Towards certifying $\ell_\infty$ robustness using Neural networks with $\ell_\infty$-dist Neurons

1 INTRODUCTION . Modern neural networks are usually sensitive to small , adversarially chosen perturbations to the inputs ( Szegedy et al. , 2013 ; Biggio et al. , 2013 ) . Given an image x that is correctly classified by a neural network , a malicious attacker may find a small adversarial perturbation δ such that the perturbed image x + δ , though visually indistinguishable from the original image , is assigned to a wrong class with high confidence by the network . Such vulnerability creates security concerns in many real-world applications . Developing a model that can resist small ` ∞ perturbations has been extensively studied in the literature . Adversarial training methods ( Szegedy et al. , 2013 ; Madry et al. , 2017 ; Goodfellow et al. , 2015 ; Huang et al. , 2015 ; Athalye et al. , 2018 ; Ding et al. , 2020 ) first learn on-the-fly adversarial examples of the inputs , and then update model parameters using these perturbed samples together with the original labels . Such approaches are restricted to a particular ( class of ) attack method and can not be formally guaranteed whether the resulting model is robust against other attacks . Another line of algorithms trains robust models by maximizing the certified radius provided by robust certification methods . Weng et al . ( 2018 ) ; Wong & Kolter ( 2018a ) ; Zhang et al . ( 2018 ) ; Mirman et al . ( 2018 ) ; Wang et al . ( 2018 ) ; Gowal et al . ( 2018 ) ; Zhang et al . ( 2019b ) develop their methods based on linear or convex relaxations of fully connected ReLU networks . However , the certification methods are usually computationally expensive and can only handle ReLU activations . Cohen et al . ( 2019 ) ; Salman et al . ( 2019 ) ; Zhai et al . ( 2020 ) show that a certified guarantee on small ` 2 perturbations can be easily computed for general Gaussian smoothed classifiers . But recent works suggest that such methods are hard to extend to the ` ∞-perturbation scenario . In this work , we overcome the challenge mentioned above by introducing a new type of neural network that naturally resists local adversarial attacks and can be easily certified under the ` ∞ perturbation . In particular , we propose a novel neuron called ` ∞-dist neuron . Unlike the standard neuron design that uses a non-linear activation after a linear transformation , the ` ∞-dist neuron is purely based on computing the ` ∞ distance between the inputs and the parameters . It is straightfor- ward to see that such a neuron is 1-Lipschitz with respect to the ` ∞ norm and the neural networks constructed with ` ∞-dist neuron ( ` ∞-dist Nets ) enjoy the same property . Based on such a property , we can obtain the certified robustness for any ` ∞-dist Nets using the margin of the prediction outputs . Theoretically , we investigate the expressive power of ` ∞-dist Nets and its adversarially robust generalization ability . We first prove a Lipschitz-universal approximation theorem for ` ∞-dist Net using a structured approach , which shows that ` ∞-dist Nets can approximate any 1-Lipschitz function with respect to ` ∞ norm . We then give upper bounds of robust test error based on the Rademacher complexity , which shows that the robust test error would be small if the ` ∞-dist Net learns a large margin classifier on the training data . Both results demonstrate the excellent capability and generalization ability of the ` ∞-dist Net function class . The ` ∞-dist Nets have nice theoretical guarantees , but empirically , training an ` ∞-dist Net is not easy . For example , the gradient of the parameters in the ` ∞ norm is sparse , which makes the optimization inefficient . We show how to initialize the model parameters , apply proper normalization , and overcome the sparse gradient problem via smoothed approximated gradients . Preliminary experiments on MNIST and Fashion-MNIST show that even without using adversarial training , the learned networks are already provably robust . Our contributions are summarized as follows : • We propose a novel neural network using ` ∞-dist neurons , called ` ∞-dist Nets . Theoretically , – In Section 3 , we show that ` ∞-dist Nets are 1-Lipschitz with respect to the ` ∞ norm in nature , which directly guarantees the certified robustness of any ` ∞-dist Net ( with respect to the ` ∞ norm ) . – In Section 4.1 , we prove that ` ∞-dist Nets have good expressive power as it can approximate any 1-Lipschitz function with respect to the ` ∞ norm . – In Section 4.2 , we prove that ` ∞-dist Nets have good generalization ability as the robust test error can be upper-bounded by the performance of a large margin classifier on the training data . • We provide several implementation strategies which are shown to be practically helpful for model training ( in Section 5 ) . 2 RELATED WORKS . There are two major lines of works seeking to get robust neural networks : Robust Training Approaches . Previous works showed that the conventional neural networks learned using standard training approaches ( e.g. , maximum likelihood method ) are sensitive to small adversarial perturbations , and significant efforts have been put on developing training approaches for learning robust models . Adversarial training is the most successful method against adversarial attacks . By adding adversarial examples to the training set on the fly , adversarial training methods ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ; Huang et al. , 2015 ; Zhang et al. , 2019a ; Wong et al. , 2020 ) can significantly improve the robustness of the conventional neural networks . However , all the methods above are evaluated according to the empirical robust accuracy against pre-defined adversarial attack algorithms , such as projected gradient decent . It can not be formally guaranteed whether the resulting model is also robust against other attacks . Certified Robustness . Many recent works focus on certifying the robustness of learned neural networks under any attack . Approaches based on bounding the certified radius layer by layer using some convex relaxation methods have been proposed for certifying the robustness of neural networks ( Wong & Kolter , 2018b ; Gowal et al. , 2018 ; Mirman et al. , 2018 ; Dvijotham et al. , 2018 ; Raghunathan et al. , 2018 ; Zhang et al. , 2020 ) . However , such approaches are usually computationally expensive and have difficulties in scaling to deep models . More recently , researchers found a new approach called randomized smoothing that can provide a certified robustness guarantee for general models . Lecuyer et al . ( 2018 ) ; Li et al . ( 2018 ) ; Cohen et al . ( 2019 ) ; Salman et al . ( 2019 ) ; Zhai et al . ( 2020 ) showed that if a Gaussian random noise is added to the input layer , a certified guarantee on small ` 2 perturbations can be computed for Gaussian smoothed classifiers . However , Yang et al . ( 2020 ) ; Blum et al . ( 2020 ) ; Kumar et al . ( 2020 ) showed that randomized smoothing can not achieve nontrivial certified accuracy against more than Ω ( min ( 1 , d1/p−1/2 ) ) radius for ` p perturbations , where d is the input dimension , therefore it can not provide meaningful results for ` ∞ perturbations due to the curse of dimensionality . Another line of more conservative certification approaches sought to bound the global Lipschitz constant of the neural network ( Gouk et al. , 2018 ; Tsuzuku et al. , 2018 ; Anil et al. , 2019 ; Cisse et al. , 2017 ) . However , the bounds are not tight ( Cohen et al. , 2019 ) , and the final robustness performances are not as good as other certification methods . 3 ` ∞-DIST NETWORK AND ITS ROBUSTNESS GUARANTEE . 3.1 PRELIMINARIES . Throughout this paper , we will use bold letters to denote vectors and otherwise scalars . Consider a standard classification task with an underlying data distribution D over pairs of examples x ∈ X and corresponding labels y ∈ Y = { 1 , 2 , · · · , M } . Usually D is unknown and we can only access a training set T = { ( x1 , y1 ) , · · · , ( xn , yn ) } in which ( xi , yi ) is i.i.d . drawn from D , i = 1 , 2 , · · · , n. Let f ∈ F be the classifier of interest that maps any x ∈ X to Y . We call x′ = x+δ an adversarial example of x to classifier f if f can correctly classify x but assigns a different label to x′ . In real practice , the most commonly used setting is to consider the attack under -bounded ` ∞ norm constraint , i.e. , δ satisfies ‖δ‖∞ ≤ , which is also called ` ∞ perturbations . Our goal is to learn a model from T that can resist attacks at ( x , y ) with high probability over ( x , y ) ∼ D for any small ` ∞ perturbations . It relates to compute the radius of the largest ` ∞ ball centered at x in which f does not change its prediction . This radius is called the robust radius , which is defined as ( Zhai et al. , 2020 ; Zhang et al. , 2019a ) : R ( f ; x , y ) = { inf f ( x′ ) 6=f ( x ) ‖x′ − x‖∞ , when f ( x ) = y 0 , when f ( x ) 6= y ( 1 ) Unfortunately , computing the robust radius ( 1 ) of a classifier induced by a standard deep neural network is very difficult . For example , Weng et al . ( 2018 ) showed that computing the ` p robust radius of a deep neural network is NP-hard for some specific p. Researchers then seek to derive a tight lower bound of R ( f ; x , y ) for general f . This lower bound is called certified radius and we denote it as CR ( f ; x , y ) . The certified radius satisfies 0 ≤ CR ( f ; x , y ) ≤ R ( f ; x , y ) for any f , x , y . 3.2 NETWORKS WITH ` ∞-DIST NEURONS . In this subsection , we propose the ` ∞-dist Neuron that is inherently Lipschitz with respect to ` ∞ norm . Using these neurons as building blocks , we then show how to obtain an ` ∞-Lipschitz neural networks dubbed ` ∞-dist Net . Denote z as the input vector to a neuron . A standard neuron processes the input by first projecting z to a scalar value using a linear transformation , and then applying an non-linear activation function σ on it , i.e. , σ ( w > z + b ) . w and b are parameters , and function σ can be the sigmoid or ReLU activation . Unlike the previous design paradigm , we introduce a new type of neuron using ` ∞ distance as the basic operation , which we call ` ∞-dist neuron : u ( z , θ ) = ‖z −w‖∞ + b , ( 2 ) where θ = { w , b } is the parameter set . From the above equation , we can see that the ` ∞-dist neuron is non-linear as it calculates the ` ∞ distance between input z and parameter w with a bias term b . As a result , there is no need to further apply a non-linear activation function . Without loss of generality , we study the properties of multi-layer perceptron ( MLP ) networks that are constructed using ` ∞-dist neurons . All theoretical results can be easily extended to other neural network architectures , such as convolutional neural nets . We use x ∈ Rdinput to denote the input vector of an MLP network . A ( MLP ) network using ` ∞-dist neurons can be formally defined as follows . Definition 3.1 . ( ` ∞-dist Net ) Denote g as an MLP network which takes x ( 1 ) , x ∈ Rdinput as input . Assume there are L hidden layers and the l-th hidden layer contains dl hidden units . We call g is an MLP network constructed by ` ∞-dist neurons , if the k-th unit in the l-th hidden layer x ( l+1 ) k is computed by x ( l+1 ) k = u ( x ( l ) , θ ( l , k ) ) = ‖x ( l ) −w ( l , k ) ‖∞ + b ( l , k ) , 0 < l ≤ L , 0 < k ≤ dl , where x ( l ) = ( x ( l ) 1 , x ( l ) 2 , · · · , x ( l ) dl−1 ) is the input vector to the l-th hidden layer . For simplicity , we will call an MLP network constructed by ` ∞-dist neurons as ` ∞-dist Net . For classification tasks , the dimensionality of the output of g matches the number of categories , i.e. , M . We write g ( x ) = ( g1 ( x ) , g2 ( x ) , · · · , gM ( x ) ) and define the predictor f ( x ) = arg maxi∈ [ M ] gi ( x ) . Note that g ( x ) can be used as the output logits the same as in any other networks , so we can apply any standard loss function on the ` ∞-dist Net , such as the cross-entropy loss or hinge loss . We will further show that the ` ∞-dist neuron and the neural networks constructed using it have nice theoretical properties to control the robustness of the model . For completeness , we first introduce the definition of Lipschitz functions as below . Definition 3.2 . ( Lipschitz Function ) A function g ( z ) : Rm → Rn is called λ-Lipschitz with respect to ` p norm ‖ · ‖p , if for any z1 , z2 , the following holds : ‖g ( z1 ) − g ( z2 ) ‖p ≤ λ‖z1 − z2‖p It is straightforward to see that the ` ∞-dist neuron is 1-Lipschitz with respect to ` ∞ norm .

Summary: The contribution of the paper is threefold: First, it proposes a novel variation of AdderNet (Chen et al. 2020) that ensures the network is always 1-Lipschitz with respect to $\ell_{\infty}$ norm. The architecture allows one to generate robustness certificates with respect to $\ell_{\infty}$ norm with only a single forward pass, which is computationally cheap compared to many of the previous methods. Second, it analyzes the expressive power and robust generalization of the architecture. Finally, it proposes two training techniques (bias batchnorm and p-norm schedule) that overcome the optimization problem inherent with training $\ell_{\infty}$ Net and analyzes its empirical performance with respect to the previous methods.