Multi-scale Diffusion Denoised Smoothing

Summary

This paper proposed a new technique for certified adversarial robustness based on randomized smoothing. Two certification schemes are proposed in the paper: first is cascaded randomized smoothing where multiple smoothed classifiers of different smoothing factors are aggregated together in an efficient way; the second part is a new fine-tuning method called diffusion calibration to address the overconfidence issue in the original randomized smoothing approach. Experimental results show that the proposed method improved upon the previous baseline approach of Diffusion Denoised Smoothing.

Strengths

1. Clarity: This paper is well-written. The method is clearly described and introduced. The results are presented in a concise and clear fashion. 2. Originality: The method is novel in two aspects. First, the proposed scheme of cascading smoothed classifiers of multiple smoothing factors is novel and promising as an approach for combining multiple smoothed classifiers. Second, two losses are proposed for calibrating the diffusion model in Diffusion Denoised Smoothing. 3. Significance: Randomized smoothing and its variant, for example, diffusion denoised smoothing are known to have practical limitations as they require huge certification samples to compute the certification bound. The proposed method for more efficient certification could pave the way for practical applications of randomized smoothing and diffusion denoised smoothing.

Weaknesses

1. While the proposed method delivers improvement of certification accuracies upon the standard diffusion denoised smoothing, the paper does not discuss the computational requirements. It would be good to discuss the computational overhead from running a cascading smoothed classifier and fine-tuning the diffusion denoiser, in the main paper. 2. It seems from the description of cascaded randomized smoothing in section 3.2, the prediction of the cascaded smoothed classifier is defined, different from what the original randomized smoothing proposed. Then i think there should be a subsection or paragraph defining the certification bounds from the cascaded smoothed classifier. Theorem 1 does not seem to point to which one is the new certification bound. I would suggest the authors to add a pseudocode in the main text or appendix describing how the prediction and certification is done for the proposed method, in a similar way to what the original randomized smoothing paper [1] did. 3. Section 3.1 discussed some of the limitations of randomized smoothing. It is not clear whether this is a contribution of this work or has been observed before. From the way it is described, these limitations seems like well-recognized in the research community. If that’s the case, it would be better to put this part in the background section to avoid confusion about the novelty. 4. Regarding the specific limitations of randomized smoothing discussed in Section 3.1, is there evidence that supports these arguments? It would be good to show empirical evidence of overconfidence or point to a previous work that has looked into this matter. 5. The Brier loss and Anti-consistency loss are proposed to address the overconfidence issue in randomized smoothing. The experiments could benefit from adding an evaluation confirming that the overconfidence issue is tackled via the proposed fine-tuning process, thus further supporting the validity and effectiveness of the approach. 6. The main contributions of the work are two parts: cascaded randomized smoothing and diffusion calibration. However, the title “multi-scale diffusion denoised smoothing” seems to only focus on the first part of the contribution. I would recommend a more proper title to reveal the true contributions of this work, which are not limited to cascaded randomized smoothing. [1] Certified adversarial robustness via randomized smoothing. Cohen et al, 2019. ================================================================== I have read the rebuttal and i will remain my score.

Questions

See Weaknesses.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.

Soundness

3 good

Presentation

3 good

Contribution

2 fair

Limitations

Yes

Summary

This paper presents a practical method to address the issues of over-smoothing and over-confidence in randomized smoothing, thereby enhancing our understanding of the trade-off between accuracy and robustness. For over-smoothing, the author introduces a multi-stage approach for computing collective certified robustness without the need to specify noise scales. This novel process provides a more precise evaluation of the certified radius. Additionally, to address over-confidence, this study incorporates two proposed loss functions, namely Brier loss and Anti-consistency loss, to fine-tune the denoiser model. By integrating these two methods into Diffusion Denoised Smoothing, significant improvements in both clean and certified accuracy can be achieved.

Strengths

1. Cascaded randomized smoothing is a specifically designed method for more accurate certified radius evaluation for Diffusion Denoised Smoothing because with diffusion models, we do not need to train smoothed classifiers for each noise scale. 2. Evaluate both empirical accuracy and certified accuracy for the robustness of the proposed method.

Weaknesses

1. I don't think the cascaded randomized smoothing can overcome the trade-off between accuracy and certified robustness. Cascaded randomized smoothing is only a tricky strategy to make a better computation of the certified radius. It cannot improve certified robustness intrinsically. 2. For calibrating diffusion models, I don't see an advantage compared with classifier fine-tuning in Carlini et al. And Table 2 in Carlini et al. shows a better performance than yours with classifier finetuning. Besides, normally speaking, fine-tuning classifiers is much simpler than fine-tuning diffusion models.

Questions

1. Results shown in your table are different from those shown in the original paper of Carlini et al. For example, in Table 1, the highest clean acc is 78.8 while the original paper shows 88.1. Is that because you use a different classifier? If yes, why you do not choose to use the classifier used in Carlini et al.? They can even reach the better results. 2. In Table 3, if the clean acc of Carlini et al. is higher than your results with Anti-consist, how can you demonstrate that your proposed loss can improve clean accuracy? I think it can only improve the overall clean accuracy with your cascaded strategy.

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

No limitations about potential negative societal impact.

Summary

This paper identifies the accuracy-robustness trade-off in randomized smoothing and the over-smoothing and over-confidence issues in diffusion denoised smoothing. It then proposes a to finetune diffusion models to mitigate these issues by first passing a datapoint through a cascaded smoothing pipeline to obtain class label and then minimizing Brier loss and Anti-consistency losses. This allows the framework to achieve higher empirical accuracy and robustness.

Strengths

- The paper is clearly written and well motivated. - The cascaded pipeline is novel and the explanations of the problems at hand are clear. - Empirical evidence for improvement is strong. - Ablation study and analysis is performed to investigate the effect of each proposed loss.

Weaknesses

There are several places in the exposition that may require more clarification. - Why do we not update classifier? Line 218 - 220 state that finetinung classifier is more computationally intensive than finetuning denoiser. Isn't backpropogating through an entire trajectory of denoising process more prohibitively expensive than finetuning classifier, especially when the starting noise-level is high? - Can the classifier itself cause any of the two over-smoothing or over-confidence issues? In this case, do we wan to finetune classifiers? In so, how do we decide which model to finetune, or both? - There lack some empirical investigation on the runtime issue with denoising, as is more apparent for such a long sequence of denoising iterations. The cascaded smoothing starts at a high noise-level, so denoising should take longer time. What's the trade-off between the accuracy/robustness increase with runtime?

Questions

My concerns and questions are written above.

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

1: Your assessment is an educated guess. The submission is not in your area or the submission was difficult to understand. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

No limitations of the model are discussed. Inference time increase can be one to further discuss and analyze. Broader societal impacts are adequately addressed as improving adversarial robustness leads to safer AI systems.

Summary

This paper builds on diffusion based denoised randomized smoothing. It analyzes two scenarios of model errors which are over-smoothing and over-confidence. To alleviate these issues, the authors proposed deploying cascaded randomized smoothing where samples are first smoothed with large variance that gradually decreases if the model abstains from prediction. Further, the diffusion model (denoiser) is calibrated to overcome the over-confidence problem.

Strengths

This work has the following strengths: 1- The problem this work is tackling is important. Building reliable and robust models are necessary for deploying such models. 2- The paper reads smoothly in most parts. Section 3.1 introduces two problems in randomized smoothing and Sections 3.2 and 3.3 propose the two components of the proposed approach. 3- The experiments conducted in this work covered the standard datasets and 3 related baselines.

Weaknesses

Despite the strengths of this work, there are few weaknesses that I would like to be resolved before getting this paper accepted: 1- The experimental results are missing important strong baselines such as [1, 36] (from the main paper) and [12] from the appendix. Since the method of this work results in a different smoothing parameters for (potentially) different inputs, a comparison with data-dependent smoothing approaches is necessary. 2- The proposed approach seems to provide very limited performance gains in the small certified accuracy regimes. For instance, comparing the certified accuracy in Table 1 at $\sigma \in [0.25, 1.0]$ and $\epsilon =0.5$: The proposed method attains 40.5% while [8] attains a 59.8 using $\sigma = 0.25$. Shouldn't a fair comparison be comparing the proposed method to the envelop curve of each baseline across the three $\sigma$ values? 3- One ablation experiment that can potentially showcases the diversity of the obtained $\sigma$ via cascaded smoothing is to plot a histogram of $\sigma_x$ for when $\sigma \in [0.25, 1.0]$. 4- Another experimental analysis is to show the number of samples that were suffering from over-smoothing or over-confidence before employing the cascaded approach and after. 5- In terms of writing, I have the following minor comments/suggestions: - The preliminary part about diffusion models in lines 116-128 is not used afterwards, especially the notation. Consider moving it to the appendix. - $n$ was defined twice in the "Evaluation metrics" paragraph (line 285 and line 290) with two different values. Please consider modifying the second one. - It is confusing to have more than one bold number per column in each table. Consider highlighting only one (perhaps the combined cascading + calibration).

Questions

Please refer to the weaknesses part.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

The authors have addressed the limitations in Appendix A.

Summary

This work aims to improve robustness-accuracy tradeoff in image classifiers, using the recent smoothing ideas. The authors propose two techniques for improving adversarial robustness without loss of accuracy. One is to fine-tune the prepended denoiser with a regularized loss, to reduce miss-classification of smoothed images. Second is to use a cascade of denoisers trained on different levels of noise to pick the highest level robustness radius. They test their method on CIFAR10 and ImageNet datasets.

Strengths

1) Focusing on important topic of robustness of classifiers. 2) Interesting method in cascading models from high noise to low noise. 3) Good empirical results compared to recent state of the art models

Weaknesses

The writing can be improved a lot both in terms of coherence and clarity. I found the paper lacking in a good flow and hard to read, because of redundant repetition, lack of a coarse to fine description of the goal and the result, redundant undefined notation. The authors The same amount of content can be written such that the reader can take the message with much less effort. Whenever a new notation is introduced, please describe what it is defining. The reader should not have to infer what symbol is refering to what. They should be mentioned explicitly in the text. Examples: $\mathbb{P}, \epsilon, x', \underline{R}, \underline{p} ,\overline{p}, R^-$ ... This makes the paper more time consuming to read which is very unnecessary. As an example Theorem 3.1 is unreadable due to undefined notation. I find the use of "diffusion" in the title somewhat misleading. I suggest diffusion be replaced with denoising since that is what has been used in the work as opposed to a diffusion process in the context of generative models. In line 109 it is mentioned that the ideal denoiser should return the original image for any noisy image. This statement is incorrect and hold only for very small levels of noise. The error in denoising is inherent in ideal denoisers as well and hence the iteration. In order to reduce misclassification, the authors suggest fine-tuning the denoiser instead of the classifier to make the training less cumbersome. Although this resulted in better accuracy, it is not clear if it makes sense in theory. The cause of unrobustness is the random or incorrect boundaries set by the classifier. The denoiser is optimal with respect to denoising loss, whereas the classifier is not optimal with respect to classifying smoothed images (it has never been trained to do so). So in theory, the network that should be fine-tuned is the classifier not the denoiser.

Questions

1) The idea of cascading denoise and classify models from large to small noise levels is a clever way to find the largest radius of robustness. The final sigma at which the model does not abstain and returns a classification output is taken as the certifies radius. This value however depends on two factors: one is the threshold $p_0$: for higher threshold the radius will be smaller and for lower threshold the radius will be larger. It is not clear in the text how this dependency is addressed. The second factor is the image content and the image class: for example in CIFAR10 for a class with generally distinctive background and content the certified radius will be larger (more smoothed images will be classified with high confidence). On the other hand, if the average background is similar between a few classes then the radius will be smaller. How do you address this variability? 2) For a fixed $p_0$ and a fixed image, do different noise samples (different runs of the method) result in different certified radius and or different predictions? If that is the case, how is this variability addressed? 3) Have you experimented with stability of prediction after the optimal radius is achieved? In other words, one way to quantify the error (or incorrect over confidence in the cascade) is to keep running the cascade for all the smaller noise levels and measure how volatile the prediction is. Assuming that for $\sigma=0$ the predication is correct (consistent with your oracle assumption on $f_{std}$), you can measure the $\sigma$ level for which the incorrect prediction flips to the correct one. Will you see a significant difference for different classes for this critical $sigma$?

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

2 fair

Presentation

1 poor

Contribution

2 fair

Limitations

I found the paper lacking solid theoretical ground. The methods, although clever, are ad hoc and do not address the robustness against adversarial attacks fundamentally. Regardless, due to impressive empirical results my score is borderline accept. I will increase the score if the authors address the comments and questions.