SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustness

Randomized smoothing is currently a state-of-the-art method to construct a certifiably robust classifier from neural networks against ℓ2-adversarial perturbations . Under the paradigm , the robustness of a classifier is aligned with the prediction confidence , i.e. , the higher confidence from a smoothed classifier implies the better robustness . This motivates us to rethink the fundamental trade-off between accuracy and robustness in terms of calibrating confidences of a smoothed classifier . In this paper , we propose a simple training scheme , coined SmoothMix , to control the robustness of smoothed classifiers via self-mixup : it trains on convex combinations of samples along the direction of adversarial perturbation for each input . The proposed procedure effectively identifies over-confident , near off-class samples as a cause of limited robustness in case of smoothed classifiers , and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness . Our experimental results demonstrate that the proposed method can significantly improve the certified ℓ2-robustness of smoothed classifiers compared to existing state-of-the-art robust training methods.3 1 Introduction . Adversarial examples [ 53 , 17 ] in deep neural networks clearly highlight that neural networks often generalize differently from humans , at least without an additional prior of local smoothness of predictions with respect to the input space : an adversarially-crafted , yet imperceptible input perturbation can drastically change the prediction of a neural network based classifier . Due to the intrinsic complexity of neural networks , however , the community has noticed that it is extremely hard to directly encode this smoothness prior into neural networks [ 6 , 3 , 55 ] , especially without relying on adversarial training [ 40 , 66 ] , i.e. , augmenting training data with its adversarial examples . Even with adversarial training , ( a ) the non-convex , minimax nature of the training introduces many optimization difficulties , often resulting in a harsh over-fitting [ 51 , 47 ] , and ( b ) it is generally hard to provably guarantee that the learned classifier is indeed smooth . ∗Work done at KAIST . †Work done at Kakao Enterprise . 3Code is available at https : //github.com/jh-jeong/smoothmix . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . Randomized smoothing [ 33 , 11 ] is relatively a recent idea that aims to indirectly encode the smoothness prior : Cohen et al . [ 11 ] have shown that any classifier , regardless of whether it is smooth or not , can be transformed into a certifiably robust classifier via averaging its predictions over Gaussian noise , where the ( certified ) robustness of the classifier depends on how well the base classifier performs with the noise . Compared to adversarial training , this notion of “ indirect ” smoothness can be favorable in a sense that ( a ) it is easier to optimize , and ( b ) offers a provable guarantee on the robustness . Currently , randomized smoothing is considered as the state-of-the-art approach in the context of building a neural network based classifier that is certifiably robust on ℓ2-perturbations [ 39 ] . In this respect , a growing body of research has focused on improving the robustness guarantee that randomized smoothing can give , e.g. , via different smoothing measures [ 34 , 62 ] or improved certification procedures [ 14 , 43 ] . One of important directions on this line of research is to investigate which training of the base classifier could maximize the certified robustness of smoothed classifiers [ 49 , 65 , 23 ] . In particular , Salman et al . [ 49 ] have proposed SmoothAdv , showing that employing adversarial training [ 40 ] for smoothed classifiers could further improve the robustness , akin to the standard neural networks . This motivates us to develop a new form of adversarial training , more specialized for smoothed classifiers . Contribution . In this paper , we propose SmoothMix , a novel adversarial training method designed for improving the certified robustness of smoothed classifiers . One of the key features that smoothed classifiers offer is a direct correspondence from prediction confidence to adversarial robustness : achieving a higher confidence in a smoothed classifier implies that the classifier can give a better certified robustness . Inspired by this , we found that the certified robustness of a given data sample can be significantly decreased by nearby off-class but over-confident [ 45 ] inputs : such “ harmful ” inputs would occupy an unnecessarily large robust radius near the sample of our interest , especially when they do not contain much information to be discriminated by the classifier . Under the finding , we aim to calibrate the confidence of these off-class inputs to improve the certified robustness at the original input . More specifically , we first observe that such over-confident examples can be efficiently found along the direction of adversarial perturbations for a given input . Then , we suggest to regularize the over-confident predictions along the adversarial direction toward the uniform prediction through a mixup loss [ 67 ] ( see Figure 1 for an overview ) . This new approach of incorporating adversarial examples effectively permits more distant examples in training , even when they go off-class , based on the local-smoothness of smoothed classifiers . It also suggests an intuitive way of defining confidence beyond the given data samples to smoothed classifiers . We evaluate our proposed SmoothMix against with various state-of-the-art robust training methods for smoothed classifiers on a wide range of image classification benchmarks , including MNIST [ 32 ] , CIFAR-10 [ 29 ] , and ImageNet [ 48 ] datasets . Overall , the results consistently show that our new adversarial training scheme for smoothed classifiers significantly improves the certified robustness compared to existing methods , e.g. , one of our CIFAR-10 model could largely outperform an existing state-of-the-art result on the average certified robustness in ℓ2-radius 0.720 → 0.737 . Through an extensive ablation study , we also verify that our method is ( a ) robust to the choice of hyperparameters , and ( b ) can effectively trade-off between the accuracy and robustness [ 66 ] of smoothed classifiers . Overall , our work suggests that the robustness of a classifier should be set individually per sample considering its nearby inputs : we approach this problem by leveraging the relationship between the prediction confidence and robustness of smoothed classifiers . Recently , there have been also some initial attempts to incorporate a sample-wise treatment for robustness by allowing input-dependent noise scales in randomized smoothing [ 1 , 58 , 10 ] . However , our theoretical analysis shows that such an approach would eventually suffer from the curse of dimensionality ( Theorem 1 in Appendix B ) , highlighting our approach of focusing on a “ better calibration ” as a promising alternative . 2 Preliminaries . We assume an i.i.d . dataset D = { ( xi , yi ) } n i=1 ∼ P , where xi ∈ R d and yi ∈ Y : = { 1 , · · · , C } , and focus on the problem of correctly classifying a given input x into one of C classes . Let f : Rd → Y be a classifier modeled by f ( x ) : = argmaxc∈Y Fc ( x ) with F : R d → ∆C−1 , where ∆C−1 denotes the probability simplex in RC . For example , F can be a neural network followed by a softmax layer . In the context of adversarial robustness , we require f not only to correctly classify ( x , y ) ∼ P , but also to be locally-constant around x , i.e. , f should not contain any adversarial examples around x . In this respect , one can measure and attempt to maximize the adversarial robustness of a classifier f by considering the minimum-distance of adversarial perturbation [ 44 , 7 , 8 ] , namely : R ( f ; x , y ) : = min f ( x′ ) 6=y ‖x′ − x‖2 . ( 1 ) Randomized smoothing . In cases when f is too complex to control its predictions in practice , e.g. , if f is a neural network on high-dimensional data , directly solving and maximizing ( 1 ) can be hard . Randomized smoothing [ 11 ] instead constructs a new classifier f̂ from f that is easier to obtain robustness by transforming the base classifier f with a certain smoothing measure , where in this paper we focus on the case of Gaussian distributions N ( 0 , σ2I ) : f̂ ( x ) : = argmax c∈Y Pδ∼N ( 0 , σ2I ) ( f ( x+ δ ) = c ) . ( 2 ) For a given ( x , y ) , Cohen et al . [ 11 ] have shown that R ( f̂ ; x , y ) can be lower-bounded by the certified radius R ( f̂ , x , y ) , which can be derived from the confidence of f̂ at x , namely we denote it by pf ( x ) : R ( f̂ ; x , y ) ≥ σ · Φ−1 ( pf ( x ) ) = : R ( f̂ , x , y ) where pf ( x ) : = Pδ∼N ( 0 , σ2I ) ( f ( x+ δ ) = f̂ ( x ) ) , ( 3 ) provided that f̂ ( x ) = y , and otherwise R ( f̂ ; x , y ) : = 0.4 This lower bound is known as tight for the ℓ2-minimum distance , e.g. , the bound is optimal for linear classifiers [ 11 ] . Although randomized smoothing can be applied for any classifier f : Rd → Y , the robustness of smoothed classifiers can vary depending on pf as in ( 3 ) , i.e. , how f performs on a given input under the presence of Gaussian noise . In this sense , to obtain a robust f̂ , Cohen et al . [ 11 ] simply propose to train f using Gaussian augmentation by default : min F E ( x , y ) ∼P δ∼N ( 0 , σ2I ) [ L ( F ( x+ δ ) , y ) ] , ( 4 ) where L denotes the standard cross-entropy loss . Adversarial training for smoothed classifiers . To obtain f that gives a more robust classifier when smoothed into f̂ , Salman et al . [ 49 ] propose SmoothAdv that employs adversarial training [ 40 ] on f̂ : min f̂ max ‖x′−x‖2≤ǫ L ( f̂ ; x′ , y ) . ( 5 ) Due to the intractability of f̂ , however , it is hard to directly optimize the inner maximization of ( 5 ) via gradient methods . To bypass this , SmoothAdv attacks the soft-smoothed classifier F̂ : = Eδ [ Fy ( x+δ ) ] instead . Specifically , SmoothAdv finds an adversarial example via solving the following : x̂ = argmax ‖x′−x‖2≤ǫ L ( F̂ ; x′ , y ) ≈ argmax ‖x′−x‖2≤ǫ ( − log ( 1 m ∑ i Fy ( x ′ + δi ) ) ) , ( 6 ) using Monte Carlo integration with m samples of δ , namely δ1 , · · · , δm ∼ N ( 0 , σ 2I ) . 4Here , Φ denotes the cumulative distribution function of the standard normal distribution . 3 Method . Our goal in this paper is to develop a more suitable form of adversarial training ( AT ) for smoothed classifiers , taking into account their unique characteristics on adversarial robustness over standard neural networks . Figure 1 illustrates a motivating example : as shown in Figure 1 ( a ) , AT typically assumes a fixed-sized ball of radius ε that each adversarial perturbation must be in , as the goal of the training is to defend the classifier against adversaries under a specific threat model . However , in a case when AT is applied to a smoothed classifier , e.g. , as done by SmoothAdv , this assumption may be too restrictive , particularly for inputs where the classifier already certifies robustness of radii larger than ε ( e.g. , Figure 1 ( b ) ) . This demands for a new form of AT specially for smoothed classifiers , e.g. , that allows more distant adversarial examples , despite its fundamental difficulty in the context of standard neural networks [ 25 , 69 ] . In this regard , our proposed training method of SmoothMix takes a completely different approach to incorporate adversarial examples during training . More specifically , for a given sample ( x , y ) ∼ P , our method finds an adversarial example of x without an explicit norm constraint , i.e. , “ unrestrictively. ” This is because our focus is not to find an input for correcting its label to y ( as in the standard AT ) , but to find an input that is over-confident and semantically off-class , i.e. , it is not beneficial to the classifier to label this input to y . Once we have such an example , SmoothMix then labels it as the uniform confidence , and considers a mixup training [ 67 ] with the original x : by linearly interpolating with the uniform confidence , SmoothMix effectively calibrates the over-confident inputs in between , re-balancing the certified radius at the original sample of x at the end .

Summary: The paper offers a novel training scheme—called SmoothMix—for fitting deep net classifiers with improved adversarial robustness while maintaining accuracy to the extent possible. The key idea is to combine the mixup loss with smooth classifiers. The former interpolates the input sample with its adversarial perturbation, designed to “mislead” the smoothed classifier. The effectiveness of the proposed idea was studied on MNIST, CIFAR10, and ImageNet, showing competitive performance to that of state-of-the-art adversarial defense strategies (Gaussian smoothing, stability training, adversarial smoothing, MACER, and consistency).