A
D ISTRIBUTIONAL
R OBUSTNESS C ERTIFICATE BY R ANDOMIZED S MOOTHING
Anonymous authors
Paper under double-blind review
A BSTRACT
The robustness of deep neural networks against adversarial example attacks has received much attention recently.
We focus on certiﬁed robustness of smoothed classiﬁers in this work, and propose to use the worst-case population loss over noisy inputs as a robustness metric.
Under this metric, we provide a tractable upper bound serving as a robustness certiﬁcate by exploiting the duality.
To improve the robustness, we further propose a noisy adversarial learning procedure to minimize the upper bound following the robust optimization framework.
The smoothness of the loss function ensures the problem easy to optimize even for non-smooth neural networks.
We show how our robustness certiﬁcate compares with others and the improvement over previous works.
Experiments on a variety of datasets and models verify that in terms of empirical accuracies, our approach exceeds the state-of-the-art certiﬁed/heuristic methods in defending adversarial examples.
I NTRODUCTION
Deep neural networks (DNNs) have been known to be vulnerable to adversarial example attacks: by feeding the DNN with slightly perturbed inputs, the attack alters the prediction output.
The attack can be fatal in performance-critical systems such as autonomous vehicles or automated tumor diagnosis.
A DNN is robust when it can resist such an attack that, as long as the range of the perturbation is not too large (usually invisible by human), the model produces an expected output despite of the speciﬁc perturbation.
Various approaches have been proposed for improving the robustness of DNNs, with or without a performance guarantee.
Although a number of approaches have been proposed for certiﬁed robustness, it is vague how robustness should be deﬁned.
For example, works including Cohen et al.
; Pinot et al.
; Li et al.
Lecuyer et al.
(2019) propose smoothed classiﬁers to ensure the inputs with adversarial perturbation to be classiﬁed into the same class as the inputs without.
However, since both inputs are inserted randomized noise, it cannot be guaranteed that the inputs are classiﬁed into the correct class.
It is possible that the adversarially perturbed input has the same label as the original one which is wrongly classiﬁed by the DNN.
In this case, the robustness guarantee does not make sense any more.
Further, the robustness guarantee is provided at the instance level, i.e., within a certain perturbation range, the modiﬁcation of an input instance cannot affect the prediction output.
But a DNN is a statistical model to be evaluated on the input distribution, rather than a single instance.
Instead of counting the number of input instances meeting the robustness deﬁnition, it is desired to evaluate the robustness of a DNN over the input distribution.
We introduce the distributional risk as a DNN robustness metric, and propose a noisy adversarial learning (NAL) procedure based on distributional robust optimization, which provides a provable guarantee.
Assume a base classiﬁer f trying to map instance x 0 to corresponding label y .
It is found that when fed with the perturbed instance x (within a l 2 ball centered at x 0 ), a smoothed classiﬁer g ( x ) =
E Z
[ f ( x + z )] with z ∼ Z = N (0 , σ 2 I ) can provably return the same label as g ( x 0 ) does.
However, we think such a robustness guarantee cannot ensure g ( x 0 ) to be correctly classiﬁed as y , resulting in unsatisfying performance in practice.
Instead, we evaluate robustness as the worst-case loss over the distribution of noisy inputs.
For simplicity, we jointly express the input instance and the label as x 0 ∼ P 0 where P 0 is the distribution of the original input.
By using (cid:96) ( · ) as the loss function, we evaluate DNNs by the worst-case distributional risk: sup S E S [ (cid:96) ( θ ; s )] .
The classiﬁer is parameterized by θ ∈ Θ , and s = x + z ∼ S where S is a distribution within a certain distance from P 0 .
We prove such a loss is upper bounded by a data-dependent certiﬁcate, which can be optimized by the noisy adversarial training procedure:
[Equation]
Compared to previous robustness certiﬁcates via smoothed classiﬁers, our method provides a provable guarantee w.r.t.
the ground truth input distribution.
Letting the optimized θ be the parameter of g ( · ) and f ( · ) respectively, we further show that the smoothed classiﬁer g ( · ) provides an improved robustness certiﬁcate than that of f ( · ) , due to a tighter bound on the worst-case loss.
The key is that, for mild perturbations, we adopt a Lagrangian relaxation for the usual loss (cid:96) ( θ ; x + z ) as the robust surrogate, and the surrogate is strongly concave in x and hence easy to optimize.
Our approach enjoys convergence guarantee similar to the method in Sinha et al.
(2018), but different from Sinha et al.
(2018), our approach does not require (cid:96) to be smooth, and thus can be applied to arbitrary neural networks.
The advantage of the smoothed classiﬁer also lies in a tighter robustness certiﬁcate than the base classiﬁer.
The intuition is that, in the inner maximization step, instead of seeking one direction which maximizes the loss, our approach performs gradient ascent along the direction which maximizes the total loss of examples sampled from the neighborhood of the original input.
The noisy adversarial training procedure produces smoothed classiﬁers robust against the neighborhood of the worst-case adversarial examples with a certiﬁed bound.
Highlights of our contribution are as follows.
First, we review the drawbacks in the previous deﬁnition of robustness, and propose to evaluate robustness by the worst-case loss over the input distribution.
Second, we derive a data-dependent upper bound for the worst-case loss, constituting a robustness certiﬁcate.
Third, by minimizing the robustness certiﬁcate in the training loop, we propose noisy adversarial learning for enhancing model robustness, in which the smoothness property entails the computational tractability of the certiﬁcate.
Through both theoretical analysis and experimental results, we verify that our certiﬁed DNNs enjoy better accuracies compared with the state-of-the-art defending adversarial example attacks.
R ELATED W ORK
Works proposed to defend against adversarial example attacks can be categorized into the following categories.
In empirical defences, there is no guarantee how the DNN model would perform against the adversarial examples.
Stability training (Zheng et al.
; Zantedeschi et al.
; Liu et al.
(2018)) improves model robustness by adding randomized noise to the input during training but shows limited performance enhancement.
Adversarial training (Goodfellow et al.
; Kurakin et al.
Madry et al.
; Kannan et al.
; Zhang et al.
; He et al.
; Wang et al.
trains over adversarial examples found at each training step but unfortunately does not guarantee the performance over unseen adversarial inputs.
Although without a guarantee, adversarial training has excellent performance in empirical defences against adversarial attacks.
Certiﬁed defences are certiﬁably robust against any adversarial input within an (cid:96) p -norm perturbation range from the original input.
A line of works construct a computationally tractable relaxation for computing an upper bound on the worst-case loss over all valid attacks.
The relaxations include linear programming (Wong & Kolter (2018)), mixed integer programming (Tjeng et al.
(2018)), semideﬁnite programming (Raghunathan et al.
(2018)), and convex relaxation (Namkoong & Duchi (2017);
Salman et al.
(2019b)).
But those deterministic methods are not scalable.
Some works such as Dvijotham et al.
(2018) formulate the search for the largest perturbation range as an optimization problem and solve its dual problem.
Sinha et al.
(2018) also propose a robustness certiﬁcate based on a Lagrangian relaxation of the loss function, and it is provably robust against adversarial input distributions within a Wasserstein ball centered around the original input distribution.
The certiﬁcate of our work is constructed on a Lagrangian relaxation form of the worst-case loss, but has a broader applicability than Sinha et al.
(2018) with a tighter loss bound due to the smoothness property.
An alternative line of works propose to select appropriate surrogates for each neuron activation layer by layer (Weng et al.
; Zhang et al.
to facilitate the search for a certiﬁed lower bound.
By integrating with interval bound propagation (Gowal et al.
(2018)), Zhang et al.
(2020) make the search computationally efﬁcient and scalable.
Other works (Mirman et al.
; Singh et al.
(2018)) apply the abstract interpretation to train provably robust neural networks.
Our work is orthogonal to these works.
Randomized smoothing introduces randomized noise to the neural network, and tries to provide a statistically certiﬁed robustness guarantee.
Pinot et
al.
(2020) have demonstrated by game theory that no deterministic classiﬁer can claim to be more robust than all others against any possible adversarial attack.
But such a question remains open in the randomized regime, where randomized smoothing can be considered as a contributing effort.
The smoothing method does not depend on a speciﬁc neural network, or a type of relaxation, but can be generally applied to arbitrary neural networks.
The idea of adding randomized noise was ﬁrst proposed by Lecuyer et al.
(2019), given the inspiration of the differential privacy property, and then Li et al.
(2019) improve the certiﬁcate with Rényi divergence.
Cohen et al.
(2019) obtain a larger certiﬁed robustness bound through the smoothed classiﬁer based on Neyman-Pearson theorem.
Phan et al.
(2020) extend the noise addition mechanism to large-scale parallel algorithms.
By extending the randomized noise to the general family of exponential distributions, Pinot et al.
(2019) unify previous approaches to preserve robustness to adversarial attacks.
Lee et al.
(2019) offer adversarial robustness guarantees for (cid:96) 0 -norm attacks.
Both Salman et al.
(2019a)
; Jia et al.
(2019) employ adversarial training to improve the performance of randomized smoothing.
Following a similar principle, our work trains over adversarial data with randomized noise.
But we provide a more practical robustness certiﬁcate and a training method achieving higher empirical accuracy than theirs.
P ROPOSED A PPROACH
We ﬁrst deﬁne the closeness between distributions, based on which we constrain how far the input distribution is perturbed.
Then we introduce our deﬁnition of robustness on smoothed classiﬁers.
Our main theorem gives a tractable robustness certiﬁcate which is easy to optimize.
Our algorithm for improving the robustness of the smoothed classiﬁers is provided.
All proofs are collected in the appendices for conciseness.
3. A D ISTRIBUTIONAL R OBUSTNESS C ERTIFICATE
Deﬁnition 1 (Wasserstein distance) .
Wasserstein distances deﬁne a notion of closeness between distributions.
Let (cid:0) X ⊂ R d , A , P (cid:1) be a probability space and the transportation cost c : X ×
X → [0 , ∞ ) be nonnegative, lower semi-continuous, and c ( x, x ) = 0 .
P and Q are two probability measures supported on X .
Let Π( P, Q ) denotes the collection of all measures on X × X with marginals P and Q on the ﬁrst and second factors respectively, i.e., it holds that π ( A, X ) =
P ( A ) and π ( X , A ) =
Q ( A ) , ∀ A ∈ A and π ∈ Π( P, Q ) .
The Wasserstein distance between P and Q is
[Equation]
For example, the (cid:96) 2 -norm c ( x, x 0 ) =
(cid:107) x − x 0 (cid:107) 22 satisﬁes
the aforementioned conditions.
Distributional robustness.
Assume the original input x 0 is drawn from the distribution P 0 , and the perturbed input x is drawn from the distribution P .
Each input is added randomized Gaussian noise z ∼ Z = N (0 , σ 2 I ) before being fed to the classiﬁer.
Instead of regarding the noise as a part of the smoothed classiﬁer, we treat s = x + z as a noisy input coming from the distribution S in the analysis.
Since z ∈ R d , we need to set X = R d to admit s ∈ X as Lecuyer et al.
; Cohen et al.
; Salman et al. (2019a) do.
Since the perturbed input should be visually indistinguishable from the original one, we deﬁne the robustness region as P =
{ P : W c ( P, P 0 ) ≤ ρ, P ∈ P ( X ) } , where ρ > 0 .
Within such a region, we evaluate the robustness as a worst-case population loss over noisy inputs: sup S ∈P E S [ (cid:96) ( θ ; s )] .
Essentially, we evaluate the robustness of a smoothed classifer based on its performance on the worst-case adversarial example distribution.
A smaller loss indicates a higher level of robustness.
We will compare the deﬁnition against others in the next section.
However, such a robustness metric is impossible to measure in practice as we have no idea about P .
Even if P can be acquired, it can be a non-convex region which renders the constrained optimization objective intractable.
Hence we resort to the Lagrangian relaxation of the problem by assuming a dual variable γ .
As the main theorem of this work, we provide an upper bound for the worst-case population loss for any level of robustness ρ .
We further show that for small enough ρ , the upper bound is tractable and easy to optimize.
Theorem 1.
Let (cid:96) :
Θ × X → R and transportation cost function c : X × X → R + be continuous.
Let x 0 be an input drawn from the input distribution P 0 , x be the adversarial example which follows the distribution P and z ∼ Z = N (0 , σ 2 I ) be the additive noise of the same shape as x .
The sum of x and z is denoted as s = x + z ∼ S and we let φ γ ( θ ; x 0 )
= sup x ∈X E Z { (cid:96) ( θ ; x + z ) − γc ( x + z, x 0 ) } be the robust surrogate.
For any γ, ρ > 0 and σ , we have
[Equation]
The proof is given in Appendix A.1.
It is notable that the right-hand side take the expectation over
P 0 and Z respectively, and given a particular input x 0 and a noise sample z , we seek an adversarial example which maximizes the surrogate loss.
Typically, P 0 is impossible to obtain and thus we use an empirical distribution, such as the training data distribution, to approximate P 0 in practice.
Since Thm. 1 provides an upper bound for the worst-case population loss, it offers a principled adversarial training approach which minimizes the upper bound instead of the actual loss, i.e.,
[Equation]
In the following we show the above loss function has a form which is tractable for arbitrary neural networks, due to a smoothed loss function.
Hence Thm. 1 provides a tractable robustness certiﬁcate depending on the data.
Properties of the smoothed classiﬁer.
We show the optimization objective of Eq.
4 has a form which is tractable for any neural network, particular for the non-smooth ones with ReLU activation layers.
More importantly, the smoothness of the classiﬁer enables the adversarial training procedure to converge as we want by using the common optimization techniques such as stochastic gradient descent.
The smoothness of the loss function comes from the smoothed classiﬁer with randomized noise.
Speciﬁcally,
Theorem 2.
Assume (cid:96) :
Θ × X → [0 , M ] is a bounded loss function.
The loss function on the smoothed classiﬁer can be expressed as ˆ (cid:96) ( θ ; x ) :
= E Z
[ (cid:96) ( θ ; x + z )] , z ∼ Z = N (0 , σ 2 I ) .
Then we have ˆ (cid:96) is 2 Mσ 2 -smooth w.r.t.
(cid:96) 2 -norm, i.e., ˆ (cid:96) satisﬁes
[Equation]
[Equation]
The proof is in Appendix A.2.
It mainly takes advantage of the randomized noise which has a smoothing effect on the loss function.
For DNNs with non-smooth layers, the smoothed classiﬁer makes it up and turns the loss function to a smoothed one, which contributes as an important property to the strong concavity of E Z [ (cid:96) ( θ ; x + z ) − γc ( x + z, x 0 )] and therefore ensures the tractability of the robustness certiﬁcate.
Corollary 1.
For any c : X × X → R + ∪ {∞} 1 -strongly convex in its ﬁrst argument, and ˆ (cid:96) : x (cid:55)→ E Z [ (cid:96) ( θ ; x + z )] being 2 Mσ 2 -smooth, the function E Z { (cid:96) ( θ ; x + z ) − γc ( x + z, x 0 ) } is strongly concave in x for any γ ≥ 2 Mσ 2 .
The proof is in Appendix A.3.
Note that here we specify the requirement on the transportation cost c to be 1 -strongly convex in its ﬁrst argument.
The (cid:96) 2 -norm cost satisﬁes the condition.
Before showing how the strong concavity plays a part in the convergence, we illustrate our algorithm ﬁrst.
3. N OISY A DVERSARIAL L EARNING A LOGRITHM
Problem 4 provides an explicit way to improve the robustness of a smoothed classiﬁer parameterized by θ .
We correspondingly design a noisy adversarial learning algorithm to obtain the classiﬁer of which its robustness can be guaranteed.
In the algorithm, we use the empirical distribution to replace the ideal input distribution P 0 , and sample z a number of times to substitute the expectation with the sample average.
Assuming we have a total of n training instances x i 0 , ∀ i ∈ [ n ] , and sample z ij ∼ N (0 , σ 2 I ) for the i -th instance for r times, the objective is:
[Equation]
The detail of the algorithm is illustrated in Alg.
In the inner maximization step (line 3-6), we adopt the projected gradient descent (PGD Madry et al.
(2017); Kurakin et al.
to approximate the maximizer according to the convention.
The hyperparameters include the number of iterations K and the learning rate η 1 .
Within each iteration, we sample the Gaussian noise r times, given which we compute an average perturbation direction for each update.
The more noise samples, the closer the averaging result is to the expectation value, which is deﬁnitely at the sacriﬁce of higher computation expense.
Similarly, a larger number of K indicates stronger adversarial attacks and higher model robustness, but also incurs higher computation complexity.
Hence choosing appropriate values of r and K is important in practice.
Algorithm
Input: batch size n , number of noise samples r , noise STD σ , learning rate η 1 , η 2 , number of iterations K , penalty parameter γ , training iterations T
Output: the classiﬁer parameter θ 1: for t ∈ { 1 , . . .
, T } do 2: for i ∈ { 1 , . . . , n } do 3: for k ∈ { 0 , . . .
, K − 1 } do 4: ∆ x ik = 1 r (cid:80) rj
=1 (cid:53) x ik (cid:96) ( θ ; x ik + z ij ) − γ (cid:53) x
ik c ( x ik + z ij , x i 0 ) , where z ij ∼ N (0 , σ 2 I ) 5: x ik +
= x ik + η 1 ∆ x ik 6: end for 7: end for 8: [-θ t +
-][Equation] = [Equation]
θ
[Equation]
=
[Equation] θ [Equation] x
[Equation]
z ij [Equation] (cid:105)(cid:111) 9: end for
After training is done, we obtain the classiﬁer parameter θ .
In the inference phase, we sample a number of z ∼ N (0 , σ 2 I ) to add to the testing instance.
The noisy testing examples are fed to the classiﬁer to get the prediction outputs.
Convergence.
An important property associated with the smoothed classiﬁer is the strong concavity of the robust surrogate loss, which is the key to the convergence proof.
The detail of the proof can be found in Appendix A.4.
As long as the loss ˆ (cid:96) is smooth on the parameter space Θ , NAL has a convergence rate O (1 / √ T ) , similar to Sinha et al.
but NAL does not need to replace the non-smooth layer ReLU with Sigmoid or ELU to guarantee robustness.
A T IGHTER B OUND
We compare our work with the state-of-the-art robustness deﬁnitions and certiﬁcates in this section.
4. A DVERSARIAL T RAINING
Our approach improves the distributional robustness certiﬁcate proposed by Sinha et al.
In
Sinha et al.
(2018), a classiﬁer f maps input instance x 0 ∼ P 0 to corresponding label y .
They perturb x 0 to x (cid:48) in the same robustness region as ours: P = { P : W c ( P, P 0 )
≤ ρ,
P ∈ P
( X ) } , where ρ > 0 .
But their worst-case population loss is deﬁned on the base classiﬁer without noise: sup P (cid:48) : W c ( P (cid:48) ,P 0 ) ≤ ρ E P (cid:48) [ (cid:96) ( θ ; x (cid:48) )] .
We show that, given the same classiﬁer parameter θ , our worst-case loss is smaller than Sinha et al.
(2018), suggesting a better robustness certiﬁcate.
Theorem 3.
Under the same denotations and conditions as Thm. 1, we have
[Equation]
The proof is given in Appendix A.5.
We demonstrate that not only the worst-case loss is smaller, but the tractable upper bound is smaller than the certiﬁcate of Sinha et al.
If the outer minimization problem applies to both sides of the inequality, our approach would obtain a smaller loss when both classiﬁers share the same neural architecture.
4. S MOOTHED C LASSIFIERS
Works including Lecuyer et al.
; Cohen et al.
; Pinot et al.
; Li et al.
and others guarantee the robustness of a DNN classiﬁer by inserting randomized noise to the input at the inference phase.
Most of them do not concern about the training phase, but merely provide a deterministic relationship between the robustness certiﬁcate and the additive noise.
Speciﬁcally, we have the original input x 0 ∈ X and its perturbation x within a given range (cid:107) x − x 0 (cid:107) 2 ≤ ε.
The smoothed classiﬁer g ( x ) returns
class c i with probability p
i .
For instance x 0 , robustness is deﬁned by the largest perturbation radius R which does not alter the instance’s prediction, i.e., g ( x ) is classiﬁed into the same category as g ( x 0 ) .
Such perturbation radius depends on the largest and second largest probabilities of p i , denoted by p A , p B respectively.
For example, the results in Cohen et al.
(2019) have shown that R = σ 2 (cid:0) Φ − 1 (cid:0) p A (cid:1) − Φ − 1 ( p B ) (cid:1) where Φ − 1 is the inverse of the standard Gaussian
CDF, p A is a lower bound of p A , and p B is an upper bound of p B .
[Figure]
The previous robustness deﬁnition only guarantees g ( x ) to be classiﬁed to the same class as g ( x 0 ) , but ignores the fact that g ( x 0 ) may be wrongly classiﬁed, which is not a precise deﬁnition.
To make up for it, Li et al.
(2019) propose stability training with noise (STN) and
Cohen et al.
(2019) adopt training with noise, both of which learn smoothed classiﬁers mapping noisy inputs to correct labels.
However, there is no guarantee to ensure g ( x 0 ) to be correctly labeled.
Actually we found the robustness mainly comes from the STN/training with noise, rather than the noise addition at the inference.
In Fig.
1, we could observe that the model performance indeed improves when tested with noise.
However, the classiﬁer trained without additive noise (triangle) degrades signiﬁcantly compared with STN/training with noise (diamond/circle).
The result is an evidence that a classiﬁer almost cannot defend adversarial attacks when trained without but tested with additive noise.
Therefore, we conclude the smoothed classiﬁer can only improve robustness only if the base classiﬁer is robust.
We consider robustness refers to the ability of a DNN to classify adversarial examples into the correct classes, and such an ability should be evaluated on the population of adversarial examples, not a single instance.
E XPERIMENT
Baselines, datasets and models.
Testing accuracies under different levels of adversarial attacks are chosen as the metric.
We compare the empirical performance of NAL with representative baselines including: WRM (Sinha et al.
SmoothAdv (Salman et al. (2019a)), STN (Li et al.
and TRADES (Zhang et al.
Since WRM requires the loss function to be smooth, we follow the convention to adapt the ReLU activation layer to the ELU layer.
SmoothAdv combines adversarial training with the smoothed classiﬁer and claims to be superior than Cohen et al.
Hence we omit Cohen et al.
in comparison.
TRADES is an adversarial training algorithm which won 1st place in the NeurIPS 2018 Adversarial Vision Challenge.
Experiments are conducted on datasets MNIST, CIFAR-10, and Tiny ImageNet, and models including a three-layer CNN, ResNet18, VGG-16, and their corresponding variants with ReLu replaced by ELU for fair comparison with
WRM.
The cross-entropy loss is chosen for (cid:96) and c ( x, x 0 ) =
(cid:107) x − x 0 (cid:107) 22 is selected as the cost function.
Training hyperparameters.
Table 1 gives the training hyperparameters in NAL and the batch size is chosen as 128 .
The hyperparameters used in baselines are supplied in Appendix B.1.
Since NAL
[Table]
[Figure]
and WRM bound the adversarial perturbations by the Wasserstein distance ρ which is different from the (cid:96) 2 -norm perturbation range ε in SmoothAdv and TRADES, we need to establish an equivalence between the perturbation ranges in different methods.
Following the convention of Sinha et al.
(2018), we choose different γ s and for each γ we generate adversarial examples x by PGD with 15 iterations.
We compute ρ as the expected transportation cost between the generated adversarial examples and the original inputs over the training set:
[Equation]
And ε can be computed accordingly.
The corresponding values of γ and ε used in experiments are given in Table 1 as well.
Attack parameters.
To evaluate the empirical accuracies for different methods, we adopt the PGD attack Kurakin et al.
; Madry et al.
(2017) as the adversarial attack following the convention of Li et al.
; Sinha et al.
; Zhang et al.
(2019), etc.
We set the number of iterations in
PGD attack as K attack = 20 and the learning rate η = 2 ε attack /K attack where ε attack is (cid:96) 2 attack radius.
5. R ESULTS
Certiﬁcate.
To better understand how close the upper bound is to the true distributional risk, we plot our certiﬁcate γρ + E (cid:98) P test [ φ γ ( θ ; x 0 )] against any level of robustness ρ , and the out-ofsample (test) worst-case performance sup S ∈P E S [ (cid:96) ( θ ; s )] for NAL (Fig. 2(a)).
Since the worstcase loss is hard to evaluate directly, we solve its Lagrangian relaxation for different values of γ adv .
For each γ adv , we compute the average distance to adversarial examples in the test set as (cid:98) ρ test ( θ ) :
= E (cid:98) P test E Z [ c ( x (cid:63) + z, x 0 )] where (cid:98) P test is the test data distribution and x (cid:63) =
arg max x E Z { (cid:96) ( θ ; x + z ) − γ adv c ( x + z, x 0 ) } is the adversarial perturbation of x 0 .
The worst-case loss is given by ( (cid:98) ρ test ( θ ) , E (cid:98) P test
E Z
[ (cid:96) ( θ ; x (cid:63) + z )]) .
As we observe, (cid:98) ρ test ( θ ) tends to increase with a higher noise level.
Hence we need to keep the noise at an appropriate level to make our certiﬁcate tractable.
Cost without noise.
To ﬁnd out if NAL works when noise is removed from the cost, we designed a veriﬁcation experiment on CIFAR-10 (ResNet-18) by letting c ( x, x 0 )
= (cid:107) x − x 0 (cid:107) 2
and inserting noise only to (cid:96) .
We set γ = 1 . 5 , σ = 0 .
1 , K = 4 , r = 4 .
As Fig.
2(b) has shown, the accuracy performance of the model excluding noise from the cost is far inferior, which shows that the randomized noise is an inherent part in the design.
Sample number and PGD iterations.
We also study the impact of the noise sample number s and
PGD iteration K to the model robustness with CIFAR-10 (ResNet-18) as an example.
The result in
[Figure]
Table 2 shows that while the model performance enhances with K , it does not necessarily increase with a larger noise samples.
We did not test with greater noise samples due to high complexity.
For a combined consideration of computation overhead and accuracy, we choose K = 4 , r = 4 by default in the experiments, which is likely to deliver a sufﬁciently good performance.
Due to space constraints, complete experimental results are in Appendix B.2.
Penalty and noise level.
We vary the value of γ and σ in the experiments to ﬁnd out their impact.
By the results in Fig.
2 (c),(d) and 3, we observe γ = 0 .
25 yields the best performance for MNIST, and γ = 1 . 5 is best for CIFAR-10 and Tiny ImageNet, considering all levels of adversarial attacks.
For a complete result on γ , one can refer to Appendix B.3.
Likewise, the best value of σ also depends on the dataset, shown by the experimental results in Appendix B.2.
Comparison with baselines.
Finally, we compare the empirical accuracies with the baselines and the results are presented in Fig.
2 (c),(d) and 3.
For WRM, the experiments are conducted on the modiﬁed structure of DNNs to ensure smoothness.
NAL has superior performance in almost all cases except that: 1) the clean accuracies (denoted by (cid:96) 2 attack radius = 0 ) on CIFAR-10 and Tiny
ImageNet of NAL are inferior to STN; 2) on MNIST, the performance of NAL is no worse but does not exceed baselines by a large margin.
For 1), we found STN mostly has far worse performance than other schemes when the attack radius > 0 , which echos the proposition in Salman et al.
(2019a)
that adversarial training brings higher robustness than stability training.
Hence it can be explained by the inherent tradeoff between clean accuracy and robustness (Zhang et al.
that STN has higher clean accuracies than others.
Actually, NAL shows better tradeoff between accuracy and robustness than baselines, indicated by the relatively ﬂat accuracy lines.
For 2), we think MNIST has a relatively simple decision boundary than the other two datasets and hence allows larger perturbations (smaller γ ).
Thus the performance boost by NAL is not signiﬁcant.
Actually, when γ is larger, the performance of NAL exceeds baselines by a large margin (Appendix B.3). [Table] [Table] [Table]
[Table]
[Table]
[Table]
K, r ) = [Table] [Table] r )
[Table]
[Table]
CONCLUSION
Our work view the robustness of a smoothed classiﬁer from a different perspective,
i
[Table]
e., the worstcase population loss over the input distribution.
We provide a tractable upper bound (certiﬁcate) for the loss and devise a noisy adversarial learning approach to obtain a tight certiﬁcate.
Compared with previous works, our certiﬁcate is practically meaningful and offers superior empirical robustness performance.
A P ROOFS A. P ROOF OF T HEOREM
Proof.
We express the worst-case loss in its dual form with dual variable γ .
By the weak dual property, we have
[Equation]
[Equation]
the left hand-side of which can be rewritten in integral form:
[Equation]
Note that for any π ∈ Π( S, P 0 ) , we have (cid:82) f ( s ) dS = (cid:82)(cid:82) f ( s ) dπ ( s, x 0 ) .
And by the deﬁnition of
Wasserstein distance, we have
[Equation]
By the independence between z and x [Equation] x [Equation]
one would obtain
[Equation]
By taking the maximum over x , [Equation] [Equation] Fixing x to be value that maximizes the expression to be integrated, x in the formula is ﬁxed
[Equation] so we only need to integrate dπ ( x, x 0 ) on X . So we can get: [Equation]
[Equation]
Because the distribution of z is deﬁnite and z is independent of x
[Equation]
and supremum of S is replaced by the supremum of x .
Therefore
[Equation]
Eq.
11 can be written as
[Equation]
By plugging the above into Eq
[Equation]
[Equation]
we could get
[Equation]
for any given γ ≥
[Equation]
which completes the proof
[Equation]
A. P ROOF OF T HEOREM
Proof.
The proof of ˆ (cid:96) being 2 Mσ 2 -smooth is equivalent to ∇ ˆ (cid:96) being 2 Mσ 2 - Lipschitz .
We apply the Taylor expansion in ∇ ˆ (cid:96) at x 0 and set δ = x 0 − x :
[Equation]
where 0 < θ < 1 .
Hence we only need to prove (cid:107)∇ 2 ˆ (cid:96) ( x + θδ ) (cid:107) 2 is bounded since (cid:107)∇ ˆ (cid:96) ( x + δ ) − ∇ ˆ (cid:96) ( x ) (cid:107)
= (cid:107)∇ 2 ˆ (cid:96) ( x + θδ ) δ (cid:107) 2 .
By taking the ﬁrst and second-order derivatives of ˆ (cid:96) ( x ) , we have
[Equation]
18) and
[Equation]
We divide the right hand-side of Eq.
19 into two halves with the ﬁrst half:
[Equation]
The second half is
[Equation]
Due to the rank of the matrix ( t − x )( t − x ) (cid:62) is 1 , its (cid:96) 2 norm is easy to compute:
[Equation] [Equation]
Hence
M
[Equation]
Finally
[Equation]
combining the two halves we get
[Equation]
A. P ROOF OF C OROLLARY
Proof.
Since ˆ (cid:96) is 2 Mσ 2 -smooth and c is 1 -strongly convex in its ﬁrst argument
[Equation]
we have [Equation] and [Equation]
[Equation]
[Equation]
Therefore we have
[Equation]
[Equation] Hence the strong concavity is proved for γ ≥ 2 M σ 2 .
A. C ONVERGENCE P ROOF
We start with the required assumptions, which roughly quantify the robustness we provide.
Assumption 1.
The loss ˆ (cid:96) : Θ × X → [0 , M ] satisﬁes the Lipschitzian smoothness conditions
[Equation]
[Equation] Let (cid:107)·(cid:107) ∗ be the dual norm to (cid:107)·(cid:107) ; we abuse notation by using the same norm (cid:107)·(cid:107) on Θ and X .
Here we have proved the second condition of Assumption 1 holds true by Theorem 2, with L xx = {+
 Mσ+} 2 .
Therefore, if ˆ (cid:96) satisﬁes the other three conditions, we could adopt a similar proof procedure for
Theorem 2 in Sinha et al.
(2018) to prove the convergence of Algorithm 1.
A. P ROOF OF T HEOREM
Proof.
By Eq.
16 we could get
[Equation]
where
[Equation]
Since (cid:96) ( θ ; x + z ) − γc ( x + z, x 0 ) is strongly concave for x + z in Sinha et al.
(2018), by Jensen
Inequality we have for any ﬁxed x ,
[Equation]
Hence, the following inequality holds
[Equation]
By Proposition 1 in Sinha et al.
, we could get
[Equation]
Finally, we can get Eq.
7 by concatenating the inequalities which completes the proof.
A. C ONNECTIONS BETWEEN R OBUSTNESS C ERTIFICATES
Proposition 1.
Let p A , p B denote the largest and second largest probabilities returned by the smoothed classiﬁer g ( x 0 ) and R =
σ 2 (cid:0) Φ − 1 (cid:0) p A (cid:1) − Φ − 1 ( p B ) (cid:1) .
We choose (cid:96) as the cross-entropy loss in the smoothed loss function ˆ (cid:96) ( x ) =
E Z
[ (cid:96) ( θ ; x + z )] , z ∼ Z = N (0 , σ 2 I ) .
If
[Equation]
34) holds, and the ground truth label y
=
c A , then g ( x ) is robust against any x such that (cid:107) x − x 0 (cid:107) 2 ≤ R .
Proof.
By Theorem 1 of Cohen et al.
(2019), we just need to prove the condition Eq.
34 leads to the condition (cid:107) x − x 0 (cid:107) 2 ≤ R .
With (cid:96) being the cross-entropy loss,
[Equation]
Then we use Jensen Inequality on − log( x ) to obtain
[Equation]
[Equation]
As y =
c A , we have E Z f ( y ) ( x + z ) =
P ( f ( x + z ) =
c A ) .
By Eq.
34, we have
[Equation]
And hence
[Equation]
By the proof of Theorem 1 in Cohen et al.
[Equation]
which leads to
[Equation]
Therefore,
[Equation]
To sum up, if Eq. 34 holds and x 0 is correctly classiﬁed, g ( x ) is robust within a (cid:96) 2 ball with radius R .
One can tell the loss on a single instance is weakly associated with the robustness of the model, and the condition of g ( x ) being robust is quite stringent.
It is not practical to sum up the single-instance loss to gauge the model robustness either.
[Equation] B. B ASELINE S ETTINGS
We provide the training settings for baselines in Table 3.
The learning rate η 1 is adjusted according to different γ s and ε s. The noise level ( σ ) is the same for all methods.
[Table]
B. R ESULTS WITH V ARYING σ AND ( K, r )
We compare NAL with SmoothAdv and STN under the same experimental setting but different σ s. In Table [Table] NAL achieves the best performance at σ = 0 .
1 above all.
We believe in different experimental settings, the best σ value is different.
For example, NAL and STN obtain the best performance at σ = 0 . 1 , whereas SmoothAdv performs best at σ = 0 .
For the same σ , NAL has superior performance than the other two baselines except that, when σ = 0 .
05 , SmoothAdv is more robust than NAL for (cid:96) 2 attack radius ≥ 0 .
This is mainly because SmoothAdv achieves the best performance when σ = 0 .
However, the model accuracies degrade below 0 .
5 is not our main consideration.
[Table]
In Table
[Table] we show NAL’s accuracy over a variety of σ [Table] K, r values.
We found that the result of σ = 0 .
12 is generally better than a larger value.
Under the same σ
[Table]
we choose K ∈ { 2 , 4 , 6 , 8 } , r ∈ { 1 , 4 } , .
We found the model cannot converge with ( K, r ) =
[Table]
and thus did not present the results.
The Table show that a larger K admits better robustness whereas r does not have that impact.
[Table]
[Table]
B. R ESULTS WITH V ARYING γ
We show the impact of γ on MNIST and CIFAR-10.
On MNIST, γ takes the value { 0 .
25 , 1 . 5 , 3 } and σ is chosen as 0 .
On CIFAR-10, γ ∈ { 0 .
, 1 . 5 , 5 } and σ is set to 0 .
( K, r ) =
(4 , 4) for all experiments.
Fig. 4(a) and 5(a) compare NAL with WRM on models with ELU, whereas the rest of
Fig. 4 and 5 show the comparison with SmoothAdv, TRADES, and STN on regular models.
NAL has superior performance than baselines in almost all cases.
[Figure]
[Figure]
The results on MNIST are similar to those obtained in the experiment section.
The gaps between
NAL and baselines in Fig.
4(c)(d) grow larger than that in 4(b), which could be explained different values of γ .
On CIFAR-10, since we switch to ResNet-18, the experimental results are slightly different from that on VGG-16.
The best robustness occurs at γ = 0 .
25 (Fig. 5(b)).
The performance of STN is consistent with that in the experiment section: it enjoys the highest clean accuracies but much worse performance over adversarial examples.
As we observe on Fig. 5(b),(c)
[Figure]
(d)
[Figure]
with an increase of γ , the clean accuracy increases but at the sacriﬁce of adversarial accuracies.
For example,
NAL degrades to the performance of SmoothAdv and TRADES at γ = 5 .
B. C OMPARISON BETWEEN R E LU AND ELU
Here we show the difference between ResNet-18 with ReLU and ELU on CIFAR-10 for NAL.
From
Fig.
6, throughout the training process, the loss of the ReLU model is smaller than that of the ELU
[Figure]
model, and ReLU model presents faster convergence.
The robustness performance of both models is presented in Table 6.
It is clear that in the testing phase, the ReLU model also obtains a better performance.
Hence NAL generally yields better performance on ReLU models than ELU models.