SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustness
Authors: Jongheon Jeong
Sejun Park
Minkyu Kim
Heung-Chang Lee
Doguk Kim
Jinwoo Shin
Venue: NeurIPS 2021 Poster (2021)
Keywords: randomized smoothing
mixup
adversarial robustness
certified defense
adversarial defense
confidence calibration

Abstract: Randomized smoothing is currently a state-of-the-art method to construct a certifiably robust classifier from neural networks against $\ell_2$-adversarial perturbations. Under the paradigm, the robustness of a classifier is aligned with the prediction confidence, i.e., the higher confidence from a smoothed classifier implies the better robustness. This motivates us to rethink the fundamental trade-off between accuracy and robustness in terms of calibrating confidences of a smoothed classifier. In this paper, we propose a simple training scheme, coined SmoothMix, to control the robustness of smoothed classifiers via self-mixup: it trains on convex combinations of samples along the direction of adversarial perturbation for each input. The proposed procedure effectively identifies over-confident, near off-class samples as a cause of limited robustness in case of smoothed classifiers, and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness. Our experimental results demonstrate that the proposed method can significantly improve the certified $\ell_2$-robustness of smoothed classifiers compared to existing state-of-the-art robust training methods.

SmoothMix: Training Confidence-calibratee Smoothed Classifiers for Certified Robustness
Jongheon Jeong'
Sejun Park2*
Minkyu Kim²
Heung-Chang Lee"
Doguk Kim
Jinwoo Shin
"Scooo of Electrical Engineering, KAIST Vector Institute for Artificial Intelligence
$ Kim Jaechul Graduate School of AI, KAIST *Kakao Enterprise
Department of Artificial Intelligence, Inha University
{ jongheonj, minkyu. kim, (kavoss) kc
sejun. waw.uppaarrvveeoiinsttt...
andrew mndreew.comkkakkteetttrrrieeee.. com dgkim@inha.c ac. kr
Abstract
Randomized smoothing currently state-of-the-arr method to construct a certi- fiably robust classifier from neural networks against fy-adversarial perturbations. Under the paradigm, the robustness of a classifier is aligned with the prediction confidence, i.e., the higher confidence from smoothed classifier implies the better robustness. This motivates us to rethink the fundamental trade-off between accu- racy and robustness in terms of calibrating confidences of smoothed classifier. In this paper, we propose a simple training scheme, coined SmoothMix, to control the robustness of smoothed classifiers via self-mixup: trains convex combinations samples along the direction of adversarial perturbation for each input. The proposed procedure effectively identifies over-confident, near off-class samples a cause of limited robustness case of smoothed classifiers, and offers an intuitive way adaptively set new decision boundary between these samples for better robustness. Our experimental results demonstrate that the proposed method can significantly improve the certified fg-robusssess smoothed classifiers compared to existing state-of-ther -hrt robust training methods."
Introduction
Adversarial examples [53, 17] in deep neural networks clearly highlight that neural networks often generalize differently from humans, least without an additional prior of local smoothness of predic- tions with respect the input space: adversarially-cratte yet imperceptible input perturbation can drastically change the prediction of a neural network based classifier. Due to the intrinsic complexity of neural networks, however, the community has noticed that it is extremely hard directly encode this smoothness prior into neural networks [6. 3. 55], especially without relying on adversarial training [40, 66), i.e., augmenting training data with its adversarial examples. Even with adversarial training. (a) the non-convex, minimax nature of the training introduces many optimization difficulties, often resulting in harsh over-fitting [51, 47], and (b) it is generally hard to provably guarantee that the learned classifier is indeed smooth.
Work done KAIST.
Work done at Kakao Enterprise.
Code available https: tttps://githuee com/ http:/cojoooo////ooooooooooo smootnii...
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

up
dnx
(a) Adversarial training [40]
(b) SmoothAdv [49]
(c) SmoothMix (Ours)
Illustrations of how each training method obtains adversarial robustness: adversarial training [40] considers an e-ball around each sample and corrects adversarial examples found in these balls; SmoothAdv [49] directly employs adversarial training on smoothed classifiers; SmoothMix (ours) can be differentiated from SmoothAdv as it (i) does not assume an explicit norm restriction on adversarial examples, and (ii) applies mixup [67] instead of correcting the adversarial examples.
Figure 1:
Randomized smoothing [33, 11] is relatively a recent idea that aims to indirectly encode the smooth- ness prior: Cohen et al. [11] have shown that any classifier, regardless of whether it is smooth not, can be transformed into certifiably robust classifier via averaging its predictions over Gaussian noise, where the (certified) robustness of the classifier depends on how well the base classifier performs with the noise. Compared to adversarial training, this notion of "indirect" smoothness can be favorable in a sense that (a) it is easier optimize, and (b) offers a provable guarantee on the robustness. Currently, randomized smoothing is considered as the state-of of-the-art approach in the context of building a neural network based classifier that is certifiably robust on f2-perturbations [39].
In this respect, a growing body of research has focused on improving the robustness guarantee that randomized smoothing can give, e-g-, via different smoothing measures [34, 62] improved certification procedures [14, 43]. One of important directions on this line of research is to investigate which training of the base classifier could maximize the certified robustness of smoothed classifiers [49, 65, 23J. In particular, Salman et al. [49] have proposed SmoothAdy, showing that employing adversarial training [40] for smoothed classifiers could further improve the robustness, akin the standard neural networks. This motivates us to develop a new form of adversarial training, more specialized for smoothed classifiers.
Contribution. In this paper, we propose SmoothMix, a novel adversarial training method designed for improving the certified robustness of smoothed classifiers. One of the key features that smoothed classifiers offer is a direct correspondence from prediction confidence to adversarial robustness: achieving higher confidence in a smoothed classifier implies that the classifier can give better certified robustness. Inspired by this, we found that the certified robustness a given data sample can be significantly decreased by nearby off-class but over-confident [45] inputs: such "harmful" inputs would occupy an unnecessarily large robust radius near the sample of our interest, especially when they do not contain much information to be discriminated by the classifier.
Under the finding, we aim to calibrate the confidence of these off-class inputs to improve the certified robustness at the original input. More specifically, first observe that such over-confident examples can be efficiently found along the direction of adversarial perturbations for a given input. Then, suggest to regularize the over-confident predictions along the adversarial direction toward the uniform prediction through a mixup loss [67] (see Figure for an overview). This new approach of incorporating adversarial examples effectively permits more distant examples in training, even when they go off-class, based on the local-smoothness of smoothed classifiers. It also suggests an intuitive way of defining confidence beyond the given data samples smoothed classifiers.
We evaluate our proposed SmoothMix against with various state-of-the-ar robust training methods for smoothed classifiers on wide range of image classification benchmarks, including MNIST [32], CIFAR-I0 10 [29], and ImageNet [48] datasets. Overall, the results consistently show that our new adversarial training scheme for smoothed classifiers significantly improves the certified robustness compared to existing methods, e.g., one of our CIFAR-10 model could largely outperform an existing state-of -ftte-of-the-art result the average certified robustness in Eyraddius 0. 0.720 - 0.737. Through an extensive ablation study, we also verify that our method is (a) robust to the choice of hyperparameters, and (b) can effectively trade-off between the accuracy and robustness [66] of smoothed classifiers.
Overall, our work suggests that the robustness of a classifier should be set individually per sample considering its nearby inputs: approach this problem by leveraging the relationship between the

---

prediction confidence and robustness of smoothed classifiers. Recently, there have been also some initial attempts to incorporate sample-wise treatment for robustness by allowing input-dependent noise scales in randomized smoothing [1, 58, 10]. However, our theoretical analysis shows that such an approach would eventually suffer from the curse of dimensionality (Theorem in Appendix B), highlighting our approach of focusing on a "better calibration" as a promising alternative.
2 Preliminaries
We assume an ii.d. dataset = ((r; v:)) P. where 2, E R and yi E EV (1.... ,C), and focus on the problem of correctly classifying given input æ into one of C' classes. Let f Rd + y be a classifier modeled by f(x) == arg ca Fa( with F : R + AC-1, where A C denotes the probability simplex in R For example, F can be a neural network followed by softmax layer.
In the context of adversarial robustmess, require f not only correctly elassify (Ir v) P, but also to be locally-constan around x; i.e., f should not contain any adversarial examples around æ. In this respect, can measure and attempt maximize the adversarial robustness of a classifier by considering the minimum-distance of adversarial perturbation [44, 7, 8], namely:
R(fix, v) =- min || 22112. f(x))ty
(I)
Randomized smoothing. In cases when f is too complex to control its predictions in practice, e.g., if f is a neural network on high-dimensional data, directly solving and maximizing (1) can be hard. Randomized smoothing [11] instead constructs new classifier I from f that is easier to obtain robustness by transforming the base classifier f with a certain smoothing measure, where in this paper we focus on the case of Gaussian distributions N(0,021)
f(x) := arg max P. (0, (f(r + 6) c).
(2)
ecy
For given (Ir, v). Cohen al. [11] have shown that R(f; xr y) can be lower-bounded by the certified
radius R(f. x. y). which can be derived from the confidence of f at æ, namely we denote by py (z):
R(f:,,y) v) 2 a + (p)())) =: R(f, x. y) where py (2) == Po- + 8) = f(x)), (3)
provided that f(xx) = y. and otherwise R(f: x. y) == 0.4 This lower bound is known as tight for the f2-minimum distance, e.g., the bound is optimal for linear classifiers [11].
Although randomized smoothing can be applied for any classifier f Rd + y, the robustness of given input under the presence of Gaussian noise. In this sense, obtain robust f. Cohen al. [11] simply propose to train using Gaussian augmentation by default:
smoothed classifiers can vary depending Py as in (3), i.e., how ʃ performs
min E (a.))~P [C(F(x + 8),
(0,0(0,021)
where L denotes the standard cross-entropy loss.
Adversarial training for smoothed classifiers. To obtain f that gives more robust classifier when smoothed into f. Salman et al. [49] propose SmoothAdv that employs adversarial training [40] on f:
min f -
max C(f:'', x',y)-
(5)
Due the intractability of however, it is hard to directly optimize the inner maximization of (5) via gradient methods. To bypass this, SmoothAdy attacks the soft-smoothed classifier F := EE (x++8))) instead. Specifically, SmoothAdv finds an adversarial example via solving the following:
(-
EF + + +b))) F
arg max C(F;3', arg max ||a-=|laaSe
-log log
(6)
m
using Monte Carlo integration with m samples of 8, namely 61, 8m N'0, 021).
Here, & denotes the cumulative distribution function of the standard normal distribution.

---

3 Method
Our goal in this paper is to develop more suitable form of adversarial training (AT) for smoothed classifiers, taking into account their unique characteristics on adversarial robustness over standard neural networks. Figure 1 illustrates motivating example: as shown in Figure (a), AT typically assumes a fixed-sized ball of radius e that each adversarial perturbation must be in, as the goal of the training is to defend the classifier against adversaries under specific threat model. However, in case when AT is applied to a smoothed classifier, e-g,, as done by SmoothAdy, this assumption may be too restrictive, particularly for inputs where the classifier already certifies robustness of radii larger than (e.g., Figure 1(b)). This demands for a new form of AT specially for smoothed classifiers, e.g., that allows more distant adversarial examples, despite its fundamental difficulty in the context of standard neural networks [25, 69].
In this regard, our proposed training method of SmoothMix takes a completely different approach to incorporate adversarial examples during training. More specifically, for a given sample (I. y) ~ P. method finds adversarial example of z without an explicit norm constraint, i.e., "unrestrictively""" This is because our focus is not to find an input for correcting its label to (as in the standard AT), but to find an input that is over-confident and semantically off-class, i.e., is not beneficial to the classifier to label this input to y. Once we have such an example, Smooth then labels it as the uniform confidence, and considers mixup training [67] with the original x: by linearly interpolating with the uniform confidence. SmoothMix effectively calibrates the over-confident inputs in between, re-balancing the certified radius at the original sample of x at the end.
3.1 Exploring over-confident adversarial examples in smoothed classifiers
Recall that we have a (base) classifier / of the form [ax) = arg my Fe(x)) f is its smoothed counterpart, and we aim to improve the robustness of f by incorporating adversarial examples in training. In this paper, we are particularly interested in adversarial examples of f that is found without a hard restriction in its perturbation size. More concretely, for a given training sample (z, v) ~ P. we find adversarial examples by solving the following optimization:
f == arg max (C(f:a', v) - B || =113)
where C is the cross-entropy loss, and 3 > 0 is to ensure that (7) cannot be arbitrarily far from x.
As proposed by Salman et al. [49] (see Section 2), one can optimize (7) by approximating the intractable f with the soft-smoothed classifier F := Ess + 6)} in similar manner to (6). Based on this approximation, we simply perform a T-step gradient ascent from z:(0) == with step size >> 0 to solve (7) using m samples of 8, namely 81.".. 5m ~ ~N I):
(+(())))
(((-1) == x0 + a [Z)))))) where J(x) = - log FF((+ m
(8)
Figure 2 demonstrates two particular instances of these "unrestricted" adversarial examples found from (8) on z, and plots how the confidence of inputs changes as they are linearly interpolated from the clean input to its adversarial counterpart. From this illustration, we make several remarks those would lead to a more direct motivation to our method:
We observe that adversarial perturbations found via (8), i.e., from a smoothed classifier, could contain enough amount of semantic changes even in a perceptual sense, in either ways of translating the input to another class (Figure 2(a)), or simply removing some relevant information for the current class (Figure 2(b)). At least for these cases, therefore, it is reasonable for the classifier to keep its low confidence to the original class. Such a sincceptuall--alignenn
representation is not a unique property of smoothed classifiers, but has been generally observed on adversarially- we leverage the provable robustness of smoothed classifiers during training to reasonably obtain semantically off-class samples, those will be labeled as the uniform confidence.
classifiers [50, 15, 26]: in other words,
'Here, we note that the 3-term in (7) are omitted in (8). In practice, we do not use nor tune 3 in our method mainly for simplicity, as the role of 3 can be replaced by assuming a finite a T. Le.. by the Lagrangion duality: an unconstrained optimization with & Egrreuularization implicitly detines a hard constraint in its E normm..

---

P1lueoraa 1
PYceer]
Calosean
0.-
05--
Sixing Rato
Midng Radio
Equal confidence
Figure 3: Equal-confidence mix- ing ratios on CIFAR-IO, i.e., the minimal mixing ratios for chang- ing the correct prediction when each input is linearly interpolated its adversarial example.
(a) In-class translation
(b) Out-of-class translation
Figure 2: Illustration of adversarial examples unrestrictively found in CIFAR-10 with smoothed ResNet-1 10 (a 0.25). The plot demonstrates the change of confidence between two classes as the input is linearly interpolated.
Table I: Comparison of the average (a) true-class confidence, and (b) maximum off-class confidence of smoothed classifiers, for adversarial inputs searched via PGD from CIFAR- 10 test samples around balball of radius e. We use ResNet- 110 trained on CIFAR-10 10 with 0.5 for this comparison.
CIFAR-10 (Test set; %)
Clean
1.0
2.0
3.0
4.0
5.0
(a) (f + 8) v)
66.4
47.1
24.3
14,2
11.3
10.7
(b) E maxo F([ + = c)
24.2
37.8
59.5
71.8
78.5
82.0
A major problem we rather highlight here is the tendency of over-confidence [45] toward the direction of adversarial perturbation: Figure 2 also presents how the confidence of the given smoothed classifier changes as we linearly interpolate the input from x to T. Overall, the ddterrsrialll-craffi to that of x, consequently their certified radius (3) would be much larger as well. Therefore, considering that are still nearby æ, such the over-confidence the certified radius of x, especially when F does not contain much semantically meaningful information as observed in Figure 2(b). This observation is further supported qualitatively in Table 1: by comparing the average (a) true-class confidence and their (b) off-class confidences of smoothed classifier, those defined by (a) [f + 5) y)] and (b) E E[maxe (f + 8) = c)], respectively, we confirm that the off-class confidence of ă can be abnormally higher than those of clean samples as we allow more budget on E.
samples 5 usually attain significantly higher confidence compared
would negatively affect
3.2 SmoothMix for confidence--aalirrated training of smoothed classifiers
Based on the observations from Section 3.1, we hypothesize that the miscalibration of confidences between F and its unrestricted adversarial example & is an important factor that degrades the certified robustness of smoothed classifiers, and propose to penalize the over-confidence by mixing the uniform confidence them. More concretely, we consider the mixup [67] training between x and ă, ie., by augmenting the given training data with the following pairs:
(9) where ((x) E C-C11 the soft-smoothed prediction of xr 2/ denotes the uniform distribution, is random variable that represents the mixing ratio between (x, F(x)) and (a(T), (())), and 1 denotes the C-dimensional vector of ones. Here, notice that À is sampled only from [0, fl. unlike the standard choice [67] of [[0, 1J): recall from Figure 2(a) that 7 can be often semantically in-class, so that direct supervision of the uniform confidence on it could harm the classifier. By simply taking only the half part of the mixed samples closer to æ, we could reasonably avoid these cases while maintaining its effect prevent the over-confidence issue. The actual loss minimize for these new data simply follows the cross- loss with Gaussian augmentation, similarly to (4):
_ := () - + nix : (1 () f(z) where \~ u (l)
nix = (g~A((0,021) [f( + 6), y mix)]
(10)
'We nevertheless remark that such ã is still sufficiently far from x compared to the adversarial examples commonly used in the standard adversarial training (and SmoothAdy), that has a hard f2-norm restriction.
5

---

Recall the over-confidence issue observed in Figure 2 as we follow from z to 8(7) Minimizing L (10) directly corresponds to calibrating the high confidence at a(T) and the samples in-between, while keeping the original prediction of F(r) at x. Even in cases that a(T) does not have an over-confidence issue, i.e., when its prediction is already close to the uniform confidence, the loss (10) would assign a relatively low value for a((T) so that it can act only if there exists overconfident (;(2)) nearby sr
Incorporating SmoothAdv for free. As our method focuses on adversarial examples that are moderately far from the original inputs assuming that the classifier is already locally-smooth, one may still enjoy the effectiveness of SmoothAdv if it could further enforce the local smoothness. We indeed observe that the joint training can be helpful for the robustness of smoothed classifiers, but a naïve combination of them could incur too much costs for finding separate adversarial examples for each method. Instead, we found that simply taking x <- .;(1) without modifying our current training, i.e., using the single-step adversarial example found during (8) instead of the clean sample, can reasonably bring similar effect. In this respect, we allow SmoothMix to use (#(1) v) instead of (x., y) depending on demand of more robustness at expense of decreased clean accuracy.
Overall training. Combining the proposed loss with the standard Gaussian training (4) gives the full objective to minimize for our training method. For given sample (xr, y) ~ P, and by letting L = Es [f(F(z + +)), 6), w)], the final loss of SmoothMix is given by:
L : uua + 17 I
(11)
where v > 0 is a hyperparameter to control the trade-off between aceuracy and robustness. Algo- rithm 1 in Appendix A demonstrates a concrete training procedure of SmoothMix using m samples of 8 for the Monte Carlo approximation.
4 Experiments
We evaluate the effectiveness of our method extensively on MNIST [32]. CIFAR-10 [29]. and ImageNet [48]' classification datasets. Overall, the results consistently highlight that our newly proposed training can significantly improve the certified robustness of smoothed classifiers compared to existing robust training methods. We point out the improvements are especially remarkable on the certified accuracy at larger perturbations, which SmoothMix mainly focus compared to prior arts. We also conduct an ablation study on the proposed method to convey a detailed analysis on the individual components. The detailed experimental setups, e.g., training details, datasets, and hyperparameters for the baseline methods, are specified in Appendix C.
Baseline methods. We compare our method with variety of existing techniques proposed for robust training of smoothed classifiers, as listed in what follows: (a) Gaussian [11]: standard training with Gaussian augmentation; (b) Stability training [38]: cross-entropy regularization between F(r) and F'x + 6): (c) SmoothAdy [49]: adversarial training on smoothed classifier; (d) MACER [65]: a regularization that maximizes an approximative form of the certified radius (3); and (e) Consistency [23]: KL-divergence based regularization that minimizes the variance of F(x + 5) across 8. Whenever possible, we use the pre-trained models released by authors for our evaluation to reproduce the baselines. The more detailed training configurations are specified in Appendix C.2.
Evaluation metrics. Our evaluation of the robustness for a given smoothed classifier f is largely based on the protocol proposed by Cohen et al. [11], similarly prior works [49, 65, 23]: more concretely, Cohen et al. [11] proposed practical Monte Carlo based certification procedure, namely CERTIFY, that returns the prediction of î and "safe" lower bound of certified radius over the randomness of n samples with probability at least 1 a. or abstains the certification.
From CERTIFY, we consider two evaluation metrics: (a) the approximate certified test accuracy at various radii: the fraction of the test dataset which CERTIFY classifies correctly with radius larger than r without abstaining, and (b) the average certified radius (ACR) [65]: the average of certified radii returned by CERTIFY on the test dataset counting only the correctly classified samples, namely ACR := |D eessl Σ( (x.y))DP.. CR(f. ar 2). f(=)=y" where Dreez is the test dataset, and CR denotes the certified radius from CERTIFY a, 2). Here, the latter metric, ACR, is for a better comparison of robustness under trade-off between accuracy and robustness [56, 66]: by its definition, ACR naturally
Results on the ImageNet dataset can be found in Appendix G.

---

Table 2: Comparison of approximate certified test accuracy (%) and ACR on MNIST. All the models are trained and evaluated with the same smoothing factor specified by a. Each value except ACR indicates the fraction of test samples which have le certified radius larger than the threshold specified at the top row. We set our results bold-faced whenever the value improves the Gaussian baseline, and underlined whenever the value improves the best among the considered baselines.
Models (MNIST)
ACR
0.00
0.25
0.50
0.75
1.00
1.25
1,50
1.75
2.00
2.25
2,50
2.75
Gaussian [11]
0.911
99.2
98.5
96.7
93.3
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Stability training [38]
0.915
99.3
97.1
93.8
0.0
0.0
0.0
0.0
0.0
0.0
0.0
SmoothAdy [49]
0.932
99.4
99.0
98.2
96.8
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
MACER [65]
0,920
99.3
98.7
97.5
94.8
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.25
Consistency [23]
0.928
99.5
98.9
98.0
96.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
SmoothMix (1y 1.0)
0.931
99.5
98.9
96.4
0.0
0.0
0.0
0.0
0.0
0.0
One-step adversary
0.933
99.4
99.0
98.2
96.9
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
SmoothMix (1) 5.0)
0.932
99.4
99.0
98.2
96.7
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Ome-step adversary
0.933
99.3
99.0
97.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Gaussian [11]
1.553
99.2
89.7
81.9
67.3
0.0
0.0
0.0
Stability training (38)
1.570
99.2
98.5
97.1
94.8
90.7
83.2
69.2
45.4
0.0
0.0
0.0
0.0
SmoothAdv [49]
1.687
99.0
98.3
97.3
95.8
93.2
88.5
81.1
67.5
0.0
0.0
0.0
0.0
MACER [65]
1.594
98.5
97.5
96.2
93.7
90.0
83.7
72.2
0.0
0.0
0.0
0.50
Consistency [23]
1.657
99.2
98.6
97.6
95.9
93.0
87.8
78.5
60.5
0.0
0.0
0.0
0.0
SmoothMix (1y 1,0)
1.678
99.0
98.4
97.4
95.7
93.0
88.1
80.0
65.6
0.0
0.0
0.0
0.0
+ Ome-step adversary
1.694
98.8
98.1
97.1
95.3
92.7
88.3
81.7
69.5
0.0
0.0
0.0
0.0
SmoothMix (1) 5.0)
1.694
98.7
98.0
95.3
92.7
88.5
81.8
70.0
0.0
0.0
0.0
+ -One-stpp adversary
1.685
98.2
97.5
96.3
94.5
91.3
87.4
81.0
70.7
0.0
0.0
0.0
0.0
Gaussian [11]
1.620
96.3
94.4
91.4
86.8
79.8
70.9
59.4
46.2
32.5
19.7
10.9
5.8
Stability training [38]
1.634
96.5
94.6
91.6
87.2
80.7
71.7
60.5
47.0
33.4
20.6
11.2
5.9
SmoothAdv [49]
1.779
95.8
93.9
90.6
86.5
80.8
73.7
64.6
53.9
43.3
32.8
22.2
12.1
MACER [65]
1.598
91.6
88.1
83.5
77.7
71.1
63.7
55.7
46.8
38.4
29.2
20.0
11.5
1.00
Consistency [23]
1.740
95.0
93.0
89.7
85.4
79.7
72.7
63.6
53.0
41.7
30.8
20.3
10.7
SmoothMix (y 1.0)
1.788
95.5
93.5
90.5
86.2
80.6
73.4
64.3
53.7
43.2
33.5
23.9
14.1
One-step adversary
1.816
94.7
92.4
89.2
84.6
79.4
72.5
64.0
54.5
44.8
36.2
27.4
18.7
SmoothMix (1) = 5.0)
1.820
93.7
91.6
88.1
83.5
77.9
70.9
62.7
53.8
44.8
36.6
28.9
21.5
+ One-step adversary
1.823
93.3
90.9
87.5
83.0
77.5
70.6
62.7
53.4
44.9
37.1
29.3
22.4
Garredan Staliiity
accuneyy
0.0
MACIER
0.8
0.
Coruleweryy Smoothifle
Cortited
Smoothhlv
04
Siaiilyy
SmoothAdy
64
0.5
MAGER
MAGER
Cons
SmoothMix
02
SmoothMix
Consatency
0.
0.7
Rodius
Roclss
Radius
(a) 0.25
(b) 0.50
(c)
L.00
Figure 4: Comparison of approximate certified accuracy for various training methods on MNIST. The sharp drop of certified accuracy in each plot is due to that there is a strict upper bound in radius that CERTIFY can output for a given and 100, 000.
assigns 0 for the incorrectly classified test samples, i.e., when f(x) * y, so that a decreased clean accuracy of f would negatively affect the value of ACR. We use the official PyTorch implementation" of CERTIFY, with n = 100, 000, no = 100 and a = 0.001, following [11, 49, 23].
4.1 Results on MNIST
For MNIST [32] experiments, we report the approximate certified accuracy and ACR of smoothed classifiers obtained from LeNet [32] with different training methods, including SmoothMix, using the full MNIST test dataset. We consider three different models as varying the noise level a e (0.25, 0.5, 1.0]. During inference, we apply randomized smoothing with the same a used in the training. When SmoothMix is used, we consider fixed hyperparameter value for a = 1.0 and
7

---

Table 3: Comparison of approximate certified test accuracy (%) and ACR on CIFAR-10. We set results bold-faced whenever the value improves the Gaussian baseline, and underlined whenever the value improves the best among the considered baselines. indicates that the results are evaluated from the official pre-trained models released by authors.
Models (CIFAR-IO 10)
ACR
0.00
0.25
0.50
0.75
1.00
1.25
1.50
1.75
Gaussian [11]
0.424
76.6
61.2
42.2
25.1
0.0
0.0
0.0
0.0
Stability training [38]
0.421
72.3
58.0
43.3
27.3
0.0
0.0
0.0
0.0
SmoothAdy" [49]
0.544
73.4
65.6
57.0
47.5
0.0
0.0
0.0
0.25
MACER" [65]
0.531
79.5
69.0
55.8
40.6
0.0
0.0
0.0
0.0
Consistency [23]
0.552
75.8
67.6
58.1
46.7
0.0
0.0
0.0
0.0
SmoothMix (Ours)
0,553
77.1
67.9
57.9
46.7
0.0
0.0
0.0
0.0
+ OOne-tep adversary
0,548
74.2
66.1
57.4
47.7
0.0
0.0
0.0
0.0
Gaussian [11]
0.525
65.7
54.9
42.8
32.5
22.0
14.1
8.3
3,9
Stubility training [38]
0.521
60.6
51.5
41.4
32.5
23.9
15.3
9.6
5.0
SmoothAdy" [49]
0.684
65.3
57.8
49.9
41.7
33.7
26.0
19.5
12.9
0.50
MACER" [65]
0.691
64.2
57.5
49,9
42.3
34.8
27.6
20.2
12.6
Consistency [23]
0.720
64.3
57.5
50.6
43.2
36.2
29.5
22.8
16.1
SmoothMix (Ours)
0.715
65.0
56.7
49.2
41.2
34.5
29.6
23.5
18.1
+ One-step adversary
0.737
61.8
55.9
49,5
43.3
37.2
31.7
25.7
19.8
m = 4, the step size and the number of noise samples. We empirically observe that it is beneficial to set a T be proportional to o, the noise level, as there exist different upper bounds on the certified radius statistical achievable in practice depending on o: in this respect, we set T = 2, 4, 8 for the models with = 0.25, 0.5, 1.0, respectively. We apply the same m = 4 for SmoothAdv, i.e., for adversarial training. as well, and T = 10 with an fz-constraint of radius SmoothMix and SmoothAdv use the same number of hyperparameters: more specifically, although SmoothMix introduces compared to SmoothAdv, the step size in (8), it instead does not use the hyperparameter E of SmoothAdy, i.e,, the maximum norm of adversarial perturbations.
1.0. Here, notice that
The results are presented in Table 2 and Figure 4. Overall, we observe that our proposed SmoothMix loss (10) added the Gaussian training dramatically improves the certified test accuracy from "Gaussian". By considering the one-step adversary (Section 3.2) in training, we could further improve the robust accuracy, significantly improving ACRs compared to the previous state-of-the-an training methods: e.g., our method could improve ACRs with a = 1.0 from 1.779 + 1.823. This shows that improvements from SmoothMix can be orthogonal to those from SmoothAdv. It is also remarkable that even without the one-step adversarial example, one could further improve the certified robustness by simply increasing the relative strength 1) the SmoothMix loss, e.g., by 1.0 + 5.0 as presented in Table 2: e.g., "SmoothMix" with 5.0 still outperforms "SmoothAdy" by 1.779 + 1.820 at a = 1.0. Finally, we note that our models could substantially improve the robustness at larger perturbations with less degradation in the clean accuracy, e-g., compared to "MACER" or "Consistency"": considering that they are also regularization based approaches that allow to control the robustness via controlling their regularization strength, the results show that our form of loss could better compensate the trade-off between accuracy and robustness.
4.2 Results on CIFAR-10
For CIFAR- 10 [29] experiments, we report the approximate certified accuracy and ACR of smoothed classifiers from ResNet-110 [20] using the full CIFAR-10 test dataset. Again, we consider three different models as varying the noise level a E {0.25, 0.5. 1.0). 9 and apply the same for inference as well. When SmoothMix is used, we consider a fixed hyperparameter value for T
and m = 2, the number of steps and the number of noise samples, respectively. We also fix 17 = 5.0 throughout the experiments, as also used for MNIST (see Table 2). Again, we make sure that a T to be proportional to so that set 0.5, 1.0, 2.0 for the models with o 0.25, 0.5, 1.0, respectively. For Smooth Ady, we report the performance evaluated from the pre-trained models released by the authors 10 for fixed configuration of T = 10, 1.0, and m = 8.
'uue the space limitation, defer the CIFAR- 10 results with 1.0 Appendix F, considering that the scenario can be less practical compared to the others: e.g., clean accuracy this setup is < 50% in most cases, even for the Gaussian baseline [1]].
10 httpps: //ggt//iit thu. com
8

---

1.0
Fabllo MACHH
Centred socuratty
Stapilly MANER
Contied occurscy
1D
4.
B.D
Corffe
84
OF 10.0
0.2
0.5
1:5
Radius
(a) 0 0.25
(b)
0.50
Figure 6: Comparison of approx-
Figure 5: Comparison of approximate certified accuracy for vari-
imate certified test accuracy of
ous training methods on CIFAR-10. The sharp drop of certified accuracy in each plot is due that there is strict upper bound in radius that CERTIFY can output for a given and n 100, 000.
SmoothMix for varying 7) "Gaus- sian" indicates the baseline train- ing with Gaussian augmentation.
The results are summarized in Table 3 and Figure 5. Again, we still observe that our method generally exhibits better trade-offs between accuracy and certified robustness compared to other baselines: e.g.. at = 0.5, "SmmottMixx" could improve the previous best result from "Consistency" by significant margin of 0.720 0.737. Without the single-step adversary. "SmoothMixx can effectively preserve the clean accuracy while also improving ACR, e.g., at 0.25, "SmoothMix" could even improve the clean accuracy of "Gaussian": although "MACER" could improve the clean accuray as well, one could see that their improvements in robust accuracy are relatively limited. It is also notable that the certified test accuracy we report in Table can sometimes complement ACR: although "Consisteeny" achieves competitive ACR with ""mmootMMix" at 0.25, one still confirm the superiority of "SmoothMix" by comparing the certified accuracy r = 0.0 (i.e., the clean accuracy), namely they both achieve similar certified accuracy at 0.75 (i.e., the robust accuracy). This is because bare increase in the clean accuracy (i.e., I correctly classifies more test samples but with CR's closer to 0) often contributes less to the increase in ACR.
75.8% vs. 77.1 %, given that
4.3 Ablation study
We also conduct ablation study to investigate the individual effects of the hyperparameters in method. Unless otherwise noted, we perform experiments on MNIST with o = 1.0. All the detailed results from this ablation study are reported in Appendix H.
Equal-confidence mixing ratios. Recall from Figure 2 that we are motivated by the problem of misculibrution in smoothed classifiers between clean and its adversarial example. To see how much proposed SmoothMix could alleviate this issue, we compare the distributions of the minimal mixing ratios that changes its prediction of given classifier the equal- confidence mixing ratios, before and after training with SmoothMix. We find the adversarial examples separately from two pre-trained ResNet- 1 11 based (smoothed) classifiers, each trained by Gaussian training and SmoothMix, respectively, assuming o = 0.25. We optimize each adversarial example assuming only quite loose norm-bound of 50-step PGD for both classifiers. Figure 3 shows the result, and indeed confirms SmoothMix has an effect of improving calibration between clean and adversarial examples.
the CIFAR-10 test samples, namely
8 to allow more update steps, i.e., via
Effeet of 1). By design, SmoothMix controls the trade-off between accuracy and robustness by adjusting 1/. the relative strength of iix over 7, (11). Here, we further examine the effect of by comparing the certified robustness on varying E {1,2, 4, 8, 16): the results in Figure 6 show that increasing 77 consistently improves the certified robustness of the classifier, which confirms nix, the mixup loss, as an effective term to trade-off the robustness against L aat for accuracy.
Trade-off between a and T. In practice, SmoothMix can trade-off between the step size a and the number of steps T to compensate between a more accurate optimization of (7) and its computational cost, while maintaining the effective range of the perturbation by a T. Figure 7(a) explores this trade- off, by comparing models trained with different combinations of (a, T') under control of a: = 8.0. Interestingly, the results indicate that the choice of and T does not significantly affect the final performance as long as a 7 is constant: all the considered combinations achieve similar robustness, with only slight degradation in ACR even at (a, T) (8.0, 1) (see Table 9 in Appendix H). This

---

Cerifed ucamooy
29A
13
2.0
Oetifed wosamoy
6.8
0.0
11..
B.
0.
Contied
04
04
044
Radius
Racks
Radius
(a) Effect of and
(b) Hard restriction ε on attacks
(c) Effect of m
Figure 7: Comparison of approximate certified test accuracy of SmoothMix and its ablations. "Gaus-
sian" " indicates the baseline training with Gaussian augmentation.
suggests that (a) finding adversarial examples in smoothed classifier can be simpler than one might expect, and (b) one can effectively reduce the training cost of SmoothMix using small in practice.
Hard restriction on adversarial attacks. One of key features of SmoothMix is at its unrestricted search of adversarial examples. Here, we examine the case when there hard restriction on each search, namely in fz-radius of с E {2, 4, 6, 8). The results presented in Figure 7(b) along with the Gaussian baseline ("Gaussian") and the original unrestricted setup ("g oc") show that SmoothMix indeed works best when there is no such restrictions, although these ablations still reasonably improve the Gaussian baseline, i.e., calibrating with adversarial examples outside the s-ball can indeed help to improve the certified robustness in our training scheme.
Effect of m. Figure 7(c) (and Table 11 in Appendix H) investigates the effect of using different m E 21,2, 4, 8), the number of noise samples to approximate the prediction of smoothed classifier: the larger m, the better approximation of smoothed classifier, which would be beneficial for both natural loss and SmoothMix loss (11). Overall, we observe that SmoothMix can still improve ACR from "Gaussian" even with m 1, but with a moderate degradation in the clean accuracy: as m is one of the crucial factors related to the total training cost in practice, one is recommended to use smaller m, e.g., m or 4, considering its little effect the final ACR.
Discussion and conclusion
We observe that adversarial training with an unrestricted adversary can be feasible and even more promising (compared to the restricted ones) when comes with smoothed classifiers, by showing their effectiveness to improve the certified adversarial robustness with novel mixup-based training. We address the brittleness deep neural networks through the lens smoothed classifiers, which could give us simpler view them. We believe our research could be useful step toward understanding what essentially constitutes adversarial examples deep neural networks.
Broader impact. Adversarial robustness in deep learning is arguably an essential requirement for Al safety [2], with much impact on various
systems: e.g., medical diagnosis [9], speech recognition [46] and autonomous driving [64]. Thanks to their certifiable guarantees, we believe a practical success of systems based on randomized smoothing would be fatal for those who maliciously attempt to break down the system via adversarial attacks. Nevertheless, one should also recognize that current techniques for robustness deep learning, including randomized smoothing as well, indeed have a clear gap to be practically used in real-world, e.g., defending against challenging unrestricted attacks [60, 5]. which should be further investigated in the future research. Consequently, it is particularly important for the defense techniques not to be misused in practical systems, failure of such systems may lead practitioners to have a biased, false sense of security.
Limitation. While our ultimate goal is to find optimal smoothed classifiers in terms of the accuracy and robustness trade-off, SmoothMix should not be considered as the final solution for the problem; our method is promising sroof-of-concept showing the close relationship between randomized smoothing and confidence-calibruae
classifiers [19, 36). Although our focus in this paper is currently limited only to the over-confidence issue, we believe there are still many rooms to be explored in future for another such connection, e.g., could the recent developments in the literature of uncertainty estimation of deep neural networks [22, 54] help to improve the robustness of smoothed classifiers.
10

---

Acknowledgments and Disclosure of Funding
This work was conducted by Center for Applied Research in Artificial Intelligence (CARAI) grant funded by Defense Acquisition Program Administration (DAPA) and Agency for Defense Develop- ment (ADD) (UD190031RD). The authors would like to thank Jaeho Lee for helpful discussions.
References
[1] Motasem Alfarra, Adel Bibi, Philip H. S. Torr, and Bernard Ghanem. Data dependent random- ized smoothing, 2020.
[2] Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Concrete problems in Al safety. arXiv preprint axXiv:/606.06565, 2016.
[3] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 274 273,283, Stockholmsmässan, Stockholm Sweden, 10-15 Jul 2018. PMLR. URL http: //pp:////////coigsssse mlr. press/v80 aatess//v0/aaaaaaaaa aaaaaaaalllllll serchalye8ee 181....111. html.
[4] Mislav Balunovic and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In International Conference on Learning Representations, 2020. URL https:// openreview. net/
[5] Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and D. A. Forsyth. Unrestricted adversarial examples via semantic manipulation. In International Conference on Learning Representations, 2020. URL https://openrevieet net. formmrormmmm Sedd=Sye_gggFPl
[6] Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop Artificial Intelligence and Security, pages 3-14, 2017.
[7] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IFEE Symposium on Security and Privacy, pages 39-57. IEFE, 2017.
[8] Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, and Aleksander Madry. On evaluating adversarial robustness. arXiv preprint arXiv: / 0672,06705 2019.
[9] Rich Caruana, Yin Lou, Johannes Gehrke, Paul Koch, Mare Sturm, and Noemie Elhadad. Intelligible models for healtheare: Predicting pneumonia risk and hospital 30-day readmission. In Proceedings of the 2 ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 1721-1730, 2015.
[10] Chen Chen, Kezhi Kong, Peihong Yu, Juan Luque, Tom Goldstein, and Furong Huang. Insta-RS: Instance-wise randomized smoothing for improved robustness and accuracy, 2021.
[11] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages 1310-13200, Long Beach, California, USA, 09-15 Jun 2019. PMLR. URI. htth: /ttp///eeooceeeeeeeeeeeeeee/s.ee . mlr press/ v97/ cowen19c.... html.
[12] Francesco Croce and Matthias Hein. Provable robustness against all adversarial I, perturbaations for p 1. In International Conference Learning Representations, 2020. URL https: //openreview.
[13] Francesco Croce, Maksym Andriushchenko, and Matthias Hein. Provable robustness of ReLU networks via maximization of linear regions. In Kamalika Chaudhuri and Masashi Sugiyama, editors, Proceedings of Machine Learning Research, volume 89 of Proceedings of Machine Learning Research, pages 2057-2066. PMLR, 16-18 Apr 2019. URL htt.httt//pprrcediingeee/o// mlr. press/v89/ http//rcceel999/ html.

---

[14] Krishnamurthy (Dj) Dvijotham, Jamie Hayes, Borja Balle, Zico Kolter, Chongli Qin, Andras Gyorgy, Kai Xiao, Sven Gowal, and Pushmeet Kohli. framework for robustness certifica- tion of smoothed classifiers using f-divergences. In International Conference on Learning Representations, 2020. URL. https:://pppeereeierr wwt.:eee///ooe ceee/fooummiine ddd.mrrsd
[15] Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Alcksander Madry, Adversarial robustness as a prior for learned representations. arXiv preprins 0rXiv:/906.00945 2019.
[16] Timon Gehr, Matthew Mirman, Dana Drachsler-Cohent Petar Tsankov, Swarat Chaudhuri, and Martin Vechev. Ai2: Safety and robustness certification of neural networks with abstract interpretation. In 2018 IEEE Symposium on Security and Privacy, pages 3-18. IEEE, 2018.
[17] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In International Conference on Learning Representations, 2015.
[18] Sven Gowal, Krishnamurthy Dj Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovie, Timothy Mann, and Pushmeet Kohli. Scalable verified training for provably robust image classification. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4842-4851, 2019.
[19] Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks. Doina Precup and Yee Whye Teh, editors, Proceedings of the 34th International Conference on Machine Learning, volume 70 of Proceedings of Machine Learning Research, pages 1321-1330, International Convention Centre, Sydney, Australia, 06-11 Aug 2017. PMLR. URL http: httpl:::pppoccednngg. mlr. prress/v70/ge gu/gguu17aa html.
[20] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for im- age recognition. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pages 770-778, 2016.
[21] Dan Hendrycks and Kevin Gimpel. baseline for detecting misclassified and out-of-distribution examples in neural networks. In International Conference on Learning Representations, 2017. URL https: http::/::////peeeeeeeeeeee/
[22] Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019. URL https: http://////o/oii/eeee cwurips.cc/papereee wttp:////////e/////eeeeeeeeeeeee
Paper pdf.
[23] Jongheon Jeong and Jinwoo Shin. Consistency regularization for certified robustness of smoothed classifiers. In Advances in Neural Information Processing Systems, 2020.
[24] Heinrich Jiang, Been Kim, Melody Guan, and Maya Gupta. To trust or not to trust classifier. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa- Besa-Bianchi, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 31, pages 5541-5552. Curran Associates, Inc., 2018. URL https: httt////eoo/ensss.e/eeeessssssss www.eeeeinnn...nnnn...eeeeeeeeee cct.ippsscc/papp///1113/ Paper pdf.
[25] Daniel Kang, Yi Sun, Dan Hendrycks, Tom Brown, and Jacob Steinhardt. Testing robustness against unforeseen adversaries, 2020.
[26] Simran Kaur, Jeremy Cohen, and Zachary C Lipton. Are percepuaall--aligned gradients a general property of robust classifier?? arXiv preprint 1rXiv:1910.0864 2019.
[27] lang-Hyun Kim, Wonho Choo, and Hyun Oh Song. Puzzle Mix: Exploiting saliency and local statistics for optimal mixup. Hal Daumé and Aarti Singh, editors, Proceedings of the 37th International Conference on Machine Learning. volume 119 of Proceedings of Machine Learning Research, pages 5275-5285 PMLR, 13-18 Jul 2020. URL http:htt////e httpp://proceedings mlr. press/vvis 1111///////nbbb kim20b...................m.mmm0m html.
12

---

[28] JangHyun Kim, Wonho Choo, Hosan Jeong, and Hyun Oh Song. Co-Mixup: Saliency guided joint mixup with supermodular diversity. In International Conference on Learning Representa- lions, 2021. URL https: //pprr/e//e/e/eeeeeeeeeee www.://oouomddddgunaaaaaaa
[29] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, Department of Computer Science, University of Toronto, 2009.
[30] Ananya Kumar, Percy S Liang, and Tengyu Ma. Verified uncertainty calibration. In Ad- vances in Neural Information Processing Systems, volume 32, pages 3792-3803, Curran Associates, Inc.. 2019. URL https://proceeding www.neuurippoom cc/ httpiipp.ccppppp//0/111 httpppppppppp///eeeeeee wttprroeeedninnnnn.rii.r........ .dd..
[31] Alex Lamb, Vikas Verma, Juho Kannala, and Yoshua Bengio. Interpolated adversarial training: Achieving robust neural networks without sacrificing too much accuracy. In Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, pages 95-103, 2019.
[32] Y. LeCun, I.. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(1 ((:21)):27822222 Nov 1998. ISSN 1558-2256. doi: 10.1 10.1109/5.72671.
[33] Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium on Security and Privacy (SP), pages 656-672. IEEE, 2019.
[34] Guang-He Lee, Yang Yuan, Shiyu Chang, and Tommi Jaakkola. Tight certificates of adversarial robustness for randomly smoothed classifiers. In Advances in Neural Information Processing Systems, volume 32, pages 1910-4921. Curran Associates, Inc., 2019.
[35] Kimin Lee, Changho Hwang, KyoungSoo Park, and Jinwoo Shin. Confident multiple choice learning. In Doina Precup and Yee Whye Teh, editors, Proceedings of the 34th Internnai Conference Machine Learning, volume 70 of Proceedings of Machine Learning Research, pages 2014-2023, International Convention Centre, Sydney, Australia, 06-11 Aug 2017. PMLR. URL http: httptt::pp//ooceeennggeee
.ml..............mmm............ press/v70/lese htmmm...........................
[36] Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibatee clas- sifiers for detecting out-of-distribution samples. In International Conference Learning Representations, 2018. URL https://openreviiss wtwpeeerreeeee.ee/fffoeeeeeeeeee http:/formmmiiiryii/v/mma.
[37] Saehyung Lee, Hyungyu Lee, and Sungroh Yoon. Adversarial vertex mixup: Toward better adversarially robust generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 272 772-281, 2020.
[38] Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with additive noise. In Advances in Neural Information Processing Systems 32, pages 9464 9474. Curran Associates, Inc., 2019.
[39] Linyi Li, Xiangyu Qi. Tao Xie, and Bo Li. SoK: Certified robustness for deep neural networks. arXiv preprint wixi:2000.041333 2020. 2020.
[40] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018. URL
[41] Alexander Meinke and Matthias Hein. Towards neural networks that provably know when they don't know. In International Conference on Learning Representations, 2020. URL /ttps://openreevess wwwpeevviiwieieeeeeeeeeeeeeeeeee wewtee/ooomiddd//eitaaae
[42] Matthew Mirman, Timon Gehr, and Martin Vechev. Differentiable abstract interpretation for provably robust neural networks. Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning. volume 80 of Proceedings of Machine Learning Research, pages -386, Stockholmsmässan, Stockholm Sweden, 10-15 Jul 2018 PMLR. URL http: httt:://proceeding. mlr, matees///////maaaaaaaa 8b html.
13

---

[43] Jeet Mohapatra, Ching Yun Ko, Tsui-Wei Weng, Pin- Yu Chen, Sijia Liu, and Luca Daniel. Higher-order certification for randomized smoothing. In Advances in Neural Information Processing Systems, 2020.
[44] Seyed-Mohsen Moosavi-Dezfooli Alhussein Fawzi, and Pascal Frossard. DeepFool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Patlern Recognition, pages 2574-2582, 2016.
[45] Gabriel Pereyra, George Tucker, Jan Chorowski, Lukasz Kaiser, and Geoffrey Hinton. Reg- ularizing neural networks by penalizing confident output distributions. arXiv preprint arXiv: 17X10:7701.06548, 2017.
[46] Yao Qin, Nicholas Carlini, Garrison Cottrell, Ian Goodfellow, and Colin Raffel. Imperceptible. robust, and targeted adversarial examples for automatic speech recognition. In Proceedings of the 36th International Conference on Machine Learning. volume 97 of Proceedings of Machine Learning Research, pages 5231-5240, Long Beach, California, USA, 09-15 Jun 2019. PMLR. http: /tattt::/pproeee http:///pcceeen..../// mlr. wwwpppressseeeeee ptress/v97// /97///n19a.///a////// html.
[47] Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In Hal Daumé IIII and Aarti Singh, editors, Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pages 8093- 8104. PMLR, 13-18 Jul 2020. URL http:/ pttt:://proceeding. .mlr.mm........ wwtpss/vie//riieeeeee html.
[48] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision, 115(3):211-252) 2015. doi: 10.1007/s1 1263-22662222 063-015--8166y.
[49] Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In Advances in Neural Information Processing Systems 32, pages 11289- 11289-11300 11300. Curran Associates,
Inc., 2019.
[50] Shibani Santurkar, Andrew Ilyas, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Image synthesis with single (robust) classifier. In Advances in Neural Information Processing Systems, volume 32, pages 1262-1273, Curran As- sociates, Inc., 2019. URL https: /tttps://proeet http://ppoooc...cc//ee///ce/ wwwpeeeddinnn.nuuiiiss..o 672880e16ss0aab0044666099933 Pat.a/s-p00992----p...... .df.
[51] Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. In Advances in Neural Information Processing Systems, 2018
[52] David Stutz, Matthias Hein, and Bernt Schiele. Conffience-calibraaeed adversarial training: Generalizing to unseen attacks. In Hal Daumé III and Aarti Singh, editors, Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pages 9155-9166. PMLR, 13-18 Jul 2020. URL stttp:/pproceet mlr. wwwppreeevvveeeeeeee v119/ http//1ttt/stttaaaaaaaa stutz20a. html.
[53] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
[54] Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. CSI: Novelty detection via contrastive learning on distributionally shifted instances. In H. Larochelle, M. Ranzato, R. Had- sell, M. F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages 11839-1 11852, Curran Associates, Inc., 2020. URL httptts:: htpptteee//ooceeedinggg .dff
neurips httpscccppppe///e http:////w./.teee/e////////////.
[55] Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In Advances Neural Information Processing Systems, volume 33, 2020.
14

---

[56] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be odds with accuracy. In International Conference on Learning Representations, 2019. URI. htttps://openretteee
[57] Vikas Verma, Alex Lamb, Christopher Beckham, Amir Najafi, loannis Mitliagkas, David Lopez-Paz, and Yoshua Bengio. Manifold mixup: Better representations by interpolating hidden states. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages 9438-6477. PMLR, 09-15 Jun 2019. URL http: htttt:://prrcceeinggs mlr. wwwpppesser/./. https//////eeemaeee /eemmae9m 9a. html.
[58] Lei Wang, Runtian Zhai, Di He, Liwei Wang, and Li Jian. Pretrain-to-finetume adversarial training via sample-wise randomized smoothing, 2021. URL https://openreviess net/ forum?iddTella22myyPt
[59] Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 5286-5295, Stockholmsmässan, Stockholm Sweden, 10-15 Jul 2018. PMLR. URL http:///proceedings mlr.
8a. html.
[60] Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. In International Conference on Learning Representations, 2018. URL https: /ttp///peeeveeeeeeeeeeeeeeeeeeee
pett/foruu?idd-lyyddde
[61] Kai Y. Xiao, Vincent Tjeng. Nur Muhammad (Mahi) Shafiullah, and Aleksander Madry. Training for faster adversarial robustness verification via inducing ReLU stability. In International Conference on Learning Representations, 2019. URL attpss:/openreett wtt.://..ee/foorttt/// Ad=BJffVjAcKm.
[62] Greg Yang. Tony Duan, J. Edward Hu, Hadi Salman, Ilya Razenshteyn, and Jerry Li. Ran- domized smoothing of all shapes and sizes. In Hal Daumé III and Aarti Singh, editors, Proceedings of the 37th International Conference on Machine Learning, volume 119 of Pro- ceedings of Machine Learning Research, pages 10693-10705. PMLR, 13-18 Jul 2020. URL htttp://proceedings mlr. www..m................m.. wttps//vv19yyyagggga html.
[63] Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. CutMix: Regularization strategy train strong classifiers with localizable features. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 6023-6032, 2019.
[64] Ekim Yurtsever, Jacob Lambert, Alexander Carballo, and Kazuya Takeda. A survey of au- tonomous driving: Common practices and emerging technologies. IEEE 2020.
IEEE Access, 8:58443-58469,
[65] Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. MACER: Attack-free and scalable robust training via maximizing certified radius. In International Conference on Learning Representations, 2020. URL https: //openreview
[66] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages 1472-7482, Long Beach, California, USA, 09-15 Jun 2019. PMLR URL http: http::////ccc.....ee/ooo/ mlr, prwss//eeveeeee htt/v99///aaa/ /t///hhagg19pp 1a..angg9p....rr html.
[67] Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In International Conference on Learning Representations, 2018. URL httpss:/ http://eeeeeeeee htt.//frrmmmmddddddp111
[68] Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane Boning, and Cho-Jui Hsieh. Towards stable and efficient training of verifiably robust neural networks. In International Conference on Learning Representations, 2020. URL https: / //openeeview
15

---

[69] Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mo- han Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In Proceedings of the 37th International Conference on Machine Learning, volume 119 of Pro- ceedings of Machine Learning Research, pages 11278-11287. PMIR, 13-18 Jul 2020. URL http:// httpp://procesdings mlr. wwwpppesssvv..ee http//vv119/////geee hhmml..l...mm. html.
[70] Linjum Zhang, Zhun Deng, Kenji Kawaguchi, Amirata Ghorbani, and James Zou. How does mixup help with robustness and generalization? In International Conference on Learning Representations, 2021. URL https:/ htopss//openrevier
16


Reviews:
[{"review_id": "u2ZbliDay8c", "reviewer": "Reviewer_DMPv", "summary": "This paper looks to improve upon SmoothAdv - a methodology that employs adversarial training on a smoothed classifier to further improve certified robustness. The methodology employed looks to tackling overconfident examples rather than adversarial examples by utilising MixUp. They demonstrate that we can combine MixUp with SmoothAdv to improve certified accuracy.", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "UPDATE:\nThe authors have made clearer the motivation of overconfident examples, as a result I am increasing my score to 6. \n\nStrengths:\n- This paper demonstrates we can combine MixUp and adversarial training to improve certified accuracy for smoothed classifiers. \n\nWeakness and Questions:\n- One main concern I have is that the improvements shown in Tables 1 and 2 seems marginal, for example SmoothMix obtains 55.3% accuracy for CIFAR-10 when $\\sigma$=0.25 whereas for Consistency it is 55.2%. Given these small margins, the authors should also report error bars on the approximate certified accuracy.\n\n- The main motivation regarding why overconfident examples should be penalised is talked about in Section 3.1. I found this section a bit confusing to read, in particular the two bullet points seems speculative.  I've read bullet point one several times and I'm still unclear what it is trying to say. Further, both bullet points refers to Figure 2 which pinpoints to just two examples. To ensure these are not cherry-picked or anecdotal examples, the authors should show statistically that smoothed classifiers is overconfident towards the direction of adversarial perturbation. \n\n- It seems throughout when SmoothAdv was used in conjunction, the attack used was only one-step. This has been to known to cause gradient obfuscation / catastrophic overfitting especially when the perturbation radius is large, given that the adversarial example here is unrestricted it would be good to see the results for multi-step attacks as well. Otherwise it is unclear what the one-step attack is doing.\n\n- From Figure 5/6 it would appear that SmoothMix performs worse when the certification radius is smaller compared to SmoothMix and Consistency. This doesn’t seem desirable, can the authors explained why this is? \n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "2"}, "extra_text": {}}, {"review_id": "ibmuagIiXCE", "reviewer": "Reviewer_jNUT", "summary": "The paper observes a connection between the confidence with which a smooth model classifies an input and the robustness radius with which the input's prediction can be certified. In particular, the paper argues that the model's over-confidence on some inputs can be a source for detrimental effects on the certified radius of other (nearby) instances. Inspired by this, the paper proposes to find over-confident near off-class samples (somewhat) near training instances, and conduct mixup training on this pair of instances as a way of improving the certified accuracy of the resulting smoothed classifier. The proposal can be regarded as another way of adversarial training that is better crafted for smoothed classifiers. Experiments conducted on MNIST, CIFAR and ImageNet show marginal but consistent improvements in certified accuracy.", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n+ The paper's object of study, i.e. modifying the training of smooth classifiers for enhancing the classifier's certified accuracy, is of interest to the adversarial robustness and certification communities, and in someway of interest for the deep learning community in general.\n+ The paper's writing is mostly clear, following a narrative that properly exposes the paper's motivation, relation to previous works and the rationale behind the experiments that are conducted. Figures are also well-built and clear.\n+ The experimental protocol is standard and sensible.\n+ Experimental results are mostly consistent across factors being studied (datasets, parameters, etc.).\n+ The paper's motivation and formulation (although as I expose next I do not entirely understand or agree with) draws on previous works but is for the largest part original.\n\nWeaknesses that affect my rating:\n+ In general I find two main issues with the paper: (1) the motivation is still not completely clear to me, and (2) the experimental results are somewhat not significant enough. In particular, I find the motivation rather troubling, as I am not entirely sure about the over-confidence item raised in the paper: is this over-confidence truly a common phenomenon in *smoothed* classifiers? Given the relation between smoothed classifiers and \"Lipschitzness\" I would have initially thought of the opposite, and so I think this (fundamental) claim in the paper would require experimental validation. Further, while the paper repeats several times that the adversaries are \"unconstrained\" in practice that does not appear to be the case, precisely because part of the importance of finding adversarial examples is that they are near the original inputs, so perhaps a more precise term for this would simply be adversarial examples with looser constraint. \n\nNext, I outline some questions that better expose what I find unclear about the paper, and so I would be thankful for further explanation.\n+ Eqn. (8) implies that the adversarial examples that the optimization procedure most likely finds are the ones for which the label $y$ has low score. How is this quantity related to \"over-confidence\", could it not be the case that simply the classifier will be not confident towards $y$ but uniformly confident towards the rest of the classes? Why would over-confidence emerge here?\n+ I do not understand the claims made in the bullet point of L138. Fig. 2 compares apparently two cases: (a) when the input suffers some modifications so that the label changes and (b) when the modifications to the input can be simply described as removing characteristic features of the class being described (the deer's antlers, in this case). How are these two cases related to how sensible it is for the classifier to keep its low confidence to the original class? Is the paper stating that the classifier's confidence for the true class when making predictions over the original input should be low because it should be aware of how few changes would be required to change the semantic class? I do not think I would agree with such a premise: even though zebras and horses look very much alike, when perceiving a zebra we can be rather certain it is a zebra and not a horse, precisely because of its *very* distinctive features.\n+ In general, while the experimental results are mostly consistent, the improvements are rather marginal, and so I am unsure whether they are significant.\n+ My understanding of one of this work's main contributions is observing a relation between the certification of a classifier and its calibration. Because of this observation, the paper proposes to improve calibration through a mixup-inspired procedure so that certification is also improved. Is my understanding correct? If so, would not a valid baseline be other previous calibration techniques? Or is there some issue with this approach? If there is no issue, how do other calibration techniques perform towards improving certification?\n\n\nWeaknesses that do not affect my rating but should be addressed if possible:\n+ L6: of smoothed classifier\n+ L8: it trains convex combinations? or *on* convex combinations? \n+ In Fig. 1's caption: \"mixup\" or \"the mixup\"?\n+ L37: one of important\n+ L57: they goes\n+ L85: construct\n+ L142: \"their\" or \"its\"?\n+ L144: have\n+ L146: \"a semantically off-class samples those to be labeled as the uniform confidence\"\n+ L151: those\n+ Fig. 2's caption is not self-contained: what the authors want to express with the figure is unclear from the caption. In particular, what is meant by \"in/out-of-class translation\"? I think this caption requires more explanation.\n+ In L159, I do not understand what the paper means by \"mixing the uniform confidence to them\". What does \"uniform confidence\" mean, and to whom is it being \"mixed\"? Similarly, in L166 the paper says \"direct supervision of the uniform confidence on it\", which I do not understand. Could the authors please clarify what was meant by these expressions?\n+ Table 1's caption: \"those\"\n+ The tables reporting the experiments follow a protocol of adding bold-face and underline that I think is confusing: usually whenever readers see a bold-faced number (I think) they think it is the largest, which is not the case in this paper. I would urge the authors to reconsider this protocol. (For instance the results of other methods are never underlined, which can misguide th reading of results)\n+ Table 1's caption: \"improves\" or \"outperforms\"?\n+ Fig. 4's caption: \"plots\"\n+ L195: trainig\n+ Fig. 5's caption: \"plots\"\n+ L230: improve\n+ L240: those\n+ For the experiment reported in L285, how were the adversarial examples computed? Were both restricted or both unrestricted? Or was there a mismatch in this? If there was a mismatch, I think the results are not interpretable, as the process of finding an adversary for the Gaussian model is constrained and so biased towards small values, while the one for SmoothMix is not.\n+ I encourage the authors to rename this method, as there is a paper with the same name: \"SmoothMix: a Simple Yet Effective Data Augmentation to Train Robust Classifiers\", Lee et al., CVPR20 \n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes, they have addressed it.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "6"}, "extra_text": {}}, {"review_id": "PiVWRwEva-Q", "reviewer": "Reviewer_8Cj1", "summary": "The paper offers a novel training scheme—called SmoothMix—for fitting deep net classifiers with improved adversarial robustness while maintaining accuracy to the extent possible. The key idea is to combine the mixup loss with smooth classifiers. The former interpolates the input sample with its adversarial perturbation, designed to “mislead” the smoothed classifier. The effectiveness of the proposed idea was studied on MNIST, CIFAR10, and ImageNet, showing competitive performance to that of state-of-the-art adversarial defense strategies (Gaussian smoothing, stability training, adversarial smoothing, MACER, and consistency).", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Originality\n\nThe idea of combining the mixup loss with adversarial smoothing is novel. Also, it is nicely motivated. First, it was demonstrated (visually) that adversarial perturbations of a smoothed classifier may have semantic changes that either transform the input to another class or removing relevant content for the current class. Second, the smoothed classifier tends to assign to adversarially-crafted examples higher confidence scores compared to the clean input.\n\nMotivated by the above observations the authors hypothesized that miscalibration (although not defined precisely) degrades the certified robustness of smoothed classifiers. They propose to penalize over-confident predictions by interpolating the original image (and label) with its unrestricted adversarial example, assigning uniform confidence to the latter. This approach encourages the smoothed classifier to produce a uniform confidence score for adversarial samples.\n\nQuality\n\nThe paper is well written, the exposition of the idea is clear, the experiments follow existing literature.\n\nMain concern\n\nWhile the method attains state-of-the-art performance, it is hard to judge whether the new results are significantly better than existing ones, e.g., they are only slightly better than adversarial smoothing. It will be interesting to see a detailed performance analysis, e.g., a report of class-conditional performance metrics could perhaps communicate better the advantages of the proposed method.    \n\nSignificance\n\nCertified adversarial robustness is an active area of research that sheds light on the robustness of deep nets. The proposed method achieves state-of-the-art performance on benchmark datasets. It is likely that---at least in the short term---this new method will have a noticeable impact.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "It will be a plus to explain that the SmoothMix approach has an additional hyper-parameter to tune (\\alpha).", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "6"}, "extra_text": {}}, {"review_id": "F3sYK3s_772", "reviewer": "Reviewer_cLLo", "summary": "The paper proposes a new method for training models to achieve better certified L-2 robustness. To this extent, SmoothMix generates adversarial examples by relaxing the perturbation budget and minimizes a mixup loss. The proposed procedure identifies instances classified with high confidence and near-off-class samples as causes of limited robustness in smoothed classifiers and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness. Finally, the method obtains improved certified accuracy for certain radii ε that each adversarial perturbation must be in.", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths\n1. The proposed method is motivated and well-explained.\n2. Evaluation results using standard datasets, such as MNIST (Table 1),  Cifar-10 (Table 2), and ImageNet (Table 4), show the effectiveness of SmoothMix across different smoothing factors.\n3. Extensive ablation studies aid in understanding the utility of SmoothMix.\n\nOpen concerns\n1. Average certified radius (ACR) is used to quantify the effectiveness of SmoothMix. However, it may be sensitive to particular adversarial samples, i.e., a few generated adversarial instances could have a high ACR score and thus can mislead the global interpretation of ACR. Analyzing the distribution of ACR scores might shed more light on this point.\n2. SmoothMixs' performance on the certified accuracy at different radii and epsilons is not consistent across datasets. In addition, it achieves marginal improvement in most cases. This is observed even for easier datasets like MNIST, where we see the difference gap getting bigger for higher epsilons (this is also arguable as to how practical it is to generate adversarial samples using such larger perturbations).", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes, the authors have clearly detailed the limitations and the broader societal impact of the work.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "7"}, "extra_text": {}}]

Author rebuttal:

Meta-review: All reviewers praised the simplicity of the idea of combining MixUp and adversarial training to boost certified accuracy and its significance.
At the same time, reviewers questioned the significance of the performance boost in terms of metric used (ACR) and potentially different behaviors across datasets. Furthermore, presentation and writing were deemed improvable. 

Authors were quite responsive during the rebuttal and provided additional explanations and experimental results that answered the major concerns raised by the reviewers.
Fixing the presentation as suggested is expected for the camera-ready version. 


Decision: Accept (Poster)