On the Scalability of Certified Adversarial Robustness with Generated Data
Authors: Thomas Altstidl
David Dobre
Arthur Kosmala
Bjoern Eskofier
Gauthier Gidel
Leo Schwinn
Venue: NeurIPS 2024 poster (2024)
Keywords: certified robustness
adversarial robustness
scaling
generated data
Primary area: safety_in_machine_learning
TL;DR: There exist inherent limitations when scaling certifiably robust Lipschitz-constrained models with additional generated data.

Abstract: Certified defenses against adversarial attacks offer formal guarantees on the robustness of a model, making them more reliable than empirical methods such as adversarial training, whose effectiveness is often later reduced by unseen attacks. Still, the limited certified robustness that is currently achievable has been a bottleneck for their practical adoption. Gowal et al. and Wang et al. have shown that generating additional training data using state-of-the-art diffusion models can considerably improve the robustness of adversarial training. In this work, we demonstrate that a similar approach can substantially improve deterministic certified defenses but also reveal notable differences in the scaling behavior between certified and empirical methods. In addition, we provide a list of recommendations to scale the robustness of certified training approaches. Our approach achieves state-of-the-art deterministic robustness certificates on CIFAR-10 for the $\ell_2$ ($\epsilon = 36/255$) and $\ell_{\infty}$ ($\epsilon = 8/255$) threat models, outperforming the previous results by $+3.95$ and $+1.39$ percentage points, respectively. Furthermore, we report similar improvements for CIFAR-100.

On the Scalability of Certified Adversarial Robustness with Generated Data
Thomas Altstidl'
David Dobre Arthur Kosmala
Björn Eskofier'
Gauthier Gide13.1
Leo Schwinn
Machine Learning and Data Analytics Lab, FAU Erlangen Nürnberg, Germany
2 Institute AI for Health, Helmholtz Zentrum München, Germany Mila, Université de Montréal, Canada CCnada CIFAR AI Chair
Data Analytics and Machine Learning, Technische Universität München, Germany
{thomas. r bebsstddd,jjjeeee wtwp:/eewww..oeeeeeeee.ee es de
{david-a alavid-a.dbbre...o gidia Smalal quebec
{a. kosmal,,,, 1. schwinn)@tum.cc
Abstract
Certified defenses against adversarial attacks offer formal guarantees on the ro- bustness of a model, making them more reliable than empirical methods such as adversarial training, whose effectiveness is often later reduced by unseen attacks. Still, the limited certified robustness that is currently achievable has been a bot- tleneck for their practical adoption. Gowal al. and Wang et al. have shown that generating additional training data using state-of-the-ar diffusion models can considerably improve the robustness of adversarial training. In this work, we demonstrate that a similar approach can substantially improve deterministic certi- fied defenses but also reveal notable differences in the scaling behavior between certified and empirical methods. In addition, we provide a list of recommen- dations to scale the robustness of certified training approaches. Our approach achieves state-of-the-ar deterministic robustness certificates on CIFAR-10 for the (E 36/255) and fo (e 8/255) threat models, outperforming the previous results by +3.95 and +1.39 percentage points, respectively. Furthermore, we report similar improvements for CIFAR-100.
Introduction
Deep learning models have been successfully applied for variety of different applications. However, it is widely recognized that the vulnerability neural networks adversarial examples [1] remains an open problem and hinders their adoption in safety-critical domains. Prior research on improving the robustness of neural networks against adversarial examples can be broadly classified into empirical [2]
3) and certified approaches [
Here, the training data of neural networks is augmented with adversarial examples, improving the robustness against attacks at inference time. Recent work has demonstrated that adversarial training can be considerably improved using synthetically generated data, even without training the generative model with external data [ 6). Nevertheless, empirical robustness has repeatedly been shown to be ineffective against more sophisticated attacks developed in subsequent work 7
Adversarial training is currently the most prominent empirical robustification method S
In contrast to empirical methods, certified approaches yield robustness guarantees given predefined threat model, most often based on the f,, l2, or foe norm. As result, these methods provide reliable protection against future attacks. Nevertheless, the robustness guarantees achieved by certification
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

CIFAR-10 (lx,, c 8/255)
CIFAR-10 (62, 36/255)
Clean Accuracy (%)
60
Clean Accuracy (%)
80
2018
201 9
2020
2021 1
70
40
2022
2023
Ours
25
30
35
40
55
60
65
Certified Accuracy (%)
Certified Accuracy (%)
Figure 1: Certified and clean accuracy of top-ranked models on CIFAR-10 taken from the SoK Certified Robustness for Deep Neural Networks [[O] leaderboard. By using data generated by an elucidating diffusion model (EDM), accuracy significantly improves for four different models and two different norms (E and fz). Grey arrows indicate improvements stemming from this data augmentation.
methods are generally substantially lower than the robustness obtained by empirical defenses for the same threat model g]
In this work, we aim to analyze how well certified robustness scales when utilizing additional data generated by diffusion models during the model training, recipe that has previously proven successful for empirical robustness. Only Hu et al. [9] have already used generated data, and thus a broader in-depth review of the factors influencing scalability is to date missing. In our empirical study, we analyze models trained to be robust against foo and models trained to be robust against lg norm attacks. The proposed approach improves robustness for both the (Loc; c = 8/255) and (62, c = 36/ 26/2 threat models on CIFAR-10, improving upon the previous results in the literature by 3.95%p and 1.39%p (percentage points), respectively. In most experiments, the increase in certified accuracy is accompanied by an increase in accuracy clean data, where we observe improvements by up to 4.83 Figure summarizes the improvements compared the previous cate-of-the-an with respect to clean and certified accuracy on CIFAR-10. Further experiments show that the same approach considerably improves certified accuracy on CIFAR- 100 as well.
Moreover, we conduct ablations to evaluate the impact of different design choices, including regular- ization, the number of training epochs, the optimization schedule, and the optimal balance between real and generated data. We summarize the most important insights of this empirical study in a list of recommendations that can be followed more accurately compare and improve the robustness of deterministic certified defenses. Lastly, we discern crucial differences in the scaling behavior between empirical and certified methods. All code used to produce the results and figures this paper will be released on GitHub after publication.
2 Related Work
Empirical Robustness. Adversarial training was first introduced by Goodfellow et al. 2 The authors employed the single-step Fast Gradient Sign Method (FGSM) craft adversarial examples during training and thereby robustify the model against these attacks. Later research by Madry et al. demonstrated that single-step adversarial training does not yield considerable robustness against multi-step attacks. They showed that using the multi-step Projected Gradient Descent (PGD) attack during training successfully improves the robustness of neural networks at time, even against strong attacks. Subsequent work proposed improvements to the loss function, the adversarial attack used during training, and better trade-offs between clean and certified accuracy 12).
Certified Robustness. Unlike empirical methods, certified methods yield robustness guarantees, thereby eliminating possible vulnerabilities to future attacks. Certification methods can be broadly classified into two methodologically distinct groups, namely probabilistic and deterministic methods. Probabilistic methods aim to approximate smooth classifiers using Monte Carlo sampling and noise injection 4 A given sample is verified as robust with certain probability depending on the noise magnitude and number of Monte Carlo samples. To obtain a tight verification bound, probabilistic methods need to perform substantial amount of sampling procedures (forward passes)

---

for each sample, considerably increasing the computational overhead in practice. Contrary to probabilistic methods, deterministic approaches do not entail considerable computational overhead during inference.
16 is group of deterministic methods that leverages interval arithmetic and linear programming to track how perturbations in the input space transform through each layer, effectively constructing an outer envelope that contains all possible network outputs for inputs within the specified perturbation region. Our initial results scaling the work by Palma et al. [6], provided in Appendix H. show that this yields severely deteriorated performance when training with additional generated data and is thus poor candidate for scaling certified robustness.
Convex bound propagation 13 14
15
Our main focus is hence devoted to deterministic approaches that bound the Lipschitz constant of each neural network layer to be small (generally smaller or equal to 1) for a predefined lp norm 17 18 The Lipschitz constant of the whole network is bounded by the multiplication of the Lipschitz constants of the individual layers [19]. Given a network's 's upper bound of the Lipschitz constant, a robustness guarantee can be trivially obtained by computing the distance between the highest two logits in the output space.
Diffusion Models. More recently, diffusion models have superseded generative adversarial net- works (GANs) as the preferred method for image generation (20]. Denoising diffusion probabilistic
models (DDPM) 22 can generate high-quality samples on 10 [22] with an FID score of
3.17, common measure image quality. Since then, other variants have been proposed 223 24 By further analyzing the design space of these models (23] elucidating diffusion models (EDMs) achieve a current state-of-the-art FID score of 1.79 on CIFAR-10. With additional discriminator guidance [24], the quality of these EDM-generee
images are reported to reach FID score of 1.64,
the best score reported literature for CIFAR-10 10 at the time of writing.
Improving Empirical Robustness with Auxiliary Data. Hendryeks et al. (25 showed that uti- lizing additional data from external datasets during adversarial training can improve empirical adversarial robustness. Gowal et al. [5] extended this approach to synthetically generated data from generative models only trained on the source dataset. Recently Wang al. [6] showed that leveraging the latest advances in diffusion models further improves empirical adversarial robustness.
In this work, we investigate if leveraging data generated with state-of the-art diffusion models also improve certified robustness against adversarial attacks and analyze how certified training approaches can be scaled optimally.
3 Experiment Setup
Given the recent improvements in adversarial training using additional data generated by diffusion models, we devise a set of experiments to investigate whether this also transfers to certified robustness. We focus on deterministic methods as probabilistic methods entail tremendous computational overhead during inference time and do not achieve considerable robustness for the &o norm yet [IO]. All our experiments are done on single Nvidia A100 graphics card (40GB of VRAM) without distributed training.
3.1 Dataset and Threat Models
We perform experiments on CIFAR-10 and CIFAR-100 22 for which EDM-gennrated data is readily available and wealth of previous robustness research exists (6. Our experiments and ablation studies focus on CIFAR-10. 10. We refrain from experiments on larger datasets like ImageNet [26) as robustness guarantees achieved by deterministic methods for these datasets are still comparatively low, and only [9] support it at the time of writing. We perform experiments on two common threat models, specifically (Loc, 8/255) and (fz, c 36/ /255) adversaries. We do not consider the & threat model, as only smoothing baase based approaches achieve considerable robustness for this threat model at the time of writing. For our experiments, we select the two best architectures from the popular certified robustness leaderboard introduced by Li et al. [10] for both the & (GloroNet 9 and LOT (17) and foc threat models (SortNet [18] and foc- Net (7)). In total, we perform experiments architectures from four different papers.
3

---

Table 1: Clean and certified test accuracy (%) on CIFAR-10 6 8/255) for foc Net and SortNet with dropout rate Bold highlights the best model with and without auxiliary data. [D genl denotes the number of EDM-generated images which highest accuracy was achieved.
Net
Ep- ochs
w/o auxiliary
w/ auxiliary
Clean
Cert.
Clean
Cert.
[D [Pen
-ist
800
57.34
34.25
61.04
36.98
Im
1600
57.19
34.00
62.02
37.53
Im
SortNet
3000
53.38
39.72
53.29
41.32
10m Im
= .85
6000
53.36
39.05
52.41
40.70
SortNet .00
3000
56.09
37.44
54.36
41.71
5m
6000
54.81
36.50
54.75
41.78
10m
3.2 Generated Auxiliary Data
To explore the effectiveness of augmenting the original CIFAR-I0 and CIFAR-100 (22 datasets with generated data, we adjust the data loader of each model to use a fraction of generated data and original data in every epoch. We use the same generated data used by Wang et al. [6] which was produced by an EDM trained only on the train set of CIFAR-IC 10. In preliminary experiment, we found the generated-to- to-rlll ratio to be optimal when 30% of training images are real and 70% are generated in every epoch during training, matching the ratio used by Wang et al. [6. We performed experiments with 50, 000 (50k), 100, 000 (100k), 200, 000 (200k), 500, 000 (500k), million (1m), 5 million (5m) and 10 million (10m) generated images. Wang et al. 6 sub-sampled the Im images from 5m images choosing only the 20% most confidently classified images according to a pretrained WRN-28- 10 model. In contrast, we naively sub-sample the Im images from the 5m image dataset to avoid potential selection bias by the classifier used to select the data. Moreover, using the same selection process for all datasets should allow us assess better the effect of the amount of generated data on the final robustness.
3.3 Hyperparameters
With additional data, it is also expected that both model size and the number of training epochs can be further scaled to improve clean accuracy and robustness. We thus perform experiments on the influence of model depth and the number of epochs clean and certified accuracy. For some models, we investigate further techniques that add learning capacity. Concretely, for SortNet [18] we also experiment with models that do not employ dropout, and for LOT [7] we adjust the learning rate scheduler to cosine annealing (28).
4 Results
In the following, we first summarize the effect of using additional generated data the achievable certified and clean accuracy. Furthermore, we ablate the effect of other design choices on the certified robustness, such as the number of training epochs, model size, the amount of additional synthetic data and other hyperparameters. Lastly, we summarize our findings and provide list of recommendations scale certified robustness effectively.
4.1 Improving Certification Approaches with Generated Data
Across all four reference models and all two threat models, we find that the inclusion of generated data can improve certified accuracy. In most cases, clean accuracy is considerably improved as well. An overview of our new ofte-of-thhean results in comparison with existing related work is given in Figure For the (Loo, = 8/255) threat model on CIFAR-10 we can increase the robustness the existing SortNet [18] to 41.789 78%, an improvement of 1.39 percentage points. For the (62,
36/255) model we achieve a certified accuracy of 69. 99.05% using LOT [17, substantial increase of 3.95 points compared to the best result previously reported in the literature [10]. In almost all cases this

---

fop dist Net & SortNet
LOT
GloroNet
42
Certified Accuracy (%6
40
68
38
dist Net
36
pm 85
LOT
65
X8
00
64
GloroNet
S
34
64
10"
10"
10'
10"
10
10
10"
10'
[Parig
[D yeal
[Dorig] + grml
[Pangl (2
Figure 2: Influence of total CIFAR- dataset size ID (Dorigl ID genl (number of original and generated images) on certified accuracy. is the dropout rate of SortNet. All models were trained with large number of epochs, i.e., 1600 for dist Net, 6000 for SortNet, 600 for LOT, and 2400 for GloroNet. Accuracy generally improves little beyond Im generated images.
improvement coincides with an increase in clean accuracy. One exception is SortNet, where the clean accuracy slightly decreases from 54.84% to 54.75%.
Full results are given in Tab. for both SortNet and fx. Net, as well as Tab. 2 for LOT and Tab. 3 for GloroNet. We find that by removing the dropout from SortNet we can improve certified accuracy from 41.32% to 41.78% when using auxiliary data. However, the same leads to a drop from 39.72% 37.44% with only the original data, reinforcing the notion that the additional data acts as good regularizer. Similarly, for LOT, cosine annealing is superior by margin of up to 1.12 points compared multi-step scheduler, indicating that the model can make better use of its capacity when trained with auxiliary data. For full results using the multi-step scheduler, we refer to App. B, Tab. all results discussed in subsequent sections refer to those obtained with cosine annealing.
Adding auxiliary data improves certified robustness on CIFAR-100 as well, as demonstrated in Tab. We restrict evaluation to the most effective models from the analysis CIFAR-10 and do not further scale the number of training epochs. The most substantial improvements on CIFAR-10 100 are obtained for the SortNet model, where certified accuracy increases by 8.08 percentage points from 9. 9.2% to 17. 27.88% and for GloroNet, where certified accuracy increases by 2.49 percentage points from 36.41% 38.9%.
4.2 Sensitivity Analysis
Scaling the Amount of Auxiliary Data. The main goal of this work was evaluate the influence of additional synthetic data during training on the achievable certified accuracy of deterministic certification methods. To this end, we analyze how different amounts of additional data affect the final certified robustness. We evaluate the saturation by training with with 50k, 100k, 200k, 500k, Im, 5m, and 10m auxiliary generated images. All models are trained for least twice the amount of epochs that were used in the original papers to ensure saturation in terms of training time. As seen in Fig. [ improvements in certified robustness beyond Im are mostly negligible. This behavior also largely independent of model size, which stands in contrast to prior results reported for adversarial training (5).
Scaling the Model Size. We performed experiments on several different model sizes to investigate possible correlations between the benefit of additional training data and the model capacity. The -bsed models are largely constructed out of fully connected layers. As a result, the computational effort when scaling these models increases quadratically. As experiments the -bssd models proved to be computationally too expensive we refrain from scaling these models and focus instead on based models.
Tables to 3 demonstrate that scaling the model size can increase the certified robustness for both LOT and GloroNet. Shown are the best improvements when adding Im, 5m, 10m auxiliary data when compared to the same model trained without any auxiliary data referred to as the base model from here The highest gains are for medium models with LOT and for large models with
5

---

Table 2: Clean and certified test accuracy (%) on CIFAR-10 (l2, 36/255) for LOT. Bold highlights the best model with and without auxiliary data. generated images at which highest accuracy was achieved.
[D gen. denotes the number of EDM-
Size
Ep- ochs
w/o auxiliary
w/ auxiliary
Clean
Cert.
Clean
Cert.
[Dgen
200
76.60
63.45
79.22
66.17
10m
S
400
76.50
63.48
80.02
67.42
5m
600
76.75
63.81
80.59
68.07
10m
200
76.92
63.38
79.59
66.95
5m
M
400
76.41
63.93
80.53
68.17
5m
600
76.49
63.63
80.98
68.66
5m
200
77.21
64.53
79.91
67.58
10m
L
400
77.00
64.47
80.80
68.66
5m
600
76.62
64.39
81.42
69.05
5m
Table 3: Clean and certified test accuracy (%) CIFAR-10 (f2, 36/255) for GloroNet. Bold highlights the best model with and without auxiliary data. generated images at which highest accuracy was achieved.
[D iPgenl denotes the number of EDM-
Size
Ep- ochs
w/o auxiliary
w/ auxiliary
Clean
Cert.
Clean
Cert.
[2gen
800
76.51
63.44
77.42
65.57
5m
XS
1600
76.95
63.79
78.38
66.48
10m
2400
77.56
64.14
78.54
66.60
10m
800
77.22
64.33
77.90
66.23
10m
S
1600
77.91
64.68
78.74
66.78
Im
2400
78.28
64.79
78.89
67.07
1m
800
77.73
64.81
77.95
66.59
5m
M
1600
77.77
65,06
79,18
67.31
10m
2400
78.41
64.87
79.43
67.56
10m
800
77.94
65.09
79.13
67.06
10m
L.
1600
78.99
65.16
79.81
67.67
1m
2400
79.33
65.21
80.28
68.12
5m
GloroNet. For GloroNet in particular we observe that model size becomes more important the longer the model is trained, with all models trained for the default 800 epochs showing similar gains.
Scaling the Number Training Epochs. As larger models and additional training data may require longer model training achieve optimal results increased the number of training epochs compared to the original configurations for all tested models For the -based models in Tab. I we see that by doubling the number of epochs removed. A similar picture arises for the baseed models, presented in Tabs. and Here, we find that increase in the number of epochs yields significant improvement regardless of model size. Overall, this parameter had the strongest impact in combination with auxiliary data and all best certified accuracies are achieved at their respective maximum number of epochs, with the only exception being SortNet with dropout.
further improve certified robustness when regularization
4.3 Relationship between Generalization Gap and Certified Robustness
The individual improvements in certified robustness vary considerably between different model and data configurations in our experiments. One possible explanation for these differences may be that the generalization gap of the respective models trained without auxiliary data i.e., the hase models are different, leading to different gains when closing this generalization gap. To investigate this, we
During training of CIFAR-I0 model will 0.7 50, 000 35, 000 generated images in each epoch.

---

4 Certified Accuracy
Gemeralization Gap
20
Ey dist
A--
SortNet
Accuracy (%)
10-
GloroNet
2
certified
10 Generalization Gap
20
None
50k
100k
200k
500k
Im
5m
10m
50
100
Cemerated-to-Orriinad Ratio
D
Figure 3: a Correlation between generalization gap and certified accuracy improvement. Generaliza- tion gap measures difference between training and testing accuracy. A refers to difference between base model and model trained with auxiliary data. b Generalization gaps by amount of auxiliary data 'Dgen| for all models trained with maximal epoch count. Clean and certified accuracy (%) for different ratios of generated and real data for -dist Net and LOT-S. Here, ratio of 70 means 70% of each batch generated data and the remaining 30% real data.
correlate the difference in generalization gap with the improvement in certified accuracy obtained when adding auxiliary data, Here, generalization gap refers to the difference between the train and test accuracy on clean data for the best epoch. Figure 3 demonstrates a considerable correlation between the decrease in generalization gap compared to the base model trained with no auxiliary data and the improvement in certified robustness for models with auxiliary data. Moreover, we perform a line fit between the generalization gap and robustness improvement for all the analyzed models. Surprisingly the slope of the different lines similar for most models, except -ictt Net, indicating that robustness gains can be predicted once the offset of the line is known for unseen models. However, the offset of the different lines depends on the base model considered. Generalization gaps for each auxiliary dataset size gDeen| in Fig. 3 also correlate well with scaling curves in Fig. 2
These results are in line with certified robustness gains achieved for SortNet with and without dropout shown in Tab, [ Here, the certified robustness of the SortNet model trained without auxiliary data and for 3000 epochs decreases when using less regularization by removing dropout from 39.72% to 37.44%. At the same time, the generalization gap of the two models increases from 4.16% to 12.89%, respectively, as an effect of removing dropout. However, once additional synthetic data is used, removing dropout actually improves the certified robustness to up to 41.71% by nearly two points. Here, increasing the generalization gap by removing dropout had a positive effect on the final certified robustness, which fits observations in Fig. 3a.
4.4 Ratio of Generated and Real Data
In every training epoch, we of images the same as the size of the original training set. The default configuration throughout our experiments, and the one also used by Wang et al. [6], is use 30% real images and 70% generated images in each batch. Figure 33 illustrates how using different proportions for generated and real data affects the certified robustness of the -dst Net and LOT-S architectures. We see that ratios of 60% generated data the clean accuracy saturates, and with 70% the certified accuracy saturates. Notably, in all cases the accuracy when only training with generated images higher than when only training with real images, indicating that it may be possible to fully train these models on only generated data in the future.
proportion of synthetic and real images and keep the total amount
4.5 Certification Radius Distribution
To examine the underlying factors contributing to the observed increase robustness when using auxiliary data, we conduct an analysis of the certification radius distribution for the SortNet (without dropout) and LOTT-L architectures. Figure displays the number of images on the y-axis with a certification radius equal to or above specific value, shown on the r-axis. Curves are plotted for the
7

---

CIFAR-I0 11R-1000 (
CIFAR-10 (l2, 36/255)
SortNet w/o dropout
LOT-L
Number of Imagos
Number of I'Images
wio auxiliary
4000
5000
w/ mixiliary
2000
correct
incorrect
0.0
0.1
0.2
Certification Radius
Certification Radius
Figure 4: Cumulative distribution of certification radii for the best lo- model, Sortnet w/o dropout, and the best Eg-based model, LOT-L. Note how for SortNet images exhibit overall smaller certification radii for both correct and incorrect classes, yet clean accuracy slightly decreases.
best models trained with and without auxiliary data. Additionally, curves for correct and incorrect classifications are displayed separately.
We observe no considerable differences between the distribution of certification radii for the LOT model obtained with or without auxiliary data. Nevertheless, models trained with auxiliary data show slightly higher robustness for correctly classified samples and lower robustness for misclassified samples on average. The SortNet architecture exhibits considerably higher robustness radii for both correct and incorrect classifications when using auxiliary data. Here, differences certified robustness do not seem to come from better generalization ability on clean data but from larger certification radii on unseen data. On the other hand, the LOT architecture shows similar certification radii but considerably better generalization on clean data. A more detailed analysis is given in App. G, Fig. 3. Both models show considerable over-robustness for a considerable fraction of the test set, where the certification radius is well beyond the certification goal
4.6 Takeaways for Scaling Certified Robustness
Differences in certified robustness between distinct defense approaches are often marginal and even small improvements over prior work may be relevant. Here, we summarize the most important take- aways from the empirical study presented in this work on how to scale the robustness of deterministic certified models.
Scale the number of training epochs. Among all investigated hyperparameters, we found the number of training epochs had the most consistent effect certified accuracy when training with auxiliary data. Based on our experiments, we expect the amount of auxiliary data to not matter as long as it is sufficient for closing the generalization gap.
Increase your model capacity. When using auxiliary data, large generalization gap between training and testing accuracies is less of an issue and, based on our results, indicative of untapped performance improvements that can be leveraged (see Sec. (.3). This means model capacity can be scaled with little fear of overfitting. Our experiments show that reducing the amount of regularization, using better optimizers, and increasing the model size all improve certified accuracy when using auxiliary data without leading to large generalization gaps.
Compare with caution. Even small adjustments, such change to dropout, learning rate schedulers, or even different random seeds can improve certified accuracy by about 0.5 to 1 percentage points. This makes difficult assess the individual contribution of different architectures towards robustness - for example, contrary to results reported in the original papers, our results indicate that LOT may actually be superior to GloroNet.
Benchmark with generated auxiliary data. As the proposed approach does not entail a computational overhead for the same amount of training epochs, we recommend future work to compare their approaches using auxiliary data and ensure that models are trained till convergence. Differentiating between approaches that use auxiliary data and those that only utilize the original dataset may be helpful for future benchmarks. Similar approaches have been adopted in the empirical robustness domain [29].

---

Decrease over-robustness. While not related to the usage of auxiliary data, our evaluation in Fig. Aindicates that considerable number of samples are noticeably more resistant to ad- versarial attacks than what was intended during training. Future research may consider using smaller certification objectives for samples that already demonstrate considerable robustness, approach that has already been shown to be successful in adversarial training [12].
5 Comparison to Empirical Robustness
While we observe many of the same trends as Gowal et al. [5] and Wang et al. [6], i.e., that larger models and more epochs generally help, we also note a few crucial differences.
Amount of training data, Scaling beyond one million CIFAR-10 generated images did not further improve certified accuracy, regardless of model size. This is different to scaling behavior reported previously for adversarial training, with, e.g., Gowal et al. (5] reporting an improvement of +2.65 and +2.52% when scaling their WRN-23-10 and WRN-70-16 models, respectively. from one million to 100 million generated images. One hypothesis would be that this is due to the consistency property of the Seliveko-Caanten class, mentioned by Béthune et al. in Section 5.1 30]. due which Lipschitz-1 neural networks' training loss converges to the testing loss for increasingly large datasets. In contrast, adversarial training can interpreted
data-dependent operator norm regularization [31] and seems to require more data samples to close the generalization gap. More recent work suggests that the Bayes error may limit the achievable accuracy of both deterministic 33 and probabilistic [ certified robustness, in line with our results.
Overfitting between best and last epoch. In adversarial training, prior work finds that the difference between the best and the last epoch becomes increasingly smaller with larger amounts of auxiliary data [6] In contrast, we observe no such effect for certifiably robust models (see App. E, Fig. 1), highlighting another difference in scaling behavior between empirical and certified robustness.
Optimal snveraatddtt-oriinne ratio. Previous research regarding the optimal generated- to-original ratio for adversarial training observes a drop-off when using only generated data. Both Gowal et al. [5] (Fig. 5) and Wang et al. [6] (App. B, Fig. 3) suggest accuracy decreases again significantly beyond 70% generated data when using diffusion models. As evident in Fig. 3b this is not as pronounced for certifiably robust models.
Together, these results suggest that for certifiably robust models it may be possible to determine sufficient amount of generated data beforehand for any given dataset contrary to what is the case for adversarial training, where more always better. Moreover, it indicates that certified robustness is considerably harder to scale than empirical robustness, as once saturation with respect to data has been achieved, further gains can only be attained by better algorithms and increased model size. Future experiments should explore concrete scaling laws for certified and empirical adversarial robustness, which was out-of-scope this paper. Deriving and verifying theoretical properties of certifiably robust models, such those already known on graphs (34] also remains exciting topic for further research.
Table 4: Clean and certified test accuracy (%) on CIFAR-100 for both (Lo,, = 8/255) and (Lg,e = 36/255) threat models. Bold highlights the best overall model for each architecture.
Architecture
w/o auxiliary
w/ auxiliary
Clean
Cert.
Clean
Cert.
[D yenl
fic- Net
25.99
9.36
27.73
10.47
10m
SortNet p -00
24.93
9.20
27.58
17.28
Im
LOTT-L
46.60
32.92
50.68
36.56
5m
GloroNet-L
51.57
36.41
51.71
38.90
10m

---

Limitations
Despite our best efforts and extensive experiments, some limitations remain. Our focus is largely on deterministic Lipschitz-bound methods, which incidentally were used in the two best-performing models for the (f e = 8 8/255) and (f2, 36/ 26/255) attacks on CIFAR-10 at the time the experi- ments were performed [TO]. Other approaches for certified robustness, including probabilistic ones and other deterministic methods, stay largely unexplored except for our experiments on convex bound propagation in Appendix H The inherently high computational complexity of the evaluated models 17 18 27 also inhibited us from running each configuration multiple times, as even a single run made the
already results in overall compute time of around five thousand GPU hours. Finally, conscious choice to not perform experiments on ImageNet as only one of the evaluated models, that by Hu al. []] supported this dataset and thus meaningful comparison could be made.
Conclusion
We show that deterministic certified robustness can be improved by up 5.28%p when additional generated data from a diffusion model is used during training. This is true across four different architectures and two different threat models, (foc E 8/255) and (62, <= = 36/255). on CIFAR-10. where we report improved certified accuracies of 41.78% and 69. 69.05% respectively. For fox we are thus able achieve new sfae-oof-the-ar, while Hu et ( report a slightly better accuracy of 70.1% % for the & threat model using data generated by DDPM. In addition, we show the data scaling also improves certified accuracy on CIFAR- 100 substantially.
We find that the highest gains can be achieved for models where the generalization gap, i.e., the difference between training and testing accuracy, is high for the original model. When augmenting with generated data, the generalization gap is mostly eliminated across all models when a sufficient amount of additional images are used. As the generalization gap gets smaller, removing regularization techniques, such as dropout, and switching to learning rate schedulers aimed at better convergence yields additional improvements. We also note that increasing the number epochs had the greatest impact when paired with generated data. Lastly, we observe that a considerable number of samples are noticeably more resistant adversarial attacks than required by the e-bound.
Acknowledgments
Thomas Altstidl acknowledges the support by the Bavarian State Ministry Health and Care, project grant number D2N-MGG-20100004--iiiiiii Leo Schwinn gratefully acknowledges funding by the Deutsche Forschungsgemeinschaatt (DFG, German Research Foundation) Projectnumber 544579844.
Author Contributions
T.A. and L.S. came up with the original idea of using generated data for certified robustness. T.A. implemented the code adjustments, ran the experiments, performed the analysis. prepared all fig- ures/tables, and wrote the manuscript. D.D. supported some experiments with additional compute. All authors contributed to the interpretation of the results and to the editing of the manuscript.
References
[1] C. Szegedy, W. Zaremba, Sutskever. J. Bruna, D. Erhan, J. Goodfellow, and Fergus, "Intriguing propertics of neural networks." " Proc. Intl. Conf. Learn. Representations (ICLR), Y. Bengio and LeCun, Eds., Banff, AB, Canada, Apr. 2014.
[2] J. Goodfellow, J. Shlens, and C. Szegedy, "Explaining and harnessing adversarial examples," in Proc. Inrl. Conf. Learn. Representations (ICLR), San Diego, CA, USA, May 2015.
[3] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, "Towards Deep Learning Models Resistant to Adversarial Attacks." in Proc. Intl. Conf. Learn. Representations (ICLR), Vancouver, BC, Canada, May 2018.
10

---

[4] J. M. Cohen, E. Rosenfeld, and J. Z. Kolter, "Certified Adversarial Robustness via Randomized Smoothing." in Proc. Intl. Conf. Mach. Learn. (ICML). K. Chaudhuri and R. Salakhutdinov, Eds., vol. 97. Long Beach, CA. USA: PMLR, Jun. 2019, pp. 1310-1320.
[5] S. Gowal, S. Rehuffi, O. Wiles, F. Stimberg, D. A. Calian, and A. Mann, "Improving Robustness using Generated Data," in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 34, Virtual Event, Dec. 2021, pp. 4218 4233.
[6] Z. Wang. T. Pang, Du, M. Lin, W. Liu, a.d Yan, "Better Diffusion Models Further Improve Adversarial Training," in Proc. Intl. Conf. Mach. Learn. (ICML), Honolulu, HII USA, Jul. 2023.
[7] L. Schwinn, R. Raab, A. Nguyen, D. Zanca, and B. M. Eskofier, "Exploring Misclassifications Robust Neural Networks to Enhance Adversarial Attacks," " Appl. Intell. (APIN), 2021.
[8]
"Improving Robustness against Real- World and Worst-Case Distribution Shifts through Decision Region Quantification," in Proc. Intl. Conf. Mach. Learn. (ICML), K. Chaudhuri, S. Jegelka, L. Song, C. Szepesvári, G. Niu, and S. Sabato, Eds., vol. 162. Baltimore, MD, USA: PMLR, Jul. 2022, pp. 19 4499.
[9] K. Hu, A. Zou, Z. Wang. Leino, and M. Fredrikson, "Unlocking Deterministic Robustness Certification on ImageNet," in Adv. Neural Inf. Process. Syst. (NeurlPS), vol. 36, New Orleans, LA, USA, Dec. 2023.
[10] L. Li, T. Xie, and B. Li, "SoK: Certified Robustness for Deep Neural Networks," in Proc. IEEE Symp. Secur. Privacy (SP), San Francisco, CA, USA, May 2023.
[11] H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. El Ghaoui, and M. I. Jordan, "Theoretically principled trade- off between robustness and accuracy," in Proc. Intl. Conf. Mach. Learn. (ICML). K. Chaudhuri and R. Salakhutdinov, Eds., vol. 97. Long Beach, CA. USA: PMLR, Jun. 2019, pp. 7472-7482
[12] M. Cheng, Q. Lei, P. Chen, S. Dhillon, and C. Hsich, "CAT: Customized Adversarial Training for Improved Robustness." in Proc. Intl. Joint Conf. Artif. Intell. (IJCAI). L. D. Raedt, Ed., Vienna, Austria, Jul. 2022, pp. 673-679.
[13] S. Gowal, K. Dvijotham, R. Stanforth, R. Bunel, C. Qin, J. Uesato, R. Arandjelovic, T. A. Mann, and P. Kohli, "Scalable Verified Training for Provably Robust Image Classification," in Proc. Intl. Conf. Comput. Vision (ICCV), Scoul, Korea, Oct. 2019.
[14] M. N. Müller, F. Eekert, M. Fischer, and M. Vechev, "Certified Training: Small Boxes are All You Need," in Proc. Inrl. Conf. Learn. Representations (ICLR), Kigali, Rwanda, May 2023.
[15] Y. Mao, M. N. Müller, M. Fischer, and M. Vechev, "Connecting Certified and Adversarial Training," in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 36, New Orleans, LA, USA, Dec. 2023, pp. 73422-77 1122-73445 440.
[16] A. D. Palma, R. Bunel, K. Dvijotham, M. Kumar. R. Stanforth, and A. Lomuscio. "Expressive Losses for Verified Robustness via Convex Combinations." in Proc. Intl. Conf. Learn. Reprexentations (ICLR). Vienna, Austria, May 2024.
[17] X. Xu, L. Li, and B. Li, "LOT: Layer-wise Orthogonal Training on Improving 12 Certified Robustness." in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 35, New Orlcans, LA, USA, Dec. 2022, pp. 18 9890411 18 915.
[18] B. Zhang, D. Jiang, D. He, and I.. Wang. "Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspective." " in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 35, New Orleans, LA. USA, Dec. 2022, pp. 19 398-19989999 19413.
[19] L. Bungert, R. Raab, T. Roith, L. Schwinn, and Tenbrinck, "CLIP: Cheap lipschitz training of neural networks," in Proc. Int. Conf. Scale Space Variational Methods Comput. Vision (SSVM), ser. Lecture Notes Comput. Sci., A. Elmoataz, J. Fadili, Y. Quéau, J. Rabin, and L. Simon, Eds., vol. 12679. Virtual Event: Springer, May 2021, pp. 307-319.
[20] P. Dhariwal and A. Nichol, "Diffusion Models Beat GANs on Image Synthesis," " in Adv Neural Inf. Process. Syst. (NeurIPS), vol. 34. Virtual Event: Curran Associates, Inc., Dec. 2021, pp. 8780-8794.
[21] J. Ho, A. Jain, and P. Abbecl, "Denoising Diffusion Probabilistic Models," in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 33, Vancouver, BC, Canada, Dec. 2020, pp. 6840-6851.
[22] A. Krizhevsky and G. Hinton, "Learning multiple layers of features from tiny images," Master's thesis, Department of Computer Science, University of Toronto, 2009, publisher: Citeseer.
11

---

[23] T. Karras, M. Aittala, T. Aila. and S. Laine, "Elucidating the Design Space of Diffusion-Bane Based Generative Models." in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 35, New Orleans, LA. USA, Dec. 2022, pp. 26566-26677..
[24] D. Kim, Y. Kim, S. Kwon, W. Kang, and L.-C. Moon, "Refining Generative Process with Discriminator Guidance in Score-based Diffusion Models," Proc. Intl. Conf. Mach. Learn. (ICML), Honolulu, HI. USA, Jul. 2023.
[25]
Hendrycks, Mazeika, Kadavath, D. Song, "Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty," in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 32, Vancouver, BC, Canada, Dec. 2019, pp. 15 637- 15 648.
[26] A. Krizhevsky, Sutskever, and G. E. Hinton, "ImageNet Classification with Deep Convolutional Neural Networks," in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 25, Lake Tahoc, NV, USA, Dec. 2012, pp. 1097-1105.
[27] B. Zhang, D. Jiang, D. He. and L. Wang, "Boosting the Certified Robustness of L-infinity Distance Nets." in Proc. Intl, Conf. Learn. Representations (ICLR), Virtual Event, Apr. 2022.
[28] I. Loshchilov and F. Hutter, "SGDR: Stochastic Gradient Descent with Warm Restarts," in Proc, Intl. Conf. Learn. Representations (ICLR). Toulon, France, Apr. 2017.
[29] F. Croce, M. Andriushchenko, V. Sehwag, E. Debenedetti, N. Flammarion, M. Chiang. P. Mittal, and M. Hein, "RobustBench: standardized adversarial robustness benchmark," Tech. Rep., Oct. 2020, arXiv:2010.09670 [cs] type: article. [Online]. Available: http://urri.aogg/hhs//0000000000
[30] L. Béthune, T. Boissin, M. Serrurier, F. Mamalet, C. Friedrich, and A. Gonzalez Sanz, "Pay attention your loss understanding misconceptions about Lipschitz neural networks." Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 35, New Orleans, LA, USA, Dec. 2022, pp- 277-220009
[31] K. Roth, Y. Kilcher, and Hofmann, "Adversarial Training is Form of Data-dependent Operator Norm Regularization," in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 33, Virtual Event, Dec. 2020, pp. 14973-14985.
[32] R. Zhang and J. Sun, "Certified Robust Accuracy of Neural Networks Are Bounded Due to Bayes Errors," in Proc. Intl, Conf. Comput. Aided Verification, Montréal, QC, Canada, Jul. 2024.
[33]
"How Does Bayes Error Limit Probabilistic Robust Accuracy," Tech. Rep.. May 2024, ar Xiv:24055. 14923 [es.I.G] type: article. [Online]. Available: http://anxi..ng/ab//20000 14923
[34] T. Roith and L. Bungert, "Continuum Limit of Lipschitz Learning on Graphs," Found. Comput. Math. vol. 23, pp. 393 431, Jan. 2023.
12

---

A
Model Details
Table lists the different model configurations used. We limit our summary the important parameters for the full parameters used during training we refer to the respective papers 9
18 and repositories, as well our own scripts provided in our code release.
Table 5: Model Configurations
Model
Configuration
Depth
Width
Comments
Code
dist Net
6
5120
SortNet
p
.85
6
5120
GitHub
SortNet
.00
6
5120
LOT
S
10 (2 blocks)
n/a
LipConvnet-10 LipConvnet-20
LOT
M
20 (4 blocks)
n/a
GitHuu
LOT
40 (8 blocks)
n/a
LipConvnet-40
GloroNet
XS
6
128
LiResNet L6W128
GloroNet
S
12
128
LiResNet L12W122
GitHub
GloroNet
M
18
128
LiResNet I.18W128
GloroNet
L
18
256
LiResNet L18W256
B Results LOT Multi-Step Scheduler
Bumlerissmmmrizze results LOT trained with the multi-step learning rate scheduler used the original paper. Overall the results are approximately 0.5% worse than using cyclic learning rate.
Table 6: LOT w/ Multi-Step Scheduler, &2,
36/255
Architecture
Epochs
No
Im
5m
10m
Clean
Cert.
Clean
Cert.
Clean
Cert.
Clean
Cert.
LOT-S
200
75.64
62.43
78.69
65.06
78.40
65.01
78.82
65.09
400
75.74
62.95
79.58
66.36
79.40
66.51
79.33
66.41
600
75.85
63.02
80.03
66.97
80.04
66.97
79.86
66.95
LOT-M
200
77.03
63.60
79.14
66.30
79.30
66.40
79.29
66.12
400
76.83
63.42
80.01
67.37
80.35
67.67
80.15
67.61
600
76.47
63.56
80.53
67.98
80.54
68.19
80.17
67.82
LOTL
200
76.90
63.70
79.35
66.60
79.33
66.79
79.53
66.66
400
76.76
64.23
80.42
67.84
80.52
67.78
80.21
67.80
600
76.93
64.35
80.73
68.70
81.08
68.40
80.59
68.54
13

---

C Full Results 1m/5m/10m
Table 7: Clean and certified test accuracy (%) CIFAR-10 6 8/255) for fo Net and SortNet. Bold and italies highlight the best model with and without auxiliary data and underlining highlights the overall best model. ACert. denotes the highest absolute increase in certified robustness when using auxiliary data, and e the number epochs.
Architecture
No
Im
5m
10m
ACert.
Clean
Cert.
Clean
Cert.
Clean
Cert.
Clean
Cert.
800
57.34
34.25
61.04
36.98
60.35
36.00
60.64
36.30
+2.73
dist Net
1600
57.19
34.00
62.02
37.53
61.39
37.20
61.40
37.03
+3.53
SortNet
3000
53.38
39.72
52.50
41.23
52.78
40.35
53.29
41.32
+1.60
w/ dropout
6000
53.36
39.05
52.41
40.70
52.57
40.23
53,09
40.65
+1.65
SortNet
3000
56.09
37.44
54.28
41.51
54.36
41.71
54.18
41.41
+4.27
w/o dropout
6000
54.81
36.50
54.72
41.76
$4.36
41.52
54.75
41.78
+5.28
Table 8: Clean and certified test accuracy (%) on CIFAR-10 (22, 36/ 36/255) for LOT and GloroNet. Bold and italics highlight the best model with and without auxiliary data and underlining highlights the overall best model. ACert. denotes the highest absolute increase in certified robustness when using auxiliary data, e the number of epochs, and XS, M, and the model size.
Architecture
No
Im
5m
10m
ACert.
Clean
Cert.
Clean
Cert.
Clean
Cert.
Clean
Cert.
200
76.60
63.45
79.19
65.81
79.18
65.93
79.22
66.17
+2.72
S
400
76.50
63.48
79.87
66.99
80.02
67.42
79.96
67.23
+3.94
600
76.75
63.81
80.36
67.75
80.56
68.00
80.59
68.07
+4.26
200
76.92
63.38
79.58
66.85
79.59
66.95
79.90
66.82
+3.57
LOT
M
400
76.41
63,93
80.37
67.96
80.53
68.17
80.75
68.08
+4.24
600
76.49
63.63
80.71
68.44
80.98
68.66
80.69
68.52
+5.03
200
77.21
64.53
80.06
67.34
80.29
67.47
79.91
67.58
+3.05
L
400
77.00
64.47
80.80
68.39
80.80
68.66
80.76
68.51
+4.19
600
76.62
64.39
81.24
68.93
81.42
69.05
81.20
69.03
+4.66
800
76.51
63.44
77.30
65.29
77.42
65.57
77.45
65.17
+2.13
XS
1600
76.95
63.79
78.13
66.24
78.21
65.98
78.38
66.48
+2,69
2400
77.56
64.14
78.98
66.53
78.34
66.34
78.54
66.60
+2.46
800
77.22
64.33
78.12
66.17
77.99
66.14
77.90
66.23
+1.90
S
1600
77.91
64.68
78.74
66.78
78.44
66.62
78.53
66.59
+2.10
GloroNet
2400
78.28
64.79
78.89
67.07
78.76
66.85
78.87
66.97
+2.28
800
77.73
64.81
78.11
66.37
77.95
66.59
78.02
66.45
+1.78
M
1600
77.77
65.06
78.83
67.12
79.04
66.83
79.18
67.31
+2.25
2400
78.41
64.87
79.57
67.39
79.44
67.44
79.43
67.56
+2.69
800
77.94
65.09
79.12
66.97
78.94
66.80
79.13
67.06
+1.97
L
1600
78.99
65.16
79.81
67.67
79.50
67.28
79.90
67.60
+2.51
2400
79.33
65.21
80.20
68.05
80.28
68.12
80.00
68.11
+2,91
14

---

D Full Results CIFAR-100
Table 9: Clean and certified test accuracy (%) on CIFAR-100 for both (Lo,, 8/255) and (l2, 6 = 36/255) threat models. Bold highlights the best overall model for each architecture.
Architecture
No
Im
5m
10m
ACert.
Clean
Cert.
Clean
Cert.
Clean
Cert.
Clcan
Cert.
dist Net
25.99
9.36
27.56
10.45
27.69
10.25
27.73
10.47
+1.11
SortNet w/o dropout
24.93
9.20
27.58
17.28
26.74
16.69
27.50
17.25
+8.08
LOT-L
46.60
32.92
50.52
36.50
50.68
36.56
50.59
36.22
+3.64
GloroNet-L
51.57
36.41
51.78
38.54
51.81
38.66
51.71
38.90
+2,49
E
Robust Overfitting
In Figure [ we visualize the number of epochs between the epoch where the hest-certified accuracy was achieved and the total amount of epochs trained the æ-axis. On the y-axis we plot the certified accuracy difference between the best and last epoch. Here, the auxiliary data used for the different configurations are visualized with unique colors and symbols. No clear connection between the amount of auxiliary data and the distance between the best and last epoch can be observed. However, the highest distance is observed for models using no auxiliary data. On average, the observed difference between the last and best epoch is small for all models and always below 0.5%. We conclude that robust overfitting is not an issue for the certified training approaches tested in our experiments.
0.0
Certified Accuracy
-0.1
-0.2
0.3
None
-0.4
5m
50
100
150
200
250
300
350
400
Epoch Difference
Figure 5: Relationship between 1) the amount of auxiliary data used, 2) the number of epochs between the epoch where the best certified accuracy was achieved, and 3) the difference in certified accuracy between the best and last epoch.
15

---

Influence Model Size/Epoch Count
Figure 0 visualizes the effeett also mention in our sensitivity analysis in Sec. 4.2. Looking at each row, increasing epoch counts yields to linear increase in improvements, with the sole exception of GloroNet-XS. Model size similarly has a positive effect on certified accuracy, especially in combination with increases of epoch counts.
LOT
GloroNet
4.5
+1.9 %
+2.4 %
+2.9 %
2.75
+3 %
+3.8 %
+4.4% %
A Certified Accuracy
Model Size
4.0
Model Size
2.50
+1.7 %
+2 %
+2.6 %
+3.1
+4.1
+4.7%
2.25
3.5
+1.9% %
+2 %
+2.2 %
2.00
+2.6
+3.6 %
+4 %
3.0
xS
+1.9 %
+2.4 %
+2.3 %
1.75
x1
x2
x3
x1
x2
x3
Number of Epochs
Number of Epochs
Figure Influence model size and increase the number of epochs for CIFAR-10 (62, 6 36/255) models. Color shading indicates average absolute improvement across 1m, 5m, and 10m auxiliary data over the same model trained without auxiliary data.
G
Certification
Figure iilustrates the difference between the best base model (w/o auxiliary) and the best model trained with auxiliary data (w/ auxiliary). We investigate different combinations of correctness and certification for each image. An image may either be correctly incorrectly classified, and either certified or not certified. If is certified, this means that its certification radius is larger than e.
CIFAR-10 (lo, e 8/255)
CIFAR-10 (l,, 36/255) LOT-L
SortNet w/o dropout
3000
6000
3100
91
337
168
6207
22 1
24
w/o auxiliary
-De -ba ACos DaL. -ia.
w/o auxiliary
65
792
87
323
2000
17
509
61
273
4000
691
251
495
496
57.
12
538
145
1000
2000
298
939
403
1464
108
145
417
749
Cal
-cus
Ocs Coe.
w/ auxiliary
w/ auxiliary
Figure Confusion matrices for different correctness and certification constellations between models trained with and without auxiliary data. Here, means not, i.c., -Cert. means that images were not certified to be within the e-bound.
16

---

H
Convex Bound Propagation
Our focus on Lipschitz-bound methods may raise questions regarding the applicability of data scaling to other certified robustmess domains, such convex bound propagation. Our additional experiments on MTL-IBP [16], a summary of which is reproduced below, indicate vastly different scaling dynamics with no observed improvements even when further adjusting (being originally used by Palma al. [16 the larger ImageNet). few remarks:
Verification runs were aborted after 24 hours to accommodate the discussion period. If aborted, reported numbers indicate percentage of certified/correetyy classified samples on the subset of CIFAR-I0 test. images which verification completed within 24 hours.
Non-completed runs included more hard-to-certiff samples that required computationally expensive branch-and-bourd verification. Extrapolated full runtimes for some configurations are up to about 2 weeks.
Runs that yielded 0% certified accuracy oftentimes completed quickly the comparatively cheap PDG attack already found counterexamples, and thus full verification was not needed.
We conclude that MTL-IBP, convex bound propagation approach, cannot benefit from additional generated data. This indicates that results with regards to scalability do not trivially transfer from one robustness method to another, and detailed investigation of single method, such as Lipschitz-bound approaches, seems justified.
Table 10: Clean (top) and certified (bottom) test accuracy (%) CIFAR-10 (foo; 8/255) for MTL-IBP. Bold highlights the best overall model for each configuration. denotes the number of epochs, a the expressive loss coefficient.
None
50k
100k
200k
500k
Im
5m
10m
260
0.5
35.08%
34.14 14%
32.04%
21.07%
0.34% *
0.00%
0.00%
520
0.5
35.95%
34.74%
34.57%
33.05%
17.57%
0.54% f
0.00%*
0.00%
260
0.05
28.71 *
26.67%.*
23.75%
8.12%
0.00%
0.00%
0.00%
520
0.05
27.76%
27.26%%
26.68%
26.72%
None
50k
100k
200k
500k
Im
5m
10m
260 0.5
53.69%
55,46%
57.70%
66.04%
79.31%
$
94.60%
94.82 %
520
0.5
54.68%
55.64%
55.88%
57.34%
68.63% %
*
94.60%*
95.09 %
260
0.05
64.58%*
66.12%
67.67% *
76.35%
84.92%
94.67%
94.84%
520
0.05
*
66.73% *
67.77 % *
Verification run did not finish within 24 hours, preliminary result on test data subset shown f Implementation by Palma et al. [16] triggered an assertion error
17

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Analysis of data scaling behavior for certified robustness described in both abstract and introduction
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as is clear that these goals attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [NA]
Justification: Limitations of the paper transfer from the models by Hu et al. 99. Xu et al. 17], Zhang et [88] (7 and the general approach of using generated data by Gowal et al.
[5]. Wang et al. [6]. and hence not separately discussed
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "I "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
18

---

Answer: [NA]
Justification:
No theoretical results provided
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof's can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: Sec. 3 Experiment Setup describes in detail the configurations used for all experiments, and code is provided
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is new model (e-g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
19

---

Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: Datasets CIFAR-10 and CIFAR-100 readily available, and link code will be added upon acceptance
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nnis.cc
Moolic//guide//Coeeeuuiiiss
cassssionoolyyyy for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ //nips. wttps/cccppplclgguiieeeeaec
Stteee//CooSSSemsssS.Si.a www.ssssiicggcooo for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Sec. Experiment Setup describes in detail the configurations used for all experiments
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: With a single model run taking one to two days on A100 graphics card proved infeasible to perform multiple runs
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
20

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: Sec. 3 Experiment Setup describes the compute resources used for experiments
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https: http://neeuipppe weeeurpps.ccpuuli///Bee... cccppublic/thhicccuueeeel....e
Answer: [Yes]
Justification:
No specific concerns to address in terms of potential harmfulness
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- cration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: Societal impact related to general impact of robustness research, i.c., robustness may improve safety of systems, but also cause emissions due to increased training times
Guidelines:
The answer NA means that there is no societal impact of the work performed.
21

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), faimess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
No specific risks to address
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best. faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: Both datasets (CIFAR-10 and CIFAR-100) and models (Eoc -dist Net, SortNet, LOT, and GloroNet) are referenced
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
22

---

If assets are released, the license, copyright information, and terms of use in the thcode has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssit
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: No new assets provided
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
No human subjects involved
Guidelines:
The answer NA means that the paper doess not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: No human subjects involved
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
23

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
24


Reviews:
[{"review_id": "xSbAbHsaqK", "reviewer": "Reviewer_hXmp", "summary": "This work proposes using data augmentation with diffusion models to improve the certified robustness of image classification models. The authors analyze the training and certification behavior of different Lipschitz-bound-based machine learning models when the training data is supplemented with additional generated samples.", "questions": "L180: Do you really mean “1m, 1m, or 1m auxiliary data”?\n\n**Remarks**\n\nTables and figures are sometimes far from where they are referenced (e.g., Table 1, Fig 2). This makes it difficult to read as the reader has to jump back and forth.\n\nSome instances of % should be replaced by percentage points, e.g., in the abstract (L14), L42, etc.", "limitations": "The limitations are not adequately addressed. The paper should include a discussion of limitations, such as the fact that only four Lipschitz-bound-based certification methods are evaluated. It is unclear if these results generalize to other Lipschitz-based certification methods and are likely not applicable to certification methods from different families. Furthermore, only mid-scale datasets like CIFAR are considered; the generalization gap may not exist in larger-scale datasets. Additionally, the results are limited to image classification, and the resulting improvements are small.", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "**The Method Improves Certified Robustness**\n\nThe experiments demonstrate that adding generated data can enhance the certified robustness of several certification methods. Three out of the four tested methods show improvements when trained on additional data, and the fourth method also shows improvements when dropout is removed. The authors suggest this is due to a generalization gap in existing models, which can be bridged by training on additional (generated) data.\n\n**Extensive Evaluation**\n\nThe evaluation section is comprehensive, with tests conducted across two datasets, four certification methods, and two threat models. It also includes numerous ablations, such as varying model sizes and percentages of generated data. This provides a well-rounded understanding of the proposed data generation method, with findings effectively summarized in the takeaway list in Section 4.6.\n\n**Code Included and Well Documented**\n\nThe supplementary material includes code for running the experiments, which enhances reproducibility. The repository is well-documented, providing clear instructions for setup and reproduction of the paper’s results, tables, and figures.", "weaknesses": "**Limited Novelty and Insights**\n\nThe idea of supplementing training data with generated data is not new and has been applied in various contexts. Specifically, it has already been used to improve Lipschitz certification by Hu et al. [22]. While this work offers a more thorough evaluation across different threat models and model architectures, the additional insights gained are limited. The paper mainly serves as an evaluation without providing new theoretical insights or methodological advancements.\n\n**Missing Comparison to a Key Related Approach**\n\nA very similar work by Hu et al. [22] also uses diffusion models (DDPM) to augment the training of Lipschitz-based certification methods. Although this work is listed in the references, it is neither discussed nor compared to, despite being the most related approach. This omission leads to several issues:\n- The claim in L105 that certified guarantees on ImageNet are “close to random guessing” is inaccurate. Hu et al. report 35% CA for $\\ell_2$-norm with $\\epsilon = 36/255$, which is significantly higher than the 0.1% of random guessing.\n- The claim in L36 that “[generated data] has not yet been combined with deterministic certified training methods” is incorrect, as Hu et al. have done this.\n- The claimed improvement over SOTA methods (L13, L145) is not entirely accurate. For $\\ell_2$-norm with $\\epsilon = 36/255$ in CIFAR-10, Hu et al. report 70.1% CA, which surpasses the 69.05% reported in this work.\n\n**Unclear Meaningfulness of Improvements**\n\nThe improvements over prior methods are minor, in the low single digits. As the authors note (L261), a change in hyper-parameters or different seeds can have similar effects on the model. Therefore, it is difficult to judge if the measured improvements are meaningful, especially considering the significant overhead of training a generator, generating the data, and additional model training on the larger dataset. This issue is compounded by the fact that all reported numbers are from single runs with one seed, without error bars or standard deviation. While the authors argue that the large computational cost makes multiple runs infeasible, it remains unclear how meaningful the improvements are.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the feedback, and for highlighting our typo in L180, which was meant to read “1m, 5m, or 10m auxiliary data.” We’d like to address your main concerns as follows.\n\n**Limited Novelty and Insights**\n\nThe original idea of using data from generative models trained on the original data actually traces back further to a paper by Gowal et al. [1] in 2021, with Wang et al. [2] later providing a more in-depth empirical analysis of the various factors contributing to the observed improvements. Both publications remain highly influential in the domain of empirical robustness. Although we acknowledge that Hu et al. [3] have now also used DDPM, they only dedicate a single paragraph to its discussion. Hence, our detailed empirical analysis in the domain of Lipschitz-bound certified defenses remains novel. One of the key, and we believe substantial, insights is that additional data can only help close the generalization gap, but not improve robustness itself for Lipschitz-bound certified robustness.\n\n**Missing Comparison to a Key Related Approach**\n\nAs outlined previously, Hu et al. [3] might be the first published work to use generative models with Lipschitz-bound certified defenses but is missing a broader set of experiments and discussion of the applicability of data scaling to improve Lipschitz-bound robustness guarantees. We did not include larger-scale datasets, in particular ImageNet, as they are the only ones to achieve meaningful levels of accuracy and also do not apply DDPM. Given the chance, a camera-ready version would better delineate our work from that by Hu et al. [3] as well as reformulate some of the claims mentioned for additional clarity.\n\n**Unclear Meaningfulness of Improvements**\n\nWe understand that a larger sample size of different seeds would have been preferable, yet a significant budget of GPU hours (approx. 3000 hours) was already spent on the presented experiments. Given that most trends are present across multiple experiments, we nevertheless feel confident that our conclusions hold up to further scrutiny.\n\nIn a camera-ready version we would also revisit placement of tables and figures and ensure that %pt (percentage points) are used in place of % where necessary.\n \n[1] S. Gowal, S. Rebuffi, O. Wiles, F. Stimberg, D. A. Calian, and T. A. Mann, “Improving Robustness using Generated Data,” in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 34, Virtual Event, Dec. 2021, pp. 4218–4233.\n\n[2] Z. Wang, T. Pang, C. Du, M. Lin, W. Liu, and S. Yan, “Better Diffusion Models Further Improve Adversarial Training,” in Proc. Intl. Conf. Mach. Learn. (ICML), Honolulu, HI, USA, Jul. 2023.\n\n[3] K. Hu, A. Zou, Z. Wang, K. Leino, and M. Fredrikson, “Unlocking Deterministic Robustness Certification on ImageNet,” in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 36, New Orleans, LA, USA, Dec. 2023.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wPHXrDVLBu", "reviewer": "Reviewer_bWYd", "summary": "The paper explores advancements in certified defenses against adversarial attacks in deep learning models by leveraging data from state-of-the-art diffusion models during training. It addresses the current challenges where empirical methods, such as adversarial training, augment data but face difficulties with new attacks, contrasting with certified approaches that provide robustness guarantees within predefined threat models but often exhibit lower overall robustness. By integrating additional data from diffusion models, the study achieves state-of-the-art robustness certifications on CIFAR-10 and CIFAR-100 under L infinite and L2 threat models. This approach not only enhances deterministic defenses but also improves accuracy on clean data. The paper also performs extensive ablation studies to examine the effects of various design choices on certified robustness.", "questions": "1. The clean accuracy and robust accuracy of the networks trained in this paper are still lower than those of other architectures. Could you explain why they are lower and provide some reasons for this?\n2. Considering the relatively low accuracies, how practical is certified robustness? Could you list several practical scenarios where sacrificing accuracy for robustness to this extent would be justified?", "limitations": "1. The results primarily focus on CIFAR-10 and CIFAR-100 datasets, with limited exploration of generalization to other datasets and real-world scenarios.\n2. The results are based on four selected neural network architectures, and the generalization to a broader range of architectures is not thoroughly investigated.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The writing of the paper is clear and easy to follow.\n2. The paper explores a novel approach by leveraging data from diffusion models to improve certified defenses, which are typically more reliable than empirical methods.\n3. The approach achieves state-of-the-art results on CIFAR-10, demonstrating a significant improvement in robustness certificates for both L infinite and L2 threat models.\n4. The experimental findings are comprehensive and solid.", "weaknesses": "1. The paper evaluated four architectures selected from the certified robustness leaderboard [9]. However, the achieved clean accuracy and robustness accuracy on these neural networks are notably low. For instance, compared to architectures like WideResNet, which can attain at least 95% clean accuracy and over 80% robustness accuracy on CIFAR-10, the accuracies achieved by the approach in this paper remain insufficient.\n2. While evaluating the impact of using generated data from diffusion models to bolster certified robustness is novel, the idea itself represents a somewhat incremental advance. Previous research has already explored the use of such data to enhance adversarial robustness  within empirical methods.\n3. Despite the appeal of certified robustness due to its robustness guarantees, its lower accuracy compared to empirical methods diminishes its practicality. While this paper enhances certified robustness, its results have limited practical applicability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for taking the time to provide valuable feedback. We’d like to address your concerns regarding the weaknesses as follows.\n\n1. This is currently a well-known general limitation of certified robustness, and we believe should thus not have any influence in how our work is evaluated. To date, there is a trade-off to be made between high levels of robust accuracy to predefined attack models (empirical robustness) or lower levels of accuracy to any theoretically possible attack model (Lipschitz-bound certified robustness, among others), the latter of which is obviously a much stronger guarantee. For what it’s worth, the work by Hu et al. [1] raises hope that some of these limitations may be overcome in future research.\n2. The idea itself may not be novel, yet its evaluation on a broad set of Lipschitz-bound models certainly is. While incremental, we still believe it is of interest to the wider community focused on certified robustness, as it establishes that a better baseline for comparing certified models may be the data-saturated regime where no generalization gap is present. This better reflects the capability of each model to certify examples, rather than its ability to generalize.\n3. Practicality is inherently subjective, yet we agree there are limits to certified robustness that prevent wide-spread adoption. However, we would also like to highlight that the direct comparison of adversarial accuracies to certified ones is inherently ill-posed, as the latter is strictly smaller than the former, which is dependent on a specific attack model (e.g., PGD). It is thus unfair to dismiss them on the basis of this comparison alone. While an in-depth discussion of advantages is beyond the scope of a rebuttal, we echo the sentiments of Mangal et al. [2] who postulate that Lipschitz-bound certified defenses may put an end to the cat-and-mouse game of adversarial defenses and attacks.\n\nWhile some points have already been mentioned as part of our discussion of the weaknesses above, we’d also like to respond to the questions.\n1. Unlike adversarial robustness, which is always evaluated with a specific attack, certified models present guarantees with respect to all possible attacks (given a norm and epsilon bound). This is achieved by imposing mathematical constraints, such as orthogonality, that have negative impacts on model capacity and computational complexity. Both limitations are currently being addressed in ongoing research.\n2. While practicality is somewhat limited currently, safety-critical domains remain interested in Lipschitz-bound certified robustness as it is immune to advanced attack models that may be devised by malicious actors in the future as part of the cat-and-mouse game that is partially fueling the large amount of publications in adversarial robustness. We’d again like to point to Mangal et al. [2] who more extensively argue regarding its importance.\n\n[1] K. Hu, A. Zou, Z. Wang, K. Leino, and M. Fredrikson, “Unlocking Deterministic Robustness Certification on ImageNet,” in Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 36, New Orleans, LA, USA, Dec. 2023.\n\n[2] R. Mangal, K. Leino, Z. Wang, K. Hu, W. Yu, C. Pasareanu, A. Datta, and M. Fredrikson, “Is Certifying ℓp Robustness Still Worthwhile?,” Tech. Rep., Oct. 2023, arXiv:2310.09361 [cs] type: article. [Online]. Available: https://arxiv.org/abs/2310.09361", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yu37vIMZDv", "reviewer": "Reviewer_Vssv", "summary": "The paper presents an empirical study on how synthetic data can help improve the robustness accuracy and clean accuracy of certified adversarial robustness. While existing studies have shown promising results in using synthetic data to improve empirical adversarial robustness, the effectiveness of synthetic data on certified robustness has never been explored. This paper bridges this gap by designing experiments on $l_2$ and $l_\\infty$ robustness of multiple models over the CIFAR-10 and CIFAR-100 datasets. Experiment results show that synthetic data improves certified robustness but in a different way than their effects on the empirical one. The paper also provides ablation studies and guidance on different hyperparameters, such as dropout rate, epochs, model sizes, learning rate schedulers, quantity, and ratios between original and synthetic data.", "questions": "1. In section 3.2, the paper mentions that \"we naively sub-sample the 1m images from the 5m image dataset to...\" Are those images from generated data or original data? Also, the sizes of the generated data are different (50K~5m). Do you always perform a 20% sub-sampling, and where do the constants \"1m\" and \"5m\" come from? \n2. Does the diffusion model used to generate synthetic data see the robust classifier? Will it generate different synthetic data for different classifiers?\n3. In section 5, the paper mentions \"overfitting between best and last epoch.\" Does the paper perform experiments comparing one model trained by early stopping with the other without the early stopping?\n\nComment:\n\nThe paper points out a distinction between the scale of synthetic data on certified robustness and empirical robustness, i.e., scaling beyond one million CIFAR-10 generated images did not further improve certified accuracy, regardless of model size. This observation might be related to Bayes error [4,5].\n\n[4] Certified Robust Accuracy of Neural Networks Are Bounded due to Bayes Errors\n\n[5] How Does Bayes Error Limit Probabilistic Robust Accuracy", "limitations": "Although the paper mentions some limitations in their checklists, one significant limitation is whether synthetic data can help other deterministic training methods, such as convex bound propagation, as mentioned in the weakness.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The paper conducts experiments with multiple models and two datasets, demonstrating the generalizability of their study.\n2. The ablation studies consider several hyperparameters such as dropout rate, epochs, model sizes, learning rate schedulers, quantity, and ratios between original and synthetic data.\n3. The paper provides guidance on comparing certified accuracy among different approaches. This guidance is important and should be prompted in this research field.", "weaknesses": "1. My biggest concern is that the paper misses a large chunk of related works in section 2 and its experiments.\n    * In section 2, when discussing the deterministic approaches of certified robustness, the paper writes, \"one deterministic approach consists of ...\" There are other groups of deterministic approaches using convex bound propagation, such as IBP, SABR, TAPS [1, 2, 3]. The paper focuses only on approaches bounding the Lipschitz constant of each neural network layer. This narrow focus hurts the generalizability of the paper and should be justified. For example, the paper mentions that this group (bounding the Lipschitz constant) of approaches generates a robust guarantee by computing the distance between the highest two logits in the output space. This sentence justifies why not focus on the convex bound propagation approaches.\n    * In experiments, the paper's generalizability can be enhanced by comparing against or combining state-of-the-art convex-bound-propagation approaches, such as SABR and TAPS, SOTA, to see how the synthetic data can help.\n\n2. In section 4.3, the paper discusses the correlation between the generalization gap and certified accuracy. The reasoning in this section makes sense. However, the paper might neglect the fact that the model trained with dropout and synthetic data hurts the certified accuracy. This is a weird result. Could you provide the generalization gap of the model trained with $\\rho=0.85$ and synthetic data to try to explain this wired result?\n\n[1] On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models\n\n[2] Certified training: Small boxes are all you need\n\n[3] Connecting Certified and Adversarial Training", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful comments, which we address below.\n\n1. While we would have loved to include an even more extensive set of models (and datasets), our focus was on the best two models for the ℓ2 and ℓ∞ norms on CIFAR-10. In particular, for CIFAR-10 with ℓ∞, ε=8/255 threat model the IBP has 32.04% accuracy (67.96% error rate), SABR has 35.13%, and TAPS 35.10%. We have, however, now expanded our discussion of related work to include convex bound propagation, and are actively trying to add experiments for one paper of that family of certified methods.\n2. We are uncertain whether we have correctly interpreted your inquiry, so what follows is our best attempt at resolving any confusion. The best SortNet model w/o auxiliary data has 39.72% certified accuracy, with a generalization gap of 4.00%pt. When removing dropout (going down Tab. 1), the gap increases to 12.55%pt. When adding auxiliary data (going to the right in Tab. 1) the gap decreases to -0.82%pt, i.e., testing accuracy is better than training accuracy, indicating negative effects of dropout. Hence the overall best SortNet model with 41.78% certified accuracy has no dropout, and is able to benefit from longer training. We’d also like to point out that for ρ=0.85, the model w/ auxiliary data (41.32%) still outperforms the one w/o auxiliary data (39.72%), and the bold simply denotes the best model w/o auxiliary data.\n\nRegarding your questions, we answer them as follows.\n\n1. Wang et al. provide their generated data at https://github.com/wzekai99/DM-Improves-AT, which is also where the 1m, 5m, and 10m constants are from. However, their 1m dataset was subsampled from the 5m using the confidences of a classifier trained on the original CIFAR-10 images. This is why we instead use the first 20% of the generated 5m images.\n2. No, the diffusion model was conditionally trained on the ground-truth CIFAR-10 labels, but did not at any point use a classifier.\n3. Appendix E contains a figure comparing the best versus last epochs, and the full result tables in supplementary material directory cert-robust also contain columns with both. We did not find any meaningful correlation, which is also a marked difference compared to adversarial robustness.\n\nWe have now included a discussion of the Bayes error in Sec. 5 “Amount of Training Data.” Undoubtedly further exploration is required to determine why this behavior differs, and we remain confident our paper provides the necessary impulse to answer these and related questions.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
In response to the reviewer’s feedback, we have made the following changes to the manuscript

* In both Sec. 1 (Introduction) and Sec. 7 (Conclusion) we have added further references to Hu et al. and their prior usage of DDPM generated data, and carefully reworded related claims where appropriate (ours remains first for $\ell_\infty$ with new state-of-the-art). This is in response to reviewer #1's valid concerns that we may not have highlighted this enough in our initial manuscript.
* In Sec. 2 (Related Work), subsection “Certified Robustness”, we have dedicated a paragraph to convex bound propagation, and how it differs from Lipschitz-bound certification. This includes the references mentioned by reviewer #3. Experiments are currently running, and we will update once results are in.
* In Sec. 3.1 (Dataset and Threat Models) we have removed the reference to random guessing and replaced it with a more extensive discussion why we chose not to evaluate on the larger-scale ImageNet dataset.
* In Sec. 5 (Comparison to Empirical Robustness), subsection “Amount of training data”, we have added Bayes error as an alternative explanation as to why 1 million additional images seem sufficient for the investigated models. Thanks to reviewer #3 for pointing us in this fairly recently researched direction (May 2024).
* After Sec. 5 we have added a new Sec. 6 (Limitations) which addresses all known limitations, previously scattered throughout the paper, in a single place. Despite our extensive experiments, this includes (a) only evaluating one type of deterministic certified robustness, namely Lipschitz-bound ones; (b) only performing one repetition per experiment; and (c) only work on CIFAR-10 and CIFAR-100, as opposed to ImageNet.

We are currently also running experiments using the work by De Palma et al. [1], which uses convex bound propagation and is the 3rd-best model after ℓ∞-dist Net. However, as we have a shared cluster, we are unable to estimate whether results will be finished by the end of the discussion period. We expect to post an update by Monday.

[1] A. De Palma, R. Bunel, K. Dvijotham, M.P. Kumar, R. Stanforth, and A. Lomuscio, “Expressive Losses for Verified Robustness via Convex Combinations,” in Proc. Intl. Conf. Learn. Representations (ICLR), Austria, AT, May 2024.

Meta-review: This paper proposes to use diffusion models for data augmentation to improve the certified robustness of image classification models. The paper is well-written and easy to follow, and the the proposed method achieves state-of-the-art results on CIFAR-10, demonstrating a significant improvement in robustness certificates for $\ell_\infinity$ and $\ell_2$ perturbations. I suggest the authors add the additional experimental results mentioned in the rebuttal into the final version. I recommend accept (poster).
Decision: Accept (poster)