Enhancing Certified Robustness via Smoothed Weighted Ensembling

2020/05/19 by Chizhou Liu, Liu, Chizhou, Yunzhen Feng +5 · 1 citation
Computer Science · Mathematics · #Advanced Neural Network Applications #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #cs.CR #cs.LG #stat.ML

paper · pdf · doi:10.48550/arxiv.2005.09363

openalex publication_date 2020/05/19 · arxiv created 2021/02/23 · arxiv updated 2021/02/24 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Randomized smoothing has achieved state-of-the-art certified robustness against l₂-norm adversarial attacks. However, it is not wholly resolved on how to find the optimal base classifier for randomized smoothing. In this work, we employ a Smoothed WEighted ENsembling (SWEEN) scheme to improve the performance of randomized smoothed classifiers. We show the ensembling generality that SWEEN can help achieve optimal certified robustness. Furthermore, theoretical analysis proves that the optimal SWEEN model can be obtained from training under mild assumptions. We also develop an adaptive prediction algorithm to reduce the prediction and certification cost of SWEEN models. Extensive experiments show that SWEEN models outperform the upper envelope of their corresponding candidate models by a large margin. Moreover, SWEEN models constructed using a few small models can achieve comparable performance to a single large model with a notable reduction in training time.

Citations

• Backpropagation Applied to Handwritten Zip Code Recognition
• An approach to reachability analysis for feed-forward ReLU neural networks
• Efficient Formal Safety Analysis of Neural Networks
• Semidefinite relaxations for certifying robustness to adversarial examples
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Certified Adversarial Robustness via Randomized Smoothing
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• On Evaluating Adversarial Robustness
• Adaptive Ensemble Prediction for Deep Neural Networks based on Confidence Level
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• Random Smoothing Might be Unable to Certify ℓ_∞ Robustness for High-Dimensional Images
• On Adaptive Attacks to Adversarial Example Defenses
• Randomized Smoothing of All Shapes and Sizes
• Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Framework

Cited by

• Improving Adversarial Robustness via Unlabeled Out-of-Domain Data

Related

• Promoting Robustness of Randomized Smoothing: Two Cost-Effective Approaches
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Accelerated Smoothing: A Scalable Approach to Randomized Smoothing
• Confidence-aware Training of Smoothed Classifiers for Certified Robustness
• Certified Adversarial Robustness via Randomized Smoothing