MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius

Abstract

Adversarial training is one of the most popular ways to learn robust models but is usually attack-dependent and time costly. In this paper, we propose the MACER algorithm, which learns robust models without using adversarial training but performs better than all existing provable l2-defenses. Recent work shows that randomized smoothing can be used to provide a certified l2 radius to smoothed classifiers, and our algorithm trains provably robust smoothed classifiers via MAximizing the CErtified Radius (MACER). The attack-free characteristic makes MACER faster to train and easier to optimize. In our experiments, we show that our method can be applied to modern deep neural networks on a wide range of datasets, including Cifar-10, ImageNet, MNIST, and SVHN. For all tasks, MACER spends less training time than state-of-the-art adversarial training algorithms, and the learned models achieve larger average certified radius.

arXiv commentPublished in ICLR 2020. 20 Pages

References in corpus (13)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Efficient Neural Network Robustness Certification with General Activation Functions
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Learning with a Strong Adversary
• Empirical Bernstein Bounds and Sample Variance Penalization
• Adversarial Robustness through Local Linearization
• Are Labels Required for Improving Adversarial Robustness?
• Adversarially Robust Generalization Just Requires More Unlabeled Data

Cited by in corpus (29)

• On Certifying Robustness against Backdoor Attacks via Randomized Smoothing
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• Randomized Smoothing of All Shapes and Sizes
• Globally-Robust Neural Networks
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• Consistency Regularization for Certified Robustness of Smoothed Classifiers
• Random Smoothing Might be Unable to Certify ${\ell }_{\infty }$ Robustness for High-Dimensional Images
• Membership Leakage in Label-Only Exposures
• Improved, Deterministic Smoothing for L_1 Certified Robustness
• On the Certified Robustness for Ensemble Models and Beyond
• TSS: Transformation-Specific Smoothing for Robustness Certification
• Boosting the Certified Robustness of L-infinity Distance Nets
• Certified Adversarial Defenses Meet Out-of-Distribution Corruptions: Benchmarking Robustness and Simple Baselines
• Data-Dependent Randomized Smoothing
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations
• Tailoring: encoding inductive biases by optimizing unsupervised objectives at prediction time
• Enhancing Certified Robustness via Smoothed Weighted Ensembling
• Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbation
• Multi-head Ensemble of Smoothed Classifiers for Certified Robustness
• ANCER: Anisotropic Certification via Sample-wise Volume Maximization
• Certified Defense via Latent Space Randomized Smoothing with Orthogonal Encoders
• Insta-RS: Instance-wise Randomized Smoothing for Improved Robustness and Accuracy
• Adversarial Feature Desensitization
• Robusta: Robust AutoML for Feature Selection via Reinforcement Learning
• Dynamic Efficient Adversarial Training Guided by Gradient Magnitude
• Deterministic Certification to Adversarial Attacks via Bernstein Polynomial Approximation
• Intriguing Properties of Input-dependent Randomized Smoothing
• Simpler Certified Radius Maximization by Propagating Covariances
• Learning to Separate Clusters of Adversarial Representations for Robust Adversarial Detection