论文标题
通过平滑的加权结合来增强认证的鲁棒性
Enhancing Certified Robustness via Smoothed Weighted Ensembling
论文作者
论文摘要
随机平滑已经实现了针对$ L_2 $ -NORM对抗攻击的最先进的认证鲁棒性。但是，在如何找到最佳基础分类器以进行随机平滑的情况下，它并未完全解决。在这项工作中，我们采用平滑的加权结合（Sween）方案来提高随机平滑分类器的性能。我们显示了Sween可以帮助实现最佳认证鲁棒性的一般性。此外，理论分析证明，在轻度假设下的培训中可以获得最佳的Sween模型。我们还开发了一种自适应预测算法，以降低Sween模型的预测和认证成本。广泛的实验表明，Sween模型的表现优于其相应候选模型的上限。此外，使用一些小型型号构建的Sween模型可以实现与单个大型模型相当的性能，其训练时间明显减少。
Randomized smoothing has achieved state-of-the-art certified robustness against $l_2$-norm adversarial attacks. However, it is not wholly resolved on how to find the optimal base classifier for randomized smoothing. In this work, we employ a Smoothed WEighted ENsembling (SWEEN) scheme to improve the performance of randomized smoothed classifiers. We show the ensembling generality that SWEEN can help achieve optimal certified robustness. Furthermore, theoretical analysis proves that the optimal SWEEN model can be obtained from training under mild assumptions. We also develop an adaptive prediction algorithm to reduce the prediction and certification cost of SWEEN models. Extensive experiments show that SWEEN models outperform the upper envelope of their corresponding candidate models by a large margin. Moreover, SWEEN models constructed using a few small models can achieve comparable performance to a single large model with a notable reduction in training time.
