论文标题
正规化培训和对随机平滑分类器具有可证明鲁棒性的经过严格认证
Regularized Training and Tight Certification for Randomized Smoothed Classifier with Provable Robustness
论文作者
论文摘要
最近，通过各向同性高斯扰动平滑基于神经网络的分类器是一种有效且可扩展的方法，可提供针对$ \ ell_2 $ norm限制的对抗扰动的最先进的概率鲁棒性保证。但是，如何训练良好的基本分类器，该分类器在平滑时尚未得到充分研究。在这项工作中，我们提出了一种新的正规风险，在这种风险中，正常化器可以在训练基本分类器时适应地鼓励平滑对应物的准确性和鲁棒性。它在计算上是有效的，可以与其他经验防御方法并行实施。我们讨论如何根据标准（非对抗性）和对抗训练计划实施它。同时，我们还设计了一种新的认证算法，该算法可以利用正则化效果来提供更紧密的稳健性下限，并具有很高的可能性。我们的广泛实验证明了CIFAR-10和Imagenet数据集的培训和认证方法的有效性。
Recently smoothing deep neural network based classifiers via isotropic Gaussian perturbation is shown to be an effective and scalable way to provide state-of-the-art probabilistic robustness guarantee against $\ell_2$ norm bounded adversarial perturbations. However, how to train a good base classifier that is accurate and robust when smoothed has not been fully investigated. In this work, we derive a new regularized risk, in which the regularizer can adaptively encourage the accuracy and robustness of the smoothed counterpart when training the base classifier. It is computationally efficient and can be implemented in parallel with other empirical defense methods. We discuss how to implement it under both standard (non-adversarial) and adversarial training scheme. At the same time, we also design a new certification algorithm, which can leverage the regularization effect to provide tighter robustness lower bound that holds with high probability. Our extensive experimentation demonstrates the effectiveness of the proposed training and certification approaches on CIFAR-10 and ImageNet datasets.
