Empirical robustiﬁcation of pre-trained classiﬁers
Abstract
Most pre-trained classiﬁers, though they may work extremely well on the domain they were trained upon, are not trained in a robust fashion, and therefore are susceptible to adversarial attacks.
A recent technique, denoised-smoothing, demonstrated that it was possible to create certiﬁably robust classiﬁers from a pre-trained classiﬁer (without any retraining) by pre-pending a denoising network and wrapping the entire pipeline within randomized smoothing.
However, this is a costly procedure, which requires multiple queries due to the randomized smoothing element, and which ultimately is very dependent on the quality of the denoiser.
In this paper, we demonstrate that a more conventional adversarial training approach also works when applied to this robustiﬁcation process.
Speciﬁcally, we show that by training an image-to-image translation model, prepended to a pre-trained classiﬁer, with losses that optimize for both the ﬁdelity of the image reconstruction and the adversarial performance of the end-to-end system, we can robustify pre-trained classiﬁers to a higher empirical degree of accuracy than denoised smoothing, while being more efﬁcient at inference time.
Furthermore, these robustifers are also transferable to some degree across multiple classiﬁers and even some architectures, illustrating that in some real sense they are removing the “adversarial manifold” from the input data, a task that has traditionally been very challenging for “conventional” preprocessing methods. This work is sponsored by DARPA grant HR11002020006 1 Bosch Center for Artiﬁcial Intelligence, Pittsburgh, USA 2 Carnegie-Mellon University, Pittsburgh, USA. Correspondence to: Mohammad Norouzzadeh <arash norouzzadeh us bosch com>.
Accepted by the ICML 2021 workshop on A Blessing in Disguise:
1. Introduction
Deep classiﬁers are well-known to be sensitive to adversarial attacks, small perturbations of input images that can drastically change the output of the network.
Although there exist methods for improving the robustness of these classiﬁers to such attacks (e.g., adversarial training (Madry et al., 2017) or certiﬁably robust training (Wong & Kolter, 2018; Salman et al., 2019)), most pre-trained models do not adopt such training strategies, as they often come at the cost of substantial drop in clean accuracy.
As a ﬁeld, however, deep learning is also moving toward the adoption of larger and larger (and more and more costly to train) pre-trained models, raising the question of whether it might be possible to “robustify” these existing models without having to retrain them from scratch using a robust training approach.
Unfortunately, attempting to naively robustify a pre-trained model is a challenging task.
Most previous methods that attempted to use e.g., simple image preprocessing techniques were broken by simple adaptive attacks that attempted to attack that end-to-end system of both the preprocessor and the classiﬁer.
A recent advance in this area, however, came from the development of Denoised smoothing (Salman et al., 2020).
Denoised smoothing exploits the fact that randomized smoothing (Cohen et al., 2019) can transform classiﬁers that are robust to random perturbations to ones that are robust to ( (cid:96) 2 bounded) adversarial perturbations; thus, denoised smoothing prepends a denoiser to the pre-trained classiﬁer, and applies randomized smoothing to the combination, leading to a (certiﬁably) robust meta-classiﬁer.
Unfortunately, denoised smoothing has substantial drawbacks as well: because it employs randomized smoothing, it requires many queries to the underlying classiﬁer to determine the prediction of the robustiﬁed classiﬁer.
It also is not easily extensible to alternative perturbation models such as (cid:96) ∞ perturbations.
This is also why, for instance, strong adversarial training is often used in practice over randomized smoothing or other certiﬁably robust models: to achieve a higher degree of empirical robustness at the cost of guarantees.
Our contribution In this paper, we propose an “empirical robustness” analogue of these methods for robustifying pre-trained models, demonstrating an efﬁcient yet powerful method to make a pre-trained classiﬁer robust to adversarial attacks without re-optimizing any of its parameters.
Specifically, we propose to prepend an image-to-image translation model (called the robustiﬁer) in front of the pretrained model.
However, unlike past attempts at creating robust models by preprocessing images (which typically looked only at attacks on the original model), we train the robustiﬁer so as to optimize the adversarial performance of the entire end-to-end pipeline (i.e. the combination of the robustiﬁer and the pretrained model); we do this, however, by only modifying the parameters of the robustiﬁer itself, and leaving the parameters of the pre-trained model frozen.
Also key to our approach is the inclusion of several different loss terms, which penalize 1) the adversarial loss of the end-to-end system (to ensure the end-to-end system is robust); 2) the difference between input and outputs of the robustiﬁer (to ensure that the robustiﬁer doesn’t destroy the image content); and 3) the difference in activations between original and adversarial images in the pretrained classiﬁer (this enforces that the post-robustiﬁed image should “look like” the non adversarial image as much as possible to the classiﬁer).
We demonstrate that:
• Our defense not only eliminates the need for multiple queries per sample but also provides better results than denoised smoothing.
The approach can also in theory be applied to any setting where adversarial training can be used, rather than applying only to classiﬁcation settings.
• It can be transferred among different models and even different architectures.
The transferability results indicate that a preprocessor model can—-to some extent— learn to separate the “adversarial manifold” from the input data, a key challenging task for “conventional” preprocessing methods.
2. Related work
Many earlier front-end defenses relied on heuristic preprocessing of input images, which shatter gradients and make a straightforward application of a vanilla gradient attacks impossible.
For example, (Guo et al., 2017) employed multiple image transforms including cropping, tilting, bit-depth reduction.
However, such simple image transformations were shown to be ineffective under the Backward Pass Differentiable Approximation (BPDA) attack (Athalye et al., 2018).
More sophisticated front-end defenses attempt to detect and/or remove adversarial noise using neural networks.
An attempt to detect and remove adversarial noise using sophisticated detector and reformer networks was proposed by (Meng & Chen, 2017), but this defense was easily broken under adaptive attacks (Carlini & Wagner, 2017b).
(Samangouei et al., 2018) harnessed generative neural networks in an attempt to remove adversarial noise, but it was also shown to have lower effectiveness under adaptive attacks (Athalye et al., 2018).
Similarly, (Mustafa et al., 2019) proposed a DNN based image super-resolution method.
However, (Choi et al., 2019) showed that image super-resolution models were also vulnerable to adversarial attacks.
Additionally, (Carlini & Wagner, 2017a) showed that most detectors for adversarial examples are ineffective.
Although these works use an approach similar to our defense (transforming input images before feeding them into a classiﬁer), they are mostly based on heuristics and cannot truly remove the “adversarial manifold” generated by strong and adaptive attacks.
Recently, (Salman et al., 2020) proposed an effective method to make a pre-trained classiﬁer robust by equipping it with a custom-trained Gaussian denoiser.
To classify an input image, ﬁrst the input image is perturbed with Gaussian noise multiple times and fed to the model.
Then, randomized smoothing (Cohen et al., 2019) is employed to determine the class of the input image.
Their method certiﬁes the robustness of a model without changing model parameters under white-box or black-box attacks.
The guarantee of the degree of robustness for any classiﬁer leveraging denoised smoothing comes at the cost of having to run the model multiple times (10 to 100) for each input, which greatly increases inference time.
3. Robustiﬁer models for pre-trained networks
In this section, we discuss the proposed pre-pended robustiﬁer to make a pre-trained machine learning model robust against adversarial attack (Fig. S.1).
Different from (Salman et al., 2020), the proposed method requires only one forward pass and can be directly applied to tasks beyond classiﬁcation.
We begin by reviewing the standard adversarial training setting, then describe the extension to our robustiﬁer setting, as well as the additional loss terms we found to be crucially important for good performance of the method.
We ﬁnally discuss how to train the robustiﬁer to improve transferability of the robustiﬁer between multiple different variants of an architecture and even between different architectures.
3.1. Standard and adversarially robust training
Given a classiﬁer h θ : X → Y mapping from an input space
X to output space Y , parameterized by parameters θ , the typical goal of training is to minimize some expected loss function
[Equation]
where D denotes a distribution over x, y pairs, and (cid:96) :
Y ×Y denotes some loss function.
Adversarially robust training (Madry et al., 2017), on the other hand, seeks to minimize the worst case loss when inputs are allowed to be perturbed within some pre-speciﬁed threat model ∆ (often taken to be e.g., an (cid:96) p norm ball, though other threat models are certainly possible as well).
This can be written formally as the optimization problem
[Equation]
A standard approach to optimizing this robust objective is via adversarial training, which for each sample in a dataset drawn from D iteratively seeks to solve the maximization problem over δ (via a gradient-based approach like projected gradient descent), and then takes a gradient step in θ at these worst-case perturbations.
3.2. Training prepended robustiﬁers
Given a ﬁxed pre-trained classiﬁer h : X → Y (we no longer write h as dependent on parameters θ , as we will treat h as ﬁxed throughout), we propose to simply prepend an image to image translation system we refer to as the robustiﬁer .
Formally, a robustiﬁer is a network r θ : X → X , parameterized by parameters θ such that our ﬁnal prediction is given by the composition of the classiﬁer and robustiﬁer h ( r θ ( x )) .
Generally speaking, any image-to-image architecture could be used as the robustiﬁer, such as Variational
Autoencoders (VAEs), image denoisers, or semantic segmentation networks (we will ultimately use a U-Net style architecture for this task).
To train the robustiﬁer, we could apply adversarial training via projected gradient descent (PGD) to composed system of the robustiﬁer and the classiﬁer.
That is, we could perform adversarial training on the objective
[Equation]
where (cid:96) is the cross entropy loss, and ∆ is the perturbation model.
The only difference between this and adversarial training is that the the weights of the classiﬁer itself are ﬁxed, and we are only using the parameters of the robustiﬁer.
However, if we train the robustiﬁer with this objective, without any constraints on the output of the image-to-image network, the output images can diverge too far from the original images (Nguyen et al., 2015).
Effectively, because the robustiﬁer can learn to output any image into the classiﬁer, the robustiﬁer can effectively identify any low-dimenional manifold of the desired output itself, and simply output images in this reduced manifold: this raises the possibility that the robustiﬁer could simply “duplicate” the effort of a typical robust classiﬁer, rather than actual “ﬁltering” away any aspects of the adversarial perturbation in a generic manner.
To avoid this phenomenon, we additionally need to ensure some measure of ﬁdelity to the original image.
We can do this by additionally incorporating some form of recontruction loss in our training objective, such as the Mean Squared
Error (MSE) loss.
Let ˜ x denote the adversarial perturbation of x according to the maximization in 3.
Then we can write this MSE loss as
[Equation]
To further improve in this regard, we found in practice it was additionally beneﬁcial to penalize an MSE loss between intermediate layer activations of the pre-trained classiﬁer applied to the original image, and these intermediate layer activations when applied to the output of the robustiﬁer (applied to the adversarial example).
That is, we want the output of the robustiﬁer, when applied to an adversarial image, to produce an image that is “nearby” the original image, both in terms of the MSE on the original image and in terms of the activations produced by the pretrained classiﬁer.
Letting h a denote the activations of classiﬁer h at selected intermediate layers L , this corresponds to the loss
[Equation]
Altogether, our training objective is the following:
[Equation]
where the coefﬁcients α, β , and γ adjust the scale and relative importance of the loss terms.
1 It is important to emphasize that while we include all three loss terms in training the robustiﬁer, the adversarial attack itself does not directly try to maximize this combined loss, but just maximizes the original robust loss: this is crucial in practice, as the “strongest” adversary (and our eventual evaluation metric) is concerned solely with maximizing the adversarial loss; the other two components are effectively regularization terms, that prevent the robustiﬁer model from overﬁtting to the min-max objective.
For more details on implementation of training procedure refer to section S.1.
4. Experiments
In this section, we present experiment setup and then discuss the obtained results when training the robustiﬁer with a single pre-trained classiﬁer.
Sec. S.1 of the supplementary materials contains details about our implementation, dataset, and architecture of models.
We discuss training the robustiﬁer with an ensemble of classiﬁers and transferability of the robustiﬁer in supplementary materials Sec.
S.4.
these
4.1. Robustiﬁer trained with one classiﬁer
As discussed in Section 3.2, we follow two main objectives during training:
1- adversarial robustness loss (cross-entropy loss), and 2 - ﬁdelity to the original image (MSE loss and the intermediate layers loss).
In extreme cases, if we abandon the adversarial robustness loss ( α = 0 in Eq.6), we get lower robust accuracy/higher clean accuracy, and the output of the robustiﬁer will be similar to the original image.
On the other hand, if we abandon the ﬁdelity objective ( β = 0 , γ = 0 in Eq. 6), we get higher robust accuracy/lower clean accuracy, and the outputs of the robustiﬁer could be heavily distorted.
We run different experiments to ﬁnd the best set of loss coefﬁcients to make a pre-trained classiﬁer robust.
Section S.3 of supplementary materials describes the steps we perform to ﬁnd an appropriate set of coefﬁcients.
Fig.depicts the achieved robust and clean accuracy understeps PGD (cid:96) ∞ and (cid:96) 2 attacks for several good performing robustiﬁers using the CIFAR-10 dataset.
Comparison against denoised smoothing Denoised smoothing (Salman et al., 2020) is the most relevant work to ours as both methods try to make a pre-trained classiﬁer immune to adversarial attacks although they reported certiﬁed accuracy (Cohen et al., 2019) in the paper.
To compare our approach to denoised smoothing fairly, we conduct experiments on the empirical robustness of denoised smoothing for different σ values and denoised objectives (MSE and stability), and then compare the best results of both methods.
Empirical results of denoised smoothing for (cid:96) ∞ and (cid:96) 2 attacks with different denoiser objectives are depicted in supplementary materials S.2.
As the results reveal, the best setting for denoised smoothing achieves 72% clean, 32% robust accuracy under (cid:96) ∞ attack, and 53% robust accuracy under (cid:96) 2 attack, shown as black dash line in Fig. 1(b) and
Fig.
1(c).
These results are inferior to the results we obtained as in Fig.
This shows that our approach can offer a higher empirical robust accuracy than denoised smoothing while avoiding the high computational cost of multiple forward pass during inference time.
5. Conclusion, limitation, and broader impact
In this paper, we demonstrate an approach that uses adversarial training to robustify existing pre-trained classiﬁers, without any retraining or ﬁne-tuning of the classiﬁer itself.
We accomplish this by prepending a custom-trained imageto-image model to these pre-trained classiﬁers and then adversarially training the prepended model while preserving a measure of ﬁdelity to the input image.
We evaluated U-Netbased robustiﬁer models at different capacities and different coefﬁcients of losses to robustiﬁer models that strike a good balance between robust and clean accuracy levels.
Moreover, we showed our defense strategy is transferable among different models and even different architectures, revealing the power of our suggested method and shedding light on common vulnerability patterns of different deep learning models.
Despite theses beneﬁts, the approach we present here also has some signiﬁcant limitations.
Most notably, the robust accuracy we achieve still does lag substantially behind the state of the art in adversarially robust training.
For instance, state of the art methods in adversarial training (albeit with a larger model and using additional data augmentation techniques), achieve great than 65% robust accuracy on CIFAR10 (Gowal et al., 2020).
Although we imagine that some of these methods could be used to improve robustiﬁer performance, there will likely still be a substantial gap between our robustiﬁer method and models trained from scratch via adversarial training.
To some degree, we believe this to be unavoidable: existing pre-trained classiﬁers are susceptible to adversarial attacks, and any attempt to robustify them still needs to cope with the reality that a ﬁxed part of the model cannot be changed to be inherently more robust.
But the results we present here, especially the transferability results, nonetheless do suggest that some real adversarial component is being removed from the data, and further study of this “manifold” may prove fruitful in future work.
Our hope is that the work here can largely serve to beneﬁt existing models by making “more robust” versions, without having to sacriﬁce the accuracy of the underlying classiﬁer (e.g., when the robustiﬁer is removed).
Thus one could e.g., add a number of “plug in components” that allowed a user to select the desired level of robustness needed for a given classiﬁer, or even adapt in real-time.
In addition, our transferability results indicate researchers do not even need to train a custom robustiﬁer for their model and can use a pretrained robustiﬁer to make their model robust.
As such, we hope that the work would have substantially more positive societal beneﬁts than negative ones.
Adversarial attacks can endanger many real-world applications of computer vision, including autonomous driving cars and other safety-critical uses, and this system can hopefully seek to improve their performance.
At the same time, it is also worth emphasizing the potential negative consequences of adopting a “robust” model, especially in the case that the robust accuracy is still not nearly on par with modern deep learning systems.
In particular, adopting a “robustiﬁer” model may provide some degree of a false sense of security, that the sensitivity of the model to adversarial attacks has been “solved”, when in reality even if the best adversarially robust models still substantially underperform the best clean models, and worse are easy still attacked by perturbations outside their speciﬁed threat model.
This is all to say that the task of truly robust machine [Figure] learning has a great deal of progress left to be made, and the ultimate societal impact of the ﬁeld is still evolving.
Supplementary materials S.1. Implementation
In order to minimize over the objective 6 in practice, when we sample a minibatch ( x, y ) from the dataset, we ﬁrst duplicate the minibatch, and then adversarially perturb one of the copies using PGD to get ˜ x .
We then feed both x and ˜ x to the robustiﬁer and respectively feed the outputs of the robustiﬁer, r θ ( x ) and r θ (˜ x ) , to the pre-trained classiﬁer h .
We store r θ ( x ) and r θ (˜ x ) , the ﬁnal output of the pretrained classiﬁer for the perturbed image, h ( r θ (˜ x )) , as well as activations of selected intermediate layers during the forward path, h a ( x ) and h a ( r θ (˜ x )) .
Finally we compute the losses according to the objective in 6 and back-propagate the error.
Figure S.2 illustrates the training procedure.
Dataset, threat model, and architecture We utilize the
CIFAR-10 dataset to evaluate the proposed methods.
We investigated both (cid:96) ∞ and (cid:96) 2 PGD attacks with the radius of 0.031 and 0.5, respectively.
For training, we use 5-step
PGD with the step size of 0.008, and for evaluation, we use 100 steps PGD (5 restarts, 20 steps each) with different step sizes (0.008, 0.004, 0.0015) and report the lowest obtained robust accuracy.
We also report robust accuracy under Autoattack (Croce & Hein, 2020) for robustiﬁers trained with one pre-trained classiﬁer.
We employ a Momentum Stochastic Gradient Decent (SGD) optimizer utilizing one cycle learning rate policy (Smith, 2017) during training with the maximum lr =0.005, momentum=0.9, weight decay=0.0005, and 20% steps spent increasing the learning rate.
We adversarially train the robustiﬁers on one RTX 2080 GPU for 100 epochs with early stopping; each epoch takes aboutminutes.
For the robustiﬁer, we chose to use an architecture similar to that of U-Net (Ronneberger et al., 2015).
The U-Net architecture is advantageous because of its skip connections, which enable the model to reconstruct ﬁne details of input image.
Details on the U-Net model we used can be found in the next paragraph.
For the pre-trained classiﬁer, we use ResNet-18 architecture.
U-Net architecture U-Net is a fully convolutional neural network architecture designed for segmentation and image translation (Ronneberger et al., 2015).
The skip connections in U-Net architecture enable it to remember ﬁne details of the input image while extracting the high-level semantic of the image using its back-bone.
In this paper, we employ a customized U-Net architecture which is depicted in Fig.
S.4.
The scale factor parameter speciﬁes the number of convolutional kernels at each layer, affecting the number of total parameters in the model.
We use the scale factor of 4, 8, and 16 with 4.3, 17.3, and 69.0 million parameters, respectively.
S.2. Empirical results of denoised smoothing
Throughout this paper, we use the empirical results of denoised smoothing (Salman et al., 2020) as our baseline. We obtained empirical results of denoised smoothing (Salman et al., 2020) with ﬁne-tuned DnCNN denoiser with MSE and stability objectives in Table S.1 and Table S.2. Here the attacks are 100-PGD (50 iterations, 2 restarts).
As equation 6 indicates, our loss function consists of three components with their own coefﬁcients α , β , and γ .
Finding a good equilibrium between these coefﬁcients is crucial for achieving a robustiﬁer model which removes the adversarial perturbation while keeping the image similar to the input image.
Trying all the possible coefﬁcients is computationally impossible.
Therefore, to ﬁnd the best set of coefﬁcients, we conduct a grid search on a range of appropriate coefﬁcient values.
First, we specify an appropriate range of the coefﬁcients based on a few sample runs and then perform a grid search on those ranges.
Fig.
S.3 depicts the results of the grid search.
For all the experiments in Fig.
S.3 we utilize U-Net with scale factor 4 because it has fewer parameters, and hence it is faster to train and evaluate.
After obtaining the results of grid-search, we pick the two most promising rows of ﬁgure S.3 ( α = 0 .
005 , β = 10 , 15 and γ = 5 , 10 , 15 , 20 , 30 , 40 , 50 ) and redo the experiments with the scale factor of 16 ( Fig. 1).
Fig.
1 conﬁrms our intuition that if we ﬁx weight for classiﬁer loss, α , and increase the weights of ﬁdelity loss, β and γ , the robust accuracy increases as clean accuracy decreases.
We also brieﬂy try the scale factor of 8 for four of our best coefﬁcient sets ( α = 0 .
005 , β = 10 and γ = 20 , 30 , 40 , 50 ) and report the results in Figure S.5.
To further verify the robustness of our robustiﬁer defense, we also report robust accuracy of our models under Autoattack (Croce & Hein, 2020) as the two blue lines in Fig. 1(b) and (c).
Our best setting, α = 0.005, β = 15.0, γ = 30. can achieve 39.0% PGD, 38.4% Autoattack robust accuracy and 74.2% clean accuracy for (cid:96) ∞ attack; and 57.3%
PGD, 55.6% Autoattack robust accuracy, and 82.5% clean accuracy for (cid:96) 2 attack.
S.4. Transferability of the robustiﬁer
Adversarial examples generated for one model can also be effective on another model trained with different initialization, or even models with different architectures (Liu et al., ; Papernot et al., 2017).
This is commonly referred to as transferability of adversarial examples.
(Su et al., 2018) showed that adversarial examples transfer well between commonly used image classiﬁers architectures, such as ResNet (He et al., 2016), DenseNet, VGG and Inception.
[Figure]
[Figure]
PretrainedDNN ( ℎ )
Sample
Batch
Sample
Batch ( ! ) PerturbedBatch ( ̃! )
Output !
Batch ( ℎ ( % ! ( ! )) )
Output ̃!
Batch ( ℎ ( % !
( ̃! )) )
Copy and Attack
Cleaned !
Batch ( % ! ( ! ) )
Cleaned ̃!
Batch ( % ! ( ̃! ) )
The transferability of adversarial examples indicates that the adversarial manifold of different model architectures are closely related, thus if we can remove adversarial noise on one model using robustiﬁer, it is likely to be effective on models trained with different initialization, as well as other similar model architectures.
To improve transferability of robustiﬁer, we propose to train the robustiﬁer with an ensemble of M classiﬁer (e.g.,
ResNet-18 models trained using different initializations, or a few classiﬁers with different model architectures).
To avoid the cost of forward and backward propagation on M base classiﬁers, we propose to just randomly sample one base classiﬁer each time rather than adding the prediction of all
M classiﬁers together.
This allows us to train the robustiﬁer using an ensemble of base classiﬁers, while keeping the training cost similar to the case of training with one base model.
We evaluate the performance and transferability of robustiﬁer when trained with an ensemble classiﬁer in
Section 4.
S.4.1. Transferability Experiments
In this section, we investigate the transferability of our proposed robustiﬁer, by training the robustiﬁer on an ensemble of 2, 4, 20 ResNet-18 models on CIFAR-10 dataset and then evaluate it on a few settings: (1) a ResNet-18 model that is included in the ensemble (denoted as “ResNetinc.”
in Table S.3 and Table S.4), (2) a ResNet-18 model that is not included in the ensemble (denoted as “ResNetexc.”
in Table S.3 and Table S.4), and (3) different model architectures such as ResNet-34, ResNet-50, DenseNet-121, and VGG-16.
In each setting, we evaluate the robustness of the robustiﬁer and classiﬁer end-to-end PGD attack as described in Section 4.
The aim of this experiments is to show the generalization of robustiﬁer and its effectiveness on a wide range of popular model architectures.
We show the transferability results in Table S.3 for (cid:96) ∞ attack and Table S.4 for (cid:96) 2 attack.
The robustiﬁer trained on multiple ResNet-18s (row 4-11 of Table S.3 and Table
S.4) also transfer to other ResNet-18 models, and the PGD accuracy almost stays the same, which demonstrates that the robustiﬁer does generalize to unseen model parameters.
Furthermore, robustiﬁers trained on ensemble of Resnet18, even with just two of them, also transfers reasonably well to other classiﬁer architectures such as DenseNet and VGG.
As the number of classiﬁer models used for training a robustiﬁer increases, the transferability of the robustiﬁer increases but not signiﬁcantly.
However when the robustiﬁer was trained on one ResNet-18 (row 2-3 of Table S.3 and
Table S.4)
, it does not transfer to other ResNet-18s as well as other classiﬁer architectures.
Impact of activations of intermediate layers used for ﬁdelity loss In addition to the loss coefﬁcient α, β, γ , the set of intermediate layers used for the ﬁdelity objective also inﬂuences the tradeoff between robust accuracy and clean accuracy as well as visual quality of the robustiﬁer output.
If we use the activations of last few layers of the robustiﬁers for Eq. 5, then the visual quality of the robustiﬁer output is poorer with lower clean accuracy and higher robust accu-
[Table]
[Figure]
β tend to increase clean accuracy and decrease robust accuracy while higher value of γ encourage higher robust accuracy and lower clean accuracy. racy.
Visual quality of robustiﬁer output with corresponding accuracy can be found in Fig.
S.6: Fig.
S.6(b) uses activations at the end of each of the four blocks of the ResNetarchitecture to compute Eq.
6, while Fig.
S.6(c) additionally include the activations of the ﬁnal fully connected layer.
It is clear that the visual quality of Fig.
S.6(c) is almost the same as the input (Fig.
S.6(a)) and is much better than Fig.
S.6(b); the robustiﬁer that produces Fig.
S.6(c) has lower robust accuracy (31%) than the robustiﬁer that produces Fig.
S.6(b) (39%) under (cid:96) ∞ attack but higher clean accuracy (87% vs 78%).
[Figure]
[Figure]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Figure]