Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers

By Hadi Salman, Greg Yang, Jungshian Li, Pengchuan Zhang, Huan Zhang, Ilya P. Razenshteyn, Sébastien Bubeck. 2019

640 citations recorded by the source corpus.

Recent works have shown the effectiveness of randomized smoothing as a scalable technique for building neural network-based classifiers that are provably robust to $\ell_2$-norm adversarial perturbations. In this paper, we employ adversarial training to improve the performance of randomized smoothing. We design an adapted attack for smoothed classifiers, and we show how this attack can be used in an adversarial training setting to boost the provable robustness of smoothed classifiers. We demonstrate through extensive experimentation that our method consistently outperforms all existing provably $\ell_2$-robust classifiers by a significant margin on ImageNet and CIFAR-10, establishing the state-of-the-art for provable $\ell_2$-defenses. Moreover, we find that pre-training and semi-supervised learning boost adversarially trained smoothed classifiers even further. Our code and trained models are available at this http URL .

Subfields: Artificial Intelligence, Molecular Biology, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

In Safety, Robustness & Interpretability

Citations in the corpus

Measuring Robustness to Natural Distribution Shifts in Image Classification (2020, methodology): “[72] Salman, H.”
Your Classifier is Secretly an Energy Based Model and You Should Treat it Like One (2019, methodology): “With respect to theL2 norm, JEM performs competitively with adversarial training (Santurkar et al., 2019) and above the state-of-the-art certified robutness method of Salman et al. (2019) (“RandAdvSmooth” in Figure 5).”
Fast is better than free: Revisiting adversarial training (2020, background): “In fact, both starting with the previous minibatch’s perturbation or initializing from a uniformly random perturbation alAs reported by Shafahi et al. (2019) using a different network architecture and an adversary with 20 steps and 10 restarts, which is strictly weaker than the adversary used in thi”
Robust fine-tuning of zero-shot models (2021, methodology): “…trained using various existing robustness interventions , e.g. special data augmentation (DeVries & Taylor, 2017; Engstrom et al., 2019; Geirhos et al., 2018a; Hendrycks et al., 2020) or adversarially robust models (Madry et al., 2017; Cohen et al., 2019; Salman et al., 2019; Shafahi et al., 2019).”
Certifying LLM Safety against Adversarial Prompting (2023, positive): “…propagation (Gowal et al., 2018; Huang et al., 2019; Dvijotham et al., 2018; Mirman et al., 2018), curvature bounds (Wong & Kolter, 2018; Raghunathan et al., 2018; Singla & Feizi, 2020; 2021) and randomized smoothing (Cohen et al., 2019; L´ecuyer et al., 2019; Li et al., 2019; Salman et al., 2019).”
Boosting Adversarial Training with Hypersphere Embedding (2020, background): “Among the existing defenses, adversarial training (AT) is a general strategy achieving the state-of-the-art robustness under different settings [60, 70, 79, 82, 83, 85, 93].”
Backward Feature Correction: How Deep Learning Performs Deep Learning (2020, methodology): “The specific adversarial attacker that we used in the training is `2 PGD perturbation plus Gaussian noise suggested by [66].”
SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks (2023, background): “The underlying idea behind SmoothLLM—which is motivated in part by the randomized smoothing literature in the adversarial robustness community [19, 20]—is to first duplicate and perturb copies of a given input prompt, and then to aggregate the outputs generated for each perturbed copy (see Figure…”
Constrained Learning With Non-Convex Losses (2021, methodology): “To this end, numerous approaches have been proposed based on robust optimization [16] and statistical smoothing [66], [67].”
A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks (2019, methodology): “, 2018] and DeepPoly [Singh et al., 2019b] used this strategy to achieve tighter verification results than Fast-Lin [Wang et al., 2018b], DeepZ [Singh et al., 2018] and Neurify [Wang et al., 2018b]. Note that although the bound propagation techniques used in these works can be viewed as using differ”
Improving Adversarial Robustness Requires Revisiting Misclassified Examples (2020, methodology): “Then in the second stage, RST applies TRADES loss to train the robust model based on both labeled and unlabeled data, i.e. , given a training data ( x , y ) , the supervised and unsupervised loss functions adopted in RST is deﬁned as As we pointed out in Figure 1(b) and the following experiment sect”
Test-Time Training with Self-Supervision for Generalization under Distribution Shifts (2019, background): “Another line of work is based on randomized smoothing (Cohen et al., 2019; Salman et al., 2019), while some other approaches, such as input transformations (Guo et al., 2017; Song et al., 2017), are shown to be less effective (Athalye et al., 2018).”
Globally-Robust Neural Networks (2021, methodology): “In addition, we include work that provides a stochastic guarantee: Randomized Smoothing (RS) (Cohen et al., 2019a), SmoothADV (Salman et al., 2019), and MACER (Zhai et al., 2020).”
Certifiably Robust Interpretation in Deep Learning (2019, background): “2We note that Salman et al. (2019) has recently and independently published a different proof of this lemma.”
Lipschitz-Certifiable Training with a Tight Outer Bound (2020, positive): “This can make any classiﬁer to acquire a certiﬁed adversarial robustness by constructing a smoothed classiﬁer [22, 21, 6, 31].”
Overfitting in adversarially robust deep learning (2020, methodology): “…Dvijotham et al.; Wong et al., 2018; Salman et al., 2019b; Zhang et al., 2019b), randomized smoothing (Cohen et al., 2019; Lecuyer et al., 2019; Salman et al., 2019a), distributional robustness (Sinha et al., 2017), abstract interpretations (Gehr et al., 2018; Mirman et al., 2018; Singh et…”