1Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
summary
Claims that adversarially train the smooth classifier (optimize the smoothed model’s loss, not data-augmented base loss) substantially improves certifiable L2 robustness. Method uses PGD-style attacks on the smooth objective with about 8 noise samples per PGD step during training and 1k–10k samples at evaluation. Results: up to ~14% gain on CIFAR-10, ~6–7% on ImageNet; with pretraining/semi‑supervision reaches ~65% certifiable at ε=0.5 and ~39% at ε=1 (L2), and ~68% for L∞≈2/255 via L2 embedding. Costs: high compute, gradient estimators noisy, optimization limited.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:55Definition
- 9:22Randomization
- 10:13Zico
- 13:31Idea
- 14:56Experimental Results
- 17:26SemiSupervised Results
- 19:28Training
- 20:43Notation
- 31:27Gradients
- 33:47Optimal Gradient
- 34:17Full Algorithm
- 37:21Parameters
- 37:56Results
- 43:39Summary
related talks
01h 24mAdversarial Examples
59mStudying Failure Modes of Deep Learning and Ways To Fix Them
42mExploring Pillars of Trustworthy AI: Robustness and Fairness
34mDistributional Robustness, Learning, and Empirical Likelihood
36mAdversarial Machine Learning: How Secure Is ML?
01h 01mRobustness, Stochastics, Uncertainty 2
28mPrivacy versus Robustness in Federated Learning: Limits and Algorithms
09mLearning Under Requirements