SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions
Table 3: Results of the smoothed model fRS with different K on IMDB using text CNN. “Clean” represents the accuracy on the clean data without adversarial attacking and “Certified” the certified accuracy.
['[ITALIC] K', '20', '50', '100', '250', '1000']
We can see that the clean accuracy decreases when K increases, while the gap between the clean accuracy and certified accuracy, which measures the smoothness, decreases when K increases. The best certified accuracy is achieved when K=100.