SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Kai Hu
kaihu@andrew.cmu.edu
Andy Zou
andyzou@cmu.edu
Zifan Wang
Center for AI Safety
San Francisco, CA 94111
zifan@safe.ai
Klas Leino
Carnegie Mellon University Pittsburgh, PA 15213
kleino@cs.cmu.edu
Matt Fredrikson
mfredrik@cs.cmu.edu
Despite the promise of Lipschitz-based methods for provably-robust deep learning with deterministic guarantees, current state-of-the-art results are limited to feedforward Convolutional Networks (ConvNets) on low-dimensional data, such as CIFAR-10. This paper investigates strategies for expanding certifiably robust training to larger, deeper models. A key challenge in certifying deep networks is efficient calculation of the Lipschitz bound for residual blocks found in ResNet and ViT architectures. We show that fast ways of bounding the Lipschitz constant for conventional ResNets are loose, and show how to address this by designing a new residual block, leading to the Linear ResNet (LiResNet) architecture. We then introduce Efficient Margin Maximization (EMMA), a loss function that stabilizes robust training by penalizing worst-case adversarial examples from multiple classes simultaneously. Together, these contributions yield new state-of-the-art robust accuracy on CIFAR-10/100 and Tiny-ImageNet under  $\ell_2$  perturbations. Moreover, for the first time, we are able to scale up fast deterministic robustness guarantees to ImageNet, demonstrating that this approach to robust learning can be applied to real-world applications. Our code is publicly available on GitHub.<sup>1</sup>
Deep neural networks have been shown to be vulnerable to well-crafted tiny perturbations, also known as adversarial examples [19, 45]. Methods for achieving provably-robust inference—that is, predictions that are guaranteed to be consistent within a norm-bounded  $\epsilon$ -ball around an input—are desirable in adversarial settings, as they offer guarantees that hold up against arbitrary perturbations. Thus, The focus of this paper is to train a network that can certify its predictions within an  $\epsilon$ -ball.
Over the last few years, a wide body of literature addressing robustness certification has emerged [6, 7, 18, 24, 26, 29, 32, 33, 43, 46, 48, 52]. To date, the methods that achieve the best certified performance are derived from randomized smoothing (RS) [6]; however, this approach has two main drawbacks. First, it provides only a probabilistic guarantee, which may generate a false positive claim around  $0.1\%$  of the time [6]; by contrast, deterministic certification may be preferred in safety-critical applications, e.g., malware detection and autonomous driving. Additionally, RS requires significant
$^{1}$ Code available at https://github.com/hukkai/liresnet.
computational overhead for both evaluation and certification—this limitation is severe enough that RS methods are typically evaluated on a  $1\%$  subset of the ImageNet validation set for timing concerns.
Because of the highly non-linear boundaries learned by a neural network, deterministically certifying the robustness of its predictions usually requires specialized training procedures that regularize the network for efficient certification, as post-hoc certification is either too expensive [27, 44] or too imprecise [18], particularly as the scale of the model being certified grows.
The most promising such approaches—in terms of both certified accuracy and efficiency—perform certification using Lipschitz bounds. For this to work, the learning procedure must impose Lipschitz constraints during training, either through regularization [32] or orthogonalization [1, 42, 48]. While Lipschitz-based certification is efficient enough to perform robustness certification at scale (e.g., on ImageNet) in principle, it imposes strict regularization that makes
training large models difficult, especially as it is challenging to maintain tight Lipschitz bounds for very deep models. As a result, state-of-the-art (deterministically) certified robustness is currently still achieved using relatively small feed-forward Convolutional Networks (ConvNets). At the same time, recent work has suggested that robust learning requires additional network capacity [4, 30], leaving the plausibility of deterministic certification for realistic applications using small ConvNet architectures in question.
The goal of this work is to scale up certifiable robustness training from ConvNets to larger, deeper architectures, with the aim of achieving higher Verifiable Robust Accuracy (VRA)—the percentage of points on which the model is both correct and certifiably robust. By realizing gains from more powerful architectures, we show it is possible to obtain non-trivial certified robustness on larger datasets like ImageNet, which, to our knowledge, has not yet been achieved by deterministic methods. Our results stem chiefly from two key innovations on GloRo Nets [32], a leading certified training approach. First, we find that the residual branches used in conventional ResNet and ViT architectures might not be a good fit for Lipschitz-based certification; instead, we find the key ingredient is to use a linear residual path (Figure 2a) forming what we refer to as a LiResNet block. The motivation for this architecture development is covered in depth in Section 3.
Second, we find that the typical loss function used by GloRo Nets in the literature may be suboptimal at pushing the decision boundary far away from the input in learning settings with large numbers of classes. Specifically, the standard GloRo loss penalizes possible adversarial examples from a single class at once (corresponding to the closest adversarial example), while we find a robust model can be more efficiently obtained by regularizing against adversarial examples from all possible classes at once, particularly when there are many classes. We thus propose Efficient Margin Maximization (EMMA) loss for GloRo Nets, which simultaneously handles possible adversarial examples from any class. More details on the construction and motivation behind EMMA loss are provided in Section 4.
Using the LiResNet architecture and EMMA loss, we are able to (1) scale up deterministic robustness guarantees to ImageNet for the first time, and (2) substantially improve VRA on the benchmark datasets used in prior work. In particular, as exemplified in Figure 1, in contrast to the existing architectures that achieve no gains in VRA when going deeper, LiResNet demonstrates an effective use of the increasing capacity to learn more robust functions.
Figure 1: Plot of VRA—the % of points where the model is both correct and certifiably robust—against the depth of the model. We compare our proposed architecture with BCOP [33], SOC [43] and Cayley layers [48] on CIFAR-100, finding our architecture scales more favorably to deeper nets. See Appendix E for plot implementation details.
2We choose GloRo Nets in particular because they involve the least run-time and memory overhead compared to other leading certification methods, e.g., orthogonalization.
To summarize our contributions: (1) we introduce LiResNet, a ResNet architecture using a linear residual branch that better fits the Lipschitz-based certification approach for training very deep networks; and (2) we propose EMMA loss to improve the training dynamics of robust learning with GloRo Nets. As a result, we achieve the new state-of-the-art VRAs on CIFAR-10  $(70.1\%)$ , CIFAR-100  $(41.5\%)$ , Tiny-ImageNet  $(33.6\%)$  and ImageNet  $(35.0\%)$  for  $\ell_2$ -norm-bounded perturbations with a radius  $\epsilon = 36/255$ . More importantly, to the best of our knowledge, for the first time we are able to scale up deterministic robustness guarantee to ImageNet, demonstrating the promise, facilitated by our architecture, of obtaining certifiably robust models in real-world applications.
We are interested in certifying the predictions of a network  $F(x) = \arg \max_{j} f_{j}(x)$  that classifies an input  $x \in \mathbb{R}^{d}$  into  $m$  classes. We use the uppercase  $F(x): \mathbb{R}^{d} \to [m]$  to denote the predicted class and the lowercase  $f(x): \mathbb{R}^{d} \to \mathbb{R}^{m}$  for the logits. A certifier checks for whether  $\epsilon$ -local robustness (Definition 1) holds for an input  $x$ .
Definition 1 ( $\epsilon$ -Local Robustness). A network  $F(x)$  is  $\epsilon$ -locally robust at an input  $x$  w.r.t norm,  $||\cdot||$ , if  $\forall x' \in \mathbb{R}^d$ .  $||x' - x|| \leq \epsilon \Rightarrow F(x') = F(x)$ .
Existing certifiers are either probabilistic (i.e., guaranteeing robustness with bounded uncertainty) or deterministic (i.e., returning a certificate when a point is guaranteed to be robust). We focus on the latter in this paper and consider the  $\ell_2$  norm if not otherwise noted.
Lipschitz-based Certification. Certifying the robustness of a prediction can be achieved by checking if the margin between the logit of the predicted class and the others is large enough that no other class will surpass the predicted class on any neighboring point in the  $\epsilon$ -ball. To this end, many prior works rely on calculating the Lipschitz Constant  $K$  (Definition 2) of the model to bound the requisite margin.
Definition 2 (K-Lipschitz Function). A function  $h: \mathbb{R}^d \to \mathbb{R}^m$  is  $K$ -Lipschitz w.r.t  $S \subseteq \mathbb{R}^d$  and norm,  $||\cdot||$ , if  $\forall x, x' \in S$ .  $||h(x) - h(x')|| \leq K||x - x'||$ .
Here,  $K$  is the maximum change of a function's output for changing the input in  $S$ . Notice that it is sufficient to use a local Lipschitz Constant  $K_{\mathrm{local}}$  of the model, i.e.,  $S = \{x^{\prime} : ||x^{\prime} - x|| \leq \epsilon\}$  in Definition 2, to certify robustness [55]. However, a local bound is often computationally expensive and may need a bounded activation in training [24]. Alternatively, one can compute a global Lipschitz Constant  $K_{\mathrm{global}}$ , i.e.  $S = \mathbb{R}^{d}$  in Definition 2, and leverage the relation  $K_{\mathrm{global}} \geq K_{\mathrm{local}}$  to certify any input at any radius  $\epsilon$ . A global bound is more efficient at test time for certification because it only needs to be computed once and can be used for any input at any  $\epsilon$ . However, an arbitrary global bound can be vacuously large and thus not useful for positive certification.
GloRo Nets. Among leading approaches that tighten the global Lipschitz constant during training for the purpose of certification [32, 42, 43, 48], GloRo, proposed by Leino et al. [32], is unique in that it naturally incorporates Lipschitz regularization into its loss rather than imposing direct constraints on the Lipschitz constant of each layer. As a result, it is more resource-efficient, and thus has the best potential to scale up to large-scale networks with high-dimensional inputs. GloRo computes the global Lipschitz constant,  $K_{ji}$  of the logit margin between the predicted class,  $j$ , and every other class,  $i$ , by taking the product of the Lipschitz constant of each constituent layer. Next, suppose the Lipschitz constant of the model  $F$  until the penultimate layer is  $K_{i-1}$ , and use  $w_i$  as the  $i^{\text{th}}$  column of the top layer's weight matrix; then GloRo computes a logit score  $f_{\perp}$  of an artificial class, which we will refer to as  $\perp$ .
$$
f _ {\perp} (x) = \max  _ {i \neq j} \left\{f _ {i} (x) + \epsilon K _ {j i} \right\} \text {w h e r e} K _ {j i} = \left\| w _ {j} - w _ {i} \right\| \cdot K _ {: - 1}. \tag {1}
$$
Then, the so-called GloRo Net outputs  $F(x) = j$  when  $f_{j}(x) \geq f_{\perp}(x)$ , or  $F(x) = \perp$  otherwise. Thus, by design, whenever the GloRo Net does not output  $\perp$ , its prediction is guaranteed to be robust.
Furthermore, when the network is trained for certification with the global bound, the global bound has the same certification potential as the local bound [32].
(b)
Figure 2: (a) An illustration of the LiResNet Architecture. (b) Plot of the percentage of instances at each epoch during training for which the threatening class (the one with the second-highest logit value) differs compared to the previous epoch (on the same instance). Numbers are reported on three datasets with 10, 100, and 200 classes using a GloRo LiResNet with GloRo TRADES [32] loss.
Robustness Needs More Capacity. Despite the fact that robust and correct predictions, i.e.,  $\mathrm{VRA} = 100\%$ , is achievable for many standard datasets [55], the state-of-the-art VRAs (which are achieved using Lipschitz-based certification) are far away from realizing this goal. Recent works have emphasized the role of network capacity in learning robust classifiers, suggesting a lack of capacity may be a factor in this shortcoming, beyond the more obvious fact that Lipschitz-based certification is conservative and may falsely flag robust points. Bubeck and Sellke [4] showed that a smooth (and thus robust) decision boundary requires  $d$  times more parameters than learning a non-smooth one, where  $d$  is the ambient data dimension. In addition, to tightly certify a robust boundary with Lipschitz-based approaches, Leino [30] demonstrated the need for extra capacity to learn smooth level curves around the decision boundary, which are shown to be necessary for tight certification.
Robust Residual Blocks. Prior work [22] has introduced residual connections, which have proven effective for scaling network depth. Residual connections have since become one of the building blocks for Transformer networks [51]. High-capacity ResNets and Vision Transformers (ViT) [14] outperform basic ConvNets in terms of clean accuracy (i.e., ignoring robustness) on major research datasets, but similar success has not been observed for VRAs. For example, several papers find ResNets have lower VRAs on CIFAR-10 compared to ConvNets [42, 48] while no paper has reported VRAs on common vision datasets with ViTs. These empirical findings are seemingly at odds with the capacity arguments raised in the literature, however this may be due to unfavorable training dynamics of current approaches. This work aims to investigate the reasons behind this discrepancy to capture the potential of residual connections. Our primary focus is the residual connection (to skip convolutions) in ResNets; however, the implications of this work include paving the way for future work on certifying other types of residual connections, e.g. skipping attention in Transformers.
3 Linear-Residual Networks
The GloRo approach can easily be adapted from a ConvNet architecture to a ResNet architecture by simply adjusting how the Lipschitz constant is computed where the residual and skip paths meet. Consider a conventional residual block  $r(x)$  given by  $r(x) = x + g(x)$ , where the residual branch,  $g$ , is a small feed forward network, typically with 2-3 convolutional/linear layers paired with nonlinear activations. The Lipschitz constant,  $K_r$ , of  $r(x)$ , with respect to the Lipschitz constant,  $K_g$ , of  $g(x)$  is upper-bounded by  $K_r \leq 1 + K_g$ .
Thus, a typical estimation of the residual block's Lipschitz constant is  $1 + K_g$ . However, this is a loose estimation. To see this, let  $u = \arg \max_x \| r(x) \| / \| x \|$ , and observe that the bound is only tight if  $u$  and  $r(u)$  point in the same direction in the representation space. This is presumably unlikely to happen, as random vectors are almost orthogonal in high-dimensional space with high probability. Thus, using  $1 + K_g$  as the Lipschitz constant of  $r(x)$  is unlikely to be tight even if  $K_g$  is tight.
The LiResNet Architecture. As discussed, the standard residual block is fundamentally challenging to obtain a tight Lipschitz bound on. Thus, we propose to use a Linear Residual Block:
$$
r _ {\text {l i n e a r}} (x) = x + \operatorname {C o n v} (x)
$$
Since  $r_{\mathrm{linear}}(x)$  is still a linear transformation of  $x$ , we can easily compute the equivalent convolution which has the same output as  $r_{\mathrm{linear}}(x)$ . For example, consider a convolution layer with  $W \in \mathbb{R}^{(2k_0 + 1) \times (2k_0 + 1) \times n \times n}$  where  $(2k_0 + 1)$  is the kernel size and  $n$  is the number of channels and zero padding  $k_0$ . The weights of the equivalent convolution are then  $W + \Delta$  where  $\Delta[k_0, k_0, i, i] = 1$  for all  $i \in \{1, \dots, n\}$  and all other entries are set to zero. Thus, the Lipschitz constant of  $r_{\mathrm{linear}}$  can be efficiently estimated using the power method [16]. Nonlinearity of the network is then obtained by adding nonlinear activations (e.g., MinMax [1]) to the outputs of each residual block. By stacking multiple linear residual blocks (with interjecting activations), and including a stem, neck, and head, we obtain the Linear ResNet (LiResNet) architecture, illustrated in Figure 2a.
A Note on the Power of LiResNet. It is worth noting that, despite the apparent simplicity of linear residual blocks, the LiResNet architecture is surprisingly powerful. First, although  $r_{\mathrm{linear}}$  can be parameterized as a single convolution, linear residual blocks are meaningfully different from convolutional layers. Specifically, linear residual blocks contain residual connections which facilitate better gradient propagation through the network. As an analogy, convolutional layers can be parameterized as dense layers that share certain weights (and zero others out), but convolutions provide meaningful regulation not captured in a standard dense layer. Similarly, linear residual blocks provide meaningful regularization that improves training dynamics, especially in deep models.
Second, while the linearity of linear residual blocks may seem to limit the expressiveness of the LiResNet architecture, this intuition is perhaps misleading. A useful analogy is to think of a ResNet with a fixed number of total layers, where we vary the number of layers per block. On one extreme end, all the layers are in a single block, resulting in a simple CNN architecture. A typical ResNet has a block size of 2 or 3; and, while adding more blocks imposes regularization that could reduce the model's expressiveness, this is not generally considered a disadvantage for ResNets, since the residual connections admit much deeper models, which ultimately makes up for any capacity that would be lost. LiResNets can be seen as the other extreme end, where each block has a single layer. While this entails further regularizaiton the same principle holds pertaining to the depth of the model.
A Note on Transformer-based Architectures. Because Transformer-based models also consist of many residual blocks, e.g., skip connections in the multi-head self-attention modules, we have experimented if the proposed linear residual block helps to certify Transformer-based models. Our primary finding is, while the linear residual block tightens the Lipschitz constant of the skip connection, the attention module is another (bigger) bottleneck for certifying Transformers. Namely, self-attention is not a Lipschitz function [28], which is incompatible with Lipschitz-based certification approaches. Recent works [9, 28] provide a few Lipschitz-continuous alternatives for attention modules, none of which are found to have competitive certifiable robustness compared to LiResNets in our experiments. Thus, the evaluation part of this paper (Section 5) will mainly focus on comparing LiResNets with prior work, while our experiments with Transformer-based models will be included in Appendix I for reference in future work.
4 Efficient Margin Maximization
Using the LiResNet architecture, we are able to train far deeper models. However, we observe that the GloRo cross-entropy loss (and the GloRo TRADES loss variant) used by Leino et al. [32], which we will refer to as standard GloRo loss, becomes inefficient as the number of classes in the dataset increases. Standard GloRo loss minimizes the logit score of the  $\perp$  class (i.e.  $f_{\perp}$  in Eq. 1), which only affects one margin—namely, the one between the predicted class and the threatening class (the one with the second-highest logit value)—at each iteration. To see this, we show in Figure 3
Figure 3: Comparison between the standard GloRo loss and our proposed GloRo EMMA loss (Definition 3). The standard GloRo loss constructs a  $\perp$  class to push the nearest decision boundary away while EMMA adds the perturbations to all rest classes (i.e. considering class 1 is the ground truth) to efficiently push all boundaries away. Another difference is that EMMA uses the adaptive  $\tilde{\epsilon}_i$  instead of  $\epsilon$  in the training. At iteration  $t + 1$ , the network using EMMA loss is already robust while standard GloRo loss may take more iterations to become robust.
that the standard GloRo loss largely focuses on the decision boundary between classes 1 and 3 at iteration  $t$ , even though class 2 is also competitive but slightly less so than class 3. Furthermore, the possibility arises that the threatening class will alternate between competing classes leading to a sort of "whack-a-mole" game during training.
Indeed, we find this phenomenon to be increasingly common as the number of classes grows. Figure 2b shows the fraction of instances at each epoch for which the threatening class differs from in the preceding epoch. In the initial 100 epochs, more than  $30\%$  instances from Tiny-ImageNet (containing 200 classes) have different threatening classes at each each iteration, while the same number for CIFAR-10 is only about  $10\%$ . At best, this contributes to making training with many classes less efficient, and at worst, it halts progress as work in one epoch is undone by the next.
To address this problem, we propose a new loss function known as the Efficient Margin Maximization (EMMA) loss (Definition 3) and we consequently refer to this method as GloRo (EMMA). Conceptually, the EMMA loss function adds the maximum possible margin to each non-ground-truth class. This margin is defined as the maximum gain a given logit can achieve over the ground truth logit within the current largest  $\ell_p$ -ball.
Formally, suppose  $f_{i}$  denotes the logit of class  $i$  and  $K_{yi}$  is the margin Lipschitz between class  $i$  and label  $y$  as defined in Equation 1. We can express the radius of the current largest certifiable  $\ell_p$ -ball for a class  $i$  relative to the ground-truth class  $y$  as  $\kappa_{i}$ . This value is determined by their logit margin over the Lipchitz constant of this margin, as shown in Equation 2.
$$
\forall i, \kappa_ {i} (x) = \frac {f _ {y} (x) - f _ {i} (x)}{K _ {y i}} \text {i f} i \neq y \text {a n d} 0 \text {o t h e r w i s e .} \tag {2}
$$
Taking into account that the expected robust radius is  $\epsilon$ , we formulate EMMA loss as follows.
Definition 3 (Efficient Margin MAximization (EMMA) loss). Suppose the radius of the current  $\ell_p$ -ball the model  $F$  can certify robustness respects to ground truth class  $y$  over class  $i$  is  $\kappa_i(x)$  as in Equation 2. We define EMMA loss for data  $(x,y)$  as follows,
$$
\ell_ {\mathrm {E M M A}} = - \log \frac {\exp (f _ {y} (x))}{\sum_ {i} \exp [ f _ {i} (x) + \tilde {\epsilon} _ {i} K _ {y i} ]} \text {a n d} \tilde {\epsilon} _ {i} = \operatorname {c l i p \_ v a l u e \_ n o \_ g r a d} (\kappa_ {i} (x), 0, \epsilon).
$$
When using EMMA loss, the actual radius at which we require the model to certify robustness at each iteration is  $\tilde{c}_i$  for the margin between class  $i$  and  $y$ . It's important to note that if the model still