A recent technique of randomized smoothing has shown that the worst-case (adversarial) $\ell_2$-robustness can be transformed into the average-case Gaussian-robustness by "smoothing" a classifier, i.e., by considering the averaged prediction over Gaussian noise. In this paradigm, one should rethink the notion of adversarial robustness in terms of generalization ability of a classifier under noisy observations. We found that the trade-off between accuracy and certified robustness of smoothed classifiers can be greatly controlled by simply regularizing the prediction consistency over noise. This relationship allows us to design a robust training objective without approximating a non-existing smoothed classifier, e.g., via soft smoothing. Our experiments under various deep neural network architectures and datasets show that the "certified" $\ell_2$-robustness can be dramatically improved with the proposed regularization, even achieving better or comparable results to the state-of-the-art approaches with significantly less training costs and hyperparameters.
翻译:最近的随机平滑技术显示,最差的情况(对抗性)$@ell_2$-robustness($2$-robustness)可以通过“悬浮”一个分类器,即考虑对高斯噪音的平均预测,转换成平均情况(obsosian-robustness),也就是说,通过考虑对高斯噪音的平均预测。在这个范式中,人们应该重新思考在噪音观察下分类器一般化能力方面的对抗性强性概念。我们发现,光滑的分类器的准确性和经认证的稳健性之间的权衡可以通过仅仅对噪音的预测一致性进行规范化来大大控制。 这种关系使我们能够设计一个强有力的培训目标,而不必通过软滑动等方法来接近一个不存在的平滑的分类器。 我们在各种深层神经网络架构和数据集下进行的实验表明,“经认证的” $@ell_2$-robustn 能够随着拟议的规范化而大大改进,甚至能够以培训成本和超分度计的状态方法取得更好或可比的结果。