Adversarial Boot Camp: label free certified robustness in one epoch
Authors: Ryan Campbell
Chris Finlay
Adam M Oberman
Venue:  (2021)
Keywords: machine
learning
adversarial
robustness
neural
networks
image
classification
computer
vision

Abstract: Machine learning models are vulnerable to adversarial attacks.  One approach to addressing this vulnerability is certification, which focuses on models that are guaranteed to be robust for a given perturbation size.  A drawback of recent certified models is that they are stochastic: they require multiple computationally expensive model evaluations with random noise added to a given image. In our work, we present a deterministic certification approach which results in a certifiably robust model. This approach is based on an equivalence between training with a particular regularized loss, and the expected values of Gaussian averages. We achieve certified models on ImageNet-1k by retraining a model with this loss for one epoch without the use of label information.

Under review as a conference paper at ICLR 2021
ADVERSARIAL Boot CAMP: LABEL FREE CERTI- FIED ROBUSTNESS IN ONE EPOCH
Anonymous authors Paper under double-blind review
ABSTRACT
Machine learning models are vulnerable to adversarial attacks. One approach addressing this vulnerability certification, which focuses on models that are guaranteed to be robust for a given perturbation size. A drawback of recent certified models that they are stochastic: they require multiple computationally expensive model evaluations with random noise added a given image. In our work, we present deterministic certification approach which results in certifiably robust model. This approach is based on an equivalence between training with a particular regularized loss, and the expected values of Gaussian averages. We achieve certified models on ImageNet-1kk by retraining a model with this loss for one epoch without the use of label information.
INTRODUCTION
Neural networks very accurate image classification tasks, but they are vulnerable to adversarial perturbations, i.e. small changes to the model input leading to misclassifica- tion (Szegedy al., 2014). Adversarial training (Madry et al., 2018) improves robustness, at the expense of a loss of accuracy on unperturbed images (Zhang et al., 2019). Model certifi- cation (Lécuyer et al., 2019; Raghunathan et al., 2018; Cohen et al., 2019) is complementary approach to adversarial training, which provides a guarantce that model prediction is invariant to perturbations up to a given norm.
Given an input the model f is certified to l2 norm at x if it gives the same classification on f(x + v) for all perturbation y with norm up to r,
arg max f(x v7) = arg max ((x), for all ||ll|2 S
(1)
Cohon et al. (2019) and Salman et al. (2019) certify models by defining "smoothed" model, femooth, which is the expected Gaussian average of our initial model f at given input example x,
pamooth (x) Rs E., [f(x + v))
where the perturbation is sampled from Gaussian, 17 AO0 d²1). Cohen et al. (2019) used a probabilistic argument to show that models defined by (2) can be certified to a given radius by making a large number of stochastic model evaluations. Certified models can classify by first averaging the model, (Salman et al., 2019), or by taking the mode, the most popular classification given by the ensemble (Cohen et al., 2019).
Cohen et al. and Salman et al. approximate the model fsmooth stochastically, using Gaussian ensemble, which consists of evaluating the base model f multiple times on the image perturbed by noise. Like all ensemble models, these stochastic models require multiple inferences, which more costly than performing inference a single time. In addition, these stochastic models require training the base model f from scratch, by exposing it to Gaussian noise, in order to improve the accuracy of famooth Salman et al. (2019) additionally expose the model to adversarial attacks during training. In the case of certified models, there a trade-off between certification and accuracy: the certified models lose accuracy on unperturbed images.

---

Under review as a conference paper at ICLR 2021
100
100
1 certified accuracy (Top-1)
f certified accuracy (Top 5)
00
beseline
beseline
stochastic (Selimen et a
stochastic (Saliaan et
deterinntti (ouns)
determiristi (ours)
0.00
0.05
0.10
0.15
0.20
0.25
0.30
0.0
0.3
04
0.5
0.6
b radius
radius
(a) CTPAR-10 top-1 certified occuracy, 0.10 (b) ImageNet top-5 certifted accumcy, a 0..5
Figure 1: Certified accuracy as a function of lz radius.
In this work, we present a deterministic model fsmooth (x) given by (2). Unlike the stochastic models, we do need to train new model from scratch with Gaussian noise data augmentations, instead,
can fine tune accurate baseline model for one epoch, using loss designed to encourage (2) to hold. The result certified deterministic model which is faster to bruin, and faster to perform inference. In addition, the certification radius for our model is improved, compared to previous work, on both the CIFAR-10 and ImageNet databases, Figure 1. Moreover, the accuracy ImageNet with a Top-5 accuracy of 86.1% for our deterministic model versus 85.3% for Cohen et al. (2019) and 78.8% for Salman et al. (2019).
unperturbed images is improved
To our knowledge, this the first deterministic Gaussian smoothing cortification technique. The main appeal of approach is large decrease in the number of function evaluations for computing certifiably robust models, and a corresponding decrease in compute time al inference. Rather than stochastically sampling many times from Gaussian at inference time, our method is certifiably robust with only a single model query. This greater speed in model evaluation is demonstrated in Table 2. Moreover, the deterministic certified model can be obtained by retraining model for one epoch, without using labels. The speed and flexibility of this method allows it be used to make empirically robust models cortifiably robust. To see this, we test method adversarially trained models from Madry et al. (2018), increasing the certified radius of the adversarially robust model, see Table
Table 1: A comparison robust models. Stochastic smoothing arises from methods like the presented in Cohen (2019) and Salman al. (2019). Adversarial training from Madry al. (2018).
Can be obtained from any pretrained model
Evaluation in one forward pass
Model
Is certified?
Deterministic Smoothing (ours)
Stochastic Smoothing Adversarial Training
X
Table 2: Average classification inference time (seconds)
Model
CIFAR-10
ImageNet-11
CPU
GPU
CPU
GPU
Deterministic (ours)
0.0049
0.0080
0.0615
0.0113
Stochastic (Cohen el. al., 2019)
0.0480
0.0399
0.1631
0.0932
2

---

Under review as a conference paper at ICLR 2021
2 RELATED WORK
The issue of adversarial vulnerability arose in the works of Szegedy et al. (2014) and Goodfellow et al. (2015), and has spawned a vast body of rescarch. The idea of training models to be robust to adversarial attacks was widely popularized in Madry et al. (2018), This method, known as adversarial training, trains a model on images corrupted by gradient- based adversarial attacks, resulting in robust models. In terms of cortification, carly work by Cheng et al. (2017) provided a method of computing maximum perturbation bounds for neural networks, and reduced to solving a mixed integer optimization problem. Weng et al. (2018a) introduced non-trivial robustness bounds for fully connected networks, and provided tight robustness bounds at low computational cost. Weng et al. (2018b) proposed metric that has theoretical grounding based on Lipschitz continuity of the classifier model and is scaleable to seate-of-the-ar ImageNet neural network classifiers. Zhang et al. (2018) proposed general framework to cortify neural networks based on lincar and quadratic bounding tochniques on the activation functions, which is more flexible than its predecessors.
Training a neural network with Gaussian noise has been shown to be equivalent gradient regularivation (Bishop, 1995). This helps improve robust of models; however, recent work has used additive noise during training and evaluation for certification purposes. Lécuyer et al. (2019) first considered adding random Gaussian noise as certifiable defense in method called PirelDP. In their method, they take a known neural network architecture and add layer of random noise to make the model's output random. The expected classification in turn more robust to adversarial perturbations. Furthermore, their defense a certified defense, meaning they provide a lower bound the amount of adversarial perturbations for which their defence will always work. In a following work, Li el al. (2018) provided defence with improved certified robustness. The certification guarantees given in these two papers are loose, meaning the defended model will always be more robust than the certification bound indicates.
In contrast, Cohen et al. (2019) provided defence utilizing randomized Gaussian smoothing that leads to tight robustness guarantees under the & norm. Moreover Cohen al. used Monte Carlo sampling to compute the radius in which a model's prediction is unchanged; we refer to this method RANDOMIZEDSMOOTHING In work building on Cohen al., Salman el al. (2019) developed an adversarial training framework called SMOOTHADV and defined Lipschitz constant of averaged models. Yang et al. (2020) generalize previous randomized smoothing methods by providing robustness guarantees in the lt, l2, and foo norms for smoothing with several non- non-Gaussian distributions.
DETERMINISTIC SMOOTHING
Suppose we are given a dataset consisting of paired samples (x.y) E & x y where is an example with corresponding true classification y. The supervised learning approach trains model f X - Ne which maps images to vector whose length equals the number of classes. Suppose f is the initial model, and let famooth be the averaged model given by equation (2). Cohen et al. (2019) find Gaussian smoothed classification model fsmooth by sampling 77 ~ (0,
independently n times, performing n classifications, and then computing the most popular classification. In the randomized smoothing method, the initial model ʃ is trained on data which is augmented with Gaussian noise to improve accuracy on noisy images.
We take a different approach to Gaussian smoothing. Starting from an accurate pretrained model f, we now discard the training labels, and iteratively retrain new model, fsmooth using a quadratic loss between the model f and the new model's predictions, with an additional gradient regularization term. We have found that discarding the original ono-hot labels and instead using model predictions helps make the model smoother.
To be precise, our new models is a result of minimizing the loss which we call HEATSMOOTH- ING,
a² || Jamoothh (x)
E2 softmax (ssmoot((x)) softmax (f(x)))
(3)
2
3

---

Under review as a conference paper at ICLR 2021
The smoothing achieved by the new models is illustrated schematically in Figure 5.
3.1 RELATED REGULARIZED LOSSES
Gradient regularization is known to be equivalent to Gaussian smoothing (Bishop, 1995; LeCun ct al., 1998). Our deterministic smoothed model arises by training using the HEΛTSMOOTHING loss (3), which is designed to ensure that (2) holds for our model. Our results is related to the carly results on regularized networks (Bishop, 1995; LeCun et al., 1998): that full gradient regularization is equivalent to Gaussian smoothing. Formally this is stated as follows.
Theorem 1. (Bishop, 1995) Training feed-forward newrolneeworkk model using the quadratic (or mean-squared error) loss, with added Gaussian noise of mean and vari- ance o² to the inputs, is equivalent to training with
Ez [I]((x) y/1 [z)))
(4)
up to higher order terms.
The equivalence is normally used to go from models augmented with Gaussian noise to regularized models. In our case, we use the result the other direction: we train a regularized model in order to produce model which is equivalent lo evaluating with noise. In practice, this means that rather than adding noise to regularize models for certifiable robustness, explicitly perform type of gradient regularization, in order to produce model which performs as if Gaussian noise was added. See Figure 4 in Appendix D for an illustration of the effect of this gradient regularization.
The gradient regularization term in the HEATSMOOTHING loss (3), is also related to adversarial training. Tikhonov regularization is used to produced adversarially robust models (Finlay and Oberman, 2019). However in adversarial training, the gradient of the loss is used, rather that the gradient of the full model. Also, our loss does not use information from the true labels. The reason for these differences is due to the fact that we wish to have model that approximates the Gaussian average of our initial model f (see Appendix A). Furthermore, minimizing the gradient-norm of the loss of the output gives us smooth model in all directions, rather than being robust only adversarial perturbations.
3.2 ALGORITHMIC DETAILS
We have found that early on training, the value 1 f f may be far greater than the o" /emoothh (x)1l² term. So we introduced softmax of the vectors in the distance-squared term to reduce the overall magnitude of this term. We perform the training minimization of (3) for one epoch. The pseudo-code for our neural network weight update is given by Algorithm 1
Note that the V fsmooth (x) 2 term in (3) requires the computation of a Jacobian matrix norm. In high dimensions this is computationally expensive. To approximate this term, we make use of the Johnson-Lindee Lindenstrauss lemma (Johnson and Lindenstranss, 1984; Vempala, 2005) followed by the finite difference approximation from Finlay and Oberman (2019).
We are able to approximate V femooth (x))l² by taking the average of the product of the Jacobian matrix and Gaussian noise vectors. Jacobian-vector products can be casily computed via reverse mode automatic differentiation, by moving the noise vector w inside:
w (V)u(z)) V (w v(r))
Further computation expense is reduced by using finite-differences to approximate the norm of the gradient. Once the inite-difference is computed, we detach this term from the automatic differentiation computation graph, further speeding training. More details of our implementation of these approximation techniques, and the definition of the term ğ which is regularization of the gradient, presented in Appendix B.
4

---

Under review as a conference paper at ICLR 2021
Algorithm 1: HRATTMOOTHING Neural Network Weight Update
Input
Minibatch of imput examples (mb)) (x(1) x (Nb))
model v set to "train" mode
Current model f set to "eval" mode
9, standard deviation of Gaussian smoothing
R, number of Gaussian noise replications (default= 10)
6, finite difference step-size (default= 0.1)
Update :eerninggrrte according to pre-defined scheduler.
for i [I,...N6}, do Compute: famooth (z())) fxx(0) E Ne
= || f (x(0) - f(x()))1
11 E
for j (1, x} do
Generate
VNo (w1, (w1,,-.,;,N) WNe), wi, -.,,---;,.. UNe (0,1
Compute the normalized gradient 9 via (18)
Detach r001 from the computation graph
o²
Jj J++ 252 (w (u..fmoont fsmooth (z!()) + +g) fsmooth (x(11))
end
Nb Σ J
J J
end
Updale the weights of by running backpropagation J at the current learning rate.
3.3 THEORETICAL DETAILS
We appeal to partial differential equations (PDE) theory for explaining the equivalence between gradient regularization and Gaussian convolution (averaging) of the model2. The idea is that the gradient term which appears in the loss leads to a smoothing of the new function (model). The fact that the exact form of the smoothing corresponds to Gaussian convolution is mathematical result which can be interpreted probabilistically or using techniques from analysis. Briefly, we detail the link as follows.
Einstein (1906) showed that the function value of an averaged model under Brownian motion related the heat equation (a PDE); the theory of stochastic differential equations makes this rigorous (Karatzas and Shreve, 1998). Moreover, solutions of the heat equation are given by Gaussian convolution with the original model. Crucially, addition solutions of the heat equation can be interpreted as iterations of regularized loss problem (called variational energy) like that of equation 3. The minimizer of this variational energy (3) satisfies an equation which is formally equivalent to the heat equation (Gelfand et al., 2000). Thus, taking these facts togethor, we see that a few steps of the minimization of the loss in (3) yield a model which approximately satisfies the heat equation, and corresponds to a model smoothed by Gaussian convolution. See Figure for an illustration of a few steps of the training procedure. This result. is summarized in the following theorem.
Theorem 2. (Strauss, 2007) Let f be bounded function, Rd, and N (0. Then the following are equivalent:
1. E, If(x + r)), the expected value of Gaussion averages of f x.
2. NO, o²1)) (x), the convolution of f with the density of the NO, o2r) distribu- tion evaluated at x.
Code and links to trained models are posted in Supplemental Materials We sometimes interchange the terms Gaussian averaging and Gaussian convolution; they equivalent, shown in Theorem 2.
5

---

Under review as a conference paper at ICLR 2021
3. The solutions of the heat equation,
8 faz t) = - fz,)ttt
0²
(6)
di
at time = 1, with initial condition f(x, - f(x).
In Appendix A, we use Theorem 2 to show the equivalence of training with noise and iteralively training (3).
To assess how well our model approximales the Gaussian average of the initial model, we compute the certified & radius for averaged models introduced in Cohen et al. (2019). A larger radius implies a better approximation of the Gaussian average of the initial model. We compare our models with stochastically averaged models via certified accuracy- This is the fraction of the test set which a model correctly classifies at a given radius while ignoring abstained classifications. Throughout, we always use the same value for certification as for training. In conjunction with the certification technique of Cohen et al., we also provide the following theorem, which describes bound based on the Lipschitz constant. of Gaussian averaged model. We refer to this bound as the L-bound, which demonstrates the link between Gaussian averaging and adversarial robustness.
Theorem 3 (L-bound). Suppose f fsmooth is the convolution (average) of f R + [0, 1 with a Goussion kernel of variance r²I,
gsmooth (x) (F0 (x)
Then any perturbation 8 which results in a change of rank of the k-th component o famoooh (1)) must have norm bounded as follows:
||ó112 2
ssmooth (1)(x+1))
where fsmooth (z) is the 2th largest value in the vector pamooth (x) E [0,
See Appendix C for proof. This bound is equally applicable to deterministic or stochastically avcraged models. In stochastically averaged models fsmooth(x) is replaced by the stochastic approximation of (Bp=s((....)) [f + 1/)].
3.4 ADVERSARIAL ATTACKS
To test how robust our model is to adversarial examples, we calculate the minimum l adversarial via our L-bound and we attack our models using the projected gradient descent (PGD) (Kurakin et al., 2017; Madry et al., 2018) and decoupled direction and norm (DDN) (Rony et al., 2019) methods. These attacks are chosen because there is specific way they can be applied to stochastically averaged models (Salman et al., 2019). In the lz setting of both attacks, it is standard to take the step
(flx + +
(8)
in the iterative algorithm. Here, x is an input example with corresponding true class y; d, denotes the adversarial perturbation at its current iteration; L denotes the cross-entropy Loss function (or KL. Divergence); e is the maximum perturbation allowed; and a the step-size. In the stochastically averaged model setting, the step is given by
L + 8, + +1).
(9)
Σ L + 6.+
where 77.....7h lid
For our deterministically averaged models, we implement the update (8). This is because models are deterministic, meaning there is no need to sample noise at evaluation time. For stochastically averaged models (Cohen et al., 2019; Salman et al., 2019), implement the update (9).

---

Under review as a conference paper at ICLR 2021
Percent Misclassified (Top-5)
Percent Misclassified (Top-5)
80
80
60
40
40
baseline
20
stochaslic (Cotee el all
20
stocheskk (Cohten el all
stoc hasta (salman al.)
stochastic ISalman al.)
deterministic (ours)
doterministic (ours)
0.0
0.5
1.0
15
2.0
2.5
30
3.5
4.0
0.0
0.5
2.0
1.5
2.0
2.5
distance
1g distance
(a) ImageNel-11 1k top-5 PGD
(b) ImageNNl-116 1k lop-5 DDN
Figure Allack curoes: % of images successfully allacked as function of & adversarial distance.
EXPERIMENTS & RESULTS
We now execute our method on the ImageNet-Ik dataset (Deng et al., 2009) with the ResNet-50 model architecture. The initial model f was trained on clean images for 29 epochs with the cross-cntropy loss function. Due lack of computing resources, we had modify the training procedure (3) and Algorithm 1 to obtain our smoothed model fsmooth, This new training procedure amounts minimizing the loss function
|sootmax (fsmooth (r + 7)) softmax (f(=)) o²
V famooth (x n)llz
(10)
for only 1 epoch of the training set using stochastic gradient descent at a fixed learning rate of 0.01 and with 0.25. This is needed because the output vectors in the ImageNet setting are of length 1,000. Using softmax in the calculation of the & distance metric prevents the metric from dominating the gradient-penaly term and the loss blowing up. Furthermore, we add noise N (0, (2) to half of the training images.
4.1 COMPARISON TO STOCHASTIC METHODS VIA CERTIFIED RADII
We compare our results to a pretrained RANDOMPZEDSMOOTIING ResNet-50 model with 0.25 provided by Cohen et al. (2019). We also compare to pretrained SMOOTHADV ResNet-50 model trained with step PGD and with a maximum perturbation of = 0.5 with 0.25 provided by Salman et al. (2019). To assess certified accuracy, run the CERTIPY algorithm from Cohen et al. (2019) with no = 25, n = 1, 1,000, a 0.25 for the stochastically trained models. We realize that this may not be optimal number of noise samples, but it was the most our computational resources could handle. For the HEATSMOOTHIGG model, we run the same certification algorithm but without running SAMPLINGUNDERNOSS to compute Č.. For completeness, we also certify the baseline model fo. Certification results on 5,000 ImageNet test images are presented in Figure 1b. We see that our model is indeed comparable to the stochastic methods presented in earlier paper, despite the fact that we only needed one training epoch. Note that CIFAR-10 results are presented in Appendix F.
Table 3: ls adversarial distonce metrics on ImageNet 1/
Model
L-bound median
PGD
DDN
mean
median
mean
median
mean
HRATSMOOTHING
0.240
0.190
2.7591
2.6255
1.0664
1.2261
SMOOTHADV
0.160
0.160
3.5643
3.0244
1.1537
1.2850
RANDOMIZEDS MOOTHING
0.200
0.180
2.6787
2.5587
1.2114
1.3412
Undefended baseline
1.0313
1.2832
0.8573
0.9864
7

---

Under review as a conference paper at ICLR 2021
100
100
Determnistic (ours)
Percent agree (Top-1)
Percent agree (Top-1)
80
60
60
40
40
Deterministic (ours)
KL bascline
0.00
0.05
0.10
0.15
0.20
0.25
0.30
0.10
0.20
0.25
0
(a) lop-1 classification agreement between gieen (b) top-1 classification agreement between model and its own stockastic wverage prediction delerministic model and a Cohen al. model prediction for varying ø.
for varying 6.
Figure 3
4.2 COMPARISON TO STOCHASTIC METHODS VIA ADVERSARIAL ATTACKS
Next, we attack our four models using PGD and DDN. For the stochastic models, we do 25 noise samples to compute the loss. We run both attacks with max & perturbation of <= 4.0 until top-5 misclassification achieved or until 20 steps are reached. Results on 1,000 ImageNet test images are presented in Table 3 and Figures 2a and 2b. We see that our model comparable the stochastic models, but docs not outperform them. In Figure 2a, it is clear that the model presented in Salman et al. (2019) performs best, since this model was trained on PGD-corrupled images. Note that CIFAR-10 results are presented in Appendix
4.3 COMPARING MODELS USING THEIR CLASSIFICATIONS
Recall that the goal of this work is to deterministic methods to obtain averaged model equivalent to that of Cohen et al. (2019). One way of mcasuring the similarity is to compare the predictions of both models. To do this, consider pretrained stochastically averaged model with a = 0.25 and our deterministic model trained using (10). We randomly select .000 ImageNet test images and assess the difference between evaluating our model in a single forward pass vs. the stochastic method presented in Cohen et al.. In Figure 3a, we see how often a model's isnge forward pass top-1 prediction matches with predictions of this model using Cohen et al.'s PREDICT algorithm, conditioning on the single forward pass prediction being correct. In Figure 3b, we then see how often our deterministic model agrees with Cohen et al.'s stochastic model's prediction. In these plots, for stochastic prediction, we fix the number of Gaussian replications n = 100. We see that our model's predictions are the same when doing single forward pass and doing a stochastic prediction with high probability. We also see that our model's deterministic predictions match a heghhperformin stochastically averaged model's predictions with high probability.
4.4 CERTIFYING ROBUST MODELS
So far, we have showed that we can take a non-robust baseline model and make il certifiably robust by retraining for one epoch with a regularized loss (10). A natural question arises: can we use this method to make robust models certifiably robust? To test this, we begin with an adversarially trained model (Madry al., 2018). This pretrained model was downloaded from Madry's "Robustness" GitHub repository and was trained with images corrupted by the Le PGD attack with maximum perturbation size = 3.0. We certify this model by retraining it with (10) for one epoch using stochastic gradient descent with fixed learning rate 0.01. In Table 4, we compute the & certified radius from Cohen et al. (2019) for these models using 1,000 ImageNet-lk test images with = 0.25. The certified radii for the model trained with the loss function (10) are significantly higher than those of the adversarially trained model from Madry et al. (2018).
8

---

Under review as a conference paper at ICLR 2021
Table 4: l certified radii summory statistics for robust models ImageNet--l 11k
Model
82 radius mean
median
max.
Certified adverariially trained
0.4226
0.4193
0.6158
Adversarially trained
0.0790
0.1126
0.6158
Undefended baseline
0.0
0.1446
0.6158
CONCLUSION
Randomized smoothing is well-known method to achieve Ganssian average of some initial neural nelwork. This desirable to guarantee that a model's predictions are unchanged given perturbed input data. In this work, used regularized loss to obtain deterministic Gaussian averaged models. By computing & certified radii, we showed that our method is comparable to previously-knowi stochastic methods. This is confirmed by attacking our models, which results in adversarial distances similar to those seen with stochastically smoothed models. We also developed
lower bound perturbations necessary to throw off averaged models, and used as a mcasure model robustness. Lastly, our method is less computationally expensive in terms of inference time (see Table 2).

---

Under review as a conference paper at ICLR 2021
REFERENCES
C. M. Bishop. Training with noise equivalent to Tikhonov regularization. Neural Computation, 7 (1):108-116, 1995. doi: 10.1162/neco. http:/eeco.199...1.11. URL sstpe://doi. sstpe://dol.org/100 www.11111cnooo/e 1995. 708.
C. Cheng, G. Nührenberg, and H. Ruess. Maximum resilience of artificial neural networks. In D. D'Souza and K. N. Kumar, editors, Automated Technology for Verification and Analysis 15th International Symposium, ATVA 2017, Pune, India, October 3-6, 2017, Proceedings, volume 10482 of Lecture Notes in Computer Science, pages 251-268. Springer, 2017. doi: 10.1007/ 978-3-319-68167-22 18. URL httpa: /ttp://doioioo/ org/10. 0000/978-31 1110//78---111111---2-22-
J. M. Cohen, E. Rosenfeld, and J. Z. Kolter. Certified adversarial robustness via randomized smoothing. In K. Chaudhuri and R. Salakhutdinov, editors, Proceedings of the 36th International Conference on Mochine Learning, ICML 2019, 9-15 June 2019, Long Beach, California, USA, volume Proceedings of Machine Learning Research, pages 1310 1320. PMLR, 2019. URL http://proceeding mlr www..preea//e.... v /tt9///oon19.....//// html.
J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, Imagenet: A large-scale hierarchical image database. In 2009 IEFE conference computer vision and pattern recognition, pages 248-255. Teee, 2009.
A. Einstein. On theory of the Brownian movement. Ann. Phys, 19()):371 381, 1906.
C. Finlay and A. M. Oberman. Scaleable input gradient regularization for adversarial robustness. CoRR, abs/1905. 1905. 11468, 2019. URL http://arxiv. wwwp://////////////// 11468.
I. M. Gelfand, R. A. Silverman, et al. Calculus of Varialions. Courier Corporation, 2000.
I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In
Y. Bengio and Y. LeCun, editors, 3rd International Conference Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. URL attp://arke org/ ab//////..//./////////////a////a 1472.6572.
W. B. Johnson and J. Lindenstrauss. Extensions of Lipschitz mappings into a Hilbert space. Contemporary mathematics, 26(1 96(189-206):1 1984.
I. Karatzas and S. E. Shreve. Brownian motion. In Brownian Motion and Stochastic Calculus, pages 47-127. Springer, 1998.
A. Krizhevsky, G. Hinton, et al. Learning multiple layers of features from tiny images. 2009.
A. Kurakin, I. J. Goodfellow, and S. Bengio. Adversarial machine learning at scale. 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.nets 2017. URL https:// htttp:///ppenrviie...t BarunPid=BIm4TKKr..
Y. LeCun, Bottou, Bengio, Haffner, Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278 2324,, 1998.
M. Lécuyer, V. Atlidakis, R. Geambasu, D. Hsu, and S. Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium Securily and Privacy, SP 2019, San Fruncisco, CA, USA, May 19-23, 2019, pages 656 672. IEEE, 2019. doi: 10.1109/SP.2011 00044. URL https://ddo http::////o..////////// 1109/S1..PPP. 2019. 00004..
B. Li, C. Chen, W. Wang, and L. Carin. Second-order adversarial attack and certifiable robustness. CoRR, 0hs//100.03111 13, 2018. URL attt:://arzis wrg. arggaba///ea 1101.00111........111 03113.
A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In 6th International Conference Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30- May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018 URL https: htttps://operreviee http://enrrriieeteteffttoor//// fet./formmiddrraa22ae
A. Raghunathan, J. Steinhardt, and P. Liang. Certified defenses against adversarial examples. In 6th International Conferenee on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30- May 3, 2018, Conference Track Proceedings. OpenRevie,.net, 2018. URL. https://openrevieet www.aa/ww.e...eeeeeora/aaaaaoao.
10

---

Under review as a conference paper at ICLR 2021
Rouy, L. G. Hafemann, L. S. Oliveira, B. Ayed, R. Sabourin, and E. Granger. Decoupling direction and norm for efficient gradient-based L2 adversarial attacks and defenses. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, pages 4322-4330. Com- puter Vision Foundation / IEEE, 2019. doi: http://openacee
URL thecvf. www.tth.hcoccceeweeeee cetevff.co//ooteett...mmm CVPR 2019/htm1 Decouplinn..n Direction. and Lar__Nom___ttt for Efficient_Graddeeeeeeeeeee Gradient- Bareeeent-Based L2 Advereaariil Attacks_ _aiisss__V_______ 2019 parpi_pppperr... html.
Dnccoupling__irrettinn
H. Salman, J. Li, P. Razenshteyn, Zhang, H. Zhang, S. Bubeck, and G. Yang. Prov- ably robust deep learning via adversarially trained smoothed classifiers. In M. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Bue, E. B. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems 82: Annual Conference Neural Information Processing Systems 2019, NewrIPS 2019, 8-14 December 2019, Vancouver, BC, Canada, pages 11289-11300 2019. URL http://papers. nips. ce/paper/ aawaaiindddmooheedee smoothed- classifiers.
adveraarrally -
W. A. Strauss. Partial differential equations: An introduction. John Wiley & Sons, 2007.
C. Szegedy, W. Zaremba, 1. Sutskever, J. Bruna, D. Erhan, 1. Goodfellow, and R. Fergus. Intriguing properties of neural networks. Bengio and Y. LeCun, editors, 2nd International Conference on Learning Representations, TCLR 2014, Banff, A AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL attp://arxiv org/ aws/aa12.... 6199..
S. Vempala. The random projection method, volume 65. American Mathematical Soc., 2005.
T. Weng, H. Zhang, H. Chen, Song, Hsich, Daniel,
Boning, and S. Dhillon. Towards fast computation of certified robustness for relu networks. In G. Dy and A. Krause, editors, Proceedings of the 35th International Conference on Machine Leorning, ICML 2018, Stockholmsmssonn, Stockholm, Sweden, July 10- 15, 2018, volume 80 of Proceedings of Machine wwr.presa/
Learning Research, pages 5273 5282. PMLR, 2018a. URL http://proceetiee weng18a. html.
T. Weng, H. Zhang, P. Chen, J. Yi, Su, Y. Gao, C. Hsieh, and L.. Daniel. Evaluating the robustness of neural networks: extreme value theory approach. 6th International Conference on Learning Representations ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Truck Proceedings. OpenReview net, 2018b. URL /ttps://openrevill www.:eeeffoooo peet/forumm' d--oummi--
G. Yang, T. Duan, J. E. Hu, H. Salman, I. P. Razenshteyn, and J. Li. Randomized smoothing of all shapes and sizes. CoRR, abs/2002.08111 2020. URL https: //arxiv. org/ aa//a/////2/00 2002 08118.
H. Zhang, T. Weng, P. Chen, C. Hsieh, and L. Daniel. Efficient neural network robustness certifica- tion with general activation functions. In S. Bengio, H. M. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, editors, Advances in Neural Information Processing Systems 81: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, 3-8 December 2018, Montréal, Canada, pages 4944-4953, 2018. URL http://paper:: nips cc/paper/ -ff2-efficient wewrciinennnnnnaalleeeeee network cewerrk-ooouuttnsseeeee certification wtw.fiiiiiiiitiitih-ieeeeee-eeee wwwhwwittttthhaattee
functions.
H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. E. Ghaoui, and M. I. Jordan. Theoretically principled trade-off between robustness and accuracy. arXiv preprint ar Xix:1990108800 2019.
11

---

Under review as a conference paper at ICLR 2021
A SOLVING THE HEAT EQUATION BY TRAINING WITH A REGULARIZED LOSS FUNCTION
Theorem tells us that training model with added Gaussian noise equivalent to training model to solve the heat equation. We can discretize the heat equation (6) to obtain
fht
0² A
(11)
for k = O,..., AT -r-- 1, where ny is the fixed number of timesteps, h = 1/nr, and fo = f. our initial model. Notice how, using the Euler- Ealer-Lagrange equation, express fh+ in (11) as the variational problem
(b) gh+ argmin / -
ho?
[V)o(()11) plz)dax
(12)
R2
where is the density from which our clean data comes form. Therefore, this is equivalent to solving
ph+t = argmin Ex [1(ts) ("x))² + 2 [V
ho²
(13)
Note that the minimizer of the objective of (12) satisfies
ho?
f* 2
Ar
(14)
which matches (11) if we set fk+1= fact that empirically, p is approximately uniform and is therefore constant. the end, we iteratively compute (13) and obtain models p"T, setting v f"r, our smoothed model.
v. In the derivation of (14), take for granted the
Something to take note of is that our model outputs be vectors whose length corresponds to the total number of classes; therefore, the objective function in (13) will not be suitable for vector-valued outputs (x) and v(z). We instead use the following update
gk+ = argmin E, [1 ( ( (=)= + ha? [[((())
! (l(())) " 2
(15)
B APPROXIMATING THE GRADIENT-NORM REGULARIZATION TERM
By the Johnson--Lnndesstrad Lemma (Johnson and Lindenstrauss, 1984; Vempala, 2005), ||V [(x)])] has the following approximation,
| [V,o<>)12
V (w, u(x)))1
(16)
(we (x + &gr)) (w) v(z)) 2
8
where
(w:
wik) RR
wy R 10
(17)
VK
and 9: given by
V. (wee(w))
if V (w; v(x)) # otherwise
8. =
(18)
0
In practice, set 8 = 0.1, 10, and K = Nc, the total number of classes.
12

---

Under review as a conference paper at ICLR 2021
C PROOF OF THEOREM 3
Proof. Suppose the loss function E is Lipschitz continuous with respect to model input æ, with Lipschitz constant L. Let to be such that if {(x) < la, the model is always correct. Then by Proposition 2.2 in Finlay and Oberman (2019), lower bound on the minimum magnitude of perturbation å necessary to adversarially perturb an image æ is given by
|0012 max {6o ((x),0)
(19)
By Lemma of Appendix A in Salman et al. (2019); our averaged model
famooth( (x) = (f+ (x)
has Lipschitz constant L V Replacing L in (19) with 1 2/2 and setting to pemooth (x)) ((x)) femooth (x)((++)) gives the proof.
D ILLUSTRATION OF REGULARIZED TRAINING
0.5
*
-0.5
*
-1 -1
-0.5
0.5
Figure Illssratioon of gradient regularization (4) én the binary classification setting. The lighter line represents classification boundary for original model with large gradients, and the darker line represents classification boundary of the smoothed model. The symbols indicate the classification by the original model: a single red circle is very close to many blue stars. The smoothed model has smoother classification boundory which flips the classification of the outlier.
(a) f0
(b) 8z
8d
Figure 5: Illustation of performing the iterative model update (15) for 8 timesteps in the binary classification setting. The dashed black line represents our decision boundary. The blue line represents current classification model. The blue stors and red circles represent our predicted classes using the current model iteration. Consider the datapoint at -0.5. In the initial model fo the adversarial distance is zs 0.10. model f², the adversarial distance is increased to ss 0.35.
13

---

Under review as a conference paper at ICLR 2021
E
RESULTS ON THE CIFAR-10 DATASET
100
100
Percent Misic Misclassifien (Top-1)
Percent Misci lassitisiid (Top-1)
60
60
40
bascline
bascline
stochasti (Cohen
stochastic (Cohen all
stocheskkc (Selman el.)
stochesti [Sallmn el.)
determiniatic (ours)
deterministic (ours)
1.0
2.0
2.5
0.5
1.0
2.0
2.5
distance
fg distance
(a) CIFAR-10 top-1 PGD
(b) CIPAR-10 top-1 DDN
Figure 6: CIFAR-10 ottack curves: % of images successfully attocked as function of &2 adversarial distence.
We test our method on the CIFAR-10 dataset (Krizhevsky et al., 2009) with the ResNet-34 model architecture. The initial model f was trained for 200 epochs with the cross-entropy loss function. Our smoothed model was computed by setting fo to minimize the loss (15) with 0.1 for nr = 5 timesteps al 200 epochs each timestep. The training our smoothed model took 5 times longer than the baseline model. We compare our results to ResNet-33 model trained with 0.1 noisy examples model using RANDOMIZESMMOTHIN (Cohen et al., 2019). We also trained a SMOOTHADV model (Salman et al., 2019) for steps of PGD with the maximum perturbation set to E = 0.5. To assess certified accuracy, we run the CERTIFY algorithm from Cohen et al. (2019) with no 100, 10, 000, a 0.1 for the stochastically trained models. For the HEATSMOOTHING model, we run the same certification algorithm, but without running SAMPLINGU NDERNOISE compute ČĄ. For completeness, we also certify the baseline model fo. Certification plots are presented in Figure 1a. In this plot, we see that our model's l2 certified accuracy outperforms the stochastic models. Next, we attack our four models using PGD and DDN. For the stochastic models, we do 100 noise samples to compute the loss. We run both attacks with 20 steps and maximum perturbation & 4.0 to force top-1 misclassification Results are presented in Table 5 and Figures 6a and 6b. In Table 5, see that HEATŠMOOTHING outperforms the stochastic models terms robustness. The only exception is robustness to mean PGD perturbations. This is shown in Figures 6a. Our model performs well up to an & PGD perturbation just above 1.0.
and running Algorithm 1
stochastically averaged
Table 5: &a adversarial distance metrics on CIFAR- R-10. A larger distance implies a more robust model.
Model
L-bound
PGD
DDN
median
mean
median
mean
median
mean
HRAISMOOTHING
0.094
0.085
0.7736
0.9023
0.5358
0.6361
SMOOTHADV
0.090
0.078
0.7697
1.3241
0.4812
0.6208
BANDOMIZEDSOOOTHIGG
0.087
0.081
0.7425
1.2677
0.4546
0.5558
Undefended baseline
0.7088
0.8390
0.4911
0.5713
14


Reviews:
[{"review_id": "xYMg204ey0J", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Randomized smoothing is the major way to certify the robustness of large scale networks, however, it requires sampling from Gaussian distribution many times, which is not fast enough for real-time inference. This paper uses a regularized loss to get deterministic Gaussian averaged results. This paper points out an interesting direction for certifying robustness, the method is simple and effective.\n\nStrength:\n\n1. The paper is clearly written. \n\n2. It is very interesting to see a method that can certify the robustness without the computational intensive randomized smoothing.\n\n3. The method is simple and effective, does not require much computation resources, which improves the inference speed by around 10 times (Table 2).\n\n4. The speed for randomized smoothing certification is a major concern for the community. This paper address this problem. If this paper is really effective, it can have a broad impact on the research community for robustness certification.\n\nWeakness and Questions:\n\n1. What if the attacker directly attacks the objective function for certification (e.g. equation 2) ? Given that the certification is deterministic, is it possible to fool the certification method?\n\n2. In Figure 2, it seems the deterministic under performs some baselines.", "extra_scores": {}, "extra_text": {}}, {"review_id": "kas_iz80FKJ", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper claims that a (computationally intractable) randomized smoothing of any classifier can be distilled into the (deterministic) classifier itself via fine-tuning it with gradient penalty. This is motivated by a theoretical result that Gaussian smoothing of a classifier is equivalent to solving a certain heat equation, which can be approximated by a regularized loss training. Experimental results use the resulting deterministic classifier to compute the certified radius compared to (stochastic) smoothed classifiers, arguing its efficiency and higher certified radius of the proposed method. \n\nThe relation between randomized smoothing and PDE seems to be an interesting direction to explore. My biggest concern is that, however, whether the proposed deterministic smooth classifier is indeed *certifiably* robust in practice. Apart from its theoretical motivation, I could not find any statistical guarantee that the deterministic smooth classifier is provably close to its stochastic counterpart for every input x, which is essential to claim the certifiable robustness of the proposed model. Otherwise, how one could prove that the deterministic smooth classifier is indeed robust to adversarial examples? - although randomized smoothing may require much more computation time, it at least provides such a statistical yet practical guarantee, namely as the CERTIFY algorithm [1].\n\nAnother possible way to go is to show that the *empirical* robustness of the deterministic smooth classifier is non-trivial. In this context, actually, the message of the paper can be \"very\" surprising (and very unlikely, at the same time): one can robustify any classifier by a single pass of fine-tuning with gradient penalty, even without adversarial training. The paper indeed provide a related result, i.e., empirical test accuracy on adversarial attacks, but the current evaluation is too weak to support the claim: considering a bunch of defense papers that are broken after published [2, 3], it is too hard for me to believe the results as is even it could bear from a specific configuration of PGD and DDN. I would recommend the paper to follow the standard guidelines suggested by [4]. The paper could explore more possible configurations of PGD attacks, or other types of attacks (e.g., gradient-free attacks [5], or black-box attacks), just to name a few.\n\n[1] Cohen et al., Certified Adversarial Robustness via Randomized Smoothing, ICML 2019.\n\n[2] Athalye et al., Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples, ICML 2018.\n\n[3] Tramer et al., On Adaptive Attacks to Adversarial Example Defenses, 2020.\n\n[4] Carlini et al., On Evaluating Adversarial Robustness, 2019.\n\n[5] Uesato et al., Adversarial Risk and the Dangers of Evaluating Against Weak Attacks, ICML 2018.", "extra_scores": {}, "extra_text": {}}, {"review_id": "PYL8Z03dmmy", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes to finetune a pretrained network with a gradient norm regularizer to mimic the Gaussian noise augmentation during training. I have two main concerns about this paper:\n\n1. As claimed by the authors, they are motivated to solve the stochasticity of previous certified defenses like random smoothing. However,  there are mainstream certified training methods that are deterministic during inference (with a single query) [1][2][3][4], but are not discussed or empirically compared in this paper.\n\n2. The proposed regularizer function in Eq.(3) is actually equivalent to L-2 adversarial training, which can be simply proved by a dual norm trick [5]. This makes the results in Table 4 seem counter-intuitive, where a from-scratch L-2 adversarially trained model performs worse than a model finetuned by a similar mechanism. I suggest the authors better explain these both formally and empirically.\n\nMinor:\nIn Sec.4.2, the authors claim that they use the pretrained ImageNet model from Madry GitHub. But as far as I know, there are only pretrained models on MNIST and CIFAR-10 in their repository, could the authors provide an official link to this baseline? \n\n\n\nReference:\n\n[1] Wong et al. Provable defenses against adversarial examples via the convex outer adversarial polytope. ICML 2018\n\n[2] Wong et al. Scaling provable adversarial defenses. NeurIPS 2018\n\n[3] Dvijotham et al. Training verified learners with learned verifiers. arXiv 2018\n\n[4] Dvijotham et al. A dual approach to scalable verification of deep networks. UAI 2018\n\n[5] Simon-Gabriel et al. First-order adversarial vulnerability of neural networks and input dimension. ICML 2019", "extra_scores": {}, "extra_text": {}}, {"review_id": "6I11oU9l_gU", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes to use a deterministic classifier to replace the sampling\nprocess in randomized smoothing based certifiably robust models.  The goal of\ntraining a deterministic robust classifier to avoid the high cost of randomized\nsmoothing is a right direction to look at. \n\nThe reason that we can get certified robustness with Gaussian smoothing is that\nthe smoothed classifier becomes Lipschitz (see Salman et al.). Unfortunately,\nit is a stochastic classifier and typically it is impossible to access the\nsmoothed classifier directly, and that's why in randomized smoothing (e.g.,\nCohen's PREDICT procedure), sampling is necessary.\n\nThe approach in this work is to train a smoothed classifier that essentially\nreturns the same prediction as the mean of the originally stochastic\nclassifier. The authors pointed out the connection between Gaussian smoothed\nclassifier and gradient regularization, so they use gradient regularization to\nobtain the desired deterministic classifier.\n\nUnfortunately, it seems to me that the proposed approach is not sound. With\ngradient regularization, we try to make the learned classifier to be smooth,\nhowever there is no guarantee that such a learned classifier will indeed be\nsmooth and produce the same outcome as the original Gaussian smoothed\nclassifier, so we cannot use the outcome of this classifier to replace Cohen's\nSampleUnderNoise procedure.  More precisely, optimizing the proposed loss\nfunction (3) does not guarantee the learned classifier f^smooth to be Lipschitz,\nwhere the original Gaussian smoothed classifier is guaranteed to be Lipschitz.\nAlthough the loss attempts to do so with gradient regularization, there is no\nguarantee here. So the entire procedure is not certified anymore.\n\nOn the positive side, the proposed method may work as a good empirical defense,\nsince the smoothed classifier can be learned quickly and can be more robust\nthan the original classifier. This may be advantageous for certain applications\nwhere adversarial training is too slow or we don't want to retrain the original\nclassifier.\n\nBecause of the fundamental problem mentioned above, I cannot recommend\nacceptance of this paper. I am willing to discuss with the authors further in\ncase I misunderstand some parts of the paper.\n\n---\n### After rebuttal:\n\nAfter reading the rebuttal, I feel my main concern is still not addressed by the response. The authors agree that they may provide a different kind of guarantee for the certificates as in (Cohen et al., Salman et al.). An empirical comparison between the output of the proposed model and the mean from sampling is not sufficient. We hope the authors can improve on this point and provide formal robustness guarantees like those in (Cohen et al., Salman et al.).\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: Although the connection between randomized smoothing and PDE revealed in this paper is an interesting direction to explore, the method proposed unfortunately is not certified. The method could work as a good empirical defense since the smoothed classifier could be learned more efficiently. 
Decision: Reject