Avoiding Robust Misclassifications for Improved Robustness without Accuracy Loss

While current methods for training robust deep learning models optimize robust accuracy , in practice , the resulting models are often both robust and inaccurate on numerous samples , providing a false sense of safety for those . Further , they significantly reduce natural accuracy , which hinders the adoption in practice . In this work , we address both of these challenges by extending prior works in three main directions . First , we propose a new training method that jointly maximizes robust accuracy and minimizes robust inaccuracy . Second , since the resulting models are trained to be robust only if they are accurate , we leverage robustness as a principled abstain mechanism . Finally , this abstain mechanism allows us to combine models in a compositional architecture that significantly boosts overall robustness without sacrificing accuracy . We demonstrate the effectiveness of our approach to both empirical and certified robustness on six recent state-of-the-art models and using several datasets . For example , on CIFAR-10 with ε∞ = 1/255 , it successfully enhanced the robust accuracy of a state-of-the-art standard trained model from 26 % to 86 % while only marginally reducing its natural accuracy from 97.8 % to 97.6 % . 1 INTRODUCTION . In recent years , there has been a significant amount of work that studies and improves both adversarial ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ; Croce & Hein , 2020 ; Madry et al. , 2018 ) and certified robustness ( Balunovic & Vechev , 2019 ; Cohen et al. , 2019 ; Salman et al. , 2019 ; Xu et al. , 2020 ; Zhai et al. , 2020 ; Zhang et al. , 2019b ) of neural networks . However , currently , there are two key limitations that hinder the wider adoption of robust models in practice . Existing Models are Robustly Inaccurate First , despite substantial progress in training robust models , existing works usually only report robust accuracy , i.e. , samples for which the model robustly predicts the correct label . Meanwhile , the issue of robust inaccuracy , i.e. , samples that are robustly misclassified with a wrong label , is usually not even reported ( we formally define robust inaccuracy in Equation 3 ) . This is especially problematic for safety-critical models , where the robustness can be mistakenly used as a safety argument . We quantify the severity of this issue in Table 1 , by evaluating recent state-of-the-art robust models . As can be seen , recent models contain up to 15 % of robust inaccurate samples and the ratio of such samples worsens with smaller perturbation regions . x1 x2 0 12 rob ( ( F , SERI ) , D ) = 91.1 % rob ( ( F , SERI ) , D ) = 100.0 % std 0 1 2 x1 x2 0 1 rob ( ( F , SERI ) , D ) = 100.0 % rob ( ( F , SERI ) , D ) = 98.4 % TRADES 0 1 2 x1 x2 0 1 rob ( ( F , SERI ) , D ) = 98.4 % rob ( ( F , SERI ) , D ) = 100.0 % ERA ( ours ) 0 1 2 robust & accurate non-robust & accurate robust & inaccurate non-robust & inaccurate robust & accurate non-robust & accurate robust & inaccurate non-robust & inaccurate Lstd LTRADES ( ours ) LERA Figure 1 : Decision regions for models trained via standard trainingLstd , adversarial trainingLTRADES ( Zhang et al. , 2019a ) , and our training LERA ( Equation 5 ) . In this case , our training achieves the same robust accuracy as LTRADES but avoids all robust inaccurate samples by making them non-robust . Note that all three models predict over all three classes , however , the decision regions for class 2 of the LTRADES and LERA trained models happen to be too small to be visible . The considered model architecture and the training hyperparameters are provided in Appendix A.2 . Robustness vs Accuracy Tradeoff Second , existing robust training methods improve the model robustness , but they also typically degrade the standard accuracy on unperturbed inputs . To address this limitation , a number of recent works study this issue in detail and propose new methods to mitigate it ( Mueller et al. , 2020 ; Raghunathan et al. , 2020 ; Yang et al. , 2020 ; Stutz et al. , 2019 ) . Our Work In this work , we advance the line of work that aims to boost robustness without sacrificing accuracy , but we approach the problem from a new perspective – by avoiding robust inaccuracy . Concretely , we propose a new training method that jointly maximizes robust accuracy while minimizing robust inaccuracy . We illustrate the effect of our training on a synthetic dataset ( described in Appendix A.2 ) in Figure 1 , showing the decision boundaries of three models , trained using standard training Lstd , adversarial training LTRADES ( Zhang et al. , 2019a ) , and our training LERA ( Equation 5 ) . First , observe that while the Lstd trained model achieves 100 % accuracy , only 91.1 % of these samples are robust ( and accurate ) . When using LTRADES , we can observe the robustness vs accuracy tradeoff – the robust accuracy improves to 98.4 % at the expense of 1.6 % ( robust ) inaccuracy . In contrast , using our LERA , we retain the high robust accuracy of 98.4 % but avoid all robust inaccurate samples by appropriately shifting the decision boundary , rendering them non-robust . Second , since our models are trained to be robust only if they are accurate , we leverage robustness as a principled abstain mechanism . This abstain mechanism then allows us to combine models in a compositional architecture that significantly boosts overall robustness without sacrificing accuracy . Concretely , in Figure 1 , we would define a selector model that abstains on all non-robust samples . Then , the abstained ( non-robust ) samples are evaluated by the standard trained model Lstd , while the selected samples are evaluated using the robust model LERA . This allows us to achieve the best of both models – high robust accuracy ( 98.4 % ) , high natural accuracy ( 100 % ) , and no robust inaccuracy . We show the practical effectiveness of our approach by instantiating over several datasets and existing robust models for both empirical and certified robustness . Our evaluations show that our method effectively reduces robust and inaccurate samples by up to 97.28 % . Further , our approach significantly improves robustness for CIFAR-10 , CIFAR-100 , MTSD and SBB datasets by 60.3 % , 38.8 % , 29.2 % and 37.7 % , respectively , while simultaneously decreasing natural accuracy by only 0.2 % . 2 RELATED WORK . There is a growing body of work that extends models with an abstain option , either by training a selector mechanism separately or jointly together with the model . The existing approaches include various selection mechanisms such as entropy selection ( Mueller et al. , 2020 ) , selection function ( Cortes et al. , 2016 ; Mueller et al. , 2020 ; Geifman & El-Yaniv , 2019 ) , softmax response ( Stutz et al. , 2020 ; Geifman & El-Yaniv , 2017 ) , or explicit abstain class ( Laidlaw & Feizi , 2019 ; Liu et al. , 2019 ) . In our work , we explore an alternative selector mechanism that uses model robustness . The advantage of this formulation is that the selector provides strong guarantees for each sample and can never produce false-positive selections . The disadvantage is that it introduces a significant runtime overhead , compared to many other methods that require only a single forward pass . At the same time , several recent works investigated the robustness and accuracy tradeoff both theoretically ( Yang et al. , 2020 ; Dobriban et al. , 2020 ) and practically by proposing new methods to mitigate it . For example , Raghunathan et al . ( 2020 ) proposes robust self-training that leverages unlabeled data to regularize the model . Stutz et al . ( 2019 ) considers a new method based on onmanifold adversarial examples , which are more aligned with the true data distribution than the ` p-norm noise models . Mueller et al . ( 2020 ) focuses on deterministic certification and also proposes using compositional models to control the robustness and accuracy tradeoff . In our work , we also take advantage of compositional models , but we focus on both empirical and probabilistic certified robustness . Further , our selector formulation is based on a new training that minimizes robust inaccuracy and can be used to fine-tune any existing robust model . Finally , we provide individual robustness at inference time , rather than distributional robustness considered in prior works . 3 PRELIMINARIES . Let fθ : Rd→Rk be a neural network which classifies inputs x∈X ⊆Rd to outputs Rk ( e.g. , logits or probabilities ) . The hard classifier induced by the network is given as Fθ ( x ) = arg maxi∈Y fθ ( x ) i , where fθ ( x ) i is the network output for the i-th class and Y , |Y| = k is the finite set of discrete labels . Natural Accuracy Given a distribution over input-label pairs D and a classifier Fθ : X → Y , an input-label pair ( x , y ) is considered accurate iff the classifier Fθ predicts the correct label y for x : Rnat ( Fθ ) = E ( x , y ) ∼D 1 { Fθ ( x ) = y } ( 1 ) Robust Accuracy Given an input-label pair ( x , y ) , we say that the classifier Fθ is robust and accurate iff it predicts the correct label y for all samples from a predefined region Bpε ( x ) , such as a ` p-norm ball centered at x with radius ε , i.e. , Bpε ( x ) .. = { x′ : ||x′ − x||p ≤ ε } . Formally : Raccrob ( Fθ ) = E ( x , y ) ∼D 1 { Fθ ( x ) = y } ∧ 1 { ∀x′ ∈ Bpε ( x ) . Fθ ( x′ ) = Fθ ( x ) } ( 2 ) Robust Inaccuracy Similarly to robust accuracy , an input-label pair ( x , y ) is considered robustly inaccurate iff the classifier Fθ predicts an incorrect label Fθ ( x ) 6= y and Fθ is robust towards that misprediction for all inputs in Bpε ( x ) . Formally , the robust inaccuracy is defined as : R¬accrob ( Fθ ) = E ( x , y ) ∼D 1 { Fθ ( x ) 6= y } ∧ 1 { ∀x′ ∈ Bpε ( x ) . Fθ ( x′ ) = Fθ ( x ) } ( 3 ) 4 REDUCING ROBUST INACCURACY : ADVERSARIAL & CERTIFIED TRAINING . In this section , we present our training method that extends existing robust training approaches by also considering samples that are robust but inaccurate . We start by describing a high-level problem statement which we then instantiate for both empirical robustness as well as certified robustness . Problem Statement Given a distribution over input-label pairs D , our goal is to find model parameters θ such that the resulting model maximizes robust accuracy , while at the same time minimizing robust inaccuracy . Concretely , this translates to the following optimization objective : arg min θ E ( x , y ) ∼D β · Lrob ( x , y ) ︸ ︷︷ ︸ optimize robust accuracy + 1 { Fθ ( x ) 6= y } · L¬accrob ( x , y ) ︸ ︷︷ ︸ penalize robust inaccuracy ( 4 ) where β ∈ R+ is a regularization term , 1 { Fθ ( x ) 6= y } is an indicator function denoting samples for which the model is inaccurate , and Lrob ( x , y ) with L¬accrob ( x , y ) are loss functions that optimize robust accuracy and penalize robust inaccuracy , respectively . Here , the first loss function Lrob ( x , y ) is standard and can be directly instantiated using existing approaches ( see next ) . The main challenge comes in defining the second loss term , as well as ensuring that the resulting formulation is easy to optimize , e.g. , by defining a smooth approximation of the non-differentiable indicator function .

Summary: The paper addresses the issue of trained models being inaccurate but robust for some samples. To address this issue a flexible fine-tuning mechanism is proposed. A robustness-based ensembling method is introduced as well.