Adversarially Trained Models with Test-Time Covariate Shift Adaptation

1 INTRODUCTION . Deep neural network ( DNN ) based models are found to be brittle to minor , adversarially-chosen perturbations for their inputs that remain undetectable to human eyes . A DNN classifier that correctly classifies an image x , can be easily fooled by an adversarial attack to misclassify x + δ ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ; Madry et al. , 2018 ) . Here , δ is a minor adversarial perturbation such that the change between x and x+ δ remains imperceptible . Among the existing successful defense frameworks , adversarial training ( AT ) produces the best empirical robustness against the known adversarial attacks without providing any guarantee ( Madry et al. , 2018 ; Tramèr & Boneh , 2019 ; Zhang et al. , 2019 ; Rice et al. , 2020 ; Gowal et al. , 2020 ) . It trains a DNN classifier using strong adversaries from a specific class of perturbation ( e.g. , a small ` p-norm ) to provide robustness for the same perturbation types . Several certification techniques are proposed that can be applied to adversarially trained models to certifiably verify if the prediction of a test example , x remains constant within its neighborhood ( Wong & Kolter , 2018 ; Wang et al. , 2018 ; Salman et al. , 2019b ; Dvijotham et al. , 2018 ; Gehr et al. , 2018 ; Sheikholeslami et al. , 2021 ) . However , these certification techniques typically do not scale for larger networks ( e.g. , ResNet50 ) and datasets ( e.g. , IMAGENET ) . Hence , currently , we can not guarantee that a more powerful , not yet known attack can not break these adversarially trained models . In fact , several recently proposed empirical defense models are later broken by stronger adaptive adversarial attacks , indicating the importance of investigating certified defenses with suitable robustness guarantees . In contrast to adversarial training , randomized smoothing provides a scalable ` 2-certification framework for any classification model , which is robust against large isotropic Gaussian noise ( Cohen et al. , 2019 ; Salman et al. , 2019a ) . However , the existing randomized smoothing-based certified models produce significantly lower empirical robustness compared to the AT models . On the other hand , this technique can not be applied for AT models as they are not robust against such large random Gaussian noises in the standard settings . Towards this , we investigate to bridge the gap between the state-of-the-art empirical and certifiable robust models against adversarial examples . In this paper , we present a novel certification through adaptation framework to transform an AT model into a randomized smoothing framework during inference , providing ` 2 certification without any additional training or architectural modification . Our proposed certification technique consists of two steps : we first apply a covariate shift adaptation to a classifier against Gaussian noise during inference for each test example ( Cariucci et al. , 2017 ; Li et al. , 2016 ) . For our paper , we use the wellknown batch normalization adaptation . This process significantly boosts the performance of the AT models against the random isotropic Gaussian noises compared to the standard non-robust models . Hence , we can now directly apply the randomized smoothing based certification technique to provide ` 2 certification in the next step . Further , the existing randomized smoothing models require selecting the noise level at training time . In contrast , our proposed framework can separately choose the appropriate noise levels for different test examples during inference ( Figure 4 ) . Furthermore , we can also evaluate the input test examples without transforming the AT models to a randomized smoothing model , ensuring that their empirical performance remains unaffected . Therefore , we are the first to provide the test-time flexibility to obtain empirically robust predictions as well as certify their predictions using the same classifier for high-dimensional datasets to the best of our knowledge . Hence , we improve the reliability of AT models sensitive real-world applications . Contributions : - 1 . We propose a novel certification through adaptation framework that can adapt an AT model during inference to provide certified robustness . Our experimental results on CIFAR-10 and IMAGENET demonstrate that the proposed certification framework can transform any AT model into a randomized smoothing classifier to provide certification for ` 2 norm , even when the model is learned using ` ∞-bounded adversaries ( Table 1 & Figure 2 ) . 2 . One main advantage of our proposed framework is that it allows us to select appropriate noise levels for different test examples during inference . This leads to outperforming the existing state-of-the-art randomized smoothing models for ` 2 certification on CIFAR-10 using AT models ( Table 1 & Figure 4 ) . Further , we can provide certification at larger ` 2 radii for existing randomized smoothing models , improving their overall average certified radius ( ACR ) . 3 . Our results also indicate a strong correlation between empirical and certified robustness than previously believed ( Cohen et al. , 2019 ; Salman et al. , 2019a ; Tramèr & Boneh , 2019 ) . In particular , we observe that the empirically stronger AT models lead to better ` 2 certification performance ( Figure 5 ) . 2 RELATED WORK . Empirical Defenses and Adversarial Training . Existing defense models against adversarial attacks can be broadly classified into empirical and certified defenses . Empirical defenses demonstrate empirical robustness against adversarial attacks ( Schott et al. , 2019 ; Moosavi Dezfooli et al. , 2019 ; Nandy et al. , 2020 ; Mao et al. , 2021 ) . Adversarial training achieves the state-of-the-art empirical defense ( Madry et al. , 2018 ) . It optimizes the following loss function for a DNN classifier , f , to provide robustness within an -bounded threat model for an ` p norm , where the perturbations , δ ∈ ∆ are constrained as ∆ = { δ : ||δ||p ≤ } : min θ E ( x , y ) [ max δ∈∆ L ( fθ ( x+ δ ) , y ) ] ( 1 ) where , θ denotes the model parameters . L is the classification loss . The inner maximization in Eq . 1 is solved by producing adversarial examples using strong iterative adversaries , e.g. , projected gradient descent ( PGD ) attack ( Kurakin et al. , 2016 ; Madry et al. , 2018 ) . Wong et al . ( 2020 ) found that even a single-step fast gradient sign method ( FGSM ) attack-based AT models also achieves high empirical robustness ( Goodfellow et al. , 2015 ) . Zhang et al . ( 2020 ) proposed to use the least adversaries for training . Recently Trades ( Zhang et al. , 2019 ) , Adv-LLR ( Qin et al. , 2019 ) introduced additional regularizers to achieve higher empirical robustness by smoothing the loss surface . However , Rice et al . ( 2020 ) showed that the standard PGD based AT model with early-stopping criteria provides one of the best empirical defenses for a given perturbation type . Recent works also explored the importance of different hyper-parameters for adversarial training ( Gowal et al. , 2020 ; Pang et al. , 2021 ) as well as incorporating additional data in a semi-supervised fashion ( Carmon et al. , 2019 ; Uesato et al. , 2019 ) to further improve their empirical robustness . Certified Defenses . Empirical defenses demonstrate robustness only against the known adversaries without providing any guarantees . In fact , most empirical defenses proposed in the literature were later broken by stronger adversaries , highlighting the importance of certified defenses to provide robustness guarantees ( Athalye et al. , 2018 ; Uesato et al. , 2018 ; Jalal et al. , 2019 ) . Several recent works proposed to train neural network models with provable robustness guarantees . These works include methods based on semi-definite relaxations ( Raghunathan et al. , 2018 ) , linear relaxations and duality ( Wong & Kolter , 2018 ; Wong et al. , 2018 ) , abstract interpretation ( Mirman et al. , 2018 ) , and interval bound propagation ( Gowal et al. , 2018 ) . Parallel to training a certified defense , several works also focus on certifying the already trained models ( Tjeng et al. , 2017 ; Gehr et al. , 2018 ; Weng et al. , 2018 ; Wang et al. , 2018 ; Bunel et al. , 2018 ) . Recently Mueller et al . ( 2021 ) combined a small certification network with a large , empirically robust AT model using some selection criteria to boost overall benign accuracy along with empirical robustness for the certified framework . However , none of these techniques scale for large networks ( e.g. , ResNet50 ) or higher-dimensional datasets ( e.g. , IMAGENET ) . Randomized Smoothing for Certification . A randomized smoothing classifier is not a neural network . It uses a neural network as its base for classification . Randomized smoothing was initially proposed as a heuristic defense ( Cao & Gong , 2017 ; Liu et al. , 2018 ) and later shown to be certifiable ( Lecuyer et al. , 2019 ; Li et al. , 2019 ) . Recently , Cohen et al . ( 2019 ) and Salman et al . ( 2019a ) separately provided a tight robustness guarantee for ` 2-norm . Salman et al . ( 2019a ) provides the current state-of-the-art ` 2 certification robustness by adversarially choosing the noise using an adaptive attack to train their base classifier . This framework is also analyzed for other ` p norms using different noise distributions as well ( Li et al. , 2019 ; Lee et al. , 2019 ; Dvijotham et al. , 2020 ; Yang et al. , 2020 ) . Salman et al . ( 2020 ) proposed to incorporate an additional denoising module as a preprocessing unit to convert a standard DNN classifier into a randomized smoothing model to provide non-trivial certified robustness . Notably , randomized smoothing is the only scalable certification framework . Further , it also achieves superior performance for different perturbation types . While achieving the state-of-the-art certification performance , randomized smoothing significantly degrades the empirical robustness against adversarial attacks ( Lecuyer et al. , 2019 ; Salman et al. , 2019a ; Cohen et al. , 2019 ) . Towards this , our proposed technique transforms an AT model into a randomized smoothing classifier without any additional training or architectural modification . Since AT models already provide the state-of-the-art empirical defense , we achieve both empirical and certified robustness against adversarial examples using the same classifier . 3 PROPOSED METHODOLOGY . In this section , we first present the background of the randomized smoothing technique and explain why it is not directly effective for AT models . Next , we present the existing test-time co-variate shift adaptation for domain adaptations and corruption robustness . Then , we present our proposed certification through adaptation framework that adapts a DNN model during inference to provide certified robustness without additional training or architectural modification . 3.1 BACKGROUND ON RANDOMIZED SMOOTHING . Consider a classifier f that maps inputs in Rd to Y classes . The randomized smoothing framework transforms the original base classifier f into a new , smoothed classifier g. In particular , for an input x ∈ Rd , the smoothed classifier g returns the most probable class to be predicted by the base classifier f under isotropic Gaussian noises of x . That is , g ( x ) = argmax y∈Y P ( f ( x+ δ ) == y ) where , δ ∼ N ( 0 , σ2I ) . ( 2 ) The noise level , σ controls the trade-off between robustness and accuracy : Increasing σ would improve the robustness of g at higher ` 2 radii . However , it degrades the robustness at lower ` 2 radii as well as the benign accuracy . Cohen et al . ( 2019 ) presented a tight robustness guarantee based on the Neyman-Pearson lemma for the smoothed classifier g and gave an efficient algorithm using Monte Carlo sampling for certifying of g. We can also obtain this guarantee alternatively by explicitly computing the Lipschitz constant of the smoothed classifier as shown in ( Salman et al. , 2019a ; Yang et al. , 2020 ) . The certification procedure is as follows : Suppose a base classifier f classifies N ( x , σ2I ) to return the “ most probable ” class , cA with probability pA = P ( f ( x + δ ) == cA ) and the “ runner-up ” class cB with probability pB = maxy 6=cA P ( f ( x + δ ) == y ) . Then , the smooth classifier , g is certifiably robust around x within an ` 2 radius of R : R = σ 2 ( Φ−1 ( pA ) − Φ−1 ( pB ) ) ( 3 ) where , Φ−1 is the inverse of the standard Gaussian CDF . However , computing the exact values of pA and pB is not possible in practice when f is a DNN . Cohen et al . ( 2019 ) addressed this problem using Monte Carlo sampling to estimate some pA and pB such that pA ≤ pA and pB ≥ pB with arbitrarily high probability . The certified radius for input x is then computed by replacing pA and pB with pA and pB respectively in Eq . 3 . As we can see in Equation 2 that the original base classifier , f needs to be robust against large Gaussian noises to provide non-trivial robustness certification results . Otherwise , it leads to lower pA and hence a lower certification of R for the test examples . Existing randomized smoothing-based models applies custom-trained using explicit Gaussian noises to learn their original base classifier ( Lecuyer et al. , 2019 ; Cohen et al. , 2019 ; Salman et al. , 2019a ; Zhai et al. , 2020 ; Jeong & Shin , 2020 ) . However , these models produce significantly lower empirical robustness compared to the AT models . Consequently , AT models are not robust against large Gaussian noises in the standard inference settings ( see Table 2 ) . Hence , we can not directly use them as the base classifier for randomized smoothing .

Summary: This paper proposes a certification through an adaptation algorithm that transforms adversarially trained models into a randomized smoothing classifier using test-time covariate shift adaptation to provide L2 certification. Random smoothing can certify robustness, but it also decreases accuracy. This paper then updates at test-time to adapt to the additive Gaussian Noise, so that some accuracy is recovered. Experiment shows that the approach is effective. It is effective for CIFAR-10, and is partially effective on ImageNet.