Question: Why is integer programming and such an esoteric formulation useful?What is the benefits of this formulation compared to the standard gradient based approach?
Evidence: Adversarial attacks aim to find adversarial examples, which are close to benign inputs in certain distance metrics yet trigger wrong behavior of neural networks. Adversarial attacks are important tools to gauge the empirical robustness of deep neural networks. Finding an adversarial example can be generally formulated as a constrained optimization problem:
where C is often an ∞ or 2 norm ball around the original input x 0 , and f (x) is an attack success criterion involving a neural network (such as the margin between the groundtruth class and another class): f (x) < 0 indicates a successful attack. A straightforward way of solving Eq. () is via firstorder constrained optimization methods, such as projected gradient descent (PGD) and its variants. Additionally, some gradient-free attacks were proposed, mostly based on certain heuristic search on the input space x.
Limitations of existing attacks. As f (x) usually consists of a highly non-convex neural network, solving Eq. () to its global minimum is challenging. This leads to failures in adversarial attacks: an adversarial example may exist but no attacks can find it, giving a false sense of security. Especially, gradient based attacks can be easily trapped into a local minimum or misguided by masked gradients. Even if we give the attacker an infinite amount of time (e.g., run a very large number of PGD steps, or allowing a large number of samples on input space), it is still hard to guarantee to find the adversarial example, since it is extremely difficult to systematically search the high dimensional and continuous input space. Models concluded robust under existing attacks might still have security vulnerability in practice, leading to an urgent request for stronger attacks that can possibly approach ground-truth robustness.
The mixed-integer approach. This paper seeks stronger adversarial attacks from a different angle: instead of searching for adversarial examples in the input space, we look for adversarial examples in the activation space. The main intuition is that neural networks with piece-wise linear activation functions (e.g., ReLU) can be seen as a piece-wise linear function and each piece is uniquely defined by a specific setting of activation function status. For ReLU networks, each neuron can either be active (its input is positive) or inactive (its input is negative so the output is 0), which can be encoded by discrete 0-1 variables. This leads to a mixed integer programming (MIP) formulation, and  conducted attacks using a MIP solver.
Benefits of the MIP formulation. The MIP formulation with the 0-1 encoding of ReLU neurons allows us to systematically search all the linear pieces in the input space, theoretically guarantee to enumerate the entire input space and obtain the global minimum of Eq. () given sufficient time.
Practically, MIP-based attacks can often find adversarial examples that are missed by existing attacks and identify true weaknesses of a model. It also helps to close the gap between the upper and lower bounds of robust accuracy (i.e., attack accuracy vs. verified accuracy). Existing works aimed to reducing this gap by tightening the lower bound with stronger verifiers, while our work aims to tighten the upper bound by a systematic search of adversarial examples. Closing this gap is difficult even on small models.
Generic MIP solvers are inefficient for adversarial attacks. Despite its strengths, a MIP-based attack are often a few orders of magnitudes slower than existing attacks due to the high cost of running an off-the-shelf solver such as Gurobi . There are three root causes for its inefficiency. First, an off-the-shelf solver is not aware of the underlying optimization problem corresponds to a neural network, and has to apply generic solving techniques (e.g., using Simplex algorithm with relaxations) which can be expensive or ineffective. Second, it cannot utilize solutions obtained cheaply from gradient based attacks to accelerate its search. Third, generic MIP solvers are mostly restricted to CPUs and can hardly utilize GPU acceleration, which is crucial for efficiency.
Contributions of this paper. We address the above weaknesses in MIP solvers for adversarial attacks, by developing a GPU-accelerated branch and bound procedure to systematically search adversarial examples in the activation space, which is more efficient than generic MIP solvers. We focus on solving hard instances, where none of existing adversarial attacks based on searching the input space are successful but no verifier can prove their robustness. Our contributions includes:
• We apply the GPU-accelerated bound propagation based methods, which were originally developed for neural network verification, to the adversarial attack setting. These specialized methods can quickly examine thousands of regions in activation space in parallel and rule out the regions with no adversarial examples, which is difficult in off-the-shelf MIP solvers with a generic solving procedure.
• We employ a top-down beam-search to explore the activation space. • Our new attack framework, BaB-Attack, is designed to tackle hard instances where existing strong adversarial attacks (such as AutoAttack) cannot succeed. Despite being more expensive than attacks on the input space, BaB-Attack is about an order of magnitude faster than using an MIP solver on hard instances, and can find adversarial examples that cannot be discovered by any existing attacks.
Benefits of the MIP formulation. The MIP formulation with the 0-1 encoding of ReLU neurons allows us to systematically search all the linear pieces in the input space, theoretically guarantee to enumerate the entire input space and obtain the global minimum of Eq. (1) given sufficient time. Practically, MIP-based attacks can often find adversarial examples that are missed by existing attacks and identify true weaknesses of a model. It also helps to close the gap between the upper and lower bounds of robust accuracy (i.e., attack accuracy vs. verified accuracy). Existing works aimed to reducing this gap by tightening the lower bound with stronger verifiers (Raghunathan et al., 2018b; Wang et al., 2021), while our work aims to tighten the upper bound by a systematic search of adversarial examples. Closing this gap is difficult even on small models (Dathathri et al., 2020).
Generic MIP solvers are inefficient for adversarial attacks. Despite its strengths, a MIP-based attack are often a few orders of magnitudes slower than existing attacks due to the high cost of running an off-the-shelf solver such as Gurobi (Tjeng et al., 2019). There are three root causes for its inefficiency. First, an off-the-shelf solver is not adware of the underlying optimization problem corresponds to a neural network, and has to apply generic solving techniques (e.g., using Simplex algorithm with relaxations) which can be expensive or ineffective. Second, it cannot utilize solutions obtained cheaplyfrom gradient based attacks to accelerate its search. Third, generic MIP solvers are mostly restricted to CPUs and can hardly utilize GPU acceleration, which is crucial for efficiency.
Answer: Existing attacks search in the input space (e.g., using gradient descent). Due to non-convexity, it is hard to systematically or exhaustively search a continuous and high dimensional input space, so even given an attack a very long time (e.g., run PGD attack for 10,000 iterations or 10,000 random start points), it can still miss some adversarial examples.
We formulate the attack in the activation space, by encoding the ReLU neurons as 0-1 variables in a mixed integer programming (MIP) formulation. The problem is discrete so we can systematically search it via branch and bound and find more adversarial examples. MIP based attacks are often stronger than other attacks. Given an infinite amount of time, it can guarantee to find an adversarial example if one exists thanks to the systematic search procedure.