Fine-tuning for Randomised Smoothing
Abra Ganz

Abstract:
Deep neural network classifiers have become powerful tools permeating various domains of human life such as cancer detection and self-driving cars. Yet neural classifiers are vulnerable to deception via adversarial examples. To address this problem, randomised smoothing provides a viable method to certify a model’s robustness to attacks without requiring any changes to the internal architecture. In order for robust, randomised-smoothing-based models to enter common usage, it is necessary for to be able to be train them without the use of excessive compute. One method which can achieve this is fine-tuning. This thesis is, to the best of the authors’ knowledge, the first investigation into whether the robustness properties of RS-models are conserved through, or can be introduced via, fine-tuning. In this study, we demonstrate the feasibility of fine-tuning models for robustness on new datasets, surpassing the performance of models solely trained for robustness on that dataset. We investigate three methods to customize fine-tuning for the robustness context and find that adjusting the noise-level applied to images throughout training results in a near-uniform improvement in certified accuracy. Additionally, we find that using data augmentation in pre-training consistently enhances the performance of randomised smoothing models. Overall, this thesis establishes the feasibility of using fine-tuning alongside randomised smoothing to create robust models with minimal computational resources. Moreover, it highlights the potential of this method to enhance model robustness over non-finetuned methods, paving the way for practical implementation of robust models in real-world applications.