Efficient Training of Robust and Verifiable Neural Networks

1 INTRODUCTION . Although deep neural networks ( DNNs ) have achieved tremendous success in various applications , it becomes widely-known that they are vulnerable to adversarial examples ( also known as adversarial attacks ) , namely , crafted examples with human-imperceptible perturbations to cause misclassification ( Goodfellow et al. , 2015 ; Szegedy et al. , 2013 ) . Many attack generation methods have been proposed in order to find the possible minimum adversarial perturbation , commonly evaluated by its ` p norm for p ∈ { 0 , 1 , 2 , ∞ } ( Papernot et al. , 2016 ; Carlini & Wagner , 2017 ; Athalye & Sutskever , 2017 ; Su et al. , 2019 ; Xu et al. , 2018 ; Chen et al. , 2018 ) . Meanwhile , various defense methods were proposed to enhance the robustness of DNNs against adversarial attacks . However , many of them are built on heuristic strategies , which are thus easily bypassed by stronger adversaries ( Athalye et al. , 2018 ) . The work Madry et al . ( 2018 ) proposed a stronger defense method , adversarial training , which minimizes the worst-case training loss under adversarial perturbations . However , it is restricted to a specific type of adversarial perturbations and not generalized to other types of perturbations ( Tramèr & Boneh , 2019 ) . Motivated by the limitation of heuristic defense , another line of research ( known as verified/certified robustness ) aims to provide provable robust guarantees of DNNs against an input with arbitrary perturbation within a certain ` p ball region ( Katz et al. , 2017 ; Cheng et al. , 2017 ; Carlini et al. , 2017 ; Kolter & Wong , 2018 ; Raghunathan et al. , 2018 ; Weng et al. , 2018 ; Zhang et al. , 2018 ; Boopathy et al. , 2019 ; Dvijotham et al. , 2018b ; Wong et al. , 2018 ; Xiao et al. , 2019 ; Gowal et al. , 2018 ; Mirman et al. , 2018 ; Dvijotham et al. , 2018a ) . The recent progress on verification spans from the exact verification method ( Katz et al. , 2017 ; Cheng et al. , 2017 ; Carlini et al. , 2017 ) to the approximate ( relaxed ) verification method ( Kolter & Wong , 2018 ; Raghunathan et al. , 2018 ; Weng et al. , 2018 ; Zhang et al. , 2018 ; Boopathy et al. , 2019 ; Dvijotham et al. , 2018b ; Wong et al. , 2018 ) . Here the former uses expensive computation methods , e.g. , mixed-integer programming ( MIP ) , to find the exact robustness bound , and the latter considers a relaxed verification problem by convexifying the adversarial polytope but significantly improves the computation efficiency compared to the exact method . Besides resorting to approximate verification method , the recent work Xiao et al . ( 2019 ) proposed the principle of co-design between training and verification , and showed that the exact verification method can be accelerated by imposing weight sparsity and activation stability ( so-called ReLU stability ) on trainable network models . On the other hand , it was shown in Kolter & Wong ( 2018 ) ; Raghunathan et al . ( 2018 ) ; Gowal et al . ( 2018 ) ; Mirman et al . ( 2018 ) ; Dvijotham et al . ( 2018a ) that by incorporating the relaxed but computationally efficient verification methods into the training process , the learnt model yields strengthened robustness with certificate . Following this line of research , in this work : • We develop a unified framework of certified defense and propose that many common certified defenses can be incorporated as different types of regularization . We theoretically analyze general regularizations and provide guidelines on how to select regularization . • We propose an efficient regularizer that better quantifies adversarial sensitivity during the training process to yield more certifiable models . Through experiments on six different architectures , we demonstrate our method ’ s computational efficiency and higher certified accuracies on large perturbations compared to all current state-of-the-art certification based training methods . In particular , we demonstrate up to a 55 % increase in certified accuracy at = 0.2 on MNIST , up to a 20.5 % increase at = 2/255 on CIFAR , and up to a 24 % increase at = 8/255 on GTSRB . In addition , on all architectures and datasets we achieve faster training than any other certification based training methods . • We extend our regularizer to an ` 0 threat model and model ensembles . We demonstrate empirically that our regularizer achieves high certified accuracy on this threat model . We also empirically show that model ensembling of models trained with our regularizer achieve higher certified accuracies . 2 BACKGROUND AND RELATED WORK . 2.1 VERIFICATIONS . Assuming a norm-bounded threat model , finding the minimum adversarial distortion exactly is an NPcomplete problem , making it computationally infeasible ( Katz et al. , 2017 ) . Fortunately , finding lower bounds on the minimum adversarial distortion is computationally tractable . Several techniques find these lower bounds only as a function of model weights ( Szegedy et al. , 2013 ; Peck et al. , 2017 ; Hein & Andriushchenko , 2017 ; Raghunathan et al. , 2018 ) , but these methods typically provide very loose bounds for neural networks with more than 2 layers . Using an input-specific certification method , it is possible to find non-trivial bounds for fully connected ReLU networks ( Kolter & Wong , 2018 ; Weng et al. , 2018 ; Wang et al. , 2018 ) , as well as networks with general activation functions ( Zhang et al. , 2018 ) and architectures ( Singh et al. , 2018 ) . An “ any-time ” certifier has also been developed that allows for a trade-off between certification time and bound quality ( Dvijotham et al. , 2018b ) . 2.2 CERTIFIED DEFENSES . Recent works have also developed methods of defending against adversarial attacks . One line of work uses adversarial training with adversarial attacks and empirically demonstrates high resistance to attacks ( Madry et al. , 2018 ; Sinha et al. , 2018 ) . However , adversarial training is not targeted towards verification or certification methods , and we therefore do not consider it a certified defense . One step towards certified defenses is natural regularization such as sparsity-inducing weight magnitude penalization . This method combined with adversarial training yields highly verifiable models ( Xiao et al. , 2019 ) . Using an additional ReLU stability regularizer to enhance ease-of-verification allows for even more verifiable models . Other defenses specifically target certifiers or use certification methods as part of the training procedure . We note that these “ certified ” defenses are not truly certified since they can not ensure robustness to unseen points without using a certifier on these points . These defenses instead produce models that are empirically more certifiable on unseen test points . Using convex outer bounds to bound the adversarial loss function has been shown to be effective at producing certifiable models , although training is relatively slow ( Kolter & Wong , 2018 ; Wong et al. , 2018 ) . Using interval bounds propagation ( IBP ) to bound the adversarial loss is much cheaper to train ( Gowal et al. , 2018 ) and has surprisingly become the state-of-the-art certifiably robust training method ( Gowal et al. , 2018 ; Salman et al. , 2019 ) despite IBP performing much more poorly than the convex outer bounds ( Kolter & Wong , 2018 ; Wong et al. , 2018 ) in certifications . In this paper , we unify certified defenses under a unified framework of regularization . We also develop an efficient certified defense that has similar computation overhead as IBP-based defense ( Gowal et al. , 2018 ) while yielding better performance than existing methods . 2.3 CERTIFICATION METHODS . Threat model In this paper , we will use the notation of fully-connected neural networks for exposition , but our method works for general convolutional neural networks including residual networks . Appendix B Table 3 includes descriptions of the main notations used in this paper . Consider an n layer neural network f ( x ) with input x where the first layer of the network z0 is set to x . Given weights Wi , biases bi and an activation function σ , for i = 0 , . . . , n− 1 , subsequent layers are defined as : zi+1 = Wi+1σ ( zi ) + bi+1 , ( 1 ) with f ( x ) = zn . With this expression , the first layer of the network is defined by using the identity activation at the first layer . We assume the following threat model : a nominal input xnom is perturbed by perturbation δ to produce a perturbed input x = xnom + δ , where ||δ||p ≤ and || · ||p represents an ` p norm . Suppose the correct classification is given by c. Then the minimum distortion ∗ is the minimal ∈ R+ satisfying : maxj 6=c znj − znc > 0 . Interval Bounds Propagation There exist several methods to efficiently find certified lower bounds on the minimum distortion necessary for misclassification . One such method is interval bounds propagation ( IBP ) ( Gowal et al. , 2018 ; Gehr et al. , 2018 ) which bounds each layer in a network with a fixed upper and lower bound . These bounds are then propagated at each layer of the network using the previous layer ’ s bounds . Specifically , given layer-wise bounds where li ≤ zi ≤ ui , the next layer ’ s bounds are found as : ui+1 = Wi+1+ σ ( u i ) +Wi+1− σ ( l i ) + bi+1 , ( 2 ) where W+ and W− denote the positive and negative components of W respectively with other entries being zeros otherwise . Lower bounds are found similarly . Intuitively , IBP finds a box bounding each layer , which can result in very loose bounds for general network as demonstrated in ( Kolter & Wong , 2018 ; Gehr et al. , 2018 ) . Linear Bounding Framework Certified bounds can also be found using a linear bounding framework as first proposed in Fast-Lin ( Weng et al. , 2018 ) and later in the Neurify ( Wang et al. , 2018 ) and DeepZ ( Singh et al. , 2018 ) frameworks . This approach typically finds tighter bounds on minimum distortion than IBP . This framework bounds each activation layer σ ( zi ) as follows : αi zi + βiL ≤ σ ( zi ) ≤ αi zi + βiU , where αi represents the slopes of linear bounds on the activation and βiL , β i U representing intercepts of linear bounds on the activation . When σ is ReLU activation , Fast-Lin sets the coefficients to be : αij = ziu , j ziu , j − zil , j , βiL , j = 0 , β i U , j = − ziu , jz i l , j ziu , j − zil , j , if the neuron j is uncertain , meaning zil , j < 0 , z i u , j > 0 and z i l , j ≤ zij ≤ ziu , j . When both bounds are positive or negative , the bound on the activation is exactly the linear component on the corresponding side ( i.e . when zil , j > 0 for example , α i j=1 , β i L , j = β i U , j = 0 ) . Using these layer-wise bounds , Fast-Lin finds a pair of linear bounds on the network : Ax+bL ≤ f ( x ) ≤ Ax+bU . Then Fast-Lin bounds the network output over all possible adversarial distortion measured by - ` p ball by : Axnom + bL − ||A|| : ,q ≤ f ( x ) ≤ Axnom + bU + ||A|| : ,q , where || · || : ,q denotes a row-wise q norm , dual to the norm p of the assumed attack threat model . is the assumed attack norm size . Intuitively , Fast-Lin finds linear upper and lower bounds on the entire network to analyze the output layer . Because Fast-Lin finds linear bounds on the network as an intermediate step to finding output bounds zu , zl , the bounds are tighter than the corresponding IBP bounds u , l. Fast-Lin is equivalent to using convex outer bounds to bound the set of possible values at each layer of the network . Fast-Lin has been extended to general activation functions and asymmetric upper and lower bounds with different values of αi in CROWN ( Zhang et al. , 2018 ) , and has been extended to general network architectures in CNN-Cert ( Boopathy et al. , 2019 ) .

Summary: The authors first demonstrate that many existing approaches are special cases of regularized objectives, and then provide a theoretical analysis on the relationship between the local minima of the original loss and the corresponding regularized loss.  Afterwards, the authors propose a new regularizer inspired by the IBP regularizer by taking account of second order information. Through a large set of experiments the authors demonstrate that their approach achieves higher certified accuracy using CNN-Cert, compared to many previous approaches.