Efficient Certification for Probabilistic Robustness

1 Introduction . Neural networks have found great success in a wide variety of applications . For many of these applications , understanding when and how a neural network can fail is crucial . Szegedy et al . ( 2014 ) found that almost visually imperceptible perturbations of input images could drastically change the output of a neural network . This realization set off a large area of research , both in finding ways of attacking neural networks and developing defense and certification methods against said attacks . The most common setting which is considered is the worst-case robustness given an lp norm . There have been a number of adversarial robustness certification methods which operate by finding provable lp balls for which the output of the neural network is guaranteed to be constant . In other words , they find lower bounds on the minimum lp radius for which an adversarial attack exists . This is done by relaxing the network for a bounded domain . Convex relaxations are typically used ( Salman et al. , 2019 ) , although some works also consider quadratic program formulations ( Raghunathan et al. , 2018 ) . Note that these are input-specific , so they do not give guarantees about the entire input domain . As opposed to the worst-case adversarial robustness , there is also great interest in the threat model where the primary concern is natural noise and corruption rather than a malicious adversary and thus the perturbations follow some probability distribution . Typical neural networks have been found to be vulnerable to common corruptions ( Dodge & Karam , 2016 ; Geirhos et al. , 2018 ) . We distinguish between these two notions of robustness as adversarial robustness and probabilistic robustness . We note that the terms such as corruption robustness , probability of violation , and adversarial density have also been used to refer to the general concept of probabilistic robustness . For the threat model of natural noise and corruption , there has not been as much work developed as for worst-case adversarial robustness . One of the very first probabilistic verification algorithms without imposing assumptions on the decision boundary is known as the PROVEN algorithm ( Weng et al. , 2019 ) . In PROVEN , the authors derive probabilistic verification bounds based on existing worst-case robustness verification such as Fast-Lin and CROWN ( Weng et al. , 2018 ; Zhang et al. , 2018 ) . Contributions . In this work , we generalize the PROVEN algorithm proposed by Weng et al . ( 2019 ) to infinite support and greatly improve the tightness of the robustness certificate without additional computation cost . We name our algorithm I-PROVEN , as the proposed algorithm is a significantly improved version of PROVEN algorithm . The I-PROVEN algorithm can achieve significant improvements ( 2×-8× tighter ) on the tightness of probabilistic robustness certificate for both MNIST and CIFAR-10 models without additional computation cost , and it also enables the certification of probability distributions with infinite support . Based on our proposed algorithm , we conduct a case study on augmenting an existing training pipeline with probabilistic robustness verification bounds , and we find mixed results for the training . We examine potential causes and implications . 2 Background and related works . Notation . In order to describe related work in depth , we will lay out some notation . We define a K-layer feed-forward ReLU neural network with n0 inputs and nK outputs f : Rn0 → RnK as f ( x ) = f ( K ) ( x ) f ( i+1 ) ( x ) =W ( i+1 ) σ ( f ( i ) ( x ) ) + b ( i+1 ) f ( 1 ) ( x ) =W ( 1 ) x+ b ( 1 ) In other words , f ( i ) ( x ) denotes the vector of pre-activation values in the ith layer . Generally , we work in the setting of image classifiers where a class c is classified over a class i if fc ( x ) − fi ( x ) > 0 . To simplify notation , we assume that the neural networks f which we are working with have already had this margin function applied to it for some given c , i . In other words , we assume nK = 1 for convenience and we are interested in when f ( x ) > 0 . 2.1 Adversarial robustness verification . Adversarial robustness verification asks , given a neural network f and a region R ( ) in the input space , does there exist an x ∈ R ( ) such that f ( x ) ≤ 0 ? To solve this problem , we can formulate it as an equivalent optimization problem : minx∈R ( ) f ( x ) . If no such x such that f ( x ) ≤ 0 exists , or equivalently , if the minimum f ( x ) is positive , then f is robust for region R ( ) . If we can prove that f is robust on regions R ( ) for all ≤ , then the robustness certificate is . The robustness certificate is a lower bound for the true minimum distortion ∗ . The regions R ( ) of general interest are Lp balls Bp ( x0 , ) for a given image or input x0 . This arises from the interpretation that an adversary is perturbing x0 by at most under a given Lp norm . Note that certification only informs robustness about a single image . As far as we know , it is infeasible to certify an entire dataset other than processing it image by image . Convex relaxation for provable verification . These methods find a convex relaxation of a neural network in order to find provable certifications for its adversarial robustness . We will discuss these methods in detail as our method builds on them in certain ways . There are a number of works following these methods ( Weng et al. , 2018 ; Singh et al. , 2018 ; Zhang et al. , 2018 ; Singh et al. , 2019b ) , and a general framework for them is described in ( Salman et al. , 2019 ) . We will use the setup used in CROWN ( Zhang et al. , 2018 ) . In these methods , inequalities on pre-activation neurons are recursively computed l ( j ) ≤ A ( j ) L x+ b ( j ) L ≤ f ( j ) ( x ) ≤ A ( j ) U x+ b ( j ) U ≤ u ( j ) for each layer j . Note that these are element-wise bounds , l ( j ) and u ( j ) are scalar vectors , and A ( j ) L , b ( j ) L , A ( j ) U , b ( j ) U are linear transformations of inputs x . These linear bounds are obtained by relaxing the non-linear activation functions to linear lower and upper bounds given that the inputs to the activation functions are within some interval found from the inequalities applied to earlier layers , l ( i ) , u ( i ) , i < j . These inequalities are propagated backwards through the network until the original input is reached . Under the typical lp ball threat model , Hölder ’ s inequality can give scalar bounds on these layers and the process can continue to the final outputs . ( Singh et al. , 2019a ; Tjandraatmadja et al. , 2020 ) have made progress on improving these bounds beyond the convex relaxation gap pointed out by Salman et al . ( 2019 ) by considering the activation functions on multiple neurons jointly . 2.2 Probabilistic robustness . For probabilistic robustness , we are considering a known probability distribution D : Rn → [ 0 , 1 ] which the inputs x are sampled from . We will focus on additive iid uniform noise which we denote , in an abuse of notation , as B∞ ( x , ) . In other words , B∞ ( x , ) is the distribution generated by sampling points evenly from the hyperrectangle [ x1 − , x1 + ] × [ x2 − , x2 + ] × · · · × [ xn − , xn + ] . Then the problem of probabilistic robustness verification is to verify that Prx∼D [ f ( x ) > 0 ] ≥ 1−Q ( 1 ) for some given failure probability Q . We can define the robustness certificate similarly to how it was done for adversarial robustness . Weng et al . ( 2019 ) and Anderson & Sojoudi ( 2020 ) particularly consider the maximum parameterizing D for which the above holds and we also provide such results . This is found by binary searching over , as empirically we find that the robustness is monotonic in for the distributions we consider , but we note that there are no theoretical guarantees for this . Sampling methods . Sampling gives well-established statistical guarantees which can be applied to the problem of probabilistic robustness . By using the neural network essentially as a black-box , Chernoff bounds can estimate the probability of the neural network giving the incorrect classification given a distribution . This has the advantage of making no assumptions on the model or the distribution , but requires a large number of samples to achieve a high degree of accuracy and there is an inherent uncertainty present in the application of such an algorithm . Baluta et al . ( 2021 ) notes for example , that proving that the probability is between [ 0.1− 0.5× 10−4 , 0.1 + 0.5× 10−4 ] with a confidence of 0.9 would require 5.5× 106 samples . To overcome this , they propose a framework which reduces the number of samples necessary , although this is dependent on the true probability . Anderson & Sojoudi ( 2020 ) also provide a method that can find upper bounds on the probability that a model is incorrect with a small number of samples . Webb et al . ( 2018 ) uses a clever sampling method that leverages the layered structure of common architectures . They require upwards of 107 samples but are able to obtain precise estimations . Though they are unable to provide theoretical guarantees , they show that empirically , their estimations agree with naive Monte Carlo estimates with as many as 1010 samples . 2.3 Training adversarially-robust models . Training methods for improving adversarial robustness have generally taken two paths . The first augments the data with adversarial attacks in order to strengthen a model ’ s resistance to such attacks ( Madry et al. , 2017 ) . The second approach adds loss regularization terms that help the model learn robust features of the data . Xiao et al . ( 2018 ) identifies weight sparsity and ReLU stability as important factors in a model ’ s adversarial robustness and builds a training framework which incorporates these . Other works use certification methods as regularization terms in order to improve the certifiable robustness of a model . Interval bound propagation ( IBP ) has found great success in this despite being a relatively loose certification method ( Gowal et al. , 2019 ) . In particular , the efficiency of IBP has made it amenable to training . A number of other works have made progress in closing this efficiency gap ( Zhang et al. , 2019 ; Xu et al. , 2020 ; Shi et al. , 2021 ; Boopathy et al. , 2021 ) .

Summary: In this paper, the authors consider a notion of statistical/probabilistic robustness which does not require a model to be robust to all inputs in a specified set, only a certain, high-probability subset of these inputs. The authors rely on a bound propagation methodology to compute the the probability that a given input property is violated. In particular, the authors expand a known methodology (PROVEN) for computing probabilistic robustness and show that in many cases their methodology is better than that of PROVEN.