Mixing classifiers to alleviate the accuracy-robustness trade-off

Yatong Bai, Brendon G. Anderson, Somayeh Sojoudi
Proceedings of the 6th Annual Learning for Dynamics & Control Conference, PMLR 242:852-865, 2024.

Abstract

Deep neural classifiers have recently found tremendous success in data-driven control systems. However, existing neural models often suffer from a trade-off between accuracy and adversarial robustness, which is a limitation that must be overcome in the control of safety-critical systems that require both high performance and rigorous robustness guarantees. In this work, we develop classifiers that simultaneously inherit high robustness from robust models and high accuracy from standard models. Specifically, we propose a theoretically motivated formulation that mixes the output probabilities of a standard neural network and a robust neural network. Both of these base classifiers are pre-trained, and thus our method does not require additional training. Our numerical experiments verify that the mixed classifier noticeably improves the accuracy-robustness trade-off and identify the confidence property of the robust base classifier as the key leverage of this more benign trade-off. Our theoretical results prove that under mild assumptions, when the robustness of the robust base model is certifiable, no alteration or attack within a closed-form $l_p$ radius on an input can result in misclassification of the mixed classifier.

Cite this Paper

BibTeX
@InProceedings{pmlr-v242-bai24a, title = {Mixing classifiers to alleviate the accuracy-robustness trade-off}, author = {Bai, Yatong and Anderson, Brendon G. and Sojoudi, Somayeh}, booktitle = {Proceedings of the 6th Annual Learning for Dynamics & Control Conference}, pages = {852--865}, year = {2024}, editor = {Abate, Alessandro and Cannon, Mark and Margellos, Kostas and Papachristodoulou, Antonis}, volume = {242}, series = {Proceedings of Machine Learning Research}, month = {15--17 Jul}, publisher = {PMLR}, pdf = {https://proceedings.mlr.press/v242/bai24a/bai24a.pdf}, url = {https://proceedings.mlr.press/v242/bai24a.html}, abstract = {Deep neural classifiers have recently found tremendous success in data-driven control systems. However, existing neural models often suffer from a trade-off between accuracy and adversarial robustness, which is a limitation that must be overcome in the control of safety-critical systems that require both high performance and rigorous robustness guarantees. In this work, we develop classifiers that simultaneously inherit high robustness from robust models and high accuracy from standard models. Specifically, we propose a theoretically motivated formulation that mixes the output probabilities of a standard neural network and a robust neural network. Both of these base classifiers are pre-trained, and thus our method does not require additional training. Our numerical experiments verify that the mixed classifier noticeably improves the accuracy-robustness trade-off and identify the confidence property of the robust base classifier as the key leverage of this more benign trade-off. Our theoretical results prove that under mild assumptions, when the robustness of the robust base model is certifiable, no alteration or attack within a closed-form $l_p$ radius on an input can result in misclassification of the mixed classifier.} }
Endnote
%0 Conference Paper %T Mixing classifiers to alleviate the accuracy-robustness trade-off %A Yatong Bai %A Brendon G. Anderson %A Somayeh Sojoudi %B Proceedings of the 6th Annual Learning for Dynamics & Control Conference %C Proceedings of Machine Learning Research %D 2024 %E Alessandro Abate %E Mark Cannon %E Kostas Margellos %E Antonis Papachristodoulou %F pmlr-v242-bai24a %I PMLR %P 852--865 %U https://proceedings.mlr.press/v242/bai24a.html %V 242 %X Deep neural classifiers have recently found tremendous success in data-driven control systems. However, existing neural models often suffer from a trade-off between accuracy and adversarial robustness, which is a limitation that must be overcome in the control of safety-critical systems that require both high performance and rigorous robustness guarantees. In this work, we develop classifiers that simultaneously inherit high robustness from robust models and high accuracy from standard models. Specifically, we propose a theoretically motivated formulation that mixes the output probabilities of a standard neural network and a robust neural network. Both of these base classifiers are pre-trained, and thus our method does not require additional training. Our numerical experiments verify that the mixed classifier noticeably improves the accuracy-robustness trade-off and identify the confidence property of the robust base classifier as the key leverage of this more benign trade-off. Our theoretical results prove that under mild assumptions, when the robustness of the robust base model is certifiable, no alteration or attack within a closed-form $l_p$ radius on an input can result in misclassification of the mixed classifier.
APA
Bai, Y., Anderson, B.G. & Sojoudi, S.. (2024). Mixing classifiers to alleviate the accuracy-robustness trade-off. Proceedings of the 6th Annual Learning for Dynamics & Control Conference, in Proceedings of Machine Learning Research 242:852-865 Available from https://proceedings.mlr.press/v242/bai24a.html.

Related Material