Towards Stable and Efficient Training of Verifiably Robust Neural Networks

1 INTRODUCTION . The success of deep neural networks ( DNNs ) has motivated their deployment in some safety-critical environments , such as autonomous driving and facial recognition systems . Applications in these areas make understanding the robustness and security of deep neural networks urgently needed , especially their resilience under malicious , finely crafted inputs . Unfortunately , the performance of DNNs are often so brittle that even imperceptibly modified inputs , also known as adversarial examples , are able to completely break the model ( Goodfellow et al. , 2015 ; Szegedy et al. , 2013 ) . The robustness of DNNs under adversarial examples is well-studied from both attack ( crafting powerful adversarial examples ) and defence ( making the model more robust ) perspectives ( Athalye et al. , 2018 ; Carlini & Wagner , 2017a ; b ; Goodfellow et al. , 2015 ; Madry et al. , 2018 ; Papernot et al. , 2016 ; Xiao et al. , 2019b ; 2018b ; c ; Eykholt et al. , 2018 ; Chen et al. , 2018 ; Xu et al. , 2018 ; Zhang et al. , 2019b ) . Recently , it has been shown that defending against adversarial examples is a very difficult task , especially under strong and adaptive attacks . Early defenses such as distillation ( Papernot et al. , 2016 ) have been broken by stronger attacks like C & W ( Carlini & Wagner , 2017b ) . Many defense methods have been proposed recently ( Guo et al. , 2018 ; Song et al. , 2017 ; Buckman et al. , 2018 ; Ma et al. , 2018 ; Samangouei et al. , 2018 ; Xiao et al. , 2018a ; 2019a ) , but their robustness improvement can not be certified – no provable guarantees can be given to verify their robustness . In fact , most of these uncertified defenses become vulnerable under stronger attacks ( Athalye et al. , 2018 ; He et al. , 2017 ) . Several recent works in the literature seeking to give provable guarantees on the robustness performance , such as linear relaxations ( Wong & Kolter , 2018 ; Mirman et al. , 2018 ; Wang et al. , 2018a ; Dvijotham et al. , 2018b ; Weng et al. , 2018 ; Zhang et al. , 2018 ) , interval bound propagation ( Mirman et al. , 2018 ; Gowal et al. , 2018 ) , ReLU stability regularization ( Xiao et al. , 2019c ) , and distributionally ∗Work partially done during an internship at DeepMind . robust optimization ( Sinha et al. , 2018 ) and semidefinite relaxations ( Raghunathan et al. , 2018a ; Dvijotham et al. ) . Linear relaxations of neural networks , first proposed by Wong & Kolter ( 2018 ) , is one of the most popular categories among these certified defences . They use the dual of linear programming or several similar approaches to provide a linear relaxation of the network ( referred to as a “ convex adversarial polytope ” ) and the resulting bounds are tractable for robust optimization . However , these methods are both computationally and memory intensive , and can increase model training time by a factor of hundreds . On the other hand , interval bound propagation ( IBP ) is a simple and efficient method for training verifiable neural networks ( Gowal et al. , 2018 ) , which achieved state-of-the-art verified error on many datasets . However , since the IBP bounds are very loose during the initial phase of training , the training procedure can be unstable and sensitive to hyperparameters . In this paper , we first discuss the strengths and weakness of existing linear relaxation based and interval bound propagation based certified robust training methods . Then we propose a new certified robust training method , CROWN-IBP , which marries the efficiency of IBP and the tightness of a linear relaxation based verification bound , CROWN ( Zhang et al. , 2018 ) . CROWN-IBP bound propagation involves a IBP based fast forward bounding pass , and a tight convex relaxation based backward bounding pass ( CROWN ) which scales linearly with the size of neural network output and is very efficient for problems with low output dimensions . Additional , CROWN-IBP provides flexibility for exploiting the strengths of both IBP and convex relaxation based verifiable training methods . The efficiency , tightness and flexibility of CROWN-IBP allow it to outperform state-of-the-art methods for training verifiable neural networks with ` ∞ robustness under all settings on MNIST and CIFAR10 datasets . In our experiment , on MNIST dataset we reach 7.02 % and 12.06 % IBP verified error under ` ∞ distortions = 0.3 and = 0.4 , respectively , outperforming the state-of-the-art baseline results by IBP ( 8.55 % and 15.01 % ) . On CIFAR-10 , at = 2255 , CROWN-IBP decreases the verified error from 55.88 % ( IBP ) to 46.03 % and matches convex relaxation based methods ; at a larger , CROWN-IBP outperforms all other methods with a noticeable margin . 2 RELATED WORK AND BACKGROUND . 2.1 ROBUSTNESS VERIFICATION AND RELAXATIONS OF NEURAL NETWORKS . Neural network robustness verification algorithms seek for upper and lower bounds of an output neuron for all possible inputs within a set S , typically a norm bounded perturbation . Most importantly , the margins between the ground-truth class and any other classes determine model robustness . However , it has already been shown that finding the exact output range is a non-convex problem and NP-complete ( Katz et al. , 2017 ; Weng et al. , 2018 ) . Therefore , recent works resorted to giving relatively tight but computationally tractable bounds of the output range with necessary relaxations of the original problem . Many of these robustness verification approaches are based on linear relaxations of non-linear units in neural networks , including CROWN ( Zhang et al. , 2018 ) , DeepPoly ( Singh et al. , 2019 ) , Fast-Lin ( Weng et al. , 2018 ) , DeepZ ( Singh et al. , 2018 ) and Neurify ( Wang et al. , 2018b ) . We refer the readers to ( Salman et al. , 2019b ) for a comprehensive survey on this topic . After linear relaxation , they bound the output of a neural network fi ( · ) by linear upper/lower hyper-planes : Ai , :∆x + bL ≤ fi ( x0 + ∆x ) ≤ Ai , :∆x + bU ( 1 ) where a row vector Ai , : = W ( L ) i , : D ( L−1 ) W ( L−1 ) · · ·D ( 1 ) W ( 1 ) is the product of the network weight matrices W ( l ) and diagonal matrices D ( l ) reflecting the ReLU relaxations for output neuron i ; bL and bU are two bias terms unrelated to ∆x . Additionally , Dvijotham et al . ( 2018c ; a ) ; Qin et al . ( 2019 ) solve the Lagrangian dual of verification problem ; Raghunathan et al . ( 2018a ; b ) ; Dvijotham et al . propose semidefinite relaxations which are tighter compared to linear relaxation based methods , but computationally expensive . Bounds on neural network local Lipschitz constant can also be used for verification ( Zhang et al. , 2019c ; Hein & Andriushchenko , 2017 ) . Besides these deterministic verification approaches , randomized smoothing can be used to certify the robustness of any model in a probabilistic manner ( Cohen et al. , 2019 ; Salman et al. , 2019a ; Lecuyer et al. , 2018 ; Li et al. , 2018 ) . 2.2 ROBUST OPTIMIZATION AND VERIFIABLE ADVERSARIAL DEFENSE . To improve the robustness of neural networks against adversarial perturbations , a natural idea is to generate adversarial examples by attacking the network and then use them to augment the training set ( Kurakin et al. , 2017 ) . More recently , Madry et al . ( 2018 ) showed that adversarial training can be formulated as solving a minimax robust optimization problem as in ( 2 ) . Given a model with parameter θ , loss function L , and training data distribution X , the training algorithm aims to minimize the robust loss , which is defined as the maximum loss within a neighborhood { x+ δ|δ ∈ S } of each data point x , leading to the following robust optimization problem : min θ E ( x , y ) ∈X [ max δ∈S L ( x+ δ ; y ; θ ) ] . ( 2 ) Madry et al . ( 2018 ) proposed to use projected gradient descent ( PGD ) to approximately solve the inner max and then use the loss on the perturbed example x + δ to update the model . Networks trained by this procedure achieve state-of-the-art test accuracy under strong attacks ( Athalye et al. , 2018 ; Wang et al. , 2018a ; Zheng et al. , 2018 ) . Despite being robust under strong attacks , models obtained by this PGD-based adversarial training do not have verified error guarantees . Due to the nonconvexity of neural networks , PGD attack can only compute the lower bound of robust loss ( the inner maximization problem ) . Minimizing a lower bound of the inner max can not guarantee ( 2 ) is minimized . In other words , even if PGD-attack can not find a perturbation with large loss , that does not mean there exists no such perturbation . This becomes problematic in safety-critical applications since those models need certified safety . Verifiable adversarial training methods , on the other hand , aim to obtain a network with good robustness that can be verified efficiently . This can be done by combining adversarial training and robustness verification—instead of using PGD to find a lower bound of inner max , certified adversarial training uses a verification method to find an upper bound of the inner max , and then update the parameters based on this upper bound of robust loss . Minimizing an upper bound of the inner max guarantees to minimize the robust loss . There are two certified robust training methods that are related to our work and we describe them in detail below . Linear Relaxation Based Verifiable Adversarial Training . One of the most popular verifiable adversarial training method was proposed in ( Wong & Kolter , 2018 ) using linear relaxations of neural networks to give an upper bound of the inner max . Other similar approaches include Mirman et al . ( 2018 ) ; Wang et al . ( 2018a ) ; Dvijotham et al . ( 2018b ) . Since the bound propagation process of a convex adversarial polytope is too expensive , several methods were proposed to improve its efficiency , like Cauchy projection ( Wong et al. , 2018 ) and dynamic mixed training ( Wang et al. , 2018a ) . However , even with these speed-ups , the training process is still slow . Also , this method may significantly reduce a model ’ s standard accuracy ( accuracy on natural , unmodified test set ) . As we will demonstrate shortly , we find that this method tends to over-regularize the network during training , which is harmful for obtaining good accuracy . Interval Bound Propagation ( IBP ) . Interval Bound Propagation ( IBP ) uses a very simple rule to compute the pre-activation outer bounds for each layer of the neural network . Unlike linear relaxation based methods , IBP does not relax ReLU neurons and does not consider the correlations between neurons of different layers , yielding much looser bounds . Mirman et al . ( 2018 ) proposed a variety of abstract domains to give sound over-approximations for neural networks , including the “ Box/Interval Domain ” ( referred to as IBP in Gowal et al . ( 2018 ) ) and showed that it could scale to much larger networks than other works ( Raghunathan et al. , 2018a ) could at the time . Gowal et al . ( 2018 ) demonstrated that IBP could outperform many state-of-the-art results by a large margin with more precise approximations for the last linear layer and better training schemes . However , IBP can be unstable to use and hard to tune in practice , since the bounds can be very loose especially during the initial phase of training , posing a challenge to the optimizer . To mitigate instability , Gowal et al . ( 2018 ) use a mixture of regular and minimax robust cross-entropy loss as the model ’ s training loss .

Summary: This paper proposes a new method for training certifiably robust models that achieves better results than the previous SOTA results by IBP, with a moderate increase in training time. It uses a CROWN-based bound in the warm up phase of IBP, which serves as a better initialization for the later phase of IBP and lead to improvements in both robust and standard accuracy. The CROWN-based bound uses IBP to compute bounds for intermediate pre-activations and applies CROWN only to computing the bounds of the margins, which has a complexity between IBP and CROWN. The experimental results are verify detailed to demonstrate the improvement.