Loss Landscape Matters: Training Certifiably Robust Models with Favorable Loss Landscape

1 INTRODUCTION . Despite the success of deep learning in many applications , the existence of adversarial example , an imperceptibly modified input that is designed to fool the neural network ( Szegedy et al. , 2013 ; Biggio et al. , 2013 ) , hinders the application of deep learning to safety-critical domains . There has been increasing interest in building a model that is robust to adversarial attacks ( Goodfellow et al. , 2014 ; Papernot et al. , 2016 ; Kurakin et al. , 2016 ; Madry et al. , 2018 ; Tramèr et al. , 2017 ; Zhang et al. , 2019a ; Xie et al. , 2019 ) . However , most defense methods evaluate their robustness with adversarial accuracy against predefined attacks such as PGD attack ( Madry et al. , 2018 ) or C & W attack ( Carlini & Wagner , 2017 ) . Thus , these defenses can be broken by new attacks ( Athalye et al. , 2018 ) . To this end , many training methods have been proposed to build a certifiably robust model that can be guaranteed to be robust to adversarial perturbations ( Hein & Andriushchenko , 2017 ; Raghunathan et al. , 2018b ; Wong & Kolter , 2018 ; Dvijotham et al. , 2018 ; Mirman et al. , 2018 ; Gowal et al. , 2018 ; Zhang et al. , 2019b ) . They develop an upper bound on the worst-case loss over valid adversarial perturbations and minimize it to train a certifiably robust model . These certifiable training methods can be mainly categorized into two types : linear relaxation-based methods and bound propagation methods . Linear relaxation-based methods use relatively tighter bounds , but are slow , hard to scale to large models , and memory-inefficient ( Wong & Kolter , 2018 ; Wong et al. , 2018 ; Dvijotham et al. , 2018 ) . On the other hand , bound propagation methods , represented by Interval Bound Propagation ( IBP ) , are fast and scalable due to the use of simple but much looser bounds ( Mirman et al. , 2018 ; Gowal et al. , 2018 ) . One would expect that training with tighter bounds would lead to better performance , but IBP outperforms linear relaxation-based methods in many cases , despite using much looser bounds . These observations on the performance of certifiable training methods raise the following questions : Why does training with tighter bounds not result in a better performance ? What other factors may influence the performance of certifiable training ? How can we improve the performance of certifiable training methods with tighter bounds ? In this paper , we provide empirical and theoretical analysis to answer these questions . First , we demonstrate that IBP ( Gowal et al. , 2018 ) has a more favorable loss landscape than other linear relaxation-based methods , and thus it often leads to better performance even with much looser bounds . To account for this difference , we present a unified view of IBP and linear relaxation-based methods and find that the relaxed gradient approximation ( which will be defined in Definition 1 ) of each method plays a crucial role in its optimization behavior . Based on the analysis of the loss landscape and the optimization behavior , we propose a new certifiable training method that has a favorable landscape with tighter bounds . The performance of the proposed method is comparable to that of state-of-the-art methods under a wide range of perturbations . We summarize the contributions of this study as follows : • We provide empirical and theoretical analysis of the loss landscape of certifiable training methods and find that smoothness of the loss landscape is important for building certifiably robust models . • We propose a certifiable training method with tighter bounds and a favorable loss landscape , obtaining comparable performance with state-of-the-art methods under a wide range of perturbations . 2 RELATED WORK . Earlier studies on training certifiably robust models were limited to 2-layered networks ( Hein & Andriushchenko , 2017 ; Raghunathan et al. , 2018a ) . To scale to larger networks , a line of work has proposed the use of linear relaxation of nonlinear activation to formulate a robust optimization . Then , a dual problem is considered and a dual feasible solution is used to simplify the computation further . By doing so , Wong & Kolter ( 2018 ) built a method that can scale to a 4-layered network , and later , Wong et al . ( 2018 ) used Cauchy random projections to scale to much larger networks . However , they are still slow and memory-inefficient . Dvijotham et al . ( 2018 ) proposed a method called predictorverifier training ( PVT ) , which uses a verifier network to optimize the dual solution . This is similar to our proposed method but we do not require any additional network . Xiao et al . ( 2018 ) proposed to add regularization technique with adversarial training for inducing ReLU stability , but it is less effective than other certified defenses . We also encourage our model to avoid unstable ReLUs , but we train the model with an upper bound of the worst-case loss and investigate ReLU stability from the loss landscape perspective . Mirman et al . ( 2018 ) proposed the propagation of a geometric bound ( called domain ) through the network to yield an outer approximation in logit space . This can be done with an efficient layerwise computation that exploits interval arithmetic . Over the outer domain , one can compute the worstcase loss to be minimized during training . Gowal et al . ( 2018 ) used a special case of the domain propagation called Interval Bound Propagation ( IBP ) using the simplest domain , the interval domain ( or interval bound ) . In IBP , the authors introduced a different objective function , heuristic scheduling on the hyperparameters , and elision of the last layer to stabilize the training and to improve the performance . Both approaches , linear relaxation-based methods and bound propagation methods , use an upper bound on the worst-case loss . Bound propagation methods exploit much looser upper bounds , but they enjoy an unexpected benefit in many cases : better robustness than linear relaxation-based methods . Balunovic & Vechev ( 2019 ) hypothesized that the complexity of the loss computation makes the optimization more difficult , which could be a reason why IBP outperforms linear relaxationbased methods . They proposed a new optimization procedure with the existing linear relaxation . In this paper , we further investigate the causes of the difficulties in the optimization . Recently , Zhang et al . ( 2019b ) proposed CROWN-IBP which uses linear relaxation in a verification method called CROWN ( Zhang et al. , 2018 ) in conjunction with IBP to train a certifiably robust model . Although beyond our focus here , there is another line of work on randomized smoothing ( Li et al. , 2018 ; Lecuyer et al. , 2019 ; Cohen et al. , 2019 ; Salman et al. , 2019 ) , which can probabilistically certify the robustness with arbitrarily high probability by using a smoothed classifier . However , it requires a large number of samples for inference . There are many other works on certifiable verification ( Weng et al. , 2018 ; Singh et al. , 2018a ; 2019 ; 2018b ; Zhang et al. , 2018 ; Boopathy et al. , 2019 ; Lyu et al. , 2020 ) . However , our work focuses on ” certifiable training ” . 3 BACKGROUND . First , we provide a brief overview of certifiable training methods . Then , we consider IBP ( Gowal et al. , 2018 ) as a special case of linear relaxation-based methods . This unified view on certifiable training methods helps us to comprehensively analyze the differences between the two approaches : bound propagation and linear relaxation . We present the details of the IBP in Appendix B . 3.1 NOTATIONS AND CERTIFIABLE TRAINING . We consider a c-class classification problem with a neural network f ( x ; θ ) with the layerwise operations z ( k ) = h ( k ) ( z ( k−1 ) ) ( k = 1 , · · · , K ) and the input z ( 0 ) = x in the input space X . The corresponding probability function is denoted by pf = softmax ◦ f : X → [ 0 , 1 ] c with subscript f . We denote a subnetwork with k operations as h [ k ] = h ( k ) ◦ · · · ◦h ( 1 ) . For a linear operation h ( k ) , we use W ( k ) and b ( k ) to denote the weight and the bias for the layer . We consider the robustness of the classifier against the norm-bounded perturbation set B ( x , ) = { x′ ∈ X : ||x′−x|| ≤ } with the perturbation level . Here , we mainly focus on the ` ∞-norm bounded set . To compute the margin between the true class y for the input x and the other classes , we define a c × c matrix C ( y ) = I − 1e ( y ) T with ( C ( y ) z ( K ) ) m = z ( K ) m −z ( K ) y ( m = 0 , · · · , c− 1 ) . For the last linear layer , the weightsW ( K ) and the bias b ( K ) are merged with C ( y ) , that is , W ( K ) ≡ C ( y ) W ( K ) and b ( K ) ≡ C ( y ) b ( K ) , yielding the margin score function s ( x , y ; θ ) = C ( y ) f ( x ; θ ) = f ( x ; θ ) − fy ( x ; θ ) 1 satisfying ps = pf . Then we can define the worst-case margin score s∗ ( x , y , ; θ ) = maxx′∈B ( x , ) s ( x′ , y ; θ ) where max is element-wise maximization . With an upper bound s on the worst-case margin score , s ≥ s∗ , we can provide an upper bound on the worst-case loss over valid adversarial perturbations as follows : L ( s ( x , y , ; θ ) , y ) ≥ max x′∈B ( x , ) L ( f ( x′ ; θ ) , y ) ( 1 ) for cross-entropy loss L ( Wong & Kolter , 2018 ) . Therefore , we can formulate certifiable training as a minimization of the upper bound , minθ L ( s ( x , y , ; θ ) , y ) , instead of directly solving minθ maxx′∈B ( x , ) L ( f ( x′ ; θ ) , y ) which is infeasible . Note that adversarial training ( Madry et al. , 2018 ) uses a strong iterative gradient-based attack ( PGD ) to provide a lower bound on the worst-case loss to be minimized , but it can not provide a certifiably robust model . Whenever possible , we will simplify the notations by omitting variables such as x , y , , and θ . 3.2 LINEAR RELAXATION-BASED METHODS . For a subnetwork h [ k ] , given with the pre-activation upper/lower bounds , u and l , for each nonlinear activation function h in h [ k ] , linear relaxation-based methods ( Wong & Kolter ( 2018 ) ; Wong et al . ( 2018 ) ; Zhang et al . ( 2019b ) ) use a relaxation of the activation function by two elementwise linear function bounds , h and h , that is , h ( z ) ≤ h ( z ) ≤ h ( z ) for l ≤ z ≤ u . We denote the function bounds as h ( z ) = a z + b and h ( z ) = a z + b for some a , b , a , and b , where denotes the elementwise ( Hadamard ) product . Using all the function bounds h ’ s and h ’ s for the nonlinear activations in conjunction with the linear operations in h [ k ] , an ith ( scalar ) activation h [ k ] i ( · ) ∈ R can be upper bounded by a linear function gT · +b over B ( x , ) as in Zhang et al . ( 2018 ) . This can be equivalently explained with the dual relaxation viewpoint in Wong & Kolter ( 2018 ) . Further details are provided in Appendix C. Now we are ready to upper bound the activation h [ k ] i over B ( x , ) . Definition 1 ( Linear Relaxation with Relaxed Gradient Approximation ) . For each neuron activation h [ k ] i , a linear relaxation method computes an upper approximation of the activation over B ( x , ) by using g ∈ Rd and b ∈ R as follows : max x′∈B ( x , ) h [ k ] i ( x ′ ) ≤ max x′∈B ( x , ) gTx′ + b = gTx+ ||g||∗ + b . ( 2 ) We call g the relaxed gradient approximation of h [ k ] i over B ( x , ) . Similarly , we can obtain the corresponding lower bound . Inductively using these upper/lower bounds on the output of the subnetwork , we can obtain the bounds for the next subnetwork h [ k+1 ] and then for the whole network s. The final bound s on the whole network s can then be used in the objective ( 1 ) . The tightness of the bounds s and L ( s , y ) highly depend on how the linear bounds h and h in each layer are chosen . Unified view of IBP and linear relaxation-based methods IBP can also be considered as a linear relaxation-based method using zero-slope ( a = a = 0 ) linear bounds , h ( z ) = u+ and h ( z ) = l+ , where v+ = max ( v,0 ) and v− = min ( v,0 ) . Thus , the bounds of a nonlinear activation depend only on the pre-activation bounds u and l for the activation layer , substantially reducing the feedforward/backpropagation computations . CROWN-IBP ( Zhang et al. , 2019b ) applies different linear relaxation schemes to the subnetworks and the whole network . It uses the same linear bounds as IBP for the subnetworks h [ k ] for k < K except for the network s = h [ K ] itself , and uses h ( z ) = u+ u+−l− ( z − l− ) and h ( z ) = 1 [ u+ + l− > 0 ] z for the whole network s. Moreover , CROWNIBP uses interpolations between two bounds with the mixing weight β , IBP bound and CROWN-IBP bound , with the following objective : L ( ( 1− β ) sIBP ( x , y , ; θ ) + βsCROWN-IBP ( x , y , ; θ ) , y ) . ( 3 ) Convex Adversarial Polytope ( CAP ) ( Wong & Kolter , 2018 ; Wong et al. , 2018 ) uses the linear bounds h ( z ) = u + u+−l− ( z − l− ) and h ( z ) = u + u+−l− z for all subnetworks h [ k ] and the entire network . As CAP utilizes the linear bounds for each neuron , it is slow and memory-inefficient . It can be easily shown that tighter relaxations on nonlinear activations yield a tighter bound on the worstcase margin score s∗ . To specify the linear relaxation variable φ ≡ { a , a , b , b } used in relaxation , we use the notation s ( x , y , ; θ , φ ) . CROWN-IBP and CAP generally yield a much tighter bound than IBP . These relaxation schemes are illustrated in Figure 6 in Appendix D .

Summary: In this paper, the authors studied the role of loss landscape in training certifiable robust models. The authors reviewed linear relaxation based methods, and showed that Interval Bound Propagation (IBP) is a special case of linear relaxation based methods. Although linear relaxation based methods have a tighter bound on worst case loss with adversarial perturbations than IBP based method, the authors found in numerical studies that towards the end of training, IBP outperforms linear relaxation based methods. The authors hypothesized that this was because IBP loss landscape was more smooth, which helped optimization. The authors demonstrated in a theorem that IBP loss was indeed more smooth under certain assumptions. Based on this insight, the authors proposed a favorable landscape method. The authors showed in numerical studies that the sum over the worst-case margin for each class is lowest for their method. The loss of their method is also the most smooth among competing methods. Their method achieved a consistent performance in a range of perturbations, which is not achieved in competing methods.