O N
THE
C ERTIFIED
R OBUSTNESS
FOR
E NSEMBLE
M ODELS AND B EYOND
Anonymous authors
Paper under double-blind review
A BSTRACT
Recent studies show that deep neural networks (DNN) are vulnerable to adversarial examples, which aim to mislead DNNs to make arbitrarily incorrect predictions.
To defend against such attacks, both empirical and theoretical defense approaches have been proposed for a single ML model.
In this work, we aim to explore and characterize the robustness conditions for ensemble ML models.
We prove that the diversiﬁed gradient and large conﬁdence margin are sufﬁcient and necessary conditions for certiﬁably robust ensemble models under the modelsmoothness assumption.
We also show that an ensemble model can achieve higher certiﬁed robustness than a single base model based on these conditions.
To our best knowledge, this is the ﬁrst work providing tight conditions for the ensemble robustness.
Inspired by our analysis, we propose the lightweight Diversity Regularized Training (DRT) for ensemble models.
We derive the certiﬁed robustness of
DRT based ensembles such as standard Weighted Ensemble and Max-Margin Ensemble following the sufﬁcient and necessary conditions.
Besides, to efﬁciently calculate the model-smoothness, we leverage adapted randomized model smoothing to obtain the certiﬁed robustness for different ensembles in practice.
We show that the certiﬁed robustness of ensembles, on the other hand, veriﬁes the necessity of DRT.
To compare different ensembles, we prove that when the adversarial transferability among base models is high, Max-Margin Ensemble can achieve higher certiﬁed robustness than Weighted Ensemble; vice versa.
Extensive experiments show that ensemble models trained with DRT can achieve the state-of-theart certiﬁed robustness under various settings.
Our work will shed light on future analysis for robust ensemble models.
I NTRODUCTION
Deep neural networks (DNN) have been widely applied in various applications, such as image classiﬁcation (Krizhevsky, 2012;
He et al., 2016), face recognition (Taigman et al., 2014; Sun et al., 2014), and natural language processing (Vaswani et al., 2017; Devlin et al., 2019).
However, it is well-known that DNNs are vulnerable to adversarial examples (Szegedy et al., 2013; Carlini & Wagner, 2017; Xiao et al., 2018), and it has raised great concerns especially when they are deployed in the safety-critical applications such as autonomous driving and facial recognition.
To defend against such attacks, several empirical defenses have been proposed (Papernot et al., 2016b; Buckman et al., 2018; Madry et al., 2018); however, many of them have been attacked again by strong adaptive attackers (Athalye et al., 2018; Tramer et al., 2020).
On the other hand, the certiﬁed defenses (Wong & Kolter, 2018; Cohen et al., 2019) have been proposed to provide certiﬁed robustness guarantees for given ML models, so that no additional attack can break the model under certain conditions.
For instance, randomized smoothing has been proposed as an effective defense providing certiﬁed robustness (Lecuyer et al., 2019;
Li et al., 2019;
Cohen et al., 2019;
Yang et al., 2020).
Compared with other certiﬁed robustness approaches such as linear bound propagation (Weng et al., 2018; Mirman et al., 2018) and interval bound propagation (Gowal et al., 2019), randomized smoothing provides a way to smooth a given DNN efﬁciently and does not depend on the neural network architecture.
However, existing defenses mainly focus on the robustness of a single ML model, and it is unclear whether an ensemble ML model could provide additional robustness.
In this work, we aim to char- acterize the conditions for a robust ensemble and answer the question from both theoretical and empirical perspectives.
In particular, we analyze the standard Weighted Ensemble (WE) and MaxMargin Ensemble (MME) protocols, and prove the necessary and sufﬁcient conditions for robust ensemble models under mild model-smoothness assumptions.
Under these conditions, we can see that an ensemble model would be more robust than each single base model.
The intuitive illustration of their certiﬁed robust radius is in Fig 1.
Our analysis shows that diversiﬁed gradient and large conﬁdence margins of base models would lead to higher certiﬁed robustness for ensemble models.
Inspired by our analysis, we propose D iversity- R egularized
T raining, a lightweight regularization-based ensemble training approach.
We derive certiﬁed robustness for both WE and MME trained with DRT, and realize model-smoothness assumption via randomized smoothing.
We analyze different smoothing protocols and prove that Ensemble Before
Smoothing provides higher certiﬁed robustness.
We further prove that when the adversarial transferability among base models is high, MME is more robust than WE.
We evaluate DRT on a wide range of datasets including MNIST, CIFAR-10, and ImageNet.
Extensive experiments show that DRT can achieve higher certiﬁed robustness compared with the stateof-the-art baselines with similar training cost as training a single model.
Furthermore, when we combine DRT with existing robust models as the base models, DRT can achieve the highest certiﬁed robustness to our best knowledge.
We summarize our main contributions as follows: 1) We provide the necessary and sufﬁcient conditions for robust ensemble models including Weighted Ensemble (WE) and Max-Margin Ensemble (MME) under the model-smoothness assumptions.
We prove that an ensemble model is more robust than a single base model under the model-smoothness assumption.
Our analysis shows that diversiﬁed gradients and large conﬁdence margins of base models are the keys to robust ensembles.
2) Based on our analysis, we propose DRT, a lightweight regularization-based training approach, containing both Gradient Diversity Loss and Conﬁdence Margin Loss. 3)
We derive certiﬁed robustness for ensemble models trained with DRT.
The analysis of certiﬁed robustness further reveals the importance of DRT.
Under mild conditions, we further prove that when the adversarial transferability among base models is high MME is more robust than WE.
We conduct extensive experiments to evaluate the effectiveness of DRT on various datasets, which show that DRT can achieve the best certiﬁed robustness with similar training time as a single ML model.
Related work.
DNNs are known vulnerable to adversarial examples (Szegedy et al., 2013).
To defend against such attacks, several empirical defenses have been proposed (Papernot et al., 2016b;
Madry et al., 2018).
For ensemble models, existing work mainly focuses on empirical robustness (Pang et al., 2019; Li et al., 2020; Srisakaokul et al., 2018) where the robustness is measured by accuracy under existing attacks and no certiﬁable robustness guarantee could be provided or enhanced; or certify the robustness for a vanilla weighted ensemble (Zhang et al., 2019; Liu et al., 2020) using either LP-based (Zhang et al., 2018) veriﬁcation or randomized smoothing but without diversity enforcement.
In this paper, we aim to prove that the gradient diversity and base model margin are two key factors for certiﬁed ensemble robustness and based on these key factors, we propose a training approach to enhance the certiﬁed robustness of model ensemble.
Randomized smoothing (Cohen et al., 2019) has been proposed to provide certiﬁed robustness for a single ML model.
It achieved the state-of-the-art certiﬁed robustness on large ImageNet and
CIFAR-10 dataset under L 2 norm. Several approaches have further improved it by: (1) choosing different smoothing distributions for different L p norms (Dvijotham et al., 2019; Zhang et al., 2020; Yang et al., 2020), and (2) training more robust smoothed classiﬁers, using data augmentation (Cohen et al., 2019), unlabeled data (Carmon et al., 2019), adversarial training (Salman et al., 2019), regularization (Li et al., 2019; Zhai et al., 2019), and denoising (Salman et al., 2020).
However, within our knowledge, there is no work studying how to customize randomized smoothing for ensemble models.
In this paper, we compare and select a good randomized smoothing strategy to improve the certiﬁed robustness of the ensemble.
In this paper, we mainly focus on the certiﬁed robustness under L 2 norm.
Though randomized smoothing suffers from difﬁculties when it comes to L ∞ norm (Yang et al., 2020; Kumar et al.,
, the analysis of certiﬁed robustness and the training approach DRT can be further extended to other L p norms.
D IVERSITY - R EGULARIZED T RAINING
In this section, we will ﬁrst provide the robustness conditions for the standard Weighted Ensemble and Max-Margin Ensemble.
Using the robustness condition, we can compare the certiﬁed robustness of the ensemble models and a single base model.
The comparison shows that under modelsmoothness assumptions, the ensemble models are more robust in terms of their certiﬁed robustness.
Motivated by the key factors in the robustness conditions, we then propose D iversity- R egularized
T raining.
Notations.
Throughout the paper, we consider the classiﬁcation task with C classes.
We ﬁrst deﬁne the classiﬁcation scoring function f : R d (cid:55)→ ∆ C , which maps the input to a conﬁdence vector , and f ( x ) i represents the conﬁdence for the i th class.
We mainly focus on the conﬁdence after normalization, i.e., f ( x ) ∈ ∆ C
= { p ∈ R C ≥ 0 : (cid:107) p (cid:107) 1 = 1 } is in the probability simplex.
To characterize the conﬁdence margin between two classes we deﬁne f y 1 /y 2 ( x ) :
= f
( x ) y 1 − f ( x ) y 2 .
The corresponding prediction F : R d (cid:55)→ [ C ] is deﬁned by F ( x ) :
= arg max i ∈
[ C ] f ( x ) i .
We are also interested in the runner-up prediction F (2) ( x ) :
= arg max i ∈
[ C ]: i (cid:54) =
F ( x ) f ( x ) i .
In this paper, we mainly consider the model robustness against the L 2 -bounded perturbations.
Deﬁnition 1 ( r -Robustness) .
For a prediction function F : R d (cid:55)→ [ C ] and input x 0 , if any instance x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } satisﬁes F ( x ) =
F ( x 0 ) , we say model F is r -robust (at point x 0 ).
We map existing certiﬁed robustness (Cohen et al., 2019) to r -Robustness in Appendix B.1.
2. R OBUSTNESS C ONDITIONS FOR E NSEMBLE M ODELS
An ensemble model contains N base models { f i } Ni =1 , where F i and F (2) i are their top and runner-up predictions respectively.
The ensemble prediction is denoted by M : R d (cid:55)→
[ C ] , which is computed based on outputs of base models following certain ensemble protocols.
In this paper, we consider both Weighted Ensemble (WE) and Maximum Margin Ensemble (MME).
Deﬁnition 2 (Weighted Ensemble (WE)) .
Given N base models { f i } Ni =1 , and the weight vector { w i } Ni =1 ∈ R N + , the Weighted Ensemble is constructed as M WE : R d (cid:55)→ [ C ] such that for any input x 0 : M WE ( x 0 ) : = arg max i
[Equation]
[ C ]
N (cid:88)
[Equation]
[Equation]
i .
Deﬁnition 3 (Max-Margin Ensemble (MME)) .
Given N base models { f i } Ni =1 , for input x 0 , the
Max-Margin Ensemble model M MME : R d (cid:55)→ [ C ] is deﬁned by
[Equation]
MME
[Equation]
F
[Equation]
) where c = arg max i ∈
[ N ]
[Equation]
[Equation]
WE sums up the weighted conﬁdence scores of base models { f i } Ni =1 with weight vector { w i } Ni =1 , and predicts the class with the highest value.
WE is commonly-used (Zhang et al., 2019;
Liu et al., 2020).
Max-Margin Ensemble chooses the base model with the largest conﬁdence margin between the top and the runner-up classes, which is a direct extension from max-margin training (Huang et al., 2008).
2.1. G ENERAL R OBUSTNESS C ONDITIONS
For WE, since it predicts the class with the highest aggregated conﬁdence, we can easily observe its sufﬁcient and necessary conditions for the certiﬁed robustness.
Proposition 1 (Robustness Condition for WE) .
Consider an input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] , and a Weighted Ensemble model M WE constructed by base models { f i } Ni =1 with weights { w i } Ni =1 .
Suppose M WE ( x 0 ) =
y 0 .
Then, the ensemble M WE is r -robust at point x 0 if and only if for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } , min y i ∈
[ C ] (cid:80) N j =1 w j f y
/y i j ( x ) ≥ 0 .
For MME, however, the model prediction is decided by the base model with the largest conﬁdence margin.
This “maximum” is a discrete operator and poses challenges especially in the multi-class setting.
We cannot assert that the model predicts the true label by simply looking at the margins between only the true label and other labels unless carefully ﬁltering out possible violated cases.
In the following theorem, through careful analysis of the layout of conﬁdence scores (e.g. enumerating the cases where y 0 is the top class, runner-up class, or one of other classes, see details in Lemmas B. and B.2), we present a succinct but sufﬁcient and necessary condition for MME robustness.
Theorem 1 (Robustness Condition for MME) .
Consider an input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] .
Let M MME be an MME deﬁned over base models { f i } Ni =1 .
Suppose: (1) M MME ( x 0 ) =
y 0 ; (2) for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } , given any base model i ∈
[ N ] , either F i ( x ) =
yor F (2) i ( x ) = y 0 .
Then, the ensemble M MME is r -robust at point x 0 if and only if for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } ,
[Equation]
In above theorem, the y i ’s and y (cid:48)
i ’s are associated with each base model f i and are respectively minimized among all the C classes except class y 0 .
We defer the proof to Appendix B.2.
This theorem along with the intermediate lemmas in the proof serves as the foundation for our subsequent analysis.
2.1. D IVERSIFIED G RADIENTS AND L ARGE C ONFIDENCE M ARGIN C ONDITIONS
The conditions in Proposition 1 and Theorem 1 are rather general and involve x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } , which is challenging to verify for neural networks due to its non-convexity.
In this section, we adapt the above conditions for DNNs based on conﬁdence scores and gradient of base models at input x 0 , showing the diversiﬁed gradients and large conﬁdence margin are the sufﬁcient and necessary conditions for ensemble robustness.
Deﬁnition 4 ( β -Smoothness) .
A differentiable function f : R d (cid:55)→ R C is β -smooth, if for any x ,
y ∈ R d and any output dimension j ∈
[ C ] ,
[Equation]
≤ β.
The deﬁnition of β -smoothness is inherited from optimization theory literature, and is equivalent to the curvature bound in certiﬁed robustness literature (Singla & Feizi, 2020).
Note that smaller β indicates smoother models, and when β = 0 the model is linear.
For Weighted Ensemble , we have the following robustness conditions.
Theorem 2 (Gradient and Conﬁdence Margin Conditions for WE Robustness) .
Given input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] , and M WE as a WE deﬁned over base models { f i } Ni =1 with weights { w i } Ni =1 .
M WE ( x 0 ) =
y 0 .
All base models f
i ’s are β -smooth.
• (Sufﬁcient Condition)
The M WE is r -robust at point x 0 if for any y i (cid:54) =
y {+0 , (cid:13)(cid:13)(cid:13) N (cid:88) j = w j ∇ x f y 
 /y i j ( x+}
[Equation]
• (Necessary Condition)
If M WE is r -robust at point x 0 , for any y i (cid:54) =
y
[Equation]
The proof directly follows from our general robustness conditions and Taylor expansion at x 0 .
For Max-Margin Ensemble with two base models, we derive the following robustness conditions.
Theorem 3 (Gradient and Conﬁdence Margin Conditions for MME Robustness) .
Given input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] , and M MME as an MME deﬁned over base models { f 1 , f 2 } .
M MME ( x 0 ) =
y 0 .
Both f 1 and f 2 are β -smooth.
• (Sufﬁcient Condition)
The M MME is r -robust at point x 0 if for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
y 0 and y 2 (cid:54) =
y 0 ,
[Equation]
• (Necessary Condition)
Suppose x ∈ { x 0 + δ :
||
δ || 2 ≤ r } , and for i ∈ { 1 , 2 } either F i ( x ) =
y 0 or F (2) i ( x ) =
y 0 .
If M MME is r -robust at point x 0 , for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
y 0 and y 2 (cid:54) =
y 0 ,
[Equation]
[Equation]
The proof combines the proof procedure of Theorem 1 with Taylor expansion at x 0 .
We remark that for MME, it is challenging to extend the theorem to the case with n > 2 base models.
The reason is that the “maximum” operator in MME poses difﬁculties for expressing the robust condition in succinct form of continuous function.
Therefore, Taylor expansion is unable to apply.
However, the general tendency should be the same.
We also derive the robustness conditions for a single model for comparison in Appendix B.3.
Comparison of ensemble and single-model robustness.
The preceding theorems enable the analysis on comparing the certiﬁed robustness for an ensemble and a single ML model.
Corollary 1 (Comparison of Ensemble and Single-Model Robustness) .
Given an input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] .
Suppose we have two β -smooth base models { f 1 , f 2 } , which are both r -robust at point x 0 .
For any ∆ ∈ [0 , 1) :
• (Weighted Ensemble) Deﬁne
Weighted Ensemble M WE by base models { f 1 , f 2 } with weights { w 1 , w 2 } .
Suppose M WE ( x 0 ) =
y 0 .
If for any label y i (cid:54) =
y 0 , the base models’ smoothness β ≤ ∆ · min { f y 0 / y [Equation] ( x 0 ) , f y 0 /
[Equation]
( x 0 ) } / ( c 2 r 2 ) , and the gradient cosine similarity
[Equation]
[Equation]
[Equation]
∇
[Equation]
( x 0 ) (cid:105) ≤ cos θ
, then the
M
WE is at least
R -robust
at
x
with
R = r · 1 − ∆ 1 + ∆ (1 − C WE (1 − cos θ ))
[Equation]
1 / 2 , where (8) [Equation] =
[Equation]
i
[Equation]
• (Max-Margin Ensemble) Deﬁne Max-Margin Ensemble M MME by base models { f 1 , f 2 } .
Suppose M MME ( x 0 ) =
y 0 .
If for any label y (cid:54)
= y 0 and y 2 (cid:54) =
y 0 , the base models’
smoothness β ≤ ∆ · min {
[Equation]
y 0 /y 1( x 0 ) , f y 0 /y 2( x 0 ) } / (
c
r 2 ) , and the gradient cosine similarity
[Equation] [Equation]
≤ cos θ , then the M MME is at least R -robust at x 0 with
R = [Equation] [Equation] 1 +
[Equation]
1 −
[Equation] [Equation]
2 , where
[Equation]
[Equation]
The above corollary reveals the connection between an ensemble and single-model robustness.
As we can see, when cos θ < 1 − 4∆ C (1+∆) 2 ( C is either C WE or C MME ), R > r .
When the base models are smooth enough ( β → 0 + so ∆ → 0 + ), in Equations (8) and (9), the RHS → 1 − .
As long as the cosine similarity of base models’ gradients are not close to 1 , this condition can be easily satisﬁed, i.e., the ensemble models achieve higher certiﬁed robustness than base models.
Furthermore, the diversity of gradients measured by cosine similarity is important for improving ensemble robustness.
We defer the proof to Appendix B.4.
Next, we discuss the implications of our theoretical analysis.
Key factors for the certiﬁed robustness of an ensemble.
We observe that smaller magnitude of joint gradients (e.g. (cid:107) (cid:80)
[Equation]
[Equation]
[-(cid:107) 
-] (Theorem 3)) indicates smaller LHS in Equations (4) to (7).
[-+ ∇ x f y 0 /y 2( x 0 ) (cid:107) 
-]
Since these robustness condition has the form LHS ≤ RHS , it implies that the robustness condition is easier to be satisﬁed for current radius r , i.e., the certiﬁed robust radius r could be improved. Therefore, smaller magnitude of joint gradients leads to higher certiﬁed ensemble robustness.
Inspired from low of cosines: for any two vectors a , b , (cid:107) a + b (cid:107)= (cid:0) (cid:107) a (cid:107)
{++ (cid:107) b (cid:107) 
+}
+ 2 (cid:107) a (cid:107) 2 (cid:107) b (cid:107) 2 cos (cid:104) a , b (cid:105) (cid:1) 1 / 2 , the smaller magnitude of joint gradients can be achieved by smaller gradient magnitude of base models or larger diversity (in terms of smaller cosine similarity) between the gradient of base models.
Therefore, constraining the magnitude of joint gradient is equivalent to improving gradient diversity and reducing base models’ gradient magnitude, and they both contribute to improved ensemble robustness.
We can also observe that large conﬁdence margins, such as (cid:80) Nj =1 w j f y
/y
i j ( x 0 ) (Theorem 2) and f y 0 /y 1( x 0 ) + f y 0 /y 2( x 0 ) (Theorem 3), directly lead to larger RHS in Equations (4) to (7).
It again implies that the robustness condition becomes easier to be satisﬁed and larger robust radius r can be achieved.
Thus, increasing conﬁdence margins can lead to higher ensemble robustness .
Comparison between ensemble and single-model robustness.
As the discussion following Corollary 1 reveals, when the base models are smooth enough, the ensemble model is more robust than the base models.
Moreover, we prove that certiﬁed robustness of ensembles is positively correlated with the base model (gradient) diversity, which is aligned with existing empirical observations (Tram`er et al., 2017; Pang et al., 2019).
2. D IVERSITY - R EGULARIZED T RAINING
Inspired by the above key factors for the certiﬁed ensemble robustness, we propose the D iversityR egularized T raining.
In particular, let x 0 be a training sample, DRT contains the following two regularization terms in the objective function to minimize:
• Gradient Diversity Loss (GD Loss):
[Equation]
• Conﬁdence Margin Loss (CM Loss):
[Equation]
In Equations (10) and (11), y 0 is the ground-truth label of x 0 , and y (2) i (or y (2) j ) is the runner-up class of base model F i (or F j ).
Intuitively, for each model pair ( i, j ) where i, j ∈
[ N ] and i (cid:54) =
j , the GD Loss encourages the joint gradient, i.e., gradient vector sum between model i and j , to be small.
Note that the gradient computed here is actually the gradient difference between different labels.
As our theorems reveal, it is the gradient difference between different labels instead of pure gradient itself that matters, which improves previous understanding of gradient diversity (Pang et al., 2019; Demontis et al., 2019).
The GD Loss encourages both large gradient diversity and small base models’ gradient magnitude in a naturally balanced way, and encodes the interplay between gradient magnitude and direction diversity.
Compared with GD Loss, solely regularizing the base models’ gradient would hurt the model’s benign accuracy, and solely regularizing gradient diversity is hard to realize due to the boundedness of cosine similarity.
The CM Loss encourages the large margin between the true and runner-up classes for base models.
Both regularization terms are directly motivated by our analysis, and the detailed implementation process can be found in Section 4.
R OBUSTNESS FOR S MOOTHED ML E NSEMBLES
To compute the certiﬁed robustness for different ensemble models based on Theorems 2 and 3, we need to ensure the model smoothness which is challenging.
Thus, in this section, we apply an adapted randomized model smoothing to compute certiﬁed robustness for general ensembles based on our conditions.
We focus on Ensemble Before Smoothing (EBS) strategy: ﬁrst construct the ensemble M from base models, then smooth M ’s prediction.
M could be either M WE or M MME .
We also consider another strategy as smoothing base models ﬁrst then ensemble.
The analysis of these two strategies which proves EBS is more robust is deferred to Appendix C.
3. C ERTIFIED R OBUSTNESS OF E NSEMBLES VIA R ANDOMIZED S MOOTHING
To derive the certiﬁed robustness of both MME and WE, we ﬁrst deﬁne the statistical robustness and conﬁdence for the single model and ensemble models.
Deﬁnition 5 ( ( (cid:15) , p ) -Statistical Robust) .
Given a random variable (cid:15) and model F : R d (cid:55)→ [ C ] , at point x 0 with ground truth label y 0 , we call F is ( (cid:15) , p ) -statistical robust if Pr (cid:15) ( F ( x 0 + (cid:15) ) =
y 0 ) ≥ p .
Note that based on Theorem B.1, when (cid:15) ∼ N (0 , σ 2 I d ) , if F is ( (cid:15) , p ) -statistical robust at point x 0 , the smoothed model G (cid:15) F over F is ( σ Φ − 1 ( p ))
-robust at point x 0 .
Deﬁnition 6 ( ( (cid:15) , λ, p ) -WE Conﬁdent) .
Let M WE be Weighted Ensemble deﬁned over base models { f i } Ni =1 with weights { w i } Ni =1 .
If at point x 0 with ground-truth y 0 and random variable (cid:15) , we have
[Equation]
we call Weighted Ensemble M WE ( (cid:15) , λ, p )
-WE conﬁdent at point x 0 .
Deﬁnition 7 ( ( (cid:15) , λ, p ) -MME Conﬁdent) .
Let M MME be a Max-Margin Ensemble over { f i } Ni =1 .
If at point x 0 with ground-truth y 0 and random variable (cid:15) , we have
[Equation]
we call Max-Margin Ensemble M MME ( (cid:15) , λ, p ) -MME conﬁdent at point x 0 .
Note that the conﬁdence of every single model lies in the probability simplex, and λ reﬂects the conﬁdence portion that a wrong prediction class can take beyond the true class ( 1 − f i ( x 0 + (cid:15) ) ).
Now we are ready to present the certiﬁed robustness for different ensemble models.
Theorem 4 (Certiﬁed Robustness for WE) .
Let (cid:15) be a random variable supported on R d .
Let M WE be a Weighted Ensemble deﬁned over { f i } Ni =1 with weights { w i } Ni =1 .
The M WE is ( (cid:15) , λ 1 , p ) -WE conﬁdent.
Let x 0 ∈ R
d be the input with ground-truth label y 0 ∈
[ C ] .
Assume { f i ( x 0 + (cid:15) )
y 0 } Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d.
and follow symmetric distribution with mean µ and variance s 2 , where µ > (1 + λ − 1 1 ) − 1 .
We have
[Equation]
Theorem 5 (Certiﬁed Robustness for MME) .
Let (cid:15) be a random variable supported on R d .
Let M MME be a Max-Margin Ensemble deﬁned over { f i } Ni =1 .
The M MME is ( (cid:15) , λ 2 , p ) -MME conﬁdent.
Let x 0 ∈ R
d be the input with ground-truth label y 0 ∈
[ C ] .
Assume { f i ( x 0 + (cid:15) )
y 0 } Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d.
and follow symmetric distribution with mean µ where µ > (1 + λ − 1 2 ) − 1 .
Deﬁne s 2 f =
Var(min i ∈
[ N ] f i ( x 0 + (cid:15) )
y 0 )
We have
[Equation]
The condition µ > 1 / (1 + λ − 1 ) guarantees normal performance of a model, which is the sufﬁcient condition for the standard setup p
A > p B as in (Cohen et al., 2019)).
For comparison, we also derive certiﬁed robustness for a single model in Proposition D.1.
We defer the proofs to Appendix D.1.
Based on our theoretical analysis above, we draw additional implications on the connections between the certiﬁed robustness and different losses.
For Conﬁdence Margin Loss , which aims at increasing the conﬁdence margin of ensembles by enlarging that of base models, from Theorems 4 and 5, we can see that small λ ( λ 1 in WE and λ 2 in MME) results in large Pr( M ( x 0 + (cid:15) ) =
y 0 ) , i.e., large certiﬁed robustness.
For Standard Training Loss , which increases base models’ conﬁdence of true class, we can view it as increasing the average conﬁdence score, µ , and its effectiveness is revealed from Theorems 4 and 5.
3. C OMPARISON FOR THE C ERTIFIED R OBUSTNESS OF E NSEMBLES
The uniﬁed form of certiﬁed robustness above allows us to compare it for different ensembles.
Corollary 2 (Comparison of Certiﬁed Robustness) .
Let (cid:15) be a random variable supported on R d .
Over base models { f i } Ni =1 , let M MME be Max-Margin Ensemble, and M WE the Weighted Ensemble with weights { w i } Ni =1 .
Let x 0 ∈ R
d be the input with ground-truth label y 0 ∈
[ C ] .
Assume { f i ( x 0 + (cid:15) )
y 0 } Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d.
and follow symmetric distribution with mean µ and variance s 2 , where µ > max { (1 + λ − 1 1 ) − 1 , (1 + λ − 1 2 ) − 1 } .
Deﬁne s 2 f =
Var(min i ∈
[ N ] f i ( x 0 + (cid:15) )
y 0 )
and assume s f < s .
When
[Equation]
for any weights { w i } Ni =1 , M WE has higher certiﬁed robustness than M MME .
When
[Equation]
for any weights { w i } Ni =1 , M MME has higher certiﬁed robustness than M WE .
Here, the certiﬁed robustness is given by Theorems 4 and
Appendix D.2 entails the detailed proofs.
Note that given λ 1 is the weighted average and λ 2 the maximum over λ ’s of all base models, λ 1 /λ 2 reﬂects the adversarial transferability (Papernot et al., 2016a) among base models under the same p : If the transferability is high the conﬁdence scores of base models are similar ( λ ’s are similar), and thus λ 1 is large resulting in large λ 1 /λ 2 .
On the other hand, when the transferability is low, the conﬁdence scores are diverse ( λ ’s are diverse), and thus λ 1 is small resulting in small λ 1 /λ 2 .
Based on our theoretical analysis we can see that MME is more robust when the transferability is high; WE is more robust when the transferability is low.
In
Appendix D.3, we also prove that under certain distribution of f i ( x 0 + (cid:15) )
y 0 , when N is sufﬁciently large, the MME always more robust.
Appendix D.4 entails the numerical evaluations.
E XPERIMENTAL E VALUATION
In order to make a fair comparison with existing work (Cohen et al., 2019; Salman et al., 2019), we evaluate our approach on different datasets: MNIST (LeCun et al., 2010), CIFAR-10 (Krizhevsky, 2012), and ImageNet (Deng et al., 2009).
We show that by training MME/WE with DRT, our model can achieve the state-of-the-art certiﬁed robustness.
4. E XPERIMENTAL S ETUP
Baselines : We mainly consider two state-of-the-art baselines for certiﬁed robustness: 1) Gaussian smoothing (Cohen et al., 2019), which trains a smoothed classiﬁer by applying Gaussian augmentation.
SmoothAdv (Salman et al., 2019), which integrates adversarial training on the soft approximation.
The comparison with more baselines can be found in Appendix E.4.
Model structures : For each base model in our ensemble, we follow the same conﬁguration of the baselines: LeNet (LeCun et al., 1998) for MNIST, ResNet-110 and ResNet-50 (He et al., 2016) for
CIFAR-10 and ImageNet datasets.
Training: We smooth the N base models of an ensemble following the baselines (Cohen et al., 2019;
Salman et al., 2019).
For each input x 0 with ground truth y 0 , we use x 0 + (cid:15) with (cid:15) ∼ N (0 , σ 2 I d ) as training input for each base model.
We call two base models (cid:0)
f i , f j (cid:1) valid model pair at ( x 0 , y 0 )
if both F i ( x 0 + (cid:15) ) and F j ( x 0 + (cid:15) ) predict y 0 .
For every valid model pair, we apply GD Loss and CM
Loss with ρ 1 and ρ 2 as the weight parameters.
The ﬁnal training loss of an ensemble is as below:
[Equation]
y 0 ) i + ρ(cid:88) i,j ∈ [ N ] ,i (cid:54) =
j F i ( x 0 + (cid:15) )=
y
F j ( x 0 + (cid:15) ) = y
L GD ( x 0 + (cid:15) ) ij + ρ(cid:88) i,j ∈ [ N ] ,i (cid:54) = j F i ( x 0 + (cid:15) )= y F j ( x 0 + (cid:15) )
= y
L CM ( x 0 + (cid:15) ) ij . The standard training loss L std ( x 0 + (cid:15) , y 0 ) i of each base model f i is either cross-entropy loss in (Cohen et al., 2019;
Yang et al., 2020), or adversarial training loss in (Salman et al., 2019).
We leave more training details in Appendix E.
Robustness Certiﬁcation: During certiﬁcation, we apply the MME or WE ensemble protocols over the trained base models { f i } Ni =1 to obtain ensemble M , then smooth M with noise (cid:15) ∼ N (0 , σ 2 I d ) .
We report the standard certiﬁed accuracy under different L 2 radius r as our evaluation metric (Cohen et al., 2019) (more implementation details in Appendix E). [Table] [Table] [Table]
E XPERIMENTAL R ESULTS
In our experiments, we consider ensemble models consisting of three base models on MNIST,
CIFAR-10, and ImageNet datasets.
We observe that when training MME or WE (using different base models) with DRT, they can achieve the state-of-the-art certiﬁed robustness.
The evaluation results on MNIST are shown in Table 1.
We observe that the certiﬁed accuracy can be improved slightly by applying the MME or WE compared with a single base model (aligned with
Corollary 1).
After training with DRT, the improvements become signiﬁcant and the DRT-trained ensemble models can achieve the highest certiﬁed accuracy under every radius r .
In particular,
DRT ensemble model can surpass the base model
’s
certiﬁed accuracy around 7% under large radius r = 2 .
We further compare the certiﬁed robustness of WE and MME in Appendix D.4.
On CIFAR-10 the evaluation results are shown in Table 2.
Similarly, we can see that the DRT-based ensemble model can achieve the best certiﬁed robustness under different radius r (more experimental details are in Appendix E.2).
Note that the DRT-based ensemble with Gaussian smoothed base models can achieve comparable results to SmoothAdv with less training time (detailed efﬁciency analysis is in Appendix E.2).
We defer the results on ImageNet to Appendix E.3 and put all discussions about hyper-parameters under different settings in Appendix E.
C ONCLUSION
In this paper, we explore and characterize the robustness conditions for ensemble ML models theoretically, and propose DRT for training a robust ensemble in practice.
Our analysis provides the justiﬁcation of the regularization- based training approach DRT, as well as why an ensemble model could have higher robustness compared with a single model.
Especially, we show that smaller magnitude of joint gradients, and the large conﬁdence margins are the key factors that contribute to high certiﬁed robustness of an ensemble.
We further compare the certiﬁed robustness of two types of ensembles: Weighted Ensemble and Max-Margin Ensemble under the randomized smoothing regime.
Extensive experiments show that the ensemble models trained with DRT can achieve higher certiﬁed robustness than existing approaches.
A T ABLE OF T HEORETICAL R ESULTS
For a quick index for the theoretical results, we refer the readers to Table 3.
B F ORMAL D EFINITIONS AND P ROOFS OF R OBUSTNESS C ONDITIONS
In this appendix, we discuss the connection between r -robustness and certiﬁed robustness given by randomized smoothing, and the detailed proofs of the robustness conditions in Section 2.
B. r -R OBUSTNESS AND R ANDOMIZED S MOOTHING
In this subsection, we discuss the connection between r -robustness and the certiﬁed robustness given by randomized smoothing (Cohen et al., 2019).
In randomized smoothing, each input’s prediction is given by the most probable prediction after adding noise.
Formally, let (cid:15) ∼ N (0 , σ 2 I d ) be a Gaussian random variable, from model prediction
F , we can deﬁne the smoothed classiﬁer G (cid:15) F : R d (cid:55)→
[ C ] where G (cid:15) F ( x ) = arg max j ∈ [ C ] g (cid:15) F ( x ) j : g (cid:15) F ( x [Equation] j := [Equation]
[Equation]
[Equation]
Intuitively, the conﬁdence score for each class is given by the probability of predicting that class under noised inputs.
Theorem B.1 (Simpliﬁed; Certiﬁed Robustness via Randomized Smoothing; Cohen et al.
At point x 0 , let (cid:15) ∼ N (0 , σ 2 I d ) , a smoothed model G [Equation] F is r -robust, where
[Equation]
19) and Φ − 1 is the inverse function of Gaussian CDF.
We remark that a tighter certiﬁed radius is
[Equation]
≥ r , while for the ease of sampling, the Equation (19) is used more often in the literature.
In Sections 3 and 4, we use Equation (19) for analysis and empirical evaluation, and these results can be generalized to the tighter radius r (cid:48) easily.
B. G ENERAL R OBUSTNESS C ONDITIONS
Proposition 1 (Robustness Condition for WE) .
Consider an input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] , and an ensemble model M WE constructed by base models { f i } Ni =1 with weights { w i } Ni =1 .
Suppose M WE ( x 0 ) =
y 0 .
Then, the ensemble M WE is r -robust at point x 0 if and only if for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } ,
[Equation]
[Equation]
Proof of Proposition 1.
According the the deﬁnition of r -robust, we know M WE is r -robust
if and only if for any point x := x 0 + δ where (cid:107) δ (cid:107) 2 ≤ r , M WE ( x 0 + δ ) =
y 0 , which means that for any other label
y i (cid:54) =
y 0 , the conﬁdence score for label y 0 is larger or equal than the conﬁdence score for label y
i .
It means that
[Equation]
for any x ∈ { x 0 + δ : (cid:107) δ [Equation] 2 ≤ r } .
Since this should hold for any y i (cid:54) =
y 0 , we have the necessary and sufﬁcient condition
[Equation]
Theorem 1 (Robustness Condition for MME) .
Consider an input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] .
Let M MME be an MME deﬁned over base models { f i } Ni =1 .
Suppose: (1) M MME ( x 0 ) =
y 0 ; (2) for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } , given any base model i ∈
[ N ] , either F i ( x ) =
yor F (2) i ( x ) = y 0 .
Then, the ensemble M MME is r -robust at point x 0 if and only if for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } ,
[Equation]
The theorem states the sufﬁcient and necessary robustness condition for MME.
We divide the two directions into the following two lemmas and prove them separately.
We mainly use the alternative form of Equation (3) as such in the following lemmas and their proofs:
[Equation]
Lemma B.1 (Sufﬁcient Condition for MME) .
Let M MME be an MME deﬁned over base models { f i } Ni =1 .
For any input x 0 ∈ R d , the Max-Margin Ensemble M MME predicts M MME ( x 0 ) =
y
if
[Equation]
Proof of Lemma B.1.
For brevity, for i ∈ [ N ] , we denote y i :
=
F i ( x 0 ) , y (cid:48) i := F (2) i ( x 0 ) for each base model’s top class and runner-up class at point x 0 .
Suppose M MME ( x 0 ) (cid:54) =
y 0 , then according to ensemble deﬁnition (see Deﬁnition 3), there exists c ∈
[ N ] , such that M MME ( x 0 )
=
F c ( x 0 ) =
y c , and
[Equation]
[Equation]
Because y c (cid:54) =
y 0 , we have f c ( x 0 ) y 0 ≤ f c ( x 0 ) y (cid:48) c , so that f c ( x 0 ) y c /y 0 ≥ f c ( x 0 ) y c /y (cid:48) c .
Now consider any model f i where i ∈ [ N ] , we would like to show that there exists y ∗ (cid:54)
=
y 0 , such that f i ( x 0 )
y i /y (cid:48)
i ≥ f i ( x 0 )
y 0 /y ∗ :
• If y i =
y 0 , let y ∗ :
= y (cid:48)
i , trivially f i ( x 0 )
y i /y (cid:48)
i =
f i ( x 0 )
y 0 /y ∗ ;
• If y i (cid:54) = y 0 , and y (cid:48)
i (cid:54) =
y 0 , we let y ∗ :
= y (cid:48)
i , then f i ( x 0 )
y i /y (cid:48)
i =
f i ( x 0 )
y i /y
∗ ≥ f i ( x 0 )
y 0 /y ∗ ;
• If y i (cid:54) = y 0 , but y (cid:48)
i =
y 0 , we let y ∗ :
= y i , then f i ( x 0 )
y i /y (cid:48)
i =
f i ( x 0 )
y
i /y 0 ≥ f i ( x 0 )
y
/y i =
f i ( x 0 )
y 0 /y ∗ .
Combine the above ﬁndings with Equation 21, we have:
∀ i ∈
[ N ] , i (cid:54) =
c, ∃ y ∗ c ∈ [ C ] and y ∗ c (cid:54) =
y 0 , ∃ y ∗ i ∈
[ C ] and y ∗ i (cid:54) =
y 0 , f c ( x 0 )
y ∗ c /y 0 > f i ( x 0 )
y 0 /y ∗ i .
Therefore, its negation
∃ i ∈
[ N ] , i (cid:54) =
c, ∀ y ∗ c ∈ [ C ] and y ∗ c (cid:54) =
y 0 , ∀ y ∗ i ∈
[ C ] and y ∗ i (cid:54) =
[Equation]
implies M ( x 0 ) =
y 0 .
Since Equation (22) holds for any y ∗ c and y ∗ i , the equation is equivalent to ∃ i ∈ [ N ] , i (cid:54)
=
c,
[Equation]
The existence qualiﬁer over i can be replaced by maximum:
[Equation]
It is implied by
[Equation]
Thus, Equation (3) is a sufﬁcient condition for M MME ( x 0 ) =
y 0 .
Lemma B.2 (Necessary Condition for MME) .
For any input x 0 ∈ R d , if for any base model i ∈
[ N ] , either F i ( x 0 ) =
y 0 or F (2) i ( x 0 ) =
y 0 , then Max-Margin Ensemble M MME predicting
M MME ( x 0 ) =
y 0 implies
[Equation]
Proof of Lemma B.2.
Similar as before, for brevity, for i ∈ [ N ] , we denote y i :
= F i ( x 0 ) , y (cid:48) i :=
F (2) i ( x 0 ) for each base model’s top class and runner-up class at point x 0 .
Suppose Equation (3) is not satisﬁed, it means that ∃ c ∈ [ N ] , ∃ y ∗ c ∈
[ C ] and y ∗ c (cid:54) =
y 0 , ∀ i ∈
[ N ] , ∃ y ∗ i ∈
[ C ] and y ∗ i (cid:54) =
y 0 , f y ∗ c /y
c
[Equation]
• If y c = y 0 , then f y ∗ c /y
c ( x 0 ) ≤ 0 , which implies that f y 0 /y ∗ i
i ( x 0 ) < 0 , and hence F i ( x 0 ) (cid:54) =
y 0 .
Moreover, we know that f y i /y (cid:48)
i i
[Equation]
• If y c (cid:54) =
y 0 ,
i
e., y (cid:48)
c
= y 0 , then f y c /y
c x 0 )
[Equation]
f y ∗ [-c /y 
-][Equation]
[Equation] x
[Equation] [Equation] ( x 0 ) .
If F i ( x 0 ) = y 0 , then f y 0 /y
∗
i
i ( x 0 ) ≥ f y 0 /y (cid:48)
i i ( x 0 ) =
f y i /y (cid:48)
i i ( x 0 ) .
Thus, f y c /y (cid:48)
c c ( x 0 ) =
f y c /y
c ( x 0 ) >
f y i /y (cid:48)
i i ( x 0 ) .
As the result, M ( x 0 )
=
F c ( x 0 ) (cid:54) =
y 0 .
For both cases, we show that M MME ( x 0 ) (cid:54) =
y 0 , i.e., Equation (3) is a necessary condition for
M ( x 0 ) =
y 0 .
Proof of Theorem 1.
Lemmas B.1 and B.2 are exactly the two directions (necessary and sufﬁcient condition) of M MME predicting label y
at point x .
Therefore, if the condition (Equation (3)) holds for any x ∈ { x
+ δ : (cid:107) δ (cid:107) 2 ≤ r } , the ensemble M MME is r -robust at point x 0 ; vice versa.
For comparison, here we list the trivial robustness condition for single model.
Fact B.1 (Robustness Condition for Single Model) .
Consider an input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] .
Suppose a model F satisﬁes F ( x 0 ) =
y 0 .
Then, the model F is r -robust at point xif and only if for any x ∈ { x
+ δ : (cid:107) δ (cid:107) 2 ≤ r } , min y i ∈
[ C ]: y i (cid:54) =
y
f y 0 /y
i ( x ) ≥ 0 .
The fact is apparent given that the model predicts the class with the highest conﬁdence.
B. G RADIENT AND C ONFIDENCE M ARGIN -B ASED C ONDITION
We can concertize the preceding general robustness condition by gradients and conﬁdence margins of base models leveraging Taylor expansion.
Theorem 2 (Gradient and Conﬁdence Margin Condition for WE Robustness) .
Given input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] , and M WE as a WE deﬁned over base models { f i } Ni =1 with weights { w i } Ni =1 .
M WE ( x 0 ) =
y 0 .
All base model f i ’s are β -smooth.
• (Sufﬁcient Condition)
M WE is r -robust at point x 0 if for any y i (cid:54) =
y[-0 , (cid:13)(cid:13)(cid:13) N (cid:88) j = w j ∇ x f y 
 /y i j ( x 0 ) (cid:13)(cid:13)(cid:13)-]
[Equation]
• (Necessary Condition)
If M WE is r -robust at point x 0 , then for any y i (cid:54) =
y
[Equation]
Proof of Theorem 2.
From Taylor expansion with Lagrange remainder and the β -smoothness assumption on the base models, we have N
[Equation]
where the term − 1 2 r 2 (cid:80) Nj =1 (2 βw j ) and 1 2 r 2 (cid:80) Nj =1 (2 βw j ) are bounded from Lagrange remainder.
From Proposition 1, the sufﬁcient and necessary condition of WE’s r -robustness is (cid:80)
Nj =
[Equation]
w
[Equation]
{+f y 
 /y i j ( x ) ≥ 0+} for any y i ∈
[ C ] such that y i (cid:54) =
y 0 , and any x = x 0 + δ where (cid:107) δ (cid:107) 2 ≤ r .
Plugging this term into Equation (23) we get the theorem.
Theorem 3 (Gradient and Conﬁdence Margin Condition for MME Robustness) .
Given input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] , and M MME as an MME deﬁned over base models { f 1 , f 2 } .
M MME ( x 0 ) =
y 0 .
Both f 1 and f 2 are β -smooth.
• (Sufﬁcient Condition)
If for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
y 0 and y 2 (cid:54) =
[Equation]
6) then M MME is r -robust at point x 0 .
• (Necessary Condition) Suppose for any x ∈ { x 0 + δ : ||
δ || 2 ≤ r } , for any i ∈ { 1 , 2 } , either F i ( x ) =
y 0 or F (2) i ( x ) =
y 0 .
If M MME is r -robust at point x 0 , then for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
y 0 and y 2 (cid:54) =
y 0 ,
[Equation]
Proof of Theorem 3.
We prove the sufﬁcient condition and necessary condition separately.
• (Sufﬁcient Condition)
From Lemma B.1, since there are only two base models, we can simplify the sufﬁcient condition for M MME ( x ) =
y
as
[Equation]
y i ∈
[ C ]
[Equation] y i (cid:54) = [Equation] y
[Equation]
/y
i
[Equation]
( x ) +
[Equation]
y
[Equation]
i ∈
[ C ]: y (cid:48)
i (cid:54) = y [Equation] y 0 /y (cid:48)
[Equation]
( x
[Equation]
≥ 0 .
In other words, for any y 1 (cid:54) =
y 0 and y 2 (cid:54) =
y 0 ,
[Equation]
With Taylor expansion and smoothness assumption, we have
[Equation]
{+Plugging this into Equation (24) yields the sufﬁcient condition. In the above equation, the term − 12 · 4 βr 2 is bounded from Lagrange remainder. Here, the 4 β term comes from the fact that f y 0 /y 
+}
[Equation]
x ) is (4 β ) -smooth since it is the sum of difference of β -smooth function.
• (Necessary Condition)
From Lemma B.2, similarly, the necessary condition for M MME ( x ) =
y 0 is simpliﬁed to: for any y 1 (cid:54)
=
y 0 and y 2 (cid:54) =
y 0 ,
[Equation] [Equation]
Again, from Taylor expansion, we have
[Equation]
Plugging this into Equation (24) yields the necessary condition.
In the above equation, the term + 12 · 4 βr 2 is bounded from Lagrange remainder.
The 4 β term appears because of the same reason as before.
To compare the robustness of ensemble models and the single model, we show the corresponding conditions for single-model robustness.
Proposition B.1 (Gradient and Conﬁdence Margin Conditions for Single-Model Robustness) .
Given input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] .
Model F ( x 0 ) =
y 0 , and it is β -smooth.
• (Sufﬁcient Condition)
If for any y 1 ∈ [ C ] such that y 1 (cid:54) =
y 0 ,
[Equation]
F is r -robust at point x 0 .
• (Necessary Condition)
If F is r -robust at point x 0 , for any y 1 ∈ [ C ] such that y
[Equation]
= y
[Equation]
Proof of Proposition B.1.
This proposition is apparent given the following inequality from Taylor expansion
[Equation]
and the necessary and sufﬁcient robust condition in Fact B.1.
B. C OMPARE C ERTIFIED R OBUSTNESS OF E NSEMBLE M ODEL AND S INGLE M ODELS
Corollary 1 (Comparison of Ensemble and Single-Model Robustness) .
Given an input x 0 ∈ R d with ground-truth label y 0 ∈
[ C ] .
Suppose we have two β -smooth base models { f 1 , f 2 } , which are both r -robust at point x 0 .
For any ∆ ∈ [0 , 1) :
• (Weighted Ensemble) Deﬁne
Weighted Ensemble M WE with base models { f 1 , f 2 }
Suppose M WE
[Equation]
x 0 )
=
y
[Equation]
If for any label y i (cid:54) =
y 0 , the base models’ smoothness
[Equation]
[Equation]
c 2 r 2 ) , and the gradient cosine similarity
[Equation]
( x 0 ) , ∇ x f
[Equation]
[Equation] ( x 0 ) (cid:105) ≤ cos θ , then the M WE with weights { w 1 , w 2 } is at least
R -robust at point x 0 with
[Equation]
=
[Equation]
/ 2 , where
[Equation] [Equation]
• (Max-Margin Ensemble) Deﬁne Max-Margin Ensemble M MME with the base models { f 1 , f 2 } .
Suppose M MME ( x 0 ) =
y 0 .
If for any label y 1 (cid:54) =
y 0 and y 2 (cid:54) =
y 0 , the base models’ smoothness β
[Equation]
2 ) , and the gradient cosine similarity cos
[Equation]
x
[Equation] [Equation]
x 0 ) (cid:105) ≤ cos θ , then the M MME is at least R -robust at point xwith
[Equation]
, where
[Equation]
Proof of Corollary 1.
We ﬁrst prove the theorem for Weighted Ensemble.
For arbitrary y i (cid:54) =
y 0 , we have
[Equation]
[Table]
[Equation]
where ( i. ) follows from the necessary condition in Proposition B.1; ( ii. ) uses the condition on β ; and ( iii. ) replaces 2 w 1 w 2 f y
/y
i( x 0 ) f
y 0 /
[Equation]
i( x [Equation] ) leveraging C WE .
Now, we deﬁne
[Equation]
All we need to do is to prove that M WE is robust within radius Kr .
To do so, from Equation (4), we upper bound (cid:107) w 1 ∇ x f y 0 /y
i
[Equation] [Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
Notice that ∆ min { f y 0 /y
i
[Equation]
x 0 )
, f y 0 /y
i( x 0 ) } ≥ βc 2 r 2 from β ’s condition, so
[Equation]
f y
[Equation]
≤
[Equation]
From Equation (4), the theorem for Weighted Ensemble is proved.
Now we prove the theorem for Max-Margin Ensemble.
Similarly, for any arbitrary y 1 , y 2 such that y 1 (cid:54) =
y 0 , y 2 (cid:54) =
y 0 , we have
[Equation]
Now we deﬁne
K
[Equation]
cos
[Equation]
− 1 / 2 .
Again, from β ’s condition we have ∆ min { f y 0 /y 1( x 0 ) , f y 0 /y 2( x 0 ) } ≥ βc 2 r
and (cid:107)∇
[Equation]
f
[Equation]
From Equation (6), the ensemble is ( K (cid:48) r ) -robust at point x 0 , i.e., the theorem for Max-Margin
Ensemble is proved.
D ISCUSSION
Optimizing Weighted Ensemble.
As we can observe from Corollary 1, we can adjust the weights { w 1 , w 2 } for Weighted Ensemble to change C WE and the certiﬁed robust radius (Equation (8)).
Then comes the problem of which set of weights can achieve the highest certiﬁed robust radius.
Since larger C WE results in higher radius, we need to choose
[Equation]
Since this quantity is scale-invariant, we can ﬁx w 1 and optimize over w 2 to get the optimal weights.
In particular, if there are only two classes, we have a closed-form solution
[Equation]
and corresponding C WE achieves the maximum 1 / 2 .
For a special case—average weighted ensemble, we get the corresponding certiﬁed robust radius by setting w 1 = w 2 and plug the yielded
[Equation]
into Equation (8).
Comparison between ensemble and single-model robustness.
We expand the discussion in Section 2.1.
The similar forms of R in the corollary allow us to discuss the Weighted Ensemble and
Max-Margin Ensemble together.
Speciﬁcally, we let C be either C WE or C MME , then
[Equation]
Since when R > r , both ensembles have higher certiﬁed robustness than the base models, we solve this condition for cos θ :
[Equation]
Notice that C ∈ (0 , 1 / 2] .
From this condition, we can easily observe that when the gradient cosine similarity is smaller, it is more likely that the ensemble has higher certiﬁed robustness than the base models.
When the model is smooth enough, according to the condition on β , we can notice that ∆ would be close to zero.
As a result, 1 − 4∆ C (1+∆) 2 is close to 1 .
Thus, unless the gradient of base models is (or close to) colinear, it always holds that the ensemble (either WE or MME) has higher certiﬁed robustness than the base models.
C A NALYSIS OF E NSEMBLE S MOOTHING S TRATEGIES
In Section 3 we mainly use the adapted randomized model smoothing strategy which is named
Ensemble Before Smoothing (EBS).
We also consider Ensemble After Smoothing (Ensemble After
Smoothing).
Through the following analysis, we will show Ensemble Before Smoothing is generally better than Ensemble After Smoothing which justiﬁes our choice of the strategy.
We formally deﬁne Ensemble Before Smoothing strategy as below:
Deﬁnition C.
(Strategy: Ensemble Before Smoothing (EBS) ) .
Let M be an ensemble model over base models { f i } Ni =1 .
Let (cid:15) be a random variable.
The EBS ensemble G (cid:15) M : R d (cid:55)→ [ C ] at input x 0 ∈ R d is deﬁned by:
[Equation]
We deﬁne the Ensemble After Smoothing strategy accordingly:
Deﬁnition C.2 (Strategy: Ensemble After Smoothing (EAS) ) .
Let M be an ensemble model over base models { f i } Ni =1 .
Let (cid:15) be a random variable.
The EAS ensemble H (cid:15) M : R d (cid:55)→ [ C ] at input x 0 ∈ R d is deﬁned as:
[Equation]
Here, c is the index of the smoothed base model selected.
Remark.
In EBS, we ﬁrst construct a model ensemble M based on base models using WE or MME protocol, then apply randomized smoothing on top of the classiﬁer.
The classiﬁer predicts the most frequent class of M when the input follows distribution x 0 + (cid:15) .
In EAS, we use (cid:15) to construct smoothed classiﬁers for base models respectively.
Then, for given input x 0 , the ensemble agrees on the base model which has the highest probability for its predicted class.
C. C ERTIFIED R OBUSTNESS
In this subsection, we characterize the certiﬁed robustness when using both strategies.
C.1. E NSEMBLE B EFORE S MOOTHING
Proposition C.1 (Certiﬁed Robustness for Ensemble Before Smoothing) .
Let G (cid:15)
M be an ensemble constructed by EBS strategy.
The random variable (cid:15) ∼ N (0 , σ 2 I d ) .
Then the ensemble G (cid:15) M is r -robust at point x 0 where
[Equation]
Here, g (cid:15) M ( x 0 ) j = Pr (cid:15) ( M ( x 0 + (cid:15) ) = j ) .
The proposition is a direct application of Theorem B.1.
C.1. E NSEMBLE A FTER S MOOTHING
Theorem C.1 (Certiﬁed robustness for Ensemble After Smoothing) .
Let H (cid:15)
M be an ensemble constructed by EAS strategy over base models { f i } Ni =1 .
The random variable (cid:15) ∼ N (0 , σ 2 I d ) .
Let y
= H (cid:15) M ( x 0 ) .
For each i ∈ [ N ] , deﬁne
[Equation]
i :=
[Equation]
Then the ensemble H (cid:15) M is r -robust at point x 0 where
[Equation]
[Equation] [Equation]
Remark.
The theorem appears to be a bit counter-intuitive — picking the best smoothed model in terms of certiﬁed robustness cannot give strong certiﬁed robustness for the ensemble.
As long as the base models have different certiﬁed robust radius (i.e., r i ’s are different), the r , certiﬁed robust radius for the ensemble, is strictly inferior to that of the best base model (i.e., max r i ).
Furthermore, if there exists a base model with wrong prediction (i.e., r i ≤ 0 ), the certiﬁed robust radius r is strictly smaller than half of the best base model.
Proof of Theorem C.1.
Without loss of generality, we assume r 1 > r 2 > · · · > r N .
Let the perturbation added to x 0 has L 2 length δ .
When δ ≤ r N , since picking any model always gives the right prediction, the ensemble is robust.
When r N < δ ≤ r 1 + r N, the highest robust radius with wrong prediction is δ − r N , and we can still guarantee that model f 1 has robust radius at least r 1 − δ from the smoothness of function x (cid:55)→ g (cid:15) F 1 ( x ) G (cid:15) F 1 ( x 0 ) (Salman et al., 2019).
Since r 1 − δ ≥ r 1 − r N≥ δ − r N , the ensemble will agree on f 1 or other base model with correct prediction and still gives the right prediction.
When δ > r 1 + r N, suppose f N is a linear model and only predicts two labels (which achieves the tight robust radius bound according to Cohen et al.
, then f N can have robust radius δ − r N for the wrong prediction.
At the same time, for any other model f i which is linear and predicts correctly, the robust radius is at most r i − δ .
Since r i − δ <
r 1 − δ <
r 1 − r N< δ − r N , the ensemble can probably give wrong prediction.
In summary, as we have shown, the certiﬁed robust radius can be at most r .
For any radius δ > r , there exist base models which lead the ensemble H (cid:15)
M ( x 0 + δ e )
to predict the label other than y 0 .
C. C OMPARISON OF T WO S TRATEGIES
In this subsection, we compare the two ensemble strategies when the ensembles are constructed from two base models.
Corollary C.1 (Smoothing Strategy Comparison) .
Given M MME , a Max-Margin Ensemble constructed from base models { f a , f b } .
Let (cid:15) ∼ N (0 , σ 2 I d ) .
Let G (cid:15)
M MME be the EBS ensemble, and H (cid:15)
M MME be the EAS ensemble.
Suppose at point x 0 with ground-truth label y 0 , G (cid:15) F a ( x 0 ) =
G (cid:15) F b ( x 0 ) =
y 0 , g (cid:15) F a ( x 0 ) > 0 .
5 , g (cid:15) F b ( x 0 ) > 0 .
Let δ be their probability difference for class y 0 , i.e, δ :=
| g (cid:15) F a ( x 0 ) y
− g (cid:15) F b ( x 0 )
y
| ,.
Let p min be the smaller probability for class y 0 between them, i.e., p min :
=
min { g (cid:15) F a ( x 0 ) y 0 , g (cid:15) F b ( x 0 ) y 0 } .
We denote p to the probability of choosing the correct class when the base models disagree with each other; denote p ab to the probability of both base models agreeing on the correct class: p :=
Pr (cid:15) ( M MME ( x 0 + (cid:15) )
=
y
| F a ( x 0 + (cid:15) )
(cid:54) =
F b ( x 0 + (cid:15) ) and ( F a ( x 0 + (cid:15) ) =
y 0 or F b ( x 0 + (cid:15) )
=
y 0 ))
, p ab :=
Pr (cid:15) ( F a ( x 0 + (cid:15) )
=
F b ( x 0 + (cid:15) )
=
y 0 ) .
We have:
If p > 1 / 2 + (2 + 4( p min − p ab ) /δ ) − 1 , r G > r H . 2.
If p ≤ 1 / 2 , r H ≥ r G .
Here, r G is the certiﬁed robust radius of G (cid:15) M MME computed from Equation (29) ; and r H is the certiﬁed robust radius of H (cid:15) M MME computed from Equation (30) .
Remark.
Since p is the probability where the ensemble chooses the correct prediction between two base model predictions, with Max-Margin Ensemble, we think p > 1 / 2 with non-trivial margin.
The quantity p min − p ab and δ both measure the base model’s diversity in terms of predicted label distribution, and generally they should be close.
As a result, 1 / 2 + (2 + 4( p min − p ab ) /δ ) − 1 ≈ 1 / 2 + 1 / 6 = 2 / 3 , and case (1) should be much more likely to happen than case (2).
Therefore, EBS usually yields higher robustness guarantee .
We remark that the similar tendency also holds with multiple base models.
Proof of Corollary C.1.
For convenience, deﬁne p a :=
g (cid:15) F a ( x 0 ) y 0 , p b := g (cid:15) F b ( x 0 ) y 0 , where p a = p b + δ and p min = p b .
From Proposition C.1 and Theorem C.1, we have
[Equation]
Notice that Pr (cid:15) ( M MME ( x 0 + (cid:15) ) =
y 0 )
=
p ab + p ( p a + p b − 2 p ab ) , we can rewrite r G as r G = σ 2 · 2Φ − 1 ( p ab + p ( p a + p b − 2 p ab )) .
When p > 1 / 2 + (2 + 4( p min − p ab ) /δ )
− 1 , since p
[Equation]
we have p ab + p
( p a + p b − 2 p ab ) > p a .
Therefore, r G > σ Φ − 1 ( p a ) .
Whereas, r H ≤ σ/ 2 · 2Φ − 1 ( p a ) =
σ Φ − 1 ( p a ) .
So r G > r H .
When p ≤ 1 / 2 , p ab + p ( p a + p b − 2 p ab ) ≤ p ab + 1 / 2 · ( p a + p b − 2 p ab )
= ( p a + p b ) / 2 .
Therefore, r G ≤ σ Φ − 1 (( p a + p b ) / 2) .
Notice that Φ − 1 is convex in [1 / 2 , + ∞ ) , so Φ − 1 ( p a ) + Φ − 1 ( p b ) ≥ 2Φ − 1 (( p a + p b ) / 2) , i.e., r H ≥ r G .
D P ROOFS AND E XPERIMENTS OF R OBUSTNESS FOR S MOOTHED ML E NSEMBLE
In this appendix, we provide the detailed proofs and discussions for the results in Sections 3. and 3.2.
Moreover, to present a more intuitive understanding, we show both numerical and realistic experiments for the theorems.
D. C ERTIFIED R OBUSTNESS VIA R ANDOMIZED S MOOTHING
First, using the notion of ( (cid:15) , p ) -Statistical
Robust (Deﬁnition 5), we prove the certiﬁed robustness of the single model and ensembles under the i.i.d.
assumption of the conﬁdence scores.
As noted in Section 3.1 and Appendix B.1, when (cid:15) follows some distribution such as N (0 , σ 2 I d ) , we can translate the statistical robustness guarantee to r -robustness guarantee of the smoothed classiﬁer.
The following lemma is frequently used in our following proofs:
Lemma D.1.
Suppose the random variable X satisﬁes E X > 0 , Var( X ) < ∞ and for any x ∈ R + ,
Pr( X ≥ E X + x ) =
Pr( X ≤ E X − x ) , then
[Equation]
Proof of Lemma D.1.
Apply Chebyshev’s inequality on random variable X and notice that X is symmetric, then we can easily observe this lemma.
D.1. C ERTIFIED R OBUSTNESS FOR S INGLE M ODEL
As the start point, we ﬁrst show a direct proposition stating the certiﬁed robustness guarantee of the single model.
Deﬁnition D.1 ( ( (cid:15) , λ, p ) -Single Conﬁdent) .
Given a classiﬁcation model F .
If at point x 0 with ground-truth label y 0 and the random variable (cid:15) , we have
[Equation]
we call F ( (cid:15) , λ, p ) -single conﬁdent at point x 0 .
Proposition D.1 (Certiﬁed Robustness for Single Model) .
Let (cid:15) be a random variable.
Let F be a classiﬁcation model, which is ( (cid:15) , λ 3 , p ) -single conﬁdent.
Let x 0 ∈ R
d be the input with groundtruth y 0 ∈
[ C ] .
Suppose f ( x 0 + (cid:15) )
y 0 follows symmetric distribution with mean µ and variance s 2 , where µ > (1 + λ − 1 3 ) − 1 .
We have
[Equation]
Proof of Proposition D.1.
We consider the distribution of quantity Y :
= f
( x 0 + (cid:15) )
y 0 − λ 3 (1 − f ( x 0 + (cid:15) )
y 0 )
Since the model F is ( (cid:15) , λ 3 , p ) -single conﬁdent, with probability 1 − p , Y ≤ f ( x 0 + (cid:15) )
y 0 − max y j ∈
[ C ]: y j (cid:54) =
y
f ( x 0 + (cid:15) )
y j .
We note that since
E Y =
(1 + λ 3 ) µ − λ 3 , Var( Y ) =
(1 + λ 3 ) 2 s 2 , from Lemma D.1,
[Equation]
Thus,
[Equation]
D.1. C ERTIFIED R OBUSTNESS FOR E NSEMBLES
Now we are ready to prove the certiﬁed robustness of the Weighted Ensemble and Max-Margin
Ensemble (Theorems 4 and 5).
In the following text, we ﬁrst deﬁne statistical margins for both WE and MME, and point out their connections to the notion of ( (cid:15) , p ) -Statistical
Robust.
Then, we reason about the expectation, variance, and tail bounds of the statistical margins.
Finally, we derive the certiﬁed robustness from the statistical margins.
Deﬁnition D.2 ( ˆ X 1 ; Statistical Margin for WE M WE ) .
Let M WE be Weighted Ensemble deﬁned over base models { f i } Ni =1 with weights { w i } Ni =1 .
Suppose M WE is ( (cid:15) , λ 1 , p ) -WE-conﬁdent.
We deﬁne random variable ˆ X 1 which is depended by random variable (cid:15) :
[Equation]
Deﬁnition D.
( ˆ X 2 ; Statistical Margin for MME M MME ) .
Let M MME be Max-Margin Ensemble deﬁned over base models { f i } N i =1 .
Suppose M MME is ( (cid:15) , λ 2 , p ) -MME-conﬁdent.
We deﬁne random variable ˆ X 2 which is depended by random variable (cid:15) :
[Equation]
We have the following observation:
Lemma D.2.
For Weighted Ensemble,
[Equation]
For Max-Margin Ensemble,
[Equation]
Proof of Lemma D.2.
(1) For Weighted Ensemble, we deﬁne the random variable X 1 :
[Equation]
Since M WE is ( (cid:15) , λ 1 , p ) -WE-conﬁdent, from Deﬁnition 6, with probability 1 − p , we have
X 1 ( (cid:15) ) ≥
N (cid:88) j = w j ( f j ( x 0 + (cid:15) )
y
[Equation]
λ
[Equation] [Equation]
f j ( x 0 + (cid:15) ) y 0 ))
= (1 + λ 2 )
N (cid:88)
[Equation]
=
[Equation] [Equation]
w (cid:107) 1 = ˆ X 1 ( (cid:15) ) .
Therefore,
Pr
[Equation]
< [Equation]
(2) For Max-Margin Ensemble, we deﬁne the random variable X 2 :
X
[Equation]
( (cid:15)
[Equation]
:= max i ∈ [ N ] min y
[Equation]
f y
[Equation]
i (
[Equation]
(cid:15)
[Equation]
Similarly, since M MME is ( (cid:15) , λ 2 , p ) -MME-conﬁdent, from Deﬁnition 7, with probability 1 − p , we have
[Equation]
Moreover, from Lemma B.1, we know
[Equation]
As the result, to quantify the statistical robustness of two types of ensembles, we can analyze the distribution of statistical margins ˆ X 1 and ˆ X 2 .
Lemma D.3 (Expectation and variance of ˆ X 1 and ˆ X 2 ) .
Let ˆ X 1 and ˆ X 2 be deﬁned by Deﬁnition D. and Deﬁnition D.3 respectively.
Assume { f i ( x 0 + (cid:15) )
y 0 } Ni =1 are i.i.d.
and follow symmetric distribution with mean µ and variance s 2 .
Deﬁne s 2 f =
Var(min i ∈
[ N ] f i ( x 0 + (cid:15) )
y 0 )
We have
[Equation]
Proof of Lemma D.3.
[Equation]
According to the symmetric distribution property of { f i ( x 0 + (cid:15) )
y 0 } Ni =1 , we have
[Equation]
Also, due the symmetry, we have
[Equation]
As a result,
[Equation]
From Lemma D.3, now with Lemma D.1, we are ready to derive the statistical robustness lower bound for WE and MME.
Theorem 4 (Certiﬁed Robustness for WE) .
Let (cid:15) be a random variable supported on R d .
Let M WE be a Weighted Ensemble deﬁned over { f i } Ni =1 with weights { w i } Ni =1 .
The M WE is ( (cid:15) , λ 1 , p ) -WE conﬁdent.
Let x 0 ∈ R
d be the input with ground-truth label y 0 ∈
[ C ] .
Assume { f i ( x 0 + (cid:15) )
y 0 } Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d.
and follow symmetric distribution with mean µ and variance s 2 , where µ > (1 + λ − 1 1 ) − 1 .
We have
Pr
[Equation]
Theorem 5 (Certiﬁed Robustness for MME) .
Let (cid:15) be a random variable.
Let M MME be a MaxMargin Ensemble deﬁned over { f i } Ni =1 .
The M MME is ( (cid:15) , λ 2 , p ) -MME conﬁdent.
Let x 0 ∈ R
d be the input with ground-truth label y 0 ∈
[ C ] .
Assume { f i ( x 0 + (cid:15) )
y 0 } Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d.
and follow symmetric distribution with mean µ where µ > (1 + λ − 1 2 ) − 1 .
Deﬁne s 2 f =
Var(min i ∈
[ N ] f i ( x 0 + (cid:15) )
y 0 )
We have
[Equation]
Proof of Theorems 4 and 5.
Combining Lemmas D.1 to D.3, we get the theorem.
Remark.
Theorems 4 and 5 provide two statistical robustness lower bounds for both types of ensembles, which is shown to be able to translate to certiﬁed robustness.
For the Weighted Ensemble, noticing that ˆ X 1 is the weighted sum of several independent variables, we can further apply McDiarmid’s Inequality to get another bound
[Equation]
which is tighter than Equation (14) when (cid:107) w (cid:107) 21 / (cid:107) w (cid:107) 22 is large.
For average weighted ensemble, (cid:107) w (cid:107) 21 / (cid:107) w (cid:107) 22 = N .
Thus, when N is large, this bound is tighter.
Both theorems are applicable under the i.i.d.
assumption of conﬁdence scores.
The another assumption µ > max { (1 + λ − 1 1 ) − 1 , (1 + λ − 1 2 ) − 1 } insures that both ensembles have higher probability of predicting the true class rather than other classes, i.e., the ensembles have non-trivial clean accuracy.
D. C OMPARISON OF C ERTIFIED R OBUSTNESS
We ﬁrst show and prove an important lemma.
Then, based on the lemma and Theorems 4 and 5, we derive the comparison corollary.
Lemma D.4.
For µ, λ 1 , λ 2 , C > 0 , when max { λ 1 / (1 + λ 1 ) , λ 2 / (1 + λ 2 ) } < µ ≤ 1 , and C < 1 , we have
[Equation]
Proof of Lemma D.4.
[Equation]
Now we can show and prove the comparison corollary
[Equation]
Corollary 2 (Comparison of Certiﬁed Robustness) .
Let (cid:15) be a random variable supported on R d .
Over base models { f i } Ni =1 , let M MME be Max-Margin Ensemble, and M WE the Weighted Ensemble with weights { w i } Ni =1 .
Let x 0 ∈ R
d be the input with ground-truth label y 0 ∈
[ C ] .
Assume { f i ( x 0 + (cid:15) )
y 0 } Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d, and follow symmetric distribution with mean µ and variance s 2 , where µ > max { (1 + λ − 1 1 ) − 1 , (1 + λ − 1 2 ) − 1 } .
Deﬁne s 2 f =
Var(min i ∈
[ N ] f i ( x 0 + (cid:15) )
y 0 )
and assume s f < s .
When
[Equation]
for any weights { w i } Ni =1 , M WE has higher certiﬁed robustness than M MME .
When
[Equation]
for any weights { w i } Ni =1 , M MME has higher certiﬁed robustness than M WE .
Here, the certiﬁed robustness is given by Theorems 4 and 5.
Proof of Corollary 2.
According to Lemma D.
[Equation]
we have
[Equation]
According to Theorems 4 and 5, we know the RHS in Equation (14) is larger than the RHS in
Equation (15), i.e., M WE has higher certiﬁed robustnesss than M MME .
According to Lemma D.4, we have
[Equation]
According to Theorems 4 and 5, we know the RHS in Equation (15) is larger than the RHS in
Equation (14), i.e., M MME has higher certiﬁed robustnesss than M WE .
Remark.
As we can observe in the proof, there is a gap between Equation (16) and Equation (17) — when λ 1 /λ 2 lies in between RHS of Equation (16) and RHS of Equation (17), it is undetermined which ensemble protocol has higher robustness.
Indeed, this uncertainty is caused by the adjustable weights { w i } Ni =1 of the Weighted Ensemble.
If we only consider the average ensemble, then this gap is closed:
[Equation]
In the corollary, we assume that s f < s .
Note that s 2 is the variance of single variable and s 2 f is the variance of minimum of N i.i.d.
variables.
For common symmetry distributions, along with the increase of N , s f shrinks in the order of O (1 /N B ) where B ∈ (0 , 2] .
Thus, as long as N is large, the assumption will always hold.
An exception is that when these random variables follow the exponential distribution, where s f does not shrink along with the increase of N .
However, since these random variables are conﬁdence scores which are in [0 , 1] , they cannot obey exponential distribution.
D. A C ONCRETE C ASE : U NIFORM D ISTRIBUTION
As shown by Saremi & Srivastava (2020) (Remark 2.1), when the input dimension d is large, the
Gaussian noise (cid:15) ∼ N (0 , σ 2 I d ) ≈ Unif( σ √ dS d − 1 ) , i.e., x 0 + (cid:15) is highly uniformly distributed on the ( d − 1) -sphere centered at x 0 .
Motivated by this, we study the case where the conﬁdence scores { f i ( x 0 + (cid:15) )
y 0 } Ni =1 are also uniformly distributed.
Under this additional assumption, we can further make the certiﬁed robustness for the single model and both ensembles more concrete.
D.3. C ERTIFIED R OBUSTNESS FOR S INGLE M ODEL
Proposition D.2 (Certiﬁed Robustness for Single Model under Uniform Distribution) .
Let (cid:15) be a random variable supported on R d .
Let F be a classiﬁcation model, which is ( (cid:15) , λ 3 , p ) -single conﬁdent.
Let x 0 ∈ R
d be the input with ground-truth y 0 ∈
[ C ] .
Suppose f ( x 0 + (cid:15) )
y 0 is uniformly distributed in [ a, b ] .
We have
[Equation]
− clip (cid:18) 1 / (1 + λ − 1 3 ) − a b − a (cid:19) ,
where clip( x ) = max(min
( x, 1) , 0) .
Proof of Proposition D.2.
We consider the distribution of quantity Y :
= f
( x 0 + (cid:15) )
y 0 − λ 3 (1 − f ( x 0 + (cid:15) )
y 0 )
Since the model F is ( (cid:15) , λ 3 , p ) -single conﬁdent, with probability 1 − p , Y ≤ f ( x 0 + (cid:15) )
y 0 − max y j ∈
[ C ]: y j (cid:54) =
y
f ( x 0 + (cid:15) )
y j .
At the same time, because f ( x 0 + (cid:15) )
y 0 follows the distribution
U ([ a, b ]) ,
Y =
(1 + λ 3 ) f
( x 0 + (cid:15) )
y 0 − λfollows the distribution U ([(1 + λ 3 ) a − λ 3 , (1 + λ 3 ) b − λ 3 ]) .
Therefore,
Pr( Y ≤ 0)
=
clip (cid:18) λ 3 − (1 + λ 3 ) a (1 + λ 3 )( b − a ) (cid:19) .
As the result,
Pr (cid:18) f
( x 0 + (cid:15) )
y 0 − max y j ∈
[ C ]: y j (cid:54) =
y
f ( x 0 + (cid:15) )
y j ≤(cid:19) ≤ p + clip (cid:18) λ 3 − (1 + λ 3 ) a (1 + λ 3 )( b − a ) (cid:19) , which is exactly
Pr ( F ( x 0 + (cid:15) )
=
y 0 ) ≥ 1 − p − clip (cid:18) λ 3 − (1 + λ 3 ) a (1 + λ 3 )( b − a ) (cid:19)
= 1 − p − clip (cid:18) 1 / (1 + λ − 1 3 ) − a b − a (cid:19) .
D.3. C ERTIFIED R OBUSTNESS FOR E NSEMBLES
Still, we deﬁne ˆ X 1 ( (cid:15) ) and ˆ X 2 ( (cid:15) ) according to Deﬁnitions D.2 and D.3.
Under the uniform distribution assumption, we have the following lemma.
Lemma D.5 (Expectation and Variance of ˆ X 1 and ˆ X 2 under Uniform Distribution) .
Let ˆ X 1 and ˆ Xbe deﬁned by Deﬁnition D.2 and Deﬁnition D.3 respectively.
Assume that under the distribution of (cid:15) , the base models’ conﬁdence scores for true class { f i ( x 0 + (cid:15) )
y 0 } Ni =1 are pairwise i.i.d and uniformly distributed in range [ a, b ] .
We have
[Equation]
Proof of Lemma D.5.
We start from analyzing ˆ X 1 .
From the deﬁnition
[Equation]
where { f i ( x 0 + (cid:15) )
y 0 } Ni =1 are i
[Equation]
i
[Equation]
d. variables obeying uniform distribution U ([ a, b ]) ,
[Equation]
Now analyze the expectation of ˆ X 2 .
By the symmetry of uniform distribution, we know
[Equation]
To reason about the variance, we need the following fact:
Fact D.1.
Let x 1 , x 2 , . . .
, x n be uniformly distributed and independent random variables.
Speciﬁcally, for each 1 ≤ i ≤ n , x i ∼ U ([ a, b ]) .
Then we have
[Equation]
b −
[Equation]
Observing that each i.i.d.
f i ( x 0 + (cid:15) )
y 0 is exactly identical to x i in Fact D.1, we have
Var
[Equation]
Therefore,
Var ˆ X
[Equation]
) ≤
[Equation]
Proof of Fact D.1.
From symmetry of uniform distribution, we know Var (min 1 ≤ i ≤ n x i ) =
Var (max 1 ≤ i ≤ n x i ) .
So here we only consider Y :=
min 1 ≤ i ≤ n x i .
Its CDF F and PDF f can be easily computed:
[Equation]
where y ∈ [ a, b ] .
Hence,
[Equation] [Equation]
(cid:90) (
[Equation]
) n + (
[Equation]
(cid:19) (cid:12)(cid:12)(cid:12)
[Equation]
a
[Equation]
n
[Equation] [Equation]
n +
[Equation]
(cid:12)(cid:12)(cid:12)
[Equation]
a
[Equation]
As the result, Var
[Equation]
Now, similarly, we use Lemma D.1 to derive the statistical robustness lower bound for WE and
MME.
We omit the proofs since they are direct applications of Lemma D.5, Lemma D.1, and
Lemma D.2.
Theorem D.1 (Certiﬁed Robustness for WE under Uniform Distribution) .
Let M WE be a Weighted
Ensemble deﬁned over { f i } Ni =1 with weights { w i } Ni =1 .
Let x 0 ∈ R
d be the input with groundtruth label y 0 ∈
[ C ] .
Let (cid:15) be a random variable supported on R d .
Under the distribution of (cid:15) , suppose { f i ( x 0 + (cid:15) )
y 0 } Ni =1 are i.i.d.
and uniformly distributed in [ a, b ] .
The M WE is ( (cid:15) , λ 1 , p ) -WE conﬁdent.
Assume a + b 2 > 1 1+
[Equation]
We have
[Equation]
where d w = (cid:107)
[Equation]
(cid:107) [Equation] [Equation] Theorem D.2 (Certiﬁed Robustness for MME under Uniform Distribution) .
Let M MME be a MaxMargin Ensemble over { f i } Ni =1 .
Let x 0 ∈ R
d be the input with ground-truth label y 0 ∈
[ C ] .
Let (cid:15) be a random variable supported on R d .
Under the distribution of (cid:15) , suppose { f i ( x 0 + (cid:15) )
y 0 } Ni =1 are i.i.d.
and uniformly distributed in [ a, b ] .
M MME is ( (cid:15) , λ 2 , p ) -MME conﬁdent.
Assume a + b>
[Equation]
We have
[Equation]
where c N =
N +(cid:18)
[Equation]
D.3. C OMPARISON
Now under the uniform distribution, we can also have the certiﬁed robustness comparison.
Corollary D.1 (Comparison of Certiﬁed Robustness under Uniform Distribution) .
Over base models { f i } Ni =1 , let M MME be Max-Margin Ensemble, and M WE the Weighted Ensemble with weights { w i } Ni =1 .
Let x 0 ∈ R
d be the input with ground-truth label y 0 ∈
[ C ] .
Let (cid:15) be a random variable supported on R d .
Under the distribution of (cid:15) , suppose { f i ( x 0 + (cid:15) )
y 0 } Ni =1 are i.i.d.
and uniformly distributed with mean µ .
Suppose M WE is ( (cid:15) , λ 1 , p ) -WE conﬁdent, and
M MME is ( (cid:15) , λ 2 , p ) -MME conﬁdent.
Assume µ > max (cid:110)
[Equation]
When
[Equation]
M WE has higher certiﬁed robustness than M MME .
When
[Equation]
M MME has higher certiﬁed robustness than M WE .
When
[Equation]
for any λ 1 , M MME has higher or equal certiﬁed robustness than M WE .
Here, the certiﬁed robustness is given by Theorems D.1 and D.2.
Proof of Corollary D.1.
First, we notice that a uniform distribution with mean µ can be any distribution U ([ a, b ]) where ( a + b ) / 2 = µ .
We replace µ by ( a + b ) / 2 .
Then (1) and (2) follow from Lemma D.4 similar to the proof of Corollary 2.
(3) Since
[Equation] [Equation]
<
[Equation]
the RHS of Equation (37) is smaller than 0 .
Thus, for any λ 1 , since λ 1 /λ 2 > 0 , the Equation (17) is satisﬁed.
According to (2), M MME has higher certiﬁed robustnesss than M WE .
Remark.
Comparing to the general corollary (Corollary 2), under the uniform distribution, we have an additional ﬁnding that when N is sufﬁciently large, we will always have higher certiﬁed robustness for Max-Margin Ensemble than Weighted Ensemble.
This is due to the more efﬁcient variance reduction of Max-Margin Ensemble than Weighted Ensemble.
As shown in Lemma D.5, the quantity Var ˆ X ( (cid:15) ) /
( E ˆ X ( (cid:15) )) 2 for Weighted Ensemble is Ω(1 /N ) , while for Max-Margin Ensemble is
O (1 /N 2 ) .
As the result, when N becomes larger, Max-Margin Ensemble has higher certiﬁed robustness.
We use uniform assumption here to give an illustration in a speciﬁc regime. Since the assumption may not hold exactly in practice, we think it would be an interesting future direction to generalize the analysis to other distributions such as the Gaussian distribution that corresponds to locally linear classiﬁers. The result from these distribution may be derived from their speciﬁc concentration bound for maximum/minimum i.i.d. random variables as discussed at the end of Appendix D.2.
D. N UMERICAL E XPERIMENTS
To validate and give more intuitive explanations for our theorems, we present some numerical experiments.
D.4. E NSEMBLE C OMPARISON FROM N UMERICAL S AMPLING
As discussed in Section 3.2, λ 1 /λ 2 reﬂects the transferability across base models.
It is challenging to get enough amount of different ensembles of various transferability levels while keeping all other variables controlled.
Therefore, we simulate the transferability of ensembles numerically by varying λ 1 /λ 2 (see the deﬁnitions of λ 1 and λ 2 in Deﬁnitions 6 and 7), and sampling the conﬁdence scores { f i ( x 0 + (cid:15) )
y 0 } and { max j ∈ [ C ]: j (cid:54) =
y
f i ( x 0 + (cid:15) )
j } under determined λ 1 and λ 2 .
For each level of λ 1 /λ 2 , with the samples, we compute the certiﬁed robust radius r using randomized smoothing (Theorem B.1) and compare the radius difference of Weighted Ensemble and Max-Margin Ensemble.
According to Corollary 2 in Section 3.2, we should observe the tendency that along with [Figure] the increase of transferability λ 1 /λ 2 , Max-Margin Ensemble would gradually become better than
Weighted Ensemble.
Figure 2 veriﬁes the trends: with the increase of λ 1 /λ 2 , MME model tends to achieve higher certiﬁed radius than WE model.
Moreover, we notice that under the same λ 1 /λ 2 , with the larger number of base models N , the MME tends to be relatively better compared with WE.
This is because we sample the conﬁdence score uniformly and under the uniform distribution, MME tends to be better than WE when the number of base models N becomes large, according to Corollary D.1.
The concrete number settings of λ 1 , λ 2 , and the sampling interval of conﬁdence scores are entailed in the caption of Figure 2.
D.4. E NSEMBLE C OMPARISON FROM C ERTIFIED R OBUSTNESS P LOTTING
In Corollary D.1, we derive the concrete certiﬁed robustness for both ensembles and the single model under i.i.d.
and uniform distribution assumption.
In fact, from the corollary, we can directly compute the certiﬁed robust radius without sampling, as long as we assume the added noise (cid:15) is
Gaussian.
In Figure 3, we plot out such certiﬁed robust radius for the single model, the WE, and the
MME.
Concretely, in the ﬁgure, we assume that the true class conﬁdence score for each base model is i.i.d.
and uniformly distributed in [ a, b ] .
The Weighted Ensemble is ( (cid:15) , λ 1 , 0 . 01)
-WE conﬁdent; the
Max-Margin Ensemble is ( (cid:15) , λ 2 , 0 . 01)
-MME conﬁdent; and the single model is ( (cid:15) , λ 3 , 0 . 01)
-MME conﬁdent.
We guarantee that λ 1 ≤ λ 3 ≤ λ 2 to simulate the scenario that ensembles are based on the same set of base models to make a fair comparison.
We directly apply the results from our analysis (Theorem D.1, Theorem D.2, Proposition D.2) to get the statistical robustness for single model and both ensembles.
Then, we leverage Theorem B.1 to get the certiﬁed robust radius (with σ = 1 . 0 , N = 100000 and failing probability α = 0 .
001 which are aligned with realistic setting).
The x -axis is the number of base models N and the y -axis is the certiﬁed robustness.
We note that N is not applicable to the single model, so we plot the single model’s curve by a horizontal red dashed line.
From the ﬁgure, we observe that when the number of base models N becomes larger, both ensembles perform much better than the single model.
We remark that when N is small, the ensembles have 0 certiﬁed robustness mainly because our theoretical bounds for ensembles are not tight enough with the small N .
Furthermore, we observe that the Max-Margin Ensemble gradually surpasses
Weighted Ensemble when N is large, which conforms to our Corollary D.1.
Note that the left sub-ﬁgure has smaller transferability λ 1 /λ
and the right subﬁgure has larger transferability λ 1 /λ 2 , it again conforms to our Corollary 2 and discussion in Section 3.2 that in the left subﬁgure the
Weighted Ensemble is relatively more robust than the Max-Margin Ensemble.
[Figure]
D.4. E NSEMBLE C OMPARISON FROM R EALISTIC D ATA
We study the correlation between transferability λ 1 /λ 2 and whether Weighted Ensemble or MaxMargin Ensemble is more certiﬁably robust using realistic data.
By varying the hyper-parameters of DRT, we ﬁnd out a setting where over the same set of base models, Weighted Ensemble and Max-Margin Ensemble have similar certiﬁed robustness, i.e., for about half of the test set samples, WE is more robust; for another half, MME is more robust.
We collect 1 , 000 test set samples in total.
Then, for each test set sample, we compute the transferability λ 1 /λ 2 and whether WE or MME has the higher certiﬁed robust radius.
We remark that λ 1 and λare difﬁcult to be practically estimated so we use the average conﬁdence portion as the proxy:
• For WE,
[Equation]
• For MME,
[Equation]
E
[Equation]
Now we study the correlation between
X := λ 1 /λ 2 − RHS of Equation (17) and Y :
=
[ MME has higher certiﬁed robustness ] .
To do so, we draw the ROC curve where the threshold on X does binary classiﬁcation on Y .
The curve and the AUC score is shown in Figure 4.
From the ROC curve, we ﬁnd that X and Y are apparently positively correlated since AUC = 0 . 66 > 0 .
5 , which again veriﬁes Corollary 2.
We remark that besides X , other factors such as non-symmetric or non-i.i.d.
conﬁdence score distribution may also play a role.
E E XPERIMENT D ETAILS
Evaluation metric : We use the certiﬁed test set accuracy at each radius r as our evaluation metric, which is deﬁned as the fraction of the test set samples that the smoothed classiﬁer can certify the robustness within the L 2 ball of radius r .
Since the computation of the accurate value of this metric is intractable, we report the approximate certiﬁed test accuracy (Cohen et al., 2019) sampled through the Monte Carlo procedure.
For each sample, the robustness certiﬁcation holds with probability at least 1 − α .
Following the literature, we choose α = 0 .
001 , n 0 = 100 for Monte Carlo sampling during prediction phase, and n = 100 , 000 for Monte Carlo sampling during certiﬁcation phase.
E. MNIST
Baseline models’ hyper-parameter conﬁguration :
We choose the number of noise samples per instance m = 2 and Gaussian smoothing parameter σ ∈ { 0 . 25 , 0 . 5 , 1 . 0 } for all the training methods.
For SmoothAdv, we consider the attack to be 10 -step L 2 PGD attack with perturbation scale δ = 1 .without pretraining and unlabelled data augmentation.
We reproduced similar results to their paper by using their open-sourced code 1 .
Training details : We use LeNet architecture and trained each base model for 90 epochs.
For the training optimizer, we use the SGD-momentum with the initial learning rate α = 0 .
The learning rate is decayed for every 30 -epochs with decay ratio γ = 0 .
and the batch size equals to 256 .
For
DRT experiments, we start our training with the small learning rate α = 5 × 10 − 4 and ﬁnetune the base models for another 90 epochs.
During the training, we ﬁnd too large regularization weights may cause the model’s training collapse on MNIST.
We turn to use small DRT hyper-parameters ρ 1 , ρ 2 and report the one with the best certiﬁed accuracy on each radius r .
Certiﬁed accuracy curve : Figure 6 and Figure 7 show the certiﬁed accuracy curve with different base model type and smoothing parameter σ among the range of the radius r .
We can notice that while simply applying MME or WE can improve the certiﬁed accuracy slightly, DRT could help boost the certiﬁed accuracy on each radius r with a signiﬁcant scale.
DRT hyper-parameters : We investigate the DRT hyper-parameters ρ 1 ∈ { 0 . 1 , 0 . 2 , 0 . 3 , 0 .
5 , 1 . 0 } and ρ 2 ∈ { 0 . 5 , 1 . 0 , 2 . 0 , 5 . 0 } corresponding to different smoothing parameter σ ∈ { 0 . 25 , 0 .
Here we put the detailed results for every hyper-parameter setting in Tables 4 to 6 and bold the numbers with the highest certiﬁed accuracy on each radius r among all the tables with different σ ’s. From the experiments, we found that the GD loss’s weight ρ 1 can have the major inﬂuence on the ensemble model’s functionality: if we choose larger ρ 1 , the model will achieve slightly worse certiﬁed accuracy on small radius r , but better certiﬁed accuracy on large r .
We cannot choose too large ρ 1 on small σ cases (e.g., σ = 0 . 25 ).
Otherwise, the training procedure will collapse.
Here we show the DRT-based model’s approximate certiﬁed accuracy with different ρ 1 in Figure 5.
[Table] [Table]
Alternatively, we found that the CM loss’s weight ρ 2 can have positive inﬂuence on model’s performance: the larger ρ 2 we choose, the better certiﬁed accuracy we can get.
Choosing large ρ 2 does not harm model’s functionality too much, but the improvement we received will become marginal.
For MNIST, ( σ, ρ 1 , ρ 2 ) ∈ { (0 . 25 , 0 . 1 , 0 . 2) , (0 . 5 , 0 .
, (1 . 0 , 1 . 0 , 5 . 0) } are good combinations.
Efﬁciency Analysis : We regard the execution time per mini-batch as our efﬁciency criterion.
For
MNIST with batch size equals to 256 , DRT with the Gaussian smoothing base model only requires 1.04s to ﬁnish one mini-batch training to achieve the comparable results to the SmoothAdv method which requires 1.86s.
Moreover, DRT with the SmoothAdv base model requires 2.52s per training batch but achieves much better results.
The evaluation is on single NVIDIA GeForce GTX
Ti
GPU.
[Figure]
[Figure]
[Figure]
[Figure]
E. CIFAR-
Baseline models’ hyper-parameter conﬁguration :
We choose the number of noise samples per instance m = 2 and Gaussian smoothing parameter σ ∈ { 0 . 25 , 0 . 5 , 1 . 0 } for all the training methods.
[Table]
WE
[Table]
DRT
[Table] [Table]
For SmoothAdv, we consider the attack to be 10 -step L 2 PGD attack with perturbation scale δ = 1 . 0 without pretraining and unlabelled data augmentation.
We also reproduced the similar results mentioned in baseline’s papers.
Training details : We use ResNet-110 architecture for each base model and train them forepochs.
During the training, We utilize the SGD-momentum with the initial learning rate α = 0 .
1 , which is decayed for every 50 -epochs with ratio γ = 0 .
For DRT experiments, we start the training with the learning rate α = 5 × 10 − 3 and ﬁnetune our base models for another 150 epochs.
Certiﬁed accuracy curve : Figure 8 and Figure 9 show the certiﬁed accuracy curve with different base model type and smoothing parameter σ among the range of the radius r .
We can see the same trends:
Applying the MME/WE mechanism will give a slight improvement and DRT can help make this improvement to be signiﬁcant.
DRT hyper-parameter : We studied the DRT hyper-parameter ρ ∈ { 0 . 1 , 0 . 2 , 0 .
5 , 1 . 0 , 1 . 5 } and ρ 2 ∈ { 0 . 5 , 2 . 0 , 5 . 0 } corresponding to different σ ∈ { 0 .
5 , 1 . 0 } and put the detailed results in
Tables 7 to 9.
We bold the numbers with the highest certiﬁed accuracy on each radius r among all the tables with different σ ’s.
The results show the similar conclusion about the choosing of ρand ρ 2 .
( σ, ρ 1 , ρ 2 ) ∈ { (0 . 25 , 0 . 1 , 0 . 5) , (0 . 5 , 1 . 0 , 5 . 0) , (1 . 0 , 1 . 5 , 5 . 0) } could be the good choices on
CIFAR-10 dataset.
[Table]
[Table]
(SmoothAdv) - - 71.
DRT + WE (SmoothAdv) 0.
Efﬁciency Analysis : We also use the execution time per mini-batch as our efﬁciency criterion.
For
CIFAR-10 with batch size equals to 256 , DRT with the Gaussian smoothing base model requires 3.82s to ﬁnish one mini-batch training to achieve the competitive results to 10 -step PGD attack based SmoothAdv method which requires 6.39s.
All the models are trained in parallel on 4 NVIDIA
GeForce GTX 1080 Ti GPUs.
[Table]
[Table]
E. I MAGE N ET
For ImageNet, we utilize ResNet-50 architecture and train each base model for 90 epochs using the SGD-momentum optimizer.
The initial learning rate α = 0 .
The learning rate is decayed for every 30 -epochs with decay ratio γ = 0 .
We tried different Gaussian smoothing parameter σ ∈ { 0 . 50 , 1 . 00 } , and consider the best hyper-parameter conﬁguration for different σ in the baseline models.
We explored the DRT hyper-parameter ρ 1 ∈ { 0 . 5 , 1 . 0 , 1 . 5 } , ρ 2 ∈ { 1 . 0 , 2 . 0 , 5 . 0 } in our experiments and started with the learning rate α = 5 × 10 − 3 during the DRT.
Table 10 shows the
[Figure]
[Figure] [Figure]
t i f i e
[Figure]
cc u r a c y
[Figure]
[Figure] results. We observe the same trends that MME or WE can improve the certiﬁed robustness on each radius r . Due to the computation cost of training the DRT ensemble model on ImageNet, we can
[Table]
Gaussian [Table] Cohen et al., 2019)
[Table]
SmoothAdv (Salman et al., 2019)
[Table]
MME
[Table]
[Table]
[Table]
only try one sub-optimal hyper-parameter setting for DRT and the result shows that DRT cannot bring more improvements on MME/WE results.
We plan to select more suitable hyper-parameters for DRT to obtain better results on the ImageNet task
[Table]
E. C OMPARISON WITH OTHER BASELINES
We compare our D iversity- R egularized T raining with other baselines on MNIST and CIFARdataset.
Baselines are: (1) Gaussian smoothing (Cohen et al., 2019):
Training a smoothed classiﬁer by applying Gaussian augmentation.
(2) SmoothAdv (Salman et al., 2019): Integrating adversarial training on the soft approximation.
(3) MACER (Zhai et al., 2019):
Adding the regularization term to maximize the certiﬁed radius R =
σ 2 ( p A − p B ) on training instances.
(4) Stability (Li et al., 2019):
Adding the adversarial perturbation by maintaining the Stability on classiﬁcation results.
(5) SWEEN (Liu et al., 2020):
Building the weighted ensemble model by composing the base models of different architectures.
For all baselines, we choose the best certiﬁed accuracy for each radius r as reported in their papers.
We do not consider the model trained by additional (unlabeled) data.
Results are shown in
Table 11 and Table 12.
We can see that we achieve the best certiﬁed accuracy on every r on MNIST dataset and achieve comparable or better results compared to the best certiﬁed accuracy on CIFAR10 dataset. [Table] E. [Table]
T HE EFFECTS OF GD L OSS AND C ONFIDENCE M ARGIN L OSS
We studied the effects of GD Loss and Conﬁdence Margin Loss separately by setting ρ 1 = 0 or ρ 2 = 0 but tuning another parameter only.
We did this ablation study on CIFAR-10 dataset with ensemble of Gaussian-smoothed base models and the results are shown in Table
[Table]
We observed that both GD Loss (GDL) and Conﬁdence Margin Loss (CML) could have positive effects on improving the certiﬁed accuracy while GDL plays a major role in the larger radius.
While combining these two regularization loss together as our DRT loss, the ensemble model could achieve the best certiﬁed accuracy among all the radii.