Timezone: »

 
SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Adversarial Robustness
Jongheon Jeong · Sejun Park · Minkyu Kim · Heung-Chang Lee · Doguk Kim · Jinwoo Shin

@
in A Blessing in Disguise: The Prospects and Perils of Adversarial Machine Learning »
Randomized smoothing is currently a state-of-the-art method to construct a certifiably robust classifier from neural networks against $\ell_2$-adversarial perturbations. Under the paradigm, the robustness of a classifier is aligned with the prediction confidence, i.e., the higher confidence from a smoothed classifier implies the better robustness. This motivates us to rethink the fundamental trade-off between accuracy and robustness in terms of calibrating confidences of smoothed classifier. In this paper, we propose a simple training scheme, coined SmoothMix, to control the robustness of smoothed classifiers via self-mixup: it trains convex combinations of samples along the direction of adversarial perturbation for each input. The proposed procedure effectively identifies over-confident, near off-class samples as a cause of limited robustness in case of smoothed classifiers, and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness. Our experiments show that the proposed method can significantly improve the certified $\ell_2$-robustness of smoothed classifiers compared to state-of-the-art robust training methods.

Author Information

Jongheon Jeong (KAIST)
Sejun Park (KAIST)
Minkyu Kim (Korea Advanced Institute of Science and Technology)
Heung-Chang Lee (kakaoenterprise)
Doguk Kim (Kakao Enterprise)
Jinwoo Shin (KAIST)

More from the Same Authors