Tactics on Refining Decision Boundary for Improving Certification-based Robust Training
Authors: Wang Zhang
Lam M. Nguyen
Subhro Das
Pin-Yu Chen
Sijia Liu
Alexandre Megretski
Luca Daniel
Tsui-Wei Weng
Venue: ICLR 2022 Submitted (2022)
Keywords: adversarial robustness
certifiable training
deep learning

Abstract: In verification-based robust training, existing methods utilize relaxation based methods to bound the worst case performance of neural networks given certain perturbation. However, these certification based methods treat all the examples equally regardless of their vulnerability and true adversarial distribution, limiting the model's potential in achieving optimal verifiable accuracy. In the paper, we propose new methods to include the customized weight distribution and automatic schedule tuning methods on the perturbation schedule. These methods are generally applicable to all the verification-based robust training with almost no additional computational cost. Our results show improvement on MNIST with $\epsilon = 0.3$ and CIFAR on $\epsilon = 8/255$ for both IBP and CROWN-IBP based methods. 

Under review as a conference paper at ICLR 2022
TACTICS ON REFINING DECISION BOUNDARY FOR IMPROVING CERTIFICATION-BASED ROBUST TRAINING
Anonymous authors Paper under double-blind review
ABSTRACT
In certification-bass robust training, existing methods utilize relaxation based methods to bound the worst case performance neural networks given certain perturbation. However, these certification based methods treat all the examples equally regardless of their vulnerability and true adversarial distribution, limit- ing the model's 's potential in achieving optimal verifiable accuracy. In the paper, we propose new methods to include the customized weight distribution and auto- matic schedule tuning methods on the perturbation schedule. These methods are generally applicable to all the certifiable robust training with almost no additional computational cost. Our results show improvement on MNIST with 0.3 and CIFAR on 8/ 8/255 for both IBP and CROWN-IBP based methods.
INTRODUCTION
Deep neural networks (DNNs) have been shown to be highly vulnerable to adversarial attacks, durefully-crafted inputs that are nearly indistinguishable from naturally-occurrig data but mis- classified by the network (Goodfellow et al., 20144 Szegedy et al. 2014). There exist many algo- rithms for both crafting adversarial attacks (Papernot al. 2016) and building neural networks that are robust against such attacks. Fast gradient sign method (FGSM) (Goodfellow et al., 2014) was the very first approach to generate strong adversary. Projected gradient descent (PGD) (Madry al.) 2018) is one of the most successful and widely-used defense methods available. Adversarial training seeks minimize the worst-case loss under adversarial perturbations within a pre-defined pertur- bation level, where multi-step PGD is used to estimate the worst-case attack during training. Com- pared to standard training, the adversarial term introduces risk of over-fitting (Moosavi-Dezfooll) 2021 Rice et al. 22200 Wang al.) (211)) and training instability (Tsipras et al. 2019 | (2aag al., 2020b) for adversarial training. There exist many related works on improving the model perfor- mance by additional regulation (Zhang et al., 2020b Cisse et al. 2017) and customizing training curriculum (Zhang et al.) 2019 Wang et al. 2020 Cai et al. 2018) for uttack-based scenario. While adversarial training has been shown to be empirically effective against many types of attacks, it can- not be proven that the resultant models are robust against all adversaries. In fact, it has been shown that many defense methods dependent heuristic techniques, including adversarial training, can be bypassed by stronger adversaries (Athalye et al. 2018).
This has motivated separate branch of research focused on robustness certification/veriiccttto computing provable guarantees on the robustness performance of neural networks against inputs with arbitrary perturbations within some lp bounded ball. There are two main types of ver- ification methods: complete and incomplete verification. The former computes exact robustness bounds using camputationalll-expensst
methods such as mixed-integer programming (MIP) (Tjeng et al. 2019 Bunel et al.] 2018), whereas the latter provides looser robustness bounds with different branches of methods like randomized smoothing (Cohen et al. 2019 Salman et al.
2019 Lecuyer
al. 2019), Lipschitz-based robustness Trockman & Kolter 2021 Tsuzuku et al.)
2018 and con-
vex adversarial polytype (Weng et al.] 2018 Zhang et al.] 2018 Dvijotham et al. 2018b Gowal
lt al. 2019) which in this paper mainly focus. A sparsely related branch of research, called
certified robust training (Dvijotham et al., 20188] Gowal et al. (2019 Zhang et al. 2020a), aims to
train certifiably robust model. These methods compute verified robustness bounds and incorporate

---

Under review as a conference paper at ICLR 2022
them into the training process, such that the resultant models can then be proven be robust using a verification method.
Currently, the most efficient certified training method is interval bound propagation (IBP) (Gowal jct al., 2019). which requires only two additional forward passes during training. is important to note that IBP is significantly more efficient than adversarial training, which often require many PGD steps to achieve high robustness (Madry et al., 2018). In standard certified training, a uniform c and loss function weight are usually used across all the training examples, this not ideal for optimal verified accuracy since the examples are not necessarily equivalent in terms of vulnerability.
1.1 OUR CONTRIBUTIONS
In this paper, we propose two novel methods improve robustness via refining certified decision boundary for verifiable adversarial training methods such as IBP and CROWN-IBP. In particular, our algorithms are generally applicable all the verifiable adversarial training methods at almost no additional computational cost. We sum up the key contributions as following: 1. Zeng et al. (2020) pointed out the adversarial example distribution deviates from the clean data. We further analyze the importance weight to correct empirical distribution from novel perspective and theoretically prove more weight is needed for the examples closer to decision boundary sampled from clean data distribution. 2. Building upon previous analysis, come up with symmetrical re-weighting function based on worst case margin of the correct labels, emphasizing the examples around the decision boundary. 3. For verifiable adversarial perturbation, empirically slightly larger étrain achieves optimal evaluation robustness accuracy on Ceval. while this uniform setup is not ideal for examples around decision boundary. To address the issue of large perturbation, we developed an auto-tuning algorithm to customize the Etrain for each individual example.
BACKGROUND
2.1 ADVERSARIAL ATTACKS AND TRAINING
Let D = ((x;, y:)) represent the dataset, where æ; E X' and yi E E
1.. C- Let
B(x,, e) denote the set of points in the en-norm ball with radius around æ;. The objective function
is
min 71
Σ ((fo(z)) v.), where x arg max ((fo(x'), ((EB((
(1)
So X' - R. score function and RCC x y R the loss function. Adversarial training tackles this min-max problem by alternating between solving inner loop by attack method to estimate the worst-case adversarial scenario in B(x,, e) and outer loop to update the model parameters and minimize loss function.
2.2 CERTIFIED TRAINING
Robustness Verification. Different from attack-based training, certified training provides a guaran- tee for worst case scenario via bounding the neural network outputs. The certified accuracy is the lower bound of robustness accuracy under any attack method, thus improving the certified accuracy helps in understanding the potential of the neural network in defending against adversarial attacks.
Interval Bound Propagation. There have been many proposed neural network verification algo- rithms that can be used to compute worst case output. IBP (Gowal al. 2019) utilizes simple, interval arithmetic approach to propagate bounds through a network. Let 2 denote the input to a layer 2g. IBP bounds 2g by computing lower and upper bounds z Σg such that 2, S 2 S Σ holds element-wise. For affine layers represented by he((==1) = W 2
+ b, IBP computes: Es = W - 3 W Fe- + and k = W E W F1 14 + b. Propa- gating the bounds through the network allows logits kx, x and evaluate if an input æ is verifiably robust. The logit of the true class equals the lower bound and the logits of other classes equal to the upper bound:
compute the upper and lower bound of last layer
2

---

Under review as a conference paper at ICLR 2022
2 Kmm
if is the true class otherwise
Kmm
KKmm
IBP training uses a hyperparameter schedule on c (starting from O and increasing to Ctrain typically set étrain which slightly larger than eeval) and a mixed loss function that combines natural and robust cross-entropy loss: ming E(æ.y)> [xd((,, y) + (1 <))((k (x),))] where P is the data distribution, / is the cross entropy loss, K is a hyperparameter that balances the weight between natural and robust loss, and K represents the worst case logits computed using IBP.
CROWN-IBE CROWN was introduced by Zhang tively selecting the linear approximation. Zhang et al. (2020a) proposed CROWN-IBP combining IBP forward bounding pass and CROWN style backward bounding pass. CROWN-IBP trained models has tighter bound compared with IBP models under the IBP metric, with incurring cost on computational efficiency from CROWN backward propagation and generally requiring more epochs for training stability.
(2018) and achieves tight bound by adap-
2.3
RE- WEIGHTING
Motivated by the idea that all data points are not equally vulnerable to adversarial attack, researchers proposed methods to re-weight the minimax risk by adding a re-weighting term w(a, 9:) ahead of individual example loss. For instance, Zeng et al. (2020) noted the adversar- ial distribution deviation from the clean examples and assigned weights that monotonically de- creases with the examples' confidence margin. The "confidence margin" is calculated by attack methods such as PGD, then the risk is re-weighted by a parameterized exponential family as: ming 1 En w(x;, 9: (ffo(()))) Mi), s.t. w(2,, 34) exp(-a margin(fe. 2; + 6;, uu)) where is a positive hyper-parameter and the new risk biases larger weights towards the mis-classified ex- amples.
Zhang et al. (2020c) propose GAIRAT (Aeametry-Aware Adversarial Training). a method to reweight adversarial examples based on how close they to the decision boundary. During the training process, GAIRAT explicitly assigns larger/smaller weights to data points closer/farther to the decision boundary respectively: w(x; y1) (1 tanh()
(1 2 x(x,, y/) K)) /2, is the maximal allowed attack iteration and x: is the least iteration
where À is a number that the attack method requires to fool the classifier. Similar to re-weighting, Wang et al. 2021 improves clean image performance by prioritizing the robustness between the most dissimilar groups
2.4 CUSTOMIZED ADVERSARIAL TRAINING
In most adversarial training methods, the adversarial attack strength usually follows a pre-defined scheduler throughout the training process. For instance, the perturbation é is a uniform number for all examples and usually gradually increases. Cheng et al. (2020) argued that this assumption may be problematic given the fact that adversarial examples are not equally vulnerable and proposed an auto-tuning method by assigning individual 6, to each data and increasing it if the current attack is successful. In IZhang et al.] (20205), they proposed friendly adversarial training (FAT) by progressively increasing the attack perturbation with early-stop PGD and alleviating the issue of strong ad adversarial attack and cross-over mixture.
3 OUR PROPOSED METHODS
3.1 BOUND-BASER WEIGHTED LOSS
In classical classification tasks, training minimizes the following loss function: B(x ((f((x))))) estimated by E [(.)) w:)] For adversarial training, let x' be the worst case input under verifiable adversary or perturbed example from attack, the adversarial examples (x',2) Pl, where Pt is an unknown distribution dependent the clean example dis- tribution P. perturbation method and neural network parameters. In practice, the training objective usually 1 (' ([fo((())) y:)] estimating P(Z.))~PP((( ((So( v)], while the true objective should
3

---

Under review as a conference paper at ICLR 2022
be -) [[(f (xx), y)]. There exists discrepancy between the true distribution and empirical sampling method. To bridge this gap. we follow Zeng et al. (2020) and introduce importance weight
P' Ve)
s(fo Me)
(3)
P( M1)
s.t.
P' ,y)
P(x, y)
(4)
E w) ((f
As further exploration, analyze the importance weight:
P'(as(lv.) (wi) P' ('(((l))))
(5)
P( yi)
(():))))P(1))
P(x
where the first equality follows from the definition of conditional probability and second equality is from the fact that the label y, and its distribution does not change through the adversarial process.
The probability ratio gives more insight in designing the parametric function for importance weight. Given label yi, there exists distribution of its corresponding clean image space P( ((x) and similarly for worst case input space P'(xxly))) If the distribution of its corresponding worst case xf gets more concentrated compared to clean image distribution P(æ (y:), then more weight should be given to this example and vice versa.
Theorem 1. Given binary classificution task IR" - (+. with equal prior probability, assume the corresponding examples x and a= are uniformly distributed region S4,8- C R.", S+ n S_ 0. If there exists bijection mapping = S+ + S_ + S s.t. the post-mapping example x4 and x'_ distribution remains uniform in each region, the expectation of conditional distribution ratio ('(l(l)) over original distribution P(x, y) is great or equal than 1. p(
label
example distribution before/after adverarial treatment
direction adversary
decision boundary
Figure 1: Example distribution movement: far away from decision boundary(left) vs close to deci- sion boundary(rightt)
Example 1. Figure shows two extreme cases of adversarial example x' distribution movement from clean æ distribution given decision boundary in simplified 2D scenario. When is far away from decision boundary, the direction of attack or movement towards worst case example under p'(w'l))
In the second scenario, assume the decision boundary is a perfect semicircle representing the local curvature decision boundary and perturbed examples from both classes follow uniform distribution, then the examples with 1_ label in the outer are condensed into the inner are and vice versa for examples with '+' label moving to the external arc. Due to the existence of curvature, the area of the outer are S.n is
verifiable adversary same for all the z. In this case, P(x]y)

---

Under review as a conference paper at ICLR 2022
greater than the inner are Sout Therefore, from Theorem the expectation of P'(a'lv) is greater P(alp)
than 1. Another detailed example is illustrated in Appendix B this later example, the uniform perturbation assumption replaced the post-mapping uniform distribution assumption, which is more realistic for adversarial scenario.
From the two extreme case analysis, claim that the importance weight around decision boundary should be larger due to the local curvature, since any arbitrary x' and æ distribution pairs (local cur- vature is relatively larger than perturbation distance but its effect is not negligible on post adversarial distribution) can be seen as an intermediate case of two extremes. Therefore, we design a parametric weight function emphasizing the examples around the decision boundary in symmetrical manner.
Similar to Zhang & Liang (2019) we define the margin of classifier f for a data point (æ, y) as the probability difference between correct label and the most confident label among others. Specially, use bound-based method such as IBP get the margin under perturbation: أ softmax (*x), where & is the worst case logits as defined in equation 2 by softmax function given ěx-
P the probability distribution calculated
margin(f, x. v) = P(f(=) v) -mxx mxy
max P(f(z)) m)
The margin is positive when the example can be certified robust, otherwise the margin is negative. The magnitude of margin heuristically indicates the "distance" of the example towards the current decision boundary. Left half of Figure 2 shows our implementation of re-weighting against vulnera- bility of examples, where the size of the labels indicate the weights and corresponding perturbations on clean data points. The most vulnerable examples are around the decision boundary, since the worst case scenario of small perturbation could cross the decision boundary and fool the classi- fier. For the perturbed data points with smaller margin absolute value (closer to boundary), despite it being correctly classified, we assign larger weights to help the model focus on these data and accom- modate more slightly mis-classfied data. On the other hand, for the data points farther from decision boundary, if it is mis-classfied (large negative margin), there is no need to assign large weight since the model capacity is limited. For correctly classified data, we also assign small weights because they are less related to the decision boundary.
Jubel proposed weight
veiified penurbation
improperly large peturbation
decision boundary
decision boundary
Figure 2: Left: Re- Re-weighting examples based vulnerability, Right: Auto-tuning customize the perturbation for mis-classified examples
We parameterize the importance weight in the following form:
3 e ( (aargam(aa. + a ~ s(So, x(.
where 7 and a are both positive hyper-parameters to balance the effect of re-weighting. The full loss function after re-weighting is then defined as:
K n 1(z y) (1 x)
Σ
Σ wil(2x,))
" w
where & is a hyper-ypaaee parameter to balance the trade-off between clean loss and re-weighted robustness loss.
5

---

Under review as a conference paper at ICLR 2022
As comparison with other re-weighting techniques, Zhang et al. (2020c) gives larger weights to the vulnerable points defined by least attack iterations to fool the model. Zeng et al. (2000) parameter- izes the weight with similar exponential function given attack-based margin. Both of their heuris- tie weight functions monotonically decrease against margin, in which case a heavily mis-classified point shares large weight and well classified point has a smaller weight. Our bound-based method method, backed up by qualitatively theoretical analysis, emphasizes the data points symmetrically around the decision boundary.
3.2 AUTO-TUNING
In certified training, the training perturbation magnitude étrain is usually larger than the Ceval for optimal test accuracy. As T shows the robustness error against different Ctrain and Cevaly the optimal testing accuracy for Ceest = 0.3, 0.35 were both achieved at Ctrain 0.4 while smaller Etrain fails certifying larger Etest-
Table 1: IBP certified robust error on MNIST data
Elest
0.30
Ees
0.35
Eis 0.40
Gest 0.45
Exrain 0.30
9.81%
100%
100%
100%
Crainn 0.35
8.76
12.13%
100%
100%
Cuain 0.40
8.66%
11.40%
15.82%
100%
Etrain = 0.45 (training gets unstable)
25.13%
30.62%
37.63%
47.88%
With slightly larger perturbation during training, the model is more capable to handle unseen data in the testing. This observation is empirical, however, due to the limitation of model capacity, it is difficult for the model to handle all the examples with very large perturbation. When étrain = 0.45, notice the training instability between different random seeds. Our intuitive explanation is shown in the right half of Figure 2 With large perturbation, for the vulnerable points around decision boundary, the worst case prediction (indicated by orange dots) protrudes the ideal boundary with a large margin and it is sometimes impossible for the model to fit these points. Including these worst case scenarios in training encourages over-fitting and compromises the model's ability find the right boundary. In implementation, very large perturbation does not help improve the verified accuracy. Besides, during the training stage, a fast growing perturbation schedule may potentially cause instability.
Following the above discussion, a natural solution would be customizing perturbation for each ex- ample in the training set. For the majority of points in the interior of decision zone, we would like to encourage large perturbation for the model to enforce thick decision "gap" (grey colored thick line) for robustness consideration. Ideally, we would like to have the interior points to see large perturba- tions for optimal robustness and boundary points with moderate perturbations to avoid over-fitting. In the following, we propose an adaptive procedure to customize the perturbation for each example based on verified bound. The algorithm is shown Algorithm
EXPERIMENTS
4.1 DATASETS AND IMPLEMENTATION
We directly use the code from (Zhang et al. 2020a) provided for IBP and CROWN-IBP and leverage the same CNN architccture(MM-Laggg and training scheduler on MNIST and CIFAR-10 datasets.
For MNIST IBP schedule, the neural network is trained for 100 epochs with batch size of 100. The base scheduler of training e starts from 0 after 3 warm-up epochs and linearly grows to desired maximum training with 17 ramp-up epochs, after which base stays at the targeted level. The Adam optimizer learning rate initialized at 0.001 and decays by 10 times after 25 and 42 epochs. With MNIST CROWN-IBP schedule, the model is trained for 200 epochs with a batch size of 256. The ramp-up stage starts from epoch 10 and ends at epoch 50.
For CIFAR-10 dataset, total of 3200 epochs including 320 warm-up epochs is used for training with a batch size of 1024 and learning rate 0.0005 following two 10x decay after epoch 2600 and 3040. As standard treatment, random horizontal flip and crops are used as data augmentation.

---

Under review as a conference paper at ICLR 2022
Bound-based Algorithu I: Bound- based Auto- Auto-Tuning Tuning algorithm
Input:
Training data set (X, F). standard perturbation scheduler, perturbation bound method. auto-eps maximum perturbation offsct Emouli, network purameters 9, learning rate ?
initialize perturbation offset = 0 for all the examples, initialize for epock I.....N
for batch I.....
+ scheduuerr)
for I..... do
6 6- Flue <jaff
get the upper
bound of classification logits bound method:
=(e.) = (a(e))) x(s,) +- boundí Bi. 6.)
calculate the softmax worst probability: P softmax(((ee))
calculate margin: margin; P(ys) maxKm.y. P(m) if margin, then
GLot margin, Gaamooff
else
end
end
update network parameter: 8 8 E ([o(a, tc. +.)) end end
Notice for CROWN-IBP implementation, we reduce the training batch size from 1024 to 256 due to memory constraint.
The hyper-parameter defined in equation liinerryy decreases from to 0.5 during ramp-up stage. According to Zhang et al.] (2200)), this scheduler (Natartt = 1, Kend = 0.5) achieves better clean ac- Kend 0) and (Netart 0, Rend 0) by ending up with weight on natural
curacy than (Nstart cross entropy loss. All the experiments were performed on random seeds for reproducibility.
Our methods are generally applicable any certifiable adversarial training method. In the next section, we first leverage IBP for illustrative examples followed by CROWN-IBP results.
4.2 RESULTS
4.2.1 EFFECTS RE- WEIIGIIHGING
In Table we show the effect of hyper-parameters used for the re-weighting under IBP, where a larger ? indicates stronger re-distribution of weight for examples and a is a small number to prevent weight vanish when marginn| is close to 1. The hyper-parameters are evaluated on CIFAR- 10 a = 8/255 and MNIST at = 0.4. Our optimal hyper-parameter turns out to be y = 5, a 0.1 for both data sets. Re-weighting method gains 0.24% verified accuracy MNIST and 0.82% on CIFAR-10.
The goal of re-weighting is to approximate the true adversarial distribution by sampling from clean data distribution. Unfortunately, difficult to visualize the intractable distribution. From another perspective, we can interpret re-weighting as concentration and encouragement for larger margin. Figure shows the comparison of margin distribution for CIFAR- 10 testing data set under testing = 258.
the robustness decision boundary
255. With the vanilla model, the example margins
Table 2: Robustness against different hyper- parametrs with re-weighting with IBP
Kvvl
Kusin
Clean em.
Verified (mr
MNIST
0.3
0.4
bascline
2.28 0.12
8.66 + 0.05
0.1
2.28 0.13
8.68 + 0.06
0.1
10
0.1
2.28
0.05
8.61 0.05
CIFAR-10
8/255
8.8 1.8/255
baseline
49.44 0.49
72.26 0.16
0.1
49.06 + 0.01
72.32 + 0.03
0.1
49.46 0.27
71.44 0.04
10
0.1
50.11 1 0.38
71.60 1. 0.11
7

---

Under review as a conference paper at ICLR 2022
concentrate around the decision boundary. The re- weightiing dilutes the example frequency both sides, thus the classification results are less sensitive to perturbation change.
1020
820
Prquuncc
verile
200
-0.75
0.25
0.30
Margin
Figure 3: Distribution margin: vanilla robust training vs re-weighting
4.2.2 EFFECTS OF AUTO-TUNING E
In robust training, Euain usually produces good defensive model for coval which is slightly smaller than itself. Practitioners refrain from using an even larger due the marginal gain of robustness accuracy with the cost of sacrificing natural accuracy.
The idea of using auto-tuning to prevent improperly large perturbation for vulnerable points around decision boundary. When Emain is considerably larger than the testing e, the worst case points exceed the decision boundary by unrecoverable large margin due to model capacity. Our auto- tuning+ method trims the unnecessary perturbation to alleviate the counter effect for robust training.
Table 3: Robustness against different hyper- paramerrrsmeterss with auto-tuning with IBP
Dotaset
Feval
feain
Emaxoli
Clean crr
Verified (7.
MNIST
0.3
baseline
2.28 +: 0.12
8.66 0.05
0.05
2.08 + 0.08
8.52 + 0.17
0.1
2.04 0.05
8.46 0.23
0.15
2.04 1: 0.10
8.36 1. 0.12
0.2
2.17 = 0.02
8.78 1788+00.00 0.06
CIFAR-10
8/255
8.8/255
baseline
49.44 0.49
72.26 0.16
0.005
49.17 0.29
72.75 0.53
0.01
49.21
0.74
73.23 + 0.50
0.015
0.19 49.21
73.37 1 0.27
CIFAR-10 8/255
14/255
haseline
55.13 0.73
70.50 + 0.62
0.005
55.78 0.30
69. 29 0.58
0.01
55.53
0.88
69.44 + 0.43
0.015
55.62 0.34
69.93 + 0.64
Table shows the hyper-parameters choice for auto-tuning e. For the MNIST data set, we found the optimal hyper-parameter Emuxott around 0.15 where the certified accuracy gains by 0.3% from baseline.
For the CIFAR data set, the standard érain 8.8/255 is only 10% larger than the Ceval- In this case, our auto-tuning method performs worse compared to the baseline results because the extra 10% necessary for certified training. By using larger irain
possible to reach even smaller testing ervor. To show the effect of auto-tuning method, we will increase the urain until the testing verified accuracy stabilizes. For Etain 10/ 25/ 14/ 445 18 12/55,, 22/ 255, we come up with verified accu- racy = 70.62% + 0.62%, 70.50% + 0.62%, 70.31% + 0. 0.83%, 71.19% + 0.21% which are roughly 2% lower than the standard result. We choose = 14/255 as the "sweet point", beyond which any increase in does not provide any improvement in accuracy because the very large perturbation is harmful to training. With the optimal 6maxoff = 0.01, the verified accuracy is improved by 1.21% from baseline.
8

---

Under review as a conference paper at ICLR 2022
4.2.3 COUPLING OF TWO METHODS
By coupling two methods, can further combine the improvements and achieve even better results. As shown in Table for MNIST, using both optimal hyper-parameters from above individual tests we reach verified aceuracy of 8.01%, gaining 0.65% from baseline. For CIFAR-10, our best results beats the IBP baseline by 2.17%. We performed more experiments on other Ceval and other architecture and defer the results Appendix
Table 4: Robustness improvement summary with IBP
Dataset
Goval
Guii
re-weight
auto-eps
Clean em.(%
Verified em.(%)
MNIST
0.3
0.4
baseline
2.28 0.12
8.66 i 0.05
2.04 +: 0.10
8.36 = 0.12
2.30 + 0.07
8.42 = 0.07
2.09 1
8.01 0.04
CIFAR-10
8/255
14/255
baseline
55.13 +: 0.73
70.50 0.62
35.66 1 1.05
69.8 1 0.30
55.78 + 0.30
69.29
35.05 + 0.17
68.33 0.21
4.2.4 RESULTS ON CROWN-IBP
To illustrate that our methods generally work for all the certifiable training, we apply the same methods and optimal hyper-parameters from IBP setup directly to CROWN-IBP. For MNIST data, we achieves 0.32% improvement from baseline by re-weighting and 0.13% from auto-eps, com- bining the two is similar to using auto-eps only though. For CIFAR data, note that we use train- ing batch size 256 instead of 1024 Zhang et al. (2020a), the standard émii 8.8/255 has veri- fied error 68. 60% + 0.12% at éeval = 8/ 255 from our experiments. By elevating the bulk emiin to 14/255, the verified error increases to 68. 3%.35% 0.43%% After applying the two methods, we achieve 66.72% + 0.7% and beat the baseline by 1.38%.
Table 5: Robustness improvement summary with CROWN-IBP
Dataset
Geval
Guai
re-weight
auto-eps
Clean em.(%
Verified emr(%)
MNIST
0.3
0.4
baseline
1.83 + 0.11
7.02 = 0.08
1.62 1 0.01
0.05
1.86 1 0.04
6.70 0.30
1.74 + 0.02
6.90 = 0.05
CIFAR-JO
8/255
14/255
baseline
34:29 0.73
68.35 0.43
54.73 + 0.34
67.12 0.08
53.41 1 0.42
67.40 0.32
53.65 1 0.89
66.72 1 0.7
CONCLUSIONS
This paper proposed new methods refine the decision boundary improve the certifiable robust- ness accuracy. We prove the necessity to assign more weights towards adversarial examples around decision boundary by parameterizing the true adversarial distribution. A future direction could be exploring the adversarial mechanism for better approximation of re-weight function and promoting the idea of sewigghtting to other non-adversarial tasks. For auto-tuning, our initial interest was to prevent extremely large Epain and relatively large éuain is necessary to show the effect. In practice, we can increase firain until accuracy stabilizes and achieve further optimal verified error. Our intu- itive approach indeed finds proper perturbation for each example. Given the fact that a larger frain achieves optimal certifiable accuracy still exists as an empirical finding (Gowal et al. 2019 Zhang al. 2020a), rigorous thcoretical thinking is needed to justify this approach.

---

Under review as a conference paper at ICLR 2022
ETHICS STATEMENT
This paper does not contain ethics concerns.
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Circumventing defenses to adversarial exam- ples. ICML, 2018.
Rudy Bunel, llker Turkaslan, Philip HS Torr, Pushmeet Kohli, and M Pawan Kumar. unified view of piecewise linear neural network verification. NeurIPS, 2018.
Qi-Zhi Cai, Min Du, Chang Liu, and Dawn Song. Curriculum adversarial training. IJCAI, 2018.
Minhao Cheng, Qi Lei, Pin- Yu Chen, Inderjit Dhillon, and Cho-Jui Hsieh. Cat: Customized adver- sarial training for improved robustness. arXiv:2002.06778 2020.
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. PMLR, 2017.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. PMLR, 2019.
Krishnamurthy Dvijotham, Sven Gowal, Robert Stanforth, Relja Arandjelovic, Brendan O'Donoghue. Jonathan Uesato, and Pushmeet Kohli. Training verified learners with learned ver- ifiers. 1805. 2018a.
Krishnamurthy Dvijotham, Robert Stanforth, Sven Gowal, Timothy A Mann, and Pushmeet Kohli. A dual approach to scalable verification of deep networks. UAI, pp. 550-559, 2018b.
lan Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXivv1412.6572, 2014.
Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Ue- sato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. Scalable verified training for provably robust image classification. ICCV, 2019.
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. arXiv preprint arXiv:1802.0347) 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018
Peilin Kang Seyed-Mohsen Moosavi-Dezfooll: Understanding catastrophic overfitting in adversarial training. arXiv:2105.02942, 2021.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense adversarial perturbations against deep neural networks. IEEE, 2016.
Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. PMLR, 2020.
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. In NeurlPS, volume 32, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. ICLR, 2014.
Vincent Tjeng, Kai Y. Xiao, and Russ Tedrake. Evaluating robustness of neural networks with mixed integer programming. ICLR, 2019.
Asher Trockman and Zico Kolter. Orthogonalizing convolutional layers with the cayley transform. In ICLR, 2021.
10

---

Under review as a conference paper at ICLR 2022
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. ICLR, 2019.
Yusuke Tsuzuku, Issei Sato, and Masashi Sugiyama. Lipschitz-margin training: Scalable certifica- tion of perturbation invariance for deep neural networks. In NeurIPS, 2018
Shiqi Wang. Kevin Eykholt, Taesung Lee, Jiyong Jang. and Ian Molloy. Adaptive verifiable training using pairwise class similarity. AAAI, 2021.
Yisen Wang. Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. PMLR, 2019.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. ICLR, 2020.
Tsui- Wei Weng, Huan Zhang, Hongge Chen, Zhao Song, Cho-Jui Hsieh, Duane Boning, Inderjit S. Dhillon, and Luca Daniel. Towards fast computation of certified robustness for relu networks. PMLR, 2018
Huimin Zeng, Chen Zhu, Tom Goldstein, and Furong Huang. Are adversarial examples cre- ated equal? learnable weighted minimax risk for robustness under non-uniform attacks. 1rXiv:2010.12989, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. ICML, 2019.
Huan Zhang, Tsui-Wei Weng, Pin- Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neural network robustness certification with general activation functions. NIPS, 2018
Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li. Duane Boning, and Cho-Jui Hsich. Towards stable and efficient training of verifiably robust neural networks. ICLR, 2020a.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. arXiv:2002.11242,, 2020b.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-reweighted adversarial training. arXiv:2010.01736, 2020c.
Yuchen Zhang and Percy Liang. Defending against whitebox adversarial attacks via randomized discretization. PMLR 89:684-693, 2019.

---

Under review as a conference paper at ICLR 2022
APPENDIX
A PROOF OF THEOREM
Theorem (Restated). Given a binary classification task IR" + (+,-) with equal prior probabil- ity, assume the corresponding examples 2+- and x- are uniformly distributed in region S C R R n 0. If there exists bijection mapping m S+ S_,S_ mapping example x'4 and x'_ distribution remains uniform in euch region, the expectation of con- ditional distribution ratio P'(a'lu) over original distribution P(æ,y) y) is great or equal than 1.
S+ s.t. the post-
P(mlu)
Proof. let 2-, x4 x'_ denote the pre-mapping and post-mapping examples for 2 labels, be- cause both pre-mapping and post-mapping examples are uniformly distributed in each region, P(æ++1y+), P(=_ y- P' be the "volume" of set S S_. Given total conditional probability equals 1:
P P'(x' P' (ar'ly-) are constant. let S+ = faes, dr, S_ faes da
Jx DES+
P(x+lv+)((z) =
/ d(x)
P(x+ly+)
J0EB
P(x+|y++ = 1/5+
Similarly we have other conditional probability equals the inverse of volume. Hence,
P' ('(x'ly)
= P(V+) /
P'(ar', 1y d(xx)
p(x
JAES
P(x+1y+
P( y+)
P'x' 1/1 d(x)
+ P(y-)
P(x-ly-) P x [
FEB
S+ S
0.5
5
S+
where the second equality comes from the balanced prior assumption(P(y4) P(y-))
Notice we cannot directly cancel the conditional probability on the numerator and denominator, otherwise integrating x' over dæ is not tractable. The inequality holds when S_ # S4.
12

---

Under review as a conference paper at ICLR 2022
B A CONCRETE EXAMPLE ON IMPORTANCE WEIGHT EXPECTATION
example distribution before/after
udversurial treatment
adversarial perturbation
Figure 4: An ideal example illustrating importance weight expectation around decision boundary with curvature
Example 2.
We assume label-balanced data æ IR2 and y E {+. and positive constant σ, the clean data with label were uniformly distributed in the inner ring Cin (z) < | ||
< 20
and data with label were uniformly distributed the outer ring Cout = (a|20 < | <
30
Then pyy +) p(y -) 0.5 and clean data distribution is: p(zly)
if +, ||0||2 20
3
y= 20 < ||>|| < 30
otherwise
assume the linear classifier f R + R uses r = ||0|| as feature and outputs the logit for probability,
if yy=+ +
s.t. the probability after sigmoid function is (y/x))
if =
I+ee
where: 20
The negative fog-likelihook
NLL F (zc..w) (cc.,))~ppaa [lg(()()(==))
-py +)
p(zly +)log(ps(1 (y = +1x))
ply --)
p(alyy )lgg (y - ax) )d
20
30
0.5(
2nrdr
2rrdr)
3T0²
1 1 es
5ra2
1 1 r=
1
pama
= -..5
2n e
+
do +
27(s + 20 2os
3TT
+
sm
Ite-s
Notice the integral includes polylogarithm term thus the indefinite integral is not elementary function and it is unnecessary to attack the final integral. Instead, we apply adversarial directly
to the above equation for (æe, y) distribution. Calculate the adversarial gradient: for 8 E [0, o).
dN dN de
GRd I- (s 2o), let (s) dNLL((s)
1te 4e- (a+22)) For
(I+e-9)
E 1-,
dNLL(s)
ds हाकक I (m s + 20), let (s) =
PNLL())
(s-22))
da
30 (1+e"ya
(s) and (s) denotes the attack gradient towards negative log-likelihood function on example (x, 3) with ||>||2  + 2o. Notice A+ 0 and A_(s) < 0 because adversarial perturbs the correctly classified examples towards the decision boundary. Assume the attack step = there exist a mapping of attack m F² + 22 R. Because this is I step attack on 2D plane with gradient towards radial direction without projection, the mapping also corresponds to verifiable worst case adversarial with (maz = under & norm, Rewrite (æz, y) in the polar coordinate(r, 0, y),
(r', A..0.'' 3/) = m(r, 0. v) = + +0. y
(r - o, 0. yfy=
13

---

Under review as a conference paper at ICLR 2022
After the attack, the importance ratio (' [b] P(ay v) 7 is inversely proportional the radius change.
The expected importance ratio could be written as
P'(x' (y)
Ply = =) / P(xly- --) P' (2'1j ly -)
E( rl P(æly)
dx
P(æly
+ P(y = +) / P(aly== = +)
P' P'(x'lv = +)
dæ
P +)
30
1
2o
0.5
2xrdr
3TO2 r r 2xrdr]
5 2
0
1-30-
σ o+t
0.5
2n (o + +tddt
5
2020-a a
20
-0 +t t
+
2 -00 + t)dt)
3TO
100+a
1-30-a
(oolog(t) 2ot - 12/2)
5TO
1=20-0
1220+
(o²log(t) - -2ot + 1212)
3TO²
1
(o'log(2) + + + 3
(0
(l0((1)) + 0.5o²)
2
23 1.14 > 1
14

---

Under review as a conference paper at ICLR 2022
C
MORE EXPERIMENTS
Table 6: Robustness improvement summary with IBP
Dataset
architecture
Coval
Grain
re-weight
auto-eps
Clean em.
Verified err.(%)
MNIST
DM-small
0.3
0.4
baseline
3.27 0.24
12.00 + 0.35
0.4
3.25 1 0.10
11.73 1 0.57
0.4
2.75 0.11
11.36
0.4
2.87 = 0.10
11.09 = 0.33
CIFAR-10 DM-small
8/255
8.8/255
baseline baseline
51.86 0.18
73.92 + 0.17
14/255
58.08 + 0.33
7L.07 + 0.23
14/255
57.56 + 0.76
70.33 + 0.29
14/255
/
58.36 1.05
70.62 0.46
14/255
57.29 1 0.17
= 0.18
MNIST DM-large
0.1
0.2
bascline
1.06 0.07
3.08 + 0.15
0.2
1.03 0.01
3.06 + 0.02
0.2
1.14 0.07
2.86 - 0.09 2.92 - 0.07
0.2
1.03 : 0.04
CIFAR-10 DM-large
2/255
2.2/255
baseline
33.89 + 0.42
58.80 + 0.84
6/255
baseline
44.32 + 0.27
52.93 1 0.42
6/255
44.01 + #0.46
52.38 + 0.10
6/255
43.60 + 0.18
52.57 + 0.30
6/255
/
42.91 + 0.64
52.17 = 0.17
15


Reviews:
[{"review_id": "uo7WJTZIOOr", "reviewer": "Reviewer_onQv", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strength\n\n1. Improving certifiable training performance is an important but very challenging task. The improvements are not marginal over IBP and CROWN-IBP compared to most of the recent papers.\n2. The designs of the two methods are novel and reasonable. I like the examples in Section 3 which clearly illustrate the insights.\n\nWeakness\n\n1. Comprehensive experiments following CROWN-IBP would be necessary to fully demonstrate the performance of the methods. For instance, more model architectures should be evaluated. Also, 0.1 for MNIST and 2/255 for CIFAR10 are important baselines as well.\n2. It would also be helpful to perform ablation studies for individual methods on CROWN-IBP besides IBP.\n3. Despite the good results, I would not expect the proposed methods have a strong future impact enlightening further performance improvements since it is highly customized for the current stage and specific task. A discussion on limitations and future directions would be a plus.\n\nQuestions and comments\n\n1. I am curious if applying the new methods on tighter relaxation like K&W [A, B], CROWN, or CROWN-IBP alone for certifiable training would improve the results or not?\n2. A similar insight for improving certifiable training (CROWN-IBP) is proposed in [C] even though the eventual goal is slightly different. It would be helpful to at least mention it in the text.\n3. Any specific reason for using \"certification-based robust training\" in the title instead of \"certifiable training\" which is a much more commonly used term?\n4. Typo: Our bound-based method method, backed up by ...\n\n[A] Provable defenses against adversarial examples via the convex outer adversarial polytope, ICML 2018\n\n[B] Scaling provable adversarial defenses, NeurIPS 2018\n\n[C] Adaptive Verifiable Training Using Pairwise Class Similarity, AAAI 2021", "summary_of_the_paper": "This paper proposes bound-based weighted loss and epsilon auto-tuning to improve the performance of certifiable training. The insights of the improvements are mainly borrowed from well-developed adversarial training while they are customized for certifiable training considering bound margins provided bound propagation methods. The experimental results clearly show the improvements from individuals and the combination of the two methods.", "summary_of_the_review": "Overall, I think the current version is a borderline paper. The proposed methods are new and the improvements shown in the paper are not that marginal compared to most of the related recent papers. However, the paper lacks comprehensive experiments to convincingly support the claims. If more consistent experimental results can be provided during rebuttal, I would vote for acceptance.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "hVtYA5lMKE7", "reviewer": "Reviewer_2goi", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strength**\n\nThe motivation of the algorithm is clear and easy to follow. The algorithm is general and easy to implement.\n\n**Weakness**\n\n1. [Theoretical Strength]\n    * From my point of view, the bijection assumption in Theorem 1 is too strong and is disconnected with the practices. This is because the adversarial perturbations are defined as the \"imperceptible\" perturbations, so the perturbed input of one class should not cover the support of another class. The perturbation defined as the bijection mapping here changes the semantic meanings of the input for sure and should not be considered \"imperceptible\".\n    * In the first paragraph of Section 3.1, the distribution P' should depends on the model parameters, because adversarial examples are generated specifically for a model. To be rigorous, the authors should point this out.\n\n2. [Algorithm Design]\n    * The sentence below Equation (12) is incorrect, because the margin itself is a bound. The margin defined in (12) is negative does not necessarily mean the input is adversarial vulnerable, it only means the current input cannot be certified robust.\n    * The exponential of the margin does not imply the right hand side in formula (13). $s$ is defined as the ratio of the adversarial and clean conditional probability, which shows no connection to the IBP margin. In addition, the tightness of IBP margin differs from instance to instance.\n    * The algorithm has too many additional hyper-parameters, including $\\alpha$, $\\gamma$ and $\\epsilon_{I, maxoff}$. The authors should conduct ablation study to show how sensitive the performance is to these additional hyper-parameters and whether or not the optimal hyper-parameters are too sensitive to the task and model architectures. I believe this will greatly facilitate the practitioners.\n\n3. [Experiments]\n    * The strength of the baselines are questionable and the results of the baselines are not consistent with the previous works. For example, the Table 3 in the IBP paper (Ref[A]) shows the IBP certified error on MNIST ($\\epsilon = 0.3$) is $8.21%$ and on CIFAR10 ($\\epsilon = 8 / 255$) is $68.44%$; both are better than the baseline results shown in Table 2 and Table 3 of this paper. The CROWN-IBP results in the original paper (Ref[B]) on CIFAR10 ($\\epsilon = 8 / 255$) is $66.94$ in their Table 3 and is better than the reported results in Table 5 of this paper. I agree that the training $\\epsilon$ here is a bit different, but the authors should present the baseline results in their optimal hyper-parameters settings.\n\n4. [Writing and Presentation]\n    * Some claims in this paper is not correct. For example, in the last paragraph of page 1, the authors say the incomplete certifier provides looser bounds by convex adversarial polytope. This is not comprehensive, because some other incomplete certifier uses semidefinite programming (Ref[C]) or randomized smoothing (Ref[D]). Convex polytope is only one category of the incomplete certifiers.\n    * The definition of formula (4) is wrong. We should use the lower bound for the true labels and the upper bounds for the rest.\n\nReference\n\nRef[A]: Gowal, S., Dvijotham, K., Stanforth, R., Bunel, R., Qin, C., Uesato, J., ... & Kohli, P. (2018). On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv:1810.12715.\n\nRef[B]: Zhang, H., Chen, H., Xiao, C., Gowal, S., Stanforth, R., Li, B., ... & Hsieh, C. J. (2019, September). Towards Stable and Efficient Training of Verifiably Robust Neural Networks. In International Conference on Learning Representations.\n\nRef[C]: Raghunathan, A., Steinhardt, J., & Liang, P. (2018, February). Certified Defenses against Adversarial Examples. In International Conference on Learning Representations.\n\nRef[D]: Cohen, J., Rosenfeld, E., & Kolter, Z. (2019, May). Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning (pp. 1310-1320). PMLR.", "summary_of_the_paper": "This paper proposes a geometry-aware reweighting scheme and auto adjusted training adversarial budget to improve the performance of provably adversarial training. The intuition arises from the distance of the training examples to the decision boundary of the model.", "summary_of_the_review": "Due to the concerns pointed above, I do not think the current manuscript is suitable for publication. However, I welcome the authors to clear my concerns in the rebuttal period. I will do a re-evaluation then.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "T32iCo7tffA", "reviewer": "Reviewer_p9xi", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "I think the weighting method is not presented that clearly in Section 3.1.\nIn particular, Equation 9 is quite confusing. Why can we just drop P'(x',y)/P(x,y) to get the final expression, isn't the whole point\nthat these two probabilities are quite different from each other (meaning the expression is not close to 1)?\nAlso how is final expression in Equation 9 any different from the standard loss from the beginning E_((x, y) ~ P) [l(f_\\theta(x), y)]?\nIt seems to me that the only different is that the random variable has changed from x to x', but the overall expected loss should stay the same.\n\nFinal importance weighting that is used seems to be almost the same as the one used by Zeng et al., except that here we have\ntwo hyperparameters alpha and gamma. Is this correct interpretation or there is some bigger difference between the two approaches?\n\nRegarding auto-tuning of epsilon, prior work has already considered using larger epsilon to train the network,\nso the key contribution here seems to be the algorithm presented in the Appendix C. As it is one of the key contributions of this work, it would make sense to put it\nin the main paper, and not the appendix.\n\nFinal results seem somewhat underwhelming.\nOn MNIST the method improves 0.32% over the baseline, and on CIFAR-10 the improvement is 1.38%.\nThis seems quite small, but might be in the line with recent work in this field.\nOne question I had here is that your report the CROWN-IBP baseline to have verified error 68.35, but CROWN-IBP paper\nreports 66.94. Could you explain where does the discrepancy come from?\n\nTypos:\n\ndifition -> definition\n\nexamples with examples with -> examples with\n\nthe the ideal boundary -> the ideal boundary\n\nlinearly grows from 1 to 0.5 -> linearly decreases from 1 to 0.5\n", "summary_of_the_paper": "This paper proposes two ideas for improving the performance of certified training.\nThe first idea is to use assign weight for each input based on the margin to the decision boundary.\nThe second idea is to use automatic scheduling of perturbation radius during training.\nThey show that using these two ideas leads to improved certified robustness on MNIST and CIFAR-10 datasets.\n", "summary_of_the_review": "I recommend rejection because the method itself is incremental over prior work and experimental results are only marginally better.\nFurthermore, I think paper would benefit from another revision as some things should be written more clearly.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "Jd2pur1__VP", "reviewer": "Reviewer_jhkj", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper mainly proposes two tactics: training data reweighting, and sample-level $\\varepsilon$ tuning. The training data reweighting is backed up by theoretical justifications and intuitive explanations. The sample-level $\\varepsilon$ tuning is relatively intuitive. Both tactics contribute to a better certified robust training approach.\n\nStrengths:\n- The proposed two tactics are novel and solid.\n- The theoretical and empirical illustrations of the proposed method are insightful.\n- Demonstrated by experimental results, the proposed method is effective. The relaxation-based training is hard to improve where recent work like CROWN-IBP, Auto-LiRPA, etc can only get 1%-3% improvements despite their complex techniques. This work is simple but has shown a similar level of improvement.\n\nWeaknesses:\n- The experimental evaluation is not comprehensive enough. The following results would be helpful if provided:\n\n  - Experiments on more model architectures other than DM-Large to show generalizability.\n\n  - Combine the proposed method with Auto-LiRPA [1], since Auto-LiRPA achieves a lower certified error compared with IBP and CROWN-IBP, e.g., 66.62% on CIFAR-10 against 8/255 $\\ell_\\infty$ perturbations.\n\n  - Show running time statistics to quantitatively justify the small overhead of the proposed method.\n\n  - Provide code for replicating the experiments, or provide a reproducibility statement.\n\n  - How many times did you replicate the experiments? It would be good to report this number in the paper.\n\n- Several writing issues as listed below.\n\nMinor:\n1. The paper title uses \"certification-based\" while the first sentence in the abstract uses \"verification-based\". Please make them consistent.\n2. Section 1, first paragraph: FGSM were the very first approaches => was the very first approach.\n3. Section 3.1: ${\\mathbb{E}}\\_{(\\mathbf{x}',y) \\sim P} [l(f_{\\theta}(\\mathbf{x}'), y)]$ => $\\mathbb{E}\\_{(\\mathbf{x}',y)\\sim P'} [l(f_{\\theta}(\\mathbf{x}'), y)]$\n4. Example1: and vice versa for examples with examples with ′+′ label moving to the external arc => and vice versa for examples with ′+′ label moving to the external arc\n5. Algorithm 1 in Appendix C: How does Algorithm 1 combine with the whole training pipeline? Is there any training process that optimizes the model weights at the end of each inside loop?\n\nSuggestions:\n1. It would be good to discuss randomized smoothing and related training (Cohen et al ICML 2019, Lecuyer et al S&P 2019, Salman et al NeurIPS 2019), Lipschitz-based robustness and related training (Tsuzuku et al NIPS 2018, Trockman et al ICML 2021) in related work. They also provide verifiable robustness.\n2. It would be good to move the algorithm description in Appendix C to the main text, otherwise the hyperparameter $\\varepsilon_{maxoff}$ shown in Section 4.2.2 has no formal definition.\n\nQuestion:\nWhen computing the sample weights, what $\\varepsilon$ is used for IBP to compute the margin (Eq. 11)? Is it the original $\\varepsilon$ or the auto-tuned $\\varepsilon$? If it is former, I worry the IBP bound is too loose for hard samples with large original $\\varepsilon$, where maybe smaller $\\varepsilon$ could be better. If it is latter, the auto-tuned $\\varepsilon$ may deviate too much from the original required $\\varepsilon$, failing to precisely reflect the actual margin bound under the original required $\\varepsilon$.\n\n[1] Xu, Kaidi, et al. \"Automatic perturbation analysis for scalable certified robustness and beyond.\" Advances in Neural Information Processing Systems 33 (2020).", "summary_of_the_paper": "This paper proposes to integrate training data reweighting and sample-level perturbation budget tuning to improve relaxation-based robust training like IBP and CROWN-IBP. The overhead is small and the improvement of the certified accuracy is +1.38% on CROWN-IBP and +2.17% on IBP on CIFAR-10.", "summary_of_the_review": "The proposed two tactics are backed up by intuitive but useful insights and shown effective for relaxation-based training. Therefore, the work would be inspirational to the community.\nHowever, the current experimental evaluation is not comprehensive enough and lacks several important details, so it is a bit difficult to tell whether the approach is generally effective or not. Also, the presentation can be improved.\nGiven these concerns, I think the paper is marginally below the threshold. If more experimental details are provided during the discussion phase, I am happy to re-evaluate this paper.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors develop an approach to improve upon methods for training certifiably robust models. They propose an input dependent margin-based weighting and an automatically generated curriculum schedule and demonstrate improvements on training certifiably robust models on MNIST and CIFAR-10.

Reviewers agree that the paper makes interesting and novel contributions. However, the lack of novelty in the approach combined with the limited empirical gains make it difficult to justify acceptance. In particular, reviewers raise valid concerns on the quality of experiments comparing to prior work (in particular Crown-IBP (Zhang et al 2020) and COLT (Balunovic & Vechev 2020)) (in particular hyperparameter tuning, inability to recreate baseline results and unjustified claims that the prior art cannot run on GPU hardware). Further, even the gains demonstrated are marginal. 

Hence, I recommend rejection, but encourage the authors to revise the paper based on the feedback received.
Decision: Reject