Confidence-aware Denoised Fine-tuning of Off-the-shelf Models for Certified Robustness
Authors: Suhyeok Jang
Seojin Kim
Jinwoo Shin
Jongheon Jeong
Venue: Accepted by TMLR ()

Abstract: The remarkable advances in deep learning have led to the emergence of many off-the-shelf classifiers, e.g., large pre-trained models. However, since they are typically trained on clean data, they remain vulnerable to adversarial attacks. Despite this vulnerability, 
their superior performance and transferability make off-the-shelf classifiers still valuable in practice, demanding further work to provide adversarial robustness for them in a post-hoc manner. A recently proposed method, denoised smoothing, leverages a denoiser model in front of the classifier to obtain provable robustness without additional training. However, the denoiser often creates hallucination, i.e., images that have lost the semantics of their originally assigned class, leading to a drop in robustness. Furthermore, its noise-and-denoise procedure introduces a significant distribution shift from the original distribution, causing the denoised smoothing framework to achieve sub-optimal robustness. In this paper, we introduce Fine-Tuning with Confidence-Aware Denoised Image Selection (FT-CADIS), a novel fine-tuning scheme to enhance the certified robustness of off-the-shelf classifiers. FT-CADIS is inspired by the observation that the confidence of off-the-shelf classifiers can effectively identify hallucinated images during denoised smoothing. Based on this, we develop a confidence-aware training objective to handle such hallucinated images and improve the stability of fine-tuning from denoised images. In this way, the classifier can be fine-tuned using only images that are beneficial for adversarial robustness. We also find that such a fine-tuning can be done by merely updating a small fraction (i.e., 1%) of parameters of the classifier. Extensive experiments demonstrate that FT-CADIS has established the state-of-the-art certified robustness among denoised smoothing methods across all $l_2$-adversary radius in a variety of benchmarks, such as CIFAR-10 and ImageNet.

Published in Transactions on Machine Learning Research (11/2024)
ianfidence-wware Denoised Fine-tuning of Off-the-shelf Models for Certified Robustness
Suhyeok Jang*
jasuhe900@kaist.occ
Korea Advanced Institute of Science 8 Technology (KAIST)
Scojin Kim
osikjs kr
Korea Advanced Institute of Science 8 Technology (KAIST)
Jinwoo Shin Korea Advanced Institute of Science 8 Technology (KAIST)
jinuoss@kaist.oo.k
Jongheon Jeong
kongh)@korea.ec.kr
Korea University
* The authors contributed equally.
Reviewed on OpenReview: https: // openreview. net/ hut/forrnn forum? id= 99GovbuMcP
Abstract
The remarkable advances in deep learning have led the emergence of many off-the-shelf classifiers, e.g., large pre-trained models. However, since they typically trained clean data, they remain vulnerable to adversarial attacks. Despite this vulnerability, their supe- rior performance and transferability make off-tho-shelf classifiers still valuable in practice, demanding further work to provide adversarial robustness for them in a post-hoe manner. recently proposed method, denoised smoothing, leverages a denoiser model in front of the classifier to obtaín provable robustness without additional training. However, the denoiser often creates hallucination, i.e., images that have lost the semantics of their originally signed class, leading to drop in robustness. Furthermore, its noise-and-denoise procedure introduces significant distribution shift from the original distribution, causing the denoised smoothing framework to achieve sub-optimal robustness. In this paper, we introduce Fine- Taning with Ponfidence-Auuryy Denoised Image Selection (FT-CADIS), a novel fine-tuning scheme to enhance the certified robustness of off-the-shelf classifiers. FT-CADIS is inspired by the observation that the confidence of off-the-shelf classifiers can effectively identify hal- Iucinated images during denoised smoothing. Based on this, we develop a confidenco-aware training objective to handle such hallucinated images and improve the stability of fine-tuning from denoised images. In this way, the classifier are beneficial for adversarial robustness. We also find that such a fine-tuning can be done by merely updating a small fraction (t.e., 1%) of parameters of the classifier. Extensive experiments demonstrate that FT-CADIS has established the state-of-tho-art cortified ro- bustness among denoised smoothing methods across all & fz-adversary radius a variety of benchmarks, such as CIFAR-10 and ImageNet.
be fine-tuned using only images that
1 Introduction
Despite the recent advancements in modern deep neural networks in various computer vision tasks (Radford et al., 2021; Rombach et al., 2022; Kirillov et al., 2023), they still suffer from the presence of adversarial examples (Szegedy al., 2013) i.e., a non-recognizable perturbation (for humans) of an image often fools the image classifiers to flip the output class (Goodfellow et al., 2014). Such adversarial examples

---

Published in Transactions on Machine Learning Research (11/2024)
I. Confidence-aware demolsed image selection
Denth = {& (ar( = x)
Dx = (Rt, &3.
X
Noise-and-
Prediction
Denoiser
Off-the-shelf Classifier fer
Komodo
Komodo dragon
denoise()
y: Komodo dragon
M =
Eai
Sea lian
II Fine-tuning with confidence-aware denoised image selection
Legend
Non-halluciateed Images
Off-the-sheif Classifier LoRA
selective cross entropy 2oss
xx Denolsed Images
Transformer Encoder
M RePi,na
Σ
CB Fexr (8).
M Number of Noises
D Non-hallnn hon-hallucinated Images
Confidence-awee aware masked adversarial loss MlAd
Masking [Pxx M)
Frozen Modules
10AX [nt 11 65
KL 4.).
Trainable Modules
Images
Figure 1: Overview of FT-CADIS framework. (1) Confidence-aware denoised image selection: for a given clean image, we create denoised images and find non- non-hallueinated images. (2) Fine-tuning with confidence- aware denoised image selection: we propose fine-tuning objectives to improve both generalizability and robustness of the smoothed classifier based on selected non-hallueinated images.
artificially crafted with malicious intent, ée.,, adversarial attacks, which pose a significant threat to the practical deployment of deep neural networks. To alleviate this issue, various approaches have been proposed develop robust neural networks, such as adversarial training (Madry al., 2018; Wang et al., 2019) and certified defenses (Wong & Kolter, 2018; Cohen et al., 2019; Li al., 2023).
Among These efforts, randomized smoolhing (Lecuyer el al., 2019; Cohen el al., 2019) has gained much attention as a framework to build robust classifiers. This is due to its superior provable guarantee of the non-existence of adversarial examples, i.e., certified robustness (Wong & Kolter, 2018; Xiao et al., 2018), under any perturbations confined in a f2-norm. Specifically, it builds a smoothed classifier through taking a majority vote from a base classifier, e.g., neural network, under Gaussian perturbations the given input image. However, it has been practically challenging to scale the model due a critical drawback: the base classifier should be specifically trained noise-angmented data (Lecuyer al., 2019: Cohen et al., 2019).
Recently, Lee (2021); Carlini et al. (2023) have introduced denoised smoothing which utilizes pre-trained off-the-shelf classifiers within the randomized smoothing framework. Rather than directly predicting the label of a noise-augmented image, first feeds the perturbed image into a denoiser, e.g., a diffusion model, and then obtains the predicted label of the denoised image using off-the-shelf pre-trained classifiers that have been trained on clean images. Intriguingly, denoised smoothing with recently developed diffusion models and pre-trained classifiers, e.g., guided diffusion (Dhariwal & Nichol, 2021) and BETT (Bao et al., 2022), shows its superior scalability with comparable certified robustness in fg-adversary to the current state-of-the-- methods (Horváth et al., 2022b; Jeong et al., 2023).
On the other hand, denoised smoothing also exhibits clear limitations. Firstly, denoised images do not follow the standard pre-training distribution of the classifiers, which results a limited robustness the denoised smoothing framework. Secondly, fine-tuning the pro-trained classificrs with the denoised images also yields sub-optimal classifiers due to the hallucinated images (Carlini et al., 2023), i.e., the diffusion denoiser tends to generate image semantics from incorrect class rather than the originally assigned class (see Figure 2a).
2

---

Published in Transactions on Machine Learning Research (11/2024)
Consequently, denoised smoothing with such classifiers leads to drop of the certified accuracy, especially in the large Ez-radius regime, i.e., high Gaussian variance (see Table 1b).
Contribution. In this paper, we aim to address the aforementioned issues of denoised smoothing by designing a fine-tuning objective for off-the-shelf classifiers that distinguishes between hollucinated images, i.e., images that have lost the original semantics after denoising, and non-hallucinated images, í.e., images that maintain the original semantics after denoising. To this end, we propose to use the "likelihood of denoised images", f.e., confidence, of the off-the-shelf classifier with respect to the originally assigned class a proxy for determining whether an image is hallucinated and then fine-tune the classifier with non- hallucinated images only. Consequently, we have developed a confidence-aware training objective based on the likelihood of denoised images to effectively discriminate hallucinated images (see Figure 1).
Specifically, we propose a scalable and practical framework for fine-tuning off the-tef classifiers, coined Fine- Tuning with Confidence- Denoised Image Selection (FT-CADIS), which improves certified robustness under denoised smoothing. In order to achieve this, two new losses are defined: the Confidence-uune aware selective cross- pross-entrpyy loss and the Confidence-aware masked adversarial loss. Two losses are selectively applied only to non-hallucinated images, thereby ensuring that the overall training process avoids over- optimizing hallucinated samples, ie., samples that are harmful for generalization, while maximizing the robustness of smoothed classifiers. Our particular loss design is motivaled by Jeong et al. (2023), who were the first to investigate training objectives for randomized smoothing depending on sample-wise confidence information. We demonstrate that our novel definition of confidence in randomized smoothing, specifically through the ratio of non- con-halluenntee images from a denoiser, can dramatically stabilize the confidence-and training, overcoming its previous limitation of severe accuracy degradation (e.g., see Table 1b).
In our experiments, we have validated the effectiveness of our proposed method standard benchmarks for certified éz-robustness, i.e., CIFAR-10 (Krizhevsky, 2009) and ImageNet (Russakovsky et al., 2015). Our results show that the proposed method significantly outperforms existing state-of-the-art denoised smoothing methods in certified robustness across all fy-norm setups, while updating only 1% of the parameters of off- the-shelf classifiers on Tet. In particular, FT-CADIS significantly improves the certified robustness the high Gaussian variance regime, i.e., high certified radius. For instance, FT-CADIS outperforms the best performing baseline, iee., diffusion denoised (Carlini et al., 2023), by 29.5% 39.4% at 2.0 for ImageNet experiments.
2 Preliminaries
Adversarial robustness and randomized smoothing. We assume a labeled dalaset D = {(x;; ) sampled from P, where x; E X C Rd and y; E y == [1,...K) and aim to develop a classifier f : X' + y which correctly classifies a given input x into the corresponding label among K classes, iee, f(x)) = y/-
Adversarial robustness refers to the worst-case behavior of f: given a sample x X and the corresponding label y E V, it requires f to produce consistent output under any perturbation 8 E Rd which preserves the original semantic of x. Here, â is commonly assumed to be restricted in some æz-norm in Rd, i.e., ||ō1|2 < e for some positive s. For example, Deosari-Dezfooli et al. (2016); Carlini et al. (2019) quantify adversarial robustness as average minimum distance of the perturbations that cause f to flip the originally assigned label y, defined as:
R)f; : E (x.g)~
min I|x ((()+)
xl|2
(1)
The primary obstacle in achieving adversarial robustness lies in the difficulty of evaluating and optimizing for it, which is typically infeasible because f is usually modeled by complex, high-dimensional neural network. Rondomized smoothing (Cohen et al., 2019; Lecuyer et al., 2019) addresses this challenge by constructing new robust classifier from f, instead of directly modeling robustness with f. In particular, Cohen et al. (2019) models by selecting the most probable output of f under Gaussian noise \000, I), defined as:
g(x) == arg max P5~N(00.=2 8)
(2)
cEy
3

---

Published in Transactions on Machine Learning Research (11/2024)
Intriguingly, 9 can guarantee the adversarial robustness around (x,y) y) ~ P. i.e. R(g;x, y) can be lower- bounded by the certified radius R(g, v), where Cohen et al. (2019) have proven that such lower-bound of certified radius is tight for Eg-adversary:
x(g;x,0 v) 2 a. (F'(xx( = R(), where Pg(X. =- Ps[f(x -l.
(3)
provided that gxx) y, i.e., y is the most probable output of f under Gaussian noise. Otherwise, we have R(g;x, x, v) = O. Here, & is the cumulative distribution function of the standard Gaussian distribution. We remark that higher Py (x, v), i.e., average accuracy of f(x + 6), results in higher robustness.
Denoised smoothing. In randomized smoothing, it is crucial that f consistently classifies perturbed images correctly. Salman et al. (2020) have proposed to define f based on concatenating a Gaussian denoiser, denoted as denoise(-), with any off-the-shelf classifier SoLs; i.e., trained with non-perturbed images, a method referred to as denoised smoothing:
f(x + 6):0 == Jass + 8))
(4)
Denoised smoothing provides more scalable framework for randomized smoothing. First, we only need off-the-shelf pre-trained classifiers (rather than noise-specialized classifiers), which is widely investigated and developed (Dosovitskiy et al., 2020; Bao et al., 2022; Radford et al., 2021). Second, recent advancements in diffusion models (Ho et al., 2020; Nichol Dhariwal, 2021; Dhariwal & Nichol, 2021) have produced appropriate denoisers for this approach. Previous efforts (Lee, 2021; Carlini et al., 2023) have further demonstrated the potential of denoised smoothing in achicving the stato-of-tho-art certified robustness when combined with recently advanced pre-trained classifiers and diffusion models.
Parameter-efficien fine-tuning. LoRA (Hu et al., 2022) is a widely-used warameter-efficien fine-tuning method that originated from language models. applics low-rank constraint to approximate the update matrix at each layer the Transformer's self-attention layer, significantly reducing the number of trainable parameters for downstream tasks. During fine-tuning, all the parameters the original model are frozen, and the update of the layer constrained by representing them with a low-rank decomposition. A forward pass h = War can be modified as follows:
h Wor + AW. Wa BAr,
where and h denote the input and output features of each layer, Wo Baxk represents the original weights of the base model f. while AW denotes the weight change, composed of the inserted low-rank matrices B E Rddrr and E Bx
3 Method
In Section 3.1, present description of our problem and the main idea. In Section 3.2, provide descriptions of our selection strategy for non-hallucinated samples. In Section 3.3, we outline our overall fine-tuning framework.
3.1 Problem description and Overview
In this paper, we investigate how to effectively elaborate an off-the-shelf classifier fer within a denoised smoothing scheme. We remark that the robustness of the smoothed classifier g from denoised smoothing of for depends directly on the accuracy of the denoised images (see Eq. (3) and (4)). Therefore, may expect that improving fer for clean images is sufficient to improve the generalizability and robustnoss of (Carlini et al., 2023), assuming that the denoised images follow the pre-training distribution with clean images (Salman et al., 2020), i.e., the denoised images preserve the semantics of the original clean images. However, this assumption not true; the noise-and-denoise procedure of denoised smoothing often suffers from distribution shifts and hallucination issues so that the resulting denoised images have completely different semantics from the original labels (see Figure 2a).
4

---

Published in Transactions on Machine Learning Research (11/2024)
Label
Prediction
Prediction
Label
Prediction
Prediction
Fig
Fig
Black Grouse
Black Grouse
Black Grouse
Noise-and Denoise
Noise-and- Denoise
Label
Prediction
Label Rocking Chair
Prediction Rocking Chair
Prediction
Dryer
Egyptian Mau
Angora Rabbit
Rocking Chair
Noise-and-
Noise-and-
Denoise
(a) Hallucinated images
(b) Non-hallucinated images
Figure 2: Examples of denoised images for FTT-CADIS ImageNet at 1.00. We visualize (a) hallucinated images and (b) non-han non-hallucinated images after the noise-and-denoss procedure. The red/ /od/green box indicates the areas where the original semantic of the image is corrupted/ corrupted/presereel preserved, respectively.
To alleviate these issues, we aim to develop a fine-tuning scheme for feis to properly handle denoised samples. One straightforward strategy would be fine-tune fat by minimizing the cross-entropy loss with all denoised images (Carlini et al., 2023):
C
CB Ca( (deroisde) ot)), w). 8 N(0,001)
(6)
M
where CE denotes the cross-entropy loss, and M denotes the number of noises. Here, we note that this approach treats both non-hallucinated and hallucinated samples equally among the denoised samples. How- ever, fine-tuning fele with hallucinated samples, i.c., demoise does not resemble the class y, is harmful for the generalizability since Eq. (6) forces the classifier far to remember non-y-like hallucinated images as y. Our contribution lies in resolving this issue by introducing (1) confidence-aune awaere selection strategy distinguish between hallucinated and non-hallueinated images and (2) fine-tuning strategy that excludes hallucinated samples from the optimization process.
3.2 Confidence-awwen aware denoised image selection
We propose confidence-aware selection strategy to identify hallucinated images and non-hallucinated images within set of denoised images. Consider the denoised images Dx = [denoise(x + 61)...., denoise(x + &ar)) for given clean image and the number of noises M. We aim to find non-hallucciated images within Dx that an off-the-shelf classifier feit classifies as the assigned label y. i.e., fer shows the highest confidence for y among all possible classes. Conversely, if fei classifies denoised images as label other than y, we define such denoised images hallucinated images, i.e., samples that no longer preserve the core semantic of y. Accordingly, the set of non-hallueinated images Dx.nh Dx is defined follows:
Dxmb [ 8.)) y, i [I,..,
(7)
We remark that the off-the-shelf classifier ferr is pre-trained with clean images, rather than denoised images. Thus, at the beginning of the fine-tuning, fei often fails to correctly assign Dx.nh due to the distribution shift from clean images to denoised images. Thus, we update Dx,nh at each training iteration using Eq. (7)
for more accurate assignment of non-hallucinated images.
3.3 Fine- tineituning with confidence- aware denoised image selection
Our main goal to improve both the generalizability and the robustness of the smoothed classifier g. through the fine-tuning of the off-the-shelf classifier Selt based on confidence-aware denoised image selection in

---

Published in Transactions on Machine Learning Research (11/2024)
Section 3.2. To this end, we propose two fine-tuning objectives for off-the-shelf classifier feie, viz. Confidence-awwree selective cross-entropy loss and Confidence-aware masked adversarial loss, to maximize the generalizability and robustness of the corresponding smoothed classifier respectively.
Confidence-aware selective cross-entropy loss. We first aim to improve the generalizability of the smoothed classifier 9; d..., the average certified accuracy of g. Specifically, we propose to optimize felt with non-hallucinated images Dx,nh:
_
1 M
Σ &EDx.oh
CR( u)
In other words, we optimize our classifier with the non-hallucinated images, while the hallucinated images are excluded from our training objective. This prevents the drop in accuracy fer caused by being forced to remember wrong semantics not relevant to the assigned class y. It also allows for fart to properly learn the distribution of denoised images, which largely different from its pre-training distribution with clean images.
Here, find that training with the objective in Eq. (8) slows down the overall training procedure since Dx.n = sometimes occurs at the start of training. This is mainly due to the distribution shift from the pre-training clean image distribution to the denoised images, ie., feit fails to classify denoised images due to insufficient exposure to denoised images. To resolve this cold-start problem, we add the most-y-like denoised image, ie., a denoised image with the largest logit for y, to Dx,nh when it emply.
Confidenco-awaro masked adversarial loss. We also propose simple strategy to further improve the robustness of the smoothed classifier 9. i.e., the certified accuracy of large fy-norm radius. Specifically, we apply the concept of adversarial tminnnng (Madry et al., 2018; Zhang et al., 2019a; Wang et al., 2019; Salman et al., 2019; Jeong et al., 2023) to our denoised smoothing setup; we carefully create more challenging images, and then additionally learn these images during aun-tunnng. Here, the main challenge is to ensure that the adversarial images preserve the core semantic of the original image, thereby maintaining generalizability while improving robustness. However, as illustrated in Figure 2, some clean images are prone to be hallucinated after the noise-and-denoise procedure. Therefore, adversarial training in denoised smoothing should be carefully designed to avoid incorporating hallucinated images.
To this end, we propose to create adversarial examples based only on images that are unlikely to be hallu- cinated, i.e., clean images x with Dx,nh- = Dx. Specifically, we apply our adversarial loss based on a simple condition of "Dx.nh M
HAddV 11[Px,nhl M] max max llo, las KL(fer( + +m), 9).
(9)
where (L(.,)) indicates the Bailbbcck-ibblee divergence and n; de -x is the difference between each denoised image and the original clean image. To find the adversarial perturbation Wi we perform a T-step gradient ascent from each T7 with a step size of 2 E/T, while projecting of to remain within an balbll of radius E: viz, the projected gradient descent (PGD) (Madry et al., 2018). For the adversarial target i, we adapt the consistency target from the previous robust training method (Jeong et al., 2023) to our denoised smoothing setup by letting the target be the average likelihood of the denoised images, i.e., 9 = EM Softmax (far (denoise(x + +.)).
Overall training objective. Building
proposed training objectives _ and Laddv, now present the complete objective for our Fine- Fine-Tuning with Confidence-Aware Denoised Image Selection (FT-CADIS). Based on our confidence-aware denoised image selection scheme, Confidence-awware selective cross-entropy loss and Confidenco-aware masked adversarial loss are applied only to non-hallucinated images Dx.n to improve both generalizability and robustness of the smoothed classifier. The overall loss function as follows:
CTTCADISS
SCE + X LARd
(10)

---

Published in Transactions on Machine Learning Research (11/2024)
where À > 0 is hyperparameter, which controls the relative trade-off between the generalizability and the robustness (see Section 4.3). The detailed algorithm for computing our CPT-CADIS is outlined in Algorithm 1.
Comparision with CAT-RS. Our FT-CADIS has drawn motivation from previous confidence-aware train- ing strategies, e.g., CAT-RS (Jeong et al., 2023). The key difference is that FT-CADIS uses the confidence of denoised images based on the pre-trained off-the-shelf classifier while CAT-RS learns their confidence of Gaussian-angmentee images during the training of the classifier from scratch. In particular, our method takes advantage of off-the-shee classifiers which are already capable of providing reasonable confidence for identifying non- oon-hallucinated images. Therefore, we can simply use the non-hallucinated images identified by the off-the-shelf classifiers in our optimization objective. On the other hand, CAT-RS additionally assumes a distribution of semantic-presrring noised sample counts based on the confidence, ie., average accuracy, of the models currently being trained from scratch. Therefore, the overall confidence remains low espe- cially for complex datasets, resulting in sub-optimal accuracy of the smoothed classifier (see Table 1b). Our FT-CADIS successfully mitigates this issue based on our carefully designed confidence-based approach utilizing off-the-shelf classifiers, achieving the state-of-the-art robustness even in complex datasets such ImageNet.
4 Experiments
We verify the effectiveness of our proposed training scheme for off-tho-shelf classifiers by conducting compre- hensive experiments. In Section 4.1, we explain our experimental setups, such as training configurations and evaluation metrics. Tn Section 4.2, we present the main results on CIFAR-10 and ImageNet. In Section 4.3, we conduct an ablation study to analysis the component-wise effect of our training objective.
4.1 Experimental setup
Baselines. We mainly consider the following recently proposed methods based on denoised smoothing (Salman et al., 2020; Lee, 2021; Carlini et al., 2023; Jeong & Shin, 2024) framework. We additionally compare with other robust training methods for certified robustness based on randomized smoothing (Lecuyer et al., 2019; Cohen et al., 2019; Salman et al., 2019; Jeong & Shin, 2020; Zhai et al., 2020; Horváth et al., 2022a; Yang et al., 2022; Jeong et al., 2021; Horváth et al., 2022b; Jeong et al., 2023). Following the previous works, we consider three different noise levels, {0.25, 0.50, 1.00), to obtain smoothed classifiers.
CIFAR-10 configuration. We follow the same classifier and the same denoiser employed by Carlini et al. (2023). Specifically, we use the 86M-parameter ViT-B/16 16 classifier (Dosovilskiy et al., 2020) which is pre- trained and fine-tuned on ImageNet-211 (Deng et al., 2009) and CIFAR-10 (Krizhevsky, 2009), respectively. We use the 50M-parameter 32x32 diffusion model from Nichol & Dhariwal (2021) as the denoiscr. Wo provide more detailed setups in Appendix B.2.
ImageNet configuration. We use the 87M-parameter VIT-B/16 classifier which is pre-trained on LAION- 2B image-text pairs (Schuhmann et al., 2022) using OpenCLIP (Cherti et al., 2023) and fine-tuned on ImageNet-12K and then ImageNet- IK. Compared to the previous maae-of-thheart method, diffusion de- noised (Carlini et al., 2023) based on BEiT-large model (Bao et al., 2022) with 305M parameters, we use a much smaller off-the-shelf classifier (30% parameters). We also adopt parammeter-fficient fine-tuning with LoRA (Hu et al., 2022), Le., the number of parameters updated through fine-tuning is only 1% of the total parameters. We use the same denoiser employed by Carlini et al. (2023), i.e., MarM-parreeter 256x256 unconditional model from Dhariwal & Nichol (2021). We provide more detailed sctups in Appendix B.2.
Evaluation metrics. We follow the standard metric in the literature for assessing the certified robustness of smoothed classifiers the approrimate certified test accuracy at r, which is the fraction of the test set that CERTIFY (Cohen et al., 2019), practical Monte-Carlo-basee certification procedure, classifies correctly with a radius larger than r without abstaining. Throughout our experiments, following Carlini el al. (2023), we use N = 100, 000 noise samples to certify robustness for entire CIFAR-10 test set and N = 10, 000 samples for 1,000 randomly selectod images from the ImageNet validation set (note that RS methods in Table 1b use N 100, 000). We use the hyperparaneters from Cohen et al. (2019), specifically ny = 100 and a 0.001. In ablation study, we additionally consider another standard metric, the average cerified radius (ACR) (Zhai
7

---

Published in Transactions on Machine Learning Research (11/2024)
Table 1: CIFAR-10 and ImageNet certified top-1 accuracy. We report the best certified accuracy among the models trained with o {0.25, 0.50, 1.00), followed by the clean accuracy of the corresponding model in parentheses. RS denotes methods based on randomized smoothing without a denoising procedure, and DS denotes methods based on denoised smoothing. O indicates training the classifier with Gaussian-augmented images, indicates direct use of the off-the-shelf classifier without fine-tuning, O indicates fine-tuning of the denoiser, indicates fine-tuning the off ofi-the-shelf classifier, and @ indicates crrameter-efficienn fine-tuning of the off-the-shelf classifier (Hu et al., 2022). The highest certified accuracy in each column is bold-faced. indicates that extra data used in the pre-training.
(a) CIFAR-10
Certifed Accuracy at # (56
Calegory
Method
Of--teehhelf
0.25
1.00
PixelDP (Lecuyer et al., 2019)
(710122.0 0
(42.01.0 0
Gaeesian (Coben es al., 2019)
(77.0)61.0
(38.)
(0000)32.
(06.0)
(47.9)
(47.0)
Smoothidd (Sdman al., 2019)
O
(85.0)73.0
58.058.0
(75.048.00
(37.0)38.0
(5a0033.0
(5a0)29.0
Consistency (Jeong & Shin, 2020)
O
(77.9)888 8
(73.958.1
(729488.5
(32-9)378
(02.933.9
(224)29.9
RS MACER (Zhai el al., 2020)
O
(81.0)71.0
(810)59.0
46.0016.0
(86.0)88.0
(86.0)29.0
(45.0)250
Boosting (Horväth es ol., 2022a)
O
(81.4)00.6
(716652.4
(3244)3888
(82.4344.4
(s2.4)30.4
DRT (Yang et al., 2022)
O
(81.9)70.4
(726060.2
(719500.5
(26 133.8
(20 036.0
(00.430.44
SmoothMix (Jeong al,, 2021)
O
(77.167. 9
(77-1)57.9
(74.)47.7
(G) (61.))772
(01.8)31.7
(61.825.77
ACES (Horvich et al,, 2022b)
()
(77 (77.9)60.0 0
(734)57722
(73-447.0
(57 013.8
(67.0)32.2
1870127.8 8
CAT-RS (Jeong ct al., 2023)
(70.3)68
(78.8)888
(76.448 2
(c2 (228))8.5 5
(02
(02.8)27 1
Demoised (Sulman et ol., 2020))
(72.0166. 0
(6200111. 0
(02.))28.0 .
(440019.0
(12.0)1600
(4.0)13.0
Score-based Demsissed (Lee, 2021)
60.0
42.0
28.
19.0
11.0
6.0
Diffusion Denoised' (Carlini et al., 2023)
(88. 1 16.
(88 11630
(68.145.3
(77.0)32.1
DS
Dillusion Denoised' (Carlini et al., 2023)
(91. 217.3
(01 2163.5
(01.2)
(8) 3135.5
Multi-scale Demoised! [Jecag Shin, 2024)
(90.5)61.9
(85.1
(7.2)
FT-CADIS (Ours)'
(88.780.3
[88 68.44
(88.7 (8..7
(74.))999
(74.931.6
(74.9223.5
(b) ImageNet
Certified Accuracy a (%)
Category
Method
Off-the-shelf
0.50
1.00
1.50
2.00
2.50
PixeIDP (Lecuyer al., 2019)
(6.0
Gauselan (Cohen et al., 2019)
(67.0) (67.0)
(57.0)37.0 0
(57.0)
(11.0)1.00
(44.0)5.00
SmoothAdy (Salman al., 2019)
O
(65.0)56.0
(55.0)45.0
(35.0)38.0 0
(12.0)28.0
(42.0)26.0
Cousistency (Jeong & Shin, 2020)
O
(55.0)50.0
(55.0)44.0
(55.0)34.0 0
(11.0)24.0
(410)21.0
MACER (Zhai el al., 2020)
O
(68.0)57.0 0
(64.0)43.0
(64.0)31 0
(48.0)25.0
(48.0)18.0
Bousting (Horváth et al., 2022a)
O
(68.0)57.0 00
(57.0)44.6
(57.0)38 4
(44.6)28.6 66
(38.6)24.6
DRT (Yang et al., 2022)
O
(6..2)6.8
(49.8)44.4
(49.8)39.8 8
(40-833..4
(49.8)29.0
SmoothMix (Jeong et sl. 2021)
O
50.00)
(55.0)43.0
(55.0)38.0 0
(40.0)24.0
ACES (Horváth et al., 2022b)
(4..3)
(55.4)42.2
(55.0)35.6
(30.6)22.0
CAT-RS (Jesug al. 2023)
(44.0)38.0 0
(44.0)35.0
(44.0)31 0
(44.0)27.0
(4..0)24.0
Denolsed (Salman al. 2020)
(60.0)33.0
(38.0)14.0
(38.0 (38.0)6.0
Score- based Denoised (Lee, 2021)
41.0
24.0
11.0
DS
Diffusion Demoised (Carluni et al., 2023)
(82.8)71.1
(7.1)54.3
(7.138.11
(60.0)
sulti Denoised! (Jooug & Shin, 2024)
(76.6)54.6
(78.6)99.8
(76.6123.0
14.60)4.6
FT-CADIS (Ours)!
(81. 177.9
677.9)60.1
(77.0)4..8
(6..):9..4 (06.2)30.7
et al., 2020): the average of cerified radii on the test set Drest while assigning incorrect samples as 0: viz., ACR == |Deesel Exx,)) [CR(fo, x): =o00)=ll where CR(-) denotes the lower bound of certified radius CERTIFY returns.
4.2 Main experiments
Results on CIFAR-10. In Table la, we compare the performance of the baselines and FT-CADIS on CIFAR-10. Overall, FT-CADIS outperforms all existing state-of-the-art denoised smoothing (denoted by DS) approaches in every radii. For example, our method improves the best-performing denoised smoothing
Further fine-tune the classifier on denoised images from CIFAR-10.
8

---

Published in Transactions on Machine Learning Research (11/2024)
Table 2: Comparison the architectures and parameters between the previous state-of-the-art certified defense methods and FT-CADIS on ImageNet.
CAT-RS
Diffusion Denoised (Carlini et al. 2023)
Multi-scale Denoised (Joong & Shin, 2024)
Method
FT-CADIS (Ours)
(Jeong al., 2023)
Guided Diffusion
Guided Diffusion
Guided Diffusion
Denoiser
(Dhariwal & Nichol, 2021)
(Dhariwal & Nichol, 2021)
(Dhariwal & Nichol, 2021)
ResNet-50 (He et al., 2016)
BErT-large
VIT-B/16 (Dosovitakly al., 2020)
VIT-B/16 (+LoRA)
Classifier
(Bao al., 2022)
(Dosovitskly et al., 2020)
Denniser
Denoiser: 552M
Denoiser: 552M
Denoiser 552M
Parameters
Classifier 26M
Classifier 305M
Classifier 87M
Classifier 87M
Denolser :
Denoiser :
Denoiser 552M
Denolser :-
Trainable
Classifeer 26M
Classifier :
Classifler: :
Classifier 0.9M
Table 3: Comparison of ACR and cortified accuracy for ablations of CFT-CADIS on CIFAR-10 with a = 1.00.
Certified Accuracy at & (%)
Fine-tuning objective design
ACR
0.00
0.25
0.50
0.75
1.00
1.25
1.50
L A Nav (CFT-CADIS; Ours)
0.784
48.1
43.5
40.6
36.9
32.5
28.6
23.7
(w/o) Non-beallucinated coudition of fee
0.726
52.4
45.6
40.4
35.9
31.2
26.1
21.9
(w/o) Mask of Maär
0.374
11.2
10.9
10.4
10.2
10.2
10.2
10.2
Cross-entropy loss C (Carlini et al., 2023)
0.633
54.4
45.8
39.3
33.2
28.1
22.4
17.3
method (Carlini al., 2023) by 35.5% -> 39.99 at = 1.00. FT-CADIS also outperforms every randomzied smoothing techinque up to radius S 1.00. Even though our method slightly underperforms at higher radii in terms of certified accuracy, we note that FT-CADIS is the only denoised smoothing method which achieves reasonable robustness at E 1.00. This means that our FT-CADIS effectively alleviates the distribution shift and hallucination issues observed in previous methods based on denoised smoothing (Carlini et al., 2023). We provide the detailed results in Appendix B.5.
Results on ImageNet. In Table 1b, we compare the performance of the baselines and FT-CADIS on ImageNet, which is a far more complex dataset than CIFAR-10. In summary, FT-CADIS outporfors all existing state-of- thottrt--rtttto methods in every radii. In particular, our method surpasses the certified accuracy of diffusion denoised (Carlini et al., 2023) by 9.9% at 2.00. In Table 2, we also compare the architecture and trainable parameters of each method. Our method even shows remarkable parameter efficiency, i.e., we only update 0.9M parameters, which is 3% of Jeong et al. (2023) and 0.2% of Jeong & Shin (2024). The overall results highlight the scalability of FT-CADIS, indicating its effectiveness in practical applications with only a small parameter updates. We provide the detailed results in Appendix B.5 and further discuss the efficiency of LoRA (Hu et al., 2022) on FT-CADIS in Appendix F.
4.3 Ablation study
In this section, we conduct an ablation study further analyze the design of our proposed losses, the impact of updating the set of non-hallucinated images, and the component-wise effectiveness of our method. Unless otherwise stated, we report the test results based on randomly sampled 1,000 images from the CIFAR-10 test set.
Effect of overall loss design. Table 3 presents a comparison of variants of CFT-CADIS including: (a) removing the non-hallucinated condition of fssE in Eq. (8), (b) removing the masking condition of Lddd in Eq. (9), and (c) training with cross-entropy loss _ only. In summary, we observe that (a) using only non- hallucinated images for _EE achieves better ACR and effectively balances between accuracy and robustness. Additionally, we find that (b) the mask "Dx,nh M in C is crucial for stable training, as it prevents the optimization of adversarial images that have lost the semantic of the original image; and (c) FT-CADIS
9

---

Published in Transactions on Machine Learning Research (11/2024)
Table Comparison ACR and certified accuracy for the ablation of the update of Dx,nh on CIFAR-10 10.
Certified Accuracy at (%)
Noise
Update of Dx,nh
ACR
0.00
0.25
0.50
0.75
1.00
1.25
1.50
0.632
91.1
80.4
66.7
49.0
0.0
0.0
0.0
0.25
/
0.642
87.9
78.7
68.0
54.0
0.0
0.0
0.0
X 0.765
75.4
66.9
56.0
46.0
36.2
28.7
21.6
= 0.50
/
0.806
72.2
64.1
57.2
48.1
40.3
34.1
25.9
X 0.626
53.4
45.9
38.2
32.9
27.3
22.5
16.4
1.00
0.783
48.1
43.5
40.6
36.9
32.4
28.5
23.8
Table 5: Comparison of ACR and certified accuracy for ablations of haav on CIFAR-10 with o = 0.50.
Every design adopts the 1 = M]] masking condition.
Certified Accuracy (%)
Adversarial objective design
ACR
0.00
0.25
0.50
0.75
1.00
1.25
1.50
(a) max;,, " (L(fe1(( + ).
0.802
71.7
64.3
56.2
48.0
39.8
33.8
25.7
(b) M Σ m KL(far +
0.792
74.9
65.8
56.1
47.8
39.7
31.8
23.4
(c)
Σ, (max,; (T(far(x v))
0.792
74.8
64.9
57.0
48.0
39.9
31.5
23.0
max;,n; KL(Sas(x n/),, 9) (Chdyy Ours)
0.806
72.2
57.2
48.1
40.3
34.1
25.9
demonst/rats higher robustness and ACR by combining Confidence-aware selective cross-entropy loss and Confidence-aware masked adversarial loss.
Effect of Confidenco-aware masked adversarial loss design. We further investigate the components of Confidence-awee aware masked adversarial loss. Table 5 presents three variants of (aadv in Eq. (9): (a) replacing the consistent target ò with the assigned label y, (b) substituting the outer maximization with average- case, and (c) combining both (a) and (b). Overall, we find that our proposed _aaáv demonstrates superior ACR compared to the variants, achieving the highest certified robustness while maintaining satisfactory clean accuracy, It shows that both design choices, i.e. maximizing loss over adversarial images and using soft-labeled adversarial targets, are particularly effective.
Effect of iterative update of Dx,nh- Our FT-CADIS iteratively updates the set of non-hallucinated images, i.e., denoise(x + 6) E Px,nh, deal with the distribution shift from the pre-training distribution (clean images) to fine-tuning distribution (denoised images). Table 4 shows the effect of D varying o e (0.25, 0.50, 1.00). For all noise levels, the iterative update strategy shows higher ACR with higher robustness. We find that the fine-tuning classifier increases the ratio of applying _ (see Figure in Appendix D), i.e., ferr gradually classifies all the denoised images of x correctly, thereby focusing on maximizing robustness and achieving a better trade-off between accuracy and robustness (Zhang et al., 2019a).
Effeet of X. In the fino-tuning objective of FT-CADIS Eq. (10), determines the ratio between L and _ Figure 3a illustrates how À affects the certified accuracy across different radii, with À varying in {0.5, 1.0, 2.0, 4.0, 8.0) and 0.50. As À increases, the robustness at high radii improves although the clean accuracy decreases, Le., the trade-off between clean accuracy and robustness.
Effect of M. Figure 3b shows the impact of M on the model when varying M E (1, 2,4,8), 8). The robustness of the smoothed classifier improves as increases, while the clean accuracy decreases. With a higher M, the model is exposed to more denoised images included in D Dx, reducing the distribution shift from clean images to denoised images. This increases the confidence of the smoothed classifier, í.e., the accuracy on denoised images, resulting in more robust predictions.
10

---

Published in Transactions on Machine Learning Research (11/2024)
0.75
0=0.5
0.75
M=1
A=1.0
M-2
2-2.0
M+4
Centified Accuracy (%)
4-4.0
Certiled Accuracy (%)
M=8
A-8.0
0.50
0.50
0.25
0.25
0
1.0
2.0
1.5
Radius
Radius
(a) Effect of A
(b) Efffec of M
Figure 3: Comparison of certified accuracy for components in FT-CADIS, (a) À and (b) M, on CIFAR-10. We plot the results at 0.50. We provide detailed results in Appendix C.
5
Related Work
Certified adversarial robustness. Recently, various defenses have been proposed to build robust classifiers against, adversarial attacks. In particular, cerlified defenses have gained significant attention due to their guarantee of robustness (Wong & Kolter, 2018; Wang et al., 2018a;b; Wong et al., 2018). Among them, randomized smoothing (Lecuyer et al., 2019; Li et al., 2019; Cohen et al., 2019) shows the state-of-the-art performance by achieving the light certified robustness guarantee over fg-adversary (Cohen et al., 2019). This approach converts any base classifier, e.g., a neural network, into a provably robust smoothed classifier by taking a majority vote over random Gaussian noise. To maximize the robustness of the smoothed classifier, the base classifier should be trained with baassian-angmenneer images (Lecuyer et al., 2019; Cohen et al., 2019; Salman et al., 2019; Zhai et al., 2020; Jeong & Shin, 2020; Jeong et al., 2023). For instance, Salman et al. (2019) employed adversarial training (Madry et al., 2018) within the randomized smoothing framework, while Jeong& & Shin (2020) suggested training classifier using simple consistency regularization. Moreover, Jeong et al. (2023) introduced sample-wise control of target robustness, motivated by the accuracy-robustae tradc-off (Tsipras et al., 2019; Zhang ot al., 2019a) in smoothed classificrs. However, training base classifiers specifically for auggeetn-euugneetted images requires large training costs and thus these methods suffer from scalability issues complex datasets, 6.9., the accuracy drops severely the ImageNet dataset.
Denoised smoothing. Denoised smoothing alleviates the aforementioned scalability issue of randomized smoothing by introducing "denoise-and-classif strategy. This approach allows randomized smoothing to be applied to any off-the-shelf classifier trained on clean images, i.e., not specifically trained on Gaussian- augmented images, by adding a denoising step before feeding Gaussian-augmented images into the classifier. In recent years, diffusion probabilistic models have emerged as an ideal choice for the denoiser in the denoised smoothing scheme. Tn particular, Lee (2021) have initially explored the applicability of diffusson models denoised smoothing, and Carlini et al. (2023) further observe that combining the latest diffusion models with an off-the-shelf classifier provides a state-of-the-art design for certified robustness. Meanwhile, Jeong & Shin (2024) investigate the trade-off between robustness and accuracy in denoised smoothing, and proposed multi-scale smoothing scheme that incorporates denoiser fine-tuning.
Our work aims to improve the certified robustness of smoothed classifiers in denoised smoothing, which is determined by the average accuracy of the off the-hhe-ell classifiers under denoised images. We improve such robustness by addressing hallucination and distribution shift. issucs of denoised images. Specifically, we focus on filtering out hallucinated images based on the confidence of off-the-shelf classifiers, and then fine-tune off-the-shelf classifiers with non-hallucinated images.
11

---

Published in Transactions on Machine Learning Research (11/2024)
6 Conclusion
We propose FTTCAADIS, scalable fine-tuning strategy of off-the-shelf classifiers for certified robustness. Specifically, we propose to use the confidence of off-the-shelf classifiers to mitigate the intrinsic drawbacks of the denoised smoothing framework, iee, hallucination and distribution shift. We also demonstrate that this can be achicved by updating only 1% of the total paramoters. We hope that our method could be a meaningful step for the future research to develop a scalable approach for certified robustness.
Limitation and future work. In this work, we apply an efficient training technique for off-the-shelf classifiers based on LoRA (Hu ct al., 2022). Nevertheless, cortification remains a bottleneck for throughput, due to its majority voling process involving large number of forward inferences, i.e., N = 100, 000. An important future work would be to accelerate the certification process for a more practical deployment of our method. In addition, certain public vision APIs do not allow us to access the underlying off-tho-shelf classifiers, i.e., black-box. In such cases, our method is not directly applicable, and further research on training methods that are independent of model parameters, such as prompt-tuning (Jia et al., 2022), will be necessary.
Acknowledgements
This work was conducted by Center for Applied Research in Artificial Intelligence (CARAI) grant funded by Defense Acquisition Program Administration (DAPA) and Agency for Defense Development, (ADD) (UD230017TD) and supported by Institute for Information & communications Technology Promotion (UTP) grant funded by the Korea government (MSIT) N0..RS-2019-I110000 Program (KAIST); No. sity)), and by Culture, Sports and Tourism R&D Program through the Korea Creative Content Agency grant funded by the Ministry of Culture, Sports and Tourism in 2024 (Project Name: International Collaborative Research and Global Talent Development for the Development of Copyright Management and Protection Technologies for Generative AI, Project Number: RS-2024-003340055)..
Artificial Intelligence Graduate School Artificial Intelligence Graduale School Program (Korea. Univer-
References
Hangbo Bao, Li Dong, Songhao Piao, and Furu Wei. BETT: BERT pre-training of image transformers. In International Conference on Learning Representations, 2022.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprinl arXiv:1902.06700. 2019.
Nicholas Carlini, Florian Tramer, Krishnamutthy Dj Dvijotham, Leslie Rice, Mingjie Sun, and J Zico Kolter. (Certified!!) Adversarial robustness for free! In The Eleventh International Conference on Learning Representations, 2023.
Mehdi Cherti, Romain Beaumont, Ross Wightman, Mitchell Wortsman, Gabriel Ilharco, Cade Gordon, Christoph Schuhmann, Ludwig Schmidt, and Jenia Jitsev. Reproducible scaling laws for contrastive language-image learning. In Proceedings of the IEEE/CVP Conference on Computer Vision and Pattern Recognition, pp. 2818 2829, 2023.
Kevin Clark, Minh- Minh-Thang Luong, Quoc V Le, and Christopher D Manning. ELECTRA: Pre-training text encoders as discriminators rather than generators. anXiv preprint arXiv:2003.10555, 2020.
Jeremy Cohen, Flan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning, pp. 1310 1320. PMLR, 2019.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large-scale hicrarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248 255. Teee, 2009.
12

---

Published in Transactions on Machine Learning Research (11/2024)
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat GANs image synthesis. Advances in Newral Information Processing Systems, $4:8780-8799 2021.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa. Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition al scale. In International Conference on Learning Rep- resentations, 2020.
Tan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint XrXic:1422.65 2014.
Priya Goyal, Piotr Dollár, Ross Girshick, Picter Noordhuis, Lukasz Wesolowski, Aapo Kyrola, Andrew Tulloch, Yangqing Jia, and Kaiming He. Accurale, large minibatch SGD: Training ImageNet in hour. arXiv preprint ar xix:117066 770602277, 2017.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770-778, 2016.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Newral Information Processing Systems, 33:6840-66 1000006661-100 2020.
Miklós 7. Horváth, Mark Niklas Mueller, Marc Fischer, and Martin Vechev. Boosting randomized smoothing with variance reduced classifiers. In International Conference on Learning Representations, 2022a.
Miklós Z Horváth, Mark Niklas Müller, Marc Fischer, and Martin Vechev. Robust and accurate- compositional architectures for randomized smoothing. ar preprinl vrXiv:2204.0043 2022b.
Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al.
LoRA: Low-rank adaptation of large language models. In International Conference Learning Repre- sentations, 2022.
Gao Huang, Yu Sun, Zhuang Liu, Daniel Sedra, and Kilian Q Weinberger. Deep networks with stochas- lic depth. In Computer Vision-ECCCY ECCV 2016: 14th European Conference, Amslerdam, The Nelherlands, October 11-14, 2016, Proceedings, Part IV 14, pp. 661. Springer, 2016.
Jongheon Jeong and Jinwoo Shin. Consistency regularization for certified robustness smoothed classifiers. Advances in Neural Information Processing Systems, 33:10558-10555 105700 2020.
Jongheon Jeong and Jinwoo Shin. Multi-scale diffusion denoised smoothing. Advances in Neural Information Processing Systems, 36, 2024.
Jongheon Jeong, Sejun Park, Minkyu Kim, Heung-Chang Lee, Do-Guk Kim, and Jinwoo Shin. SmoothMix: Training comfidence-calibratede smoothed classifiers for certified robustness. Advances in Neural Informa- tion Processing Systems, 34:30153- 14:00133-30168, 2021.
Jongheon Jeong, Seojin Kim, and Jinwoo Shin. Confidence-aware training of smoothed classifiers for certified robustness. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 8005 8013, 2023.
Menglin Jia, Luming Tang, Bor-Chun Chen, Claire Cardie, Serge Belongie, Bharath Hariharan, and Ser-Nam Lim. Visual prompt tuning. In European Conference Computer Vision, pp. 709-727. Springer, 2022.
Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitchead, Alexander C Berg, Wan-Yen Lo, et al. Segment Anything. In Proceedings of the IEEE/CVE International Conference on Computer Vision, pp. 4015 4026, 2023.
Alex Krizhevsky. Learning multiple layers of features from tiny images. https://www. cs. toronto.
edu/krizz httii//lleriiin-faaeeeeeseeee TR. pdf, 2009.
13

---

Published in Transactions on Machine Learning Research (11/2024)
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 JEEE Symposium on Security and Privacy (SP), pp. 656 672. LEEE, 2019.
Kyungmin Lee. Provable defense by denoised smoothing with learned score function. In JCLR Workshop on Security and Safety in Machine Learning Systems, volume 2, pp- 2021.
Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with additive noise. Advances in Neural Information Processing Systems, 32, 2019.
Linyi Li, Tao Xie, and Bo Li. SoK: Certified robustness for deep neural networks. In 2023 IEEE Symposium on Securily and Privacy (SP), pp.
TEFF, 2023.
Nya Loshchilov and Frank Hutter. Decoupled weight decay regularization. International Conference on Learning Representations, 2019.
Nyy Loshchilov and Frank Hutter. SGDR: Stochastic gradient descent with warm restarts. In International Conference on Learning Representations, 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Seyed- Moosavi-Dezfooli Alhussein Fawzi, and Pascal Frossard. DeepFool: A simple and accurate method fool deep neural networks. In Proceedings of the IEEF Conference on Computer Vision and Pattern Recognition, pp. 2574 2582, 2016.
Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International Conference on Machine Learning, pp. 8162-8171. PMLR, 2021.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pp. 8748-8763. PMLR, 2021.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVE Conference on Compuler Vision and Pattern Recognition, pp. 10684-10660 2022.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV), 115(3):211 252, 2015.
doi: 10.1007/55 /11 1263-01--011--
Hadi Salman, Jerry Li, Nya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. Advances in Neural Information Processing Systems, 32, 2019.
Hadi Salman, Mingjie Sun, Grog Yang, Ashish Kapoor, and J Zico Kolter. Denoised smoothing: A provable defense for pretrained classifiers. Advances in Neural Information Processing Systems, 33:21945-21957, 2020.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al. LAION-5B: An open large- scale dataset for training next generation imago-text models. Advances in Neural Information Processing Systems, 35:25278- 25294, 2022.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. Xixio preprint 1rX:::1312.611 61999 2013.
14

---

Published in Transactions on Machine Learning Research (11/2024)
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In International Conference on Learning Represenlations, 2019.
Shiqi Wang, Yizheng Chen, Ahmed Abdou, and Suman Jana. MixTrain: Scalable training of verifiably robust neural networks. arXiv preprint 181.:2811.02222 2018a.
Shiqi Wang, Kexin Pei, Justin Whitehouse, Junfeng Yang, and Suman Jana. Efficientt formal safety analysis neural networks. Advances in Neural Information Processing Systems, 31, 2018b.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Represen- lations, 2019.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pp. 3286-5295 PMLR, 2018.
Eric Wong, Frank Schmidt, Jan Hendrik Metzen, and J Zico Kolter. Scaling provable adversarial defenses.
Advances in Neural Information Processing Systems, 31, 2018.
Kai Y Xiao, Vincent Tjeng, Nur Muhammad Mahi Shafiullah, and Aleksander Madry. Training for faster adversarial robustness verification via inducing ReLU stability, In International Conference on Learning Representations, 2018.
Zhuolin Yang, Linyi Li, Xiaojun Xu, Bhavya Kailkhura, Tao Xie, and Bo Li. On the certified robustness for ensemble models and beyond. In International Conference on Learning Represenlations, 2022.
Runtian Zhai, Chen Dan, Di Hc, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsich, and Liwei
Wang. MACER: Attack-free free and scalable robust training via maximizing certified radius. In International Conference on Learning Representations, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theo- retically principled trade-off between robustness and accuracy. In International Conference Machine Learning, pp. 7472-7482. PMLR, 2019a.
Jingzhao Zhang, Tianxing He, Suvrit Sra, and Ali Jadbabaie. Why gradient clipping accelerates training: theoretical justification for adaptivity. In International Conference on Learning Representations, 2019b.
15

---

Published in Transactions on Machine Learning Research (11/2024)
Supplementary Material
A Appendix: Confidence-aware Denoised Fine-tuning of Off-the-shelf Models for Certified Robustness
A Training Procedure of FT-CADIS
Algorithm Fine- Tuniengnnn with Awwae Denoised Image Selection (FT-CADIS)
Require: training sample (x, y). variance of Gaussian noise number of noises M. off the-shehlff classifier
fele. attack f2-norm 0. adversarial target f A K-1, cocfficient. of Confidenco-aware masked
adversarial loss X > O.
Generate NOISLANDDEEOOSSO(
... &M NOISTANDDDENOSSEXXM..O σ) Identify Dx. {&t fels (R:) y, i [1, [M]
x; copy of x
3: for = to M do
4:
L; + CC.(ferrrr).......
5: T - arg max KL(farr + n)),)), 7 == &; -x
|| nullase
end for
LT.M: INDICES argsort(Cu.M), D xxnh+ { INDICES.indox/ & Dx,nhi
DE xx * 0 then
9:
_ + M E CT)
10: else
11:
L 1 (CT)
27: lowest cross-cntropy loss
12: end if
13: KAdY f- 1||Dx,nhl M] max KL(far(x + +n),, 9)
14: FFT-CADIS CSCE + X CaAdv
Algorithm 2 Noise-and-Denooie Procedure (Carlini al., 2023)
function NOISEANDDENOIST(S, o)::
t",ap- GETTIMESTEP(O)
X₁- Vo- 8), 5 o
& + deeooisexx:itt))
denoise one-shot diffusion denoising process
5: return x
6: end function
7:
function GETTIMESTEP(O)::
+ find the timestep s.t. 0² 1-0c
D 0q noise level constant of diffusion model
a
10: return az
11: end function
16

---

Published in Transactions on Machine Learning Research (11/2024)
B Experimental Details
B.1 Datasets
CIFAR-10 (Krizhevsky, 2009) consists of 60,000 RGB images of size 32x32, with 50,000 images for training and 10,000 for testing. Each image is labeled as one of 10 classes. We apply the standard data augmentation, including random horizontal flip and random translation up to 4 pixels, as used in previous works (Cohen et al., 2019; Salman et al., 2019; Zhai et al., 2020; Jeong & Shin, 2020; Jeong et al., 2021; 2023). No additional normalization is applied except for scaling the pixel values from [0,255] to [0.0, 1.0] when converting image into a tensor. The full datasct can be downloaded at https://www.cs.orrrr/ cs. tww.nto.oooooooooooo kriz/ hte//fff..tttm
ImageNet (Russakovsky et al., 2015) consists of 1.28 million training images and 50,000 validation images, each labeled into one of 1,000 classes. For the training images, we apply 224x224 randomly resized cropping and horizontal flipping. For the test images, we resize them to 256 resolution, followed by center cropping to 224. Similar to CIFAR-10, no additional normalization is applied except. for scaling the pixel values to [0.0, 1.0]. The full dataset can be downloaded at https:/ /tt////maaggeeeeeee net.org/toooo.... wtt..org/dwwloaddd /ownload.
B.2 Training
Noise-and-Denoise Procedure. We follow the protocol of Carlini et al. (2023) to obtain the denoised images for fine-tuning. Firstly, the given image is clipped to the range [-1,1] expected by the off-the- shelf diffussio models. Then, the perturbed image is obtained from certain diffusion time step according to the target noise level. Finally, we adopt a one-shot denoising, i.e., outputting the best estimate for the denoised image in a single step, resulting in a denoised image within the range of [-1,1]- Since this range differs from the typical range of [0, 1] assumed in prior works, we set the target noise level to twice the usual level for training and certification. A detailed implementation can be found at https:/ http:///ttttbbbooo /ethz- spylab/ spylab/diffusiie diwffssionndeeoiiseeeee www.ooiieedd-oohhinngg and the algorithm is provided in Algorithm
CIFAR-10 fine-tuning. We conduct end-to-end fine-tuning of pre-trained ViT-B/16 (Dosovitskiy et al., 2020), considering different scenarios of a E (0.25, 0.50, 1.00] for randomized smoothing. The same o is applied to both the training and certification. As part of the data pre-processing, we interpolate the dataset to 224x224. Our finc-tuning follows the common practice of supervisod ViT training. The default sctting is shown in Table 6a. We use the linear ir scaling rule (Goyal el al., 2017): I base br batch size + 256. The batch size is calculated as batch per GPU x number of GPUs accum iter // ramber of noises, where accum iter denotes the batch accumulation hyperparameter.
IetgeNet fine-tuning. We adopt LoRA (Hu et al., 2022) to fine-tune a pre-trained VIT-B/16 (Dosovitskiy et al., 2020) in a parameter-officient manner. We use the same training scenarios for CIFAR-10. As part of the data pre-processing, we interpolate the dataset to 384x384. The default setting is shown in Table 6b. Compared to end-to-end fine-tuning, we reduce the regularization setup, e.g., weight decay, b decay, drop path, and gradient clipping. For LoRA fine-tuning, we freeze the original model except for the classification layer. Then, LoRA weights are incorporated into each query and value projection matrix of the self-attention layers of VIT. For these low-rank matrices, we use Kaiming-uniform uniform initialization for weight A and zeros for weight B, following the official code. To implement LoRA with ViT, refer to www.h/ooo/mmmsseeeee
B.3 Hyperparameters
In proposed loss functions (see Eqs. (8), (9), and (10)), there are two main hyperparameters:: the cocfficient X for the Confidenco-aware masked adversarial loss, and the attack radius e of Confidence-awaro masked adversarial loss. We have determined the optimal configurations for two hyperparameters through a simple grid search on À over [1,2,4] and & over [0. 125, 0.25, 0.5, 1.0).
For CIFAR-10, we use 1.0, 2.0, 4.0 for = 0.25, 0.50, 1.00, respectively. Assuming that denoise(x = x with high probability, we adopt a small E = 0.25 by default, which is increased to 0.50 after 10 epochs only for 1.00. For ImageNet, we use x 2.0, 1.0, 2.0 for a 0.25, 0.50, 1.00 respectively, and e is fixed
17

---

Published in Transactions on Machine Learning Research (11/2024)
Table Denoised fine-tuning settings for the off-the-shelf classifier on CIFAR-10 and ImageNet.
(a) CIFAR-10 end-to-end fine-tuning
Configuration
Value
Optimizer
AdamW (Loshchilov Hutter, 2019)
Optimizer momentur
f/ 0.9, 0.990
Base learning rate
5e-4 (o 0.25, 0.25,0.50), 0.50), le-4 (ir 1.00) start, end 0.04, 0.1 (cosine schedule) 0.63
Weight decay
Layer-wise It decay (Clack al., 2020; Bao et al., 2022)
Balch
128
Learning rate schedule
cosine decay (Loshchilov & Hutter, 2022)
Warmup epochs (Goyal al,, 2017)
Training epochs
30 (early stopping at 20)
Drop path (Huang et al., 2016)
Gradient clipping (Zhang al., 2019b)
(b) ImageNet LoRA (Hu et al., 2022) fine-tuning
Configuration
Value
Optimizer
AdamW (Loshchilov & Hutter, 2019)
Optimizer momentum
81 82 - 0.9, 0.999
Base learning rate
2e-1 (o 0.25), 4e-1 (o 0.50, 1.00)
start, end
0.2
0.25)
Weight drray
start, end 0.01, 0.1 (a 0.50, 1.00)
Layee-wise Ir detay (Clark et al., 2020; Bao el al., 2022)
0.8 (o 0.26), 0.9 (a = 0.50, 0.50,1.00)
Batch size
128
Learning rate schedule
cosine docay (Loshchilov Hutter, 2022)
Warmup epochs (Goyal al., 2017)
Training epochs
10 (early stopping 5)
Drop path (Huang et al., 2016)
0.0
Grudient clipping (Zhang al., 2019b)
1.0
LoRA rauk
LoRA scaler
0.25 for all noise levels. Although the number of noises M and the number of attack steps T' can also be tuned for better performance, fix M 4 and T 4 for CIFAR-10. For ImageNet, fix M 2 and T = 1 to reduce the overall training cost. Additional training configurations are provided in Table 6. Due to the extensive training cost of large models, we have adjusted some training configurations for the ablation study, e.g., the warmup and training epochs are reduced to 2 and 20, with s doubled after 10 epochs.
B.4 Computing infrastructure
In summary, we conduct our experiments using NVIDIA GeForce RTX 2080 Ti GPUs for CIFAR-10, NVIDIA GeForce RTX 3090 and NVIDIA RTX A6000 GPUs for ImageNet. In the CIFAR-10 experiments, we utilize NVIDIA GeForce RTX 2080 Ti GPUs for fine-tuning per rum, resulting in ~ hours training cost. During the certification, we use NVIDIA GeForce RTX 2080 GPUs for data splitting, taking ~9 minutes per image (with N 100, 000 for each inference) to perform a single pass of smoothed inference. In the ImageNet experiments, utilize 4 NVIDIA RTX A6000 GPUs for fine-tuning per run, observing ~51 hours of training cost. During the certification, 8 NVIDIA GeForce RTX 3090 GPUs are used in parallel, taking +4 minutes per image (with N = 10, 000 for each inference) to complete single pass of smoothed inference.
18

---

Published in Transactions on Machine Learning Research (11/2024)
B.5 Detailed results main experiments
Table 7: Certified accuracy of FT-CADIS for varying levels Gaussian noise a on CIFAR-10 and ImageNet.
Values in bold-faced indicate the ones reported in Table 1a for CIFAR-10 and Table 1b for ImageNet.
(a) CIFAR-10
Certified Accuracy at 6 (%)
Noise
0.00
0.25
0.50
0.75
1.00
1.25
1.50
0.25
88.7
80.3
68.4
54.5
0.0
0.0
0.0
0.50
74.9
67.3
58.7
49.2
39.9
31.6
23.5
1.00
49.6
45.5
41.0
36.8
32.5
28.4
24.2
(b) ImageNet
Certified Accuracy at (%)
Noise
0.00
0.50
1.00
1.50
2.00
2.50
0
0.25
81.1
71.9
0.0
0.0
0.0
0.0
0.50
77.0
69.3
60.1
45.8
0.0
0.0
O 1.00
66.2
60.7
54.0
46.4
39.4
30.7
0=0.50
0=0.50
Certifed Accuracy (00
20.75
0=0.00
Gertified Accuracy (90)
70.75
0=1.00
0.50
0.50
1.0
1.5
2.5
3.0
1.0
1.5
2.5
3.0
Radius
Radius
(a) CIFAR-10
(b) ImageNet
Figure 4: Certified accuracy of FT-CADIS at different levels of Gaussian noise E {0.25, 0.50, 1.00]. Upper bounds in radius are calculated with N 100,000 for CIFAR-10 and N = 10,000 for ImageNet.
19

---

Published in Transactions on Machine Learning Research (11/2024)
C
Detailed Results on Effect of and M
Table 8: Comparison of ACR and certified accuracy for ablations of varying À on CIFAR-10 with = 0.50.
Certified Accuracy at (%)
Setups
ACR
0.00
0.25
0.50
0.75
1.00
1.25
1.50
À = 0.50
0.786
75.7
64.9
55.8
47.5
39.5
30.8
22.8
= 1.00
0.797
75.3
64.3
56.3
47.9
39.7
32.8
24.5
= 2.00
0.806
72.2
64.1
57.2
48.1
40.3
34.1
25.9
= 4.00
0.814
70.9
63.3
55.9
48.0
41.0
35.0
27.7
= 8.00
0.823
68.6
62.4
56.0
47.6
41.5
35.9
28.5
Table 9: Comparison of ACR and certified accuracy for ablations of varying M on CIFAR-10 with o 0.50.
Certified Accuracy at (%)
Setups
ACR
0.00
0.25
0.50
0.75
1.00
1.25
1.50
M = 1
0.773
75.6
67.0
56.3
46.2
38.1
29.4
21.6
M = 2
0.790
74.9
65.4
55.6
47.6
39.1
32.2
23.3
M 4
0.806
72.2
64.1
57.2
48.1
40.3
34.1
25.9
M 8
0.817
70.4
62.5
55.9
47.9
42.1
35.8
27.9
D Effect of Iterative Update of Dx,nh Cu
Ratio of a
0.25
update
w/o update
Ratio (
0.20
0.15
5
10
15
20
Epoch
Figure 5: Change in the ratio of [Dx.ull M, i.e., ratio of clean images x satisfying the masking condition of Cu during fine-tuning on CIFAR-10 with a 1.00, depending on whether Dx,uh being updated or
not. In the legend, red indicates that ax is iteratively updated, while orange indicates that Dx fixed.
20

---

Published in Transactions on Machine Learning Research (11/2024)
E Details on Certifying Robustness of FT-CADIS
We simply follow the common evaluation framework of the basclines (Carlini et al., 2023; Jeong & Shin, 2024). In denoised smoothing framework (Salman et al., 2020), the robustness of the smoothed classi- fier is guaranteed based on the accuracy of the off-the-shelf classifier far under denoised images, viz, (deoosixeeiiee(xt + 6)) = y] =: Po (). However, since fer is a high-dimensional neural network, this ac- curacy cannot be computed directly. Instead, we estimate it using the practical Monte-Care based algorithm CERIIFY from Cohen et al. (2019).
CERTIFY algorithm consists of two main procedures: (a) given imput x, identifying the most probable output class A of f, and (b) computing a lower-bound on the probability that output of f is čλ:
(a) Using a small number no (e.g., no 100) denoised images and taking a majority vote over the outputs of Sae, d.e,, computing feir (deoossn)s + 6)) no times identify the most frequent class C
(b) Using a large number n (e.g., n = 100,000) of denoised images to estimate the lower bound of Polfer(denoisse + 6)) = Eal, víz., Pg (x ča), considering the significance level a (see Cohen et al. (2019) for details).
Finally, the cortified &--norm radius of smoothed classifier, derived by Cohen et al. (2019), calculated as a (p εa)) when Pa (x, &^)) > f; otherwise return ABSTAIN. verifies that the smoothed classifier g does not change its output within an E ball of radius (p GA)) around any input
21

---

Published in Transactions on Machine Learning Research (11/2024)
F Analysis on Efficiency of FT-CADIS with LoRA
Table 10: Comparison of fine-tuning costs and ACR, between the baselines (Carlini et al., 2023; Jeong Shin, 2024) and FT-CADIS on ImageNet with o 0.50. i indicates that the numbers are taken from the original paper.
LoRA (Hu et al., 2022)
Trainable parameters
Method
ACR
Fine-tumed model
GPU days
Diffiusion Denoised (Carlini et al., 2023)
0.896
OM
Multi-scale Denoised* (Jeong& Shin, 2024)
Guided Diffusion
0.743
552M
32
(Dhariwal & Nichol, 2021)
ViT-B/16 (Dosovitskiy el al., 2020)
1.013
87M
11.2
FT-CADIS (Ours)
ViT-B/16 (Dosovitskiy et al., 2020)
1.001
0.9M
8.4
In Table 10, we compare the time complexity of different methods. Firstly, our FT-CADIS (without LoRA (Hu et al., 2022)) largely outperforms Multi-scale Denoised (Jeong Shin, 2024), í.e. 0.743 + 1.013 in ACR, with significantly smaller training costs, i.e., + 11.2 in GPU days. Furthermore, LoRA roduces the training time of FT-CADIS by 25% and the trainable parameters by 99% compared full parameter fine-tuning, while maintaining ACR par with full parameter fine-tuning. We note that the efficiency of LoRA can be further improved through advancements of GPU infrastructure low-level code optimization. Since LoRA is generally applicable to other robust training techniques, we hope that our work initiates the research direction on alleviating the large cost of robust training.
Meanwhile, Diffussion Denoised (Carlini al., 2023) proposes to obtain robust classifier without fine-tuning, While they achieve reasonable robustness in an extremely efficient manner, i.e,, no fine- ane-tuning costs, they suffer from the fundamental limitation associated with hallucination effect of the denoiser (see Figure 2a). Due to this bottleneck, find that the robustness of Diffusion Denoised degrades particularly at large radii (see Table 1b). One of our main contributions is identilying and addressing such hallucination issue, achieving improved robustness, i.e 0.896 + 1.013 in ACR.
22

---

Published in Transactions on Machine Learning Research (11/2024)
G Analysis on Pre-trained Classifiers
Table 11: Comparison of ACR and certified accuracy between FT-CADIS and Diffusion Denoised (Carlini et al., 2023) on CIFAR-10 with 0.50.
Test Accuracy
Certified Accuracy at e (%)
Method
Classifier
ACR
0.25
0.75
1.25
1.50
Diffusion Denoised
ResNet-110 (1.7M)
93.7%
0.669
75.0
62.8
50.2
38.9
30.9
22.8
15.6
(Carlini et al., 2023)
ResNet-110 (1.7M)
93.7%
0.754
68.8
60.9
53.9
45.2
38.3
29.4
23.4
FT-CADIS (Ours)
VIT-B/16 (85.8M)
97.9%
0.806
72.2
64.1
57.2
48.1
40.3
34.1
25.9
In Table 11, we investigate the relationship between our proposed method and pre-trained classifiers. The results show that our proposed method still outperforms Carlini et. al. (2023) on ResNet-110 (He et al., 2016), i.e., much smaller architecture than ViT-B /66 (Dosovitskly et al., 2020). Also, we observe that the certified robustness of our method improves as based ViT-B/1e 3/16 largely improves the results based ResNet-110. These findings demonstrate that the effectiveness of our method is not restricted to specific classifiers and can be further enhanced with continuous advancements in this field.
more advanced pre-trained classifiers, e.g,, FT-CADIS
Additional Results on lo Adversarial Attack
Comparison of Lo certified accuracy (%) on CIFAR-10 with radius We report the model with the highest certified too accuracy for each method.
Table 12:
Diffusion Denoised (Carlini et al., 2023) (Jeong Shin, 2024)
Multi-scale Denoised
CIFAR-10 (exx)
FT-CADIS (Ours)
2 Robust (s 255
62.9
67.1
71.8
In Table 12, we present the certified robustness of defense methods on another threat model, i.e., foo -orm. Specifically, we leverage the geometric relationships between the f-ror ball and -orm ball assess the robustness under -orm (Salman al., 2019). Through this simple conversion, our proposed method provide robustness against other apadversarics.
23

---

Published in Transactions on Machine Learning Research (11/2024)
Additional Examples of Hallucinated Images
Label Polar Bear
Prediction Motorboat
Prediction Motorboat
Noise-and- Denoise
Label
Prediction Smooth Newt
Prediction
Pufferfish
Eel
Noise-and- Denoise
Label
Prediction Seashore
Prediction
Sea Lion
Seashore
Noise-and- Denoise
Label
Prediction Website
Prediction
Turnstile
Website
Noise-and-
Denoise
Label
Prediction
Prediction
Kuvasz
Hare
Wool
Noise-and-
Denoise
Figure 6: Additional examples of hallucinated images after the noise-and-deeoise procedure on ImageNet 1.00. The red box indicates the areas where the original semantic of the image is corrupted.
24

---

Published in Transactions on Machine Learning Research (11/2024)
Label Automobile
Prediction
Prediction
Truck
Truck
Noise-and- Denoise
Label Cat
Prediction Bird
Prediction
Bird
Noise-and- Denoise
Label Dog
Prediction Cat
Prediction
Cat
Noise-and- Denoise
Label
Prediction Dog
Prediction
Horse
Dog
Noise-and- Denoise
Label Automobile
Prediction Airplane
Prediction
Airplane
Noise-and-
Denoise
Figure 7: Additional examples of hallucinated images after the loise-and-denois procedure on CIFAR-10 at 1.00. The red box indicates the areas where the original semantic of the image is corrupted.
25

---

Published in Transactions on Machine Learning Research (11/2024)
J Analysis on Training Stability of FT-CADIS
Train Loss_SCE
Train Loss_MMsMMMd _Adv
0.3
apach
10
20
5
10
20
0.8
85
0.6
65
epoch
epoch
Figure 8: Plots of (1) Confidence-awaree selective cross-entropy loss _ScR, (2) Confidence-wware masked adver- sarial loss LMaav (3) Overall training objective CFI-CADIS, and (4) Top-1 accuracy from our main experiments
on CIFAR-10 with a = 0.25.
In this section, we demonstrate that our training objective FT remains stable throughout the fine- tuning process. As mentioned in Section 3.3, our overall objective is composed of Confidence-aware selective cross-entropy loss _ace and Confidence-aware masked adversarial loss [ Figure 8, we show that (1) the training loss, including the adversarial loss, converges smoothly without oscillation, and (2) the training accuracy also converges well.
26


Reviews:
[{"review_id": "Iciy1k2S6P", "reviewer": "Reviewer_AF4i", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: \n1. The paper is clearly written and the overall approach is quite easy to understand. The main idea is to filter out hallucinated examples from the denoiser and add an adversarial loss component. \n2. The method achieves better certified robustness compared to other state-of-art denoised smoothing approaches \n3. There are also good ablation studies analyzing the contributions of each component of the method. \n\n\nWeaknesses: \n1. Conceptually I don't know if filtering out the 'hallucinated' images is a good idea. Those images are still recognizable as the target class by humans, but just misclassified by the off-the-shelf classifier. They represent the distribution shift between the denoised images and clean images. Adapting to these examples could be useful since we are going to use the denoiser during test time and we cannot avoid these distribution shifts. This is analogous to the generation of adversarial examples during adversarial training, we deliberately generate misclassified examples so that the classifier can cope better with adversarial examples during test time when there is an adversary. \nApart from the empirical results do the authors have any explanation why filtering out those 'hallucinated' images help? \n2. From Table 3 we can see that under low-noise conditions the certified robustness with 'hallucinated' images are better than the authors' filtering approach. Is this phenomenon related to the inability of the denoiser to denoise the images under high noise conditions? \n3. I cannot find the details of LoRA finetuning in the paper.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors propose an approach called FT-CADIS training models with certified robustness using denoising models. The approach is based on the denoised smoothing approach which puts a denoiser before an off-the-shelf classifier to deal with the noise injected to input for certified robustness. The authors improve this approach by adding an example filtering process by removing denoised images that are misclassified (what they refer to as hallucinated images), and adding an adversarial loss to the training. Their approach achieves better certified robustness compared to other state-of-art approaches.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Provide answers to questions listed in weaknesses above.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "nJZ9lsbrCC", "reviewer": "Reviewer_wc3e", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n- The proposed method provides a simple way to deal with the hallucination coming from the denoising model. Moreover, it integrates adversarial training to further improve the obtained guarantees.\n\n- The experimental results show the effectiveness of FT-CADIS, which mostly outperforms the baselines. Several ablation studies are shown to justify the design choices.\n\nWeaknesses\n- The claims about better efficiency of the proposed fine-tuning are a bit weak: first, LoRA is a standard method and could be applied to the other baselines as well, and it is not clear how (if) it'd change their performance. Second, there are baselines like Carlini et al. (2023) which don't need any fine-tuning and can be seen as more efficient than the proposed method. Finally, the cost of adversarial training and discarding the hallucinated images is not taken into account. While it's not straightforward to compare the exact computational cost of each method, the current discussion seems at least incomplete, potentially misleading.\n\n- The presentation can be largely improved:\n  - The method by which the adversarial points $\\eta_i^*$ are computed is not discussed until the appendix. This is a major part of the proposed algorithm which I think should be included in the main part.\n  - Similarly, in Sec. 3.2 it's mentioned that the classifier $f_\\texttt{clf}$ is iteratively updated to renew the training set, but it's not clear how. Is it simply the fine-tuned model at the current iteration or something else?\n  - The notations $f_\\texttt{clf}$ and $F_\\texttt{clf}$ seem to be used interchangeably. If they indicate the same model, a single notation should be used, if not, the difference should be defined.\n  - Table 4, Table 5, Fig. 3 and Fig. 4 appear in the opposite order compared to the text, which is very inconvenient for the reader.\n  - Sec. 2: \"most provable output\" --> \"most probable output\"?\n  - Sec. 4.3 discusses the difference to the training scheme of the main experiments, which have however not been introduced before.\n\n- In the adversarial loss (Eq. (9)), I see the role of having the mask (the indicator function), but can it make training unstable? The adversarial loss, which might by high, is in fact added when all the denoised images are correctly classified, i.e. clean loss is low. Moreover, the adversarial loss might be applied or not for consecutive iterations, which it seems might make the overall loss quite largely oscillate.\n\nOverall, I think the proposed method is reasonable and supported by the experimental results, but the paper would benefit from more complete discussion about efficiency and a clearer presentation.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes a novel fine-tuning scheme, FT-CADIS, for image classifiers to improve the certified robustness obtained by employing them in the denoised smoothing framework. FT-CADIS first fine-tunes the classifier only on images which are still correctly classified after the noise-and-denoise procedure. Moreover, it integrates adversarial training when the classifier performs well on the denoised images. This approach aims at improving both clean performance and robustness, which yield higher average certified radius. In the experiments on CIFAR-10 and ImageNet, FT-CADIS mostly outperforms the baselines.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "I think the discussion about efficiency should be updated, as well as the presentation improved (see details above).", "broader_impact_concerns": "No concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "t1gnURdwjl", "reviewer": "Reviewer_u4XJ", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n\n- This paper presents an innovative methodology where the confidence-aware image selection strategy marks a significant improvement over traditional denoised smoothing techniques, effectively mitigating the issue of hallucination and distribution shift. \n- The method achieves high certified robustness across multiple benchmarks, demonstrating its effectiveness in improving model resilience to adversarial attacks. \n- Additionally, by only updating 1% of the classifier's parameters, the method is computationally efficient, which is crucial for deploying robust models in resource-constrained environments. \n- The comprehensive experimental validation provided in the submission, including comparisons with a wide range of baselines, thorough ablation studies, and analysis of the method's scalability, is another strong aspect.\n\nHowever, the method has some weaknesses. \n\n- While the approach is intuitive, it lacks a rigorous theoretical foundation, such as providing certified robustness guarantees that are commonly expected in adversarial defense research.\n- This work also does not delve deeply into the theoretical analysis of the method's effectiveness, which could have strengthened the overall contribution. \n- While it performs well against $\\ell_2$-norm adversaries, it is unclear how it generalizes to other types of adversarial attacks, such as $\\ell_\\infty$-norm, $\\ell_1$-norm, trace-norm or more complex threat models. \n- The approach also relies heavily on the availability and quality of pre-trained classifiers, which could compromise its effectiveness if these classifiers are not robust or well-calibrated. \n- Furthermore, the method involves several intricate steps, such as confidence-aware selection and masked adversarial loss, which might be challenging to implement and require careful tuning.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This work introduces a method called FT-CADIS (Fine-Tuning with Confidence-Aware Denoised Image Selection), which aims to enhance the certified robustness of off-the-shelf classifiers against adversarial attacks. The key contributions include the introduction of a confidence-aware selective cross-entropy loss and a confidence-aware masked adversarial loss, specifically designed to handle hallucinated images generated by denoising procedures. This approach focuses on improving both the generalizability and robustness of classifiers by selecting non-hallucinated images for fine-tuning. The method achieves improvements in certified robustness with minimal computational overhead by updating 1% of the classifier's parameters, using techniques like LoRA for parameter-efficient fine-tuning. Experiments on benchmarks like CIFAR-10 and ImageNet demonstrate that FT-CADIS outperforms existing denoised smoothing methods across various adversary radii, especially in high Gaussian variance regimes.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "To address the identified weaknesses, the following modifications are suggested to strengthen the paper:\n\n1. (**Suggestion**): It would be better to include a rigorous theoretical foundation, particularly by providing certified robustness guarantees if possible. This is a key expectation in adversarial defense research and would significantly enhance the credibility and impact of the proposed method. A theoretical analysis or proof that aligns the FT-CADIS approach with certified robustness frameworks should be developed and presented in the paper.\n\n2. While the method shows strong performance against $\\ell_2$-norm adversaries, it is critical to evaluate and demonstrate its effectiveness against other adversarial threat models, such as $\\ell_\\infty$-norm, $\\ell_1$-norm, trace-norm, or even more complex attack models. Including these evaluations would provide a more comprehensive understanding of the method's generalizability and robustness across different types of adversarial attacks.\n\n3. The paper should address the dependency on pre-trained classifiers by either reducing this reliance or by providing a detailed analysis of how the method performs across different pre-trained models, including those that may not be robust or well-calibrated. This analysis would help in understanding the limitations and potential risks associated with this dependency and propose strategies to mitigate them.\n\n4. The paper should simplify the implementation details where possible and provide clear guidelines or best practices for implementing the confidence-aware selection and masked adversarial loss steps. This would reduce the barrier to entry for other researchers and practitioners who wish to adopt the method. Additionally, the paper should include more detailed information on the tuning process required for these steps to ensure that the method can be effectively implemented and replicated.", "broader_impact_concerns": "There is no broader impact concern.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: As highlighted by all reviewers, this paper proposes a new method to improve certified robustness of image classifiers via denoised smoothing. A problem of interest to the community. The approach is well-motivated, and the experimental results support it, often outperforming the existing methods.
Decision: Accept (poster)