Fast Certified Robust Training with Short Warmup
Authors: Zhouxing Shi
Yihan Wang
Huan Zhang
Jinfeng Yi
Cho-Jui Hsieh
Venue: NeurIPS 2021 Poster (2021)
Keywords: Certified robustness
Adversarial robustness

Abstract: Recently, bound propagation based certified robust training methods have been proposed for training neural networks with certifiable robustness guarantees. Despite that state-of-the-art (SOTA) methods including interval bound propagation (IBP) and CROWN-IBP have per-batch training complexity similar to standard neural network training, they usually use a long warmup schedule with hundreds or thousands epochs to reach SOTA performance and are thus still costly. In this paper, we identify two important issues in existing methods, namely exploded bounds at initialization, and the imbalance in ReLU activation states and improve IBP training. These two issues make certified training difficult and unstable, and thereby long warmup schedules were needed in prior works. To mitigate these issues and conduct faster certified training with shorter warmup, we propose three improvements based on IBP training: 1) We derive a new weight initialization method for IBP training; 2) We propose to fully add Batch Normalization (BN) to each layer in the model, since we find BN can reduce the imbalance in ReLU activation states; 3) We also design regularization to explicitly tighten certified bounds and balance ReLU activation states during wamrup. We are able to obtain 65.03% verified error on CIFAR-10 ($\epsilon=\frac{8}{255}$) and 82.36% verified error on TinyImageNet ($\epsilon=\frac{1}{255}$) using very short training schedules (160 and 80 total epochs, respectively), outperforming literature SOTA trained with hundreds or thousands epochs under the same network architecture. The code is available at https://github.com/shizhouxing/Fast-Certified-Robust-Training.


Fast Certified Robust Training with Short Warmup
Zhouxing Shi"", Yihan Wang",, Huan Zhang!?, Jinfeng Yi', Cho-Jui Hsieh University of California, Los Angeles Carnegie Mellon University 'JD Al Research zahi@cs ucla. edu, yihanvangāca. ucla.edu, huanchuan-zhang.com yijinfengejd. com, chohsieh@cs. ucla. edu Equal contribution
Abstract
Recently, bound propagation based certified robust training methods have been proposed for training neural networks with certifiable robustness guarantees. De- spite that ofate-of-the-art (SOTA) methods including interval bound propagation (IBP) and CROWN-IBP have per-batch training complexity similar to standard neural network training, they usually use long warmup schedule with hundreds or thousands epochs to reach SOTA performance and are thus still costly. In this paper, we identify two important issues in existing methods, namely exploded bounds at initialization, and the imbalance in ReLU activation states and improve IBP training. These two issues make certified training difficult and unstable, and thereby long warmup schedules were needed in prior works. To mitigate these issues and conduct faster certified training with shorter warmup, we propose three improvements based on IBP training: 1) We derive a new weight initialization method for IBP training: 2) We propose to fully add Batch Normalization (BN) to each layer in the model, since we find BN can reduce the imbalance in ReI.U activation states; 3) We also design regularization to explicitly tighten certified bounds and balance ReLU activation states during wamrup. We are able to obtain 65.03% % verified error on CIFAR-10 (e = 255
8 ) and 82.36 verified error on Tiny- ImageNet (c = 255 using very short training schedules (160 and 80 total epochs, respectively), outperforming literature SOTA trained with hundreds thousands epochs under the same network architecture. The code is available at https: //github. comm wwwishuxiig//aaaseeeee htwpphoowwwppetttteerrfieeeeeeee CewtiffeddRoobutttt
Introduction
While deep neural networks (DNNs) are successfully applied in various areas, its robustness problem has attracted great attention since the discovery of adversarial examples (Szegedy et al., 2013; Goodfellow et al., 2015; Carlini Wagner, 2017: Kurakin al., 2016; Chen al., 2017; Madry et al., 2018; Su et al., 2018 8; Choi et al., 2019), which poses concerns in DNN applications especially the safety-critical ones such autonomous driving. Methods for improving the empirical robustness of DNNs, such as adversarial training (Madry et al., 2018), provide no provable robustness guarantees, and thus some recent works aim to pursue certified robustness. Specifically, the robustness is evaluated in certifiable manner using robustness verifiers (Katz et al., 2017: Zhang et al., 2018; Wong & Kolter, 2018; Singh et al., 2018, 2019; Bunel et al., 2017: Raghunathan et al., 2018b; Wang et al., 2018b; Xu et al., 2020; Wang al., 2021), which verify whether the model is provably robust against all possible input perturbations within the range. This is achieved usually by efficiently computing the output bounds.
To improve certified robustness, certified robust training methods (also referred as certified defense) minimize& a certified robust worst-case loss given specified input perturbations. So far, Interval Bound Propagation (IBP) (Gowal
loss computed by verifier, and the certified loss is an upper bound of the
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

et al.. 2018; Mirman et al., 2018) and CROWN-IBP (Zhang et al., 2020; Xu et al., 2020) are the most efficient and effective methods for general models. IBP computes an interval with the output lower and upper bounds for each neuron, and CROWN-IBP further combines IBP with tighter linear relaxation-bann based bounds (Zhang et al., 2018; Singh et al., 2019) during warmup.
Both IBP and CROWN-IBP with loss fusion (Xu et al., 2020) have per-batch training time complexity similar to standard DNN training. However, certified robust training remains costly and challenging, mainly due to their unstable training behavior - they could easily diverge or stuck at a degenerate solution without a long "warmup" schedule. The warmup schedule here refers to training the model with a regular (non-robust) loss first and then gradually increasing the perturbation radius from O to the target value in the robust loss (some previous works also refer to as "ramp-up"), For example, generalized CROWN- IBP in Xu et al. (2020) used 900 epochs for warmup and 2,000 epochs in total to train a convolutional model on CIFAR-10 (Krizhevsky et al., 2009).
In this paper, we identify two important issues in existing certified training, so that long warmup schedule could not be easily removed in previous works. First, we find that the certified bounds can explode at the start of training, which is partly due to the suboptimal weight initialization in prior works. A good weight initialization is important for successful DNN training (Glorot & Bengio, 2010; He et al., 201 but prior works for certified training generally use weight initialization methods originally designed for standard DNN training, while certified training is essentially optimizing a different type of augmented network defined by robustness verification (Zhang et al., 2020). The long warmup with gradually increasing perturbation radii prior works can somewhat be viewed as finding a better initialization for final IBP training with the target radius, but it is too costly. Second, we also observe that IBP leads to imbalanced ReI.U activation states, where the model prefers inactive (dead) ReLU neurons significantly more than other states because inactive neurons tend to tighten IBP bounds. It can however hamper classification performance if too many neurons are dead. This issue can become more severe if the warmup schedule is shorter.
We focus on improving IBP training, since IBP is efficient per batch, and it is also the base of recent state-of oftte-of-the-rr methods (Zhang et al., 2020; Xu et al., 2020). We propose the following improvements:
We derive a new weight initialization, IBP initialization, for IBP-based certified training. The new initialization can stabilize the tightness of certified bounds at initialization.
We identify the benefit of Batch Normalization (BN) in certified training, and we find BN which normalizes pre-activation outputs can balance ReI.U activation states and also stabilize variance. We propose to fully add BN to every layer, while was partly or fully missed prior works.
We further propose regularizers to explicitly stabilize certified bounds and balance ReLU activation states during warmup.
We are able to efficiently train certifiably robust models that outperform previous SOTA performance in significantly shorter training epochs. We achieve verified error of 65.03 % (e - on CIFAR- 10 in 160 total training epochs, and 82.36 % TinylmageNet (c 1 in 80 epochs, based on efficient IBP training. Under the same convolution-base architecture, we significantly reduce the total training cost by 20 60 times compared to previous SOTA (Zhang al., 2020; Xu et al., 2020) or concurrent work (I.yu et al., 2021).
2 Background and Related Work
2.1 Certified Robust Training
Training robust neural networks can generally be viewed as solving the following min-max optimiza- tion problem:
min E Ex,jxx
max L(fo(x (x)6(x+)).9) 6EA(x)
(1)
where So stands for a neural network parameterized by 0, X' the data distribution, x is a data example, y is its ground-truth label, 8 is perturbation constrained by specification Axx), and L. is the loss function. Empirical adversarial training methods (Goodfellow al., 2015; Madry et al., 2018) solve the inner maximization in Eq. (1) with adversarial attack, and then solve the outer
2

---

minimization as regular DNN training but augmented with 6. However, in adversarial training, the inner maximization has no guarantee to find å which can lead to worst model performance. In contrast, certified robust training methods compute a certified upper bound for the inner maximization, so that the upper bound provably covers the worst-case perturbation.
In terms of certified robustness works, Raghunathan et al. (2018a) used semidefinite relaxations for small two-layer models, and Wong & Kolter (2018); Mirman et al. (2018); Dvijotham et al. (2018); Wang et al. (2018a) used linear relaxations but are still too computationally expensive for large models. On the other hand, Mirman et al. (2018) first used interval bounds to train certifiably robust network, and Gowal et al. (2018) 8) made it more effective. This approach is often referred to as interval bound propagation (IBP). CROWN-IBP (Zhang al., 2020) further combined IBP with tighter linear relaxation bounds by CROWN (Zhang et al., 2018) during warmup, and it is generalized and accelerated in Xu et al. (2020). Additionally, Balunovic & Vechev (2020) combined certified training with adversarial training: Xiao et al. (2019) added a ReLU stability regularizer to empirical adversarial training, to reduce unstable neurons for faster and tighter verification when tested with mixed integer programming (MIP), but their objective is distinct from ours and this method was shown not to improve certified training (Lee et al., 2021). In concurrent works, Lyu et al. (2021) proposed parameterized ramp function as alternative activation function, and used a tighter linear bound propagation algorithm for verification; Zhang et al. (2021) proposed to use a different architecture with "L distance neurons" instead of traditional linear convolutional layers. Yet they still need long training schedules.
Moreover, while our scope in this paper is deterministic certified robustness, there are also random- ization based works for probabilistic certified defense (Cohen et al., 2019; Li et al., 2019; Lecuyer et al., 2019; Salman et al., 2019). But randomized smoothing requires costly sampling at test time, and it usually for le perturbations and has fundamental limitations for too ones (Yang et al., 2020; Blum al., 2020; Kumar et al., 2020).
2.2 Weight Initialization of Neural Networks
Many prior works have studied the weight initialization for standard DNN training. Xavier Glorot initialization (Glorot & Bengio, 2010), adopted by popular deep learning libraries such as PyTorch (Paszke al., 2019) and Tensorflow (Abadi et al., 2016) as the default initialization, aim to stabilize the magnitude of forward propagation and gradient backpropagation signals measured with variance. It uses uniform distribution or normal distribution to independently initialize each element in the weight matrix with a derived variance for the distribution. He et al. (2015a) derived an initialization that more accurately stabilizes the variance ReLU networks. Saxe et al. (2013) proposed an orthogonal initialization which may lead to better learning dynamics. Some other works also derived initializations for specific DNN structures (Taki, 2017: Huang et al., 2020), and Bhattacharya (2020): Zhu et al. (2021) proposed to automatically learning initializations. However, these initializations were designed for standard DNN training, while they can generally lead to exploded certified bounds for IBP training as we will show in this paper.
2.3 Batch Normalization for DNN Training
Batch normalization (BN) (loffe& & Szegedy, 2015) is originally proposed to improve DNN training by reducing interval covariate shift. More recently, Santurkar et al. (2018) instead suggests that BN actually improves DNN training by smoothing the loss landscape without the necessity of reducing internal covariate shift, and BN can accelerate DNN training (Van Laarhoven, 2017). In this paper, we identify the extra benefit of using BN in IBP training.
3 Methodology
3.1 Notations and Definitions
We focus on improving IBP training, and we consider commonly adopted for perturbation setting
in adversarial robustness on K-way classification task, For DNN fo(x) with clean input x, there can be some perturbation 8 satisfying ||0]|oo I e, and the actual perturbed input to the model is x + 8.
3

---

In robustness verification for achieving certified robustness, we verify whether
[x + +6)ly [ + 5)]; > O, V s.t. i + y, ||ô]| S,
(2)
holds true, where (x+(x++)) +)]; is the logits score for class and y is the ground-truth. This is equivalent
to verifying whether the DNN provably makes correct prediction for all input x + ([]6]] oo S <e). For network fe. we assume that there are m hidden affine layers (either convolutional or fully-connected layers) with ReLU activation. We use h, to denote the pre-activation output value of the i-th layer, and h., denotes the j-th neuron in the i-th layer. We also use z, Rh, to denote the post-activation value. For a convolutional or tully-connected layer. we use W, and b, to denote its parameters, where W; R number of the layer respectively (He et al., 2015b). This is straightforward for a fully-connected layer, and for a convolutional layer with kernel size k. Gin input channels and Coa output channels, we can still view the convolution as an affine transformation with n; = k.C and r; = Cout In particular, we use hg x + denote the input layer perturbed by d (zg is not applicable).
IR" and r3 and n, are called the "fan-out" and "fan-in"
For IBP (Mirman et al., 2018; Gowal et al., 2018), it computes and propagates lower and upper bound intervals layer by layer until the last layer the verification objective. For pre-activation h, its interval bounds can be denoted as [h, h:). where h, < h; S h, (V]loll I e). Similarly, there also post-activation interval bounds [2, zi). Finally Eq. (2) can be verified by checking the lower bound of (x (x + 5) [fo(x + 6)];
3.2 Issues in Existing Certified Robust Training
In this section, we analyze the issues in existing IBP training. In particular, we identify two issues, including exploded bounds at initialization, and also the imbalance between ReLU activation states.
3.2.1
Exploded Bounds at Initialization
For simplicity, assume the network has feedforward architecture in this analysis, but the analysis can also be easily extended to other architectures. For affine layer h, = W 22 + b,, the IBP bound computation is follows:
h Wi,+2-1 + W., b;, h; Wi, W.
2: + b.,
(3)
where W.,+ stands for retaining positive elements in W, only while setting other elements to zero, and vice versa for W., -. h, be viewed as function with the post-activation value of the previous layer z; as input, denoted as (2,). In Eq. (3), the IBP bounds guarantee that h S (2,) < h; (v2, I 2; s 2,) for element-wise "S"
We then check the tightness of the interval bounds:
A - h - h = W 21 W
(4)
where A, denotes the gap between the upper and lower bounds, which can reflect the tightness of the bounds, and |W, stands for taking the absolute value element-wiis At initialization, assume that each W, independently follows a distribution with zero mean and variance o?, and the distribution is symmetric about O. For vector matrix with independent elements following the same distribution, we use E(-) to denote the expectation of this distribution. We can view each element in vector A, random variable that follows the same distribution, and denote its expectation as E(A,), to measure the expected tightness at layer i. As W; and 8, are independent, we have E(A:) = 12, W, (6),,.))) Detailed in Appendix D.I, we further have (E())) = (RReLU(h.)) ReLU (L,)),))) 1 (E( Ai), and
14 B(W ((W.))E(),-)).
E(D.)
(5)
2
Empirically, we can estimate E(A,) given batch of concrete data, by taking the mean, and we use ((A)) to denote the result of the empirical estimation.
We define a metric characterize what extent the certified bounds become looser, after propagating bounds from layer - 1 to layer i:
Definition 1. We define the difference gain when bounds are propagated from layer i 1 to layer i:
B(A.)
T4 B(W:))
(6)
Bounds are considered to be stable if the difference gain ((A,)) is close to 1.

---

active unstable
Ap
Conv 27
Canv S76
Conv
Ratio of ReLU neurons
3
Layer
Vanilaa Vanilla
Figure 1: We show that certified bounds explode initialization, in simple untrained CNN (the classification layer is omitted) using Xavier ini- tialization. We plot log É(A;) for each layer i.
Figure 2: Ratios active and unstable ReLU neurons for CNN-7 on CIFAR-I0 10 with different settings. The vanilla ones are not regularized, and "vanilla (w/o BN)" does not use BN either.
large difference gain indicates exploded bounds, but it cannot be much smaller than either to avoid signal vanishing in the model. We find that weight initialization in prior works have large difference gain values especially for layers with larger n,. For example, for the widely used Xavier initialization (Glorot & Bengio, 2010), the difference gain is & tyn,, and it can be as large as 45.25 45.25 when n, 32768 for fully-connected layer in experiments. This indicates that certified bounds explode at initialization. We illustrate the bound explosion in Figure 1, and in Appendix A, we list the difference gain of each existing initialization method in Table 5. As a result, long warmup schedules are important in previous works, to gradually tighten certified bounds and case training, but this is inefficient.
3.2.2 Imbalanced ReLU Activation States
We show another issue in existing certified training, where the models have a bias towards inactive ReLU neurons. Here "inactive ReLU neurons" are defined neurons with non-positive pre-activation upper bounds (h,, S 0), i.c., they always inactive regardless of input perturbations. Similarly, active ReLU neurons have non-negative pre-activation lower bounds (h,,; 2 0). There are also unstable ReLU neurons with uncertain activation states given different input perturbations (h,, 50
h, In IBP training, inactive neurons have tighter bounds than active and unstable ones as shown in Figure in Appendix B, and thus the optimization tends to push the neurons be inactive. We show this imbalance ReLU status in Figure 2 (vanilla w/o BN), and is more severe when the warmup is shorter shown in Appendix B.7. Too many inactive neurons indicates that many neurons essentially unused or dead, which will harm the model's capacity and block gradients as discussed by Lu et al. (2019) on standard training.
3.3 The Proposed Method
To address the aforementioned issues, we propose our method in three parts: 1) We derive new weight initialization for IBP training to stabilize the tightness of bounds at initialization; 2) We propose to fully add BN to mitigate the ReLU imbalance and stabilize the variance of bounds, while models in prior works did not have BN for some or all the layers. 3) We further propose regularizations to explicitly stabilize the tightness and the balance of ReLU states during warmup.
3.3.1 IBP initialization
We propose a new IBP initialization for IBP training. Specifically, we independently initialize each element in W, following normal distribution (0, of). and we aim to choose a value for o; such that the difference gain defined in Eq. (6) is exactly 1. When elements in W, follow the normal distribution, have B([W:)) 22/TO, and thereby we take a; La which makes the difference gain 2. B( W exactly This initialization can further calibrated for fon-eeedforward networks such as ResNet as we discuss in Appendix A.3.
5

---

3.3.2 Batch Normalization
Batch normalization (BN) (loffe & Szegedy, 2015) normalizes the input of each layer to distribution with stable mean and variance. It can improve the optimization for DNN as shown in prior works for standard DNN training (loffe & Szegedy, 2015; Van Laarhoven, 2017; Santurkar et al., 2018). 8).. In addition, for IBP training, BN can normalize the variance bounds, and it can also improve the balance of ReLU activation states by shifting the center of upper and lower bounds to zero (before the additional linear transformation which comes after the normalization). In prior certified training works (Gowal et al., 2018; 8: Zhang et al., 2020; Xu et al., 2020), they only used BN for some layers in some models but not all layers, and they did not identify the benefit of BN in certified training. We empirically demonstrate that fully adding BN to each affine layer can significantly mitigate the imbalance ReLU issue and improve IBP training. We follow the BN implementation by Wong et al. (2018); Xu et al. (2020) for certified training, where the shifting and scaling parameters are computed from unperturbed data.
Note that our previous analysis on IBP initialization considers network without BN. BN which rescales the output of each layer can still affect the tightness of IBP bounds, and the effect of IBP initialization may be weakened. This is a limitation of the proposed initialization which could possibly be improved by considering the effect of BN in future work. Nevertheless, in Appendix A.4, we empirically show that BN still does not cancel out the effect of IBP initialization.
3.3.3 Warmup Regularization
To further address the aforementioned two issues in Sec. 3.2, and to explicitly stabilize the tightness of certified bounds and balance ReLU neuron states, we add two regularizers in the warmup stage of IBP training. The regularizers are principled and motivated by the two issues we discover.
Bound tightness regularizer Similar to the goal of stabilizing certified bounds at initialization, we also expect keep the mean value of A; in the current batch, ((A,), stable along the warmup. Note that [B( (A)) is empirically computed from concrete batch and different from the expectation E(A,) at initialization In the initialization, we aim to make B(A,) = B(Ax-1). Here, we relax the
goal to making (A;) < ((Ao) with configurable tolerance value (0 (0<T5- 1), to balance the regularization power and the model capacity. We add the following regularization term:
1
E(Ao)
Leightness
ReLU(T E(A;)
Tmn
where the training is penalized only when rÉ(A)) > B(Do) due to the clipping effect by ReLU(-).
ReLU activation states balancing regularizer To balance ReLU activation states, we expect to balance the impact active ReLU neurons and inactive neurons respectively. Here, we consider the center of the interval bound, c, = (h, + /,2,2, and we model the impact as the contribution of each type of neurons to the mean and variance of the whole layer, i.e., E(c,) and Var(c,) respectively. Note that in the beginning almost all neurons are unstable, and gradually most neurons become either active or inactive. Therefore, we add this regularizer only when there is at least one active neuron and one inactive neuron, which generally holds true unless the training start. We use a; to denote the ratio between the contribution of the active neurons and inactive neurons respectively to (Cc;), and similarly we use B to denote the ratio of contribution to Var(c,). They are computed as:
E,I > 0)ais
3 = E, (). - i(c)))²
0; = E, 1(hr,j < 0)cr.i
Σ, 0)(c,. - B(c.))²
and in general a,, 8 > O. We regard that the activation states are roughly balanced as and 3, are close to 1. With the same aforementioned tolerance T, expect to make <a,, 3 < 1/T, which equivalent to making min(a,, 1/a;) 2 t, min(3,, 1/3.) 2 r. Thereby we design the following regularization term:
m
ReLU(T min(ar, 1 + ReLU(T min(3:, 11
Liela
(8)
Tm

---

3.4 Training Objectives
Certified robust training solves the robust optimization problem as Eq. (1), and when the inner maximization is verifiably solved, the base training objective without regularization is:
Lub = D,,,, where L(fo, v. N max L(fo(x + +8) v),
(9)
such that L(fo, x, y, c) an upper bound of L(fo(x + 6), y) given by robustness verifier, e.g., IBP. In our proposed method, we first initialize the parameters with our IBP initialization, and then we perform a short warmup with gradually increasing e (0 S 6 S Enarget), where émrget stands for the target perturbation radius that is usually equal to slightly larger than the maximum perturbation radius used for test. Our training objective L combines the ordinary objective Eq. (9) and the proposed regularizers:
C = Lob + (Crightnes + Crolu).
(10)
where À is for balancing the regularizers and the original Lieb loss. For simplicity and efficiency, we use IBP to compute the bounds in Liob and the regularizers. During warmup, we also gradually decrease \ from Ao to as grows, where X = Ao - 1/11 <mugee) After warmup, we only use & = fobb for final training with Curget. Note that in the regularizers, the value of each ReLU(.)) term has the same range [0, r], and thus in Eq. (10) we directly sum up them without weighing them for simplicity. In test, we still only use pure IBP bounds without any other tighter method.
4 Experiments
In the experiments, we demonstrate the effectiveness of our proposed method for training certifiably robust neural networks more efficiently while achieving better comparable verified errors.
4.1 Settings
We adopt three datasets, MNIST (LeCun al., 2010), CIFAR-10 (Krizhevsky et al., 2009) and TinyImageNet (Le & Yang, 2015). Following Xu et al. (2020), we consider three model architectures: a 7-layer feedforward convolutional network (CNN-7), Wide-ResNet (Zagoruyko & Komodakis, 2016) and ResNeXt (Xie et al., 2017). According our discussion in Sec. 3.3.2, we also modify the models to fully add a BN after every convolutional or fully-connected layer. For target perturbation radii, mainly Garget 0.4 for MNIST, Eaargtt 8/255 for CIFAR-10, and Gurget 1/255 for TinylmageNet, following prior works, and we provide results on other perturbation radii in Appendix B.3. We provide more implementation details in Appendix C. We mainly compare with the following SOTA baselines on all the settings (note that in our main results, we also make these baselines models with full BNs unless otherwise indicated):
Vanilla IBP (Gowal et al., 2018) with existing initialization and no warmup regularizer. We use the default Xavier initialization in PyTorch, and we find that orthogonal initialization originally used by Gowal et al. (2018) does not improve the performance here.
CROWN-IBS IBP (Zhang et al., 2020) with linear relaxation bounds by CROWN (Zhang et al., 2018) during warmup. We use the generalized and accelerated version with loss fusion by Xu et al. (2020), while the original version is O(K) (the number of classes) more costly. During the warmup, it combines bounds by IBP and linear relaxation with weight e/Enarget and (1 - e/tturpes) respectively.
4.2 Certified Robust Training with Short Warmup
We conduct certified robust training using relatively short warmup schedules to demonstrate the effectiveness of our proposed techniques for fast training. We show the results in Table for MNIST, CIFAR-10 and Table 2 for TinylmageNet. Compared to Vanilla IBP and CROWN-IBP. our improved IBP training consistently achieves lower standard errors and verified errors under same schedules respectively, where BN is added to the models for all these three training methods. We find that CROWN-IBP with loss fusion (Xu et al., 2020) tends to require larger number of epochs to obtain good results and it sometimes underperform Vanilla IBP under short schedules, but disabling loss fusion can make it much more costly and unscalable. In terms of the best results, we achieve verified error 10.82% on MNIST Etarget 0.4, 65.03% on CIFAR-10 Ctarget 8/255, and 82.36% on
7

---

Table 1: Standard and verified error rates (%) of models trained with different methods respectively on MNIST (Curget =0.4) and CIFAR-10 (Garge = 8/255). Schedule is represented as the total number of epochs and the number of epochs in each of the three phases with = 0, increasing and final e étrggr respectively. We report the mean and standard deviation of the results on 5 repeats for CNN-7 and 3 repeats for NeseeR and ResNeXt respectively. All models include BN after every layer (see Sec. 3.3.2). We also report the best run in "Ours (best)" since main results in prior works did not have repeats, Literature results with the "t" mark are concurrent works.
(0, Curget)
Schooduls (epochs)
CNN-7 (wilh full BN) Verified
Wide-ReaNa (with full
ResNeXi (with full Verified
Danaset
Method
Stundard
Standard
Verified
Standard
Vanilla IBP
D.06
1243 0.09
3.18
12.93 + 0.17
4.09 +
15:36 0.94
70 (0+20+50)
CROWN-IBP
Ours
2.33 0.08
0.12
11.03 = 0.13
12.04
2.77 + 0.02
11.76 + 9.07
0.15
3.22 +: 0,08
13.43 : 0.17
15.24 0.78
Ours (best)
2.20
10.82
2.75
11.69
3.17
13.20
MNIST
Literalure resulls
Warmup
Total tepocts)
Standard
Vertlidd
Gowal et al. (2018)
(2K-10K) steps
100
1.66
15.01
Zhung (2020)
[9 + 51) spociss
200
2.17
12.06
IBP+ ParamRamp (Lyu et al., 2021)*
[9 + 51) epochs
200
2.16
10.88
(Lyu et al., 2021)*
[9 51) spoclss
200
2.36
10.61
Vanilla IBP
58.72 + 0.27
69.88 = 0.10
58.85 + 0.22
69.77 +: 0.32
60.10
= 0.27
71.19
0.21
70 (14304449)
CROWN-IBP
63.19 +: 0.36
71.29 = 0.119
62.76
+: 0.25
71.82 +: 0.30
64.75 = 0.50
72.50 0.20
Qurs
56.64 0.48
0.24
56.74
0.40
68.71 0.29
59.33
0.86
70.62
0.59
Vanilla IBP
33.50 1: 0.7]
67.01 0.29
$4.31 0.46
67:45
0.21
55.23
0.12
68.28 0.15
160 (1+80+
CROWN-IRP
56.76 +: 0.76
69.67
0.38
60.30
+ 0.35
70.07
# 0.42
61.08
= 0.35
71.26
:: 0:11
Ours
$1.72 1 0.40
65,58
0.32
51.95 1: 0.27
65.91 1: 0.14
53.68
= 0.33
66.91 0.40
(best)
$1.06
65.03
51.63
66.41
CIFAR-10
Literature results
Warmup
Total (epochs)
Standard
Venified
Gowal et al. (2018)
(SK)) steps
3,200
50.51
68.24
Zhang (2020)
(320 + 1600) epochs
3,200
54.02
66,94
Balunavic & Vechey (2020)
NIA
800
48.3
72.5
Xu et al. (2020)
(100 800) epochs
2,000
53.71
66.62
IRP4Paramkamp (1 yu el., 2021)
(320 4 16000) epochs
3,300
55.38
CCROWN-IB.. I ParomRamp (Lyu et al., 2021)
(320 1 1600) epochs
3,200
$1.94
65.08
12.-dit -ist net (other urchitecturre (Phang et at., 2021)*
48.32
64.90
CROWN-IBP here follows Xu et al. (2020) with loss fusion for efficiency, but we found it does not perform well with a short training schedule under our settings and usually requires longer schedule to achieve good results. Some test results in Gowal et al. (2018) are obtained with costly mixed integer programming (MIP) and linear
programming (LP); we take IBP verified errors for fair comparison following Zhang et al. (2020).
Additional PGD adversarial training was involved for this result, according to Zhang et al. (2020).
BBlunovic & Vechev (2020) used a different training scheme and train the network layer by layer.
Lyu et al. (2021) use IBP- bbseb and CROWN- IBP-based training respectively with their parameterized activation, and they use a tighter linear bound propagation method for testing instead of IBP.
"Zhang et (2021)
very different model architecture with f. distance neurons rather than traditional DNNs, but still need long schedule on both e and l, norn where p is gradually increased until co.
Table 2: Standard and verified error rates (%) on TinyImageNet (e, = 1/255). The best result in literature (Xu et al., 2020) has standard error of 72.18% and verified error of 84.14% using 800 epochs. We achieve 82.36% verified error using only 80 epochs.
Schedule (epochs)
Vanilla IBP
CROWN-IBP
Ours
Model (with full BN)
Standard
Verified
Standard
Verified
Standard
Verified
CNN-7
(1+10+69)
75.50
82.92
76.00
82.81
75.20
82.45
(1+20+59)
74.68
82.84
76.27
83.35
74.29
82.36
80 (1+100669
75.89
83.00
75.85
83.65
74,90
82,49
Wide-ResNet
80 (1+20+59)
75.65
83.17
75.95
83.08
74.59
82.75
80X1+0++69)
82.39
87.15
85.47
89.11
80.20
85.77
ResNeXt
80 (1+20459)
81.72
87.10
80.81
86.43
78.91
85.78
The Wide-ResNet model used here 5 times smaller than the one used in Xu et al. (2020) to save training time. Additionally, we include BN after every layer in all models (see Section 3.3.2).
TinyImageNet Eurget = 1/255, which makes a notable improvement over literature SOTA (Gowal et al., 2018; Xu et al., 2020) that used long training schedules. Compared to concurrent works (Lyu et al., 2021: Zhang et al., 2021) which use different improvement techniques, we have comparable verified errors, but they still need long training schedules. For reference, we tried Zhang et al. (2021) which used a different architecture with "E.x distance neurons" rather than convolution-based DNNs. On CIFAR-10 10 using 160 total epochs by reducing their training schedule proportionally, their verified error 68. 68.44% which is much higher than ours. Overall, the results demonstrate that our improved IBP training is effective for more efficient certified robust training with shorter warmup.
8

---

4.3 Comparison on Training Cost
Table 3:
Comparison of estimated time cost (seconds), for CNN-7 on CIFAR-10. We report the total time, and also the per-epoch time during three training phases of e schedule for methods with a short warmup. Literature results with the "i" mark are considered as concurrent.
Epach time each phase
Method
Epochs
0
(0, firge)
Farge
(s)
(Gowal et al., 2018)
40496
CROWN-IBP (wlo loss fusion) (Zhang et al., 2020)
3200
91258
Literature Results
CROWN-IBP (Ku et al., 2020)
52362
IBBP ParamRamp (uuu et 2021)
3200
40496
1.00
BHOWN--IBPPPrammfe (Lyu et al., 2021)
3200
91288
1,51
Vanilla
30.0
54.8
54.8
8747.9
Short Warmup
CROWN IBP
160
30.0
78.5
54.8
10641_1
Ours
64.0
64.0
54.8
9512.3
4 GPUs were used and their models are slightly different (we add BN after every layer).
The factors 1.09 and 1.51 are the overhead of their method reported by (Lyu et al., 2021) when combining with IBP or CROWN-IBP.
We compare the training cost using a single NVIDIA RTX 2080 Ti GPU. For methods using short warmup, we measure the per-epoch time cost during three different phases, namely c=0, <<<<< Curget and = Crarget. and we then estimate the total training time according to the schedule. We use gradient accumulation wherever needed to fit the training into the memory of a single GPU. We also compare with total time cost with literature methods using long schedules. We show the results of CNN-7 for CIFAR-10 in Table 3, and other settings in Appendix B.I. For = 0, Vanilla IBP and CROWN-IBP use regular training while we compute IBP bounds for regularization and have a small overhead, but this phase is extremely short (no more than epoch here). For 0 <<c < Cargett our method has a small overhead on regularizers compared to Vanilla IBP, while CROWN-IBP using linear relaxation can be more costly. For e = Etarget, all the three methods use the same pure IBP.
For total time on CIFAR-10 with the same 160-epoch schedule. we only have small overhead of around 9% ~ 13% compared to Vanilla IBP and the cost is still around 12% ~ 23% lower than CROWN-IBP. while we achieve lower verified errors than the baselines under such short warmup schedules (see Table 1). And importantly, compared to literature using long training schedules. we significantly reduce the number of training epochs and the total training time (e.g., Xu et al. (2020) is around 2 more costly than ours total).
4.4 Ablation Study and Discussions
In this section, we empirically verify whether each part of our modification contributes to the improvement and whether they behave as we expect. We conduct an ablation study and also plot the curve of the regularization terms to reflect the bound tightness and ReLU balance during training.
We use CIFAR- 10 with the currently best CNN-7 model under the "1 + 20" and "1 + 80" warmup schedules as used in Table 1. We report the results in Table 4. The first three rows show that fully adding BN improves the training when vanilla IBP is used, and it is important to add BN for the fully-comnected layer, which was missed in prior works. Based on the improved model structure, adding both IBP initialization and warmup regularization further improves the performance, and removing either of these parts leads to a degraded performance.
We notice that adding IBP initialization without warmup regularization may not improve the verified error. A factor is that IBP initialization can reduce the variance of the outputs (see Appendix D.2), and it may harm the training during the early warmup, when is small and certified training is close to standard training. Also, the effect of initialization can be weakened when e is much smaller than Surget. But the warmup regularization can continue to tighten the bounds, and the IBP initialization can benefit the optimization for the tightness regularizer. Nevertheless, IBP initialization is more beneficial for deep models where the exploded bound issue is more severe (see Appendix B.8).
is also important to fully add BN to make the warmup regularization work well. BN can normalize the variance of the layers, so the tightness regularizer can more effectively tighten certified bounds w.r.t. the stable variance; otherwise the the training may trivially optimize tightness regularizer by making the magnitude of the network output small.
9

---

Table Standard eтror and verified error rates (%) in the ablation study with CNN-7 on CIFAR-10 "BN-Conv" stands for BN after each convolutions, and "BN-FC" stands for BN after the hidden fully-connected layer. "V" means that the component enabled, and "x" means that the component is disabled. We repeat each setting for 5 times and report the mean and standard deviation.
BN-Conv
BN-FC
IBP Initialization
Lugunes
70 (1+20+49) epochs
160 (I+80+79) epochs
Standard
Verified
Standard
Verified
59.33:10.70
10.1810..8
$7.08
63.43-10.28
61.9511080
71.12:10.42
57.21110.5
69.21110.30
58.72:1.227
69 89.8800.100 10
53.8010.71
67.01:10.29
58.93=00.29
69.60+0.35
54.59=0.64
67.63:10.34
56.76.10.38
68 40.99
53.08.10.26
66. 66.74.10.20
58.49:10.42
69.38:10.23
53.29:10.66
66 66.46:10.44
58.79=00.40
69.29::0.28
5..45=0.34
66.34:00338
56.64=0.48
68.81=00.24
51.72=00.40
65.58=0.32
Vanill IBP
Vanilia IBP
Vanill
1.4
0.8-
IBP initaalization only
IBP initialization only
Regularizers only
1.2-
Regularizers
Inttiallzatton & regulartzers
Inizalization & regularizers
0.8
0.6
0.4
0.2
0.0
0.0
30
60
40 Training epoch
Training epoch
Figure 3: Lightess during warmup. Lighness is optimized only for "regularizers only" and "ini- tialization & regularizers" setting, and BN is fully added to every layer except for "Vanilla IBP (w/o BN)".
Figure 4: Lietu during warmup, under same set- ting as Figure 3.
Finally, we also plot the training curves of the regularizers to confirm if the regularizers are effectively optimized, so that the bound tightness and ReLU balance are indeed improved. Note that for the settings without regularizers,
only plot but not optimize the regularizers. In Figure 3, plot Lighhnsss By using the regularization in training, Lightnsss descends faster, and further adding the IBP initialization leads to even faster descent during the early epochs. In Figure 4, we show that the Lretu indeed under control when we optimize it, while Liela could gradually grow larger when the is not added in training. Notably, when BN is removed and the regularization term is not optimized (Vanilla IBP (w/o BN)), Lretu becomes extremely large later epochs, and Ligghtess is also large in the end, which suggests that the training is hampered.
5 Conclusion
In this paper, we identify two issues in existing certified robust training methods regarding exploded bounds and imbalanced ReLU neuron states. To address these issues based IBP training, propose an IBP initialization and warmup regularization, and we also identify the benefit of fully adding BN. With our improvements, we demonstrate that we are able achieve better verified errors using much shorter warmup and training schedules compared to literatures under the same convolution based network architecture, for fast certified robust training.
10

---

Funding Disclosure
This work is supported in part by NSF under IIS-1901527, IIS-2008 IIS-2048280 and by Army Research Laboratory under agreement number W91 19
Additional revenues related this work: Zhouxing Shi and Yihan Wang were interns at JD AI Research when this work was partly done; Cho-Jui Hsieh has part-time employment at Amazon.
References
Abadi, M., Agarwal, A., Barham, P., Brevdo, E., Chen, Z.., Citro, C.,, Corrado, G. S., Davis, A., Dean, J., Devin, M., Ghemawat, S., Goodfellow, I., Harp, A., Irving, G., Isard, M., Jia, Y., Jozefowicz, R., Kaiser, L.., Kudlur, M., Levenberg, J., Mane, D., Monga, R., Moore, S., Murray, D., Olah, C., Schuster, M., Shlens, J., Steiner, B., Sutskever, I., Talwar, K., Tucker, P., Vanhoucke, V.,
Vasudevan, V., Viegas, F., Vinyals, O., Warden, P., Wattenberg, M., Wicke, M., Yu, Y. and Zheng, X. Tensorflow: Large-scale machine learning on heterogeneous distributed systems, 2016.
Arpit, D., Campos, V., and Bengio, Y. How to initialize your network? robust initialization for weightnorm &amp; resnets. In Wallach, H., Larochelle, H., Beygelzimer, A., d'Alché-Bue Buc, F., Fox, E., and Garnett, R. (eds.), Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019, URL https: /pppceediingeeee newriin.urpppp. wweurip..ccpppeeeeeeeeeeeeeeeeee cc/paper/2219/filee e520f 00007772.:00000666666666600 Paperr.
Balumovic, M. and Vechev, M. Adversarial training and provable defenses: Bridging the gap. In International Conference on Learning Representations, 2020.
Bhattacharya, A. Learnable weight initialization in neural networks. 2020.
Blum, A., Dick, T., Manoj, N., and Zhang, H. Random smoothing might be unable to certify foc robustness for high dibensiinnii images. Journal of Machine Learning Research, 21:1-21, 2020.
Bunel, R., Turkaslan, I., Torr, P. H. S., Kohli, P., and Kumar, M. P. Piecewise linear neural network verification: A comparative study. CoRR, abs/1711 111.00455, 2017. URL http::tt////e //arxiv. org/ /bs/ 1711. 1711.00455 00455.
Carlini, N. and Wagner, D. Adversarial examples are not casily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop Artificial Intelligence and Security, pp. 3-14. ACM, 2017.
Chen, H., Zhang, H., Chen, P.-Y., Yi, J., and Hsieh, C.-J Attacking visual language grounding with adversarial examples: A case study on neural image captioning. arXiv preprint arXiv:1712.02051 2017.
Choi, J.-H., Zhang, H., Kim, J.-H., Hsieh, C.-J,, and Lee, J.S. Evaluating robustness of deep image super-reso resolution against adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 303 003-311, 2019.
Cohen, J. M., Rosenfeld, E., and Kolter, J. Z. Certified adversarial robustness via randomized smoothing. In ICML, 2019.
Dvijotham, K., Gowal, S., Stanforth, R., Arandjelovic, R., O' D'Donoghue, B., Uesato, J., and Kohli, P. Training verified learners with learned verifiers. arXiv preprint 1rX.: 10265, 2018.
Glorot, X. and Bengio, Y. Understanding the difficulty of training deep feedforward neural networks. In Teh, W. and Titteiigton,, M. (eds.), Proceedings of the Thirteenth International Conference on Artificial Intelligence and Statistics, volume 9 of Proceedings of Machine Learning Research, pp. 249-256, Chia Laguna Resort, Sardinia, Italy, 13-15 15 May 2010. JMLR Workshop and Conference Proceedings. URL http: pwwceedingss....m mlr. press/vee vv/ het/gglrootto 10 Oa. html.
Goodfellow; J., Shlens, J., and Szegedy, Explaining and harnessing adversarial examples. In ICLR, 2015.
11

---

Gowal, S., Dvijotham, K., Stanforth, R., Bunel, R., Qin, C., Uesato, J., Mann. T., and Kohli, P. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv: arXiv:1810.127/5. 2018.
Hanin, B. and Rolnick, D. How to start training: The effect of initialization and architec- ture. In Bengio. S.. Wallach, H., Larochelle, H., Grauman, K., Dasa-Bianchi, N., and Garnett, R. (eds.), Advances in Neural Information Processing Systems, volume 31. Cur- ran Associates, Inc., 2018. URL https://proceeee (0111901022200040409944440000000
neurips wtt.cc//pppppc cccpppprr/018/fille pdf.
He, K., Zhang, X., Ren, S., and Sun, Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. In Proceedings of the IEEE International Conference on Computer Vision (ICCV). December 2015a.
He, K., Zhang, X., Ren, S., and Sun, Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. In Proceedings of the IEEE International Conference Computer Vision (ICCV), December 2015b.
Huang, X. S., Perez, F., Ba, J., and Volkovs, M. Improving transformer optimization through better initialization. In III, H. D. and Singh, A. (eds.), Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pp. 4475 4483. PMLR. 13-18 Jul 2020. URL http::/ppooceeeinnnee
mlr press/vii99 https//vv1//hhhagggee html.
loffe, S. and Szegedy, C. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference on machine learning, pp. 448-456. PMLR, 2015.
Jovanović, N., Balunović, M., Baader, M., and Vechev, M. Certified defenses: Why tighter relaxations may hurt training? arXiv preprint arXiv:2102.067000 2021.
Katz, G., Barrett, C., Dill, D. L., Julian, K., and Kochenderfer, M. Reluplex: An efficient smt solver for verifying deep neural networks. In International Conference on Computer Aided Verification, pp. 97-117. Springer, 2017.
Kingma, D. and Ba, J. Adam: method for stochastic optimization. arXiv preprint arXiv: 1412,6990 2014.
Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. Technical Report TR-2009, 2009.
Kumar, A., Levine, A., Goldstein, T., and Feizi, S. Curse of dimensionality on randomized smoothing for certifiable robustness. In International Conference on Machine Learning, pp. 5458-5467. PMLR, 2020.
Kurakin, A., Goodfellow, I., and Bengio, S. Adversarial examples in the physical world. arXiv preprint arXiv:1607 02533, 2016.
Le, Y. and Yang, X. Tiny imagenet visual recognition challenge. CS 231N, 2015.
LeCun, Y., Cortes, C., and Burges, C. Mnist handwritten digit database. ATT Labs [Online]. Available: htp::/yann www.:/ywann.eeeu..oo www.lllcccccc..... cwwpexdb//m/i/it.t...mmmm/m// 2, 2010.
Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D.. and Jana, S. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 656-672. IEEE, 2019.
Lee, S., Lee, W., Park, J., and Lee, J. Loss landscape matters: Training certifiably robust models with favorable loss landscape. 2021. URL https://openrevieee http://orrrm//////xxx.eeeeeoaoo
Li, B., Chen, C., Wang, W. and Carin, L. Certified adversarial robustness with additive noise. In Advances in Neural Information Processing Systems, pp. 1464,9977, 2019.
Lu, I.., Shin, Y., Su, Y., and Kamiadakis, G. E. Dying relu and initialization: Theory and numerical examples. arXiv preprint arXiv:1903.06753 2019.
12

---

Lyu, Z., Guo, M., Wu, T., Xu, G., Zhang, K., and Lin, D. Towards evaluating and training verifiably robust neural networks, 2021.
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
Mirman, M., Gehr, T., and Vechev, M. Differentiable abstract interpretation for provably robust neural networks. International Conference on Machine Learning. pp. 3575-3583, 2018.
Paszke, A., Gross, S.. Massa, F., Lerer, A., Bradbury, J.. Chanan, G., Killeen, T., Lin, Z., Gimelshein, N., Antiga. L., Desmaison, A., Kopf. A., Yang, E., Vitioo, Z., Raison, M., Tejani, A., Chilamkurthy, S., Steinee, B., Fang, I.., Bai, J., and Chintala, S. Pytorch: imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems 32, pp.
Curran Associates, Inc., 2019.
Raghunathan, A., Steinhardt, J., and Liang, Certified defenses against adversarial examples. International Conference on Learning Representations (ICIR), arXiv preprint arXiv: 1801180014494 2018a.
Raghunathan, A., Steinhardt, J., and Liang, P. S. Semidefinite relaxations for certifying robustness to adversarial examples. In Advances in Neural Information Processing Systems, pp. 10877-10887, 2018b.
Salman, H., Li, J., Razenshteyn, I., Zhang, P., Zhang, H., Bubeck, S., and Yang. G. Provably robust deep learning via adversarially trained smoothed classifiers. In Advances in Neural Information Processing Systems, pp. 1129-11130, 2019.
Santurkar, S., Tsipras, D., Ilyas, A., and Mądry, A. How does batch normalization help optimization? In Proceedings of the 32nd international conference neural information processing systems, pp.
2498, 2018
Saxe, M., McClelland, L.,, and Ganguli, S. Exact solutions to the nonlinear dynamies of learning in deep linear neural networks. arXiv preprint arXiv:1312.6122 2013.
Singh, G., Gehr, T., Mirman, M., Püschel, M., and Vechev, M. Fast and effective robustness certification. In Advances in Neural Information Processing Systems, pp. 10825-10836, 2018.
Singh, G., Gehr, T., Püschel, M., and Vechev, M. An abstract domain for certifying neural networks. Proceedings of the ACM Programming Languages, 3(POPL):41, 20199.
Su, D., Zhang, H., Chen, H., Yi, J., Chen, P.-Y., and Gao, Y. Is robustness the cost of accuracy?-a comprehensive study on the robustness of deep image classification models. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 631-648, 2018.
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. In ICLR, 2013.
Taki, M. Deep residual networks and weight initialization. CoRR, abs/1709.02256, 2017. URL 0ttp//779.009955
http://arxiv.orge
Van Laarhoven, T. 1.2 regularization versus batch and weight normalization. arXiv preprint
1700::100..05350, 2017.
Wang, S., Chen, Y., Abdou, A., and Jana, Mixtrain: Scalable training of formally robust neural networks. arXiv preprini arXiv: 1.02625, 2018: 8a.
Wang, S., Pei, K., Whitehouse, J., Yang, J., and Jana, S. Efficient formal safety analysis of neural networks. In Advances in Neural Information Processing Systems, pp. 6367-6377, 2018b.
Wang, S., Zhang, H., Xu, K., Lin, X., Jana, S., Hsieh C.-J., and Kolter, Z.. Beta-crown: Efficient bound propagation with per-neuron split constraints for complete and incomplete neural network verification. arXiv preprint arXiv:2103..mmm 063.06624 2021.
Wong, F. and Kolter, Z. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pp. 5283-5292, 2018.
13

---

Wong, E., Schmidt, F., Metzen, J. H., and Kolter, J. Z. Scaling provable adversarial defenses. In NIPS, 2018.
Xiao, K. Y., Tjeng, V., Shafiullah, N. M., and Madry, A. Training for faster adversarial robustness verification via inducing relu stability. In ICLR, 2019.
Xie, S., Girshick, R., Dollár, P., Tu, Z., and He, K. Aggregated residual transformations for deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1492-1500, 2017.
Xu, K., Shi, 7 Zhang, H., Wang, Y., Chang, K.- Huang, M., Kailkhura, B., Lin, X., and Hsieh, C.-J. Automatic perturbation analysis for scalable certified robustness and beyond. Advances in Neural Information Processing Systems, 33, 2020.
Yang, G., Duan, T., Hu, J. E., Salman, H., Razenshteyn, and Li, Randomized smoothing of all shapes and sizes. In International Conference on Machine Learning, pp. 10693-10705. PMLR, 2020.
Zagoruyko, S. and Komodakis, N. Wide residual networks. arXiv preprint urXiv:1605.077 2016.
Zhang, B., Cai, T., Lu, Z., He, D., and Wang. L. Towards certifying foe robustness using neural networks with f dist neurons. arXiv preprint
2021.
Zhang, H., Weng, T.WW., Chen, P.-Y,, Hsieh, C.-J, and Daniel, L. Efficient neural network robustness certification with general activation functions. In Advances in neural information processing systems, pp. 4939-4948, 2018.
Zhang. H., Chen, H., Xiao, C., Li, B., Boning, D., and Hsich, C.-J. Towards stable and efficient train- ing of verifiably robust neural networks. In International Conference on Learning Representations, 2020.
Zhu, C.,, Ni, R., Xu, Z.., Kong, K., Huang, W. R., and Goldstein, Gradinit: Learning to initialize neural networks for stable and efficient training, arXiv preprint arXtv:2102.08099, 2021.
Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] In Section 3.3.2.
(c) Did you discuss any potential negative societal impacts of your work? [N/A] We believe there is no negative societal impact.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [Yes]
(b) Did you include complete proofs of all theoretical results? [Yes] Additional proofs are in Appendix D.
3. If you experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or as URL)? [Yes] We include the
link to our open-source code.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] See Section 4 and Appendix C.
(c) Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [Yes] See Table and Table 4.
(d) Did you include the total amount compute and the type of resources used (e.g., type of GPUs, internal cluster, cloud provider)? [Yes] See Section 4.3 and Appendix C.
14

---

4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes] See Sec. 4.1 and Appendix C.
(b) Did you mention the license of the assets? [N/A] The datasets we use are all widely adopted benchmark datasets.
(c) Did you include any assets either in the supplemental material or as URL? [N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you're 're using/curating? [N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A] We do not have crowdsourcing experiments or human evaluations. (b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
15


Reviews:
[{"review_id": "VuDyDQZ_YsM", "reviewer": "Reviewer_gGDq", "summary": "Authors consider the problem of certified training and identify two main issues:\nstandard weight initialization causes explosion in certified training and ReLU activations are imbalanced.\nFurther, they also add batch normalization to the architectures they train.\nThey perform experimental evaluation of their approach on MNIST, CIFAR-10 and TinyImageNet.\n", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Generally, I think that problem considered in this paper is quite important.\nSo far, training models with SOTA certified robustness has been quite difficult with limited resources, and I like the idea of this paper to try to make the training faster.\n\nI think it is somewhat unfortunate that the main approach is not that principled (except maybe the insight with new initialization), and it boils down to combining 4 different improvements. However, ablation study shows that all of the losses are indeed necessary. Could you comment on main differences between your regularizers and the ones from Xiao et al. or COLT?\n\nI am also curious whether the improvements presented here could also be applied to training methods other than IBP, for example CROWN-IBP. Have authors tried this?\n\nIn L250, authors write that they \"significantly outperform literature SOTA\" which might be a bit of an overclaim. Comparing to results from CROWN-IBP paper, improvements seem to be around 2% on MNIST and 1% on CIFAR-10, so it is questionable how significant this is. I think improvement is still nice, but I would perhaps rephrase the formulation.\n\nOverall, I am leaning towards accepting this paper due to the nice speedup compared to prior work which could somewhat democratize certified training. My main negative point is that combining 4 different improvements is somewhat unprincipled.\n\nHere are some typos I found:\n\nL21: problem have -> problems have\n\nL74: methods -> method\n\nL278: contribute -> contributes\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "4"}, "extra_text": {}}, {"review_id": "SKof_7k8I7_", "reviewer": "Reviewer_NvoX", "summary": "The paper identifies two major issues of the current IBP training that contribute to the required long warmup schedule. Subsequently, authors propose three tricks for mitigating those issues, which include adding BN to each layer, initializing parameters with IBP specified random initialization, and adopting two regularization terms. Experimental results verified the usefulness of the proposal.", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The submission is a good engineering  paper that introduces several useful and easy tricks for shortening the warmup phase of IBP training. With the proposed techniques, certified robust training might be more accessible to the community. \nThe motivation for IBP initialization and the two regularizers are sufficient. The writing is also quite clear.\nMinor concerns are specified in Limitations.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "1. As one of the itemized contribution of this paper, the study for the contribution of BN layer is somewhat insufficient. Although Fig2 does show some effect of BN in controlling the number of active neurons, it seems the improvement is marginal compared with \"Ours\" (with regularizers). Table 4 also lacks such ablation comparisons (all tricks added but full BN). \n2. The standard deviation is not reported in Table 2.\n3. The name of the models should be unified in Table 1 and 2.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "FyO11gX3rR", "reviewer": "Reviewer_3ihN", "summary": "In this paper, the authors targeted the certifiable robust training problem. They identified two important issues in existing SOTA methods, namely exploded bounds at initialization, and the imbalance in ReLU activation states, which makes certified training difficult and unstable and thus requires a long warmup. Then the authors proposed several ways to mitigate these issues. Specifically, they used a new weight initialization method, added Batch Normalization to each layer, and proposed a new regularizer to explicitly tighten certified bounds and balance ReLU activation states. The numerical results showed that the proposed methods improved the performance. ", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper basically followed the Interval Bound Propagation and found some issues with the previous IBP SOTA approaches. However, I have some questions for the \"issues\" identified in the paper: \n\n1. The current assumptions on the $\\mathbf{W}_i$ and $\\mathbf{h}_0$, and the definitions of $\\bar{z}_i, \\underline{z}_i$ are not quite clear and makes reader hard to follow. \n2. $\\delta_i$ and $\\Delta_i$ should be vectors, so what does $\\log \\mathbb{E}(\\Delta_i)$ means in the Figure 1. \n3. The derivation of Equation (11) in Appendix D: could you explain more on why $p(-c|\\mathbf{W}_i) = p(c|\\mathbf{W}_i) $? Given $\\mathbf{W}_i$, then $c$ depends on $\\bar{z}_i, \\underline{z}_i$. However, they have a trivial lower bound $0$, since we are considering the ReLU activation function, which means they will not be symmetric. How could you get the desired results? \n4. Can the authors explain why a fully BN improves the performance intuitively? \n\nFor the numerical simulation, the authors only compare IBP related approaches, I was wondering if the authors could compare other types of certified robust methods, such as [1]. Besides, in Figure 5, it seems if we further train the model, all methods will achieve similar performance. Could the authors add an experiment with longer training epochs? \n\nThe authors should reorganize the paper to make it clearer. \n\n\n\n\nMinors: \n\n1. Typos: e.g., line 22, has attracted, etc.\n2. citation format, e.g., line 40. in [50], etc. \n\nIf the authors could address my questions, I am willing to raise my score. \n\n\n\n[1] Li, Bai, et al. \"Certified adversarial robustness with additive noise.\" *arXiv preprint arXiv:1809.03113* (2018).", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper seems to make significant empirical improvements on the runtime of the certified robustness via a combination of four "tricks". The reviewers appear to be generally happy with the empirical improvements, but are somewhat concerned about the use of 4 tricks (each of which helps) that are not sufficiently justified theoretically. These pros and cons make this paper a borderline paper but the AC balances them and would like to recommend acceptance for the paper. The main consideration of the AC is that having principled approaches in this area is in the AC's opinion difficult. Therefore, the AC finds the empirical improvements with proper evaluations slightly outweigh the lack of principled techniques in this case. 
Decision: Accept (Poster)