Training Provably Robust Models by Polyhedral Envelope Regularization

1 INTRODUCTION . Despite their great success in many applications , modern deep learning models are vulnerable to adversarial attacks : small but well-designed perturbations can make the state-of-the-art models predict wrong labels with very high confidence ( Goodfellow et al. , 2014 ; Moosavi-Dezfooli et al. , 2017 ; Szegedy et al. , 2013 ) . The existence of such adversarial examples indicates unsatisfactory properties of the deep learning models ’ decision boundary ( He et al. , 2018 ) , and poses a threat to the reliability of modern machine learning systems . As a consequence , studying the robustness of deep learning has attracted growing attention , from the perspective of both attack and defense strategies . Popular attack algorithms , such as the fast gradient method ( FGM ) ( Goodfellow et al. , 2014 ) , the CW attack ( Carlini & Wagner , 2017 ) and the projected gradient descent ( PGD ) algorithm ( Madry et al. , 2017 ) , typically exploit the gradient of the loss w.r.t . the input to generate adversarial examples . To counteract such attacks , many defense algorithms have been proposed ( Buckman et al. , 2018 ; Dhillon et al. , 2018 ; Guo et al. , 2017 ; Ma et al. , 2018 ; Samangouei et al. , 2018 ; Song et al. , 2017 ; Xie et al. , 2017 ) . However , it was shown in Athalye et al . ( 2018 ) that most of them depend on obfuscated gradients for perceived robustness . In other words , these methods train models to fool gradient-based attacks but do not achieve true robustness . As a consequence , they become ineffective when subjected to stronger attacks . The only exception is adversarial training ( Madry et al. , 2017 ) , which augments the training data with adversarial examples . Nevertheless , while adversarial training yields good empirical performance , it still provides no guarantees of a model ’ s robustness . In this work , we focus on constructing certifiers to find certified regions of the input neighborhood where the model is guaranteed to give the correct prediction , and on using such certifiers to train a model to be provably robust against adversarial attacks . In this context , complete certifiers can either guarantee the absence of an adversary or construct an adversarial example given an adversarial budget . They are typically built on either Satisfiability Modulo Theories ( SMT ) ( Katz et al. , 2017 ) or mixed integer programming ( MIP ) ( Tjeng et al. , 2017 ; Xiao et al. , 2018 ) . The major disadvantages of complete certifiers are their super-polynomial complexity and applicability to only piecewise linear activation functions , such as ReLU . By contrast , incomplete certifiers are faster , more widely applicable but more conservative in terms of certified regions because they rely on approximations . Techniques such as linear approximation ( Kolter & Wong , 2017 ; Wong et al. , 2018 ; Zhang et al. , 2018 ; Weng et al. , 2018 ) , symbolic interval analysis ( Wang et al. , 2018b ) , abstract transformers ( Gehr et al. , 2018 ; Singh et al. , 2018 ; 2019 ) , semidefinite programming ( SDP ) ( Raghunathan et al. , 2018a ; b ) and randomized smoothing ( Cohen et al. , 2019 ; Salman et al. , 2019a ) are exploited to offer better certified robustness . Some of these methods enable training provably robust models ( Raghunathan et al. , 2018a ; Kolter & Wong , 2017 ; Wong et al. , 2018 ; Cohen et al. , 2019 ; Salman et al. , 2019a ) by optimizing the parameters so as to maximize the area of the certified regions . While effective , all the above-mentioned methods , in their vanilla version , only provide binary results given a fixed adversarial budget . That is , if a data point is certified , it is guaranteed to be robust in the entire given adversarial budget ; otherwise no guaranteed adversary-free region is estimated . To overcome this and search for the optimal adversarial budget that can be certified , Kolter & Wong ( 2017 ) ; Weng et al . ( 2018 ) ; Zhang et al . ( 2018 ) use either Newton ’ s method or binary search . By contrast , Croce et al . ( 2018 ) take advantage of the geometric property of ReLU networks and gives finer-grained robustness guarantees . Given the piecewise linear ReLU function , any input is located in a polytope where the ReLU network can be considered linear . Based on geometry , robustness guarantees can thus be calculated using the input distance to the polytope boundary and the decision boundary constraints . Unfortunately , in practice , the resulting certified bounds are trivial because such polytopes are very small even for robust models . Nevertheless , Croce et al . ( 2018 ) introduce a regularization scheme based on these bounds to effectively train provably robust models . In this paper , we construct a stronger certifier , as well as a regularization scheme to train provably robust models . To this end , building upon the geometry-inspired idea of Croce et al . ( 2018 ) , we estimate a linear bound of the model ’ s output given a predefined adversarial budget . Then , the condition to guarantee robustness inside this budget is also linear and forms a polyhedral envelope of the model ’ s decision boundary . Similar to Croce et al . ( 2018 ) , the region contained in the polyhedral envelope and the adversarial budget is certified to be adversary-free . We then further exploit this certifier to design a regularization framework to train provably robust neural network models . In short , our contributions are twofold . First , we design a geometric-inspired certification method giving finer-grained one-shot bounds than its counterparts ( Kolter & Wong , 2017 ; Weng et al. , 2018 ; Zhang et al. , 2018 ) with little overhead and applies to general activation functions . More importantly , we propose a regularization scheme to train provably robust models . Compared with existing provable training methods , which have been found to over-regularize the model ( Zhang et al. , 2019 ) , our training framework yields competitive robustness guarantees while maintaining good performance on clean inputs . In the remainder of the paper , we call our certification method Polyhedral Envelope Certifier ( PEC ) and regularization scheme Polyhedral Envelope Regularizer ( PER ) . 2 PRELIMINARIES . 2.1 NOTATION AND TERMINOLOGY . For simplicity , we discuss our approach using a standard N -layer fully-connected network . Note , however , that it straightforwardly extends to any network topology that can be represented by a directed acyclic graph ( DAG ) in the same way as in ( Liu et al. , 2019 ) . A fully-connected network parameterized by { W ( i ) , b ( i ) } N−1i=1 can be expressed as z ( i+1 ) = W ( i ) ẑ ( i ) + b ( i ) i = 1 , 2 , ... , N − 1 ẑ ( i ) = σ ( z ( i ) ) i = 2 , 3 , ... , N − 1 ( 1 ) where z ( i ) and ẑ ( i ) are the pre- & post-activations of the i-th layer , respectively , and ẑ ( 1 ) def== x is the input of the network . An lp norm-based adversarial budget S ( p ) ( x ) is defined as the set { x′|‖x′ − x‖p ≤ } . x′ , z′ ( i ) and ẑ′ ( i ) represent the adversarial input and the corresponding pre- & post-activations . For layer i having ni neurons , we have W ( i ) ∈ Rni+1×ni and b ( i ) ∈ Rni+1 . Throughout this paper , underlines and bars are used to present lower and upper bounds of adversarial activations , respectively , i.e. , z ( i ) ≤ z′ ( i ) ≤ z̄ ( i ) . A “ + ” or “ − ” subscript indicates the positive or negative part of a tensor . We use [ K ] as the abbreviation for the set { 1 , 2 , ... , K } . 2.2 MODEL LINEARIZATION . Given an adversarial budget S ( p ) ( x ) , we study the linear bound of the output logits z′ ( N ) , given by U ( N ) x′ + p ( N ) ≤ z′ ( N ) ≤ V ( N ) x′ + q ( N ) ( 2 ) The linear coefficients introduced above can be calculated by iteratively estimating the bounds of intermediate layers and linearizing the activation functions . In Appendix A.1 , we discuss this for several activation functions , including ReLU , sigmoid , tanh and arctan . Note that our method differs from Zhang et al . ( 2018 ) because we need the analytical form of the linear coefficients for training , which removes numerical methods such as binary search . The bounding algorithm trades off computational complexity and bound tightness . In this work , we study two such algorithms . One is based on Fast-Lin / CROWN ( Weng et al. , 2018 ; Zhang et al. , 2018 ) . It has tighter bounds but high computational complexity . Another is inspired by the interval bound propagation ( IBP ) ( Gowal et al. , 2018 ) , which is faster but leads to looser bounds . The details of both algorithms are provided in Appendices A.2 and A.3 . We briefly discuss the complexity of both algorithms in Section 5 . 3 ALGORITHMS . 3.1 ROBUSTNESS GUARANTEES BY POLYHEDRAL ENVELOPE . For an input point x with label c ∈ [ K ] , a sufficient condition to guarantee robustness is that the lower bounds of z′ ( N ) c − z′ ( N ) i are positive for all i ∈ [ K ] . Here , we use a trick called elision of the last layer ( Gowal et al. , 2018 ) to merge the subtraction of z′ ( N ) c and z ′ ( N ) i with the last linear layer and obtain the lower bound of z′ ( N ) c − z′ ( N ) i : z ′ ( N ) c − z′ ( N ) i def == Uix ′ + pi . Then , the sufficient condition to ensure robustness within a budget S ( p ) ( x ) can be written as z′ ( N ) c − z′ ( N ) i = Uix′ + pi ≥ 0 ∀i ∈ [ K ] . ( 3 ) The constraint is trivial when i = c , so there areK−1 such linear constraints , corresponding toK−1 hyperplanes in the input space . Within the adversarial budget , these hyperplanes provide a polyhedral envelope of the true decision boundary . In the remainder of the paper , we use the term dic to represent the distance between the input and the hyperplane defined in ( 3 ) and define dc = mini∈ [ K ] , i6=c dic as the distance between the input and the polyhedral envelope boundary . The distance can be based on different lp norms , and dic = 0 when the input itself does not satisfy the inequality ( 3 ) . Since ( 3 ) is a sufficient condition for robustness given the adversarial budget S ( p ) ( x ) , there is no adversarial examples in the intersection of S ( p ) ( x ) and the polytope defined in ( 3 ) . The theorem below formalizes our robustness certification . We defer its proof to Appendix C.1 . Theorem 1 ( PEC in Unconstrained Cases ) . Given a model f : Rn1 → [ K ] and an input point x with label c , let U and p in ( 3 ) be calculated using a predefined adversarial budget S ( p ) ( x ) . Then , there is no adversarial example inside an lp norm ball of radius d centered around x , with d = min { , dc } where dic = max { 0 , Uix+pi‖Ui‖q } . lq is the dual norm of the lp norm , i.e. , 1p + 1 q = 1 . Based on Theorem 1 , when < dc , PEC has the same robustness guarantees as KW ( Kolter & Wong , 2017 ) , Fast-Lin ( Weng et al. , 2018 ) and CROWN ( Zhang et al. , 2018 ) if we use the same model linearization method . When 0 < dc < , KW / Fast-Lin / CROWN can not certify the data point at all , while PEC still gives non-trivial robustness guarantees thanks to the geometric interpretability of the polyhedral envelope . Figure 1 ( a ) compares the certified bounds of KW / Fast-Lin and PEC on a randomly picked input for different values of . Figure 1 ( b ) shows a 2D sketch of the two cases mentioned above . If is too small , as in the left portion of the figure , the linear bounds in ( 3 ) are tight but only valid in a small region S ( p ) ( x ) . Therefore , the certified robustness is at most . If is too large , the linear bounds are valid in a larger region but more pessimistic because of linear approximation . 1 This is depicted by the right portion of the figure , where the distances between the input and the hyperplanes are smaller and the certified robustness is then dc . The hyperplane segments inside the adversarial budget ( green lines ) never exceed the decision boundary ( dark blue lines ) , by definition of the polyhedral envelope . 1The value of dic monotonically decreases with the increase of . 0.00 0.05 0.10 0.15 0.20 Value of 0.00 0.02 0.04 0.06 0.08 0.10 C er ti fi ed B ou nd PEC KW/Fast-Lin ( a ) Certified l∞-based bound of a randomly picked input by PEC and KW / Fast-Lin for different values of . The model is the ‘ FC1 ’ on MNIST trained by ‘ MMR+at ’ in Croce et al . ( 2018 ) ( b ) 2D sketch of decision boundary ( dark blue ) , hyperplane defined by ( 3 ) ( light blue ) , adversarial budget ( red ) , polyhedral envelope ( green ) in PEC . The distance between the input data and the hyperplanes is depicted by a yellow circle . The left and right portion correspond to dc bigger and smaller than respectively . Figure 1 : The two phases in PEC algorithm . To search for the optimal , i.e. , the peak in Figure 1 ( a ) , Kolter & Wong ( 2017 ) use Newton ’ s method , which is an expensive second-order method . By contrast , Weng et al . ( 2018 ) ; Zhang et al . ( 2018 ) use binary search , and our PEC can accelerate their strategy . The acceleration comes from the partial credit when 0 < dc < , in which case we can rule out all values of below dc and obtain a better lower bound of the optimal . A more detailed discussion is provided in Appendix B.1 . Under many circumstances , the input is constrained in a hypercube [ r ( min ) , r ( max ) ] n1 . For example , for images with normalized pixel values , an attacker should not perturb the image out of the hypercube [ 0 , 1 ] n1 . Because of this constraint for the attacker , the certified regions become larger . To obtain robustness guarantees in this scenario , we need to recalculate dic , which is now the distance between the input and the hyperplanes in ( 3 ) within the hypercube . The value of dic then is the minimum of the optimization problem min ∆ ‖∆‖p s.t . a∆ + b ≤ 0 , ∆ ( min ) ≤ ∆ ≤ ∆ ( max ) ( 4 ) where , to simplify the notation , we define a = Ui , b = Uix + p , ∆ ( min ) = r ( min ) − x and ∆ ( max ) = r ( max ) − x . When b ≤ 0 , the minimum is obviously 0 as the optimal ∆ is an all-zero vector . In this case , either we can not certify the input at all or even the clean input is misclassified . When b > 0 , by Hölder ’ s inequality , a∆ + b ≥ −‖∆‖p‖a‖q + b , with equality reached when ∆p and aq are collinear . Based on this , the optimal ∆ of minimum lp norm to satisfy a∆ + b ≤ 0 is ∆̂i = − b ‖a‖qq sign ( ai ) |ai| q p , ( 5 ) where sign ( · ) returns +1 for positive numbers and −1 for negative numbers . To satisfy the constraint ∆ ( min ) ≤ ∆ ≤ ∆ ( max ) , we use a greedy algorithm that approaches this goal progressively . That is , we first calculate the optimal ∆̂ based on Equation ( 5 ) and check if the constraint ∆ ( min ) ≤ ∆ ≤ ∆ ( max ) is satisfied . For the elements where it is not , we clip their values within [ ∆ ( min ) , ∆ ( max ) ] and keep them fixed . We then optimize the remaining elements of ∆ in the next iteration and repeat this process until the constraint is satisfied for all elements . The pseudo-code is provided as Algorithm 2 in Appendix B.2 . The output of Algorithm 2 is the optimum of Problem ( 4 ) , i.e. , dic . We provide the proof in Appendix C.2 . The certified bound in this constrained case is then min { , dc } just as demonstrated by Theorem 1 .

Summary: There exists several method (KW, Crown, zonotope transformers) which essentially propagate linear lower and upper bound through the network (bounds is a linear function of the input variables). So far, to check for robustness, these methods propagated the bounds until the last layer (+ margin computation) and then concretized them and compared the result to zero to see if the studied radius was safe or not. This paper highlights the fact that in the case where the studied radius is not safe, it is possible to extract a safe radius from the linear bound.