Confidence-aware Training of Smoothed Classifiers for Certified Robustness

1 INTRODUCTION . Despite these tremendous advances in deep neural networks for a variety of tasks towards artificial intelligence , e.g. , visual recognition ( He et al. , 2016 ; Chen et al. , 2020 ) , natural language processing ( Vaswani et al. , 2017 ; Brown et al. , 2020 ) , and reinforcement learning ( Silver et al. , 2017 ; Vinyals et al. , 2019 ) , the broad existence of adversarial examples ( Szegedy et al. , 2014 ) is still one of the most significant aspects that reveals the gap between machine learning systems and humans : for a given input x ( e.g. , an image ) to a classifier f , say a neural network , f often permits a perturbation δ that completely flips the prediction f ( x+ δ ) , while δ is too small to change the semantic in x . In response to this vulnerability , there have been significant efforts in building robust neural network based classifiers against adversarial examples , either in forms of empirical defenses ( Athalye et al. , 2018 ; Carlini et al. , 2019 ; Tramer et al. , 2020 ) , which are largely based on adversarial training ( Madry et al. , 2018 ; Zhang et al. , 2019 ; Wang et al. , 2020 ; Zhang et al. , 2020b ; Wu et al. , 2020 ) , or certified defenses ( Wong & Kolter , 2018 ; Xiao et al. , 2019 ; Cohen et al. , 2019 ; Zhang et al. , 2020a ) , depending on whether the robustness claim can be theoretically guaranteed or not . Randomized smoothing ( Lecuyer et al. , 2019 ; Cohen et al. , 2019 ) , our focus in this paper , is currently a prominent approach in the context of certified defense , thanks to its scalability to arbitrary neural network architectures while previous methods have been mostly limited in network sizes or require strong assumptions on their architectures : specifically , for a given classifier f , it constructs a new classifier f̂ , where f̂ ( x ) is defined to be the class that f ( x + δ ) outputs most likely over δ ∼ N ( 0 , σ2I ) , i.e. , the Gaussian noise . Then , it is shown by Lecuyer et al . ( 2019 ) that f̂ is certifiably robust in ` 2-norm , and Cohen et al . ( 2019 ) further tightened the ` 2-robustness guarantee which is currently considered as the state-of-the-art in certified defense . However , even with recent methods for adversarial defense , including randomized smoothing , the trade-off between robustness and accuracy ( Tsipras et al. , 2019 ; Zhang et al. , 2019 ) has been well evidenced , i.e. , increasing the robustness for a specific input can be at the expense of decreased accuracy for other inputs . For instance , with the current best practices , Salman et al . ( 2020 ) report that the accuracy of ResNet-50 on ImageNet degrades , e.g. , 75.8 % → 63.9 % , by an ` ∞-adversarial training , i.e. , optimizing the classifier to ensure robustness at all the given training samples around an ` ∞-ball ( of size 4255 ) . In addition , Zhang et al . ( 2019 ) have shown that the ( empirical ) robustness of a classifier can be further boosted in training by paying more expense in accuracy . A similar trend can be also observed with certified defenses , e.g. , randomized smoothing , as the clean accuracy of smoothed classifiers are usually less than those one can obtain from the standard training on the same architecture ( Cohen et al. , 2019 ) . Contribution . In this paper , we develop a novel training method for randomized smoothing , coined Confidence-Aware Training for Randomized Smoothing ( CAT-RS ) , which incorporates a sample-wise control of target robustness on-the-fly motivated by the accuracy-robustness trade-off in smoothed classifiers . Intuitively , a natural approach one can consider in response to the trade-off in robust training is to appropriately lower the robustness requirement for “ hard-to-classify ” samples while maintaining those for the remaining ( “ easier ” ) samples : here , the challenges are ( a ) which samples we should choose for it during training and ( b ) how to control their target robustness . To implement this idea , we focus on the direct correspondence from prediction confidence to adversarial robustness that smoothed classifiers offer : due to its local-Lipschitzness ( Salman et al. , 2019 ) , achieving a high confidence at x from a smoothed classifier also implies a high ( certified ) robustness at x . Inspired by this , we propose to use the sample-wise confidence ( of smoothed classifiers ) as an efficient proxy of the certified robustness , and defines two new losses , namely bottom-K and worstcase Gaussian training , each of those targets different levels of confidence so that the overall training can be more informed sample-wise for better robustness by preventing low-confident samples from being enforced to increase their robustness . We verify the effectiveness of our proposed method through an extensive comparison with existing robust training methods for smoothed classifiers , including the state-of-the-arts , on a wide range of established benchmarks on MNIST and CIFAR-10 datasets . Our experimental results constantly show that the proposed method can significantly improve the previous state-of-the-art results on certified robustness achievable from a given neural network architecture , by ( a ) maximizing the robust radii of high-confidence samples while ( b ) reducing the risk of deteriorating the accuracy at low-confidence samples . Our extensive ablation study further confirms that each of both proposed components has an individual effect on improving certified robustness , and can effectively control the accuracy-robustness trade-off with the hyperparameter between the two proposed losses . 2 PRELIMINARIES . Adversarial robustness . Consider a labeled dataset D = { ( xi , yi ) } ni=1 from a certain distribution P , where x ∈ Rd and y ∈ Y : = { 1 , · · · , K } , which forms a classification problem with K classes . Let f : Rd → Y be a classifier . Notice that f is a discrete and non-differentiable , so that one can additionally consider a differentiable F : Rd → ∆K−1 to allow a gradient-based optimization assuming f ( x ) : = arg maxk∈Y Fk ( x ) , where ∆ K−1 is probability simplex in RK . The standard framework of empirical risk minimization to optimize f assumes that the samples in D are i.i.d . from P and expect f to perform well given that the future samples also follow the i.i.d . assumption . However , in the context of adversarial robustness ( and for other notions of robustness as well ) , the i.i.d . assumption on the future samples does not hold anymore : instead , it additionally assumes that the samples can be arbitrarily perturbed up to a certain restriction , e.g. , a bounded ` 2-ball , and focuses on the worst-case performance over the perturbed samples . One possible way to quantify this scenario is to consider the average minimum-distance of adversarial perturbation ( MoosaviDezfooli et al. , 2016 ; Carlini & Wagner , 2017 ; Carlini et al. , 2019 ) , namely : R ( f ; P ) : = E ( x , y ) ∼P [ min f ( x′ ) 6=y ||x′ − x||2 ] . ( 1 ) In this respect , we aim to find f that maximizes R ( f ; P ) while maintaining the performance on P . Randomized smoothing . The essential challenge in achieving adversarial robustness in neural networks , however , stems from that directly evaluating ( 1 ) ( and further optimizing it ) is usually computationally infeasible , e.g. , under the standard practice that F is modeled by a complex , highdimensional neural network . Randomized smoothing ( Lecuyer et al. , 2019 ; Cohen et al. , 2019 ) bypasses this difficulty by constructing a new classifier f̂ from f instead of letting f to directly model the robustness : specifically , it transforms the base classifier f with a certain smoothing measure , where in this paper we focus on the case of Gaussian distributions N ( 0 , σ2I ) : f̂ ( x ) : = arg max c∈Y Pδ∼N ( 0 , σ2I ) ( f ( x+ δ ) = c ) . ( 2 ) Then , the robustness of f̂ at ( x , y ) , namely R ( f̂ ; x , y ) , can be explicitly lower-bounded in terms of the certified radius R ( f̂ , x , y ) , e.g. , Cohen et al . ( 2019 ) showed that the following bound holds which is tight for ` 2-adversary , e.g. , it is the optimal for linear classifiers : R ( f̂ ; x , y ) ≥ σ · Φ−1 ( pf ( x , y ) ) = : R ( f̂ , x , y ) ( 3 ) where pf ( x , y ) : = Pδ ( f ( x+ δ ) = y ) , ( 4 ) provided that f̂ ( x ) = y , otherwise R ( f̂ ; x , y ) : = 0.1 Here , we remark that the formula for certified radius ( 3 ) is essentially a function of pf ( 4 ) , which represents the prediction confidence of f̂ at x , or equivalently , the accuracy of f ( x + δ ) over δ ∼ N ( 0 , σ2I ) . In other words , unlike standard neural networks , smoothed classifiers can guarantee a correspondence from prediction confidence to adversarial robustness - which is the key motivation of our method in this paper . Figure 1 plots this relationship shown by Cohen et al . ( 2019 ) as well as by some prior works ( Lecuyer et al. , 2019 ; Li et al. , 2019 ) which also attempt to lower-bound the robustness of smoothed classifiers . 3 CONFIDENCE-AWARE TRAINING FOR RANDOMIZED SMOOTHING . We aim to develop a new training method to maximize the certified robustness of f̂ , considering the trade-off relationship between robustness and accuracy ( Zhang et al. , 2019 ) : even though randomized smoothing can be applied for any classifier f , the actual robustness of f̂ depends how much f classifies well under presence of Gaussian noise , i.e. , by pf ( x , y ) as in ( 3 ) . A simple way to train f for a robust f̂ , therefore , is to minimize the standard cross-entropy loss ( denoted by CE below ) with Gaussian augmentation as in Cohen et al . ( 2019 ) : min F E ( x , y ) ∼P δ∼N ( 0 , σ2I ) [ CE ( F ( x+ δ ) , y ) ] . ( 5 ) In this paper , we extend this basic form of training to incorporate a confidence-aware strategy to decide which noise samples δ ∼ N ( 0 , σ2I ) should be focused on sample-wise during training of f . Recall Figure 1 that plots mappings from the ( smoothed ) confidence pf ( 4 ) to a certified radius , e.g. , those derived by Cohen et al . ( 2019 ) ( at the blue line ) . Ideally , one may wish to obtain a classifier f that achieves pf ( x , y ) ≈ 1 for every ( x , y ) ∼ P to maximize its certified robustness . In practice , however , such a case is highly unlikely , and there usually exists a sample x that pf ( x , y ) should be quite lower than 1 to maintain the discriminativity with other samples : in other words , these 1Φ denotes the cumulative distribution function of the standard normal distribution . samples can be actually “ beneficial ” to be misclassified at some ( hard ) Gaussian noises , otherwise the classifier has to memorize the noises to correctly classify them . On the other hand , for the samples which can indeed achieve pf ( x , y ) ≈ 1 , the current Gaussian training in ( 5 ) may not be able to provide enough samples of δ for x throughout the training , as pf ( x , y ) ≈ 1 implies that f ( x+ δ ) must be correctly classified for “ almost every ” possibility of δ ∼ N ( 0 , σ2I ) . Also , considering that the radius certifiable at x rapidly increases as pf ( x , y ) → 1 as shown in Figure 1 , it is important for an overall robustness of f̂ to increase pf ( x , y ) , especially when it can be close to 1 at the end . In these respects , we propose two different variants of Gaussian training ( 5 ) that address each of the possible cases , i.e. , whether ( a ) pf ( x , y ) < 1 or ( b ) pf ( x , y ) ≈ 1 , namely with ( a ) bottom-K and ( b ) worst-case Gaussian training , respectively . During training , the method first estimates pf ( x , y ) for each sample by simply computing their accuracy over M random samples of δ ∼ N ( 0 , σ2I ) , and applies different forms of loss depending on the value . In the following two sections , i.e. , Section 3.1 and 3.2 , we provide the details on each of the proposed losses , and Section 3.3 describes how to combine the two losses and defines the overall training scheme . 3.1 BOTTOM-K GAUSSIAN TRAINING : LOSS FOR LOW-CONFIDENCE SAMPLES Consider a base classifier f and a training sample ( x , y ) ∈ D , and suppose that pf ( x , y ) = p 1 , e.g. , f̂ has a low-confidence at x . Figure 2 ( a ) visualizes this scenario : in this case , by definition of pf ( x , y ) in ( 4 ) , f ( x + δ ) would be correctly classified to y only with probability p over δ , and this can imply either that ( a ) x + δ has not yet been adequately exposed to f during the training , or ( b ) x+ δ may be indeed hard to be correctly classified for some noise samples δ , so that minimizing the training loss at these noises could harm the classifier . The design goal of our proposed bottom-K Gaussian training is to modify the standard Gaussian training ( 5 ) to reduce the optimization burden from ( b ) while minimally retaining its ability to cover enough noise samples during training for ( a ) . To this end , we first consider M random i.i.d . samples of δ , namely δ1 , δ2 , · · · , δM ∼ N ( 0 , σ2I ) . Then , one can notice that the random variables 1 [ f ( x + δi ) = y ] ’ s are also i.i.d. , each of which follows the Bernoulli distribution of probability p , given that pf ( x , y ) = p. This means that , if the current pf ( x , y ) is the value one attempts to keep instead of further increasing it , the number of noise samples that should be correctly classified , which can be defined as ∑ i 1 [ f ( x + δi ) = y ] , would follow the binomial distribution , namely K ∼ Bin ( M , p ) , and this motivates us to consider the following loss that only minimizes the K-smallest cross-entropy losses out of from M samples : Llow : = 1 M K∑ i=1 CE ( F ( x+ δπ ( i ) ) , y ) , where K ∼ Bin ( M , pf ( x , y ) ) . ( 6 ) Here , π ( i ) denotes the noise index with the i-th smallest loss value in the M samples . Yet , the loss defined in ( 6 ) may not handle the cold-start problem on pf ( x , y ) , e.g. , at the early stage of the training where x + δ has not been adequately exposed to f , so that Llow can be minimized too early with an under-estimated p̂f . We found that , however , a simple trick of clamping K with 1 can bypass the issue : i.e. , we always allow the “ easiest ” noise among the M samples to be fed into f throughout the training . In addition , we also found that it is still beneficial to constrain the samples that are not within K , i.e. , the “ harder ” ones , to ensure that they still have a certain level of confidence for the class y even if they are misclassified : here , as a simple design , we propose to truncate the cross entropy loss with log p0 so that Fy ( x+ δ ) can be at least p0 , e.g. , p0 = 120 as done in our experiments . In these respects , we re-define the loss in ( 6 ) as in the followings : Llow : = 1 M K+∑ i=1 CE ( F ( x+ δπ ( i ) ) , y ) + M∑ i=K++1 [ CE ( F ( x+ δπ ( i ) ) , y ) + log p0 ] + , ( 7 ) where K ∼ Bin ( M , p ) , K+ : = max ( 1 , K ) , [ · ] + : = max ( 0 , · ) , and p0 ∈ ( 0 , 1 ] is a hyperparameter . Note that the loss becomes the standard Gaussian training as p0 → 1 and returns to ( 6 ) as p0 → 0 .

Summary: This paper proposes CAT-RS which combines two novel losses for training base classifiers for randomized smoothing. The two novel losses aim at preserving clean accuracy for hard samples and improving the certified radius for easy samples. In term of ACR (average certified radius), the method achieves state-of-the-art on MNIST and CIFAR-10.