PaperlayerView exact revision on arXiv

Source-linked AI summary

Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers

Hadi Salman, Greg Yang, Jerry Li, Pengchuan Zhang, Huan Zhang, Ilya Razenshteyn, Sebastien Bubeck

arXiv:1906.04584v5cs.LGcs.CRstat.ML

TL;DR

The paper addresses limited scalable certifiable robustness against ℓ2 adversarial perturbations. It introduces an adapted attack for smoothed classifiers and uses it for adversarial training, achieving state-of-the-art provable robustness on ImageNet and CIFAR-10, with further gains from pre-training and semi-supervised learning.

  • Problem

    Neural networks are brittle to small adversarial perturbations, while prior certifiable defenses do not immediately scale to large practical networks.

  • Method

    The paper attacks smoothed soft classifiers and uses the adapted attack to adversarially train models whose smoothed classifiers can be certified.

  • Results

    The method consistently outperforms existing provably ℓ2-robust classifiers on ImageNet and CIFAR-10, establishing state-of-the-art provable ℓ2 defenses.

  • Takeaways & Limitations

    Pre-training and semi-supervised learning further improve the certified robustness of adversarially trained smoothed models.

  • Takeaways & Limitations

    The attack based on an unbiased, gradient-free method is empirically weak, likely because its gradient estimator has high variance.

Abstract

from arXiv · show

Recent works have shown the effectiveness of randomized smoothing as a scalable technique for building neural network-based classifiers that are provably robust to $\ell_2$-norm adversarial perturbations. In this paper, we employ adversarial training to improve the performance of randomized smoothing. We design an adapted attack for smoothed classifiers, and we show how this attack can be used in an adversarial training setting to boost the provable robustness of smoothed classifiers. We demonstrate through extensive experimentation that our method consistently outperforms all existing provably $\ell_2$-robust classifiers by a significant margin on ImageNet and CIFAR-10, establishing the state-of-the-art for provable $\ell_2$-defenses. Moreover, we find that pre-training and semi-supervised learning boost adversarially trained smoothed classifiers even further. Our code and trained models are available at http://github.com/Hadisalman/smoothing-adversarial .

1 Introduction

Neural networks are vulnerable to small adversarial perturbations, while scalable certifiable defenses remain limited. This paper combines randomized smoothing with adversarial training to improve provable ℓ2 robustness and reports state-of-the-art results.

  • Small adversarial perturbations can change neural-network predictions despite being indistinguishable from clean inputs to humans.
  • Certifiable robustness seeks classifiers whose predictions remain constant within a neighborhood of most test inputs, but prior techniques do not immediately scale to large practical networks.
  • Randomized smoothing transforms a base classifier into a smoothed classifier with certifiable ℓ2 robustness guarantees using isotropic Gaussian noise.
  • Randomized smoothing scales to networks of any architecture and size, supporting robust real-world neural networks.
  • Adversarial training improves randomized smoothing, while an adapted attack enables adversarial training of smoothed models with stronger empirical and certifiable robustness.
  • 56% certified top-1 accuracy is achieved by the ResNet-50 ImageNet classifier under ℓ2 perturbations below 127/255, versus 49% previously.
  • The paper also provides a concise alternative proof of Cohen et al.'s tight robustness guarantee by framing it as a nonlinear Lipschitz property.

2 Our techniques

The paper develops an attack and adversarial-training procedure tailored to smoothed classifiers, then combines it with randomized smoothing to improve certifiable robustness. The method targets the smoothed soft classifier because directly attacking the hard classifier is ill-behaved, and standard base-classifier adversarial training does not optimize smoothed robustness.

  • 2.1 Background on randomized smoothing: Randomized smoothing constructs g by assigning the class most likely under isotropic Gaussian perturbations of input x.The noise level σ2 controls a robustness/accuracy trade-off, and certification uses the resulting class probabilities.
  • 2.1 Background on randomized smoothing: Monte Carlo estimates provide conservative bounds on the top-class and runner-up probabilities used to certify an ℓ2 robustness radius.The guarantee remains valid when estimated probabilities satisfy pA ≤ pA and pB ≥ pB.
  • 2.2 SMOOTHADV: Attacking smoothed classifiers: The SMOOTHADV attack optimizes the smoothed soft classifier G rather than the argmax-based smoothed hard classifier g.The hard-classifier objective is ill-behaved, while attacks on G empirically produce effective adversarial examples for g.
  • 2.2 SMOOTHADV: Attacking smoothed classifiers: SMOOTHADV directly decreases G’s correct-class probability, unlike an alternative objective that seeks examples for the base classifier robust to Gaussian noise.The paper reports that this distinction is crucial because attacks based on the alternative objective were empirically ineffective.
  • 2.3 Adversarial training using SMOOTHADV: Adversarial training finds SMOOTHADV perturbations and updates model weights using Gaussian perturbations of those adversarial examples.This combines the new attack with randomized smoothing’s training approach and encourages robustness of the resulting smoothed classifier.
  • 2.3 Adversarial training using SMOOTHADV: The resulting heuristic training procedure has no provable guarantee by itself, but its smoothed classifiers obtain substantially stronger certifiable robustness.Standard adversarial training can improve empirical robustness yet produces base classifiers that are not optimized for randomized smoothing.

3 Implementing SMOOTHADV via first order methods

SMOOTHADV is implemented with first-order attacks that estimate gradients of the smoothed-model objective using Gaussian samples, then optimize it with PGD or DDN. The paper also describes an unbiased gradient-free alternative, but reports that it is weak in practice and focuses empirically on the biased estimator.

  • First-order attacks: PGD and DDN approximate optimization of the non-convex SMOOTHADV objective for smoothed classifiers.Both methods use first-order updates, with DDN providing an alternative to PGD for ℓ2 attacks.
  • Gradient estimation: Monte Carlo sampling estimates the smoothed-model objective and its gradient from independent Gaussian perturbations.The estimator converges to the target expression with more samples, but evaluating all samples requires repeated network evaluations.
  • Adversarial training: SMOOTHADV adversarial training reuses Gaussian noise samples while updating adversarial examples and augmenting the training loss.The training procedure generates adversarial examples with estimated smoothed-model gradients before backpropagating through their noisy versions.
  • Estimator choice: The estimator used by SMOOTHADVPGD is biased but empirically produces the strongest attacks and certifiable defenses in the paper.The authors distinguish this estimator from an unbiased gradient-free alternative and use it for their strongest empirical results.
  • Estimator choice: The unbiased gradient-free alternative avoids gradients of the base classifier but is reported to be weak, likely because of high estimator variance.Its theoretical advantages include unbiasedness, reduced memory use, and applicability to hard classifiers.
  • Evaluation: Figure 1 compares certified accuracies of SMOOTHADV-trained CIFAR-10 classifiers with Cohen et al. across overall and per-σ envelopes.The figure includes representative models for each σ, with model details reported in Appendix G tables.

4 Experiments

Experiments evaluate SMOOTHADV against prior smoothed and provably robust classifiers on CIFAR-10 and ImageNet, finding stronger certified robustness across radii and additional gains from more data.

  • Setup: Experiments use ResNet-110 on CIFAR-10 and ResNet-50 on ImageNet, with PREDICT and CERTIFY based on Gaussian-noise predictions.The evaluation uses mtrain, mtest, σ, attack-step, and perturbation-radius settings across the experiments.
  • SMOOTHADV-ersarial training: For all radii, adversarially trained smoothed classifiers outperform Cohen et al. in certified accuracy on both ImageNet and CIFAR-10.Certified accuracy counts correctly classified, non-abstaining test examples certified robust at radius r.
  • CIFAR-10: Our CIFAR-10 models outperform Cohen et al. across the certified-accuracy envelope and for each tested noise level σ.The CIFAR-10 envelope selects the best model for each radius over attacks, noise levels, perturbation limits, and training-sample counts.
  • ImageNet: Our ImageNet models outperform Cohen et al. overall and per σ using models trained with mtrain = 1 and 1-step SMOOTHADVPGD or 2-step SMOOTHADVDDN.The ImageNet results are summarized in Figure 2, with certified accuracies listed in Appendix Table 6.
  • More data: Pre-training or semi-supervised learning consistently improves the certified robustness of adversarially trained smoothed models.The paper also studies combining both approaches.

5 Related Work

Related work distinguishes empirical defenses from certified defenses and traces randomized smoothing from heuristic use to scalable provable ℓ2 robustness.

  • Defense categories: Empirical defenses are evaluated against known attacks, while certified defenses guarantee prediction constancy within a specified perturbation neighborhood.Adversarial training is described as the strongest empirical defense, but it does not guarantee resistance to unknown stronger attacks.
  • Certified defenses: Certified methods may be exact or conservative, with prior approaches including satisfiability and mixed-integer programming techniques.Exact methods aim to find adversarial examples exhaustively, whereas conservative methods provide sound but incomplete guarantees.
  • Randomized smoothing: Randomized smoothing transforms a base classifier into a smoothed classifier with certifiable ℓ2 robustness guarantees.The approach was first introduced as a heuristic defense before formal robustness guarantees were established.
  • Randomized smoothing: Subsequent randomized-smoothing work strengthened the guarantees and made the method scalable to networks of any architecture and size.Cohen et al. derived robustness using the Neyman-Pearson lemma.

6 Conclusions

The paper introduces an adapted attack for smoothed classifiers and uses it for adversarial training, substantially improving provable robustness on ImageNet and CIFAR-10.

  • Conclusion: The adapted attack enables adversarial training that substantially improves the provable robustness of smoothed classifiers.The method targets the smoothed classifier rather than only its base classifier.
  • Conclusion: Extensive experiments show consistent, significant-margin improvements over existing provably ℓ2-robust classifiers on ImageNet and CIFAR-10.The authors characterize the resulting method as state of the art for provable ℓ2 defenses.

B Another perspective for deriving SMOOTHADV

The paper derives SMOOTHADV by replacing the hard argmax in a smoothed classifier with a softmax approximation, then attacks the resulting smoothed soft classifier. This objective converges to attacks on the true smoothed classifier as the softmax inverse temperature increases, while larger temperatures make optimization more difficult.

  • Derivation: The smoothed soft classifier averages softmax outputs of the neural network’s logits under Gaussian noise.The hard classifier’s logits are represented by L, and Gaussian smoothing is applied before the softmax probabilities are aggregated.
  • Derivation: As β increases, the softmax approximation converges to the hard argmax, so the optimization approaches an attack on the true smoothed classifier.The convergence is stated as β →∞.
  • Derivation: SMOOTHADV minimizes the correct-class probability of the smoothed soft classifier to find adversarial examples.This directly targets the smoothed model rather than only making the base classifier vulnerable under noise.
  • Derivation: For neural networks, β = 1 makes the softmax-based optimization equivalent to the stated SMOOTHADV objective because logarithm is monotonic.The solutions to the two objectives coincide under this parameter choice.
  • Open direction: Varying β may improve attacks and adversarial training, but increasing it also makes the optimization increasingly ill-behaved for first-order methods.The paper identifies this trade-off as an open direction rather than reporting a resolved choice.
  • Training samples: Higher mtrain tends to produce higher certified accuracies when models are trained with SMOOTHADV attacks.The experiment compares SMOOTHADVPGD and SMOOTHADVDDN across attack steps, noise levels, perturbation limits, and training sample counts.

C.3 Effect of ϵ during training on the certified accuracy of smoothed classifiers

The experiments examine how training and evaluation choices affect certified and empirical accuracy for smoothed classifiers. Larger training perturbations favor larger certified radii but reduce accuracy at smaller radii, while stronger attacks and more prediction samples change empirical accuracy and abstention behavior.

  • Effect of ϵ: As ϵ increases, certified accuracy decreases at small ℓ2 radii but increases at large ℓ2 radii.The paper describes this radius-dependent trade-off as expected.
  • Evaluation samples: Increasing mtest strengthens SMOOTHADVPGD, reducing the gap between certified and empirical accuracies.With mtest = 1, vanilla PGD can perform better, but the adapted attack improves as more samples estimate the gradient.
  • Prediction samples: Increasing PREDICT’s Monte Carlo sample count n raises empirical accuracy because smoothed predictions improve and fewer predictions abstain.The attack uses mtest = 128 in this experiment.
  • Gradient estimation: The gradient-free estimator produces a weak attack in practice, which the authors speculate results from excessive estimator variance.They identify improving this attack as future work.
  • Abstention: Our models have substantially lower certification abstention rates than Cohen et al.’s models across all evaluated ℓ2 radii.The comparison concerns certification abstention, whereas Cohen et al. reported prediction abstention rates.

D Experiments Details

The experiments use adapted PGD and DDN attacks to adversarially train smoothed classifiers on CIFAR-10 and ImageNet. The setup specifies attack, noise, optimization, certification, architecture, and reproducibility details.

  • Attacks: SMOOTHADVPGD and SMOOTHADVDDN adapt PGD and DDN by using gradients defined for smoothed classifiers.The attacks are used for adversarial training rather than attacking only the base classifier.
  • Attacks: For SMOOTHADVPGD, the constant step size is γ = 2ϵ/T, where T is the number of attack steps.ϵ denotes the maximum allowed ℓ2 perturbation.
  • Attacks: DDN seeks the closest adversarial example, unlike PGD, which seeks the best adversarial example within a specified neighborhood.The reported DDN hyperparameters are ϵ0 = 1, γ = 0.05, and an annealed step size.
  • Training: The training algorithm uses m noise samples for gradient estimation and Gaussian augmentation, and T attack steps.B denotes mini-batch size.
  • Training setup: The study uses ResNet-50 on ImageNet and ResNet-110 on CIFAR-10, following architectures similar to Cohen et al.CIFAR-10 training uses SGD for 150 epochs, while ImageNet training uses synchronous SGD for 90 epochs.
  • Certification and reproducibility: CERTIFY and PREDICT generally use n = 100,000 and α = 0.001, with CERTIFY additionally using n0 = 100.The paper’s source code and trained models, including logs, are publicly available.

E.1 Pre-training

The paper pretrains smoothed ResNet-110 classifiers on down-sampled ImageNet and fine-tunes them on CIFAR-10, replacing the output layer for the target task. It also investigates semi-supervised self-training and its combination with pre-training.

  • Pre-training: ImageNet32 pre-training trains 16 models spanning four σ values and four ϵ values with SMOOTHADVPGD.The models use T = 2 attack steps and mtrain = 1 noise sample.
  • Semi-supervised learning: Semi-supervised learning uses a 500K unlabelled dataset with pseudo-labels generated by a standard CIFAR-10 neural network.Training alternates between labelled CIFAR-10 minibatches and pseudo-labelled minibatches.
  • Semi-supervised learning: For pseudo-labelled minibatches, the cross-entropy loss is scaled by η ∈ {0.1, 0.5, 1.0} before following the training procedure.Labelled minibatches follow the main training algorithm without this scaling.
  • Combined procedure: The paper combines semi-supervised learning with ImageNet32 pre-training and fine-tunes the resulting models on CIFAR-10.This combined procedure uses SMOOTHADVPGD with T ∈ {2, 4, 6, 8, 10} and mtrain = 1.

F ℓ2 to ℓ∞Certified Defense on ImageNet

The paper reports that its ℓ2-robust ImageNet models also achieve strong certified ℓ∞ robustness, exceeding the previous state of the art by around 8.2% at radius 1/255.

  • Around 8.2%: the models exceed previous state-of-the-art certified ℓ∞ defenses on ImageNet at radius 1/255.The paper describes this ℓ∞ robustness as non-trivial and derives the radius from ℓ2 certified accuracy at approximately 1.5.
  • Table 5 reports certified ℓ∞ robustness at a radius of 1/255 on ImageNet.
  • The reported table includes ℓ∞ accuracy at 1/255 and standard accuracy as separate measures.
  • Replicating the self-training results requires a 500K unlabelled dataset and pseudo-labels obtained from the authors of [5].The dataset was not public when the paper was written.

G ImageNet and CIFAR-10 Detailed Results

Detailed ImageNet and CIFAR-10 results report certified accuracies across radii and hyperparameter settings, with the best σ highlighted for each radius and comparisons against Cohen et al. across all ℓ2 radii.

  • Detailed certified results: Across all ℓ2 radii, the paper reports wide-margin improvements over Cohen et al.'s models.The appendix highlights the best accuracy across all models for each radius.
  • ImageNet results: Table 6 organizes ImageNet approximate certified test accuracy by σ and ϵ settings across ℓ2-radius columns, highlighting the best σ for each radius.Random guessing would attain 0.001 accuracy.
  • Training configurations: Tables 7–9 report SMOOTHADV adversarial training with 2, 4, and 6 steps using one training sample.
  • Training configurations: Tables 10–11 report SMOOTHADV training with 8 and 10 steps using one training sample.
  • Training configurations: Tables 12–13 report SMOOTHADVDDN training with 4 and 10 steps and mtrain values from 1 to 8 samples.
  • Training configurations: Tables 14–15 report SMOOTHADVPGD training with 2 and 10 steps and mtrain values from 1 to 8 samples.
  • Dataset results: Tables 16–17 give certified top-1 accuracy across ℓ2 radii for the best ImageNet and CIFAR-10 classifiers, with standard accuracies in parentheses.ImageNet uses a 500-point subsample, whereas CIFAR-10 uses the full test set.
Loading 1906.04584v5…