Confidence-aware Training of Smoothed Classifiers for Certified Robustness

1 INTRODUCTION . Despite these tremendous advances in deep neural networks for a variety of tasks towards artificial intelligence , e.g. , visual recognition ( He et al. , 2016 ; Chen et al. , 2020 ) , natural language processing ( Vaswani et al. , 2017 ; Brown et al. , 2020 ) , and reinforcement learning ( Silver et al. , 2017 ; Vinyals et al. , 2019 ) , the broad existence of adversarial examples ( Szegedy et al. , 2014 ) is still one of the most significant aspects that reveals the gap between machine learning systems and humans : for a given input x ( e.g. , an image ) to a classifier f , say a neural network , f often permits a perturbation δ that completely flips the prediction f ( x+ δ ) , while δ is too small to change the semantic in x . In response to this vulnerability , there have been significant efforts in building robust neural network based classifiers against adversarial examples , either in forms of empirical defenses ( Athalye et al. , 2018 ; Carlini et al. , 2019 ; Tramer et al. , 2020 ) , which are largely based on adversarial training ( Madry et al. , 2018 ; Zhang et al. , 2019 ; Wang et al. , 2020 ; Zhang et al. , 2020b ; Wu et al. , 2020 ) , or certified defenses ( Wong & Kolter , 2018 ; Xiao et al. , 2019 ; Cohen et al. , 2019 ; Zhang et al. , 2020a ) , depending on whether the robustness claim can be theoretically guaranteed or not . Randomized smoothing ( Lecuyer et al. , 2019 ; Cohen et al. , 2019 ) , our focus in this paper , is currently a prominent approach in the context of certified defense , thanks to its scalability to arbitrary neural network architectures while previous methods have been mostly limited in network sizes or require strong assumptions on their architectures : specifically , for a given classifier f , it constructs a new classifier f̂ , where f̂ ( x ) is defined to be the class that f ( x + δ ) outputs most likely over δ ∼ N ( 0 , σ2I ) , i.e. , the Gaussian noise . Then , it is shown by Lecuyer et al . ( 2019 ) that f̂ is certifiably robust in ` 2-norm , and Cohen et al . ( 2019 ) further tightened the ` 2-robustness guarantee which is currently considered as the state-of-the-art in certified defense . However , even with recent methods for adversarial defense , including randomized smoothing , the trade-off between robustness and accuracy ( Tsipras et al. , 2019 ; Zhang et al. , 2019 ) has been well evidenced , i.e. , increasing the robustness for a specific input can be at the expense of decreased accuracy for other inputs . For instance , with the current best practices , Salman et al . ( 2020 ) report that the accuracy of ResNet-50 on ImageNet degrades , e.g. , 75.8 % → 63.9 % , by an ` ∞-adversarial training , i.e. , optimizing the classifier to ensure robustness at all the given training samples around an ` ∞-ball ( of size 4255 ) . In addition , Zhang et al . ( 2019 ) have shown that the ( empirical ) robustness of a classifier can be further boosted in training by paying more expense in accuracy . A similar trend can be also observed with certified defenses , e.g. , randomized smoothing , as the clean accuracy of smoothed classifiers are usually less than those one can obtain from the standard training on the same architecture ( Cohen et al. , 2019 ) . Contribution . In this paper , we develop a novel training method for randomized smoothing , coined Confidence-Aware Training for Randomized Smoothing ( CAT-RS ) , which incorporates a sample-wise control of target robustness on-the-fly motivated by the accuracy-robustness trade-off in smoothed classifiers . Intuitively , a natural approach one can consider in response to the trade-off in robust training is to appropriately lower the robustness requirement for “ hard-to-classify ” samples while maintaining those for the remaining ( “ easier ” ) samples : here , the challenges are ( a ) which samples we should choose for it during training and ( b ) how to control their target robustness . To implement this idea , we focus on the direct correspondence from prediction confidence to adversarial robustness that smoothed classifiers offer : due to its local-Lipschitzness ( Salman et al. , 2019 ) , achieving a high confidence at x from a smoothed classifier also implies a high ( certified ) robustness at x . Inspired by this , we propose to use the sample-wise confidence ( of smoothed classifiers ) as an efficient proxy of the certified robustness , and defines two new losses , namely bottom-K and worstcase Gaussian training , each of those targets different levels of confidence so that the overall training can be more informed sample-wise for better robustness by preventing low-confident samples from being enforced to increase their robustness . We verify the effectiveness of our proposed method through an extensive comparison with existing robust training methods for smoothed classifiers , including the state-of-the-arts , on a wide range of established benchmarks on MNIST and CIFAR-10 datasets . Our experimental results constantly show that the proposed method can significantly improve the previous state-of-the-art results on certified robustness achievable from a given neural network architecture , by ( a ) maximizing the robust radii of high-confidence samples while ( b ) reducing the risk of deteriorating the accuracy at low-confidence samples . Our extensive ablation study further confirms that each of both proposed components has an individual effect on improving certified robustness , and can effectively control the accuracy-robustness trade-off with the hyperparameter between the two proposed losses . 2 PRELIMINARIES . Adversarial robustness . Consider a labeled dataset D = { ( xi , yi ) } ni=1 from a certain distribution P , where x ∈ Rd and y ∈ Y : = { 1 , · · · , K } , which forms a classification problem with K classes . Let f : Rd → Y be a classifier . Notice that f is a discrete and non-differentiable , so that one can additionally consider a differentiable F : Rd → ∆K−1 to allow a gradient-based optimization assuming f ( x ) : = arg maxk∈Y Fk ( x ) , where ∆ K−1 is probability simplex in RK . The standard framework of empirical risk minimization to optimize f assumes that the samples in D are i.i.d . from P and expect f to perform well given that the future samples also follow the i.i.d . assumption . However , in the context of adversarial robustness ( and for other notions of robustness as well ) , the i.i.d . assumption on the future samples does not hold anymore : instead , it additionally assumes that the samples can be arbitrarily perturbed up to a certain restriction , e.g. , a bounded ` 2-ball , and focuses on the worst-case performance over the perturbed samples . One possible way to quantify this scenario is to consider the average minimum-distance of adversarial perturbation ( MoosaviDezfooli et al. , 2016 ; Carlini & Wagner , 2017 ; Carlini et al. , 2019 ) , namely : R ( f ; P ) : = E ( x , y ) ∼P [ min f ( x′ ) 6=y ||x′ − x||2 ] . ( 1 ) In this respect , we aim to find f that maximizes R ( f ; P ) while maintaining the performance on P . Randomized smoothing . The essential challenge in achieving adversarial robustness in neural networks , however , stems from that directly evaluating ( 1 ) ( and further optimizing it ) is usually computationally infeasible , e.g. , under the standard practice that F is modeled by a complex , highdimensional neural network . Randomized smoothing ( Lecuyer et al. , 2019 ; Cohen et al. , 2019 ) bypasses this difficulty by constructing a new classifier f̂ from f instead of letting f to directly model the robustness : specifically , it transforms the base classifier f with a certain smoothing measure , where in this paper we focus on the case of Gaussian distributions N ( 0 , σ2I ) : f̂ ( x ) : = arg max c∈Y Pδ∼N ( 0 , σ2I ) ( f ( x+ δ ) = c ) . ( 2 ) Then , the robustness of f̂ at ( x , y ) , namely R ( f̂ ; x , y ) , can be explicitly lower-bounded in terms of the certified radius R ( f̂ , x , y ) , e.g. , Cohen et al . ( 2019 ) showed that the following bound holds which is tight for ` 2-adversary , e.g. , it is the optimal for linear classifiers : R ( f̂ ; x , y ) ≥ σ · Φ−1 ( pf ( x , y ) ) = : R ( f̂ , x , y ) ( 3 ) where pf ( x , y ) : = Pδ ( f ( x+ δ ) = y ) , ( 4 ) provided that f̂ ( x ) = y , otherwise R ( f̂ ; x , y ) : = 0.1 Here , we remark that the formula for certified radius ( 3 ) is essentially a function of pf ( 4 ) , which represents the prediction confidence of f̂ at x , or equivalently , the accuracy of f ( x + δ ) over δ ∼ N ( 0 , σ2I ) . In other words , unlike standard neural networks , smoothed classifiers can guarantee a correspondence from prediction confidence to adversarial robustness - which is the key motivation of our method in this paper . Figure 1 plots this relationship shown by Cohen et al . ( 2019 ) as well as by some prior works ( Lecuyer et al. , 2019 ; Li et al. , 2019 ) which also attempt to lower-bound the robustness of smoothed classifiers . 3 CONFIDENCE-AWARE TRAINING FOR RANDOMIZED SMOOTHING . We aim to develop a new training method to maximize the certified robustness of f̂ , considering the trade-off relationship between robustness and accuracy ( Zhang et al. , 2019 ) : even though randomized smoothing can be applied for any classifier f , the actual robustness of f̂ depends how much f classifies well under presence of Gaussian noise , i.e. , by pf ( x , y ) as in ( 3 ) . A simple way to train f for a robust f̂ , therefore , is to minimize the standard cross-entropy loss ( denoted by CE below ) with Gaussian augmentation as in Cohen et al . ( 2019 ) : min F E ( x , y ) ∼P δ∼N ( 0 , σ2I ) [ CE ( F ( x+ δ ) , y ) ] . ( 5 ) In this paper , we extend this basic form of training to incorporate a confidence-aware strategy to decide which noise samples δ ∼ N ( 0 , σ2I ) should be focused on sample-wise during training of f . Recall Figure 1 that plots mappings from the ( smoothed ) confidence pf ( 4 ) to a certified radius , e.g. , those derived by Cohen et al . ( 2019 ) ( at the blue line ) . Ideally , one may wish to obtain a classifier f that achieves pf ( x , y ) ≈ 1 for every ( x , y ) ∼ P to maximize its certified robustness . In practice , however , such a case is highly unlikely , and there usually exists a sample x that pf ( x , y ) should be quite lower than 1 to maintain the discriminativity with other samples : in other words , these 1Φ denotes the cumulative distribution function of the standard normal distribution . samples can be actually “ beneficial ” to be misclassified at some ( hard ) Gaussian noises , otherwise the classifier has to memorize the noises to correctly classify them . On the other hand , for the samples which can indeed achieve pf ( x , y ) ≈ 1 , the current Gaussian training in ( 5 ) may not be able to provide enough samples of δ for x throughout the training , as pf ( x , y ) ≈ 1 implies that f ( x+ δ ) must be correctly classified for “ almost every ” possibility of δ ∼ N ( 0 , σ2I ) . Also , considering that the radius certifiable at x rapidly increases as pf ( x , y ) → 1 as shown in Figure 1 , it is important for an overall robustness of f̂ to increase pf ( x , y ) , especially when it can be close to 1 at the end . In these respects , we propose two different variants of Gaussian training ( 5 ) that address each of the possible cases , i.e. , whether ( a ) pf ( x , y ) < 1 or ( b ) pf ( x , y ) ≈ 1 , namely with ( a ) bottom-K and ( b ) worst-case Gaussian training , respectively . During training , the method first estimates pf ( x , y ) for each sample by simply computing their accuracy over M random samples of δ ∼ N ( 0 , σ2I ) , and applies different forms of loss depending on the value . In the following two sections , i.e. , Section 3.1 and 3.2 , we provide the details on each of the proposed losses , and Section 3.3 describes how to combine the two losses and defines the overall training scheme . 3.1 BOTTOM-K GAUSSIAN TRAINING : LOSS FOR LOW-CONFIDENCE SAMPLES Consider a base classifier f and a training sample ( x , y ) ∈ D , and suppose that pf ( x , y ) = p 1 , e.g. , f̂ has a low-confidence at x . Figure 2 ( a ) visualizes this scenario : in this case , by definition of pf ( x , y ) in ( 4 ) , f ( x + δ ) would be correctly classified to y only with probability p over δ , and this can imply either that ( a ) x + δ has not yet been adequately exposed to f during the training , or ( b ) x+ δ may be indeed hard to be correctly classified for some noise samples δ , so that minimizing the training loss at these noises could harm the classifier . The design goal of our proposed bottom-K Gaussian training is to modify the standard Gaussian training ( 5 ) to reduce the optimization burden from ( b ) while minimally retaining its ability to cover enough noise samples during training for ( a ) . To this end , we first consider M random i.i.d . samples of δ , namely δ1 , δ2 , · · · , δM ∼ N ( 0 , σ2I ) . Then , one can notice that the random variables 1 [ f ( x + δi ) = y ] ’ s are also i.i.d. , each of which follows the Bernoulli distribution of probability p , given that pf ( x , y ) = p. This means that , if the current pf ( x , y ) is the value one attempts to keep instead of further increasing it , the number of noise samples that should be correctly classified , which can be defined as ∑ i 1 [ f ( x + δi ) = y ] , would follow the binomial distribution , namely K ∼ Bin ( M , p ) , and this motivates us to consider the following loss that only minimizes the K-smallest cross-entropy losses out of from M samples : Llow : = 1 M K∑ i=1 CE ( F ( x+ δπ ( i ) ) , y ) , where K ∼ Bin ( M , pf ( x , y ) ) . ( 6 ) Here , π ( i ) denotes the noise index with the i-th smallest loss value in the M samples . Yet , the loss defined in ( 6 ) may not handle the cold-start problem on pf ( x , y ) , e.g. , at the early stage of the training where x + δ has not been adequately exposed to f , so that Llow can be minimized too early with an under-estimated p̂f . We found that , however , a simple trick of clamping K with 1 can bypass the issue : i.e. , we always allow the “ easiest ” noise among the M samples to be fed into f throughout the training . In addition , we also found that it is still beneficial to constrain the samples that are not within K , i.e. , the “ harder ” ones , to ensure that they still have a certain level of confidence for the class y even if they are misclassified : here , as a simple design , we propose to truncate the cross entropy loss with log p0 so that Fy ( x+ δ ) can be at least p0 , e.g. , p0 = 120 as done in our experiments . In these respects , we re-define the loss in ( 6 ) as in the followings : Llow : = 1 M K+∑ i=1 CE ( F ( x+ δπ ( i ) ) , y ) + M∑ i=K++1 [ CE ( F ( x+ δπ ( i ) ) , y ) + log p0 ] + , ( 7 ) where K ∼ Bin ( M , p ) , K+ : = max ( 1 , K ) , [ · ] + : = max ( 0 , · ) , and p0 ∈ ( 0 , 1 ] is a hyperparameter . Note that the loss becomes the standard Gaussian training as p0 → 1 and returns to ( 6 ) as p0 → 0 .

Summary: The paper studies certified robustness via randomized smoothing (RS). RS has a fundamental accuracy and robustness tradeoff. The authors aim to enhance such tradeoff through a sample-wise control of robustness over the training samples. In particular, the authors investigate the correspondence between robustness and prediction confidence of smoothed classifiers and design a new loss function. The proposed method is evaluated on MNIST and CIFAR10.