Towards Stable and Efficient Training of Verifiably Robust Neural Networks

1 INTRODUCTION . The success of deep neural networks ( DNNs ) has motivated their deployment in some safety-critical environments , such as autonomous driving and facial recognition systems . Applications in these areas make understanding the robustness and security of deep neural networks urgently needed , especially their resilience under malicious , finely crafted inputs . Unfortunately , the performance of DNNs are often so brittle that even imperceptibly modified inputs , also known as adversarial examples , are able to completely break the model ( Goodfellow et al. , 2015 ; Szegedy et al. , 2013 ) . The robustness of DNNs under adversarial examples is well-studied from both attack ( crafting powerful adversarial examples ) and defence ( making the model more robust ) perspectives ( Athalye et al. , 2018 ; Carlini & Wagner , 2017a ; b ; Goodfellow et al. , 2015 ; Madry et al. , 2018 ; Papernot et al. , 2016 ; Xiao et al. , 2019b ; 2018b ; c ; Eykholt et al. , 2018 ; Chen et al. , 2018 ; Xu et al. , 2018 ; Zhang et al. , 2019b ) . Recently , it has been shown that defending against adversarial examples is a very difficult task , especially under strong and adaptive attacks . Early defenses such as distillation ( Papernot et al. , 2016 ) have been broken by stronger attacks like C & W ( Carlini & Wagner , 2017b ) . Many defense methods have been proposed recently ( Guo et al. , 2018 ; Song et al. , 2017 ; Buckman et al. , 2018 ; Ma et al. , 2018 ; Samangouei et al. , 2018 ; Xiao et al. , 2018a ; 2019a ) , but their robustness improvement can not be certified – no provable guarantees can be given to verify their robustness . In fact , most of these uncertified defenses become vulnerable under stronger attacks ( Athalye et al. , 2018 ; He et al. , 2017 ) . Several recent works in the literature seeking to give provable guarantees on the robustness performance , such as linear relaxations ( Wong & Kolter , 2018 ; Mirman et al. , 2018 ; Wang et al. , 2018a ; Dvijotham et al. , 2018b ; Weng et al. , 2018 ; Zhang et al. , 2018 ) , interval bound propagation ( Mirman et al. , 2018 ; Gowal et al. , 2018 ) , ReLU stability regularization ( Xiao et al. , 2019c ) , and distributionally ∗Work partially done during an internship at DeepMind . robust optimization ( Sinha et al. , 2018 ) and semidefinite relaxations ( Raghunathan et al. , 2018a ; Dvijotham et al. ) . Linear relaxations of neural networks , first proposed by Wong & Kolter ( 2018 ) , is one of the most popular categories among these certified defences . They use the dual of linear programming or several similar approaches to provide a linear relaxation of the network ( referred to as a “ convex adversarial polytope ” ) and the resulting bounds are tractable for robust optimization . However , these methods are both computationally and memory intensive , and can increase model training time by a factor of hundreds . On the other hand , interval bound propagation ( IBP ) is a simple and efficient method for training verifiable neural networks ( Gowal et al. , 2018 ) , which achieved state-of-the-art verified error on many datasets . However , since the IBP bounds are very loose during the initial phase of training , the training procedure can be unstable and sensitive to hyperparameters . In this paper , we first discuss the strengths and weakness of existing linear relaxation based and interval bound propagation based certified robust training methods . Then we propose a new certified robust training method , CROWN-IBP , which marries the efficiency of IBP and the tightness of a linear relaxation based verification bound , CROWN ( Zhang et al. , 2018 ) . CROWN-IBP bound propagation involves a IBP based fast forward bounding pass , and a tight convex relaxation based backward bounding pass ( CROWN ) which scales linearly with the size of neural network output and is very efficient for problems with low output dimensions . Additional , CROWN-IBP provides flexibility for exploiting the strengths of both IBP and convex relaxation based verifiable training methods . The efficiency , tightness and flexibility of CROWN-IBP allow it to outperform state-of-the-art methods for training verifiable neural networks with ` ∞ robustness under all settings on MNIST and CIFAR10 datasets . In our experiment , on MNIST dataset we reach 7.02 % and 12.06 % IBP verified error under ` ∞ distortions = 0.3 and = 0.4 , respectively , outperforming the state-of-the-art baseline results by IBP ( 8.55 % and 15.01 % ) . On CIFAR-10 , at = 2255 , CROWN-IBP decreases the verified error from 55.88 % ( IBP ) to 46.03 % and matches convex relaxation based methods ; at a larger , CROWN-IBP outperforms all other methods with a noticeable margin . 2 RELATED WORK AND BACKGROUND . 2.1 ROBUSTNESS VERIFICATION AND RELAXATIONS OF NEURAL NETWORKS . Neural network robustness verification algorithms seek for upper and lower bounds of an output neuron for all possible inputs within a set S , typically a norm bounded perturbation . Most importantly , the margins between the ground-truth class and any other classes determine model robustness . However , it has already been shown that finding the exact output range is a non-convex problem and NP-complete ( Katz et al. , 2017 ; Weng et al. , 2018 ) . Therefore , recent works resorted to giving relatively tight but computationally tractable bounds of the output range with necessary relaxations of the original problem . Many of these robustness verification approaches are based on linear relaxations of non-linear units in neural networks , including CROWN ( Zhang et al. , 2018 ) , DeepPoly ( Singh et al. , 2019 ) , Fast-Lin ( Weng et al. , 2018 ) , DeepZ ( Singh et al. , 2018 ) and Neurify ( Wang et al. , 2018b ) . We refer the readers to ( Salman et al. , 2019b ) for a comprehensive survey on this topic . After linear relaxation , they bound the output of a neural network fi ( · ) by linear upper/lower hyper-planes : Ai , :∆x + bL ≤ fi ( x0 + ∆x ) ≤ Ai , :∆x + bU ( 1 ) where a row vector Ai , : = W ( L ) i , : D ( L−1 ) W ( L−1 ) · · ·D ( 1 ) W ( 1 ) is the product of the network weight matrices W ( l ) and diagonal matrices D ( l ) reflecting the ReLU relaxations for output neuron i ; bL and bU are two bias terms unrelated to ∆x . Additionally , Dvijotham et al . ( 2018c ; a ) ; Qin et al . ( 2019 ) solve the Lagrangian dual of verification problem ; Raghunathan et al . ( 2018a ; b ) ; Dvijotham et al . propose semidefinite relaxations which are tighter compared to linear relaxation based methods , but computationally expensive . Bounds on neural network local Lipschitz constant can also be used for verification ( Zhang et al. , 2019c ; Hein & Andriushchenko , 2017 ) . Besides these deterministic verification approaches , randomized smoothing can be used to certify the robustness of any model in a probabilistic manner ( Cohen et al. , 2019 ; Salman et al. , 2019a ; Lecuyer et al. , 2018 ; Li et al. , 2018 ) . 2.2 ROBUST OPTIMIZATION AND VERIFIABLE ADVERSARIAL DEFENSE . To improve the robustness of neural networks against adversarial perturbations , a natural idea is to generate adversarial examples by attacking the network and then use them to augment the training set ( Kurakin et al. , 2017 ) . More recently , Madry et al . ( 2018 ) showed that adversarial training can be formulated as solving a minimax robust optimization problem as in ( 2 ) . Given a model with parameter θ , loss function L , and training data distribution X , the training algorithm aims to minimize the robust loss , which is defined as the maximum loss within a neighborhood { x+ δ|δ ∈ S } of each data point x , leading to the following robust optimization problem : min θ E ( x , y ) ∈X [ max δ∈S L ( x+ δ ; y ; θ ) ] . ( 2 ) Madry et al . ( 2018 ) proposed to use projected gradient descent ( PGD ) to approximately solve the inner max and then use the loss on the perturbed example x + δ to update the model . Networks trained by this procedure achieve state-of-the-art test accuracy under strong attacks ( Athalye et al. , 2018 ; Wang et al. , 2018a ; Zheng et al. , 2018 ) . Despite being robust under strong attacks , models obtained by this PGD-based adversarial training do not have verified error guarantees . Due to the nonconvexity of neural networks , PGD attack can only compute the lower bound of robust loss ( the inner maximization problem ) . Minimizing a lower bound of the inner max can not guarantee ( 2 ) is minimized . In other words , even if PGD-attack can not find a perturbation with large loss , that does not mean there exists no such perturbation . This becomes problematic in safety-critical applications since those models need certified safety . Verifiable adversarial training methods , on the other hand , aim to obtain a network with good robustness that can be verified efficiently . This can be done by combining adversarial training and robustness verification—instead of using PGD to find a lower bound of inner max , certified adversarial training uses a verification method to find an upper bound of the inner max , and then update the parameters based on this upper bound of robust loss . Minimizing an upper bound of the inner max guarantees to minimize the robust loss . There are two certified robust training methods that are related to our work and we describe them in detail below . Linear Relaxation Based Verifiable Adversarial Training . One of the most popular verifiable adversarial training method was proposed in ( Wong & Kolter , 2018 ) using linear relaxations of neural networks to give an upper bound of the inner max . Other similar approaches include Mirman et al . ( 2018 ) ; Wang et al . ( 2018a ) ; Dvijotham et al . ( 2018b ) . Since the bound propagation process of a convex adversarial polytope is too expensive , several methods were proposed to improve its efficiency , like Cauchy projection ( Wong et al. , 2018 ) and dynamic mixed training ( Wang et al. , 2018a ) . However , even with these speed-ups , the training process is still slow . Also , this method may significantly reduce a model ’ s standard accuracy ( accuracy on natural , unmodified test set ) . As we will demonstrate shortly , we find that this method tends to over-regularize the network during training , which is harmful for obtaining good accuracy . Interval Bound Propagation ( IBP ) . Interval Bound Propagation ( IBP ) uses a very simple rule to compute the pre-activation outer bounds for each layer of the neural network . Unlike linear relaxation based methods , IBP does not relax ReLU neurons and does not consider the correlations between neurons of different layers , yielding much looser bounds . Mirman et al . ( 2018 ) proposed a variety of abstract domains to give sound over-approximations for neural networks , including the “ Box/Interval Domain ” ( referred to as IBP in Gowal et al . ( 2018 ) ) and showed that it could scale to much larger networks than other works ( Raghunathan et al. , 2018a ) could at the time . Gowal et al . ( 2018 ) demonstrated that IBP could outperform many state-of-the-art results by a large margin with more precise approximations for the last linear layer and better training schemes . However , IBP can be unstable to use and hard to tune in practice , since the bounds can be very loose especially during the initial phase of training , posing a challenge to the optimizer . To mitigate instability , Gowal et al . ( 2018 ) use a mixture of regular and minimax robust cross-entropy loss as the model ’ s training loss .

Summary: This work proposes CROWN-IBP - novel and efficient certified defense method against adversarial attacks, by combining linear relaxation methods which tend to have tighter bounds with the more efficient interval-based methods. With an attempt to augment the IBP method with its lower computation complexity with the tight CROWN bounds, to get the best of both worlds. One of the primary contributions here is that reduction of computation complexity by an order of \Ln while maintaining similar or better bounds on error. The authors show compelling results with varied sized networks on both MNIST and CIFAR dataset, providing significant improvements over past baselines.