Confidence-aware Training of Smoothed Classifiers for Certified Robustness
Authors: Jongheon Jeong
Seojin Kim
Jinwoo Shin
Venue: ICLR 2022 Submitted (2022)
Keywords: randomized smoothing
adversarial robustness
certified defense
adversarial defense
robust training
confidence calibration

Abstract: Any classifier can be "smoothed out" under Gaussian noise to build a new classifier that is provably robust to $\ell_2$-adversarial perturbations, viz., by averaging its predictions over the noise, namely via randomized smoothing. Under the smoothed classifiers, the fundamental trade-off between accuracy and (adversarial) robustness has been well evidenced in the literature: i.e., increasing the robustness of a classifier for an input can be at the expense of decreased accuracy for some other inputs. In this paper, we propose a simple training method leveraging this trade-off for obtaining more robust smoothed classifiers, in particular, through a sample-wise control of robustness over the training samples. We enable this control feasible by investigating the correspondence between robustness and prediction confidence of smoothed classifiers: specifically, we propose to use the "accuracy under Gaussian noise" as an easy-to-compute proxy of adversarial robustness for each input. We differentiate the training objective depending on this proxy to filter out samples that are unlikely to benefit from the worst-case (adversarial) objective. Our experiments following the standard benchmarks consistently show that the proposed method, despite its simplicity, exhibits improved certified robustness upon existing state-of-the-art training methods.

Under review as a conference paper at ICLR 2022
CONFIDENCE-AWARE TRAINING OF SMOOTHED CLASSIFIERS FOR CERTIFIED ROBUSTNESS
Anonymous authors Paper under double-blind review
ABSTRACT
Any classifier can be "smoothed out" under Gaussian noise to build a new clas- sifier that is provably robust to Éz-adversarial perturbations, viz., by averaging its predictions over the noise, namely via rundomized smoothing. Under the smoothed classifiers, the fundamental trade-off between accuracy and (adversar- ial) robustness has been well evidenced in the literature: i.e., increasing the ro- bustness of classifier for input can be the expense of decreased accuracy for some other inputs. this paper, we propose a simple training method lever- aging this trade-off for obtaining more robust smoothed classifiers, particular, through a sample-wise control of robustness over the training samples. We en- able this control feasible by investigating the correspondence between robustness and prediction confidence of smoothed classifiers: specifically, we propose to use the "accuracy under Gaussian noise" as an easy-to-compure proxy of adversarial robustness for each input. We differentiate the training objective depending on this proxy to filter out samples that are unlikely to benefit from the worst-case (adversarial) objective. Our experiments following the standard benchmarks con- sistently show that the proposed method, despite its simplicity, exhibits improved certified robustness upon existing oate-of-thccart training methods.
INTRODUCTION
Despite these tremendous advances in deep neural networks for variety of tasks towards artificial intelligence, e.g., visual recognition (He et al., 6; Chen et al., 2020), natural language processing (Vaswani al., 2017; Brown al., 2020), and reinforcement learning (Silver al., 2017; Vinyals et al., 2019), the broad existence of adversarial examples (Szegedy et al., 2014) is still one of the most significant aspects that reveals the gap between machine learning systems and humans: for given input (e.g.. an image) to classifier f. say a neural network, f often permits a perturbation ó that completely flips the prediction f(z + 5). while 8 too small change the semantic in x. In response to this vulnerability, there have been significant efforts in building robust neural network based classifiers against adversarial examples, either in forms of empirical defenses (Athalye al., 2018; Carlini et al., 2019; Tramer et al., 2020), which are largely based on adversarial training (Madry et al., 2018; Zhang et al., 2019; Wang et al., 2020; Zhang et al., 2020b; Wu et al., 2020), or certified defenses (Wong& & Kolter, 2018; Xiao et al., 2019; Cohen et al., 2019; Zhang et al., 2020a), depending on whether the robustness claim can be theoretically guaranteed or not.
Randomized smoothing (Lecuyer al., 2019; Cohen et al., 2019), our focus in this paper. is currently a prominent approach in the context of certified defense, thanks to its scalability to arbitrary neural network architectures while previous methods have been mostly limited in network sizes or require strong assumptions on their architectures: specifically, for a given classifier f, it constructs a new classifier f. where f(x) is defined to be the class that f(r + 5) outputs most likely over ó ~ (O, o²1), 1). i.e., the Gaussian noise. Then, it is shown by Lecuyer et al. (2019) that is certifiably robust in f2-norm, and Cohen et al. (2019) further tightened the fz-robustness guarantee which is currently considered as the state-of-the-art in certified defense.
However, even with recent methods for adversarial defense, including randomized smoothing, the trade-off between robustness and accuracy (Tsipras et al., 2019; Zhang et al., 2019) has been well evidenced, i.e., increasing the robustness for a specific input can be at the expense of decreased accuracy for other inputs. For instance, with the current best practices, Salman et al. (2020) report

---

Under review as a conference paper at ICLR 2022
that the accuracy of ResNet-50 on ImageNet degrades, e.g., 75.8% + 63.9%, by an eoo adversaaal training. i.e. optimizing the classifier to ensure robustness at all the given training samples around an lxc -ball (of size 2z.). In addition, Zhang al. (2019) have shown that the (empirical) robustness of a classifier can be further boosted in training by paying more expense in accuracy. A similar trend can be also observed with certified defenses, e-g-, randomized smoothing, the clean accuracy of smoothed classifiers are usually less than those one can obtain from the standard training on the same architecture (Cohen et al., 2019).
Contribution. In this paper, we develop a novel training method for randomized smoothing, coined Confidence-Awart Training for Randomized Smoothing (CAT-RS), which incorporates sample-wise control of target robustness on-the-fly fly motivated by the accuracy robuutcy- trade-off in smoothed classifiers. Intuitively, a natural approach one can consider response to the trade-off in robust training is to appropriately lower the robustness requirement for "hard-to-classify" samples while maintaining those for the remaining ("easier") samples: here, the challenges are (a) which samples we should choose for it during training and (b) how to control their target robustness.
To implement this idea, we focus on the direct correspondence from prediction confidence to adver- sarial robustness that smoothed classifiers offer: due to its Lcaa-Lipschitzeess (Salman et al., 2019), achieving a high confidence at æ from a smoothed classifier also implies a high (certified) robustness at x. Inspired by this, we propose to use the sample-wiss wise confidence (of smoothed classifiers) as an efficient proxy of the certified robustness, and defines two new losses, namely bottom- K and worst- case Gaussian training, each of those targets different levels of confidence that the overall training can be more informed sample-wise for better robustness by preventing low-confident samples from being enforced to increase their robustness.
We verify the effectiveness of our proposed method through an extensive comparison with existing robust training methods for smoothed classifiers, including the state-of-the-arts on a wide range of established benchmarks on MNIST and CIFAR-10 datasets. Our experimental results constantly show that the proposed method can significantly improve the previous state-of-the-ar results on certified robustness achievable from a given neural network architecture, by (a) maximizing the robust radii of high-confidence samples while (b) reducing the risk of deteriorating the accuracy at low-confidence samples. Our extensive ablation study further confirms that each of both proposed components has an individual effect on improving certified robustness, and can effectively control the robustesss trade-off with the hyperparameter between the two proposed losses.
2 PRELIMINARIES
Adversarial robustness. Consider labeled dataset D [ y:)} from certain distribution P. where E Ed and y E J : {1,..... K}. which forms classification problem with K classes. Let f : Rd + y be a classifier. Notice that f is a discrete and non-diffcrentiable, so that one additionally consider differentiable F Rd A K to allow gradient- based optimization assuming f(z)= == arg max FA (z), where A K- is probability simplex in RK The standard framework of empirical risk minimization to optimize í assumes that the samples in D i.i.d. from P and expect f to perform well given that the future samples also follow the i.i.d. assumption.
However, in the context of adversarial robustness (and for other notions of robustness well), the i.i.d. assumption on the future samples does not hold anymore: instead, it additionally assumes that the samples can be arbitrarily perturbed up to a certain restriction, e.g., a bounded balball, and focuses on the worst-case performance over the perturbed samples. One possible way to quantify of adversarial perturbation (Moosavi-
this scenario is to consider the average Dezfooli et al., 2016; Carlini & Wagner, 2017; Carlini et al., 2019), namely:
R(f: = B( min || fe'==lla] {(2))
2112
(1)
In this respect, we aim find that maximizes R(f: P) while maintaining the performance on P.
Randomized smoothing. The essential challenge in achieving adversarial robustness in neural networks. however, stems from that directly evaluating (1) (and further optimizing it) is usually computationally infeasible, e.g., under the standard practice that F is modeled by a complex, high- dimensional neural network. Randomized smoothing (Lecuyer al., 2019; Cohen et al., 2019)
2

---

Under review as a conference paper at ICLR 2022
Lecuyer et al. (2018)
Liet al. (2018)
Certified radius
Cohen et (2019)
X
X
2-
T
X
T
X
X
0.5
0.6
0.8
0.9
1.0
(a) Low-confidence samples (b) High-confidence samples
Figure 1: Existing fg-robustness guar- antees with respect to the confidence of smoothed classifiers at o 1.0.
Figure 2: Illustration of the two proposed losses, i.e., bottom-K K and worst-case Gaussian training, under dif- ferent confidence conditions in randomized smoothing.
bypasses this difficulty by constructing a new classifier from f instead letting f to directly model the robustness: specifically, it transforms the base classifier f with certain smoothing measure, where in this paper we focus on the case of Gaussian distributions N (0, (0))
f(x) arg max (0.20 (f + =)
eEy
Then, the robustness of f at w), namely R(f; x. y). can be explicitly lower-bounded in terms of the certified radius R(f,,,)) v), e.g., Cohen et al. (2019) showed that the following bound holds which is tight for Ezaavversary, e.g., is the optimal for linear classifiers:
R(fiz,)) a. 10 (p, v)) Rlf, 2, where pf(x, v) = (s(s(r+ = g),
(3)
0. Here, we remark that the formula for certified radius (3) is essentially function of p, (4), which represents the prediction confidence of x, (00,0²1) In other words, unlike standard neural networks, smoothed classifiers can guarantee a correspondence from prediction confidence adversarial robustness which is the key motivation of our method in this paper. Figure plots this relationship shown by Cohen et al. (2019) as well as by some prior works (Lecuyer et al., 2019; Li al., 2019) which also attempt lower-bound the robustness of smoothed classifiers.
provided that f(x)) y, otherwise R(f:2,y)
or equivalently, the accuracy of f(x + 5) over
CONFIDENCE-AWARE TRAINING FOR RANDOMIZED SMOOTHING
We aim to develop a new training method to maximize the certified robustness of considering the trade-off relationship between robustness and accuracy (Zhang et al., 2019): even though random- ized smoothing can be applied for any classifier f. the actual robustness of í depends how much classifies well under presence of Gaussian noise, i.e., by py y) as in (3). A simple way to train f for robust f. therefore, is to minimize the standard cross- loss (denoted by CE below) with Gaussian augmentation in Cohen al. (2019):
min E
(a.U)~ (CE(F(x+)))) 20,20
(5)
In this paper, we extend this basic form of training to incorporate a confidence-awuus strategy to decide which noise samples 5 >N(0,, o²I) should be focused on sample- wise during training of f. Recall Figure that plots mappings from the (smoothed) confidence pf (4) to certified radius, e.g., those derived by Cohen et al. (2019) (at the blue line). Ideally, one may wish obtain a classifier that achieves Py (I. y) R 1 for every (z, v) P to maximize its certified robustness. In practice, however, such a case is highly unlikely, and there usually cxists a sample æ that (z y) should be quite lower than I to maintain the discriminativity with other samples: in other words, these
t denotes the cumulative distribution function of the standard normal distribution.
3

---

Under review as a conference paper at ICLR 2022
samples can be actually "beneficial" to be misclassified at some (hard) Gaussian noises, otherwise the classifier has to memorize the noises to correctly classify them. On the other hand, for the samples which can indeed achieve py (z, y) = 1, the current Gaussian training in (5) may not be able to provide enough samples of 5 for x: throughout the training, as py y) s 1 implies that f(x + 6) must be correctly classified for "almost every" possibility of ~ N(0 o² the radius certifiable at rapidly increases as py. y) 1 as shown in Figure 1, it is important for an overall robustness of f to increase py (r, y). especially when it can be close to at the end.
Also, considering that
In these respects, we propose two different variants of Gaussian training (5) that address each of the possible cases, i.e. whether (a) (r. y) < or (b) py ~ 1, namely with (a) bottom- K and (b) worst-case Gaussian training, respectively. During training, the method first estimates pf (ar, y) for each sample by simply computing their accuracy over M random samples of ó ~ (0, I²I), and applies different forms of loss depending on the value. In the following two sections, i.e., Section 3.1 1 and 3.2, we provide the details on each of the proposed losses, and Section 3.3 describes how to combine the two losses and defines the overall training scheme.
3.1 BOTTOM-K GAUSSIAN TRAINING: LOSS FOR LOW-CONHIDENCE SAMPLES
Consider base classifier ʃ and a training sample (x. E DD and suppose that py p y) p < 1, e.g., f has low-confidence at x. Figure 2(a) visualizes this scenario: in this case, by definition of py(x, y) in (4), f(x + 5) would be correctly classified to y only with probability p over 5, and this can imply either that (a) 5 has not yet been adequately exposed to f during the training, or (b) + 6 may be indeed hard to be correctly classified for some noise samples d, so that minimizing the training loss at these noises could harm the classifier. The design goal of our proposed bottom- K Gaussian training is to modify the standard Gaussian training (5) to reduce the optimization burden from (b) while minimally retaining its ability to cover enough noise samples during training for (a).
To this end, we first consider M random i.i.d. samples of 8, namely 81, ō2,.... .ō. (O0 o²1). Then, one can notice that the random variables [f + 6,) = y)'s are also i..dd each of which follows the Bernoulli distribution of probability p. given that ( y) p. This means that, if the current Py (x, y) is the value one attempts to keep instead of further increasing it, the number of noise samples that should be correctly classified, which can be defined Σ, [[(( + 6,) v). would follow the binomial distribution, namely K ~ Bin(M, p). and this motivates us to consider the following loss that only minimizes the K K-smallest cross-entropy losses out of from M samples:
1 K M
7, 1000
Σ CF(F(x + )x()),)), where K Bin Py (x. v)).
Here, =i) denotes the noise index with the i-th smallest loss value in the M samples.
Yet, the loss defined in (6) may not handle the cold-start problem on py (2, y), e.g., at the early stage of the training where x + 8 has not been adequately exposed to f. so that I can be minimized too early with an under-estimated Py. We found that, however, a simple trick of clamping K with I can bypass the issue: i.e., we always allow the "easiest" noise among the M samples to be fed into throughout the training. In addition, we also found that it is still beneficial samples that are not within K, i.e., the "harder" ones, to ensure that they still have a certain level of confidence for the class y even if they are misclassified: here, as a simple design, we propose to truncate the cross entropy loss with log Po so that F, (x 8) can be at least Po, e.g., Po 20 as done in our experiments. In these respects, we re-define the loss in (6) as in the followings:
constrain the
M
1 =
1 M
Σ CE(F(x ( ()))). +
Σ <
[CE(F(# oz(1). v) + +log po] p
(7)
where K ~ Bin(M, K) K- == max (1, K), 11 := max(0, -., and po E (0, 1] is a hyperparameter. Note that the loss becomes the standard Gaussian training as Po + 1 and returns to (6) as Po + 0.
3.2 WORST-CASE GAUSSIAN TRAINING: LOSS FOR HIGH- HIGH-CONFIDENCE SAMPLES
Next, we focus on the case when (z. y) x 1, i.e., f has a high confidence at æ, as illustrated in Figure 2(b). In contrast the previous scenario in Section 3.1 (and Figure 2(a)), now the major
4

---

Under review as a conference paper at ICLR 2022
drawback of Gaussian training (5) does not come from the abundance of hard noises during training, but from the sparseness of such noises: considering that one can only present a limited number of noise samples to f throughout its training, naively minimizing (5) may not cover some "potentially hard" noise samples, and this would result in significant harm in certified radius especially at the regime of pf (3r, y) 1 as shown in Figure 1. The purpose of worst-case Gaussian training is to overcome this lack of samples via an adversarial search around each of the noise samples.
Specifically, given that have M samples of ó in (7), namely òi, d2,... .8M ~ (0,000111 we propose to modify (5) to find and minimize the worsl-case noise (a) around an b2lball for each noise as well as (b) among the M samples, instead of minimizing the average-case loss:
high == max
max |6 S
CE(F(x + 6)).
(8)
We use the projected gradient descent (PGD) (Madry et al., 2018) to solve the inner maximization in (8): namely, we perform a T -tep gradient ascent from each ó; with step size 2- E/T while projecting the perturbations to be in the f2-ball of size e. Here, although T and e can be hyperparameters that affect the inner maximization, also make sure that the likelihood of the optimized 8* as i.idd. Gaussian still remains high by simply normalizing the mean and standard deviation of 8* to follow those of the original 8.
simply fix them in our experiments by & 1.0 and T = 4. We
Comparison to SmoothAdv. The idea of incorporating an adversarial search for the robustness of smoothed classifiers has been also considered in previous works (Salman al., 2019; Jeong et al., 2021): e.g., Salman et al. (2019) have proposed SmoothAdy that applies adversarial training (Madry et al., 2018) to a "soft" approximation of f given ff and M noise samples:
x arg max
||= mml 25 (- log
EF M
Σ Fyla's + 63)
Our method is different from the previous approaches in which part of the inputs is adversarially optimized: i.e., we directly optimize the noise samples 0.'s instead of x, with no need to assume a soft relaxation of f. This is due to our unique motivation of finding the worst-case Gaussian noise, and our experimental results in Section 4 further support the effectiveness of this approach.
3.3 OVERALL TRAINING SCHEME
Given the two losses T,low and high defined in Section 3.1 and 3.2, respectively, we now define the full objective of our proposed Confidence-Aware Training for Randomized Smoothing (CAT- RS). Overall, in order to differentiate how to combine the two losses per sample basis, use the smoothed confidence (I, y) (4) as the guiding proxy: specifically, we aim to apply the worst-case loss of high only for the samples where (2 y) is already high enough. In practice, however, one does not have a direct access to the value of ( y) during training, and we estimate this with the M noise samples as done for Lo and bigh i.e. by Py (x, y) == M ΣM [[[( + 6,) = v)- Here, set simple condition of "py y) 1" to activate high and the final loss becomes:
L CAT 10x + X 1 (z, v) 1] bigh
(10)
where 1.: is the indicator random variable, and À > 0 a hyperparameter. The complete procedure of computing our proposed CAT-RS loss can be found in Appendix A.
4 EXPERIMENTS
In this section, we evaluate the effectiveness of our proposed training scheme compared to existing state-of-the-arr training methods for smoothed classifiers, based on two well-established benchmarks on MNIST (LeCun et al., 1998) and CIFAR- 10 (Krizhevsky, 2009) extensively in compliance to the standard protocol of the previous works (Cohen et al., 2019; Zhai et al., 2020; Jeong & Shin, 2020; Jeong et al., 2021). Overall, the experiments show that our method can consistently outperform the previous best efforts to improve the average certified radius by (a) maximizing the robust radii of high-confidence samples while (b) better maintaining the accuracy at low-confidence samples. We
In our experiments, we use M for our method unless otherwise noted.
5

---

Under review as a conference paper at ICLR 2022
Comparison of ACR and approximate certified test accuracy (%) MNIST. For each column, we set our result bold-faced whenever the value improves the Gaussian baseline. We mark the highest and lowest values of certified accuracy at each radius blue and red colors, respectively.
Table 1:
Methods
ACR
0.00
0.25
0.50
0.75
1.00
1.25
1.50
1.75
2.00
2.25
2.50
Gaussian (Cohen al., 2019)
0.910
99.2
98.5
96.7
93.3
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Stability (1. et 2019)
0.914
99.3
98.6
97.1
93.8
0.0
0.0
0.0
0.0
0.0
0.0
0.0
SmoothAdy (Salman al. 2019)
0.932
99.4
99.0
98.2
96.8
0.0
0.0
0.0
0.0
0.0
0.0
0.25 MACER (Zhai et al., 2020)
0.921
99.3
98.7
97.5
94.8
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Consistency (leong & Shin, 2020)
0.928
99.5
98.9
96.0
0.0
0.0
SmoothMix (Jeong al., 2021)
0.932
99.4
99.0
98.2
96.7
0.0
0.0
0.0
0.0
0.0
0.0
0.0
CAT-RS (Ours)
0.933
99.3
98.9
98.2
97.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Gaussian (Cohen et al., 2019)
1,557
99.2
98.3
96.8
94.3
89.7
81.9
67.3
43.6
0.0
0.0
0.0
Stability (Li et al., 2019)
1.573
99.2
98.5
97.1
94.8
90.7
83.2
69.2
45,4
0.0
0.0
0.0
SmoothAdy (Salman et al., 2019)
1.687
99.0
98.3
97.3
95.8
93.2
88.5
81.1
67.5
0.0
0.0
0.0
0.50
MACER (Zhai al., 2020)
1,583
98.5
97.5
96.2 2
93.7
90.0
72.2
0.0
0.0
0.0
Consistency (Joong & Shin, 2020)
1.655
99.2
98.6
97.6 6
95.9
93.0
87.8
78.5
60.5
0.0
0.0
0.0
SmoothMix (Jeong et al., 2021)
1.694
98.7
98.0
97.0
95.3
92.7
88.5
81.8
70.0
0.0
0.0
0.0
CAT-RS (Ours)
1.699
70.9
Gaussian (Cohen al., 2019)
1.619
96.3
94.4
91.4
86.8
79.8
70.9
59.4
46.2
32.5
19.7
10.9
Stability (Li et al., 2019)
1.636
96.5
94.6
91.6
87.2
80.7
71.7
60.5
47.0
33.4
20.6
11.2
SmoothAdy (Salman al., 2019)
1.779
73.7
1.00
MACER (Zhai et al., 2020)
1.598
91.6
88.1
83.5
77.7
71.1
63.7
55.7
46.8
38.4
29.2
20.0
Consistency (Jeong & Shin, 2020)
1.738
95.0
93.0
89.7
85.4
79.7
72.7
63.6
53.0
41.7
30.8
20.3
SmoothMix (leong al., 2021)
1,820
93.7
91.6
88.1
83.5
77.9
70.9
62.7
53.8
44.8
36.6
28.9
CAT-RS (Ours)
1,830
93.9
91.3
88.0
83.5
78.0
71.8
64.0
55.7
47.3
38,9
29.8
1.0
1.0
1.0
Gaeusene Slaceity
Cerifed socuracy
0.8
securayy
0.8
SmoothAdy
0.8
Gavesion
Sanoothhdvv
Stubilly
Siubilly
SmoothAdv
Condistency
Smoohhakk CAT-RS (ours]
MACER
0.4
MACER
64
0.8
Consistency
Consistoncy may
Smoothhii
022
Smoothhitx
0.2
CAT-RS (ours)
CAT-RS (ours)
0.7
6.
5.5
1.0
15
7.0
Radius
Recka
Rediu
(a)
0.25
(b)
0.50
(c)
1.00
Figure 3: Comparison of approximate certified accuracy for various training methods on MNIST. The sharp drop of certified accuracy in each plot is due to a strict upper bound in radius that CERTIFY can output for a given a, N = 100, 000, and a = 0.001.
also perform thorough ablation study on our loss design and confirm that (a) both of our proposed components have effectiveness to improve the certified robustness, and (b) the single hyperprameter A (10) between the two losses can balance the trade-off between robustness and accuracy.
Training setups. For fair comparison, we follow the training setup considered in most of the previous works to compare the performance of the smoothed classifiers (Cohen et al., 2019; Zhai et al., 2020; Jeong& & Shin, 2020; Jeong al., 2021): specifically, we mainly consider LeNet (LeCun et al., 1998) and ResNet- 10 (He et al., 2016) for MNIST and CIFAR-10, respectively, and consider three different scenarios of a 0.25, 0.5, and 1.0 for randomized smoothing. We train each model for 150 epochs with stochastic gradient descent (SGD) with a momentum of 0.9. The learning rates are initialized to 0.01 for MNIST and 0.1 for CIFAR-IO, and decreased by factor of 0. in every 50 epochs. We apply the same a for both training and evaluation. More details on the training setups, e.g., hyperparameters, can be found in Appendix B.
Baselines. We compare our method with an extensive list of baseline methods in the literature for training smoothed classifiers: (a) Gaussian training (Cohen et al., 2019) simply trains a classifier with Gaussian augmentation (5); (b) Stability training (Li et al., 2019) adds a cross-entropy term be- tween the logits from clean and noisy images; SmoothAdv (Salman et al., 2019) employs adversarial training for smoothed classifiers (9); (d) MACER (Zhai et al., 2020) adds regularization that aims to maximize a soft approximation of certified radius: (e) Consistency (Jeong & Shin, 2020) regular- izes the variance of confidences over Gaussian noise; (f) SmoothMix (Jeong et al., 2021) proposes mixup- based (Zhang et al., 2018) adversarial training for smoothed classifiers. Whenever possible, use the pre-trained models publicly released by the authors to reproduce the results.

---

Under review as a conference paper at ICLR 2022
GELEEAA (ouns)
Cartifed acsuney
0.8
wozureey
S.
0.6
MAlgHt
Senti by
0.6
Smoohhli CAT (oun
Certfed
CAT 241-5 (ears)
0.4
0.2
Radius
Radius
(a) 0.25
(b)
0.50
(c) L.00
Figure 4: Comparison of approximate certified accuracy for various training methods on CIFAR- 10. The sharp drop of certified aceuracy in each plot due strict upper bound radius that CERTIFY can output for a given N = 100, 000, and a 0.001.
Evaluation metries. We follow the standard evaluation protocol for smoothed classifiers (Salman et al., 2019; Zhai et al., 2020; Jeong & Shin, 2020; Jeong et al., 2021): specifically, Cohen et al. (2019) have proposed a practical Monte Carlo based certification procedure, namely CERTIFY, that returns the prediction of f and lower bound of certified radius, CR(f, a, æ)), over the randomness abstains the certification. Based on CERTIFY, consider two major evaluation metrics: (a) the average certified radius (ACR) (Zhai et al., 2020): the average of certified radii the test dataset Drest while assigning incorrect samples as 0, namely ACR == [ (a.yy) [CR(S, a, x) /(x)=y) and (b) the approximate certified test accuracy at r: the fraction of the test dataset which CERTIFY classifies correctly with the radius larger than without abstaining. We use n 100, 000, no 100, and a 0.001 for CERTIFY, following the previous works (Cohen et al., 2019; Salman et al., 2019; Jeong & Shin, 2020; Jeong et al., 2021).
of n samples with probability at least 1 -
4.1 RESULTS ON MNIST
We compare the certified robustness of the smoothed classifiers on MNIST from our method those from other baselines in Table 1. We also present in Figure 3 the plots of the approximate certified accuracy across varying r for a E (0.25, 0.5, 1.0]. Overall, the results show that our method of CAT-RS clearly surpasses all the other baselines in terms of ACR: i.e., our method could better balance between the clean accuracy and robustness. For o = 0.25, we notice that some baselines, i... SmoothAdv and SmoothMix, already achieve reasonably saturated level of ACR: even in this trivial task, our method could further improve the robust accuracy at r = 0.75 as 96.8% + 97.0%. In more challenging cases of a 0.5 and 1.0, the other hand, the improvements from CAT- RS in ACR become more evident as a increases: e.g., at o = 1.0, compared to SmoothMix (the best- performing baseline), CAT-RS could improve the certified accuracy while even improving the clean accuracy (i.e., certified accuracy at r = 0.0) by 93.7% + 93.9%. This means that our proposed CAT-RS can be more effective at challenging tasks, where it is more likely that a given classifier gets more diverse confidence distribution for the training samples, so that our proposed confidence-awe aware training can better play its role.
2.50 by 28.9% 29.8%
Accuracy-robustnes trade-off. To further validate that our method can exhibit better trade-ofi between accuracy and robustness compared to other methods, we additionally compare the perfor- mance trends between clean accuracy and certified accuracy at r 2.0 as we vary a hyperparameter to control the trade-off, e-g., X (10) case of our method. We use a = 1.0 for this experiment. We choose Consistency (Jeong & Shin, 2020) and SmoothMix (Jeong et al., 2021) for this com- parison, considering that they also offer a single hyperparameter (namely À and 17, respectively) for the balance between accuracy and robustness similar to method, while both generally achieve good performances among the baselines considered. The results plotted in Figure 5 clearly show that CAT-RS indeed exhibits a higher trade-off frontier compared to both methods, which confirms the effectiveness of our method. More detailed results can be found in Appendix C.
4.2 RESULTS CIFAR-10
Table 2 shows the performance of the baselines and our model on CIFAR-10. In Figure 4, also plot the approximate certified accuracy over the range of r for a E {0.25, 0.5, 1.0). In this experiment, for each a, the baseline models are individually chosen based on its "best" ACR, ie.,
7

---

Under review as a conference paper at ICLR 2022
Table 2: Comparison of ACR and approximate certified test accuracy (%) CIFAR-10. For each column, we set our result bold-faced whenever the value improves the Gaussian baseline. We mark the highest and lowest values of certified accuracy at each radius blue and red colors, respectively.
Methods
ACR
0.00
0.25
0.50
0.75
1.00
1.25
1.50
1.75
2.00
2.25
2.50
Gaussian (Cohen al., 2019)
0.424
76.6
61.2
42.2
25.1
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Stability (1. et al., 2019)
0.420
73.0
58.9
42.9
26.8
0.0
0.0
0.0
0.0
0.0
0.0
0.0
SmoothAdv (Salman al. 2019)
0.544
73.4
65.6
57.0
47.5
0.0
0.0
0.0
0.0
0.0
0.25
MACER (Zhai et al., 2020)
0.531
79.5
69.0
55.8
40.6
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Consistency (Jeong & Shin, 2020)
0.552
46.7
Smoothhix (Jeong al., 2021)
0.553
77.1
67.9
57.9
46.7
0.0
0.0
0.0
0.0
0.0
0.0
0.0
CAT-RS (Ours)
0.557
76.2
68.1
58.4
47.4
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Gaussian (Cohen al., 2019)
0.525
65.7
54,9
42.8
32.5
22.0
14.1
8.3
3.9
0.0
0.0
0.0
Stability (Li et 2019)
0.531
62.1
$2.6
42.7
33.3
23.8
16.1
4.7
0.0
SmoothAdy (Salman et al., 2019)
0.717
53.1
49.2
44.9
41.0
37.2
33.2
29.1
24.0
0.0
0.0
0.0
0.50
MACER (Zhai al., 2020)
0.691
57.5
42.3
20.2
0.0
Consistency (Joong & Shin, 2020)
0.720
64.3
57.5
50.6
43.2
36.2
29.5
22.8
16.1
0.0
0.0
0.0
SmoothMix (Jeong et al., 2021)
0.737
61.8
55.9
49.5
43.3
37.2
31.7
25.7
19.8
0.0
0.0
0.0
CAT-RS (Ours)
0.752
Gaussian (Cohen al., 2019)
0.511
47.1
40.9
33.8
27.7
22.1
17.2
13.3
9.7
6.6
4.3
2.7
Stability (Li et al., 2019)
0.514
43.0
37.8
32.5
27.5
23.1
18.8
14.7
11.0
7.7
5.2
3.1
SmoothAdy (Salman al., 2019)
0.790
1.00
MACER (Zhai et al., 2020)
0.744
41.4
38.5
35.2
32.1
29.3
26.4
23.4
20.2
17.4
14.5
12.1
Consistency (Jeong & Shin, 2020)
0.756
46.3
42.2
38.1
34.3
30.0
26.3
22.9
19.7
16.6
13.8
11.3
SmoathMix (leong al., 2021)
0.773
45.1
41.5
37.5
33.8
30.2
26.7
23.4
20.2
17.2
14.7
12.1
CAT-RS (Ours)
0,812
43.9
40.9
37.6
34.4
31.3
28.0
25.1
22.3
19.3
16,6
13.9
Certtedd Aps. Rt 22000))
60-
A0 0.29
Ceribed acourer
0.6
Carifidd accurayy
40-
66
Consietency Smoothhix
CAT-RS
20
90
Radius
Raddus
Ceann Acc.
(a) Effeect of po
(b) Efffect of À
Figure 5: Comparison of clean vs. certified accuracy at 2.0 on MNIST (a = 1.0) for meth- ods those offer trade-off control.
Figure 6: Comparison of certified accuracy of CAT-RS ablations on CIFAR-10. We use ResNet-20 for ablation study and plot the results at a = 0.5. More results can be found in Appendix D.
the hyperparameter of the same baseline may vary over a. For example, we choose the SmoothAdy baseline as the best model from the hundreds of hyperparameter configurations those examined by Salman et al. (2019) for each Overall, our method of CAT-RS achieves significant improvement of ACR compared to the baselines. In case of a = 0.25 and a = 0.5, for example, CAT-RS clearly offers better trade-off between the clean accuracy and robustness compared to SmoothAdy, in sense that (a) they achieve similar certified accuracy at large r, yet (b) CAT-RS could maintain much 0.5. For
higher clean accuracy, e.g., 53.2% - 60.2% in case of method significantly surpasses the previous best model, SmoothMix, by 0.773 - 0.812. As in MNIST, the improvement of CAT-RS is most evident in 1.0, demonstrating the effectiveness of confidence-award training. Furthermore, we observe that the performance gap between our method and the previous best model more significant in CIFAR-I0 because the higher complexity of CIFAR-10 10 compared to MNIST makes the confidence information more critical.
1.0, the ACR of our
4.3 ABLATION STUDY
We also conduct an ablation study to further analyze individual effectiveness of the design compo- nents in method. Unless otherwise specified, use ResNet-20 (He et al., 2016) throughout this section and test it on subsampled CIFAR-10 of size 500. We assume À = 1.0 and Po = 10 by default. We report the detailed results for this study in Appendix D.
Effect of Po- We introduce a hyperparameter Po in (7) to control how much we constrain the confidence of "hard" noises, that Po would lead the proposed 7, (7) into the standard
8

---

Under review as a conference paper at ICLR 2022
Table 3: Comparison of ACR and approximate certified test accuracy (%) varying components of CAT-RS on CIFAR-10. We assume = 0.5 in this experiment. The best ACR is bold-faced.
Method (CIFAR-10)
ACR
0.00
0.25
0.50
0.75
1.00
1.25
1.50
1.75
Gaussian
0.532
68.2
54.8
41.0
31.8
23.0
15.4
9.2
4.0
(a) o only
0,552
67.0
55,4
44.8
33.0
24.6
16.8
9.4
5.0
(b) L only
0.687
52.8
48.2
44.2
39.2
35.2
31.8
26.4
22.0
(c) L + X high
0.712
57.0
51.8
47.0
41.6
36.6
32.0
25.6
20.2
(d) L L (11)
0.692
60.2
54.0
46.8
41.0
35.8
28.6
22.8
17.4
L LA (Ours; (10))
0.717
58.4
52.2
45.4
41.2
36.6
33.6
26.4
20.2
Gaussian training. To verify its effectiveness, we conduct an experiment comparing the certified robustness of models with different Po E {0, 32 16 8 a 2: 1} on a (0.25. 1.0]: Table in Appendix D summarizes the results. Overall, we observe that setting Po < 1 is clearly beneficial to improve ACR for all the a considered, e.g., in case of a = 1.0 the method achieve the best 1
ACR when Po T6 32. and this confirms that our proposed loss of L (7) alone is superior to
the Gaussian training even without the effect from high (8). From the Figure 6(a) which plots the results at a = 0.5, one can observe that letting po - 0 leads the classifier to achieve a better robust accuracy with relatively little degradation in the clean accuracy.
Effect of X. By the definition in (10), À controls the contribution of L We evaluate the impact of À here, and the results are shown in Figure 6(b). We compare the performance of the models, varying À E {0.25, 0.5, 1.0, 2.0, 4.0] on a = 0.5. As expected, we observe that À balances the trade-off between robustness and clean accuracy; as increases, robustness increases while clean accuracy decreases. Also, in Table 7 in Appendix C, we verify that CAT-RS offers more effective trade-off between robustness and the clean accuracy than other methods. Further details can be found in Table 6 in Appendix D.
Loss design. Our loss design in (10) combines several important ideas proposed in Section 3, and here we validate that each of the components has an individual effect in improving the certified robustness. In Table 3, we compare several variants of our proposed CAT-RS loss (10), namely (a) using only Low (7), (b) using only L (8), and (c) L + high i.e., not applying the masking condition 1 ( y) = 1] to n.gggh, We also consider (d) a variant of T.high, where the outer max operation over noise samples (8) is replaced by the average, i.e, we define:
T.vg.nax
1 M -6i
max
CE(F(x (PFEx+))).))) 62).8)
(11)
We report the experimental results on a 0.5. Overall, CAT-RS achieves the best ACR and ap- proximate certified accuracy among the variants. We observe that Low alone improves Gaussian baseline, which highlights the importance of the confidence information for robust training. Also, L alone increases the robustness dramatically, while it sacrifices the clean accuracy. Combining [ and L high achieves better results by balancing robustness and accuracy. CAT-RS further im- proves the overall performance by simply masking out high for low- www-coniienntil predictions: i.e., when the confidence is not high enough, learning challenging adversarial samples harm the perfor- mance. By comparing the results made by using T,avg_nax and h.iggh we verify that it is more helpful for a model to utilize the most challenging adversarial examples instead of averaging them.
CONCLUSION
This paper explores a close relationship between confidence and robustness, a natural property of smoothed classifiers yet neural networks cannot currently offer. We have successfully leveraged this relationship to relax the hard-to-ccmpute metric adversarial robustness into an easier concept of prediction confidence. Consequently, we could propose a practical robust training method that enables a sample-level control of adversarial robustness, which has been difficult without heuristics in conventional belief. We believe work could be a useful step for the future research on exploring the interesting connection between adversarial robustness and confidence calibration (Guo et al., 2017; Lee et al., 2018) through the framework of randomized smoothing.

---

Under review as a conference paper at ICLR 2022
ETHICS STATEMENT
Deploying deep learning based systems into the real-world, especially when they are of security- concerned (Caruana et al., 2015; Yurtsever et al., 2020), still poses many potential risks for both companies and customers, and we researchers are responsible to make this technology more reliable through research towards Al safery (Amodei et al., 2016). Adversarial robustness is one of the central parts of this direction, and we believe our research on certified robustness can a useful step towards building practical yet secure deep learning system. Nevertheless, one should also recognize that adversarial robustness still a bare minimum requirement for reliable deep learning, and the future research should address how extend this restrictive notion of robustness into other challenging setups, e.g., corruption robustness (Hendrycks et al., 2020) and unrestricted attacks (Bhattad al., 2020), just to name few, establish practical sense of security for practitioners.
REPRODUCIBILITY STATEMENT
For the best practices to maintain the reproducibility of this paper, we have conducted our ex- periments on publicly available datasets, with the detailed descriptions for pre-processing in Ap- pendix B.I. We have documented a thorough specification on the experimental details, e.g., training setups, baselines, and evaluation metrics, in Section 4. have also fully specified all the hyperpa- rameters considered to reproduce the baselines as well as our results in Appendix B.2. The code to reproduce our results will be publicly available, as well as the pre-traine pre-trained models for our method.
REFERENCES
Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Con- crete problems in Al safety. arXiv preprint /606. 2016.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Cireumventing defenses to adversarial examples. In Proceedings of the 35th Interna- tional Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Re- search, pp. 274-283, Stockholmsmässan, Stockholm Sweden, 10-15 Jul 2018. PMLR. URL http: http::/proceedeee pttp///ppceeeeeeeeepeeee mlr. wwwps//eessseeeee wwwpess/v0//ttaall//e attaaaaaallllleeeea .hmml.
Anand Bhattad, Min Jin Chong, Kaizhao Liang. Bo Li, and D. A. Forsyth. Unrestricted adversarial examples via semantic manipulation. International Conference on Learning Representations, 2020. URL
net wwrum/ wiw.ammiddd_eeeeeeeeeem Saree___ghhhhte wH.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhari- wal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agar- wal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel Ziegler, Jeffrey Wu, Clemens Winter, Chris Hesse, Mark Chen, Eric Sigler, Ma- teusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCan- dlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learners. In Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin (eds.), Ad- vances in Neural Information Processing Systems, volume 33, pp. 1877-1901. Curran Asso- ciates, Inc., 2020. URL https: htttps://proceedinggg neurips wwtpurppscc/pppeeee wwtpppppe//////////ee.eep 1457c0d6bfcb4 66776611880 111.777881888111666ee11 Paper pdf.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, pp. 39-57. IEEE, 2017.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, and Aleksander Madry. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019.
Rich Caruana, Yin Lou, Johannes Gehrke, Paul Koch, Mare Sturm, and Noemie Elhadad. Intel- ligible models for healthcare: Predicting pneumonia risk and hospital 30-day readmission. In Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1721-1730, 2015.
10

---

Under review as a conference paper at ICLR 2022
Ting Chen, Simon Korbblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In Hal Daumé III and Aarti Singh (eds.), Pro- ceedings of the 37th International Conference Machine Learning. volume 119 of Proceed- ings of Machine Learning Research, pp. 1597-1607. PMLR, 13-18 Jul 2020. URL https:
//proceedings. ml pressppeessss... / v1 19 chen20j htmml.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.). Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 1310-1320, Long Beach, California, USA, 09-15 Jun 2019. PMLR. URL http: / //proceedings , ml press/ / v cohen1 9c. html.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks. In Doina Precup and Yee whye Tch (eds.), Proceedings of the 34th International Conference on Machine Learming. volume 70 of Proceedings of Machine Learning Research, pp. 1321-1330, International Convention Centre, Sydney, Australia, 06-11 Aug 2017. PMLR. URL http: pttp/eeeccenggsssee/ee
www.innnn....rr.r.mmeeeeeeeeeeee .ml...r...... www..prsss / v70 gooll 7 html.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp- 770-778, 2016.
Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang. Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, al. The many faces of robustness: A critical analysis of distrii-ittiiioonnn generalization. arXiv preprint arXiv:2006. 16241, 2020.
Jongheon Jeong and Jinwoo Shin. Consistency regularization for certified robustness of smoothed classifiers. In H. Larochelle, M. Ranzato, Hadsell, M. Balcan, and H. Lin (eds.), Ad- vances in Neural Information Processing Systems, volume 33, pp. sociates, Inc., 2020. URL https: htt.tts:::/pptooee httttp:://ppooeeddngs. neuriiggnnnneuussspp cttaps.cc//pee httpsssccpppppee///L..... /ttp://ie//////ee////e 77330e1 300e0ee3330eebllll ffe.o
Curran As-
pdd..
Jongheon Jeong, Sejun Park, Minkyu Kim, Heung-Chang Lee, Doguk Kim, and Jinwoo Shin. SmoothMix: Training confidence-calibrated smoothed classifiers for certified adversarial ro- bustness. In ICML. 202/ Workshop on Adversarial Machine Learning, 2021. URL https: / //openzeview.net wettt//ooommmddg////a
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, Depart- ment of Computer Science, University of Toronto, 2009.
Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278-2) Nov 1998. ISSN 1558-2256. doi: 10.1109/5.726791.
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium Security and Privacy (SP), pp. 672. IEEE, 2019.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confideece--alibrrteed classifiers for detecting out-of-distribution samples. In International Conference on Learning Representationss 2018. URL https:://// http:////ppeeeeeee///ooe net/ wwtp::entteotttteeeeeee for.morioiiooooo 2
Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with additive noise. Advances in Neural Information Processing Systems 32, pp. 1464-94744 Curran Associates, Inc., 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, To- wards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations, 2018. URL ht tttps:: : /wtp///eeeeeeeeeee//e/eeeeeeeeee net www.ororrrooor.o..oooooooo. 1id
Seyed-Mohsen Moosavi-Dezfoo Alhussein Fawzi, and Pascal Frossard. DeepFool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Com- pufer Vision and Pattern Recognition, pp. 2574-2581 2016.

---

Under review as a conference paper at ICLR 2022
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In Advances in Neural Information Processing Systems 32, pp. 11289-11221 Curran Associates, Inc., 2019.
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adver- sarially robust imagenet models transfer better? In ArXiv preprint arXiv:2007.08489 2020.
David Silver, Julian Schrittwieser, Karen Simonyan, Ioannis Antonoglou, Aja Huang, Arthur Guez, Thomas Hubert, Lucas Baker, Matthew Lai, Adrian Bolton, et al. Mastering the game of go without human knowledge. nature, 550(7776):354-3333 359, 2017.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry, On adaptive attacks to adversarial example defenses. In Advances in Neural Information Processing Systems, volume 33, 2020.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In International Conference on Learning Representa- tions, 2019. URL https::/cpenreviiee
net/ fest//foum?iiee (i-.oumnmidsssAAbexYY..
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, tukasz Kaiser, and Illia Polosukhin. Attention is all you need. In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (eds.), Advances in Neural Information Processing Systems, volume 30. Curran Asso- ciates, Inc., 2017. URL httpss://proceeeingg.
wttp:/nwwww.....peeeeeeeeee cc//paper/221//iile 2tt.c//eee1100000ccccaaa----aa00
pdf.
Oriol Vinyals, Igor Babuschkin, Wojeiech M Czamecki, Michaël Mathieu, Andrew Dudzik, Juny- oung Chung, David H Choi, Richard Powell, Timo Ewalds, Petko Georgiev, et al. Grandmaster level in starcraft ii using multi-agent reinforcement learning. Nature, 575(7782)350-354, 2019.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improv- ing adversarial robustness requires revisiting misclassified examples. In International Confer- ence on Learning Representations, 2020. URL https: https::////ppeeveee/e net forum? 1id=
rk 6FF
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In Jennifer Dy and Andreas Krause (eds.), Proceedings of the 35th Inter- national Conference Machine Learning, volume 80 of Proceedings of Machine Learning Re- search, pp. 5295, Stockholmsmässan, Stockholm Sweden, 10-15 Jul 2018. PMLR. URL http: http:::/ppoceeeiing... mlrr. prwss/ 2t00///onglll .....8ahhhh. html.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gen- eralization. In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin (eds.), Ad- vances in Neural Information Processing Systems, volume 33, pp. 2958-2969, Curran Asso- ciates, Inc., 2020. URL https: https:://proceediigg 0TS.111112..14411111166666620000 pdf.
neurips wtt.ipp.....pppeee wttpc/ppppp//////1eeee.eee
Kai Y. Xiao, Vincent Tjeng, Nur Muhammad (Mahi) Shafiullah, and Aleksander Madry. Training for faster adversarial robustness verification via inducing ReLU stability. International Confer-
ence on Learning Representations, 2019. URL https: htttp::/oppeneev// /owpnrevieeeeeeeeeeeeeeeeee net forum?id BJfIVjAcKm.
Ekim Yurtsever, Jacob Lambert, Alexander Carballo, and Kazuya Takeda. A survey of autonomous driving: Common practices and emerging technologies. IEEE Access, 8:58443-58469, 2020.
Rumtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. MACER: Attack-free and scalable robust training via maximizing certi- fied radius. In International Conference on Learning Representations, 2020. URL https: / //operreview. net/ffoumm d
12

---

Under review as a conference paper at ICLR 2022
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 7472-7482, Long Beach, California, USA, 09-15 Jun 2019. PMLR. URL. http: //proceedings ngs mlr wtt.s.ml..................e / 9 zhangl 9p. html.
Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond em- pirical risk minimization. In International Conference on Learning Representations, 2018. URL
https::/ http:///ppeeeeeeeeeeeeee .we.et/.//e.eeeeeeeeee /
Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane Boning. and Cho-Jui Hsich. Towards stable and efficient training of verifiably robust neural networks. In International Conference on Learning Representations, 2020a. URL ht / /opereview. net/ fert/form?? d=5kxuk rFwB.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In Hal Daumé III and Aarti Singh (eds.). Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pp. 11278-11287 PMLR, 13-18 Jul 2020b.
A TRAINING PROCEDURE OF CAT-RS
Algorithm Confidence-Awwarr Training for Randomized Smoothing (CAT-RS)
Require: training sample (I, y). smoothing factor number of noise samples M 0. truncation probability po E (0, 1]. regularization strength À >> 0. attack norm > 0.
1: Sample 8,, 60 ~ (N I"
2: py Nf E, [[f + 6,) = y]
3: // //CMPUTE THE BOTTOM-A K LOSS
4: Sample K ~ Bin(M,
5: K+ < max(1, (1, K)
6: for i - to M do
7: Li + CCE(F(2 + 8.),5)
8: end for
9: Li + argsort(( L1:M)
10: L + NJ 1
1 L + D Kt +1 (Lā + +)
// COMPUTE THE WORST-CASE LOSS
12: for i to M do
8, f arg max -. CE(F(# +
end for
15: Lhigh + max; (Z + 8,), y)
16: // COMPUTE THE CAT-RS LOSS
17: L CAT-RS +- Lov + X 1b6 1] high
13

---

Under review as a conference paper at ICLR 2022
B EXPERIMENTAL DETAILS
B.1 DATASETS
MNIST (LeCun al., 1998) consists of 70,000 gray-scale hand-written digit images of size 28x28, 60,000 for training and 10,000 for testing, where each is labeled to one value between 0 and 9, We do not perform any pre-processing except for normalizing the range of each pixel from 0-255 to 0-1. The dataset can be downloaded at http::// //yann, lecun. com/ htte//xxb///ne/ /mnist/.
CIFAR-10 (Krizhevsky, 2009) consists of 60,000 RGB images of size 32 x32 pixels, 50,000 for training and 10,000 for testing, where each is labeled to one of 10 classes. We use the standard data- augmentation scheme of random horizontal flip and random translation up to 4 pixels, following the practice of other baselines (Cohen et al., 2019; Salman et al., 2019; Zhai et al., 2020; Jeong & Shin, 2020; Jeong et al., 2021). We also normalize the images in pixel-wise by the mean and the standard deviation calculated from the training set. The full dataset can be downloaded at https: //www. cs. toronto. edw/-kriiie far .htll.
B.2 HYPERPARAMETERS
Stability training (Li et al., 2019) uses a single hyperparameter y to control the relative strength of the regularization term. We fix y = 2 for MNIST experiments. For CIFAR-10 10 experiments, 7 2 is used for a = 0.25, 0.5, and 7 = is used for a = 1.0.
Adv (Salman et al., 2019) uses three major hyperparameters to perform the projected gra- dient descent: namely, the attack radius in terms of f2-norm e, the number PGD steps T, and the number of noises In our experiments, and m = 4 as well. In case CIFAR-10, on the other hand, we report the results chosen among the list of "best" configurations for each noise level which are previously searched by Salman et al. (2019): specifically, we report the results of g = 1.0 and m = 4 for a = 0.25, and & = 2.0 and m 2 for 0.5, 1.0. When SmoothAdv is used, we adopt the warm-up strategy, i.e., we initially set = 0.0 and linearly increase to the target value of 8 for 10-epochs.
fix T = 10. For MNIST experiments,
fix 1.0
MACER (Zhai al., 2020) introduces four hyperparameters: namely, the number of noises k; the coefficient for the regularization term X, the clamping parameter for maximizing the certified radius 7. and the temperature scaling parameter 3. For the MNIST experiments, we use
16, 8.0, = 16.0, and X = 16.0 when a = 0.25, 0.5, following the configurations in Zhai et al. (2020). When α 1.0, for the training to succeed, we set = 6.0. For the CIFAR-10 experiments, we follow the original configurations used by Zhai et al. (2020). We set k = 16, 8.0, and , = 16.0. is set to be 12.0 and 4.0 for a = 0.25 and 0.5, respectively. For a = 1.0, the training starts with A 0 until the first learning rate decay and we set À = 12.0 thereafter.
Consistency (Jeong Shin, 2020) uses two hyperparameters: namely, the coefficient for the con- sistency term 1/ and those for the entropy term 7. We report the best results in terms of ACR among those reported by Jeong & Shin (2020) varying 7). Following the original practice, we fix y = 0.5 throughout our experiments. For MNIST, we use À = 10 for 0.25 and À = 5 for other noises. For the CIFAR-10 experiments, we use = 20 for o = 0.25 and À = 10 for other noises.
SmoothMix (Jeong et al., 2021) introduces four hyperparameters: namely, the coefficient for the mixup loss 77, the step size for adversarial attack a, the number of steps for adversarial attack T, and the number of noises T. For the MNIST experiments, we fix " 5.0, a 1.0, and m 4. T = 2, 2,4, 8 are used for the models with a = 0.25, 0.5, 1.0, respectively. For the CIFAR-10 experiments, we again report the best result among those reported from Jeong et al. (2021): i.e. we fix 5.0, m = 2, and T' = 4, and use a = 0.5, 1.0, 2.0 for a = 0.25, 0.5, 1.0, respectively. The "one-step adversary" is used for 0.5, 1.0 follow the "best" configurations.
CAT-RS (Ours). CAT-RS uses two main hyperparameters: namely, the coefficient for "worst-case" loss À and the clamping parameter for maximizing the confidence of "hard" samples Po- For the MNIST experiments, we use the fixed configuration of À = 1.0 and Pa = } For the CIFAR-10 experiments, we use À 0.5, po 2n for a 0.25, and À = 2.0, po TO for = 0.5 and 1.0.
14

---

Under review as a conference paper at ICLR 2022
C COMPARISON OF ACCURACY-ROBUSTTESS TRADE-OFF
1.85
50
stancy
1.80
R-1.0
82
SimeothMx
CAT-RB (ours)
45
1.75
1.70
1.65
Consistrnyy
35
Conderennyy
SmouPMM
1.60
(ours)
(ours)
83
96
30
95.0
95
96.0
90.5
97.0
82
90
97
Clean
190
(a) ACR
(b) Certified accuracy at 1.0 (c) Certified accuracy at 2.0
Figure 7: (a): Comparison of the trends between the clean accuracy ws. (a) ACR, (b) the certified accuracy at r 1.0, and (c): the certified accuracy at 2.0, that each method exhibits as varying its hyperparameter. We assume MNIST dataset with 1.0 for this experiment.
Table 4: Comparison of ACR and approximate certified test accuracy MNIST for varying hyper- parameters of three different methods: Consistency, SmoothMix, and CAT-RS (ours). We assume 1.0 this experiment. "Gaussian" indicates the baseline Gaussian training. Consistency and SmoothMix degenerates to Gaussian when their hyperparameter is set to 0.
Methods
Setups
ACR
0.00
0.50
1.00
1.50
2.00
2.50
Gaussian
1.620
96.4
91.4
79.9
59.6
32.6
10.8
1.714
96.0
91.2
81.1
63.5
39.2
16.2
A 5
1.740
95.0
89.7
79.9
63.7
41.9
20.0
Consistency
10
1.735
94.1
88.6
78.5
62.8
42.4
22.1
A 15
1.731
93.6
87.7
77.8
62.3
42.6
22.9
20
1.720
93.0
86.6
77.1
61.6
42.1
23.4
A 25
1.226
73.2
64.4
53.9
42.4
27.4
14.5
1 2
1.789
95.5
90.5
80.7
64.1
43.1
24.1
1.810
94.9
89.7
79.6
63.8
44.4
26.6
SmoothMix
7 = 4
1.820
94.0
88.4
78.3
63.0
44.9
28.7
8
1.817
93.4
87.5
77.3
62.4
44.8
29.3
7 = 16
1.812
92.9
86.7
76.6
61.8
44.5
29.6
À = 0.00
1.675
96.9
92.1
81.8
62.7
35.4
12.4
À 0.12
1.770
96.0
91.3
81.3
64.7
42.7
20.9
À = 0.25
1.799
95.5
90.5
80.7
64.8
44.2
24.5
CAT-RS
À 0.50
1.820
94.9
89.5
79.6
64.5
45.7
27.4
(Ours)
A 1.00
1.830
93.9
88.0
78.0
64.0
47.3
29.8
À 2.00
1.820
92.0
85.4
75.5
62.7
47.8
31.8
À 4.00
1.788
89.0
82.0
72.8
62.1
48.7
32.6
15

---

Under review as a conference paper at ICLR 2022
D DETAILED RESULTS ON ABLATION STUDY
Table Comparison of ACR and approximate certified test accuracy (%) varying Po on CIFAR-IO. For each d, set ACR bold-facee when it achieves the best among variants.
CIFAR-10
Certified accuracy (%)
Setups
ACR
0.0
0.25
0.5
0.75
1.0
1.25
1.5
1.75
2.0
2.25
1/po 1.0
0.536
71.6
64.2
56.8
47.8
0.0
0.0
0.0
0.0
0.0
0.0
1 po = 2.0
0.524
69.4
62.4
56.0
46.2
0.0
0.0
1/po = 4.0
0.538
71.8
63.6
56,0
48.0
0.0
0,0
0.0
0.0
0.0
0.0
0.25
1/po 8.0
0.522
67.2
61.8
54.8
47.4
0.0
0.0
0.0
0.0
0.0
0.0
1 /PP 16.0
0.515
67.6
61.2
52.8
46.6
0.0
0.0
I I/DO = 32.0
0.523
68.4
62.2
55.2
45.8
0.0
0.0
0.0
0.0
0.0
0.0
I/po
0.508
65.4
59.8
53,4
45.4
0.0
0.0
0.0
0.0
0.0
0.0
1/Po 1.0
0.700
62.4
56.6
48.4
40.2
34.4
28.8
23.0
18.2
0.0
0.0
1/po 2.0
0.690
61.4
54.4
47.0
40.0
34.6
28.2
22.2
16.8
0.0
0.0
1 Pa = 4.0
0.707
61.8
54.6
46.8
40.8
35.0
30.0
24.6
18.6
0.0
0.0
0.50
1 PO = 8.0
0.705
58.0
54.6
45.6
41.8
36.4
31.0
24.0
18.8
0.0
0.0
PO 16.0
0.713
56.4
53.2
48.0
41.4
36.2
30.6
25.6
20.8
0.0
0.0
1 PO = 32.0
0.707
56.4
52.6
47.6
39.6
36.4
25.4
21.2
0.0
0.0
I/Do = DO
0.714
57.2
52.0
46.4
41.0
35.8
31.8
26.8
22.0
0.0
0.0
1/Po = 1.0
0.716
48.2
41.2
37.6
32.0
27.4
24.0
20.6
17.8
15.0
13.0
1 PO 2.0
0.732
47.0
44.0
38.2
33.2
26.4
22.6
20.6
17.4
16.2
13.4
1/Do 4.0
0.743
46.4
41.4
37.0
32.8
27.8
25.4
21.2
18.6
16.0
13.4
1.00
1/ PU = 8.0
0.787
45.8
42.0
38.6
33.8
30.4
25.6
22.6
20.0
17.8
15.4
1/ PO 16.0
0.815
45.2
41.2
39.4
34.2
30.8
28.2
23.8
19.6
17.4
15.6
1 PO 32.0
0.815
45.2
41.6
38.0
33.8
31.2
28.4
24.2
20.4
17.0
15.8
Po = DO
0.784
44.6
40.8
37.2
34.0
30.2
25.8
22.4
19.6
17.0
15.0
Table 6: Comparison of ACR and approximate certified test accuracy (%) for varying À on CIFAR- 10. We assume 0.5 in this experiment. For each column, the best value bold-faced.
CIFAR-10 10
Certified accuracy (%)
Setups
ACR
0.0
0.25
0.5
0.75
1.0
1.25
1.5
1.75
À 0.25
0.681
65.4
57.0
49.0
40.4
32.6
27.4
19.8
14.4
À 0.50
0.704
62.2
56.4
47.2
39.6
36.0
29.6
23.0
17.0
À 1.00
0.717
58.4
52.2
45.4
41.2
36.6
33.6
26.4
20.2
A 2.00
0.719
53.6
49.0
45.0
41.2
37.8
34.2
29.6
22.8
À 4.00
0.720
52.4
49.2
44.2
41.0
38.0
34.4
29.4
24.8
Table 7: Comparison of ACR and approximative certified test accuracy (%) for varying M CIFAR-10, We assume o = 0.5 in this experiment.
CIFAR-10
Certified accuracy (%)
Setups
ACR
0.0
0.25
0.75
1.0
1.25
1.5
1.75
M = 0.667
63.6
55.4
47.0
38.6
33.4
25.8
19.0
14.8
M 2 0.689
60.8
54.4
46.8
40.8
35.0
28.8
22.8
17.6
M = 4 0.717
58.4
52.2
45.4
41.2
36.6
33.6
26.4
20.2
M 0.708
55.4
49.8
45.0
40.8
36.4
33.0
27.4
21.8
16


Reviews:
[{"review_id": "aAUO9TFova5", "reviewer": "Reviewer_dpjw", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n+The studied problem is important\n+Paper is easy to follow \n\nWeaknesses\n-Novelty is limited \n-Insufficient evaluation \n-Missing important references\n\nHow do you make predictions during the training process, e.g., how do you obtain $\\hat{p}_f $ in line 2 in Algorithm 1? Going forward, what’s the computational complexity of the proposed method? \n\nThe loss $L^{(high)}$ is only evaluated when  $\\mathbb{1}[(\\hat{p}_f=1)]$?  How many training samples with the associated generated noises make $(\\hat{p}_f=1$. I thinks this is a very strong constrain on my end. \n\nWhy $p_0$ is limited to the range (0,1], instead of $(1, \\infty)$? \n\nThe proposed method obtains comparable performance with the existing methods. How about the running time?\n\nThere is no result on the ImageNet.  \n\nThe following paper also considers model’s confidence. Please discuss with it.  \n\nKumar et al., “Certifying Confidence via Randomized Smoothing” \n\n\nThe following papers also derive certified robustness based on randomized smoothing \n\nWang et al. “Certified robustness of graph neural networks against adversarial structural perturbation via Randomized Smoothing”\n\nJia et al., “Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing” \n\nZhang et al., “Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Framework”\n\nMohapatra et al., “Higher-Order Certification for Randomized Smoothing”\n\nKumar et al., “Certifying Confidence via Randomized Smoothing”\n\nKumar et al., “Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness ”\n\nFischer  et al., “Certified Defense to Image Transformations via Randomized Smoothing”\n\nLee et al., “Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers”\n", "summary_of_the_paper": "The paper studies certified robustness via randomized smoothing (RS). RS has a fundamental accuracy and robustness tradeoff. The authors aim to enhance such tradeoff through a sample-wise control of robustness over the training samples. In particular, the authors investigate the correspondence between robustness and prediction confidence of smoothed classifiers and design a new loss function. The proposed method is evaluated on MNIST and CIFAR10.  ", "summary_of_the_review": "The studied problem is important and paper is easy to follow. However, the novelty is limited and the evaluation is insufficient.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "_955q8FI3NF", "reviewer": "Reviewer_5emU", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Major comments:\n- The paper proposes a pretty novel method to boost the training for certified robustness. The experiments look descent to me although the hyperparameter selection seems random to me. I wonder if a cross-validation is performed.\n- The intuition behind the loss of high-confidence samples is that the noise samples provided is limited, which cannot guarantee the real $p_f(x,y)$ to be close enough to 1. This is especially important especially for ACR as increasing $p_f(x,y)$ can increase the certified radius more when $p_f(x,y)$ is closer to 1. However, the method used by the authors seems a little arbitrary to me. They find the worst noises within the $\\ell_2$-ball of sampled noise by PGD, and somehow normalize the worst noise. Unlike SmoothAdv or simply increasing the number of samples, there is no clear reason why this should work. \n- The intuition behind low-confidence part is also natural, basically giving ways to high-confidence part. I think the authors have done that part pretty well.\n\nMinor comments:\n- $K$ is used as the number of classes and the binomial random variable.\n- Sec 3.1, para 2, $p$ is not known here, so I think the $p$ in binomial distribution should be the empirical estimation $\\hat p$.\n- Sec 3.2, define $\\delta^*$ and how it is normalized.\n- Why is the binomial distribution necessary? You can probably just set $K$ to be the $pM$. \n- In Table 3, row (b), do you include the masking condition to $L^{high}$? If not, what is the performance if the condition is applied?", "summary_of_the_paper": "This paper proposed new loss functions during the training of classifiers for certified robustness via randomized smoothing. The new loss function treat samples with different confidence level differently. The main idea is to prioritize samples with high confidence because it provides more additional certified radius when its confidence grows.", "summary_of_the_review": "My current assessment of this paper is slightly below the threshold because I am not very satisfied with the high-confidence part. I would like to hear from the authors about the mathematical intuition behind the current loss.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "Irqx7x6ZY-u", "reviewer": "Reviewer_girT", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "While the provided experimental results look promising, the designed loss function (especially for the low-confidence loss) seems to be very complicated in my perspective and the explanation in Section 3 are not clear enough to support such design. In particular, I have the following questions for authors to provide more clarifications:\n\n1. The proposed CAT-RS loss relies on the prediction confidence of a classifier f for selecting examples. Is such f trained in advance or iteratively updated over the training process? How do you obtain the final certified smoothed classifier?\n\n2. I do not understand the design of Equation (7) for the low confidence examples. Discussions in Section 3.1 do not give a clear picture on such specific design choice. Can you provide a clarification on this? \n\n3. Follow the previous question, the cold start problem mentioned in Section 3.1 is also confusing to me. Why Equation (6) leads to a cold start problem? Why Equation (7) resolves this issue? The authors use many terms like “the easiest noise” and “harder ones” in the paragraph above Equation (7), which are vague and hard to parse.\n\n4. Figure 1 and Figure 2 are not well-explained. What do you mean by p_f=0.9 in Figure 1? Is it computed for a single example or computed as an averaged score for the whole dataset? What does areas with different colors represent in Figure 2? I do not understand the colored cross mark in Figure 2 as well.\n\nOther comments:\n\n1. The whole procedure for obtaining the final randomized smoothed classifier should be described in addition to the training loss.\n\n2. It would be better to provide experiments on larger dataset such as Image-Net.\n\n", "summary_of_the_paper": "This paper proposes a loss function for training the base classifier for randomized smoothed classifiers. Specifically, the loss distinguishes between training examples with high prediction confidence and those with low confidence. Several empirical tricks are applied to design the loss function to optimize the performance. Experiments on MNIST and CIFAR-10 show that the proposed training method is superior to existing state-of-the-art randomized smoothed classifiers, especially when the radius r is large.", "summary_of_the_review": "In summary, the empirical results of the paper show advantages of the proposed training objective in producing better certified smoothed classifiers. However, given the current low clarity of the paper, especially when introducing the design of the proposed loss function, I suggest a weak reject for this work.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "7D-qG2Bilkb", "reviewer": "Reviewer_6h9p", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This paper focuses on improving the certified robustness via training a better base classifier for randomized smoothing. The empirical analysis of \"hard\" and \"easy\" training samples is novel and innovative, which backs up the proposed losses. However, the experimental results do not provide strong empirical evidence on the effectiveness of the proposed method, and some important evaluation data, like results on ImageNet, running time statistics, etc, are not reported.\n\nStrengths:\n- The analysis, including the separation of \"hard\" and \"easy\" training samples and different treatments for them, is novel and interesting.\n- The paper is very well written. The narration is coherent. The proposed method is clearly backed up by explanations.\n\nWeaknesses:\n- Based on the existing experimental results, the effectiveness of the proposed method is not apparent.\n\nI appreciate that major baselines in this field are included in the experimental evaluation.\n\nIn terms of ACR, the proposed approach achieves state-of-the-art. However, the margin is not large enough, only except CIFAR-10 sigma=1.00 case. The authors claim that the method may be more significant on dataset with high complexity. Then IMHO, ImageNet results are inevitable to support this.\n\nIn terms of certified test accuracy, the proposed approach cannot achieve good benign accuracy or high certified accuracy under small radius though this is one of its primary goals (a better trade-off between robustness and accuracy). On CIFAR-10, the empirical performance seems to be better. However, the proposed method still cannot improve the accuracy under all radii compared with Gaussian (Cohen et al), and under most radii, the performance improvements are within 1.5%.\n \n- Lack of ImageNet results.\n\nAll the compared baselines are evaluated on ImageNet. The high certified robustness on the standard ImageNet dataset is one of the unique strengths of randomized smoothing, and evaluation on ImageNet provides a more complete landscape on the method's performance on complex and large-scale datasets. Without ImageNet, it is hard to fairly evaluate the approach.\n\n- Lack of training time statistics.\n\nThe M=4 intuitively would make the training process take > 4 times longer than Gaussian (Cohen et al), > 2 times longer than Consistency (Jeong et al), and about the same time as SmoothAdv (with m=4). Is it true? Then we may need to consider whether it is valuable to take a much longer time to obtain a small improvement.\n\nQuestions:\n- On what set are the models evaluated?\nIs the evaluation conducted on a uniformly picked subset of the full test set as other baselines? If so, is the set size 1000?\n- Can you report the upper contour results across different sigma's for a clearer comparison?\n- If the experiment results on ImageNet are provided, based on those results, I will re-evaluate this work.\n\nSuggestion on the method:\n- Maybe you can also try to assign different weights to the training samples. For example, if $p_f(x,y)$ is already high, we may sample more (e.g., set M=8/16 for each sample) to have a more precise estimation of $p_f(x,y)$, then assign higher weights to the sample with larger $p_f(x,y)$, since improvement on that sample would contribute more to ACR.\n- In $L^{\\mathtt{high}}$ loss, you first find $\\delta^*$ then normalize them. Maybe you can incorporate the normalization inside - applying PGD on $\\mathrm{normalized}(\\delta^*)$.", "summary_of_the_paper": "This paper proposes CAT-RS which combines two novel losses for training base classifiers for randomized smoothing. The two novel losses aim at preserving clean accuracy for hard samples and improving the certified radius for easy samples. In term of ACR (average certified radius), the method achieves state-of-the-art on MNIST and CIFAR-10.", "summary_of_the_review": "I appreciate the analysis and the novelty of the proposed training method. However, the current loss design seems to be not effective enough, and there are a few important details missing in the experimental evaluation. Therefore, I do not lean towards acceptance. The authors may try to follow the proposed principle to improve the detail design of the current training approach.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This authors seek to improve upon previous work on randomized smoothing for certifiably robust models. They develop loss functions inspired by the notion of distinguishing hard and easy samples while training the base classifier that is randomly smoothed and conduct experiments evaluating their proposed losses on benchmark datasets.

While the reviewers agree that the paper contains interesting ideas, the paper in its current form is unacceptable for publication because:
1) Missing large scale experiments: All prior work on randomized smoothing report results on ImageNet, and this was seen as one of the main advantages of randomized smoothing. Since the authors do not report this, it brings into question the robustness and scalability of improvements obtained.
2) Computational complexity and improvements: The authors' approach has significant computational complexity and the final improvements obtained are marginal. This makes it difficult to justify the use of a more expensive method.
Decision: Reject