ) = E ∼N ( 0 , σ2xI ) [ f ( x+ ) ] 1 . Note here that the variance of the Gaussian is now dependent on the data input x . Moreover , given that σx varies with x , classical randomized smoothing based certification does not apply directly . We propose a simple memory-based approach to certify the resultant data dependent smooth classifier g. We show that our memory-enhanced data dependent smooth classifier can boost certification performance of several randomized smoothing techniques . Our contributions can thus be summarized in three folds . ( i ) We propose a parameter free and generic framework that can easily turn several randomized smoothing techniques into their data dependent variants . In particular , given a network f and an input x , we propose to optimize the smoothing distribution parameters for every x , e.g . σ∗x , so they maximize the certification radius . This choice of σ∗x is then used to smooth f at x and construct a smoothed classifier g. Moreover , as the data dependent smooth classifier is not directly certifiable using Cohen et al . ( 2019 ) MCMC approaches , we propose a memory-enhanced data dependent smooth classifier for certification . ( ii ) We demonstrate the effectiveness of our memory-enhanced data dependent smoothing by showing that we can improve the certified accuracy of several models , specifically models trained with Gaussian augmentation ( COHEN ) ( Cohen et al. , 2019 ) , adversaries on the smoothed classifier ( SMOOTHADV ) ( Salman et al. , 2019a ) , and radius regularization ( MACER ) ( Zhai et al. , 2020 ) without any model retraining . We boost the certified accuracy of the best baseline by 5.4 % on CIFAR10 and by 2.8 % on ImageNet for ` 2 perturbations with less than 0.5 ( =127/255 ) ball radius . ( iii ) We show that incorporating the proposed data dependent smoothing in the training pipeline of COHEN , SMOOTHADV and MACER can further boost results to get certified accuracies of 68.3 % on CIFAR10 and 64.2 % on ImageNet at ` 2 perturbations less than 0.25 . 2 RELATED WORK . Certified Defenses . Certified defenses aim to guarantee that an adversary does not exist in a certain region around a given input . Certified defenses can be divided into exact ( Cheng et al. , 2017 ; Lomuscio & Maganti , 2017 ; Huang et al. , 2017 ; Ehlers , 2017 ) and relaxed certification ( Salman et al. , 2019b ; Wong & Kolter , 2018 ) . Generally , exact certification suffers from poor scalability with networks that are at most 3 hidden layers deep ( Tjeng et al. , 2019 ) . On the other hand , relaxed methods resolve this issue by aiming at finding an upper bound to the worst adversarial loss over all possible bounded perturbations around a given input ( Weng et al. , 2018 ) . However , the latter is too expensive for any mixed certification-training routine . Randomized Smoothing . The earliest work on randomized smoothing ( Lecuyer et al. , 2019 ) was from a differential privacy perspective , where it was demonstrated that adding Laplacian noise enjoys an ` 1 certification radius in which the average classifier prediction under this noise is constant . This work was later followed by the tight ` 2 certificate radius for Gaussian smoothing ( Cohen et al. , 2019 ) . Since then , there has been a body of work on randomized smoothing with empirical defenses ( Salman et al. , 2019a ) to certify black box classifiers ( Salman et al. , 2020 ) . Other works derived certification 1The paper focuses on Gaussian smoothing , but the idea holds for other parameterized distributions . guarantees for ` 1 bounded ( Teng et al. , 2019 ) , ` ∞ bounded ( Zhang et al. , 2019 ) , and ` 0 bounded ( Levine & Feizi , 2020 ) perturbations . Even more recently , a novel framework that finds the optimal smoothing distribution for a given ` p norm ( Yang et al. , 2020 ) was proposed showing state-of-art certification results on ` 1 perturbations . We deviate from the common literature by introducing the notion of smoothing , particularly Gaussian smoothing for ` 2 perturbations , which varies depending on the input . In particular , since an input x that is far from the decision boundaries should tolerate larger smoothing ( and equivalently have a larger certification radius ) as compared to inputs closer to these boundaries , we optimize for the amount of smoothing per input ( specifically σx ) that maximizes the certification radius . This proposed process is denoted as data dependent smoothing where we provide a procedure for certifying the resultant smooth classifier . 3 DATA DEPENDENT SMOOTHING . 3.1 PRELIMINARIES AND NOTATIONS . We consider the standard classification problem , where x ∈ Rd and the labels y ∈ Y = { 1 , . . . , k } form the input-label pairs ( x , y ) sampled from an unknown data distribution . Unless explicitly mentioned , we consider a classifier fθ : Rd → P ( Y ) parameterized by θ where P ( Y ) is a probability simplex over k labels . We say that fθ is ` rp certifiably accurate for an input x , if and only if , arg maxc f c θ ( x ) = arg maxc f c θ ( x+δ ) = y ∀ ‖δ‖p ≤ r , where f cθ is the cth element of fθ . That is to say , the classifier correctly predicts the label of x and enjoys a constant prediction for all perturbations δ that are in the ` p ball of radius r from x . As such , the overall ` rp certification accuracy is defined as the average certified accuracy over the data distribution . In this paper and following previous works ( Cohen et al. , 2019 ; Salman et al. , 2019a ; Zhai et al. , 2020 ) , we focus on ` r2 certification . 3.2 OVERVIEW OF RANDOMIZED SMOOTHING . Randomized smoothing constructs a certifiable classifier gθ by smoothing a base classifier fθ . That is to say , for any σ > 0 , the smooth classifier is defined as follows : gθ ( x ) = E ∼N ( 0 , σ2I ) [ fθ ( x+ ) ] . Let gθ predict label cA for input x with some confidence , i.e . E [ f cAθ ( x + ) ] = pA ≥ pB = maxc6=cA E [ f cθ ( x+ ) ] , then , gθ is certifiably robust at x with certification radius : R = σ 2 ( Φ−1 ( pA ) − Φ−1 ( pB ) ) . ( 1 ) Here , g ( x+ δ ) = g ( x ) ∀‖δ‖2 ≤ R , where Φ is the CDF of the standard Gaussian .

Summary: The paper's core contribution is to extend randomized smoothing to a setting where the smoothing depends on the input data. That is, the variance of the smoothing distribution is not constant anymore but depends on the input. To ensure a proper certificate, the authors propose some memory-based technique (which essentially changes the final classifier based on the observed input data so far).