Insta-RS: Instance-wise Randomized Smoothing for Improved Robustness and Accuracy
arXiv:2103.04436
Abstract
Randomized smoothing (RS) is an effective and scalable technique for constructing neural network classifiers that are certifiably robust to adversarial perturbations. Most RS works focus on training a good base model that boosts the certified robustness of the smoothed model. However, existing RS techniques treat every data point the same, i.e., the variance of the Gaussian noise used to form the smoothed model is preset and universal for all training and test data. This preset and universal Gaussian noise variance is suboptimal since different data points have different margins and the local properties of the base model vary across the input examples. In this paper, we examine the impact of customized handling of examples and propose Instance-wise Randomized Smoothing (Insta-RS) -- a multiple-start search algorithm that assigns customized Gaussian variances to test examples. We also design Insta-RS Train -- a novel two-stage training algorithm that adaptively adjusts and customizes the noise level of each training example for training a base model that boosts the certified robustness of the instance-wise Gaussian smoothed model. Through extensive experiments on CIFAR-10 and ImageNet, we show that our method significantly enhances the average certified radius (ACR) as well as the clean data accuracy compared to existing state-of-the-art provably robust classifiers.
arXiv commentWe plan to make major modifications to this paper including rewriting the entire text, rewriting the proofs and adding experiments. Given that the paper will be completely different, we decided to take this paper down temporarily
References in corpus (16)
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Certified Defenses against Adversarial Examples
- Efficient Neural Network Robustness Certification with General Activation Functions
- Evaluating Robustness of Neural Networks with Mixed Integer Programming
- Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
- An approach to reachability analysis for feed-forward ReLU neural networks
- Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks
- Towards Fast Computation of Certified Robustness for ReLU Networks
- A Unified View of Piecewise Linear Neural Network Verification
- Provably Minimally-Distorted Adversarial Examples
- Output Range Analysis for Deep Neural Networks
- Sorting out Lipschitz function approximation
- Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets
- MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
- Data-Dependent Randomized Smoothing
- Deterministic Gaussian Averaged Neural Networks