Overview

• Proposed a method to significantly improve the trade-off between clean accuracy and adversarial robustness in neural classifiers
• Mixing output probabilities of a standard (high clean accuracy) and robust classifier, leveraging the robust classifier's confidence difference for correct and incorrect examples
• Theoretically certified the robustness of the mixed classifier under realistic assumptions
• Adapted an adversarial input detector to create a mixing network that adjusts the mixture adaptively, further reducing the accuracy penalty
• Empirically evaluated on CIFAR-100, achieving high clean accuracy while maintaining strong robustness against strong attacks like AutoAttack

Plain English Explanation

Neural networks, the powerful AI models behind many of today's intelligent systems, can be easily fooled by carefully crafted "adversarial" inputs that look normal to humans but cause the model to make mistakes. Researchers have proposed various methods to make these models more robust against such attacks, but in the process, the models often suffer significant drops in their regular, "clean" accuracy - the accuracy on normal, non-adversarial inputs.

This paper presents a clever approach to significantly alleviate this accuracy-robustness trade-off. The key idea is to combine the output of two neural networks: one optimized for clean accuracy (but not robust) and one optimized for robustness (but with lower clean accuracy). By carefully mixing the outputs of these two models, the researchers were able to achieve high clean accuracy while maintaining strong robustness.

The method works because the robust model is particularly confident in its correct predictions but much less confident in its incorrect predictions. By leveraging this property, the researchers can selectively trust the robust model's outputs when it is highly confident, while relying more on the standard model's outputs in other cases.

The researchers also adapt an adversarial input detector to create a "mixing network" that can dynamically adjust the mixture of the two models based on the input, further reducing the accuracy penalty.

Technical Explanation

The paper proposes a method called "Adaptive Smoothing" to address the accuracy-robustness trade-off in neural classifiers. The key idea is to mix the output probabilities of a standard classifier (optimized for clean accuracy) and a robust classifier (optimized for adversarial robustness).

The researchers first show that the robust classifier's confidence difference for correct and incorrect examples is the key to this improvement. Specifically, the robust classifier is highly confident in its correct predictions but much less confident in its incorrect predictions. By leveraging this property, the method can selectively trust the robust model's outputs when it is highly confident, while relying more on the standard model's outputs in other cases.

The paper then theoretically certifies the robustness of the mixed classifier under realistic assumptions. Furthermore, the researchers adapt an adversarial input detector to create a "mixing network" that can dynamically adjust the mixture of the two models based on the input, further reducing the accuracy penalty.

The empirical evaluation on the CIFAR-100 dataset shows that the proposed method can achieve an 85.21% clean accuracy while maintaining a 38.72% $ell_infty$-AutoAttacked ($epsilon = 8/255$) accuracy, becoming the second most robust method on the RobustBench CIFAR-100 benchmark as of submission, while improving the clean accuracy by ten percentage points compared with all listed models.

Critical Analysis

The paper addresses an important and practical challenge in the field of adversarial robustness - the trade-off between clean accuracy and robustness. The proposed Adaptive Smoothing method is a clever and effective approach that leverages the strengths of both a standard and a robust classifier.

One potential limitation is that the method relies on the availability of a robust classifier, which may not always be easy to obtain. The researchers acknowledge this and suggest that their approach can work in conjunction with existing or even future methods that improve clean accuracy, robustness, or adversary detection.

Additionally, the theoretical certification of robustness is based on certain assumptions, and it would be valuable to explore the sensitivity of the method to violations of these assumptions. Further research could also investigate the performance of Adaptive Smoothing on a wider range of datasets and attack scenarios.

Conclusion

This paper presents a significant advancement in addressing the accuracy-robustness trade-off in neural classifiers. By mixing the outputs of a standard and a robust classifier, leveraging the robust classifier's confidence difference, and adaptively adjusting the mixture, the researchers were able to achieve high clean accuracy while maintaining strong robustness against powerful adversarial attacks.

The Adaptive Smoothing method has the potential to be widely adopted, as it can be used in conjunction with existing and future techniques for improving clean accuracy and robustness. This represents an important step forward in making neural networks more reliable and trustworthy in real-world applications.