Adversarial Boot Camp: label free certified robustness in one epoch

2020/10/05 by Ryan Campbell, Campbell, Ryan, Chris Finlay +3
Computer Science · #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #Domain Adaptation and Few-Shot Learning #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #Machine Learning and Algorithms

paper · pdf · doi:10.48550/arxiv.2010.02508

openalex publication_date 2020/10/05 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Machine learning models are vulnerable to adversarial attacks. One approach to addressing this vulnerability is certification, which focuses on models that are guaranteed to be robust for a given perturbation size. A drawback of recent certified models is that they are stochastic: they require multiple computationally expensive model evaluations with random noise added to a given input. In our work, we present a deterministic certification approach which results in a certifiably robust model. This approach is based on an equivalence between training with a particular regularized loss, and the expected values of Gaussian averages. We achieve certified models on ImageNet-1k by retraining a model with this loss for one epoch without the use of label information.

Citations

• Gradient-based learning applied to document recognition
• Certified Adversarial Robustness via Randomized Smoothing
• Theoretically Principled Trade-off between Robustness and Accuracy
• Randomized Smoothing of All Shapes and Sizes
• Learning Multiple Layers of Features from Tiny Images

Related

• Towards Bridging the gap between Empirical and Certified Robustness against Adversarial Examples
• PROSAC: Provably Safe Certification for Machine Learning Models under Adversarial Attacks
• Certified Training: Small Boxes are All You Need
• Are Labels Required for Improving Adversarial Robustness?
• FullCert: Deterministic End-to-End Certification for Training and Inference of Neural Networks