Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothing

Understand

While prior research has proposed a plethora of methods that build neural classifiers robust against adversarial robustness, practitioners are still reluctant to adopt them due to their unacceptably severe clean accuracy penalties.

• This paper significantly alleviates this accuracy-robustness trade-off by mixing the output probabilities of a standard classifier and a robust classifier, where the standard network is optimized for clean accuracy and is not robust in general.
• We show that the robust base classifier's confidence difference for correct and incorrect examples is the key to this improvement.
• In addition to providing intuitions and empirical evidence, we theoretically certify the robustness of the mixed classifier under realistic assumptions.