Pretrain-to-Finetune Adversarial Training via Sample-wise Randomized Smoothing

1 INTRODUCTION . The vulnerability of neural networks to adversarial examples has attracted considerable attention in safety-critical scenarios . For example , adding visually indistinguishable perturbations to input images would misguide a deep classifier to make wrong predictions ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ) . Such an intriguing property of neural networks has spawned a lot of works on training robust neural networks and certifying network robustness with theoretical guarantees . Many heuristic defense algorithms have been developed ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Moosavi-Dezfooli et al. , 2016 ; Papernot et al. , 2016 ; Kurakin et al. , 2016 ; Carlini & Wagner , 2017 ; Athalye et al. , 2018 ) , together with many empirically robust models intended to defend certain types of adversarial perturbations . However , there is no theoretical guarantees of robustness for many heuristic defense algorithms and many of them have been broken subsequently by more carefully designed and more powerful attack algorithms ( Athalye et al. , 2018 ) . This motivates the development of certifiably robust classifiers whose outputs are guaranteed to be the same within a lp-ball of certain radius , hence can defend any adversarial pertubation smaller than that radius ( Hein & Andriushchenko , 2017 ; Raghunathan et al. , 2018 ; Wong & Kolter , 2017 ; Gowal et al. , 2018 ; Wong et al. , 2018 ; Zhang et al. , 2018 ; Cohen et al. , 2019 ; Salman et al. , 2019 ) . Recently , Cohen et al . ( 2019 ) utilized a randomized smoothing technique to build robust smoothed classifiers with provable l2-robustness . Specifically , the smoothed classifier outputs the class most likely to be predicted by the base classifier when the input is perturbed by a certain level of Gaussian noise . Building upon this idea , Salman et al . ( 2019 ) combined randomized smoothing with adversarial training and achieved a state-of-the-art provable l2-defense . Both Cohen et al . ( 2019 ) and Salman et al . ( 2019 ) added the same level of Gaussian noise to each sample , and a higher noise level leads to lower accuracy but a larger average robust radius . While it is well known that accuracy and robustness are at odds with each other ( Tsipras et al. , 2018 ) , we find that we can improve both accuracy and robustness via sample-wise randomized smoothing , which assigns different noise levels to different samples . While the above argument seems intuitive , we note that there is a subtle and challenging issue : a close examination of the proof of the randomized smoothing theorem in Cohen et al . ( 2019 ) dictates that we can not assign arbitrary noise level to any test point ; a certain robustness radius around a point can be certified only if all points within the radius are assigned the same Gaussian variance . To address this issue , we divide the input space into “ robust regions ” , and samples in the same region are assigned the same noise level . To certify a sample-wise randomized smoothed model , we make sure that the certified l2-ball is entirely contained by one of the regions , so that the randomized smoothing theorem can be applied to that region . Hence , precisely speaking , in our method , the classification of a testing point depends on which “ robust regions ” it lies in , and hence on other testing points in the test dataset . Hence , we present our results in the transductive setting ( the test dataset is known ) , but our method also works in the setting where the test data points come online in an i.i.d . fashion ( see the detailed discussion in Appendix D ) . Our contributions can be summarized as follows : 1 . We introduce a pretrain-to-finetune framework that first pretrains a model with random noise levels and then further finetunes it with specific selected noise levels , which maximizes the robust radius of each train set sample based on the pretrained model ’ s output . 2 . In transductive setting , we allocate specific robust regions and assign noise levels for test set data using linear programming to get near optimal results . If the test data points come online , we allocate robust regions for them one by one . If the newly test sample falls in an allocated region , then it uses the same noise level . Otherwise , we allocate a brand new region for it . 3 . We conduct a series of experiments on CIFAR-10 and MNIST to evaluate the performance of our method . Comparing with the state-of-the-art algorithms , Smooth-Adv ( Salman et al. , 2019 ) and Macer ( Zhai et al. , 2020 ) , our sample-wise method achieves 40 % improvements on average certified radius on CIFAR-10 and comparable results on MNIST . 2 RELATED WORK . There are a large body of works proposing different adversarial defense algorithms , which can be divided into two categories , empirical defenses and provable defenses , by whether the resulting model achieves certified robustness . Empirical defenses Empirical defenses train classifiers that are robust under specific attacks . Lacking theoretical guarantees , these defenses can usually be broken by stronger attacks . Early defenses added noise to the input sample or features in inference in hopes that the adversarial perturbation would degenerate into random noise which could be easily handled . For example , Papernot et al . ( 2016 ) used a distillation framework to remove the effect of adversarial examples on the model . Guo et al . ( 2017 ) preprocessed the input images before feeding them into the networks , such as JPEG compression . However , Athalye et al . ( 2018 ) found that these empirical defenses could be broken by stronger attacks . So far , adversarial training ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ) , the process of training a model over on-the-fly adversarial examples , has been one of the most powerful empirical defenses . Later directly minimize the classification errors of adversarial examples generated by project gradient descend ( PGD ) which maximize the errors , actually solving a min-max optimization problem . The TRADES technique ( Zhang et al. , 2019 ) improved the results by minimizing a surrogate loss , consisting of the natural error and boundary error , and provided a tight upper bound to the original loss . Though powerful , adversarial training still lacks a certified guarantee . Provable defenses Due to the fact that empirical defenses are only robust to some specific attacks and face potential threats , the focus of the research switches to the certified defenses whose predictions can be proved robust when perturbed within a certain range . Gradually more certified defenses have been proposed recently.Raghunathan et al . ( 2018 ) certified a shallow network based on semidefinite relaxation , Wong & Kolter ( 2017 ) made use of convex outer adversarial polytope based on relu activation function and Zhang et al . ( 2018 ) proposed a solution for general activation function . Though effective , they all rely on the structure of the network . A randomized smoothing classifier ( Cohen et al. , 2019 ) is a certified robust classifier independent of the structure of the network and only relies on the prediction of the base classifier . In fact , it is a virtual classifier and its prediction is generated from the prediction of the base classifier . Then Salman et al . ( 2019 ) proposed Smooth-Adv which can directly attack the virtual classifier and promoted performance with a large margin . Based on these , we propose sample-wise randomized smoothing to improve certified robustness further . 3 PRELIMINARIES . 3.1 NOTATION . We study the task of image classification . Every image is represented by x ∈ X and X stands for the image space [ 0 , 1 ] h×w×c , where h , w , c represent the height , width and depth of the picture respectively . For a classification task of k classes , we intend to build a classifier f : X → Y = { 0 , 1 , ... , k − 1 } . For a neural network , fθ ( x ) represents the prediction of the sample x and variable θ represents the parameters of the neural network . fθ predicts the class that achieves the maximum value at the last layer of the network . 3.2 ADVERSARIAL EXAMPLES . Given a classifier fθ and an input-label pair ( x , y ) , we say that x′ is an adversarial example to x if D ( x , x′ ) < , fθ ( x ) = y and fθ ( x′ ) 6= y . The attack algorithm seeks for any different prediction result in the -ball centered at x ( i.e. , { x′ | D ( x , x′ ) < } ) . D ( · , · ) can represent different distance metric such as l2 and l∞ metric . We only focus on l2 distance in this paper and we use D ( · , · ) to denote the l2 distance . For empirical defenses , researchers have built heuristic robust classifiers so that specific attack algorithms can hardly find adversarial examples x′ around x . For certified defenses , they build certified robust classifiers gθ and look for the maximum value of with which for any perturbation δ such that D ( x+ δ , x ) < , one can rigorously prove that gθ ( x+ δ ) = gθ ( x ) . Such is also called the robustness radius about x . 3.3 RANDOMIZED SMOOTHING . The randomized smoothing method ( Cohen et al. , 2019 ) is a powerful defense framework and can be applied to any classification model . Suppose fθ is the base model . The smoothed model gθ ( x , σ ) predicts the category c most likely to be predicted by fθ when the input is sampled from a Gaussian distribution N ( x , σ2I ) , where σ is a carefully chosen standard deviation . Formally , gθ is defined as follows : gθ ( x , σ ) = arg max c∈Y P ( fθ ( x+ η ) = c ) where η ∼ N ( 0 , σ2I ) ( 1 ) Cohen et al . ( 2019 ) proved that gθ is provably robust to adversarial perturbations under the l2 norm constraint . Define cA = arg maxc P ( fθ ( x + η ) = c ) , pA = P ( fθ ( x + η ) = cA ) and pB = maxc6=cAP ( fθ ( x+η ) = c ) . We can prove that gθ always predicts cA in { z ∈ X : D ( z , x ) < r } , where the robust radius r is given by the following formula : r = R ( fθ , σ , x ) = σ 2 ( Φ−1 ( pA ) − Φ−1 ( pB ) ) ( 2 ) where Φ−1 is the inverse of the standard Gaussian CDF . This theorem ( called the randomized smoothing theorem ) implies that gθ is provably l2-robust at x if it predicts the label of x correctly . To train provably robust models , Cohen et al . ( 2019 ) proposed to train and certify the model with the same noise level , exactly the same standard deviation . Furthermore , ( Salman et al. , 2019 ) equipped randomized smoothing with adversarial training , and proposed an attack algorithm , called Smooth-Adv . By randomly sampling multiple Gaussian noise around each sample during the training procedure , the algorithm directly estimates gθ and seeks for adversarial examples for gθ . The attack algorithm is shown in Eq . ( 3 ) and LCE represents the cross entropy loss . x′ = arg max D ( x′ , x ) < LCE ( gθ ( x′ , σ ) , y ) = arg max D ( x′ , x ) < ( − log ( 1 m m∑ i=1 fθ ( x ′ + ηi ) y ) ) ( 3 ) Though heuristic for adversarial training , combining with randomized smoothing and directly optimizing gθ has greatly improve the certifiable robustness . Based on Smooth-Adv , we apply sample-wise randomized smoothing to further improve the defense .

Summary: This paper suggests an extension of randomized smoothing, wherein the degree of smoothing is optimized both at training and test-time on each individual sample. At training time, the model is first "pre-trained" using a range of smoothing parameters (variance of the Gaussian perturbations), and then "fine-tuned" by selecting the variance on each sample which maximizes the verified radius. At test time, we can again select the smoothing parameter to maximize robustness.