Boosting Randomized Smoothing with Variance Reduced Classifiers

1 INTRODUCTION . Modern deep neural networks are successfully applied to an ever-increasing range of applications , but while they often achieve excellent accuracy on the data distribution they were trained on , they have been shown to be very sensitive to slightly perturbed inputs , called adversarial examples ( Biggio et al. , 2013 ; Szegedy et al. , 2014 ) . This limits their applicability to safety-critical domains . Heuristic defenses against this vulnerability have been shown to be breakable ( Tramèr et al. , 2020 ; Carlini & Wagner , 2017 ) , highlighting the need for provable robustness guarantees . A promising method providing such guarantees for large networks is randomized smoothing ( RS ) ( Cohen et al. , 2019 ) . The core idea is to provide probabilistic robustness guarantees with arbitrarily high confidence by adding noise to the input of a base classifier and computing the expected classification over the perturbed inputs using Monte Carlo sampling . The key to obtaining high robust accuracies is a base classifier with low variance with respect to these perturbations that remains consistently accurate even under high levels of noise . Existing works use different regularization and loss terms to encourage such behavior ( Salman et al. , 2019 ; Zhai et al. , 2020 ; Jeong & Shin , 2020 ) but are ultimately all limited by the bias-variance trade-off of individual models . We show first theoretically and then empirically how ensembles can be constructed to significantly reduce this variance component and thereby increase certified radii for individual samples , and consequently , certified accuracy across the whole dataset . We illustrate this in Fig . 1 . Ensembles are a well-known tool for reducing classifier variance at the cost of increased computational cost ( Hansen & Salamon , 1990 ) . However , in the face of modern architectures ( He et al. , 2016 ; Huang et al. , 2017 ) allowing the stable training of large models , they have been considered computationally inefficient . Yet , recent work ( Wasay & Idreos , 2021 ) shows ensembles to be more efficient than single monolithic networks in many regimes . In light of this , we develop a theoretical framework analyzing this variance reducing property of ensembles under the perturbations introduced by RS . Further , we show how this reduced variance can significantly increase the majority class ’ s prediction probability , leading to much larger certified radii than evaluating more perturbations with an individual model . Certification with RS is computationally costly as the base classifier has to be evaluated many thousand times . To avoid exacerbating these costs by using ensembles as base models , we develop two techniques : ( i ) an adaptive sampling scheme for RS , which certifies samples for predetermined certification radii in stages , reducing the mean certification time up to 55-fold , and ( ii ) a special aggregation mechanism for ensembles which only evaluates the full ensemble on challenging samples , for which there is no consensus between a predefined subset of the constituting models . Main Contributions Our key contributions are : • A novel , theoretically motivated , and statistically sound soft-ensemble scheme for randomized smoothing , reducing perturbation variance and increasing certified radii ( §4 and §5 ) . • A data-dependent adaptive sampling scheme for RS that reduces the sample complexity for predetermined certification radii in a statistically sound manner ( §6 ) . • An extensive evaluation , examining the effects and interactions of ensemble size , training method , and perturbation size . We obtain state-of-the-art results on ImageNet and CIFAR10 for a wide range of settings , including denoised smoothing ( §7 ) . 2 RELATED WORK . Adversarial Robustness Following the discovery of adversarial examples ( Biggio et al. , 2013 ; Szegedy et al. , 2014 ) , defenses aiming to robustify networks were proposed ( Madry et al. , 2018 ) . Particularly relevant to this work are approaches that certify or enforce robustness properties . We consider probabilistic and deterministic approaches . Deterministic certification methods compute the reachable set for given input specifications using convex relaxations ( Singh et al. , 2019 ; Xu et al. , 2020 ) , mixed-integer linear programming ( Tjeng et al. , 2019 ) , semidefinite programming ( Dathathri et al. , 2020 ) , or SMT ( Ehlers , 2017 ) , to reason about properties of the output . To obtain networks amenable to such approaches , specialized training methods have been proposed ( Mirman et al. , 2018 ; Balunovic & Vechev , 2020 ; Xu et al. , 2020 ) . Probabilistic certification ( Li et al. , 2019 ; Lécuyer et al. , 2019 ) introduces noise to the classification process to obtain probabilistic robustness guarantees , allowing the certification of larger models than deterministic methods . We review Randomized Smoothing ( RS ) ( Cohen et al. , 2019 ) in §3 and associated training methods ( Jeong & Shin , 2020 ; Zhai et al. , 2020 ; Salman et al. , 2019 ) in App . G.3 . Orthogonally to training , RS has been extneded in numerous ways ( Yang et al. , 2020 ; Zhang et al. , 2020 ; Lee et al. , 2019 ; Dvijotham et al. , 2020 ; Fischer et al. , 2020 ) , which we review in App . B. Ensembles have been extensively analyzed with respect to different aggregation methods ( Kittler et al. , 1998 ; Inoue , 2019 ) , diversification ( Dietterich , 2000 ) , and the reduction of generalization errors ( Tumer & Ghosh , 1996b ; a ) . Randomized Smoothing and ensembles were first combined in Liu et al . ( 2020 ) as ensembles of smoothed classifiers . However , the method does not retain strong certificates for individual inputs ; thus , we consider the work to be in a different setting from ours . We discuss this in App . A . While similar at first glance , Qin et al . ( 2021 ) randomly sample models to an ensemble , evaluating them under noise to obtain an empirical defense against adversarial attacks . They , however , do not provide robustness guarantees . 3 RANDOMIZED SMOOTHING . Here we review the relevant background on Randomized Smoothing ( RS ) as introduced in Cohen et al . ( 2019 ) . We let f : Rd 7→ Rm denote a base classifier that takes a d-dimensional input and produces m numerical scores ( pre-softmax logits ) , one for each class . Further , we let F ( x ) : = arg maxq fq ( x ) denote a function Rd 7→ [ 1 , . . . , m ] that directly outputs the class with the highest score . For a random variable ∼ N ( 0 , σ2 I ) , we define a smoothed classifier G : Rd 7→ [ 1 , . . . , m ] as G ( x ) : = arg max c P ∼N ( 0 , σ2 I ) ( F ( x+ ) = c ) . ( 1 ) This classifier G is then robust to adversarial perturbations as follows : Theorem 3.1 ( From Cohen et al . ( 2019 ) ) . Let cA ∈ [ 1 , . . . , m ] , pA , pB ∈ [ 0 , 1 ] . If P ( F ( x+ ) = cA ) ≥ pA ≥ pB ≥ max c6=cA P ( F ( x+ ) = c ) , then G ( x+ δ ) = cA for all δ satisfying ‖δ‖2 < R with R : = σ 2 ( Φ−1 ( pA ) − Φ−1 ( pB ) ) . Algorithm 1 Certify from ( Cohen et al. , 2019 ) 1 : function CERTIFY ( F , σ , x , n0 , n , α ) 2 : cnts0← SAMPLEUNDERNOISE ( F , x , n0 , σ ) 3 : ĉA ← top index in cnts0 4 : cnts← SAMPLEUNDERNOISE ( F , x , n , σ ) 5 : pA ← LOWERCONFBND ( cnts [ ĉA ] , n , 1− α ) 6 : if pA > 12 then 7 : return prediction ĉA and radius σ Φ−1 ( pA ) 8 : return For radii R as per Theorem 3.1 with inverse Gaussian CDF Φ−1 and any x , showingR ≥ δ certifies G ( x ) = G ( x′ ) for any x′ ∈ { x+ η | ‖η‖2 < δ } . Computing the exact probabilities P ( F ( x+ ) = c ) is generally intractable . Thus , to allow practical application , CERTIFY ( Cohen et al. , 2019 ) ( see Algorithm 1 ) utilizes sampling : First , n0 samples to determine the majority class , then n samples to compute a lower bound pA to the success probability with confidence 1− α via the Clopper-Pearson lemma ( Clopper & Pearson , 1934 ) . If pA > 0.5 , we set pB = 1− pA and obtain radius R = σ Φ−1 ( pA ) via Theorem 3.1 else we abstain ( return ) . See App . F for exact definitions of the sampling and lower bounding procedures . To obtain high certified radii , the base model F must be trained to cope with the added Gaussian noise . To achieve this , several training methods , discussed in App . G.3 , have been introduced . We also see this in Fig . 1 , where various models obtain different pA , and thereby different radii R . 4 RANDOMIZED SMOOTHING FOR ENSEMBLE CLASSIFIERS . In this section , we extend the methods discussed in §3 from single models to ensembles . For a set of k classifiers { f l : Rd 7→ Rm } kl=1 , we construct an ensemble f̄ via weighted aggregation , f̄ ( x ) = ∑k l=1 w l γ ( f l ( x ) ) , where wl are the weights , γ : Rm 7→ Rm is a post-processing function , and f l ( x ) are the pre-softmax outputs of an individual model . Soft-voting ( where γ denotes identity ) and equal weights wl = 1k perform experimentally well ( see App . H.3.1 ) while being mathematically simple . Thus , we consider soft-ensembling via the averaging of the logits : f̄ ( x ) = 1 k k∑ l=1 f l ( x ) ( 2 ) The ensemble f̄ and its corresponding hard-classifier F̄ ( x ) : = arg maxq f̄q ( x ) , can be used without further modification as base classifiers for RS . We find that classifiers of identical architecture and trained with the same method but different random seeds are sufficiently diverse too , when ensembled with k ∈ [ 3 , 50 ] , exhibit a notably reduced variance with respect to the perturbations . As we will show in the next section , this increases both the true majority class probability pA and its lower confidence bound pA , raising the certified radius as per Theorem 3.1 . 5 VARIANCE REDUCTION VIA ENSEMBLES FOR RANDOMIZED SMOOTHING . We now show how ensembling even similar classifiers f l ( cf . Eq . ( 2 ) ) reduces their variance over the perturbations introduced in RS and thereby increases their majority class probability pA , making these ensembles f̄ particularly well-suited as base classifiers for RS . To this end , we first model network outputs with general distributions before investigating our theory empirically for Gaussian distributions . We defer algebra to App . C and justify our modeling assumptions empirically in App . D. Our modeling approach is mathematically closely related to Tumer & Ghosh ( 1996a ) , which focuses on analyzing ensemble over the whole dataset . However , we condition on a single input to study the interplay between the stochasticity in training and random perturbations encountered in RS . Individual Classifier We consider individual classifiers f l : Rd 7→ Rm and perturbed inputs x+ for a single arbitrary but fixed x and Gaussian perturbations ∼ N ( 0 , σ2 I ) . We model the presoftmax logits f l ( x ) = : yl ∈ Rm as the sum of two random variables yl = ylp + ylc . Here , ylc corresponds to the classifier ’ s behavior on the unperturbed sample and models the stochasticity in weight initialization and training with random noise augmentation . ylp describes the effect of the random perturbations applied during RS . Note that this split will become essential when analyzing the ensembles . We drop the superscript l when discussing an individual classifier to avoid clutter . We model the distribution of the clean component yc over classifiers with mean c = El [ f l ( x ) ] , the expectation for a fixed sample x over the randomness in the training process , and covariance Σc characterizing this randomness . We assume the distribution of the perturbation effect yp to be zero-mean ( following from local linearization and zero mean perturbations ) and to have a covariance Σp . While Σp might depend on the noise level σ , it is distinct from it . We do not restrict the structure of either covariance matrix and denote Σii = σ2i and Σij = σiσjρij . As yc models the global training effects and yp models the local behavior under small perturbations , we assume them to be independent . We thus obtain logits y with mean c , the expectation over the training process for the clean sample , and covariance matrix Σ = Σc + Σp , where Σc and Σp encode the stochasticity of the training process and over perturbations respectively . The classifier prediction F l ( x ) = arg maxq yq is not determined by the absolute values of logits but rather by the differences between them . We thus call the difference between the majority class logit and others the classification margin . During certification with RS , the first step is to determine the majority class . Without loss of generality , let the class with index 1 be the majority class , leading to the classification margin zi = y1 − yi . Note that if zi > 0 for all i 6= 1 , then the majority class logit y1 is larger than the logits of all other classes yi . Under the above assumptions , the statistics of the classification margin for a single classifier are : E [ zi ] = c1 − ci Var [ zi ] = σ 2 p,1 + σ 2 p , i + σ 2 c,1 + σ 2 c , i − 2ρp,1iσp,1σp , i − 2ρc,1iσc,1σc , i Ensemble Now , we construct an ensemble of k of such classifiers . We use soft-voting ( cf . Eq . ( 2 ) ) to compute the ensemble output ȳ = 1k ∑k l=1 y l and then the corresponding classification margins z̄i = ȳ1 − ȳi . By the linearity of expectation we have E [ z̄i ] = E [ zi ] = c1 − ci . We consider similar classifiers , differing only in the random seed used for training . Hence , we assume that the correlation between the logits of different classifiers has a similar structure but smaller magnitude than the correlation between logits of one classifier . Correspondingly , we parametrize the covariance between yic and y j c for classifiers i 6= j with ζcΣc and similarly between yip and yjp with ζpΣp for ζc , ζp ∈ [ 0 , 1 ] . Depending on these correlation coefficients ζc and ζp , this model captures the range from no correlation ( ζ = 0 ) to perfect correlation ( ζ = 1 ) . We obtain the following variance : Var [ z̄i ] = k + 2 ( k 2 ) ζp k2 ( σ2p,1 + σ 2 p , i − 2ρp,1iσp,1σp , i ) ︸ ︷︷ ︸ σ2p ( k ) + k + 2 ( k 2 ) ζc k2 ( σ2c,1 + σ 2 c , i − 2ρc,1iσc,1σc , i ) ︸ ︷︷ ︸ σ2c ( k ) . Variance Reduction We can split Var [ z̄i ] into the components associated with the clean prediction σ2c ( k ) and the perturbation effect σ 2 p ( k ) , both as functions of the ensemble size k. We now compare these variance terms independently to the corresponding terms of an individual classifier dropping the subscripts p and c from σ2c ( k ) /σ 2 c ( 1 ) and σ 2 p ( k ) /σ 2 p ( 1 ) as they follow the same structure : σ2 ( k ) σ2 ( 1 ) = ( 1 + ζ ( k − 1 ) ) ( σ21 + σ2i − 2ρ1iσ1σi ) k ( σ21 + σ 2 i − 2ρ1iσ1σi ) = 1 + ζ ( k − 1 ) k k→∞−−−−→ ζ ( 3 ) We observe that both variance components go towards their corresponding correlation coefficients ζc and ζp as ensemble size grows , highlighting the importance of non-identical classifiers and illustrated under a Gaussian assumption ( explained later ) in Fig . 2a . Effect on Success Probability We can compute the probability of an ensemble of k classifiers predicting the majority class by integrating the probability distribution of the classification margin over the orthant1 z̄i > 0 ∀i ≥ 2 where majority class 1 is predicted : p1 : = P ( F̄ ( x+ ) = 1 ) = P ( z̄i > 0 : ∀ 2 ≤ i ≤ m ) = ∫ z̄s.t.z̄i > 0 , ∀ 2 ≤i≤m P ( z̄ ) dz̄ . ( 4 ) Assuming Gaussian distributions , we observe the increase in success probability shown in Fig . 2b . Without assuming a specific distribution , we can still lower-bound the success probability using Chebyshev ’ s inequality and the union bound . Given that a mean classification yields the majority class and hence c1 − ci > 0 , we let ti = c1−ciσi ( k ) and have : p1 ≥ 1− m∑ i=2 P ( |z̄i − c1 + ci| ≥ ti σi ( k ) ) ≥ 1− m∑ i=2 σi ( k ) 2 ( c1 − ci ) 2 ( 5 ) where σi ( k ) 2 = σc , i ( k ) 2 + σp , i ( k ) 2 is the variance of classification margin z̄i . We observe that as σi ( k ) decreases with increasing ensemble size k ( see Eq . ( 3 ) ) , the lower bound to the success probability increases quadratically . The further we are away from the decision boundary , i.e. , the larger ci , the smaller the absolute increase in success probability for the same variance reduction . Given a concrete success probability p1 , we compute the probability distribution over the certifiable radii reported by CERTIFY for a given confidence α , sample number n , and perturbation variance σ2 ( up to choosing an incorrect majority class ĉA ) as : P ( R = σ Φ −1 ( p1 ( n1 , n , α ) ) ) = B ( n1 , n , p1 ) , for R > 0 ( 6 ) where B ( s , r , p ) is the probability of drawing s successes in r trials from a Binomial distribution with success probability p , and p ( s , r , α ) is the lower confidence bound to the success probability of a Bernoulli experiment given s successes in r trials with confidence α according to the Clopper-Pearson interval ( Clopper & Pearson , 1934 ) . We illustrate the resulting effect assuming Gaussian distributions in Fig . 2c . 1n-dimensional equivalent of a quadrant Empirical Analysis via Gaussian Assumption To investigate our theory , we now assume ylc and ylp and hence also z̄i to be multivariate Gaussians . This choice is empirically well-fitting ( see App . D ) and follows from the central limit theorem for ylc and from Gaussian perturbations and local linearization for ylp . To estimate the free parameters c , Σc , Σp , ζc , and ζp , we evaluate ensembles of up to k = 50 GAUSSIAN trained ResNet20 ( for details , see §7 ) at σ = 0.25 . We obtain c and Σc as the mean and covariance of the output on a randomly chosen sample x . Subtracting the clean outputs from those for the perturbed samples , we estimate the covariance matrix Σp . We determine ζc ≈ 0 and ζp ≈ 0.82 as the median ratio of the inter- and intra-classifier covariance . ζc ≈ 0 implies that our models can be treated as independent conditioned on a single fixed and unperturbed input . Plugging these estimates into our model under the Gaussian assumption , we observe a significant decrease in the variance of the classification margin to the runner-up class as ensemble size k increases ( see Fig . 2a ) . This generally leads to more polarized success probabilities : the majority class ’ probability is increased , while the other classes ’ probabilities are decreased because the probability mass concentrates around the mean , and consequently on one side of the decision threshold z̄ = 0 , which determines the success probability via Eq . ( 4 ) . An increase , as in our case ( see Fig . 2b ) , leads to much larger expected certified radii ( see Fig . 2c ) for a given number of sampled perturbations ( here n = 103 ) via Eq . ( 6 ) . In contrast , sampling more perturbations will , in the limit , only recover the true success probability . In our example , going from one classifier to an ensemble of 50 increases the expected certified radius by 191 % , while drawing 50 times more perturbations for a single model only yields a 28 % increase ( see Fig . 2c ) . As illustrated in Fig . 3 , these effects are strongest close to decision boundaries ( pA 1 ) , where small increases in pA impact the certified radius much more than the number of samples n , which dominated at pA ≈ 1 .̧

Summary: This paper integrates model ensembles with randomized smoothing to improve the certified accuracy. The methodology is motivated theoretically by showing the effect of model ensemble on reducing the variance of smooth classifiers. Moreover, it proposes an adaptive sampling algorithm to reduce the computation required for certifying with randomized smoothing. Extensive experiments were conducted on CIFAR10 and ImageNet datasets.