On the Convergence of Certified Robust Training with Interval Bound Propagation

1 INTRODUCTION . It has been shown that deep neural networks are vulnerable against adversarial examples ( Szegedy et al. , 2014 ; Goodfellow et al. , 2015 ; Carlini & Wagner , 2017 ; Kurakin et al. , 2016 ) , where a human imperceptible adversarial perturbation can easily alter the prediction by neural networks . This poses concerns to safety-critical applications such as autonomous vehicles , healthcare or finance systems . To combat adversarial examples , many defense mechanisms have been proposed in the past few years ( Kurakin et al. , 2016 ; Madry et al. , 2018 ; Zhang et al. , 2019 ; Guo et al. , 2018 ; Song et al. , 2018 ; Xiao et al. , 2020 ) . However , due to the lack of reliable measurement on adversarial robustness , many defense methods are later broken by stronger attacks ( Carlini & Wagner , 2017 ; Athalye et al. , 2018 ; Tramer et al. , 2020 ) . There are recently a line of robust training works , known as certified defense , focusing on training neural networks with certified robustness , where the evaluation of robustness needs to be provable – the network is considered robust on a test example if and only if the prediction is provably correct for any perturbation in a predefined set ( e.g. , a small ` ∞ ball ) ( Wang et al. , 2018b ; Bunel et al. , 2018 ; Zhang et al. , 2018 ; Wang et al. , 2018c ; Wong & Kolter , 2018 ; Singh et al. , 2018 ; 2019 ; Weng et al. , 2018 ; Xu et al. , 2020 ) . Unlike empirical methods that evaluate robustness with adversarial attacks and thus the evaluation can be limited by the strength of the attack algorithm , certified defense methods provide provable robustness guarantees without referring to any specific attack . To obtain a neural network with certified robustness , a common practice is to derive a neural network verification method that computes the upper and lower bounds of output neurons given an input region under perturbation ( e.g. , a small ` ∞ ball around an unperturbed sample ) , and then train the neural network to optimize the loss defined not on the original output , but on the worst-case output produced by the verification method . Many methods along this line have been proposed in the past few years ( Wong & Kolter , 2018 ; Wong et al. , 2018 ; Mirman et al. , 2018 ; Gowal et al. , 2018 ; Raghunathan et al. , 2018a ; Zhang et al. , 2020a ) . Among these methods , Interval Bound Propagation ( IBP ) ( Mirman et al. , 2018 ; Gowal et al. , 2018 ) is a simple but effective and efficient method for certified robust training . It simply propagates the interval bound of each neuron through the network in the forward pass to obtain output bounds of the network . Most of the latest state-ofthe-art certified defense methods are still at least partly based on IBP training ( Zhang et al. , 2020a ; Shi et al. , 2021 ; Lyu et al. , 2021 ; Zhang et al. , 2021 ) . Despite being one of the most successful certified defense methods , the convergence properties of IBP training remained unknown . For natural neural network training ( training without considering adversarial perturbation , aka standard training ) , it has been shown that gradient descent for overparameterized networks can provably converge to a global minimizer with random initialization ( Li & Liang , 2018 ; Du et al. , 2019b ; a ; Jacot et al. , 2018 ; Allen-Zhu et al. , 2019 ; Zou et al. , 2018 ) . Compared to natural neural network training , IBP-based robust training has a very different training scheme , and thus requires a different convergence analysis . First , in the robust training problem , input data can contain adversarial perturbations , and the training objective is to minimize a robust loss rather than a natural loss . Second , IBP training essentially optimizes an augmented network which contains IBP bound computation rather than standard neural networks , as illustrated in Zhang et al . ( 2020a ) . Third , in IBP training , the activation state of each neuron depends on the certified bounds rather than the value in natural neural network computation , and this introduces additional perturbation-related terms in the convergence analysis for IBP . In this paper , we conduct a theoretical analysis to study the convergence of IBP training . Following recent convergence analysis on Stochastic Gradient Descent ( SGD ) for natural training , we consider IBP robust training with gradient flow ( gradient descent with infinitesimal step size ) for a two-layer overparameterized neural network on a classification task . We summarize our contributions below : • We provide the first convergence analysis for IBP-based certified robust training . On a two-layer overparameterized ReLU network with logistic loss , with sufficiently small perturbation radius and large network width , gradient flow with IBP has a linear convergence rate , and is guaranteed to converge to zero training error with high probability . • Our result implies that IBP converges to a state where the certified robust accuracy measured by IBP bounds tightly reflects the true robustness of the network . • We show additional perturbation-related conditions required to guarantee the convergence of IBP training so far , and identify additional challenges in the convergence analysis for IBP training compared to standard training . 2 RELATED WORK . 2.1 CERTIFIED ROBUST TRAINING . The goal of certified robust training is to maximize the robust accuracy of the model under the evaluation by provable robustness verifiers . Some works add heuristic regularizations during adversarial training to improve certified robustness ( Xiao et al. , 2019 ; Balunovic & Vechev , 2020 ) . Some others optimize a certified robust loss which is a certified upper bound of the loss function under all considered perturbations , computed from certified bounds by robustness verifiers . Among them , Wong & Kolter ( 2018 ) ; Mirman et al . ( 2018 ) ; Dvijotham et al . ( 2018 ) ; Wong et al . ( 2018 ) ; Wang et al . ( 2018a ) used verification with linear relaxation for nonlinear activation functions , and Raghunathan et al . ( 2018b ) used semi-definite relaxation . However , Interval Bound Propagation ( IBP ) ( Mirman et al. , 2018 ; Gowal et al. , 2018 ) which computes and propagates an interval lower and upper bound for each neuron , has been shown as efficient and effective and can even outperform methods using more complicated relaxation as partly discussed by Lee et al . ( 2021 ) ; Jovanović et al . ( 2021 ) . At least partly based on IBP , Zhang et al . ( 2020a ) combined IBP with linear relaxation bounds ; Lyu et al . ( 2021 ) designed a parameterized activation ; Zhang et al . ( 2021 ) designed a 1-Lipschitz layer with ` ∞-norm computation before layers using IBP ; Shi et al . ( 2021 ) improved IBP training with shortened training schedules . Yet , the state-of-the-art methods still contain IBP as an important part , and thus we focus on analyzing the convergence of IBP training in this paper . On the theoretical analysis for IBP bounds , Baader et al . ( 2020 ) analyzed the universal approximation of IBP verification bounds , and Wang et al . ( 2020 ) extended the analysis to other activation functions beyond ReLU . However , to the best of our knowledge , there is still no existing work analyzing the convergence of IBP training . The aforementioned methods for certified robustness target at robustness with deterministic certification . There are also some other works on probabilistic certification such as randomized smoothing ( Cohen et al. , 2019 ; Li et al. , 2019 ; Salman et al. , 2019 ) which is out of our scope . 2.2 CONVERGENCE OF STANDARD NEURAL NETWORK TRAINING . There have been many works analyzing the convergence of standard neural network training . For two-layer ReLU neural networks with quadratic loss , Du et al . ( 2019b ) proved that randomly initialized gradient descent can converge to a globally optimum with a large enough network width m which is polynomial in the number of training examples n. Ji & Telgarsky ( 2019 ) pushed the requirement of network width m to a polylogarithmic function . For deep neural networks , Allen-Zhu et al . ( 2019 ) proved that for randomly initialized ReLU deep neural networks , gradient descent has a linear convergence rate for various loss functions with width polynomial in network depth and number of training examples . And Chen et al . ( 2019 ) proved that a polylogarithmic width is also sufficient for deep neural networks to converge to the optimal point . However , these works only focus on standard training , and can not be directly adapted to the robust training setting . 2.3 CONVERGENCE OF EMPIRICAL ADVERSARIAL TRAINING . Robust training including both certified training and empirical adversarial training is essentially a min-max optimization . For a training data distribution X , the objective for learning a model fθ parameterized by θ can be written as1 : arg min θ E ( x , y ) ∼X max ∆∈S ` ( fθ ( x + ∆ ) , y ) , ( 1 ) where ( x , y ) is an example sampled from X , ` ( · , y ) is the loss function for ground truth y , S is the space of all possible perturbations . Empirical adversarial training approximately solves the inner minimization by running adversarial attacks . Some works have analyzed the convergence of adversarial training . Wang et al . ( 2019 ) considered a first-order stationary condition for solving the inner constrained maximization problem . Gao et al . ( 2019 ) ; Zhang et al . ( 2020b ) showed that overparameterized networks with projected gradient descent can converge to a state where the surrogate robust loss by adversarial attack is close to the true robust loss ( i.e. , the inner maximization by adversarial attack is mostly optimal ) and the robust loss is close to 0 . Zou et al . ( 2021 ) showed that adversarial training provably learns robust halfspaces in the presence of noise . However , there is a significant difference between empirical adversarial training and IBP training . In adversarial training , there is a concrete perturbation ∆ generated for the inner maximization , and there is a concrete adversarial input x+ ∆ . However , in IBP-based training , the inner maximization is computed from certified bounds , where for each layer , the interval certified bounds of each neuron are computed independently . Thereby , the certified bounds of the network generally no longer correspond to any concrete ∆ . Due to this significant difference , prior theoretical analysis on adversarial training , which required there to be a concrete ∆ for inner maximization , is not applicable to IBP . 3 PRELIMINARIES . 3.1 NEURAL NETWORKS . We consider a similar network architecture as used in Du et al . ( 2019b ) – a two-layer ReLU network . Unlike Du et al . ( 2019b ) which considered a regression task with a square loss , here we consider a classification task where IBP is usually used , and we consider binary classification for simplicity . On a training dataset { ( xi , yi ) } ni=1 , for every i ∈ [ n ] , ( xi , yi ) is a training example with d-dimensional input xi ( xi∈Rd ) and label yi ( yi∈ { ±1 } ) , and the network output is : f ( W , a , xi ) = 1√ m m∑ r=1 arσ ( w > r xi ) , ( 2 ) where m is the width of hidden layer ( the first layer ) in the network , W ∈ Rm×d is the weight matrix of the hidden layer , wr ( r ∈ [ m ] ) is the r-th row of W , a ∈ Rm is the weight vector of the second layer ( output layer ) with elements a1 , · · · , am , and σ ( · ) is the activation function . We assume the activation is ReLU as IBP is typically used with ReLU . For initialization , we set ar ∼ 1Here we use notations to denote the general robust training problem , but in our later theoretical analysis , we will have different notations for a simplified problem setting . unif [ { 1 , −1 } ] and wr ∼N ( 0 , I ) . Following Du et al . ( 2019b ) , we assume the second layer is fixed after initialization , and we only train the first layer . Since we consider binary classification , we use a logistic loss . For training example ( xi , yi ) , we define ui ( W , a , xi ) : = yif ( W , a , xi ) , and then the loss for this example is computed as l ( ui ( W , a , xi ) ) = log ( 1 + exp ( −ui ( W , a , xi ) ) ) , and the standard training loss on the whole training set is L = n∑ i=1 l ( ui ( W , a , xi ) ) = n∑ i=1 log ( 1 + exp ( −ui ( W , a , xi ) ) ) . ( 3 )

Summary: Training deep neural networks in the presence of adversarial perturbations (in the input data) is a very active research topic. There are lots of works defining notions of robustness, proposing solution algorithms, and introducing algorithmic improvements. Several of the recent techniques involve or extend the interval bound propagation (IBP) technique. However, there is no work analysing the convergence of IBP even in its simplest setting. In this paper, the author(s) analyse the convergence of IBP in a simplified setting for the first time.