Efficient Certification for Probabilistic Robustness

1 Introduction . Neural networks have found great success in a wide variety of applications . For many of these applications , understanding when and how a neural network can fail is crucial . Szegedy et al . ( 2014 ) found that almost visually imperceptible perturbations of input images could drastically change the output of a neural network . This realization set off a large area of research , both in finding ways of attacking neural networks and developing defense and certification methods against said attacks . The most common setting which is considered is the worst-case robustness given an lp norm . There have been a number of adversarial robustness certification methods which operate by finding provable lp balls for which the output of the neural network is guaranteed to be constant . In other words , they find lower bounds on the minimum lp radius for which an adversarial attack exists . This is done by relaxing the network for a bounded domain . Convex relaxations are typically used ( Salman et al. , 2019 ) , although some works also consider quadratic program formulations ( Raghunathan et al. , 2018 ) . Note that these are input-specific , so they do not give guarantees about the entire input domain . As opposed to the worst-case adversarial robustness , there is also great interest in the threat model where the primary concern is natural noise and corruption rather than a malicious adversary and thus the perturbations follow some probability distribution . Typical neural networks have been found to be vulnerable to common corruptions ( Dodge & Karam , 2016 ; Geirhos et al. , 2018 ) . We distinguish between these two notions of robustness as adversarial robustness and probabilistic robustness . We note that the terms such as corruption robustness , probability of violation , and adversarial density have also been used to refer to the general concept of probabilistic robustness . For the threat model of natural noise and corruption , there has not been as much work developed as for worst-case adversarial robustness . One of the very first probabilistic verification algorithms without imposing assumptions on the decision boundary is known as the PROVEN algorithm ( Weng et al. , 2019 ) . In PROVEN , the authors derive probabilistic verification bounds based on existing worst-case robustness verification such as Fast-Lin and CROWN ( Weng et al. , 2018 ; Zhang et al. , 2018 ) . Contributions . In this work , we generalize the PROVEN algorithm proposed by Weng et al . ( 2019 ) to infinite support and greatly improve the tightness of the robustness certificate without additional computation cost . We name our algorithm I-PROVEN , as the proposed algorithm is a significantly improved version of PROVEN algorithm . The I-PROVEN algorithm can achieve significant improvements ( 2×-8× tighter ) on the tightness of probabilistic robustness certificate for both MNIST and CIFAR-10 models without additional computation cost , and it also enables the certification of probability distributions with infinite support . Based on our proposed algorithm , we conduct a case study on augmenting an existing training pipeline with probabilistic robustness verification bounds , and we find mixed results for the training . We examine potential causes and implications . 2 Background and related works . Notation . In order to describe related work in depth , we will lay out some notation . We define a K-layer feed-forward ReLU neural network with n0 inputs and nK outputs f : Rn0 → RnK as f ( x ) = f ( K ) ( x ) f ( i+1 ) ( x ) =W ( i+1 ) σ ( f ( i ) ( x ) ) + b ( i+1 ) f ( 1 ) ( x ) =W ( 1 ) x+ b ( 1 ) In other words , f ( i ) ( x ) denotes the vector of pre-activation values in the ith layer . Generally , we work in the setting of image classifiers where a class c is classified over a class i if fc ( x ) − fi ( x ) > 0 . To simplify notation , we assume that the neural networks f which we are working with have already had this margin function applied to it for some given c , i . In other words , we assume nK = 1 for convenience and we are interested in when f ( x ) > 0 . 2.1 Adversarial robustness verification . Adversarial robustness verification asks , given a neural network f and a region R ( ) in the input space , does there exist an x ∈ R ( ) such that f ( x ) ≤ 0 ? To solve this problem , we can formulate it as an equivalent optimization problem : minx∈R ( ) f ( x ) . If no such x such that f ( x ) ≤ 0 exists , or equivalently , if the minimum f ( x ) is positive , then f is robust for region R ( ) . If we can prove that f is robust on regions R ( ) for all ≤ , then the robustness certificate is . The robustness certificate is a lower bound for the true minimum distortion ∗ . The regions R ( ) of general interest are Lp balls Bp ( x0 , ) for a given image or input x0 . This arises from the interpretation that an adversary is perturbing x0 by at most under a given Lp norm . Note that certification only informs robustness about a single image . As far as we know , it is infeasible to certify an entire dataset other than processing it image by image . Convex relaxation for provable verification . These methods find a convex relaxation of a neural network in order to find provable certifications for its adversarial robustness . We will discuss these methods in detail as our method builds on them in certain ways . There are a number of works following these methods ( Weng et al. , 2018 ; Singh et al. , 2018 ; Zhang et al. , 2018 ; Singh et al. , 2019b ) , and a general framework for them is described in ( Salman et al. , 2019 ) . We will use the setup used in CROWN ( Zhang et al. , 2018 ) . In these methods , inequalities on pre-activation neurons are recursively computed l ( j ) ≤ A ( j ) L x+ b ( j ) L ≤ f ( j ) ( x ) ≤ A ( j ) U x+ b ( j ) U ≤ u ( j ) for each layer j . Note that these are element-wise bounds , l ( j ) and u ( j ) are scalar vectors , and A ( j ) L , b ( j ) L , A ( j ) U , b ( j ) U are linear transformations of inputs x . These linear bounds are obtained by relaxing the non-linear activation functions to linear lower and upper bounds given that the inputs to the activation functions are within some interval found from the inequalities applied to earlier layers , l ( i ) , u ( i ) , i < j . These inequalities are propagated backwards through the network until the original input is reached . Under the typical lp ball threat model , Hölder ’ s inequality can give scalar bounds on these layers and the process can continue to the final outputs . ( Singh et al. , 2019a ; Tjandraatmadja et al. , 2020 ) have made progress on improving these bounds beyond the convex relaxation gap pointed out by Salman et al . ( 2019 ) by considering the activation functions on multiple neurons jointly . 2.2 Probabilistic robustness . For probabilistic robustness , we are considering a known probability distribution D : Rn → [ 0 , 1 ] which the inputs x are sampled from . We will focus on additive iid uniform noise which we denote , in an abuse of notation , as B∞ ( x , ) . In other words , B∞ ( x , ) is the distribution generated by sampling points evenly from the hyperrectangle [ x1 − , x1 + ] × [ x2 − , x2 + ] × · · · × [ xn − , xn + ] . Then the problem of probabilistic robustness verification is to verify that Prx∼D [ f ( x ) > 0 ] ≥ 1−Q ( 1 ) for some given failure probability Q . We can define the robustness certificate similarly to how it was done for adversarial robustness . Weng et al . ( 2019 ) and Anderson & Sojoudi ( 2020 ) particularly consider the maximum parameterizing D for which the above holds and we also provide such results . This is found by binary searching over , as empirically we find that the robustness is monotonic in for the distributions we consider , but we note that there are no theoretical guarantees for this . Sampling methods . Sampling gives well-established statistical guarantees which can be applied to the problem of probabilistic robustness . By using the neural network essentially as a black-box , Chernoff bounds can estimate the probability of the neural network giving the incorrect classification given a distribution . This has the advantage of making no assumptions on the model or the distribution , but requires a large number of samples to achieve a high degree of accuracy and there is an inherent uncertainty present in the application of such an algorithm . Baluta et al . ( 2021 ) notes for example , that proving that the probability is between [ 0.1− 0.5× 10−4 , 0.1 + 0.5× 10−4 ] with a confidence of 0.9 would require 5.5× 106 samples . To overcome this , they propose a framework which reduces the number of samples necessary , although this is dependent on the true probability . Anderson & Sojoudi ( 2020 ) also provide a method that can find upper bounds on the probability that a model is incorrect with a small number of samples . Webb et al . ( 2018 ) uses a clever sampling method that leverages the layered structure of common architectures . They require upwards of 107 samples but are able to obtain precise estimations . Though they are unable to provide theoretical guarantees , they show that empirically , their estimations agree with naive Monte Carlo estimates with as many as 1010 samples . 2.3 Training adversarially-robust models . Training methods for improving adversarial robustness have generally taken two paths . The first augments the data with adversarial attacks in order to strengthen a model ’ s resistance to such attacks ( Madry et al. , 2017 ) . The second approach adds loss regularization terms that help the model learn robust features of the data . Xiao et al . ( 2018 ) identifies weight sparsity and ReLU stability as important factors in a model ’ s adversarial robustness and builds a training framework which incorporates these . Other works use certification methods as regularization terms in order to improve the certifiable robustness of a model . Interval bound propagation ( IBP ) has found great success in this despite being a relatively loose certification method ( Gowal et al. , 2019 ) . In particular , the efficiency of IBP has made it amenable to training . A number of other works have made progress in closing this efficiency gap ( Zhang et al. , 2019 ; Xu et al. , 2020 ; Shi et al. , 2021 ; Boopathy et al. , 2021 ) .

Summary: This work considers problem of local robustness where each input is perturbed according to some probability distribution (e.g. uniform distribution over the L-infinity ball). Proposed approach is based on extending an approach proposed by prior work which uses linear bounds to compute bounds on the output of the network. The key contribution is computing the probabilistic bounds for inner layers, and not only the final one as was done in prior work. Authors show that their approach improves over prior work on MNIST and CIFAR-10 datasets.