On the Certified Robustness for Ensemble Models and Beyond

Abstract

Recent studies show that deep neural networks (DNN) are vulnerable to adversarial examples, which aim to mislead DNNs by adding perturbations with small magnitude. To defend against such attacks, both empirical and theoretical defense approaches have been extensively studied for a single ML model. In this work, we aim to analyze and provide the certified robustness for ensemble ML models, together with the sufficient and necessary conditions of robustness for different ensemble protocols. Although ensemble models are shown more robust than a single model empirically; surprisingly, we find that in terms of the certified robustness the standard ensemble models only achieve marginal improvement compared to a single model. Thus, to explore the conditions that guarantee to provide certifiably robust ensemble ML models, we first prove that diversified gradient and large confidence margin are sufficient and necessary conditions for certifiably robust ensemble models under the model-smoothness assumption. We then provide the bounded model-smoothness analysis based on the proposed Ensemble-before-Smoothing strategy. We also prove that an ensemble model can always achieve higher certified robustness than a single base model under mild conditions. Inspired by the theoretical findings, we propose the lightweight Diversity Regularized Training (DRT) to train certifiably robust ensemble ML models. Extensive experiments show that our DRT enhanced ensembles can consistently achieve higher certified robustness than existing single and ensemble ML models, demonstrating the state-of-the-art certified L2-robustness on MNIST, CIFAR-10, and ImageNet datasets.

arXiv commentICLR 2022. 51 pages, 10 pages for main text. Forum and code: https://openreview.net/forum?id=tUa4REjGjTf

References in corpus (23)

• Popular Ensemble Methods: An Empirical Study
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Efficient Neural Network Robustness Certification with General Activation Functions
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Spatially Transformed Adversarial Examples
• Generating Adversarial Examples with Adversarial Networks
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• Certified Adversarial Robustness with Additive Noise
• Improving Adversarial Robustness of Ensembles with Diversity Training
• Unrestricted Adversarial Examples via Semantic Manipulation
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles
• Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Framework
• MULDEF: Multi-model-based Defense Against Adversarial Examples for Neural Networks
• Enhancing Certifiable Robustness via a Deep Model Ensemble
• Improved, Deterministic Smoothing for L_1 Certified Robustness
• TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothness
• Enhancing Certified Robustness via Smoothed Weighted Ensembling
• Mixture of Robust Experts (MoRE):A Robust Denoising Method towards multiple perturbations
• Provable Robust Classification via Learned Smoothed Densities