Adversarial Boot Camp: label free certified robustness in one epoch

1 Introduction . Neural networks are very accurate on image classification tasks , but they are vulnerable to adversarial perturbations , i.e . small changes to the model input leading to misclassification ( Szegedy et al. , 2014 ) . Adversarial training ( Madry et al. , 2018 ) improves robustness , at the expense of a loss of accuracy on unperturbed images ( Zhang et al. , 2019 ) . Model certification ( Lécuyer et al. , 2019 ; Raghunathan et al. , 2018 ; Cohen et al. , 2019 ) is complementary approach to adversarial training , which provides a guarantee that a model prediction is invariant to perturbations up to a given norm . Given an input x , the model f is certified to ` 2 norm r at x if it gives the same classification on f ( x+ η ) for all perturbation η with norm up to r , arg max f ( x+ η ) = arg max f ( x ) , for all ‖η‖2 ≤ r ( 1 ) Cohen et al . ( 2019 ) and Salman et al . ( 2019 ) certify models by defining a “ smoothed ” model , fsmooth , which is the expected Gaussian average of our initial model f at a given input example x , fsmooth ( x ) ≈ Eη [ f ( x+ η ) ] ( 2 ) where the perturbation is sampled from a Gaussian , η ∼ N ( 0 , σ2I ) . Cohen et al . ( 2019 ) used a probabilistic argument to show that models defined by ( 2 ) can be certified to a given radius by making a large number of stochastic model evaluations . Certified models can classify by first averaging the model , ( Salman et al. , 2019 ) , or by taking the mode , the most popular classification given by the ensemble ( Cohen et al. , 2019 ) . Cohen et al . and Salman et al . approximate the model fsmooth stochastically , using a Gaussian ensemble , which consists of evaluating the base model f multiple times on the image perturbed by noise . Like all ensemble models , these stochastic models require multiple inferences , which is more costly than performing inference a single time . In addition , these stochastic models require training the base model f from scratch , by exposing it to Gaussian noise , in order to improve the accuracy of fsmooth . Salman et al . ( 2019 ) additionally expose the model to adversarial attacks during training . In the case of certified models , there is a trade-off between certification and accuracy : the certified models lose accuracy on unperturbed images . Model CIFAR-10 ImageNet-1k CPU GPU CPU GPU Deterministic ( ours ) 0.0049 0.0080 0.0615 0.0113 Stochastic ( Cohen et al. , 2019 ) 0.0480 0.0399 0.1631 0.0932 2 Related work . The issue of adversarial vulnerability arose in the works of Szegedy et al . ( 2014 ) and Goodfellow et al . ( 2015 ) , and has spawned a vast body of research . The idea of training models to be robust to adversarial attacks was widely popularized in Madry et al . ( 2018 ) . This method , known as adversarial training , trains a model on images corrupted by gradientbased adversarial attacks , resulting in robust models . In terms of certification , early work by Cheng et al . ( 2017 ) provided a method of computing maximum perturbation bounds for neural networks , and reduced to solving a mixed integer optimization problem . Weng et al . ( 2018a ) introduced non-trivial robustness bounds for fully connected networks , and provided tight robustness bounds at low computational cost . Weng et al . ( 2018b ) proposed a metric that has theoretical grounding based on Lipschitz continuity of the classifier model and is scaleable to state-of-the-art ImageNet neural network classifiers . Zhang et al . ( 2018 ) proposed a general framework to certify neural networks based on linear and quadratic bounding techniques on the activation functions , which is more flexible than its predecessors . Training a neural network with Gaussian noise has been shown to be equivalent to gradient regularization ( Bishop , 1995 ) . This helps improve robustness of models ; however , recent work has used additive noise during training and evaluation for certification purposes . Lécuyer et al . ( 2019 ) first considered adding random Gaussian noise as a certifiable defense in a method called PixelDP . In their method , they take a known neural network architecture and add a layer of random noise to make the model ’ s output random . The expected classification is in turn more robust to adversarial perturbations . Furthermore , their defense is a certified defense , meaning they provide a lower bound on the amount of adversarial perturbations for which their defence will always work . In a following work , Li et al . ( 2018 ) provided a defence with improved certified robustness . The certification guarantees given in these two papers are loose , meaning the defended model will always be more robust than the certification bound indicates . In contrast , Cohen et al . ( 2019 ) provided a defence utilizing randomized Gaussian smoothing that leads to tight robustness guarantees under the ` 2 norm . Moreover Cohen et al . used Monte Carlo sampling to compute the radius in which a model ’ s prediction is unchanged ; we refer to this method as RandomizedSmoothing . In work building on Cohen et al. , Salman et al . ( 2019 ) developed an adversarial training framework called SmoothAdv and defined a Lipschitz constant of averaged models . Yang et al . ( 2020 ) generalize previous randomized smoothing methods by providing robustness guarantees in the ` 1 , ` 2 , and ` ∞ norms for smoothing with several non-Gaussian distributions . 3 Deterministic Smoothing . Suppose we are given a dataset consisting of paired samples ( x , y ) ∈ X × Y where x is an example with corresponding true classification y . The supervised learning approach trains a model f : X −→ RNc which maps images to a vector whose length equals the number of classes . Suppose f is the initial model , and let fsmooth be the averaged model given by equation ( 2 ) . Cohen et al . ( 2019 ) find a Gaussian smoothed classification model fsmooth by sampling η ∼ N ( 0 , σ2I ) independently n times , performing n classifications , and then computing the most popular classification . In the randomized smoothing method , the initial model f is trained on data which is augmented with Gaussian noise to improve accuracy on noisy images . We take a different approach to Gaussian smoothing . Starting from an accurate pretrained model f , we now discard the training labels , and iteratively retrain a new model , fsmooth using a quadratic loss between the model f and the new model ’ s predictions , with an additional gradient regularization term . We have found that discarding the original one-hot labels and instead using model predictions helps make the model smoother . To be precise , our new models is a result of minimizing the loss which we call HeatSmoothing , Ex [ 1 2 ∥∥softmax ( fsmooth ( x ) ) − softmax ( f ( x ) ) ∥∥22 + σ22 ∥∥∇xfsmooth ( x ) ∥∥22 ] ( 3 ) The smoothing achieved by the new models is illustrated schematically in Figure 5 . 3.1 Related regularized losses . Gradient regularization is known to be equivalent to Gaussian smoothing ( Bishop , 1995 ; LeCun et al. , 1998 ) . Our deterministic smoothed model arises by training using the HeatSmoothing loss ( 3 ) , which is designed so to ensure that ( 2 ) holds for our model . Our results is related to the early results on regularized networks ( Bishop , 1995 ; LeCun et al. , 1998 ) : that full gradient regularization is equivalent to Gaussian smoothing . Formally this is stated as follows . Theorem 1 . ( Bishop , 1995 ) Training a feed-forward neural-network model using the quadratic ( or mean-squared error ) loss , with added Gaussian noise of mean 0 and variance σ2 to the inputs , is equivalent to training with Ex [ ‖f ( x ) − y‖2 + σ2‖∇f ( x ) ‖2 ] ( 4 ) up to higher order terms . The equivalence is normally used to go from models augmented with Gaussian noise to regularized models . In our case , we use the result in the other direction : we train a regularized model in order to produce a model which is equivalent to evaluating with noise . In practice , this means that rather than adding noise to regularize models for certifiable robustness , we explicitly perform a type of gradient regularization , in order to produce a model which performs as if Gaussian noise was added . See Figure 4 in Appendix D for an illustration of the effect of this gradient regularization . The gradient regularization term in the HeatSmoothing loss ( 3 ) , is also related to adversarial training . Tikhonov regularization is used to produced adversarially robust models ( Finlay and Oberman , 2019 ) . However in adversarial training , the gradient of the loss is used , rather that the gradient of the full model . Also , our loss does not use information from the true labels . The reason for these differences is due to the fact that we wish to have a model that approximates the Gaussian average of our initial model f ( see Appendix A ) . Furthermore , minimizing the gradient-norm of the loss of the output gives us a smooth model in all directions , rather than being robust to only adversarial perturbations . 3.2 Algorithmic Details . We have found that early on in training , the value 12 ∥∥fsmooth ( x ) − fk ( x ) ∥∥22 may be far greater than the σ 2 2 ∥∥∇xfsmooth ( x ) ∥∥22 term . So we introduced a softmax of the vectors in the distance-squared term to reduce the overall magnitude of this term . We perform the training minimization of ( 3 ) for one epoch . The pseudo-code for our neural network weight update is given by Algorithm 1 1 Note that the ∥∥∇xfsmooth ( x ) ∥∥22 term in ( 3 ) requires the computation of a Jacobian matrix norm . In high dimensions this is computationally expensive . To approximate this term , we make use of the Johnson-Lindenstrauss lemma ( Johnson and Lindenstrauss , 1984 ; Vempala , 2005 ) followed by the finite difference approximation from Finlay and Oberman ( 2019 ) . We are able to approximate ∥∥∇xfsmooth ( x ) ∥∥22 by taking the average of the product of the Jacobian matrix and Gaussian noise vectors . Jacobian-vector products can be easily computed via reverse mode automatic differentiation , by moving the noise vector w inside : w · ( ∇xv ( x ) ) = ∇x ( w · v ( x ) ) ( 5 ) Further computation expense is reduced by using finite-differences to approximate the norm of the gradient . Once the finite-difference is computed , we detach this term from the automatic differentiation computation graph , further speeding training . More details of our implementation of these approximation techniques , and the definition of the term ĝ which is a regularization of the gradient , are presented in Appendix B. Algorithm 1 : HeatSmoothing Neural Network Weight Update Input : Minibatch of input examples x ( mb ) = ( x ( 1 ) , . . . , x ( Nb ) ) A model v set to “ train ” mode Current model f set to “ eval ” mode σ , standard deviation of Gaussian smoothing κ , number of Gaussian noise replications ( default= 10 ) δ , finite difference step-size ( default= 0.1 ) Update : learning-rate according to a pre-defined scheduler . for i ∈ { 1 , . . . Nb } do Compute : fsmooth ( x ( i ) ) , f ( x ( i ) ) ∈ RNc Ji = 12 ∥∥fsmooth ( x ( i ) ) − f ( x ( i ) ) ∥∥22 ∈ R for j ∈ { 1 , . . . κ } do Generate w = 1√ Nc ( w1 , . . . , wNc ) , w1 , . . . , wNc ∈ N ( 0 , 1 ) Compute the normalized gradient ĝ via ( 18 ) Detach x ( i ) from the computation graph Ji ← Ji + σ2 2δ2 ( w · fsmooth ( x ( i ) + δĝ ) − w · fsmooth ( x ( i ) ) ) 2 end J ← 1Nb Nb∑ i=1 Ji end Update the weights of v by running backpropagation on J at the current learning rate .

Summary: The paper claims that a (computationally intractable) randomized smoothing of any classifier can be distilled into the (deterministic) classifier itself via fine-tuning it with gradient penalty. This is motivated by a theoretical result that Gaussian smoothing of a classifier is equivalent to solving a certain heat equation, which can be approximated by a regularized loss training. Experimental results use the resulting deterministic classifier to compute the certified radius compared to (stochastic) smoothed classifiers, arguing its efficiency and higher certified radius of the proposed method.