Pretrain-to-Finetune Adversarial Training via Sample-wise Randomized Smoothing
Authors: Lei Wang
Runtian Zhai
Di He
Liwei Wang
Li Jian
Venue:  (2021)
Keywords: Adversarial Robustness
Provable Adversarial Defense
Sample-wise Randomized Smoothing.

Abstract: Developing certified models that can provably defense adversarial perturbations is important in machine learning security. Recently, randomized smoothing, combined with other techniques (Cohen et al., 2019; Salman et al., 2019),  has been shown to be an effective method to certify models under $l_2$ perturbations.  Existing work for certifying $l_2$ perturbations added the same level of Gaussian noise to each sample. The noise level determines the trade-off between the test accuracy and the average certified robust radius. We propose to further improve the defense via sample-wise randomized smoothing, which assigns different noise levels to different samples. Specifically, we propose a pretrain-to-finetune framework that first pretrains a model and then adjusts the noise levels for higher performance based on the model’s outputs. For certification, we carefully allocate specific robust regions for each test sample. We perform extensive experiments on CIFAR-10 and MNIST datasets and the experimental results demonstrate that our method can achieve better accuracy-robustness trade-off in the transductive setting.

Under review as a conference paper at ICLR 2021
PRETRAIN-TO-FINETUNE ADVERSARIAL TRAINING VIA SAMPLE-WISE RANDOMIZED SMOOTHING
Anonymous authors Paper under double-blind review
ABSTRACT
Developing certified models that can provably defense adversarial perturbations is important in machine learning security. Recently, randomized smoothing, com- bined with other techniques (Cohen et al. 2019; Salman et al. 2019), has been shown to be an effective method to certify models under 12 perturbations. Existing work for certifying l2 perturbations added the same level of Gaussian noise to each sample. The noise level determines the trade-off between the test accuracy and the average certified robust radius. We propose to further improve the defense via sample-wise randomized smoothing, which assigns different noise levels to different samples. Specifically, we propose pretrain-to- to-tittuneeee framework that first pretrains a model and then adjusts the noise levels for higher performance based the model's outputs. For certification, we carefully allocate specific robust regions for each test sample. We perform extensive experiments on CIFAR- 10 and MNIST datasets and the experimental results demonstrate that our method can achieve better accuracy-robustnes trade-off in the transductive setting.
INTRODUCTION
The vulnerability of neural networks to adversarial examples has attracted considerable attention in safety-critical scenarios. For example, adding visually indistinguishable perturbations input images would misguide deep classifier to make wrong predictions (Szegedy et al.) 2013] Goodfellow et al. 2014). Such an intriguing property of neural networks has spawned a lot of works on training robust neural networks and certifying network robustness with theoretical guarantees.
Many heuristic defense algorithms have been developed (Szegedy et al. 2013
Goodfellow et al.
2014
Moosavi-Dezfooll et al.) [016]] Papernot et al.) 2016, Kurakin et al. 2016 Carlini & Wagner
Athalye al. 2018)) together with many empirically robust models intended to defend certain types of adversarial perturbations. However, there is no theoretical guarantees of robustness for many heuristic defense algorithms and many them have been broken subsequently by more carefully designed and more powerful attack algorithms (Athalye et al. 2018). This motivates the development of certifiably robust classifiers whose outputs are guaranteed to be the same within a -ball of certain radius, hence can defend any adversarial pertubation smaller than that radius (Hein & Andriushchenko 2017 Raghunathan et al. 2018 Wong & Kolter 2017 Gowal et al.) 2018 Wong et al. 2018 Zhang
2017
al. 2018 Cohen et al.
2019 Salman et al. 2019).
Recently, Cohen et al. (0119) utilized randomized smoothing technique to build robust smoothed classifiers with provable la lg-robustness. Specifically, the smoothed classifier outputs the class most likely to be predicted by the base classifier when the input is perturbed by a certain level of Gaussian noise. Building upon this idea, (Saama et al. (2019) combined randomized smoothing with adversarial training and achieved a state-of-the-at provable 12-defense. Both Cohen et al. (2019) and (Saman al. (2019) added the same level of Gaussian noise to each sample, and a higher noise level leads to lower accuracy but larger average robust radius. While it is well known that accuracy and robustness are at odds with each other (Tsipras et al. 20188), we find that we can improve both accuracy and robustness via sample-wise randomized smoothing, which assigns different noise levels to different samples. While the above argument seems intuitive, we note that there is a subtle and challenging issue: close examination of the proof of the randomized smoothing theorem in Cohen et al. (2019) dictates that we cannot assign arbitrary noise level to any test point; certain robustness radius around point can be certified only if all points within the radius assigned the same Gaussian variance. To

---

Under review as a conference paper at ICLR 2021
address this issue, divide the input space into "robust regions", and samples in the same region assigned the same noise level. To certify a sample-wise randomized smoothed model, we make sure that the certified (z-ball is entirely contained by one of the regions, so that the randomized smoothing theorem can be applied to that region. Hence, precisely speaking, in our method, the classification of which "robust regions" it lies in, and hence on other testing points in the
testing point depends test dataset. Hence, we present our results in the transductive setting (the test dataset is known), but our method also works in the setting where the test data points come online in i.i.d. fashion (see the detailed discussion in Appendix D).
Our contributions can be summarized as follows:
We introduce a pretrain-to cetrainnto-finetum framework that first pretrains a model with random noise levels and then further finetunes it with specific selected noise levels, which maximizes the robust radius of each train set sample based on the pretrained model's output.
2. In transductive setting, we allocate specific robust regions and assign noise levels for test set data using linear programming to get near optimal results. If the test data points come online, we allocate robust regions for them one by one. If the newly test sample falls in an allocated region, then it uses the same noise level. Otherwise, we allocate brand new region for it.
3. We conduct series of experiments CIFAR-10 and MNIST to evaluate the performance of our method. Comparing with the state-of-the-art algorithms, Smooth-Ady (Salman et al.) 2019 and Macer (Zhai al. 2020 our sample-wise method achieves 40% improvements on average certified radius on CIFAR-10 10 and comparable results on MNIST.
2 RELATED WORK
There are large body of works proposing different adversarial defense algorithms, which can be divided into two categories, empirical defenses and provable defenses, by whether the resulting model achieves certified robustness.
Empirical defenses Empirical defenses train classifiers that are robust under specific attacks. Lacking theoretical guarantees, these defenses can usually be broken by stronger attacks. Early defenses added noise to the input sample or features in inference in hopes that the adversarial perturbation would degenerate into random noise which could be easily handled. For example, Papernot et al. (2016) used distillation framework to remove the effect of adversarial examples on the model. Guo et al. (2017) preprocessed the input images before feeding them into the networks, such JPEG compression. However, /Athalye et al. 2018 found that these empirical defenses could be broken by stronger attacks.
So far, adversarial training (Goodfellow et al. 2014 Madry et al. 2017), the process of training model over on-the-fly adversarial examples, has been one of the most powerful empirical defenses. Later directly minimize the classification errors of adversarial examples generated by project gradient descend (PGD) which maximize the errors, actually solving min-max optimization problem. The TRADES technique (Zhang et al. 2019) improved the results by minimizing surrogate loss, consisting of the natural error and boundary error, and provided a tight upper bound to the original loss. Though powerful, adversarial training still lacks a certified guarantee.
Provable defenses Due to the fact that empirical defenses are only robust to some specific attacks and face potential threats, the focus the research switches to the certified defenses whose predictions can be proved robust when perturbed within certain range. Gradually more certified defenses have been proposed recently Raghunathan et al. (2018) certified a shallow network based on semidefinite recendlyRaghunathan
relaxation, WWogg & Kolter (2017) made activation function and Zhang et al. (2018) proposed a solution for general activation function. Though effective, they all rely the structure of the network.
of convex outer adversarial polytope based relu
randomized smoothing classifier (Cohen et al. 2019) is a certified robust classifier independent of the structure of the network and only relies the prediction of the base classifier. In fact, it is virtual classifier and its prediction is generated from the prediction of the base classifier. Then (Samann et al. 2019) proposed Smooth-Ady which can directly attack the virtual classifier and promoted
2

---

Under review as a conference paper at ICLR 2021
sample-wise wise randomized smoothing to performance with large margin. Based on these, we propose sample- improve certified robustness further.
PRELIMINARIES
3.1 NOTATION
We study the task of image classification. Every image is represented by X' and X stands for the image space [0, 1j4xwxc, where h, w. c represent the height, width and depth of the picture respectively. For classification task of k classes, (0, 10..,..,K k k- --- }.. For a neural network, So (x) represents the prediction of the sample x and variable represents the parameters of the neural network. fo predicts the class that achieves the maximum value at the last layer of the network.
intend build classifier
X
3.2 ADVERSARIAL EXAMPLES
Given a classifier fo and an input-label pair (at, y), we say that x' an adversarial example to D(x, x') < c, fo(x)) = y and fo(x') * The attack algorithm seeks for any different prediction result in the e-ball centered at x (i.e., {a') D(2, x²) < e)). D(.-) can represent different distance metric such as (2 and 6. metric. We only focus on l2 distance in this paper and use D(.,) to denote the l2 distance. For empirical defenses, researchers have built heuristic robust classifiers that specific attack algorithms can hardly find adversarial examples x' around For certified defenses, they build certified robust classifiers and look for the maximum value with which for any perturbation ō such that ((x 5, < e, rigorously prove that go (x: 5) () Such is also called the robustness radius about T.
3.3 RANDOMIZED SMOOTHING
The randomized smoothing method (Cohen al., 2019) powerful defense framework and can be applied to any classification model. Suppose To is the base model. The smoothed model go a) predicts the category e most likely be predicted by so when the input is sampled from a Gaussian distribution N (xx d²1)) I), where is carefully chosen standard deviation. Formally, ge is defined as follows:
go (2 0) arg argmax P(fo(z c) eEy
where ~ ~~0,00
Cohen et al. (019)) proved that ge is provably robust to adversarial perturbations under the l2 norm constraint. Define ca = arg max, P(fo( + 1) = c), PA P(fo(x + 1) = CA) and PB maxeste, (( = c). We can prove that go always predicts in E X D(2,ar) < <r), where the robust radius r given by the following formula:
r=
+ (pa)) - -p-(pp))
(2)
where --1 is the inverse of the standard Gaussian CDF. This theorem (called the randomized smoothing theorem) implies that gs is provably fo-robust if it predicts the label of x correctly.
To train provably robust models,(Cofee et al. (2019) proposed to train and certify the model with same noise level, exactly the same standard deviation. Furthermore, (Salman et al. 2019) equipped randomized smoothing with adversarial training, and proposed an attack algorithm. called Smooth-Ady. By randomly sampling multiple Gaussian noise around each sample during the training procedure, the algorithm directly estimates ge and seeks for adversarial examples for go. The attack algorithm is shown in Eq. 3 and LCE represents the cross entropy loss.
L arg (o ,0), D(z' wc)e
(3)
1 Σ fo + m))) i=1
arg max D(x' _e
-
m
3

---

Figure 1: Certified radius of several samples with different Gaussian distribution noise under three Under review as a conference paper at ICLR 2021
Though heuristic for adversarial training, combining with randomized smoothing and directly optimiz- ing ge has greatly improve the certifiable robustness. Based on Smooth-Ady, we apply sample-wing wise randomized smoothing to further improve the defense.
SAMPLE-WISE RANDOMIZED SMOOTHING
4.1 MOTIVATION
BARDUT
sample1 samplc2
2.0
20
2.0
serpic sempred
Gentied
5.0
1.0
6.6
(a) Smooth-adv with test samples (b) Pretrain model with train samples (c) Finetune model with test samples
models. (a) Smooth-ady model test with test set samples. (b) Our pretrain model test with train set samples. (c) Our finetune model test with test set samples which are the same (a).
From Eq. [I and Eq. (2) we can see that the prediction of the model and the robust radius it achieves at each sample are highly correlated to the level of added Gaussian noise. The choice of a has great impact on the model's accuracy as well as robustness. Previous works built the smoothed model by adding the same level of noise the entire dataset, which is not optimal for each individual sample. we add a large noise to a sample near the decision boundary, is very likely for the sample to be misclassified. On the other hand, for samples far away from the decision boundary, adding large noise allows us to achieve larger certified radius. Ideally, we need to use small a for samples near the decision boundary, and big for samples far away.
To provide motivating example, we randomly select several test samples from the CIFAR- 10 test set and certify them with different under one pretrained Smooth-Ady model provided by Salman et al.) (2019) which was trained with a 1.0. We take the base classifier out and build upon it different smoothed classifiers with from 1.0 with 0.05 as the interval. Then we certify the smoothed classifier with Eq. (2) and plot the result in Fig. [(a] We can see that the optimal a is not 1.0. By assigning the optimal each individual sample, we can achieve larger certified radii than reported in the original paper.
4.2 SAMPLE- WISE RANDOMIZED SMOOTHING
The above example motivates to design sample-wist wise randomized smoothing algorithm which assigns different noise levels to different samples. In this section, we elaborate the details of this framework. Generally speaking, the training procedure consists of two stages: the pretrain stage learns the data distribution with randomly assigned a, and the finetune stage improves the performance of the model by selecting the optimal a.
Pretrain-to- -oiirattttt-Fneeunee Framework In order to assign the most suitable a to every sample, we first train base classifier fe, and then select the optimal for each sample based on this classifier. At the first pretraining stage, we utilize the Smooth-Ady as shown in Eq. 3 to train the base classifier fo with uniform random of applied to ju sample in ith epoch as described in Eq.
of ~ Uniform(@minn Omaz)
(4)
Having pretrained the base classifier for we certify every sample in the train set with various o using Eq. (5) h X y + {0, 1} indicates whether go predicts right wrong with given When (2 o) = y h takes the value I otherwise From the Eq. (5). we would like to find a that maximizes the certified radius under the premise of correct prediction. The basic approach is to use
4

---

Under review as a conference paper at ICLR 2021
grid search, with o interval being the size of the grid:
train arg max (R(fo. x² o) x og .2))
(5)
where E fo t X Ointerval miin S o S Omans E N
Algorithm Training of our proposed framework
Input:
Training dataset S. Batchsize B. Noise range (Amin Tmaw) and interval dintereat- Epochs
T Tpretroin and I' finetune- Learning rate Irpretrain and ir fineture- Number of noise sample m and attack steps k.
ATTACKER
Smooth-Adv
2: while epoch i < T pretrain do
3: Generate of
Faaz) for S len(S) while iterations S B do Sample batch images zh11 _ y.. kk Generate noise samples 1//" ~N Rr) for S B, 1. S S m
4:
5:
k1, k2, ... KB S len(S)
6:
7: Generate adversarial examples wiy" ho Rp
for a²* using k-steps ATTACKER with 1/ &y
8: Calculate LCE by Ziq + 1ly and update 0 with lr preettainn
9: end while
10: end while
Generate specified の² = arg max, 2R(fo,x',0) x hgo. (2),))))) for S S len (S) while epoch i < T finetane do while iterations S len(S)/ do Sample batch images x² =² ...,,ke, S k1, k2..... KB S len(S)
12:
14:
Generate noise samples 174" NN σhv) for S p B. q m
16:
Generate adversarial examples zn for x using k-steps ATTACKER with 172"
&p Calculate Lee by z + nla" and update 0 with Ir finetune end while
18:
end while
Fig. [(b] shows the certified radius of the pretrained model several samples in train set under various noise levels. We can see that the model has different behavior on different samples. Sample far away from the decision boundary, its certified radius keeps growing increases. Sample is closer to the decision boundary and achieves its optimal a at 0.7. Sample 3 is mis-classified by the base classifier, and its certified radius is always O.
After we find the optimal of Ilvin for each training sample, we further finetune the model fo with the optimal noise levels assigned at the second stage, thereby improving the performance of the smoothed classifier. The whole framework for training is shown in Algorithm Fig. [(c) shows the certified radius of the same samples in Fig. ((a) with the finetuned model.
Predicting Procedure At test time, we divide the input space into a set of balls (2,) (which we call robust regions) that do not intersect with each other. Within B; the standard deviation of the Gaussian noise is fixed at o,,, so that we can apply the randomized smoothing theorem within each B, 2/est lies in the robust region B,, and uses the standard deviation of = BB, Define the neighborhood Bxx), rd) {x D D(x,
x r where r stands for the robust radius of x² We have to make sure that B(x rr) C B,, or we cannot apply the randomized smoothing theorem. The next problem is how to divide the input space to make rd as large possible.
We consider the case where the test samples arrive one by one (in the appendix we will consider the other case where test samples arrive in batches). As shown in Algorithm [ when a new test example Iesst arrives, we first check whether falls in any allocated robust region B, E CJ' {Br, 1
j j'). If wij'st B;, then simply let iy The robust radius o in this according to Eq. (6). where B. stands for the boundary of the ball B.,, and d(...) is the Euclidean distance function.
be obtained
3 = mmnn |R(oo oh Phese Heaa) di BBir)}
(6)
5

---

Under review as a conference paper at ICLR 2021
If the new sample of does belong to any allocated robust region B,, then we will create new one from the unallocated part of the input space A' which is essentially a ball centered at Tleat
First we find the optimal noise level of using Eq. 7 It is slightly different from Eq. 5 which used during training because we have no access to the true label at test time.
Test arg max (R(Jo: Fhese: 0))
where a E = x Ontervall Umin I a Tmaws I NJ
Then define the new region B,, according to Eq. (8. It ensures that the region would not intersect with any of the old ones.
3 = min [[ Thest olas)): min B.Ecs d
dl aB.}, Bi = Blotests
(8)
Algorithm 2 Allocation of Regions and Assignment of Standard Deviations
Input: Testing dataset S.
Output: Bj. B,, Peest B(xi, r²), I & len(S))
1: for j' 1,... .lee(S) do
2: C²' BB, :issjss))
3: for each B; in C do
if Weees B, then ==
4:
5:
6:
7:
on, م min R(Sa, Flest rece); di ²B.)
Lest =o
8:
9:
Continue the next
10:
end if
11:
end for
12:
// No B; found, create a new one
of' = arg max [R(fo, I o))
13:
rJ' = min { {R(fo. vlese Fles)) min minn,ecs {B;)
14:
B: B r5)
end for
Now we define our final model G X' + y by Eq. 9 where we assign the noise level ofeat to sample z².
G(r') = go (x', oeset arg max P(fo(x' +1) c) where 1 N'O0 o Lles cEY
2
For the sample I², since we do not know its label, the principle of choosing the is to choose the o that can maximize the certified radius. Such a prediction method will choose an appropriate a according test sample's location and the property, which selects the larger noise level promote robustness selects the smaller noise level to ensure accuracy, thus achieving better -ccuracysrobustness trade-off.
As the regions allocated these provable robustness. In the transductive setting, we can find the near optimal solution by linear programming instead of allocating individually. The details of linear programming and how much the order affects the robustness are shown in Appendix C.
by one, the order allocate regions affects the performance of
5 EXPERIMENTS
In this section, we evaluate our sample-wise randomized smoothing method on CIFAR- 10 and MNIST and compare with existing state-of-the-art models, Smooth-Adv(Salmaa et al. 2019) and

---

Under review as a conference paper at ICLR 2021
Macer(Zhai et al. 2020). We have conducted extensive experiments and the result can show the following results: (1) our method can improve the provable robustness significantly over existing methods CIFAR-10. (2) our method achieves comparable results MNIST. (3) Ablation studies show that our sample-wise randomized smoothing method should be applied in both training and testing to get better results (Appendix B.2). (4) we can achieve nearly optimal allocation of regions using linear programming in transductive setting (Appendix C).
5.1 SETTINGS
Following the experiment settings in (Salman et al. classifier ResNet-1 10 for CIFAR-IO and LeNet for MNIST. T. As our sample-wise method is trained based on Smooth-Adt Adv, the hyper-parameters are the same as those in (Salman et al. 2019) and the details can be found in Appendix A. Specially, we replace the fixed standard deviation a by a range [Amin mmaz) and it has three choices: {10, 12, 0.25]. 10.12, 0.50], [0.12, 1.00]]. Onterraal is set to be a fixed value 0.05. We pretrain the models for 150 epochs and finetune them for another 150 epochs.
2019: Zhai et al.
2020). we use the same base
For certification, we use only 500 noise samples to select specific o for train set and 100,000 noise samples for test set.
5.2 RESULTS
In this section, we first compare our sample-wise wise method with Smooth-Adv as our training process is based on Smooth-Adv. Then we compare with Smooth-ady and Macer on the metric average certified radius(ACR) suggested by (Zhai et al. 2020). The average certified radius is defined as x hgg.as as (x), y²) and h is defined in Section 4.2.
r +
except The models are trained with attack steps & 10, maximum l2 perturbation e 2.0 and number of noise samples m = 2. In Fig. [ Smooth-Adv--... stands for the Smooth-Adv model trained with σ = 0.25 and so on. Our sample-wise model use 3 different ranges of a, for example the Ours-(0.12-0.25) stands for the model whose ranges from 0.12 to 0.25.
Fig. 2 depicts the certified accuracy of two methods given the same
Fig. shows our sample-wise model performs better than the baseline model Smooth-Adv. With the larger noise level, the improvement is more pronouneed. This is because with larger a, the bascline model performs poorer. However, with more careful selection of a in our method, some points misclassified initially also be classified correctly given appropriate a even if the robust radius may not be as large as before. The results on MNIST can be found in Appendix B.1.
1.0
1,0
Certifled aceuragy
0.0
Smooth-Ad--0.2 25
Oums-J0.12-0.3 12-0.22
Centified accuracy
0.8
Ours-j0.124
Smooti-Adt-0,50
Certified accuracy
0.0
Smoolh-Ady-11 1.00
Ours-qo 1.000
0.6
0.4
0.4
0.4
0.0
0.0
0.00
0.0
robust radius
robust radius
robust radius
(a) a 0.25
(b) a = 0.50
(c) 1.00
Figure 2: Comparing our sample-wise method with Smooth-Adv on CIFAR-10.
T for the highest certified accuracy under a given 1a perturbation with all hyper--prrameter On CIFAR-10, our sample-wa wise model outperforms Smooth-Ady significantly, especially with large perturbations. However, on MNIST, our sample-wise model performs worse with large perturbations. We suspect that this may be due to the following reasons: first MNIST dataset has lower dimension- ality and hence is relatively easy, and existing methods already achieve fairly good robustness. But the distance between each two data points in MNIST is smaller that in method have to reduce large robust radius to ensure there is no intersection between different regions (see in Eq. (6) and Eq. (8). So there is drop on MNIST and the details can be found in Appendix C.2.
7

---

Under review as a conference paper at ICLR 2021
Method
0.00
1.25
1.50
1.75
Smoott-AAv(S)
87
73
38
33
29
24
CIFAR-10
Ours(%))
84
74
41
36
32
23
Smoolh Adv(S)
99
99
MNIST
Ours(())
99
99
98
94
88
80
70
56
38
23
Table 1: Upper envelopes of certified accuracy over all experiments CIFAR-10 and MNIST. The certified accuracy is calculated by sampling 100,000 noise samples for each test set sample.
Table 2 and 3 show the comparison on the ACR metric with single model. The results of Macer on two datasets and results of Smooth-Ady on CIFAR-I0 are directly quoted from (Zhai et al. 2020). We implement Smooth-Ady on MNIST with LeNet and report the results as shown in Table The details of models be found in Appendix A.
Method
0.00
0.25
0.50
0.75
1.00
1,25
1.50
1.75
2,00
2.25
ACR
0.25
Smooth (dv(
74
67
57
47
0
0
0.538
0.25
Macer(S) (8)
81
71
59
0
0
0.556
0.12-0.25
Ours(%)
84
74
58
0.557
0.50
Smooth-Ade (Sv(
46
29
0,50
Macor(%)
66
60
53
46
38
29
19
12
0,726
0.12-0.50
Ours( (%))
71
69
42
33
24
17
0.840
1,00
Smooth Smmooth-Adb($S) (A)(%)
45
41
38
35
32
28
25
22
19
17
0.787
Macer( (8)
25
0.12-1.00
Ours(%)
52
52
51
49
45
41
36
31
26
22
I.III
Table 2: Certified accuracy and average certified radius(ACR) CIFAR-10 10. Every row is single model. The results of Smooth-ady and Macer are quoted from (Zhai et al. 2020).
Method
0.00
0.25
0.50
0.75
1.00
1,25
1.50
1.75
2.00
2.25
ACR
0.25
Smooth (dv(())
99
0.929
0,25
Macer(18)
99
99
97
0
0
0.918
0.12 0.25
Ours( (S))
99
99
98
0
0
0.922
0.50
Smmooth-Adv($3
99
98
97
96
93
88
81
66
0
1,688
(R)
0.12:0.50
Ourst (k)
99
99
97
94
87
79
69
52
0
1,581
1,00
Smooth (db((E)
93
91
87
82
69
51
53
1.792
1.00
Macer[ (8)
89
85
79
75
69
61
54
45
1.520
0.12-1.00
Ourst (6)
98
97
96
81
73
1,810
Table 3: Certified accuracy and average certified radius(ACR) on MNIST, Every row is a single model. The result of Macer is quoted from (Zhai et al. 2020).
On CIFAR-10, as shown in Table sample-wise model performs better than others on ACR. With lower noise levels a {0.25. 0.50}. it shows the accuracy-robus, trade-off that the higher the accuracy of the model, the relative robustness under larger disturbance will be weakened. However with large 1.00, sample-wise method makes overall progress and promotes ACR with great margin 0.319, nearly 40% improvement. We argue that with higher noise level, sample-wise method has more choices for noise selection to provide better accuracy- cccuracyrobbuttess trade-off.
On MNIST, as shown in Table 3 sample wise method performs nearly the same as Macer with E (0.25, 0.50} though worse than Amooth-Adv. The sample-wise method can still achieve better results with high noise level a 1.00 meaning more selection choices.
CONCLUSION
In this work, we propose sample-wise randomized smoothing technique which selects different noise level for every sample during both training and testing. By allocation of robust regions and assignment o, our sample-wise model achieves better with high noise level. Through comparisons, sample-wise model promotes ACR with great margin, nearly 40% improvement on CIFAR-10, and achieves comparable results on MNIST.
trade-off especially
8

---

Under review as a conference paper at ICLR 2021
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint vrXiv:1802.00420 2018.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. IEEE, 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. In Advances Neural Information Processing Systems, pp. 11192-11208 2019.
Jeremy M Cohen, Elan Rosenfeld, and J Zico Kolter. Certified adversarial robustness via randomized smoothing. arXiv preprint urXiv:I902. 02918, 2019.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint 4rXiv:1412.65772, 2014.
Sven Gowal, Krishnamurthy Dvijotham. Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. On the effectiveness interval bound propagation for training verifiably robust models. arXiv preprint arXiv: 18 2018.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.001 17, 2017.
Matthias Hein and Maksym Andriushchenko. Formal guarantees on the robustness of a classifier against adversarial manipulation. In Advances in Neural Information Processing Systems, pp. 2266-2276 2017.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint 16X0:2/6 2016.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint / 1706.06083 2017.
Seyed-Mohsen Peoosvv-Deeffoli, Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 2574-2582, 2016.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE Symposium Security and Privacy (SP), pp. 582-597. IEEE, 2016.
Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Certified defenses against adversarial examples. arXiv preprint arXiv: 009444 2018
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Scbastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In Advances in Neural Information Processing Systems, pp. 11289-12 1-39-11300 11300, 2019.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint 13 2013.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry, Robustness may be odds with accuracy. arXiv preprint arXiv: 1805. 1805.12152, 2018
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. arXiv preprint 1rXiv:1711.0085/ 2017.
Eric Wong, Frank Schmidt, Jan Hendrik Metzen, and J Zico Kolter. Scaling provable adversarial defenses. In Advances in Neural Information Processing Systems, pp. 8400-8409, 2018.
Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John Hopcroft, and Liwei Wang. Adversarially robust generalization just requires more unlabeled data. arXiv preprint arXiv:/906.005:: 2019.

---

Under review as a conference paper at ICLR 2021
Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. Macer: Attack-free and scalable robust training via maximizing certified radius. arXiv preprint arXfv:2001.02378, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. 2019.
Huan Zhang, Tsui- Wei Weng, Pin- Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neural network robustness certification with general activation functions. Advances in neural information processing systems, pp. 4939-4948, 2018.
10

---

Under review as a conference paper at ICLR 2021
A APPENDIX OF EXPERIMENTAL DETAILS
A.1 EXPERIMENT SETTINGS
Following the experiment settings in (Salman al. 2019 Zhai al. 2020), we the same base classifier ResNet- for CIFAR-10 10 and LeNet for MNIST. Based on Smooth-Ady, we use the project gradient des))nd(PGD) experiments with set of hyper-parameters. For the attacking steps k of PGD, we have conducted with & E {2, 4, 10). For the maximum l2 perturbation denoted c, we set it with E {0.25, 1.0, 2.0). As for the number of noise samples m in AmoothhAAyy we set it with m E (2,
the inside attack algorithm. And we have conducted lots of
As for the standard deviation Ø, we modify the fixed standard deviation And we have conducted with (amin 0 maz) E {0.122 0.25), (0.12, 0.50). (0.12, 1.00); }.
range minn masl
As for the pvetraintt-ffinete 150 epochs and finetune the model with specific a with another 150 epochs. And we set the initial learning rate 0.1 for pretrain stage and 0.001 for finetune stage. For both stages, the learning rate drops by a factor of 10 every 50 epochs which is the same as that in (Salman et al. 2019).
framework, we first pretrain the base model with random with
For certification, we use 500 noise samples for training stage to assign specific a for every train samples. As for testing stage, actually, we first certify the test set sample x² with varying E [omen mazz with only 1000 noise samples. After selecting the best σ², we do another certification procedure with 100,000 noise samples to get robust radius. As for the allocation order, we apply the ascending order defined in Appendix C.2.
We the same hyper-paramette parameters for both CIFAR-10 and MNIST. And we implement Smooth-Ady on MNIST with the same settings, except that a E {0.11, 0.25, 0.50, 1.00].
A.2 COMPARING MODELS
In this section, we list the models that used in the comparison of average certified radius( (ACR). Table Jssows the exact models that are used for CIFAR-10. The results of Smooth-Ady and Macer directly quoted from Zhai et al. (2020). Table shows the exact models that used for MNIST. The result of Macer is quoted from Zhai et al. (2020), and the result of Smooth-Ady is got by the implementation of ourselves.
Method
Description
0.25
Smooth-Adv
8-sample 10-step Smooth-Ady with 1.00
0.25
Macer Ours
Macer with A: = 16, À = 12.0, / = 16.0 and y 8.0
0.12-0.25
4-sample 4-step sample-wise model with e 0.25
0.50
Smooth-Ady
2-sample 10-step Smooth-Adv with e 2.00
0.50
Macer
Macer with 16, A 4.0, 3 16.0 and 8.0
0. 1.12-0.50
Ours
4-sample 2-step sample-wise model with e = 1.00
1.00
Smooth-Ady
2-sample 10-step Smooth-Ady with e 2.00
1.00
Macer
Macer with k 16. dynamic A, 3 16.0 and y 8.0
0.12-1.00
Ours
2-sample 4-step sample-wise model with e = 2.00
Table Compared models on CIFAR-10 for ACR comparison.
B APPENDIX OF EXPERIMENTS RESULTS
In this section, we show more results of the comparison with Smooth-Adv on MNIST, And through several ablation experiments, study the effects of different parts in the provable robustness.
B. COMPARISON WITH SMOOTH-ADV
We compare our sample-wist wise method with Smooth-Aue Adv given the same hyper-parameterr parameters except The models shown in Fig. are both trained with k = 10, 2 and 2.0. The Smooth-
11

---

Under review as a conference paper at ICLR 2021
Method
Description
0.25
Smooth-Ady
4-sample 10-step Smooth-Adv with e = 0.25
0.25
Macer
Macer with 16, 16.0, / 16.0 and 7 8.0
0. 0.12-0.25
Ours
4-sample 2-step sample-wise model with c = 0.25
0.50
Smooth-Adv
4-sample 10-step Smooth-Adv with 1.00
0.50
Macer
Macer with 16, 16.0, / 16.0 and 7 8.0
0. 1.12-0.50
Ours
4-sample 2-step sample-wise model with e 1.00
1.00
Smooth-Ady
s-smplle 10-step Smooth-Adv with 2.00
1.00
Macer
Macer with = 16, = 16.0, 5 = 16.0 and 7 = 8.0
0.12-1.00
Ours
4-sample 10-step sample-wise model with 2.00
Table 5: Compared models on MNIST for ACR comparison.
Adv models are trained with E {0.25, 0.50, 1.00). Correspondingly, we train our model with (Tmin mazz) E (0.12, 0.25). (0.12, 0.50). (0.12, 1.00)). With small = 0.25, these two methods perform nearly the same. With 0.50, Smooth-Adv performs better with promotion on large perturbation. With a 1.00, our method performs better with small perturbation and Smooth-Ady performs better with large perturbation. The reason why it is worse on large perturbation on MNIST is that the data points in MNIST are simpler and it is easier to obtain higher robust radius. However in our algorithm, order to make the regions have no intersection, the larger robust radius will be sacrificed.
Certiiie accuracy
0.0
Certifed accuracy
0.8
Certified accuracy
0.9
0.4
0.4
0.4
Ours-B: 120
0.2
10
(urs|j0.12-1.00
8maoth-Adw00.55
SmvoothAAy--050
Smooth-Adu-100 1.00
0.0
0.0
radius
robust radius
robu st radius
(a) a 0.25
(b) a = 0.50
(c)
1.00
Figure Comparing our sample-wist wise method with Smooth Adv Adv(Sallan al. 2019)
B.2 ABLATION STUDY
As aforementioned, method consists of two parts: the first one is pertrain-to-finete framework and the second one sample-wise certification procedure. Thus, we study the effects of different parts on CIFAR- 10 and MNIST as shown in Fig. and Fig. We have conducted the following four algorithms:
Our -i-nnetuee model test under sample-wise certification procedure, with specific different noise level for each test data.
Ours-diff:
Ours-same: Our pretrain-to to fi-nenuu model test with the same noise level for all test data (conven- tional certification procedure).
Smooth-Adv-diff: The Smooth-Ads model test under sample-wise certification procedure.
Smooth-Ady-same: The Smooth-Ady model test with the same noise level for all test data.
From the results CIFAR-10 shown in Fig. 4 our sample-wise certification procedure can still slightly promote the performance of Smooth-Ady and our pretrain-to- cetrainnto-finetumm fo-fnnneuee model test under the same noise level performs nearly the same as Smooth-Ady From these, the promotion of individual part is limited. Only by combining the pretrain- to- finetune framework with sample-wise certification procedure model achieve larger improvement.
12

---

Under review as a conference paper at ICLR 2021
1.0
1,0
Certifed acquracy
0.8
StredhAdtdd
Oum-lif
aun-dame
Cartifed accuracy
0.8
Quedd
Ourevame
Smeah-Aavd1
Certifid accurace
0.8
Smochh-Ad-dff
G.n-d1
Our-onee
Srradh-d--sare
Sncah-AAv-sam
Smoch-Add-sam
0.6
0.5
0.4
0.4
0.4
0.0
0.0
0.0
0.0
2.0
radilu
0.25
0.50
(c) 1.00
Figure 4: The effects of different components in model CIFAR-10.
1.0
1,0
Oun-d7 Oum-ons
0.8
Certifed acquracy
0.8
Certifed accuracy
0.8
Smochh-Ad-ddf
Smich--Ad-eam
0.6
Certifed
0.4
Ous-oif
0.4
Ous
0.4
Out--s2no
Ous sate
0.2
B
Smooth Adr-d1
Snochhatt-came
Ade-ooss
0.0
0.0
0.0
0.0
radius
radius
radius
0.25
0.50
(c) 1.00
Figure 5: The effects of different components in our model on MNIST.
Fig. shows the comparison on MNIST. With lower noise level, there is nearly no difference between sample-wise certification and conventional certification. With high noise level 1.00, sample-wise certification weaken the robustness of Smooth-Adv but significantly improves the performance of our model, which also show that the two parts should be applied at the same time.
C EFFECT OF ORDER
Since our algorithm needs to generate regions for each test sample one by one, the order of allocation will also affect the performance of the provable robustness. In this section, we several experiments to illustrate the effect of the order and elaborate the distance from the optimal results.
C.1 PROBLEM REDEFINITION
Suppose that we do not consider whether each sample in test set is correctly classified, and we do not consider the standard deviation assigned to each sample point. The main purpose is to allocate non-overlapping regions around each sample and maximum the sum of the radii of these regions. Described mathematical language as follows:
The test set is denoted as {I/ Jisisn. Define D(x, y) as the Euclidean distance between two points and y. Allocate specific neighborhood B(x², rd) {z Dxx,x²) < r.). The radius {r'} } is exactly
the variable and satisfies that rd S (1 S S n). Then the optimization objective as shown in (10)
ー r3 B(x rt) n B( r²) 0,
maximize Σ
(10)
s.t.
Wi
C.2 RESULTS OF DIFFERENT ORDER
Following the definition in previous section, study the effects of the different sequences order. The variable R is exactly the maximum robust radius calculated with o E [amin: maz]]- And transform the optimization problem to undirected graph G(V, F), exactly GCIFAR-10 and
13

---

Under review as a conference paper at ICLR 2021
GMNIST- If ((x',R)) has intersection with B(x), RR). then we add x² and x² to V and add the edge x'r2 E. Then we can plot the distribution of the degree in G for CIFAR-10 and MNIST as
shown in Figure 6 And the models we use are the same as those in Table and Table with o ranges from 0.12 1.00.
100
CIFAR-10
modes
600
75
Number
50
25
50
100
150
200
400
800
800
Degres
CIFAR-10
(b) MNIST
Figure 6: Distribution of the degree in G' for CIFAR-10 and MNIST
Figure showw that most of the graph nodes have low degree and only few nodes have very large degree, especially the degree even exceeds 800 in MNIST. Exactly, there are 569 nodes in GeIFAR-10 10 and 4777 nodes in GINTST which means that only 5% regions intersect others in CIFAR-10 10 but nearly 47% regions intersect others in MNIST if without post-processing. Due to the high overlap between differentt regions in MNIST, our sample-wise method performs poorly MNIST.
Actually, the optimization function in Eq. I0 is standard linear programming problem. We get the theoretical optimal solution by solving the linear programming problem. However, especially for MNIST, there exits nearly 4700 variables and more than 300,000 limits, making this problem difficult. As it is hard to optimize such many variables in the same time, we switch to a online setting which optimizes variables one by one. The online setting is more practical and just what we have described in the main body. The online optimization objective is briefly described as Eq. [II
marimize pnt (1 S n)
s.t.
(11)
0 0 < R*
B(x n B(r , rー) 9 (1 < < k)
Based on the degree of graph nodes, we use the following two special orders to estimate the results.
1. (Descending order) Degree in descending order.
2. (Ascending order) Degree in ascending order.
And the test results is shown in Table The type of Overlapping means that the rJ. R regardless of the overlapping of regions. Descending represents the order that test samples come with descending degree and Ascending represents the reverse order. The results shows that the regional overlap affects the performance lot. On CIFAR-10. the difference between there is few intersections. On MNIST, the ascending order performs a little bit better. From the results, we choose to apply the ascending order our algorithm the main body.
orders is small as
Datasel
Types
0.00
0.25
0.50
0.75
1.00
1.25
1,50
1.75
2.00
2.25
ACR
Overlapping
100
99.5
96.2
89.4
79.9
69.6
59.7
50.4
42.1
35.0
1.933
CIFAR-10
Descending
94.4
93.9
90.6
83.8
74.3
64.0
$4,1
44.8
36.5
29.5
1.737
Ascending
83.7
29.4
Overlapping
100
100
100
100
100
99.7
98.4
92.6
82.6
2.811
MNIST
Descending
97.4
96.2
94.0
90.0
83.7
77.1
69.6
59.6
45.7
30.8
1.821
Ascending
99.9
99.5
97.9
93.3
86.4
79.6
71.9
63.4
50.3
35.1
1.917
Table 6: Certified accuracy and ACR on CIFAR-10 and MNIST with different orders.
14

---

Under review as a conference paper at ICLR 2021
D DISCUSSION OF TRANSDUCTIVE SETTING
The transductive setting means that we know the test data points except their labels. this setting, we explore which noise level could be more suitable for each sample. As we discussed in detail before, we divide the input space into "robust regions" according to the properties of test data. Hence, in this setting, we can solve linear program based on the given test data (See Appendix C).
In the setting that test data points come online, we give up global optimization (i.e., solving the linear program for all test data points). this case, we have allocate regions for test data one by one. As we discussed in Section 4.2, the classification of testing point depends on which "robust regions" lies in. Hence, one can imagine that the robustness of a testing point is limited by the distance between it and the boundary of its allocated region. As the number of test data increases, those closer to some region boundary would get a smaller radius and is plausible that the average robust radius could gradually decrease. Hence, this may be seen as potential weakness of our sample-wise algorithm.
Nevertheless, explore how much the size of the test set affects our performance in the following experiments. We extend CIFAR- 10 with 20,000 images, whose categorics are subset of CIFAR- 10, from ImageNet. We directly (10,000 from CIFAR- 10 and 20,000 from ImageNet) using linear programming or with the online setting. The results are shown in Table
trained sample-wise model to certify all these 30,000 images
Dataset
Types
0.00
0.25
0.50
0.75
1.00
1,25
1,50
1.75
2.00
2,25
CIFAR- Extrx
Lineur Programming Online setting
41.03
40.78
39.74
37.43
34.03
30.10
26.04
22.18
18.68
15.54
40.98
40.80
39.76
37.44
34.04
30.06
26.00
22.12
18.58
15.41
Table 7:
Certified accuracy on extension dataset with linear programming online setting.
Table shows that the performance with online setting and linear programming are nearly the same on test of 30,000 images. This also shows that even in the online setting, the impact of increasing the test data set on performance small, and the performance degradation is slow. In particular, with 30,000 test points, transform the result graph described in Appendix and there are only 1388 data points intersect others, affecting less than 5% of all testing points.
To sum up, sample-wise algorithm works in the transductive setting and the setting where the test data points come online if there are reasonable number of testing data points. In the extreme case that there are drastically more test points, it possible further leverage these unlabeled data to enhance the robustness via semi-supervised learning (Carmon et al.) 2019 Zhai et al. 2019), and we leave it as interesting future direction.
15


Reviews:
[{"review_id": "pr4AAm4ZEGt", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper considers the problem of provably defense to adversarial perturbations using randomized smoothing. The authors propose sample-wise randomized smoothing -- assigning different noise levels to different samples. They also propose to first pretrain a model and then adjust the noise for higher performance based on the model’s outputs. Experiments show that proposed approach improves the performance of randomized smoothing with same noise level for small perturbations. \n\nPros:\n1)\tThe paper is well written and easy to read.\n2)\tThe idea of sample-wise randomized smoothing is interesting, and results are reasonable.\n3)\tIssues with assigning arbitrary noise level to test points is well described/thought and solutions (online and batchwise) are proposed to make it compatible. \n4)\tExperimental setup is comprehensive and appropriate ablation studies have been performed. \n\nCons:\n1)\tMy main concern with this work is that it is not clear to me that these ACR gains are being achieved at what cost? It appears that sample-wise randomized smoothing adds an additional computational complexity during both training and prediction/certification phases. I would like to see the train and prediction cost comparison with standard train/test, MACER, and vanilla random smooth model. This comparison will provide a better insight into the performance as on some cases, e.g., MNIST, the sample-wise RS performs pretty close to the baselines. I will argue that in the computation cost on sample-wise RS is significantly higher than the baseline robust approaches, one can simply increase the m_test in those approaches. \n2)\tIt will insightful to see how much gain the proposed scheme achieves with vanilla gaussian augmented models (authors only show these results with smooth adversarially trained models).\n3)\tSimilar to adv-smooth, it will be useful to see how much gain can be achieved with: 1) pre-training, and 2) semi-supervised learning. \n4)\tResults in Sec 5.2 is for online or batch setting?\n5)\tHow does resolution of grid or \\sigma_interval impact the performance (train and prediction/certification time and ACR/ACA)?\n\nMinor:\n1)\tThere seems to be typo in Sec 5.1: [0, 12, 0.25].\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "U7vgvB00KNk", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes an improved sample-wise randomized smoothing technique, where the noise level is tuned for different samples, for certification of robustness. Further, it also proposes a pretrain-to-finetune methodology for training networks which are then certified via sample-wise randomized smoothing. The authors show in experiments on CIFAR and MNIST that combining their training methodology and certification methodology can sometimes improve the average certified when compared to state-of-the-art randomized smoothing techniques Smooth-Adv (Salman et. al, 2019).\n\nI recommend a rejection because the key takeaways of the paper should be clarified and the pretrain-to-finetune framework and the allocation of regions must be explained and justified better.\n\nThe key idea of using different noise levels for different samples is intuitive and explained well in the motivation section (4.1). Furthermore, the authors show that their methodology does indeed lead to minor improvements in average certified l2-radius on Smooth-Adv for the CIFAR dataset, which is a more interesting dataset than MNIST, where the proposed technique performs similarly or slightly worse than Smooth-Adv.\n\nHowever, the paper does have shortcomings in its clarity and organization. First, I think the sample-wise certification is a clear and well-motivated idea, and should be discussed as the major contribution, rather than the pretrain-to-finetune framework. Furthermore, I was confused about the allocation of regions in the prediction step of the sample-wise certification; explaining why it is necessary, and why it is better than allocating a region for every single test datapoint (which is what I thought the motivation section in 4.1 explained) would improve the paper significantly. Finally, the amount of notation in the paper should be simplified significantly, and the notation often makes the paper more confusing (and sometimes, I could not understand due to either incorrect or unclear notation). For example, the pseudocode in Algorithm 1 would have been better if the notation was simplified, and in Algorithm 2, I did not know what B_{i_j} referred to at all.\n\nSpecifically regarding the allocation of regions, I did not understand why it was necessary or led to improvements over choosing a new region for each test datapoint. Explaining it clearly, and showing an ablation study that compares using region-allocation and not using region-allocation would provide good motivation for its use.\n\nSpecifically regarding the pretrain-to-finetune framework, I have the following questions:\nI saw that in Appendix C that the pretrain-to-finetune framework is necessary for the sample-wise randomized smoothing to show an improvement. Are there explanations for why sample-wise randomized smoothing does not well work by itself?\n\nWhy does it make sense to do this 2 step procedure? Why does the pre-training have to involve varying noise levels if the fine-tuning procedure already finds the optimal noise level for each sample to train with? Could the pre-training just be the same as Smooth-Adv?\n\nHow much does it matter which noise levels we choose during the pre-training phase? I noticed that the authors usually chose noise from 0.12 up to the amount that they compare to with SmoothAdv, but the reasons for this are not discussed.\n\n\nOverall, I feel that the paper has a well-motivated idea (sample-wise randomized smoothing) and shows some minor improvements in terms of results, but that clarity for all other parts of the paper must be improved significantly.\n\n\nPost Rebuttal Update:\n\nI appreciate the author response, but I will maintain my score after reading the rebuttal and discussion with other reviewers. It still appears to me that the motivation and clarity can be improved, and so I would recommend focusing on those aspects in future revisions. Additionally, baselines such as \"allocating a region for every single test point\" should be compared to in a clear way (as opposed to being in the appendix), as such baselines seem natural to compare to.", "extra_scores": {}, "extra_text": {}}, {"review_id": "QvhnP-lpQ2l", "reviewer": "AnonReviewer5", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper suggests an extension of randomized smoothing, wherein the degree of smoothing is optimized both at training and test-time on each individual sample. At training time, the model is first \"pre-trained\" using a range of smoothing parameters (variance of the Gaussian perturbations), and then \"fine-tuned\" by selecting the variance on each sample which maximizes the verified radius. At test time, we can again select the smoothing parameter to maximize robustness.\n\nPros:\n- Numerically, the results seem fairly strong\n\nCons:\n- It's unclear to me whether the evaluation is fair\n\n\nA few (somewhat critical) questions:\n\n1. (Major) For the test-time procedure, this procedure selects $\\sigma$ based on a computed robustness statistic. I assume that this robustness statistic uses the original image, as in other randomized smoothing approaches? (as opposed to an adversarially perturbed image). If so, this comparison seems somewhat unfair - the typical threat model is that the classifier does not get to first see the nominal image (otherwise, the classifier could cache the clean image + label, and use a nearest-neighbor lookup against its cache to handle any adversarial images.) If not, could you explain how the adversarial image is selected here?\n\n2. What is the purpose of the balls $B$ in the section on \"Predicting Procedure.\"? What do they add compared to computing $r^j$ directly? For what fraction of the test set is an existing $B_i$ found including the test point? (I would expect this fraction to be very small?)\n\n3. It seems that for e.g. the SmoothAdv model trained with $\\sigma = 0.25$, we should be interested in robustness with radii significantly below 0.25 (and certainly not above it). Am i misunderstanding the naming of the models?\n\nMinor points:\n- It would be interesting to see an ablation of whether the fine-tuning phase helps.\n- The presentation of the algorithm could be significantly simplified (lots of notation is unnecessarily complicated, double subscripting, going into details before explaining the idea, lots of new symbols introduced throughout, etc.). The pseudocode is very helpful.\n\nOverall:\nIt's clear that the authors have put significant effort into this submission, but I believe it does not currently meet the necessary bar for ICLR, though I may adjust my rating if the rebuttal satisfactorily addresses the points above. I hope some of this feedback will be useful to the authors.\n\nEDIT: Thanks for the clarifications. Unfortunately, none of the responses are enough for me to update my rating.\nOne thing regarding point 1 in particular: the transductive setting seems contrived for adversarial robustness as it does not seem to correspond to a plausible threat model. It's true that in the transductive setting, the examples don't have labels, but since clean accuracy >> robust accuracy, just caching predicted labels on the clean examples is roughly as good (which can be done even if test labels are not available).\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "O_x2aTsptkV", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper propose a method to improve the randomized smoothing algorithm for certified robustness against adversarial attacks.\nThe idea is that, instead of adding the same Gaussian noise to every data points, it uses a different standard deviation for each data points. When an example is far away from the decision boundary, one can add more noise.\nPros:\n- Certified robustness is an important problem in adversarial ML, and randomized smoothing is one of most promising methods.\n- The proposed method is intuitive and seems to be a practical way to improve the original randomized smoothing algorithm\n- Experiments show that, the certified accuracy on CIFAR-10 really increases\nCons:\n- It seems to me that the proposed method is a relatively straightforward extension from the original randomized smoothing algorithm, so the technical contribution is limited.\n\n\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper considers an extension of randomized smoothing where the smoothing noise may differ for different points. The resulting method shows good performance experimentally. However, the reviewers raised a number of problems which, at the moment, precludes the acceptance of the paper, such as the following:

- The paper analyzes the transductive setting, where all the test points are available to fine-tune the smoothing parameters of the predictor. It is not clear how this setting corresponds to a real adversarial threat model, and whether the final tuning needs to use the perturbed or unperturbed points. In the first case, the resulting certified radius is different from what is normally used in the literature, while in the latter it is not clear how the method would be useful to mitigate any real adversarial attack.
- A related comment is that the paper should explain (and state) properly how the results of Cohen et al.  (2019) are applicable to compute the certified radius, which would also provide a proper explanation why partitioning is used.
- The training cost of the procedure seems very high, and this is not discussed.
- The clarity of the presentation should be improved.




Decision: Reject