Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers

TL;DR

This paper enhances the robustness of neural network classifiers against adversarial attacks by integrating adversarial training with randomized smoothing, achieving state-of-the-art provable defenses on ImageNet and CIFAR-10.

Contribution

It introduces an adversarial training method tailored for smoothed classifiers, significantly improving provable robustness against $\,ell_2$-norm adversarial perturbations.

Findings

Outperforms existing provably $\,ell_2$-robust classifiers on ImageNet and CIFAR-10.

Pre-training and semi-supervised learning further enhance robustness.

Establishes new state-of-the-art in provable $\,ell_2$-defenses.

Abstract

Recent works have shown the effectiveness of randomized smoothing as a scalable technique for building neural network-based classifiers that are provably robust to $\ell_2$-norm adversarial perturbations. In this paper, we employ adversarial training to improve the performance of randomized smoothing. We design an adapted attack for smoothed classifiers, and we show how this attack can be used in an adversarial training setting to boost the provable robustness of smoothed classifiers. We demonstrate through extensive experimentation that our method consistently outperforms all existing provably $\ell_2$-robust classifiers by a significant margin on ImageNet and CIFAR-10, establishing the state-of-the-art for provable $\ell_2$-defenses. Moreover, we find that pre-training and semi-supervised learning boost adversarially trained smoothed classifiers even further. Our code and trained models are available at http://github.com/Hadisalman/smoothing-adversarial .