D ATA D EPENDENT R ANDOMIZED S MOOTHING
Anonymous authors
Paper under double-blind review
A BSTRACT
Randomized smoothing is a recent technique that achieves state-of-art performance in training certiﬁably robust deep neural networks.
While the smoothing family of distributions is often connected to the choice of the norm used for certiﬁcation, the parameters of these distributions are always set as global hyper parameters independent from the input data on which a network is certiﬁed.
In this work, we revisit Gaussian randomized smoothing and show that the variance of the Gaussian distribution can be optimized at each input so as to maximize the certiﬁcation radius for the construction of the smooth classiﬁer.
Since the data dependent classiﬁer does not directly enjoy sound certiﬁcation with existing approaches, we propose a memory-enhanced data dependent smooth classiﬁer that is certiﬁable by construction.
This new approach is generic, parameter-free, and easy to implement.
In fact, we show that our data dependent framework can be seamlessly incorporated into 3 randomized smoothing approaches, leading to consistent improved certiﬁed accuracy.
When this framework is used in the training routine of these approaches followed by a data dependent certiﬁcation, we achieve 9% and 6% improvement over the certiﬁed accuracy of the strongest baseline for a radius of 0.5 on CIFAR and ImageNet.
I NTRODUCTION
Despite the success of Deep Neural Networks (DNNs) in various learning tasks (Krizhevsky et al., 2012; Long et al., 2015), they were shown to be vulnerable to small carefully crafted adversarial perturbations (Goodfellow et al., 2015; Szegedy et al., 2013).
For a DNN f that correctly classiﬁes an image x , f can be fooled to produce an incorrect prediction for x + η even when the adversary η is so small that x and x + η are indistinguishable to the human eye.
To circumvent this nuisance, there have been several works proposing heuristic training procedures to build networks that are robust against such perturbations (Cisse et al., 2017; Madry et al., 2018).
However, many of these works provided a false sense of security as they were subsequently broken, i.e. shown to be ineffective against stronger adversaries (Athalye et al., 2018; Tramer et al., 2020; Uesato et al., 2018).
This has inspired researchers to develop networks that are certiﬁably robust , i.e. networks that provably output constant predictions over a characterized region around every input.
Among many certiﬁcation methods, a probabilistic approach to certiﬁcation called randomized smoothing has demonstrated impressive state-of-the-art certiﬁable robustness results (Cohen et al., 2019; Lecuyer et al., 2019; Li et al., 2019).
In a nutshell, given an input x and a base classiﬁer f , e.g. a DNN, randomized smoothing constructs a “smooth classiﬁer” g ( x ) =
E (cid:15) ∼D [ f ( x + (cid:15) )] such that, and under some choices of D , g ( x )
=
g ( x + δ ) ∀ δ ∈ R .
As such, g is certiﬁable within the certiﬁcation region R characterized by x and the smoothing distribution D .
While there has been considerable progress in devising a notion of “optimal” smoothing distribution D for when R is characterized by an (cid:96) p certiﬁcate (Yang et al., 2020), a common trait among all works in the literature is that the choice of D is independent from the input x .
For example, one of the earliest works on randomized smoothing grants (cid:96) 2 certiﬁcates under D = N (0 , σ 2 I ) , where σ is a free parameter that is constant for all x (Cohen et al., 2019).
That is to say, the classiﬁer f is smoothed to a classiﬁer g uniformly (same variance σ 2 ) over the entire input space of x .
The choice of σ used for certiﬁcation is often set either arbitrarily or via cross validation to obtain best certiﬁcation results (Salman et al., 2019a).
We believe this is suboptimal and that σ should vary with the input x (data dependent), since using a ﬁxed σ may under-certify inputs ( i.e. the constructed smooth classiﬁer g produces smaller certiﬁcation radii), which are far from the decision boundaries as exempliﬁed by x 1 in Figure 1.
Moreover, this ﬁxed σ could be large for inputs x close to the decision boundaries resulting in a smooth classiﬁer g that incorrectly classiﬁes x (refer to x 3 in Figure 1).
In this paper, we aim to introduce more structure to the smoothing distribution D by rendering its parameters data dependent.
That is to say, the base classiﬁer f is smoothed with a family of smoothing distributions to produce: g ( x )
=
E (cid:15) ∼N (0 ,σ 2 x I )
[ f ( x + (cid:15) )] 1 .
Note here that the variance of the Gaussian is now dependent on the data input x .
Moreover, given that σ x varies with x , classical randomized smoothing based certiﬁcation does not apply directly.
We propose a simple memory-based approach to certify the resultant data dependent smooth classiﬁer g .
We show that our memory-enhanced data dependent smooth classiﬁer can boost certiﬁcation performance of several randomized smoothing techniques.
Our contributions can thus be summarized in three folds.
( i )
We propose a parameter free and generic framework that can easily turn several randomized smoothing techniques into their data dependent variants.
In particular, given a network f and an input x , we propose to optimize the smoothing distribution parameters for every x , e.g. σ ∗ x , so they maximize the certiﬁcation radius.
This choice of σ ∗ x is then used to smooth f at x and construct a smoothed classiﬁer g .
Moreover, as the data dependent smooth classiﬁer is not directly certiﬁable using Cohen et al.
(2019) MCMC approaches, we propose a memory-enhanced data dependent smooth classiﬁer for certiﬁcation.
( ii )
We demonstrate the effectiveness of our memory-enhanced data dependent smoothing by showing that we can improve the certiﬁed accuracy of several models, speciﬁcally models trained with Gaussian augmentation (C OHEN )
(Cohen et al., 2019), adversaries on the smoothed classiﬁer (S MOOTH A DV ) (Salman et al., 2019a), and radius regularization (MACER)
(Zhai et al., 2020) without any model retraining .
We boost the certiﬁed accuracy of the best baseline by 5.4% on CIFAR10 and by 2.8% on ImageNet for (cid:96) 2 perturbations with less than 0.5 (=127/255) ball radius.
( iii )
We show that incorporating the proposed data dependent smoothing in the training pipeline of C OHEN , S MOOTH A DV and MACER can further boost results to get certiﬁed accuracies of 68.3% on CIFAR10 and 64.2% on ImageNet at (cid:96) 2 perturbations less than 0.25.
R ELATED W ORK
Certiﬁed Defenses.
Certiﬁed defenses aim to guarantee that an adversary does not exist in a certain region around a given input.
Certiﬁed defenses can be divided into exact (Cheng et al., 2017;
Lomuscio & Maganti, 2017; Huang et al., 2017; Ehlers, 2017) and relaxed certiﬁcation (Salman et al., 2019b; Wong & Kolter, 2018).
Generally, exact certiﬁcation suffers from poor scalability with networks that are at most 3 hidden layers deep (Tjeng et al., 2019).
On the other hand, relaxed methods resolve this issue by aiming at ﬁnding an upper bound to the worst adversarial loss over all possible bounded perturbations around a given input (Weng et al., 2018).
However, the latter is too expensive for any mixed certiﬁcation-training routine.
Randomized Smoothing.
The earliest work on randomized smoothing (Lecuyer et al., 2019) was from a differential privacy perspective, where it was demonstrated that adding Laplacian noise enjoys an (cid:96) 1 certiﬁcation radius in which the average classiﬁer prediction under this noise is constant.
This work was later followed by the tight (cid:96) 2 certiﬁcate radius for Gaussian smoothing (Cohen et al., 2019).
Since then, there has been a body of work on randomized smoothing with empirical defenses (Salman et al., 2019a) to certify black box classiﬁers (Salman et al., 2020).
Other works derived certiﬁcation guarantees for (cid:96) 1 bounded (Teng et al., 2019), (cid:96) ∞ bounded (Zhang et al., 2019), and (cid:96) 0 bounded (Levine & Feizi, 2020) perturbations.
Even more recently, a novel framework that ﬁnds the optimal smoothing distribution for a given (cid:96) p norm (Yang et al., 2020) was proposed showing state-of-art certiﬁcation results on (cid:96) 1 perturbations.
We deviate from the common literature by introducing the notion of smoothing, particularly Gaussian smoothing for (cid:96) 2 perturbations, which varies depending on the input.
In particular, since an input x that is far from the decision boundaries should tolerate larger smoothing (and equivalently have a larger certiﬁcation radius) as compared to inputs closer to these boundaries, we optimize for the amount of smoothing per input (speciﬁcally σ x ) that maximizes the certiﬁcation radius.
This proposed process is denoted as data dependent smoothing where we provide a procedure for certifying the resultant smooth classiﬁer.
D ATA D EPENDENT S MOOTHING 3. P RELIMINARIES AND N OTATIONS
We consider the standard classiﬁcation problem, where x ∈ R d and the labels y ∈ Y = { 1 , . . .
, k } form the input-label pairs ( x, y ) sampled from an unknown data distribution.
Unless explicitly mentioned, we consider a classiﬁer f θ : R d → P ( Y ) parameterized by θ where P ( Y ) is a probability simplex over k labels.
We say that f θ is (cid:96) rp certiﬁably accurate for an input x , if and only if,
[Equation]
∀
[Equation]
(cid:107) p ≤ r , where f cθ is the c th element of f θ .
That is to say, the classiﬁer correctly predicts the label of x and enjoys a constant prediction for all perturbations δ that are in the (cid:96) p ball of radius r from x .
As such, the overall (cid:96) rp certiﬁcation accuracy is deﬁned as the average certiﬁed accuracy over the data distribution.
In this paper and following previous works (Cohen et al., 2019; Salman et al., 2019a; Zhai et al., 2020), we focus on (cid:96) r 2 certiﬁcation.
3. O VERVIEW OF R ANDOMIZED S MOOTHING
Randomized smoothing constructs a certiﬁable classiﬁer g θ by smoothing a base classiﬁer f θ .
That is to say, for any σ > 0 , the smooth classiﬁer is deﬁned as follows:
[Equation]
Let g θ predict label c A for input x with some conﬁdence, i.e. E (cid:15)
[ f c A θ ( x + (cid:15) )]
=
p
A ≥ p B = max c (cid:54) =
c A E (cid:15)
[ f cθ ( x + (cid:15) )] , then, g θ is certiﬁably robust at x with certiﬁcation radius:
[Equation]
Here, g ( x + δ ) =
g ( x ) ∀(cid:107) δ (cid:107) 2 ≤ R , where Φ is the CDF of the standard Gaussian.
3. R OBUSTNESS -A CCURACY T RADE - OFF
Note that Equation 1 holds regardless of the prediction c
A made by the smooth classiﬁer g θ .
This suggests that one can perhaps improve the robustness of g θ , i.e. increase certiﬁcation radius R where g θ is constant, by increasing the hyper parameter σ in Equation 1.
However, to reason about (cid:96) rcertiﬁcation accuracy, it is not enough to increase the certiﬁcation radius R , as this requires c A to be the correct prediction for x by g θ .
This reveals the robustness-accuracy trade-off as one cannot improve (cid:96) r 2 certiﬁed accuracy by only increasing the certiﬁcation radius R (robustness) through the increase in σ .
This is because it comes at the expense of requiring a classiﬁer g θ that correctly classiﬁes x with correct label y under large Gaussian perturbations (accuracy).
As such, the following inequality should hold E (cid:15)
[ f yθ ( x + (cid:15) )] ≥ p
A ≥ p B ≥ max c (cid:54) =
y E (cid:15)
[ f c ( x + (cid:15) )] .
3. D ATA D EPENDENT S MOOTHING FOR C ERTIFICATION
The certiﬁcation region R = { δ : (cid:107) δ (cid:107) 2 ≤ R } at an input x is fully characterized by the classiﬁer f θ and the standard deviation of the Gaussian distribution σ .
Moreover, for a given f θ , the certiﬁcation region R varies at different x , when σ is ﬁxed, due to the nonlinear dependence of the prediction gap Φ − 1 ( p A ( x ; σ )) − Φ − 1 ( p B ( x ; σ )) on x .
This hints that, for a given f θ , different inputs x may enjoy a different optimal σ ∗ x that maximizes the certiﬁcation region through radius R .
To see this, consider the three inputs x 1 , x 2 and x 3 all correctly classiﬁed by the binary classiﬁer f θ as C 1 in Figure 1.
Using a ﬁxed σ to smooth the predictions of f θ , i.e. predict with g θ , reveals that inputs, depending on how close they are from the decision boundaries, can enjoy different levels of smoothing without affecting the prediction of g θ .
For instance, as shown in Figure 1 for constant σ , the input far from the decision boundary x 1 could have still been classiﬁed correctly with similarly large prediction gap even if f θ were to be smoothed with a larger σ .
This indicates that perhaps the certiﬁcation radius at x 1 could have been enlarged with a larger smoothing σ .
As for x 2 , we can observe that while the prediction under this choice of σ by g θ is still correct, the prediction gap Φ − 1 ( p A ( x ; σ )) − Φ − 1 ( p B ( x ; σ )) drops, due to having more Gaussian samples fall in the C 2 region.
This indicates that a different choice of σ could have been used to trade-off the drop in prediction gap and certiﬁcation radius.
[Table]
return
[Table]
Last, for the input x 3 that is very close to the decision boundary, the sub optimal choice of σ (too large for x 3 ) could result in an incorrect prediction by g θ .
Despite the observations that σ plays a signiﬁcant role in (cid:96) r 2 certiﬁcation accuracy, certiﬁcation methods generally ( i ) choose σ arbitrarily and ( ii ) set it to be constant for all x .
Based on this observation, for a given smooth classiﬁer with a speciﬁc σ 0 , where σ 0 can be zero reducing the smooth classiﬁer to f θ , we seek to construct another smooth classiﬁer with parameter σ ∗ x for every input x such that: ( i ) the prediction of both smooth classiﬁers (smoothing with σ 0 and σ ∗ x ) is identical for all x .
( ii )
The certiﬁcation radius of the new smooth classiﬁer at every x is maximized.
To construct a classiﬁer smoothed with σ ∗ x enjoying the two previous properties, let c A be the prediction under σ 0 smoothing, i.e. c A = arg max c E (cid:15) ∼N (0 ,σ 0 I )
[ f c ( x + (cid:15) )] .
We directly maximize the radius R in Equation 1 over σ for every x by solving the following optimization:
[Equation]
Since Φ − 1 is a strictly increasing function, it is important to note that solving Equation 2 for a ﬁxed c A can at worst yield a smooth classiﬁer of an identical radius to when the classiﬁer is smoothed with σ 0 with both classiﬁers predicting c A for x .
Solver .
While our proposed Objective 2 has a similar form to the MACER regularizer (Zhai et al., 2020) used during training, ours differs in that we optimize σ for every x and not the network parameters θ , which are ﬁxed here.
A natural solver for 2 is stochastic gradient ascent with the expectation approximated with n Monte Carlo samples.
As such, the gradient of the objective at the k th iteration will be approximated as follows: ∇
[Equation] [Equation]
) (cid:1)(cid:3) , where γ c ( σ k ) = 1 n (cid:80) ni
=1 f c ( x + (cid:15) i ) for (cid:15) 1 , . . .
, (cid:15) n ∼ N (0 , ( σ k ) 2 I ) .
However, this estimation of the gradient suffers from high variance due to the dependence of the expectation on the optimization variable σ that parameterizes the smoothing distribution N (0 , σ 2 I ) (Williams, 1992).
To alleviate this, we use the reparameterization trick suggested by Kingma & Welling (2014); Rezende et al.
(2014) to compute a lower variance gradient estimate for our Objective 2.
In particular, with the change of variable (cid:15) =
σ ˆ (cid:15) where ˆ (cid:15) ∼ N (0 , I ) , Objective 2 is now equivalent to :
[Equation]
Note that, unlike before, the expectation over the distribution ˆ (cid:15) ∼ N (0 , I ) no longer depends on the optimization variable σ .
This allows the gradient of 3 to enjoy a lower variance compared to the gradient of 2 (Kingma & Welling, 2014; Rezende et al., 2014).
Algorithm 1 summarizes the updates for optimizing σ for each x by solving 3 with K steps of stochastic gradient ascent.
It is worthwhile to mention that the function OptimizeSigma in Algorithm 1 is agnostic of the choice of architecture f θ and of the training procedure that constructed f θ .
3. M EMORY -B ASED C ERTIFICATION FOR D ATA D EPENDENT C LASSIFIERS
Unlike previous approaches where σ is constant for all inputs, the data dependent classiﬁer g θ with varying σ per input can not be directly certiﬁed by the classical Monte Carlo algorithms proposed by Cohen et al.
This is since the data dependent classiﬁer g θ does not enjoy a constant σ within the given certiﬁcation region, i.e. g θ tailors a new σ x for every input x including within the certiﬁed region of x .
Informally, let R ( σ ∗ x 1 ) be the radius of certiﬁcation at x 1 granted by the data dependent classiﬁer g θ .
The data dependent classiﬁer does not guarantee that there can not exist x 2 within the region of certiﬁcation of x 1 , i.e. (cid:107) x 1 − x 2 (cid:107) 2 ≤
R ( σ ∗ x 1 ) , where g θ with σ ∗ x 2 predicts x 2 differently from x 1 breaking the soundness of certiﬁcation.
Function TrainBatch( f θ , { x i , y i } Bi =1 , { σ x i } Bi =1 , α , n ) : for i = 1 , . . .
, B do σ ∗ x i =
OptimizeSigma
( f θ , x i , α, σ x i , n )
TrainFunction (cid:0) { x i , y i } Bi =1 , { σ ∗ x i } Bi
=1 (cid:1) //
any
training routine e.g. MACER
To circumvent this problem, we propose a memory-based procedure to certifying our proposed data dependent classiﬁer.
Let { x i } Ni =1 be a set of previously predicted inputs and {C i } Ni =1 be their corresponding predictions with mutually exclusive (cid:96)certiﬁed regions R i for differently predicted inputs, i.e. R i ∩ R j = ∅ ∀
i (cid:54) =
j, C i (cid:54) =
C j .
Let x N +1 be a new input with a certiﬁed region R N +1 computed by the Monte Carlo algorithms of Cohen et al.
for the data dependent classiﬁer g θ with prediction C N +1 .
If there exists an i such that R N +1 ∩ R i (cid:54) = ∅ , x N +1 ∈ R
i , and C N +1 (cid:54)
=
C i , we adjust the prediction of the data dependent classiﬁer g θ to be C i and update R N +1 to be the largest subset of R N +1 that is a subset of R
i (see middle example in Figure 2).
On the other hand, if R N +1 ∩ R i (cid:54) = ∅ , x N +1 / ∈ R i , and
that C N +
(cid:54) =
C i , we update R N +1 to be the largest subset of R N +1 not intersecting with R
i (see right example in Figure 2).
We perform the previous operations for all elements in the memory and add x N +1 , C N +1 , R N +1 to memory.
The aforementioned procedure grants a sound certiﬁcation for the data dependent classiﬁer preventing by construction overlapping certiﬁed regions with different predictions.
While the memory-based certiﬁcation is essential for a sound certiﬁcation, empirically, we never found in any of the later experiments a case where two inputs predicted differently suffer from intersecting certiﬁed regions.
That is to say while our sound certiﬁcate works on the memoryenhanced data dependent smooth classiﬁer, we found that the certiﬁed radius of the memory classiﬁer for every input is the radius granted by the Monte Carlo certiﬁcates of Cohen et al.
for the data dependent classiﬁer.
Therefore and throughout, we refer to the memory-enhanced data dependent smooth classiﬁer and data dependent smooth classiﬁer interchangeably.
We elaborate more on this and provide an algorithm in the Appendix .
3. T RAINING WITH D ATA D EPENDENT S MOOTHING
Models that enjoy a large (cid:96) r 2 certiﬁcation accuracy under the randomized smoothing framework need to enjoy a large certiﬁcation radius R in Equation 1 for all x and be able to correctly classify inputs corrupted with Gaussian noise, i.e. g θ ( x ) = y .
While there are several approaches to train f θ (or directly g θ ) so as to output correct predictions for inputs corrupted with noise sampled from
N (0 , σ 2 I ) , all existing works ﬁx σ for all inputs during training.
We are interested in complementing these approaches with smoothing distributions that are data dependent.
As such, we can employ the training procedure of these approaches but with σ ∗ x computed by OptimizeSigma .
Algorithmsummarizes this proposed training pipeline.
The function TrainFunction proceeds by performing backpropagation using any training scheme, given the estimated σ ∗ x i for each x i .
We note that whenever Algorithm 2 is used, we initialize σ x i at each epoch with σ ∗ x i computed at the previous epoch.
Since C OHEN , S MOOTH A DV and MACER are among the most popular approaches that embed randomized smoothing certiﬁcates as part of the training routine, TrainFunction refers here to any of these three training methods.
Empirically, we show that we can boost all three methods even further when models are trained with Algorithm 2.
E XPERIMENTS
We conduct two sets of experiments to validate our key contributions.
( i )
We show that we can boost certiﬁed accuracy for several pre-trained models by using Algorithm 1 for data dependent smoothing only during certiﬁcation, i.e. without employing any additional training.
( ii ) Once data dependent smoothing is employed during training, we can improve the certiﬁed accuracy even further.
Since our framework is agnostic to the training routine, we incorporate it into ( i ) C OHEN (Cohen et al., 2019), ( ii ) S MOOTH A DV (Salman et al., 2019a) and ( iii ) MACER (Zhai et al., 2020).
Throughout, we use
DS to refer to when data dependent smoothing is used only in certiﬁcation and DS 2 when it is used during both training and certiﬁcation.
Setup.
We conduct experiments with ResNet-18 and ReNet-50 (He et al., 2016) on CIFAR (Krizhevsky & Hinton, 2009) and ImageNet (Russakovsky et al., 2015), respectively.
For CIFAR experiments, we train from scratch for 200 epochs.
For ImageNet, we initialize using the network parameters provided by the authors.
When σ is ﬁxed and following prior art, e.g. C OHEN ,
S MOOTH A DV , and MACER, we set σ ∈ { 0 . 12 , 0 . 25 , 0 . 50 } and σ ∈ { 0 . 25 , 0 . 50 , 1 . 0 } for CIFAR10 and ImageNet, respectively, for training and certiﬁcation.
We set α = 10 − 4 in Algorithm 1 and the initial σ 0 to the σ used in training the respective model.
Unless stated otherwise, we set n = 1 in Algorithm 1.
Following C OHEN and S MOOTH A DV , we compare models using the approximate certiﬁed accuracy curve (simply referred to as certiﬁed accuracy) followed by the envelope curve over all σ .
We also report the Average Certiﬁed Radius (ACR) proposed by MACER/ |S test | (cid:80) ( x,y ) ∈S test R ( f θ , x ) .
1 { arg max c g cθ ( x ) =
y } , where 1 { . } is an indicator function.
Following C OHEN 2 and all randomized smoothing methods, we certify all results using N 0 = 100 Monte
Carlo samples for prediction and N = 100 , 000 estimation samples to estimate the radius with a failure probability of 0 .
001 given a smoothing σ .
4. C OHEN + DS
We combine data dependent smoothing with C OHEN .
Following Gaussian augmentation, this method trains f θ on ( x + (cid:15) ) , where (cid:15) ∼ N (0 , σ 2 I ) , with the cross entropy loss.
DS for certiﬁcation only.
We ﬁrst certify the trained models with the same ﬁxed σ used in training for all inputs, dubbed C OHEN .
Then, we certify using the memory based certiﬁcation the same trained models with the proposed data dependent σ ∗ x produced by Algorithm 1, which we refer to as
C OHEN -DS.
Figure 3 plots the certiﬁed accuracy for CIFAR10 and ImageNet in the ﬁrst and second rows, respectively.
Even though the base classiﬁer f θ is identical for C OHEN and C OHEN -DS, Figure
[Table]
3 shows that C OHEN -DS is superior to C OHEN in certiﬁed accuracy across almost all radii and for all training σ on both datasets.
This is also evident from the envelope plots in the last column of Figure 3.
In Table 1, we report the best certiﬁed accuracy per radius over all training σ for C OHEN (envelope ﬁgure) against our best C OHEN -DS, cross-validated over all training σ and the number of iterations in Algorithm 1 K , accompanied with the corresponding ACR score.
For instance, we observe that data dependent certiﬁcation C OHEN -DS can signiﬁcantly boost certiﬁed accuracy at radii 0 .
5 and 0 .
75 by 7 .
7% (from 40 .
1 to 47 .
8 ) and 9 .
1% (from 29 .
2% to 38 .
3% ), respectively, and by 0 .
193 ACR points on CIFAR10.
Moreover, we boost the certiﬁed accuracy on ImageNet by 4 . 6% and 3 .
2% at 0 .
5 and 0 .
75 radii, respectively, and by 0 .
159 ACR points.
DS for training and certiﬁcation.
We employ data dependent smoothing in both training and certiﬁcation for C OHEN models (denoted as C OHEN -DS 2 ) by running Algorithm 2.
For CIFAR10, we train C OHEN ﬁrst with ﬁxed σ for 50 epochs, i.e. K = 0 in Algorithm 1, and then we perform data dependent smoothing with K = 1 for the remaining 150 epochs.
For ImageNet experiments, we only ﬁnetune the provided models for 30 epochs using Algorithm 2 with K = 1 .
Once training is complete, we certify all trained models with Algorithm 1 using the memory based certiﬁcation.
In Figure 3, we observe that C OHEN -DS 2 can further improve certiﬁed accuracy across all trained models on both CIFAR10 and ImageNet.
This is also evident in the last column of Figure 3 that shows the best certiﬁed accuracy per radius (envelope) over all training σ .
We note that C OHEN -DS 2 improves the certiﬁcation accuracy of C OHEN -DS by 2 . 6% and by 0 .
9% at radii 0 .
5 and 0 .
75 respectively on
CIFAR10, and by 4 . 8% and 1 . 8% at radii 0 .
5 and 0 .
75 respectively on ImageNet.
The improvements are consistently present over a wide range of radii on both datasets.
We do observe that the ACR score for C OHEN -DS 2 on CIFAR10 marginally drops compared to C OHEN -DS.
We believe that this is due to the fact that some inputs that are classiﬁed correctly at the small radii have an overall larger certiﬁcation radius for C OHEN -DS compared to C OHEN -DS 2 on CIFAR10.
Regardless, C OHEN -DSsubstantially outperforms C OHEN by 0 .
ACR points.
As compared to C OHEN -DS, C OHEN -DSimproves the ACR on ImageNet from 1 . 257 to 1 . 319 .
4. S MOOTH A DV + DS
We combine our data dependent smoothing strategy with the more effective S MOOTH A DV , which trains the smoothed classiﬁer for every x on the adversarial example ˆ x that maximizes − log E (cid:15) ∼N (0 ,σ 2 I )
[ f yθ ( x (cid:48)
+ (cid:15) )] , where (cid:107) x (cid:48) − x (cid:107) ≤ ζ .For CIFAR10 experiments, we follow the train-
[Table]
ing procedure of S MOOTH A DV , where the adversary ˆ x is computed with 2 PGD (proximal gradient descent) steps with ζ = 0 .
25 and one augmented sample to estimate the expectation.
For ImageNet experiments, we use the best reported models, in terms of certiﬁed accuracy, provided by the authors, which correspond to ζ = 0 .
5 for σ = 0 .
25 and ζ = 1 .
for σ ∈ { 0 . 5 , 1 . 0 } .
DS for certiﬁcation only.
Similar to C OHEN , we ﬁrst certify S MOOTH A DV models trained with the same ﬁxed σ .
Then, we certify the proposed data dependent σ ∗ x models using the memory-based certiﬁcation, which we refer to as S MOOTH A DV -DS.
In Figure 4, we show the certiﬁed accuracy for both CIFAR10 and ImageNet in the ﬁrst and second rows, respectively.
The last column shows the envelopes per radius.
Even though they both share the same classiﬁer f θ , S MOOTH A DV -DS signiﬁcantly improves upon S MOOTH
A DV over all radii and all values of σ in training for both
CIFAR10 and ImageNet.
In particular, for models trained with σ = 0 .
S MOOTH A DV achieves a zero certiﬁed accuracy for large certiﬁcation radii ( ≥ 1 . 0 ), while S MOOTH A DV -DS achieves nontrivial certiﬁed accuracy in these cases.
Similar to the earlier setup, we report the best certiﬁed accuracy along with the ACR scores in Table 2.
We improve over S MOOTH A DV by large margins.
For example, the certiﬁed accuracy at 0 .
5 radius increases by 5 . 4% and 2 .
8% on CIFAR10 and
Imagenet, respectively.
The improvement is consistent over all radii.
The ACR also improves by 0 .
118 and 0 .
158 on CIFAR10 and ImageNet, respectively.
DS for training and certiﬁcation.
We ﬁne tune the S MOOTH A DV trained models (either the retrained CIFAR10 models or the ImageNet models provided by S MOOTH A DV ) using Algorithm 2, where σ ∗ x is computed using Algorithm 1.
We report the per σ certiﬁcation accuracy comparing
S MOOTH A DV -DS 2 (certiﬁed also using memory based certiﬁcation) to both S MOOTH A DV -DS and S MOOTH A DV .
S MOOTH
A DV -DS 2 further improves the certiﬁed accuracy as compared to
S MOOTH A DV -DS with performance gains more prominent on ImageNet.
While the improvement of S MOOTH A DV -DS 2 over S MOOTH A DV -DS is indeed small, e.g. 0 .
7% at radius 0 .
5 on CIFAR10, we observe that the performance gaps are much larger on ImageNet reaching 1 . 4% at 0 .
5 radius as shown in Table 2.
We see a similar trend in ACR with improvements of 0 .
013 and 0 .
069 on CIFAR and ImageNet, respectively.
S MOOTH
A DV -DS 2 boosts the certiﬁed accuracy of S MOOTH A DV at radius 0.5 by 6 .
1% and 4 .
2% on CIFAR10 and ImageNet, respectively.
4. MACER + DS
We integrate data dependent smoothing within MACER which trains g θ by minimizing over the parameters θ the following objective − log
[Equation]
where R also depends on θ .
While this seems to be similar in spirit to our approach, we in fact maximize the certiﬁcation radius over σ with ﬁxed parameters θ for every x .
We conduct experiments
[Table]
on CIFAR10 3 following the training procedure of MACER estimating the expectation withsamples, λ = and γ = 8 .
We set n = 8 in Algorithm 1 with ablations on n = 1 in the appendix .
DS for certiﬁcation only.
Similar to the earlier setup in C OHEN and
S MOOTH A DV , we certify models with ﬁxed σ and then with data dependent σ ∗ x using the memory based certiﬁcation, referred to as MACER-DS.
In Figure 5, we observe that MACER-DS signiﬁcantly outperforms MACER particularly in the large radius region.
This can also be seen in the envelope ﬁgure reporting the best certiﬁed accuracy per radius over σ .
Similarly, Table 3 demonstrates the beneﬁts of data dependent smoothing, where it boosts certiﬁed accuracy by 7 . 4% (from 59 .
3% to 66 .
7% ) and 8 .
7% ( 43 . 6 to 52 . 3 ) at 0 .
25 and 0 .
5 radii, respectively.
Moreover, we improve ACR by 0 .
139 points.
DS for training and certiﬁcation.
We incorporate data dependent smoothing as part of MACER training and certiﬁcation in a similar fashion to the earlier setup, dubbed MACER-DS 2 .
Figureshows the improvement of MACER-DS 2 over the certiﬁcation only MACER-DS over all trained models.
Table 3 summarizes the best certiﬁed accuracy per radius.
Overall, we ﬁnd that the performance is comparable or slightly better than MACER-DS, which is still signiﬁcantly better than MACER by 8 .
67% at radius 0 .
We also observe that MACER-DS enjoys better ACR than
MACER-DS 2 with both being far better than the MACER baseline.
4. D ISCUSSION AND A BLATION
Varying K .
We pose the question: does attaining better solutions to our proposed Objective 3 improve certiﬁed accuracy?
To answer this, we control the solution quality of σ ∗ x by certifying trained models with a varying number of stochastic gradient ascent iterations K in Algorithm 1.
In particular, we certify the trained models S MOOTH
A DV -DS 2 and S MOOTH
A DV -DS on CIFAR10 and ImageNet, respectively, with a varying K .
We leave the rest of the experiments for other models to the appendix .
We observe in Figure 7 that the certiﬁed accuracy per radius consistently improves as K increases, particularly in the large radius regime.
This is expected, since Algorithm 1 produces better optimal smoothing σ ∗ x per input x with larger K , which in turn improves the certiﬁcation radius leaving room for improvements with more powerful optimizers 4 .
Visualizing σ ∗ x .
We show the variation of σ ∗ x that maximizes the certiﬁcation radius over different inputs x .
Figure 6 shows two examples, where the ﬁrst and fourth columns contain the clean images.
In the second column, a choice of ﬁxed σ = 0 .
5 is too large compared to our estimated σ ∗ x = 0 .
368 that maximizes the certiﬁcation radius as per Algorithm 1.
As for the ﬁfth column, we observe that a constant σ = 0 .
25 is far less than σ ∗ x = 0 .
This indicates that indeed the σ ∗ x maximizing the certiﬁcation radius varies signiﬁcantly over inputs.
R EPRODUCIBILITY S TATEMENT
This work has two main components to reproducing our experimental results; Algorithm 1 and the memory-based certiﬁcation.
In the setup paragraph in our experimental section, we mentioned all necessary implementation details for Algorithm 1.
Nonetheless, we provide an implementation using
PyTorch (Paszke et al., 2019) of Algorithm 1 in Appendix A.
As for memory based certiﬁcation, we provide a detailed algorithm supported with PyTorch implementation of our memory-based certiﬁcation in Appendix C. Algorithm 2 is based on publically available code training with links in the appendix.
Moreover, since we used trained models with different frameworks, we provide the links to the corresponding Github public repositories in Appendix A. We also attach code reproducing some of the experimetns in the zip ﬁle attached in the submission.
The full code will be released in the future.
E THICS S TATEMENT
Since our work has an experimental nature where all of our experiments are computational, we believe that our work did not raise any ethical concerns.
In particular, we did not include any human subjects, any potential harmful insights, nor discrimination.
A I MPLEMENTATION D ETAILS
For reproducibility, we will release the full code upon acceptance.
Nevertheless, we give the detailed implementation of Algorithm 1 in PyTorch Paszke et al.
(2019) below.
28return
For comparisons against Cohen et al.
(2019), we followed their ofﬁcial code in https:// github.com/locuslab/smoothing .
We also followed the common practice in using their provided code for certifying all models in all of our experiments.
For comparisons against
SmoothAdv (Salman et al., 2019a), we also followed their ofﬁcial implementation in https:// github.com/Hadisalman/smoothing-adversarial and similarly for MACER https: //github.com/RuntianZ/macer .
B D ATA D EPENDENT G REEDY S EARCH O VER σ
We observe that the optimization problem equation 3 that we solve for every input x is one dimensional in σ ∗ x .
In this section, we show that heuristic grid search procedures are far inferior to solving
Equation equation 3 with our solver in Algorithm 1.
In particular, we show that under the same sample complexity as our approach for data dependent certiﬁcation a trivial heuristic grid search as a baseline does not work.
We conduct experiments where we only certify with data dependent smoothing a pre-trained model SmoothAdv with training σ ∈ { 0 .
50 } on CIFAR10.
We examine a single model SmoothAdv-DS which is certiﬁed with K = 100 iterations and with n =to approximate the expectation in Algorithm 1.
Observe that since n = 1 , and including the forward and backward passes computation, our data dependent certiﬁcation of SmoothAdv-DS has a total of 200 , since K = 100 , evaluations for every given x before performing the certiﬁcation with the optimized σ ∗ x .
To that end, we compare against a crude grid search baseline over ˆ σ ∗ x , and for a fair comparison, with a total of 200 evaluations.
We restrict the grid search to ˆ σ ∗ x ∈ [0 , 1] with a resolution of n / 200 so that the total number of evaluations is always exactly 200 similar to our SmoothAdv-DS.
That is to say, the grid heuristic search solves the following problem: heuristic data dependent smoothing on CIFAR10.
We observe that when the number of samples n in Equation 4 the better the performance.
Moreover, and despite that the total number of evaluations of the data dependent certiﬁcation matches our approach SmoothAdv-DS reported in Figure 4, the performance is still far inferior to even data dependent certiﬁcation as also evident from the last envelope ﬁgure.
[Equation]
We also explore with the number of samples to n ∈ { 1 , 2 , 4 , 10 } for the grid search pipeline.
Note that this trades-off the accuracy of the expectation approximation to the resolution of the solution ˆ σ ∗ x .
We summarize our results in Figure 8.
Note that in the ﬁrst three ﬁgures, we report certiﬁed accuracies for when the model is certiﬁed with the same σ = { 0 , 12 , 0 . 25 , 0 . 50 } used in training without data dependent smoothing, i.e. ﬁxed σ for all inputs.
We refer to these plots as SmoothAdv-0.12,
SmoothAdv-0.25 and SmoothAdv-0.50.
In addition, we refer to the data dependent baseline grid search heuristic as SmoothAdv-GDS-n-1, SmoothAdv-GDS-n-2, SmoothAdv-GDS-n-4, and
SmoothAdv-GDS-n-10 where n refers to the number of samples approximating the expectation in
Equation equation 4.
We report the envelops in the last ﬁgure.
At ﬁrst we observe that the larger n used to approximate the expectation, the better the overall certiﬁcation accuracy.
This is regardless of the σ used to train the model.
However, the performance is still far inferior to the baseline that is data independent which is inferior to our approach.
This is also evident from the envelope last ﬁgure.
This indicates that while data dependent smoothing is essential towards improving performance, a careful optimization is necessary for it to work.
We reiterate here that both the grid search heuristic and our approach use the same number of evaluations, i.e. 200, when certifying the model; however, our approach reported in Figure 4 are far more superior.
C M EMORY -B ASED C ERTIFICATION FOR D ATA D EPENDENT C LASSIFIERS
Algorithm 3: Memory-Based Certiﬁcation
Input: input point x N +1 , certiﬁed region R N +1 , prediction C N +1 , and memory M
Result:
Prediction for x N +1 and certiﬁed region at x N +1 that does not intersect with any certiﬁed region in M .
for ( x i , C i , R i ) ∈
M do if C N +1 (cid:54) =
C i then if x N +1 ∈ R
i then ˜
R N +1 =
LargestInSubset ( R i , R N +1 ),
R N +1 ← ˜ R N +1 ; C
N +1 ← C i else if Intersect ( R N +1 , R i ) then
R (cid:48)
N +1 =
LargestOutSubset ( R i , R N +1 );
R N +1 ← R (cid:48)
N +1 ; end add ( x N +1 , C N +1 , R N +1) to M ; return C N +1 , R N +1 ;
Let M = { ( x i , C i , R i ) }
Ni =1 be set of the triplets: the input x i , the prediction of x i denoted by C i and the certiﬁcation region at x i denoted as R i which is characterized by the certiﬁcation radius R i and the center x i .
Moreover, we assume that R i ∩ R j = ∅ , ∀ i (cid:54) =
j, C i (cid:54) =
C j .
That is to say, none of the certiﬁcation regions of the inputs stored in the memory M intersect for inputs with different predictions.
This is the key property for a sound certiﬁcation procedure.
Otherwise, if such a property does not hold, then this implies that the data dependent classiﬁer produces different predictions within the same certiﬁed region.
In what follows, and to circumvent this nuisance in the data dependent classiﬁer g θ , we rely on updating the memory while enforcing this property to hold.
In particular, we certify the data dependent classiﬁer using the classical Monte Carlo approach by Cohen et al.
(2019) while guaranteeing that the certiﬁed regions does not intersect with the certiﬁcation region of any previously predicted inputs.
In what follows, we present Algorithm 3 that enforces the non-intersection property of certiﬁed regions
M .
Let R N +1 be the certiﬁed region at x N +1 of g θ .
(i)
If x N +1 ∈ R i and arg max c g cθ ( x N +1 ) (cid:54) =
C i , we ﬁnd the largest ˜ R N +1 such that the following two properties hold ˜ R N +
⊂ R N +
and ˜ R N +1 ⊂
R i .
For when the certiﬁed regions R i are simple (cid:96) 2 -balls, ﬁnding the largest ˜ R N +1 satisfying previous two properties is straightforward.
We denote this with the function LargestInSubset (second example in Figure 2).
We then update R N +1 with the reﬁned ˜ R N +1 and change C N +1 to C i .
(ii) Otherwise, if R N +1 ∩ R i (cid:54) = ∅ where x N +1 / ∈ R i and arg max c g cθ ( x N +1 )
(cid:54) =
C i , we ﬁnd R (cid:48) N + such that R (cid:48)
N +1 ⊆
R N +1 is the largest subset of R N +1 non-intersecting with R i .
We denote this function LargestOutSubset (third example in Figure 2).
We then update R N +1 with the reﬁned
R (cid:48)
N +1 .
Moreover, computing LargestOutSubset for when R i are (cid:96) 2 -balls is straightforward.
At last, note that Intersect is a function that returns whether two (cid:96) 2 -balls intersect.
At last, we then add ( x N +1 , C N +1 , R N +1 ) to memory.
We provide below a pytorch implementation of the memory-based certiﬁcation of the pseudo-algorithm 3.
While the memory-based certiﬁcation is essential for a sound certiﬁcation, empirically on CIFAR and ImageNet, we never found in any of the experiments a case where two inputs predicted differently suffer from intersecting certiﬁed regions.
That is to say, the certiﬁed regions in the memory for every input is the certiﬁed regions granted by the Monte Carlo certiﬁcates of Cohen et al.
for the data dependent classiﬁer.
We hypothesize that this is due to the following reasons: (i) Image datasets have very high dimensionality, resulting in samples very far apart, compared with the certiﬁed radius that randomized smoothing could provide.
Thus, it is very unlikely to ﬁnd two samples that have intersecting certiﬁed regions.
(ii)
Even if the rare case where two image inputs are close to one another that their certiﬁed regions intersect, we found that the data dependent classiﬁer g θ predicts these inputs similarly (the left example of Figure 2).
This is since the data dependent classiﬁer is trained to output smooth prediction, i.e. prediction changes are small for small input changes, resulting in a shared prediction.
(iii) To maintain reasonable test accuracy on clean samples, the values of σ , and correspondingly optimized σ ∗ x used in smoothing are moderately low ( σ ∗ x ≤ 1 . 0) .
This results in limited smaller certiﬁed regions, (cid:96) 2 balls of radii ≈ 4 σ ∗ x which is much smaller than the distance between inputs in higher dimensional data ( e.g. ImageNet).
It is worthwhile mentioning that while the memory-based certiﬁcate could work, in principle, independently without being combined with the data dependent smooth classiﬁer under any arbitrary choice of a certiﬁcation radius for every input; this results in a sub-optimal certiﬁcation.
This is since this may result in one of the following situations: (i) Assigning large radii for every input will yield a classiﬁer that is very robust, but inaccurate.
This is since several new points to be certiﬁed later will more likely fall in the certiﬁcation region requiring either changing their prediction (inaccurate predictions) or reducing their certiﬁcation radius.
Therefore, measuring the certiﬁed accuracy for such a classiﬁer will be very poor since it counts for both accuracy and robustness.
(ii) Assigning, on the other hand, small certiﬁed radii for every input will result in a highly accurate classiﬁer but very low robustness.
Hence, this also results in a very small certiﬁed accuracy at large radii.
Therefore, we combine the memory based certiﬁcate with our data-dependent smooth classiﬁer that has a better robustness/accuracy tradeoff.
For completeness, we provide the full implementation of the memory-based algorithm using PyTorch.
overlap with any other instances if
_overlap any
_overlap] overlap_diff_ preds pre 17 different prediction if
_radii[
_overlap ]
_overlap
[where_overlap] 23preds_overlap_with_diff_class = preds_overlap[ where_overlap_diff_class] rad_with_overlap_diff_class = saved_radii_with_overlap[ where_overlap_diff_class] dif_with_overlap_diff_class = dif_with_overlap[ where_overlap_diff_class]
_class - rad
_class)
return
, pre): #The img already exists in the saved dictionary if img in self.saved_images: idx = self.saved_images =
= img return self.saved_radii[idx], self.saved_predictions[idx] 41if self.saved_radii !
=
[]: #Saved dictionaries are not empty rad, pre = self._internal_adjustment(img, rad, pre) 44self.saved_radii.append(rad) self.saved_images.append(img) self.saved_predictions.append(pre) return rad, pre
D A DDITIONAL V ISUALIZATIONS
Here, we show similar results to the one in Figure 6.
Similar to the earlier observations, while model parameters are ﬁxed, optimal smoothing parameters vary per sample.
E L IMITATIONS , B ROADER I MPACT AND C OMPUTE P OWERS U SED .
Limitations.
Similar to any certiﬁcation framework, the main limitation of this kind of work is its running time to compute the certiﬁed radius.
The proposed memory-based certiﬁcation is at
Clean image σ 0 = 0 .σ
∗ x = 0 .
Clean image σ 0 = 0 .σ
∗ x = 0 .
Clean image σ 0 = 0 .σ
∗ x = 0 .
Clean image σ 0 = 0 .σ
∗ x = 0 .
Clean image σ 0 = 1 .σ
∗ x = 1 .
Clean image σ 0 = 1 .σ
∗ x = 0 .
Clean image σ 0 = 0 .σ
∗ x = 0 .
Clean image σ 0 = 0 .σ
∗ x = 0 .
Clean image σ 0 = 0 .σ
∗ x = 0 .
Clean image σ 0 = 0 .σ
∗ x = 0 .
Clean image σ 0 = 1 .σ
∗ x = 1 .
Clean image σ 0 = 1 .σ
∗ x = 0 .
the cost of both memory and computational complexity.
While the memory cost is of order O ( N ) the computational complexity is more involved.
Let p be the probability that a new point x N + be in one of the certiﬁcation regions R i , n is the complexity of computing a certiﬁcation region at x N +1 , i.e. R N +1 , using the classical Monte Carlo Algorithms of Cohen et al.
(2019), then the expected computational complexity of prediction or certiﬁcation will be O
( Np + (1 − p )(2 N + n )) .
The factor 2 N + n is due to performing N comparisons to check that x N +1 is not in any R i , then computing R N +1 of complexity n , and at last a complexity of N for computing R (cid:48)
N +1 .
Informally, for larger N and in small dimensional input, p ≈ 1 leading to a complexity of order N .
When N is smaller compared to the input dimension, we have p ≈ 0 with an expected complexity of order 2 N + n .
Moreover, the memory-based data dependent smooth classiﬁer is order dependent.
That is, the certiﬁed accuracy depends on the order at which the data at test time is presented.
However, this is not the case if there is no overlap between the certiﬁed regions of differently predicted inputs (middle and right scenarios of Figure 2 do not occur).
We found that is the case in all of our experiments making our memory-enhanced data dependent smooth classiﬁer order invariant.
We elaborated on why we believe that is the case in Appendix C. We plan in future extension to delve into more practical solution to this problem.
We postpone the design for more efﬁcient algorithms that validate the soundness of data dependent certiﬁcation to future work.
Broader Impact.
While the performance of Deep Neural networks is dominating over several ﬁelds, the existence of adversarial examples hinders their deployment in lots of applications.
This raise the attention to build networks that are not only accurate, but also robust to such perturbations.
This work takes a step towards a remedy for this nuisance by improving the certiﬁed robustness of deep neural networks.
Compute Powers.
In our experiment on CIFAR10, we used either NVIDIA Quadro RTX-600 GPU or NVIDIA 1080TI GPU.
For ImageNet experiments, we used NVIDIA-V100 GPU.
Note that one
GPU was enough to run any of our experiments.
F D ETAILED ABLATIONS
[Equation]
In this section, we detail the certiﬁed accuracy per radius for all trained models per σ for Cohen and per σ and number of iterations K for Cohen et al.
(2019), Cohen-DS and Cohen-DS 2 in Algorithmon both CIFAR10 and ImageNet.
[Equation]
In a similar spirit to the previous section, we report the certiﬁed accuracy for the SmoothAdv variants
[Table]
0.0 σ
[Table]
K
[Table] [Table]
K= 69.
[Table]
K
[Table] [Table]
K
[Table] [Table]
K= 73.
[Table]
K= 71.
[Table]
K= 70.
[Table]
K
[Table] [Table]
K
[Table] [Table]
K
[Table] [Table]
[Table]
K
[Table] [Table]
[Table]
K
[Table] [Table]
[Table] [Table]
[Table] [Table]
K
[Table] [Table]
K
[Table] [Table]
K
[Table] [Table]
K
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] [Table]
[Table] [Table]
K
[Table] [Table]
0.0 σ
[Table] [Table]
K= 74.
0.0 σ = 0.
K= 73.
[Table]
K= 73.
[Table]
K= 73.
[Table]
K= 63.
[Table]
K
[Table] [Table]
K= 64.
[Table]
K= 64.
0.0 σ
[Table]
K= 64.
0.0 σ
[Table]
K= 64.
0.0 σ = 0.
K= 64.
0.0 σ
[Table]
K= 63.
0.09 σ = 0.
K= 64.
0.14 σ
[Table]
K= 64.
0.21 σ
[Table]
K= 63.
0.2 σ
[Table]
K= 63.
0.23 σ
[Table]
K= 63.
0.21 σ
[Table]
K= 63.
0.22 σ
[Table]
K= 62.
[Table]
0.0 σ = 0.
K= 58.
0.0 σ = 0.
K= 58.
0.0 σ = 0.
K= 57.
0.0 σ = 1.
K= 45.
0.2 σ = 1.
K= 45.
0.6 σ = 1.
K= 45.
2.0 σ = 1.
K= 44.
C oh e n - D
S
[Table]
= 0.
K= 67.
0.0 σ = 0.
K= 66.
0.0 σ = 0.
K= 66.
0.0 σ = 0.
K= 67.
0.0 σ = 0.
K= 58.
0.0 σ = 0.
K= 57.
0.0 σ = 0.
K= 57.
0.0 σ = 0.
K= 57.
0.0 σ = 1.
K= 46.
0.4 σ = 1.
K= 46.
0.4 σ = 1.
K= 46.
1.8 σ = 1.
K= 46.
We compare SmoothAdv against
SmoothAdv-DS and SmoothAdv-DS 2 under varying σ and number of iterations K in Algorithm
[Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
0.0 σ
[Table]
K= 61.
0.03 σ
[Table]
K= 61.
0.43 σ
[Table]
K= 61.
S m oo t h
A dv - D
S
[Table]
K= 76.
[Table]
K= 76.
[Table]
K= 76.
[Table]
K= 75.
0.0 σ
[Table]
K= 76.
[Table]
K= 76.
0.0 σ = 0.
K= 76.
0.0 σ = 0.
K= 76.
0.0 σ = 0.
K= 76.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 61.
0.0 σ = 0.
K= 61.
0.0 σ = 0.
K= 61.
0.0 σ = 0.
K= 61.
0.0 σ = 0.
K= 61.
0.0 σ = 0.
K= 61.
0.01 σ = 0.
K= 61.
[Table]
K
[Table] [Table]
K
[Table]
We compare SmoothAdv against
SmoothAdv-DS and SmoothAdv-DS 2 under varying σ and number of iterations K in Algorithm 1.
[Table]
K
[Table] [Table]
K
[Table] [Table]
K
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
K
[Table] [Table]
[Table]
K
[Table]
S m oo t h
A dv - D
S
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table]
K
[Table]
0.0 σ = 0.
K= 62.
0.0 σ
[Table]
K= 61.
[Table]
K
[Table] [Table]
K
[Table]
0.0 σ
[Table]
K= 55.
[Table]
K= 55.
[Table]
K= 44.
[Table]
K= 44.
[Table]
K= 44.
4.2 σ
[Table]
[Equation]
We report (cid:96) r 2 certiﬁed accuracy per radius r for MACER (Zhai et al., 2020) variants on CIFAR10.
Note that as highlighted in the main manuscript, for certiﬁcation only, i.e. MACER − DS , we set n = 8 for all experiments in Algorithm 1.
Moreover, in the main paper and for ease of computation we set n = 1 for when training is employed, i.e. − DS 2 .
In here we also explore the variant where when data dependent smoothing is introduced during training we set n = 8 for ablations.
We refer to when n = 1 and n = 8 for when data dependent smoothing is used in training and certiﬁcation as
MACER − DS ( n = 1) and MACER − DS ( n = 8) , respectively. [Table] [Table] K
[Table]
[Table]
[Table]
K
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] [Table]
K
[Table] [Table]
K
[Table]
[Table]
[Table]
K
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] [Table]
[Table]
[Table]
[Table]
0.0 σ
[Table]
K= 78.
0.0 σ = 0.
K= 78.
0.0 σ = 0.
K= 78.
0.0 σ
[Table]
K= 78.
0.0 σ
[Table] K= 71. [Table]
K= 71.
0.0 σ
[Table]
K= 71. 0.0 σ [Table] K= 71.
0.0 σ
[Table]
K= 71.
0.0 σ [Table] K= 71. 0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ = 0.
K= 71.
0.0 σ
[Table]
K= 60.
0.0 σ
[Table]
K= 61.
[Table]
K= 61.
0.0 σ
[Table]
K= 61.
0.0 σ
[Table]
K= 61.
0.0 σ = 0.
K= 61.
0.0 σ = 0.
K= 61.
0.0 σ = 0.
K= 61.
0.4 σ = 0.
K= 61.
0.51 σ = 0.
K= 61.
[Table]
0.0 σ
[Table]
K= 82.
0.0 σ
[Table]
K= 82.
[Table]
K
[Table] [Table]
K
[Table] [Table]
K= 75.
[Table]
K= 75.
[Table]
K
[Table] [Table]
K= 75.
[Table]
K= 75. 0.0 σ = 0.
K= 75.
0.0 σ = 0.
K= 75.
0.0 σ = 0.
K= 75.
0.0 σ
[Table]
K= 61.
0.0 σ
[Table]
K= 62.
0.0 σ
[Table]
K= 62.
0.0 σ
[Table]
K= 62.
0.0 σ
[Table]
K= 62.
0.0 σ
[Table]
K= 62.
0.0 σ = 0.
K= 62.
[Table]
K
[Table] [Table]
K= 62.
[Table]
K= 63.
[Table]
Similar to the earlier experiments on (cid:96) 2 certiﬁcate, deploying data-dependent smoothing with the memory enhanced classiﬁer yields signiﬁcant improvement for the (cid:96) 1 certiﬁed accuracy in all considered scenarios.
G D ATA -D EPENDENT S MOOTHING FOR (cid:96) 1 C ERTIFICATES .
While indeed we focused both our methodology and experiments on (cid:96) 2 certiﬁcates, our methodology is extendable to any other (cid:96) p certiﬁcate.
For that regard and as per reviewer’s request, we conducted experiments on (cid:96) 1 certiﬁcation.
We leveraged the results of Yang et al.
(2020) that derived the tightest (cid:96) 1 certiﬁcate using randomized smoothing with uniform distribution U [ − λ, λ ] d .
The certiﬁed radius in that case has the form R 1 =
λ ( p A − p B ) .
We replace our objective in Equation equation 3 with:
[Equation]
We solved our objective in an identical fashion to our Algorithm 1 with the same hyperparameters for λ ∈ { 0 . 25 , 0 .
5 , 1 . 0 } in certiﬁcation on both CIFAR10 and ImageNet.
Further, we combine our data-dependent smooth classiﬁer with the memory based algorithm proposed in Section 3.5.
It is worthwhile mentioning that similar to the (cid:96) 2 case, the memory based algorithm did not ﬁnd any overlap between the certiﬁed regions of any pair of instances.
We report the results in Figure 11 and Table 11.
We observe that, similar to our extensive experiments on the (cid:96) 2 certiﬁcate, our proposed memory-enhanced data-dependent smoothing yields consistent improvement in the (cid:96)certiﬁed accuracy.
We report an improvement of 7% and 3% over the state of the art certiﬁed accuracy at (cid:96) 1 radius of 0.5 on CIFAR10 and ImageNet, respectively.
At last, we note similar improvement to the (cid:96) 1 ACR as reported in Table 11. H R UNTIME
We measure the certiﬁcation runtime on an NVIDIA Quadro RTX-6000 GPU for our proposed data dependent smoothed classiﬁer (time includes Algorithm 1 in addition to the memory based certiﬁcation) compared to the certiﬁcation of a ﬁxed σ classiﬁer.
Certifying one CIFAR10 test input with ResNet18 takes 1.6 and an average of 1.8 seconds for a ﬁxed σ classiﬁer and for the data dependent classiﬁer ( K = 900 ), respectively.
Certifying an ImageNet test input on ResNet takes 109.5 and an average of 136 seconds for a ﬁxed σ classiﬁer and our data dependent classiﬁer ( K = 400 ), respectively.
The runtime overhead added by using Algorithm 1 and memory based certiﬁcation is negligible compared to the gains in certiﬁed accuracy.