Pretrain-to-Finetune Adversarial Training via Sample-wise Randomized Smoothing

1 INTRODUCTION . The vulnerability of neural networks to adversarial examples has attracted considerable attention in safety-critical scenarios . For example , adding visually indistinguishable perturbations to input images would misguide a deep classifier to make wrong predictions ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ) . Such an intriguing property of neural networks has spawned a lot of works on training robust neural networks and certifying network robustness with theoretical guarantees . Many heuristic defense algorithms have been developed ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Moosavi-Dezfooli et al. , 2016 ; Papernot et al. , 2016 ; Kurakin et al. , 2016 ; Carlini & Wagner , 2017 ; Athalye et al. , 2018 ) , together with many empirically robust models intended to defend certain types of adversarial perturbations . However , there is no theoretical guarantees of robustness for many heuristic defense algorithms and many of them have been broken subsequently by more carefully designed and more powerful attack algorithms ( Athalye et al. , 2018 ) . This motivates the development of certifiably robust classifiers whose outputs are guaranteed to be the same within a lp-ball of certain radius , hence can defend any adversarial pertubation smaller than that radius ( Hein & Andriushchenko , 2017 ; Raghunathan et al. , 2018 ; Wong & Kolter , 2017 ; Gowal et al. , 2018 ; Wong et al. , 2018 ; Zhang et al. , 2018 ; Cohen et al. , 2019 ; Salman et al. , 2019 ) . Recently , Cohen et al . ( 2019 ) utilized a randomized smoothing technique to build robust smoothed classifiers with provable l2-robustness . Specifically , the smoothed classifier outputs the class most likely to be predicted by the base classifier when the input is perturbed by a certain level of Gaussian noise . Building upon this idea , Salman et al . ( 2019 ) combined randomized smoothing with adversarial training and achieved a state-of-the-art provable l2-defense . Both Cohen et al . ( 2019 ) and Salman et al . ( 2019 ) added the same level of Gaussian noise to each sample , and a higher noise level leads to lower accuracy but a larger average robust radius . While it is well known that accuracy and robustness are at odds with each other ( Tsipras et al. , 2018 ) , we find that we can improve both accuracy and robustness via sample-wise randomized smoothing , which assigns different noise levels to different samples . While the above argument seems intuitive , we note that there is a subtle and challenging issue : a close examination of the proof of the randomized smoothing theorem in Cohen et al . ( 2019 ) dictates that we can not assign arbitrary noise level to any test point ; a certain robustness radius around a point can be certified only if all points within the radius are assigned the same Gaussian variance . To address this issue , we divide the input space into “ robust regions ” , and samples in the same region are assigned the same noise level . To certify a sample-wise randomized smoothed model , we make sure that the certified l2-ball is entirely contained by one of the regions , so that the randomized smoothing theorem can be applied to that region . Hence , precisely speaking , in our method , the classification of a testing point depends on which “ robust regions ” it lies in , and hence on other testing points in the test dataset . Hence , we present our results in the transductive setting ( the test dataset is known ) , but our method also works in the setting where the test data points come online in an i.i.d . fashion ( see the detailed discussion in Appendix D ) . Our contributions can be summarized as follows : 1 . We introduce a pretrain-to-finetune framework that first pretrains a model with random noise levels and then further finetunes it with specific selected noise levels , which maximizes the robust radius of each train set sample based on the pretrained model ’ s output . 2 . In transductive setting , we allocate specific robust regions and assign noise levels for test set data using linear programming to get near optimal results . If the test data points come online , we allocate robust regions for them one by one . If the newly test sample falls in an allocated region , then it uses the same noise level . Otherwise , we allocate a brand new region for it . 3 . We conduct a series of experiments on CIFAR-10 and MNIST to evaluate the performance of our method . Comparing with the state-of-the-art algorithms , Smooth-Adv ( Salman et al. , 2019 ) and Macer ( Zhai et al. , 2020 ) , our sample-wise method achieves 40 % improvements on average certified radius on CIFAR-10 and comparable results on MNIST . 2 RELATED WORK . There are a large body of works proposing different adversarial defense algorithms , which can be divided into two categories , empirical defenses and provable defenses , by whether the resulting model achieves certified robustness . Empirical defenses Empirical defenses train classifiers that are robust under specific attacks . Lacking theoretical guarantees , these defenses can usually be broken by stronger attacks . Early defenses added noise to the input sample or features in inference in hopes that the adversarial perturbation would degenerate into random noise which could be easily handled . For example , Papernot et al . ( 2016 ) used a distillation framework to remove the effect of adversarial examples on the model . Guo et al . ( 2017 ) preprocessed the input images before feeding them into the networks , such as JPEG compression . However , Athalye et al . ( 2018 ) found that these empirical defenses could be broken by stronger attacks . So far , adversarial training ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ) , the process of training a model over on-the-fly adversarial examples , has been one of the most powerful empirical defenses . Later directly minimize the classification errors of adversarial examples generated by project gradient descend ( PGD ) which maximize the errors , actually solving a min-max optimization problem . The TRADES technique ( Zhang et al. , 2019 ) improved the results by minimizing a surrogate loss , consisting of the natural error and boundary error , and provided a tight upper bound to the original loss . Though powerful , adversarial training still lacks a certified guarantee . Provable defenses Due to the fact that empirical defenses are only robust to some specific attacks and face potential threats , the focus of the research switches to the certified defenses whose predictions can be proved robust when perturbed within a certain range . Gradually more certified defenses have been proposed recently.Raghunathan et al . ( 2018 ) certified a shallow network based on semidefinite relaxation , Wong & Kolter ( 2017 ) made use of convex outer adversarial polytope based on relu activation function and Zhang et al . ( 2018 ) proposed a solution for general activation function . Though effective , they all rely on the structure of the network . A randomized smoothing classifier ( Cohen et al. , 2019 ) is a certified robust classifier independent of the structure of the network and only relies on the prediction of the base classifier . In fact , it is a virtual classifier and its prediction is generated from the prediction of the base classifier . Then Salman et al . ( 2019 ) proposed Smooth-Adv which can directly attack the virtual classifier and promoted performance with a large margin . Based on these , we propose sample-wise randomized smoothing to improve certified robustness further . 3 PRELIMINARIES . 3.1 NOTATION . We study the task of image classification . Every image is represented by x ∈ X and X stands for the image space [ 0 , 1 ] h×w×c , where h , w , c represent the height , width and depth of the picture respectively . For a classification task of k classes , we intend to build a classifier f : X → Y = { 0 , 1 , ... , k − 1 } . For a neural network , fθ ( x ) represents the prediction of the sample x and variable θ represents the parameters of the neural network . fθ predicts the class that achieves the maximum value at the last layer of the network . 3.2 ADVERSARIAL EXAMPLES . Given a classifier fθ and an input-label pair ( x , y ) , we say that x′ is an adversarial example to x if D ( x , x′ ) < , fθ ( x ) = y and fθ ( x′ ) 6= y . The attack algorithm seeks for any different prediction result in the -ball centered at x ( i.e. , { x′ | D ( x , x′ ) < } ) . D ( · , · ) can represent different distance metric such as l2 and l∞ metric . We only focus on l2 distance in this paper and we use D ( · , · ) to denote the l2 distance . For empirical defenses , researchers have built heuristic robust classifiers so that specific attack algorithms can hardly find adversarial examples x′ around x . For certified defenses , they build certified robust classifiers gθ and look for the maximum value of with which for any perturbation δ such that D ( x+ δ , x ) < , one can rigorously prove that gθ ( x+ δ ) = gθ ( x ) . Such is also called the robustness radius about x . 3.3 RANDOMIZED SMOOTHING . The randomized smoothing method ( Cohen et al. , 2019 ) is a powerful defense framework and can be applied to any classification model . Suppose fθ is the base model . The smoothed model gθ ( x , σ ) predicts the category c most likely to be predicted by fθ when the input is sampled from a Gaussian distribution N ( x , σ2I ) , where σ is a carefully chosen standard deviation . Formally , gθ is defined as follows : gθ ( x , σ ) = arg max c∈Y P ( fθ ( x+ η ) = c ) where η ∼ N ( 0 , σ2I ) ( 1 ) Cohen et al . ( 2019 ) proved that gθ is provably robust to adversarial perturbations under the l2 norm constraint . Define cA = arg maxc P ( fθ ( x + η ) = c ) , pA = P ( fθ ( x + η ) = cA ) and pB = maxc6=cAP ( fθ ( x+η ) = c ) . We can prove that gθ always predicts cA in { z ∈ X : D ( z , x ) < r } , where the robust radius r is given by the following formula : r = R ( fθ , σ , x ) = σ 2 ( Φ−1 ( pA ) − Φ−1 ( pB ) ) ( 2 ) where Φ−1 is the inverse of the standard Gaussian CDF . This theorem ( called the randomized smoothing theorem ) implies that gθ is provably l2-robust at x if it predicts the label of x correctly . To train provably robust models , Cohen et al . ( 2019 ) proposed to train and certify the model with the same noise level , exactly the same standard deviation . Furthermore , ( Salman et al. , 2019 ) equipped randomized smoothing with adversarial training , and proposed an attack algorithm , called Smooth-Adv . By randomly sampling multiple Gaussian noise around each sample during the training procedure , the algorithm directly estimates gθ and seeks for adversarial examples for gθ . The attack algorithm is shown in Eq . ( 3 ) and LCE represents the cross entropy loss . x′ = arg max D ( x′ , x ) < LCE ( gθ ( x′ , σ ) , y ) = arg max D ( x′ , x ) < ( − log ( 1 m m∑ i=1 fθ ( x ′ + ηi ) y ) ) ( 3 ) Though heuristic for adversarial training , combining with randomized smoothing and directly optimizing gθ has greatly improve the certifiable robustness . Based on Smooth-Adv , we apply sample-wise randomized smoothing to further improve the defense .

Summary: This paper considers the problem of provably defense to adversarial perturbations using randomized smoothing. The authors propose sample-wise randomized smoothing -- assigning different noise levels to different samples. They also propose to first pretrain a model and then adjust the noise for higher performance based on the model’s outputs. Experiments show that proposed approach improves the performance of randomized smoothing with same noise level for small perturbations.