Adversarial Boot Camp: label free certified robustness in one epoch

Ryan Campbell, Chris Finlay, Adam M Oberman

Keywords: machine, learning, adversarial, robustness, neural, networks, image, classification, computer, vision

Abstract: Machine learning models are vulnerable to adversarial attacks. One approach to addressing this vulnerability is certification, which focuses on models that are guaranteed to be robust for a given perturbation size. A drawback of recent certified models is that they are stochastic: they require multiple computationally expensive model evaluations with random noise added to a given image. In our work, we present a deterministic certification approach which results in a certifiably robust model. This approach is based on an equivalence between training with a particular regularized loss, and the expected values of Gaussian averages. We achieve certified models on ImageNet-1k by retraining a model with this loss for one epoch without the use of label information.

One-sentence Summary: Deriving a regularized loss function that leads to certifiably robust computer vision models.

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics

Community Implementations: [ 1 code implementation](https://www.catalyzex.com/paper/arxiv:2010.02508/code)

Reviewed Version (pdf): https://openreview.net/references/pdf?id=L9gANh_o80