On the trade-off between robustness and accuracy in smoothed classifiers

Abstract

Notwithstanding the recent successes of deep learning towards artificial intelligence (AI), real-world deployment of AI systems has been impeded by their fragility in worst-case (or essentially adversarial) behaviors. Randomized smoothing is currently one of a few tangible approaches that provides adversarial robustness in such scenarios, with a benefit of being applicable to models at scale, e.g., those of large pre-trained models: specifically, any classifier can be "smoothed out" to make it provably robust against adversarial inputs, by taking a majority vote of its predictions over random Gaussian noise. This dissertation aims to make randomized smoothing more practical, with a particular focus on mitigating the current trade-off between certified robustness and accuracy in randomized smoothing. We observe that "calibrating" the confidence of smoothed classifiers can be a peculiar proxy to this end, and develop various methods based on this to obtain robust smoothed classifiers with less degradation in accuracy. The proposed solutions cover not only efficient training methods for smoothed classifiers, but also inference and fine-tuning schemes for large-scale randomized smoothing on pre-trained models.