Improve Certified Training with Signal-to-Noise Ratio Loss to Decrease Neuron Variance and Increase Neuron Stability
Authors: Tianhao Wei
Ziwei Wang
Peizhi Niu
ABULIKEMU ABUDUWEILI
Weiye Zhao
Casidhe Hutchison
Eric Sample
Changliu Liu
Venue: Accepted by TMLR ()

Abstract: Neural network robustness is a major concern in safety-critical applications. Certified robustness provides a reliable lower bound on worst-case robustness, and certified training methods have been developed to enhance it. However, certified training methods often suffer from over-regularization, leading to lower certified robustness.
This work addresses this issue by introducing the concepts of neuron variance and neuron stability, examining their impact on over-regularization and model robustness. To tackle the problem, we extend the Signal-to-Noise Ratio (SNR) into the realm of model robustness, offering a novel perspective and developing SNR-inspired losses aimed at optimizing neuron variance and stability to mitigate over-regularization. Through both empirical and theoretical analysis, our SNR-based approach demonstrates superior performance over existing methods on the MNIST and CIFAR-10 datasets.  In addition, our exploration of adversarial training uncovers a beneficial correlation between neuron variance and adversarial robustness, leading to an optimized balance between standard and robust accuracy that outperforms baseline methods.

Casidhe Hutchison Published in Transactions on Machine Learning Research MMy/2202)
Improve Certified Training with Signal-to-Noise Ratio Loss to Decrease Neuron Variance and Increase Neuron Stability
Tianhao Wei
tweil8@nnree.cmm.commm
Robotics Institute, Cornegie Mellon University
Ziwei Wang
stwckunz2@endree.ccmee
Robotics Institute, Carnegic Mellon University
Peizhi Niu
pwiu@ondrew.cmm. edu
Robotics Institute, Cornegie Mellon University
Abulikemu Abuduweili
abulikea@undree..com cww. edu
Robotics Institute, Carnegic Mellon University
Weiye Zhao Robotics Institute, Carnegie Mellon University
weljeezhaSonndrew.ome
Mautchin@nrec.mm cmu, edu
Robotics Institute, Carnegie Mellon University
Eric Sample Robotics Institute, Cornegie Mellon University
esample@nrec.ri.oo wwt.rri.cmm...mmmmm. edu
Changliu Liu
cliu@Sandrew.cmu.cmmmmm edu
Robotics Institute, Carnagie Mellon University
Reviewed on OpenReview: https: opwreviee......e. net/ forum? id- &003kFF25
Abstract
Neural network robustness is major concern in safety-critical applications. Certified bustness provides reliable lower bound on worst-case robustness, and certified training methods have been developed to enhance it. However, certified training methods often suffer from reguaargulii,ittoon, leading to lower certified robustness. This work addresses this issue by introducing the concepts of neuron variance and neuron stability, examining their impact on over-rogulaiization and model robustness. To tackle the problem, we ex- lend the Signal-to-Noise Ratio (SNR) into the realm of model robustness, offering a novel perspective and developing SNR-inspired losses aimed at optimizing neuron variance and stability to mitigate ovar-rogularization. Through both empirical and theoretical analysis, our SNR-based approach demonstrates superior performance over existing methods on the MNIST and CIFAR-10 datasets. In addition, our exploration of adversarial training un- covers a beneficial correlation between neuron variance and adversarial robustness, leading to an optimized balance between standard and robust accuracy that outperforms bascline hods
1 Introduction
Ensuring robustness in neural networks, espocially those deployed in safety-critical systems, paramount. Recent efforts have led to the development of various algorithms to both empirically (Madry al.) 2017
Goodfellow et al. 2014) and formally (Liu et al. 2021 assess the robustness of neural networks, giving

---

caused by Published in Transactions on Machine Learning Research (May/2024)
Adversarial Robusiness
True Robustness
Last Layer Variance
Model SNR Loss
SNR
Neuron Variance
Layer SNR
Signel
Noise
Certified
Neuron
Robustness
regulartzation
Stabilit
Figure 1: Overview of the analysis and the method. The Signal-to Rignal-to-Noise Ratio inspired losses at different scale improve neuron variance and neuron stability, leading to higher true robustness and less over-approximation and consequently higher certified robustness and higher adversarial robustness.
2
2
2
2
2
2
2
2
stable, high variance
stable, low variance
stable, low variance unstable, high variance unstable, low variance
Figure Neuron variance and stability in ReLU activation. 2 denotes the input range of the ReLU, denotes the output range of the ReLU. A neuron is unstable if its input crosses 0.
rise to the concepts of adversarial and certified robustness. While certified robust offers reliable lower bound on the worst case output robustness (termed as true robustness), adversarial robustness provides a near upper bound. However, computationally, certified robustness is usually much lower than adversarial robustness because of the difficulty of certification (Liu al. 2021). To address this problem, certified training methods were proposed (Gowal al.) 2018 Mao al. 2023b) to make the model easier to certify within finite time. However, model being casier to certify does not necessarily equate to higher certified robustness. De Bartolomeis et. al. (2023) have shown that major challenge of certified training is over- regulariaation, which excessively penalizes the model to reduce the difficulty of certification, leading to lower (although faster to compute) cortified robustness than adversarially trained models (Mao et al. 2023a)..
In this work, we aim to bridge this gap by enhancing certified training methods. We focus on reducing the over-regularization achieve higher certified robustness. In general, over-regularization over-approximation of the worst case output of the neural network. In practical certification algorithms, this aver-approximation comes from convex relaxation of the neural network (Liu et al. 2021 Müller et al, 2022) which overcomes the nonlinearity of neural networks for easier certification. Many convex relaxation methods were proposed, some are tight but slow (Tran et al. (021)) while some are loose but fast (Gowal et al. 2018h. is a common belief that the certified robustness is generally hindered by the number of unstable neurons (i.e., neurons introducing nonlinearity, hence requiring convex relaxation) (Shi et al., 2021: De Bartolomcis al., 2023). However, a detailed quantification of how the collective bohavior single neurons impacts certified robustness remains absent from the literature.
To analyze these relationships, characterize behaviors of neurons. Neuron variance is the variance of neuron output given an input range of the model. As shown in fig. 2 we say a neuron has high variance the output varies a lot under perturbation. Neuron stability is a binary status defined for piece-wise linear activations such as ReLU and Leaky ReLU. We call neuron unstable for ReLU activation, if the input of the ReLU is always positive or always negative, then the neuron is considered stable.
first introduce two concepts neuron variance and neuron stability to
introduces non-lincarity, and otherwise stable. For example,
2

---

Published in Transactions on Machine Learning Research (May/202) /204)
We use both empirical and theoretical methods to analyze how over-approximation relates to neuron variance and neuron stability. Tn the empirical study, to isolate the impacts of neuron variance and neuron stability on over-approximation, we shift bias terms to control the number of unstable neurons and neuron variance. It is revealed that the over-approximation is positively related to neuron stability under tight convex relaxations, such as Star (Taa et al. 2021] and Zonotope (Singh el al. 2018), and the over-approximation related to the neuron variance for both tight relaxation and loose relaxation, such as the commonly used box relaxation (also known as IBP) (Gowal et al.) 2018). Since the best practice of certified training is to train with box relaxation and verify with tight relaxation (Jovanović et al. 2021), it is essential to both reduce the number of unstable neurons and reduce neuron variance. However, directly using neuron variance and neuron stability as loss functions is impractical due to the binary nature of neuron stability and the varying scales of neuron variance across different layers.
positively
To tackle this challenge, we introduce the concept of Signal-to-Noiss Ratio (SNR), offering a novel perspective on model robustness and providing two surrogate losses for neuron variance and neuron stability. SNR is a widely used metric in signal processing but has not been used to analyze neural nefwork robustness so far. By viewing the neuron-by-nenn
output of the clean input as the signal and the output deviation under perturbation as noise, our intuition is that a robust model should aim to suppress the noise and maximize the SNR. The de facto loss used in adversarial training, TRADES (Zhang et al. 2019a), can be viewed as a model level SNR, loss that only applies to the last layer of the model. However, unlike adversarial training where only the robustness of the last layer matters, in certified training, the robustness of intermediate layers plays a vital role because the convex relaxation error accumulates through the network. Therefore, it is essential to optimize these intermediate layers to improve neuron variance and stability for reducing over-approximation. We define the inverse of the layer-level SNR as the loss for neuron variance, which is exactly weighted sum of neuron variance based on the layer-wise output scale. We also define a continuous surrogate loss for neuron stability based on the neuron-level SNR. The overview of our analysis and method is shown in fig. Our experiment results show that the SNR inspired losses effectively improve the certified robustness, and outperform state-of-the-art methods on MNIST and CIFAR-10.
Furthermore, given the fact that SNR losses improve certified robustness, we hypothesize that SNR losses could also improve adversarial robustness even true robustness. To validate the hypothesis, we first draw the layer-level SNR. across network layers of adversarial-trainen versus coandard-trained models to show the correlation between neuron variance and the ad adversarial robustness, where we observe a distinctive behavior. Notably, the layer-level SNR has an increasing trend over depth in adversarial-trained models, contrary to the consistency seen across all layers in standard models, which demonstrates a strong correlation between neuron variance and the adversarial robustness. Then we combine the variance loss with two popular adversarial training methods, TRADES (Zhang et al., 2019a) and AD (Madry et al. 2017), which can be viewed as model- level SNR. Our experiments manifest the efficacy of this regularization by achieving higher robust accuracy while maintaining the same natural accuracy on MNIST and CIFAR-10, demonstrating that the variance loss effectively improves the adversarial robustness. Since adversarial robustness is close approximation of the true robustness (Müleer et al. 2022), this finding suggests that neuron variance is strongly correlated with true robustness (ideally, an extremely robust model should have zero neuron variance).
In summary, our contributions are multifaceted: 1. we numerically and analytically demonstrate that the reachable set ovoraapproximation has a positive correlation with both neuron stability and neuron variance. 2. We exlend the concept of Signal-to-Noise Ratio (SNR) model robust and design two losses based on it to reduce the neuron variance and the number of unstable neurons. 3. We apply these two losses to certified training and demonstrate their efficacy by outperforming state-of-the-arr methods on MNIST and CIFAR-10. 4. We show that the true robustness of model is correlated with neuron variance and can be improved by variance loss through adversarial training, achieving a better trade-off between robust accuracy and standard accuracy on MNIST and CIFAR-10.
3

---

Published in Transactions on Machine Learning Research (May/2024)
2 Background
Training robust neural networks tion:
can generally be viewed as solving the following min-max optimiza-
min E (x.)) 0
max (U0((++),90) 6EA(X)
(1)
where To denotes a neural network parameterized by 0, is the data distribution, x is a data sample, y is ground-truth label, å is a perturbation constrained in the set Axx), and C is the loss function.
Adversarial training methods solve the inner maximization in equation 1 with adversarial attack, and solve the outer minimization with normal training with corrected labels (Goodfellow et al. 2014). Madry
ct al. (2017) further advanced adversarial training using a strong itcrative adversary, demonstrating its capability to train models that are highly robust to many adversarial attacks. However, it's worth noting that adversarial training can compromise the generalization performance of deep learning models (Zhang et al. 2019a). Consequently, researchers have introduced variations of adversarial training aiming to strike balance between accuracy and robustness, as exemplified by methods such as TRADES (Zhang et al. 2019a), Interpolated Adversarial Training {Lamb el. al.,
2019), and other approaches (Raghunathan el al.
2020 Han et al., 2020). In this work, we show that better trade-off on some datasets can be achieved by combining our method with TRADES (Zhang et al.,
2019a) AD (Madry et al., 2017). Furthermore,
TRADES and AD can be viewed as an SNR loss with a focus on the SNR of the last layer of the model.
Certified training methods optimize an upper bound of the inner maximization in equation 1 The upper bound is derived from bound propagation (Mao et al. 2023b). There are two classes of methods to derive the upper bound: Sound methods provide a strict upper bound, such as IBP (Gowal et al. 2018). Star (Tran et al. 2021), and Deep'Z (Singh et al.] 2018)), but the upper bound generally loose because of over-approxination 2. Unsound methods, attempting to reduce over-approximatio, provide more accurate estimations of the upper bound at the cost of soundness Müller et al. (2022) Mao et al. (202aa).
Over-regularization is common problem in certified training. Because certified training methods rely on convex relaxation to derive the upper bound, over-approximation of the upper bound often exists (Mao et al. 2023a). There is a consistent empirical understanding of the relative tightness of different convex relax- ations (Jovanović el al.] 2021). However, a light relaxation, even though it leads to less over-regularization, does not necessarily produce higher certified accuracy in certified training due to the continuity and sensitiv- ity of the training dynamics (Jovanović et al., 2021). Therefore, new methods to address over-regularization are needed. We propose to reduce over-approximation by reducing unstable neurons, which is orthogonal to existing convex relaxation based methods.
3 How Do Neuron Variance and Stability Affect Reachable Set Over-approximation?
In this section, we present a new analysis to show that both neuron variance and stability affect over- regularization through the introduction of reachable set over-approximation, which motivates our method in section 4 The limitations of existing analysis, which prevents the detailed quantification of the cause of over-approximation, will be first discussed with a case study. To address the limitations, we present. a new analysis, controlling neuron variance and stability by shifting bias terms. A numerical study and an analytical study are developed based this method, showing that the over-approxination in Box relaxation is dominated by neuron variance, and that the peerapppoximaiions in tight relaxations, such as Star and Zonotope, is dominated by neuron stability. Therefore, it is important to minimize both of them to achieve higher model robustness.
We study the averappproiination in certification with reachability based methods Liu et al. 2021 where a reachable set Y of the output is computed. Directly comparing the reachable set gives us an intuition of the worst case over-approximation arbitrary directions. In contrast, other methods focus on checking whether the output specification is violated or not, hence not computing Y.
4

---

Published in Transactions on Machine Learning Research (May/2024)
3.1 Limitation and Solution
It is well known that unstable neuron introduces over-approximation at the neuron level (Zhang et al, 2018). Consequently, a common belief is that the performance of certification reduces with the growth of the number of unstable neurons because they result in reachable set over-approximation (Xu et al.) 2020; Lee et al., 2021). However, this belief has not been directly and rigorously verified because it is difficult lo control the number of unstable neurons without affecting the true reachable set. Existing approaches control the number of unstable neurons indiroctly through factors such as model width, depth, and perturbation budget (De Bartolomeis el al. 2023 Mao et al.) 2023b). However, as is to be shown in fig. Chese factors also change the true reachable set, making it challenging to quantify the over-approximation
Case study We consider fully connected neural networks with 2- dimensional outputs for visualizing the last layer reachable set. We compute the exact reachable set by enumerating all linear pieces of the neural network. We consider three popular convex relaxation: Box (also known IBP), Zonotope, and Star. Box keeps dimension- wise lower bounds and upper bounds. Zonotope is defined as f x c Σ, a:9s. s.t.|a| < 1}. with and as ayyr-ouutuutddimmnsionn vectors. The vector с denotes the center of the set; gi is a generator of the set; and a is scalar. In short, Zonotope contains all points that can be represented as the center plus a weighted sum of the generators, where the Ln norm the weight should be less than 1. Star uses a similar representation as Zonotope, but with different constraint on the weight: {a | = Σ, aggi, s.t.Aa < 6). This constraint Aa < is more flexible than |a| < 1, therefore Star is tighter than Zonotope but slower to compute. We also draw the convex hull of the exact reachable set to illustrate the optimal convex relaxation. As shown in fig. 3 when these factors change, both the true reachable set and the convex relaxation change. The 3-4-4-2 model is randomly initialized. To control the variables, other models are obtained by directly taking the subset of the 3-4-4-2 model parameters. For example, 3-4-2 is obtained by removing the third layer of 3-4-4-2. Figure 3a and fig. 3b demonstrate the depth change. Figure 3b fig. 3c and fig. 3i demonstrate the width change. Figure
and fig. 3d show the input set change. The input set is reduced by half on each dimension in fig. 3d (the volume is 1/8 of the original input). Because both the true reachable set and the convex relaxation change, we cannot directly conclude that the over-approximation is determined by the number of unstable neurons.
Bax
Bax
Zonotope
Zomotope
Star
Star
2
2
Convex Hull
2-
Convex Hull
Exact
Exact
Box
Star
Zonotope
0
0
Convex Hull
-2
-2
-1
0
-2
-1
0
4
-2
-1
0
(a) 3-4-2 10-2255 PC
(b) 3-4-4-2 4-422-2 FC
(c) 3-3-3-2 FC
Zonotoge
3
Zanotope
3
Zonotope
Star
Star
Star
Convex Hull
2-
Conves Hull
2
Convex Hull
0
0
0
-23 -2
-2
(d) 3-4-4-2 FC, smaller input set
(e) 3-4-4-2 FC, bias shift
(f) 3-2-2-2 FC
Figure 3: How do different factors affect the true reachable set and its convex relaxation for models with 2 dimensional outputs. a-b-c-d FC denotes fully connected model with four layers of the size b, c, and d.
5

---

Published in Transactions on Machine Learning Research (May/2024) /204)
Solution To address this problem, we control the number of unstable neurons by shifting the bias before each activation function. As shown in fig. 3e this method can keep the exact reachable set al similar scale while reducing the over-approximation. Given the lower bound and upper bound of each neuron in the model, we can make an unstable neuron stable by subtracting either its upper bound or its lower bound, making it always negative (inactive) or positive (active). To gel an accurale estimation of the lower bound and upper bound of each neuron, a sampling based method is adopted. We sample multiple inputs from the input set and perform inference on the model. The extreme values of each neuron (adding a constant margin) are used as their lower bound and upper bound.
To explain why bias shift is better way to control the number of unstable neurons than width, depth and input set size, we can consider the deep linear network (DLN) f(x) = W; x, which describes ReLU networks for infinitesimal perturbation magnitudes. Because DLN retains the layer-wise structure and joint non-convexity in the weights of different layers, it a popular analysis tool (Mao et al. 2023b; Ribeiro et al., 2016). The reachable set of DLN is an affine transformation of the input set. is obvious that changing width, depth and the inpul set changes the reachable set size. However, shifting bias results in only translated reachable set for a DLN because f' f((x) Wi(Wi-1(-- (V(W--(---WW1=+bbb> (12++b))+62++ +..+6..+++.+.))))) 1
W2 z
has the same transformation as fx) except for a different constant.
This analysis does not directly generalize to ReLU networks because bias shift, actually changes the exact reachable set when ReLU is present. As shown in fig. | for a neuron, the reachable set becomes larger after shifting it to positive, and becomes smaller after shifting it to negative. However, we can still isolate the source of over-approximation by controlling variables. We can study bias shift for ReLU in three cases: 1. shift all unstable neurons to inactive: as the unstable neurons reduce, the exact reachable set shrinks while the non-linearity decreases. 2. shift all unstable neurons to active: as the unstable neurons reduce, the exact reachable set increases while the non-linearity decreases. 3. shift unstable neurons to active or inactive, a random half of the unstable neurons are shifted to active and the other half are shifted to inactive. As the unstable ncurons reduce, the nonlincarity reduccs. Howover, empirical observations indicate that the exact reachable set remains approximately the same in scale, as shown in fig. 3el By comparing the over- approximation in these three cases, we can identify the dominating source of over-approximation for different solvers.
3.2 Numerical study
We conducted the numerical test on a randomly generated 4-layer fully connected neural network, with 50 neurons per layer. Because it is difficult to directly compare high dimensional polytopes, we measure the size of the reachable set by the maximal dimension-win -ise radius. The radius of the exact set is estimated by the weight matrix norm of the corresponding DLN as used by Mao et al. (2023b). As shown in fig, 5 Box relaxation grows when neurons shift to active, and reduces when neuron shift to inactive, even though in both cases, the number of unstable neurons reduces. This reveals that the over-approximation of the box relaxation is dominated by the dimensionwise reachable set (neuron variance), which is expected (Gowal et al. 2018). But in contrast, the performance light convex relaxation methods such as Star and Zonotope are dominated by the nonlinearity (number of unstable neurons). Even though in the shift to active case, the exact reachable set grows larger when there are fewer unstable neurons, Star and Zonotope still achieve smaller reachable sets, indicating less over-approximation This demonstrates that the number of unstable neurons plays a vital role in over-approximation for tight relaxations.
It has been shown that the most effective way for cortified training is to train the network with Box relaxation followed by verifying the network with tight relaxation such as Star and Zonotope Jovanović et al. (2021 Therefore, it is important to reduce the over-approximation of both methods, which motivates us to reduce the number of unstable neurons and the dimension-win wise reachable set, thus reducing neuron variance.
3.3 Analytical study
To confirm that neuron stability is important for tight solvers and the neuron variance is important for all solvers, we give an analytical solution of the overaaprroxination in the shift to active case. We consider two layer neuron network with two dimensional input and output, which can be denoted by 2 = Wix + bi, 2
6

---

Published in Transactions on Machine Learning Research (May/2022) 2024)
2
Z
2 A
Hefore Kelu size
100000000
2
1
2
2
-2
1
2
2
2
1 2 2
shift to inactive
original
shift active
Figure 4: One dimensional reachable set after bias shift. Shift to active leads to dimension- wise larger reachable set, and shift to inactive leads to dimension-wise smaller reachable set.
Exact
120
Star
Zonotope
100
Exset
80
Exact
Redhus
40
40
Star
Star
Zonotoge
60
Zonotope
Boxs
20
20
40
20
20
100
20
40
100
20
100
Number Unstable Neurou
Number Unstable Neuron
Number Unstable Neuron
(a) shift to inactive
(b) shift to inactive/active
(c) shift to active
Figure 5: Level of over-approximation against neuron stability under three bias shift cases. The over- approximation (the gap between the convex relaxation radius and the estimated exact radius) grows with the number of unstable neurons consistently for tight solvers such Star and Zonotope. But the over- approximation of Box is dominated by the reachable set radius (controlled by the bias shift method).
(2), y W22 + b2, where is the input, 2 is the pre-activation layer, the hidden layer, and y is the output. We denote the reachable set of cach layer by X, Ż, Z, Y respectively. In general, it is difficult to give an analytical solution of the Star vve-aappooimmatin because it involves solving linear programming, which typically requires numerical solvers. Therefore, we consider special case where Ž is an Ią-norm ball and W2 is a rotation matrix as shown in fig. 6 Specifically, W2 rotates z by T/4. We denote the Lı norm ball by (cz, cy) and r, representing the center and radius respectively. We measure the over-approximation by the after rotation Y-radius of the reachable set.
We analyze the over-approximation in the shift active case under different number of unstable neurons: 2 unstable neurons, unstable neuron, and 0 unstable neuron. Without loss of generality, assume c, Gy in all cases. The detailed derivation of all cases is in appendix A A summary of the analytical solutions is in table 1 When there are fewer unstable neurons, Box over-approxination increases while Star over- approximation decreases, showcasing that stability is important for light solvers such as Star. Both Box over- aprroxipoxiiiioonn and Star wverapppoxximatie are related to neuron variance, represented by the radius r of the ball,,, indicating that the variance is a critical factor for all solvers. The analytical solution confirms that enhancing neuron stability and minimizing neuron variance are critical in reducing over-approximation (and consequently in improving certified robustness) observed in the numerical test.

---

Published in Transactions on Machine Learning Research (May/2024)
Cx. Cy)
Exact Star
Y-radius
2
Y
Figure 6: Reachable set propagation when Ž is an L1 norm ball, and W2 is x/4 rotation matrix. In this example, there are two unstable neuron when going through the ReLU activation. We analyze the over- approximation by computing the Y-radius of output set.
Y-radius of
2 unstable
unstable
0 unstable
Exact
v2
(g + r max (2)
2r
2rr
Box
/2 (cg + cy + 2r)
// (cz + 3r)
2/2r
Star
22
2 c2 + Gy + +r)
1/
(2 + 2r max Cz. 0})
/2r
2
Box- Exact
22
(r (2
+ min Cz2 0}) E [0, v22
2 (r + cx) E [0, 2r]
22r 2r
Star Exact
2 (r cxl) E [0, x22
2 (r - (cal) [0, 22
Table 1: Analytical solution of Y-radius over-approxinaation for the given example. Box Fxact and Star Exact measure the Box and Star over-approximation respectively. (cx, and denote the center and radius of the Li norm ball.
4 Method: SNR loss
We have shown that both the number unstable neurons and neuron variance are vital reducing over- approximation. In this section, we propose two losses: variance loss and stability loss, to reduce neuron variance and enhance neuron stability respectively. We observe strong connection between model robustness and the concept of Signal-to-NNiss Ratio (SNR), widely recognized in signal processing and communications, We extend SNR to model robustness and define layer-level SNR and neuron-level SNR, which inspires the variance loss and stability loss. The layer-level SNR. loss can be viewed as weighted sum of neuron variance based on the output range of each layer, and the neuron-level SNR loss can be viewed as a weighted sum of neuron noises based on a neuron's 's distance to the stability boundary (when signal equals noise).
4.1 Mathematical Definition Signal-to-Nonn Noiise Ratio
We denote neural network by x X Y, the output of i-th layer by f'(x), and the output of the i-th layer j-th neuron by (z). Considering
original input Do and perturbed inputs ",, where 2; E A (x)) Ç X, we define the signal of a neuron as of. = f)(x)), and the noise of a neuron The intuition that the signal is the truly useful output, and the noise is the output
n/ - f(x) deviation caused by perturbations. The max noise can be viewed as an under-approximation of the size of the dimension-wise reachable set. æ, be sampled from arbitrary distribution adversarially searched. But adversarial search usually gives wear-worst-case noises and therefore gives better amdor-approximation of the reachable set. Similarly, we define the squared signal of layer as S == E, sj and the squared noise of layer as N? = m E, Em n//x" The SNR of layer is defined as
Σ, S
(xo)) [1(()))) (wx)))
SNR' = 1 Σ, Σ k=
(2)
ΣE
m
8

---

Published in Transactions on Machine Learning Research (May/2024)
4.2 Layer SNR: Variance loss
We can see the denominator of the layer SNR is exactly the neuron variance and the numerator is the scale of the layer output. Therefore, we can directly use the inverse of SNR. as the loss to minimize neuron variance.
Cear TO E EK=I DE
1 mi E (xx) f
(3)
E5=1
(
During experiments, we found that the model tends to minimize the loss by enlarging the signal through increasing the weight scale instead of reducing the noise. We hypothesize that this due to the loss function causing the model to enlarge the signal instead of reducing the noise. Reducing noise requires the model to learn a truly robust representation of semantic features, whereas enlarging the signal only requires increasing the weight scale. Therefore, we exclude the gradient w.r.t the signal, fi(x0), to prevent the model from cheating and only increasing the signal. So, we only optimize the loss to reduce noise, not enlarge signal. The term 1/ (xx) serves as loss weight to balance the penalty of different layers.
4.3 Neuron SNR: Stability loss
A neuron is unstable max, (zp > 0 and ming fz((z) < roduce unstable neurons:
We design the following stability loss to
1
ml 1 k=1j=1 + k=1j=1 fy (xx) +e
(z)))) fj(wo)
L.u
(4)
The intuition behind this loss is encourage the noise to be small when the signal is close to zero, such that unstable neurons can be reduced. We also allow the signal to shift away from zero reduce the number of unstable neurons. In contrast to the layer-wise variance loss, the stability loss is a neuron-wise loss. Since the loss does not decrease by simply increasing the weight matrix scale, we permit gradient with respect to the signal. We use L1 norm of ný because we are most concerned with the number of unstable neurons instead of the maximal noise. We use sj² + c instead of s) in the denominator to avoid n//// + oc when 8) + and to make the gradient of Cs continuous and smooth.
5 Experiments
In this section, we show that the propose two losses Syar and Lass can be used to improve model robustness in both certified training and adversarial training.
5.1 Certified Training
Datasets and Implementation Details We first introduce the datasets on which we conducted exper-
iments and the implementation details of our method. The datasets include MNIST LeCun et al. (011
and CIFAR-10 Krizhevsky et al. (2009). Following the experimental settings in SABR Müller et al. (022
we adopted horizontal flip and random cropping with normalization for data augmentation in CIFAR- 10.
We used the test sets of MNIST and CIFAR-10 for evaluation, where the metrics include natural accuracy and cortified accuracy. The former demonstrates the performance on clean samples, and the latter depicts the ratio of samples that are guaranteed to be correctly classified under any perturbation within given magnitude. The perturbation magnitudes for experiments on MNIST were set to 0.1 and 0.3, respectively, and those on CIFAR-10 were assigned to 2/255 and 8/255. We employed MN-BAB Ferrari et al. (2022) for certification, where the time limit for verifying a single input was 500 and 1000 seconds for samples in MNIST and CIFAR-10, respectively. The training and evaluation is carried on a single 16GB NVIDIA RTX A4000 GPU.
The model we utilize is CNN7, following the settings described in Müller 2022) We will leave the study more complex models for future work, as they require more advanced verification algorithms to
9

---

Published in Transactions on Machine Learning Research (May/2024)
Table 2: Comparison of the natural accuracy and the certified accuracy with different perturabation mag- itutes and on different datasets. The verification method MN-BAB and the time limit of verifying each input 500s and 1000s for samples in MNIST and CIFAR-10 respectively.
Dataset
Coo
Method
Year
Natural Acc.
Certified Acc.
COLT
2020
99.20
97.10
Crown-IBP
2020
98.83
97.76
0.1
IRP-Fast
2021
98.84
97.95
SABR
2023
99.23
98.22
Ours
99.22
98.24
MNIST
COLT
2020
97.30
85,70
Crown-IBP
2020
98.18
92,98
0.3
IBP-Fast
2021
97. 67.67
93.10
SABR
2023
98.75
93.40
Ours
98.64
93.22
COLT
78.40
60.50
Crown-IBP
2020
71.52
53.97
[BP-Fast
2021
66.84
52.85
2/255
1BP-R
2022
78.19
61.97
SABR
2023
79.24
62,84
Ours
78.75
62.99
CIFAR-10
COLT
51.70
27.50
Crown-IBP
46.29
[BP-Fast
2021
48.94
34.97
8/255
IBP-R
2022
51.43
27.87
SABR
2023
52.38
35. 13
Ours
51.18
35.44
certify. For the adversarial sample generation, we adopted PGD Madry et al. 2017 with 10 iterative steps, where the step size was set to 0.007. The total loss we use is = Leabr + a E, Cear + B Ciabs where feabr from Müller et al. (2022). ; a 0.001, and 3 0.0005. We used the Adam optimizer to update the network parameters with a batchsize of 256.
Comparison with the State-of-the-arts We compare method with existing certified training meth- ods including COLT Balunović & Vechev (2020), CROWN-IBP Zhang et al. (2019b). IBP-Fast (Shi et al. (2021), IBP-R De Palma et al. (2022), and SABR Mûller et al. (2022) on different datasets with various perturbation magnitudes. Table 2 demonstrates the clean accuracy and the certified accuracy of baselines and our methods, where our method outperforms all baseline approaches most experimental settings. The state-of srate-of-hhe-rr method, SABR, propagates small interval of the adversarial region significantly reduce the over-approximation, while not considering neuron variance neuron stability. Tn contrast, our method introduces variance loss and stability loss, respectively, for neuron variance reduction and neuron stability en- hancement. As result, method outperforms state-of-the-ard methods with 62.99% and 35.44% certified robustness on CIFAR-10 under the 2/255 and 8/255 Los perturbation. The advantages of our method are more obvions in the sconarios with higher perturbation magnitude bocause larger noise usually causes more unstable neurons, and explicitly reducing the neuron instability can benefit the certified robustness of the networks. We also outperform state-of-the-an methods with a 98. 98.24% certified robustness on MNIST with the 0.1 Loe perturbation. The performance enhancement in MNIST is not significant as in CIFAR-10, since in MNIST, the samples are casier to be classified correctly and certified.
SNR before and after training We show that the proposed losses effectively improve SNR and enhance neuron stability. Figure 7 shows the logarithm of the layer signal and the layer noise defined by equation 2 of different layers CNN7 across all test samples in MNIST. Our model trained with the variance loss and the stability loss generally achieves higher signal and lower noise in all layers. We also show the line S? N² in the figure. Samples located under the line have S? N2, indicating lower variance and fewer unstable neurons because the magnitude of the noise is smaller than that of the signal.
10

---

Published in Transactions on Machine Learning Research (May/2024)
SABR
Ours
Convl
Conv2
Conv3
-5
-10
-10
15
-15
-20
-20
Logarithm of Noise
-25
-10
-8
6
-20
-15
-10
-
-5
20
-15
-10
-
Conv4
Conv5
-5
-10
15
-15
-10
-20
-0
25
-2
-10
-20
-10
Logurithm of Signal
Figure log S/. and log N? across different layers of CNN7 for 10000 test samples. Our method achieves higher signal and lower noise than the baseline. The dashed line represents S = N?. Samples above the dashed line generally have more unstable neurons because their noise is larger than signal.
An ablation study of and 3 is shown in table The results report clean accuracy and certified accuracy CIFAR-10 under 2/255 perturbations. We can see that the performance does not change monotonously with either parameter. We hypothesize that these two losses are coupled with each other, therefore leading to this non-monotonous behavior. We will investigate a more decoupled design to isolate the effect of the loss in the future. We will also investigate how to choose the best alpha and beta under the current design in future work.
Table 3: Comparison of and 3 values on CIFAR-10 under 2/255 perturbations Numbers denote natural accuracy and certified accuracy respectively.
0.0001
3 0.0005
0.001
0.0001
79.00% 80%
78.53%
79.05% /61.%%
a: 0.001
78.52% 62.73%
78.75%/62.995
77. 77.13%%/62.co 63%
0.01
78.23%
77.82%//2.100%
77.69%
5.2 Adversarial training
Neuron variance and adversarial robustness We have shown that the SNR losses improve certified robustness. Next, we show that the adversarial robustness is also related to neuron variance and SNR, and can be improved by the variance loss.
We draw the SNR curves for models trained adversarially versus those trained with standard methods, as sourced from RobustBench Croce et al. (2020), to show the correlation between neuron variance and adversarial robustness. We consider the three most popular adversarial learning architectures Croce el al. (2200;: WideResNet-288. 2801 WideResNNet-3-22 trained models have significantly higher SNRs than standard trained models. The denoising behavior is consistent across all models. Very interestingly, we find that the signal processing can be roughly divided into three stages, which call pil, platform, and incline, exactly corresponding to the three block groups
and WideResNet-7O-4
As shown in fig. 3 adversarially
11

---

Published in Transactions on Machine Learning Research (May/200 2224)
of the ResNet architecture. The pattern is consistent with what Allen- & Li (022 have proposed:
adversarially trained models learn to purify spurious features while standard trained models do not.
07.519%
10
56.94%
54.929%
50.823
10"
66. 5435
7496
102
Layer SNR
0.00%
10
50.57
12.2
57.149%
0.0055
10p
107
105
wwww
107
10a
W
5
1.0
30
60
Jayer
lageer
Bayner
(a) WRN-28-10
(b) WRN-34-20
(c) WRN-70-16
Figure 8: SNR curves of models at different robustness levels from RobustBench. The number in the legend indicates the adversarial robustness of the model. Robust models generally have high and increasing SNR curve. The non-robust model (0.00%) shows low SNR curve with different trend.
Variance loss improves adversarial robustness We next show that the adversarial robustness be improved by reducing neuron variance. We combine the variance loss with two popular adversarial training methods, AD Madry et al. (2017) and TRADES Zhang et. al. (2019a), by two hyperparameters ry Ctrades + whear and yLad + whear. Following the setup described in TRADES Zhang et al. (0199a) a CNN architecture with two convolutional layers and two fully-connected layers employed for MNIST. Settings include perturbation
rate Ir 0.01, batch size 0.1, perturbation step size 17 0.01, number of iterations K 20, learming 128, and training epoch is 50. For CIFAR-10, ResNet-18 serves the classificatton. Here, perturbation 8/255, perturbation step size 0.007, number of iterations K 10, learning rate lr 0.1, batch size m = 128, and training epoch is 100.
The trade-off curve between natural accuracy and robust accuracy is illustrated, highlighting that variance loss results in higher robustness under the same natural accuracy. We plot the curve by fix the value of y in [0.1, 0.2, 0.4, 0.6, 0.8, 1, 2, 3, 4, 5]. When the value of y is fixed, we modified the value of w for many times. For each value of 7, the corresponding experimental results of w with the best performance are selected and connected as lines, and the other experiments fig.9 TRADES+SNII exhibits more favorable trade-off than TRADES alone. Interestingly, AD, previously considered inferior to TRADES Zhang et al. (2019a), surpasses TRADES when augmented with the variance loss. The curve of TRADES is based on the original results from the paper ZZhan et al. (2019a). These findings affirm the positive impact of reducing neuron variance on adversarial robustness.
drawn scatter points. As depicted in
Decomposition of certified training Certified training methods usually directly optimize the over- approximated set (Mao et al., 2023b). However, with the variance loss and stability loss, we essentially decompose certified training into two parts: 1. improving the robustness of the worst-case output (true robustncss) by reducing neuron variance; 2. reducing avorappproiinttion (the gap between true robustness and certified robustness) by minimizing unstable neurons and neuron variance. For part 1, although the worst-case output is difficult to compute exactly, adversarial attacks find close approximations of it, making adversarial robustness good proxy for true robustness. Therefore, the experiment results adversarial robustness confirm the correlation between neuron variance and the true robustness. For part 2, we have shown that neuron variance and neuron stability are related to over-approximation in section 3
6 Conclusion
This study addresses the critical challenge of regulariaaiii in certified training of neural networks. By introducing and analyzing the novel concepts of neuron variance and neuron stability, have uncovered
12

---

Published in Transactions on Machine Learning Research (May/2024)
Trades Trades SNI AD SNR
53%
Trades
99%
Trides
SNR
50%
98%
Rolnet Are
97%
47%
96%
Robnst
95%
94%
38%
93%
35%
92%
32%
91
99.0%
99.11%
99.2%
99.3%
99.15
81% 82% 83% 81% 85% 86% 87% 88% 89%
Natural Ace
Natural
(a) MNIST
(b) CIFAR-10
Figure 9: Trade-off between natural accuracy and robust accuracy, We test on multiple hyper-parameters and draw the upper curve the points the trade-off curve. In general, comparing to TRADES, our method achieves a better trade off between robust accuracy and natural accuracy.
their significant roles in influencing the model's certified robustness. Our pioneering extension of the Signal- to-Noise Ratio (SNR) into the domain of model robustness has yielded a novel analytical perspective, leading to the development of SNR-inspired losses specifically designed to optimize neuron variance and stability. Empirical and theoretical analyses underscore the effectiveness of our SNR-based losses in improving certi- fied robustness, demonstrably outperforming existing methods on benchmark datasets such MNIST and CIFAR-10. Furthermore, our exploration into adversarial training highlights positive correlation between neuron variance and the true robustness of model. By optimizing neuron variance, superior trade-off between standard accuracy and robust accuracy compared to baseline methods.
approach achieves
One limitation of our method is the added complexity in training dynamics due to the application of stability and activation losses across multiple layers. This complexity necessitates careful balance between these new losses and the original loss functions, introcuiigg challenges in achieving optimal training outcomes. For future work, we aim delve deeper into this issue, exploring strategies to streamline the balancing process and enhance the efficacy of the training regimen.
7 Acknowledgements
This material is based upon work supported by The Boeing Company. Any opinions, findings, and conclusions or recommendations expressed this material are those of the authors and do not. necessarily reflect the views of The Bocing Company.
References
Zeyuan Allen-Zhu and Yuanzhi Li. Feature purification: How adversarial training performs robust deep learning. 2021 IEFE 62nd Annual Symposium on Foundations of Computer Science (FOCS), pp. 977 988. JEEE, 2022.
Mislav Balunović and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In 8th International Conference on Learning Representations (ICLR 2020) (virtuv)) International Conference Learning Representations, 2020.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Pratock Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. arxiv preprint Xrx:200000. 09670, 2020.
Piersilvio De Bartolomeis, Jacob Clarysse, Amartya Sanyal, and Fanny Yang. How robust accuracy suffers from certified training with convex relaxations. arxie preprint arXiv:2306.06090 2023.
13

---

Published in Transactions on Machine Learning Research May/2024)
Alessandro De Palma, Rudy Bunel, Krishnamurthy Dvijotham, M Pawan Kumar, and Robert Stanforth. Ibp regularization for verified adversarial robustness via. branch-and-bound. arviv preprint orXiu:2206. 14772, 2022.
Claudio Ferrari, Mark Niklas Muller, Nikola Jovanovic, and Martin Vechev. Complete verification via multi- neuron relaxation guided branch-and-boume bound. arXiv preprint arXi::2205.0025 2022.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXii: 2014.
Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXic: 12715, 2018.
Yu Han, Shuai Yang, Wenjing Wang, and Jiaying Liu. From design draft to real attire: Unaligned fashion image translation. In Proceedings of the 28th ACM International Conference on Multimedia, pp. 1533- 1541, 2020.
Nikola Jovanovié, Mislav Balunović, Maximilian Baader, and Martin Vechev, On the paradox of certified training. Xrxiv preprint 2Xxx:2102.06700 2021.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alex Lamb, Vikas Verma, Juho Kannala, and Yoshua Bengio. Interpolated adversarial training: Achieving robust neural networks without sacrificing too much accuracy. In Proceedings of the 12th ACM Workshop on Artificial Intelligence and Securily, pp. 95-103, 2019.
Yann LeCun, Corinna Cortes, Chris Burges, et al. Mnist handwritten digit database, 2010
Sungyoon Lee, Woojin Lee, Jinseong Park, and Jaewook Lee. Towards better understanding training cer- tifiably robust models against adversarial examples. Advances in Neural Information Processing Systems, 34:953-964, 2021.
Changliu Liu, Tomer Arnon, Christopher Lazarus, Christopher Strong, Clark Barrett, Mykel J Kochenderfer, et al. Algorithms for verifying deep neural networks. Foundations and Trendso in Optimization, 4(3-4): 244-404, 2021.
Aleksander Madry, Alcksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXic: 06083, 2017.
Yuhao Mao, Mark Niklas Müller, Mare Fischer, and Martin Vechev. Taps: Connecting certified and adver- sarial training. arXiv preprint arXiv:2305.0/ 04574,, 2023a.
Yuhao Mao, Mark Niklas Müller, Marc Fischer, and Martin Vechev. Understanding certified training with interval bound propagation. arXiv preprint 2XXi:22366.00200 2023b.
Mark Niklas Müller, Franziska Eckert, Mare Fischer, and Martin Vechev. Certified training: Small boxes are all you need. arXiv preprint ar arXiv:2210.0487. 2022.
Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John C Duchi, and Percy Liang, Understanding and mit- igating the tradeoff between robustness and accuracy. In Proceedings of the 37th International Conference on Machine Learning, pp. 7909-7919, 2020.
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. why should i trust you?" explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pp. 1135-1144, 2016.
Zhouxing Shi, Yihan Wang, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsich. Fast certified robust training with short warmup. Advances in Neural Information Processing Systems, 34:18335- 18349, 2021.
14

---

Published in Transactions on Machine Learning Research (May/202) 2024)
Gagandeep Singh, Timon Gehr, Matthew Mirman, Markus Púschel, and Martin Vechev. Fast and effective robustness certification. Advances in neural information processing systems, 31, 2018.
Hoang-Dung Tran, Neelanjana Pal, Diego Manzanas Lopez, Patrick Musau, Xiaodong Yang, Luan Viet Nguyen, Weiming Xiang, Stanley Bak, and Taylor T Johnson. Verification of piccewise deep neural networks: star set approach with zonolope pre-filter. Formal Aspects of Compuling, 33:519 545, 2021.
Kaidi Xu, Huan Zhang, Shiqi Wang, Yihan Wang, Suman Jana, Xue Lin, and Cho-Jui Hsieh. Fast and complete: Enabling complete neural network verification with rapid and massively parallel incomplete verifiers. arXiv preprint arXie:2011.1389, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theo- retically principled trade-off between robustness and accuracy. In International conference on machine learning, pp. 7472-7482. PMLR, 2019a.
Huan Zhang, Wei Weng, Pin-Yu Yu Chen, Cho-Jui Hsieh, and Luca. Daniel. Efficient neural network robust- ness certification with general activation functions. Advances in neural information processing systems, 31, 2018.
Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane Boning, and Cho- Jui Hsieh. Towards stable and efficient training of verifiably robust neural networks. arXiv preprint arXiv: (elo:190600111 2019b.
A Appendix
A.1 2 unstable neurons
In this case, we have Ox - <r + and by - < < cy +r. Without loss of generality, we assume
Gy >
Cr.
Ground truth The ground truth Y-radius Lf maxfc, + r, Cr + c. +r) (e, max(0,,c.)).
Box over-approximate the non-convex shape ReLU(B) with hyperrectangle { y) x E [0,c, r).
[0, cy +r]. The after W2 rotation Y -radiuss is: (ce + sin + (c, + r) cos = 22 (cz + + 2r).
Star representation of the Lo-norm ball
(Coy ey)
+ (r, 0) + a2 r)
(5)
1
8.1.
0'1
<
(6)
-1
022
-1
-1
(7)
After ReLU activation, the star over-approximated reachable set is
15

---

Published in Transactions on Machine Learning Research (May/2024)
(0,0) a (0,0) + +) + 1)
(8)
0
-1
0
1
0
0
-1
0
0
1000
01
s.t.
000
0
-1
022
(9)
-1
31
CD
U2
1000
-
32
U
-1
Cy
-2y/
0
1
Uyy 2
(10)
The after rotation Yraddius is B1 sin 0 + 32 cos 0, where (31, B2) must be vertex of the feasible region of Star. We enumerating all possible vertices of the feasible region and find that the after-rotation Y-radius only depends on the max of two vertices A and B's y-value, where A and B are derived from
01 + 02
01 + 022 = 1
A:
-a1
+ 02
B:
ai 02
=
(11)
u2/2 ai + 31 U
ra B1 Cz
ra2 32
Cy
Ug/2 2
02 $2
un// 12
(12)
= 0
aj = 1
A:
02 =
B
a2 0
(13)
B1 = (cz + 2
B1 Cg + r
B2 Cy +r
B2 (Gy r2
(14)
Because we assumed Gy > Cay The after rotation Y-radius is max (2) B2)
(f Gy + 3r)
A.2 1 unstable neuron
Without loss of generality, we assume 4, < 0 < and y-axis is stable. There are two cases: 1) 4, uyy < 0 and 2) 0 < ly < Uy. In the first case, all methods give the results because it degenerates to a line segment. We consider the second case.
Ground truth The ground truth Y-radius /2r.
Box over-approximates the non-convex shape ReLU(B) with a hyperrectangle {(x, v) x E 10 +r.yve (y - r, + r])- The after W. rotation Y-radius is: (cx + r) sin + 2r cos 0 22 (c, + 3r).
16

---

Published in Transactions on Machine Learning Research [May/202))
Star After ReLU activation, the star over-approximated reachable set is
(0, (gy (1, 0) + (0,r)
(15)
-1
0
-1
0
a1
1
s.t. -1
-1
0
Q2
<
1
(16)
-1
B1
1
Ca
U2
(17)
The after rotation Y-max is 31 sin + (cy + raz) cos where (51, 02) must be vertex the feasible region of Star. We enumerate all possible vertices of the feasible region and find that the after-rotation Y-max only depends on the max of two vertices:
Q1 + a2
01 + a2
= 1
01 + 02
= 1
01 02
= 1
(18)
Uy/
2 0i + B1
= uu//
ran 31 -Cr
ra2 - B2 -Cy
Uyy /2-222222 02
$2
0n/2
(19)
a1 = 0
= 1
02
02 = 0
(20)
81
(cz + r)/2
31 = C2 +
(21)
That is, ((c, + 1))/2, co +
and (cz + cy). Because Cx -r 0, the after 7/4 rotation y-max is
V2 1
3
v2 1
+ 3 )r)
( + cy + 5 + cy + +r
+ Cg
(22)
2
2 2
Similarly, the after rolation
Y-min depends on
0n + 02
an + 02
0i + a2
ai 0Q 1
(23)
U2 01 + B1
Ug/
ra $1 -c
ra2 B2
-Cy
Uyy/ / 02 + 82
= By /
(24)
on
On max 03/r
02
a2 max 03/r
(25)
Bi
max
Czi 0}
B1
(26)
That is, (max 0y, -y)) and (0, max 0}). The after a/4 rotation y-min is
V2
2 (c, r max(cz.0) 0)).
(27)
The after rotation Y-radius is
V2
V2
V2,
Ce + cy + 2²)
(c, - r max(ca,
01)
2 1, Cz + max 0})
(28)
2 2
2
2
17

---

Published in Transactions on Machine Learning Research (May/2024)
A.3 0 unstable neurons
There are two cases: 1) Or +r < 0 and by +r < 0; 2)0 c, and 0 < cy In the first case, all met give an empty set. We consider the second case.
Ground truth The ground truth Y-radius /2r.
Box over-approximate the (eLU(B) with hyperrectangle {(r, x (c, - -, +r (o -1, +r)) The after W2 rolation Y-radius 2r sin 2r cos 2/
Star has no over-approximation when there unstable neurons, therefore it has the same radius as the ground truth 2r.
18


Reviews:
[{"review_id": "BfagCfXndb", "reviewer": "Reviewer_W1rM", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n1. This paper considers neuron variance and stability that can be used to see how a network is regulated, which is interesting.\n\n2. Based on the above motivation, SNR is used to decrease the variance and increase the stability, to reach a better certified network.\n\n3. Some experiments are provided to see if the proposed idea can work in some constructed datasets.\n\n4. Experiments are solid and conducted on many models.\n\nWeaknesses:\n\n1. It would be great to add some simple theoretical analysis using a simple network, showing how the neuron variance and stability affect the certified robustness. \n\n2. In Table 2, it should be \\epsilon_{\\rm inf}", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This study addresses the challenge of over-regularization in certified training, which tends to compromise the certified robustness of models. It introduces and investigates the roles of neuron variance and neuron stability in fostering over-regularization and their effects on a model's certified robustness. Adapting the concept of Signal-to-Noise Ratio (SNR) to the domain of model robustness, the research provides a fresh perspective and devises SNR-inspired loss functions aimed at optimizing neuron variance and stability to alleviate over-regularization. Validated through both empirical and theoretical analyses, this SNR-based methodology demonstrates enhanced performance over existing approaches on the MNIST and CIFAR-10 datasets. Furthermore, the study explores the relationship between neuron variance and adversarial robustness within the context of adversarial training. This exploration identifies a positive correlation that leads to an optimized balance between standard accuracy and robust accuracy, thereby exceeding the efficacy of baseline methods.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. It would be great to add some simple theoretical analysis using a simple network, showing how the neuron variance and stability affect the certified robustness.", "broader_impact_concerns": "No concerns for this section.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "mk7aKNlxU6", "reviewer": "Reviewer_Vhde", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Pros:\n1. The paper is in general well-written and easy to follow. There are some typos and improvements I find as listed in the Minors.\n2. The paper proposes a new perspective to analyze the over-approximation problem with neuron variance and neuron stability, which is interesting and novel.\n3. The proposed regularizer could be used both in adversarial training and certified training and shows some improvements.\n\nCons:\n1. There is not enough introduction on how to get the reachable set and the definition of the radius of the reachable sets. As the most essential analytic tools for the hypothesis, it is necessary to illustrate them very clearly. \n2. The Neuron SNR loss's motivation is unclear to me to reduce the number of unstable neurons. More evidence is needed.\n3. The experiments needs a detailed analysis on the choice of $\\alpha$ and $\\beta$ especially under certification case. There are only one set of $\\alpha$ and $\\beta$ tested and it is unclear whether the proposed method could still achieve good results under different $\\alpha$ and $\\beta$. \n4. There is no ablation experiments on separating the two losses.\n5. The experiments on the adversarial robustness is weak with only comparing with two old baselines AD and TRADES. Stronger defense in the RobustBench should be considered. \n\nMinors:\n1. No axis labels in Figure 3 and 6.\n2. table 1 should be \"Table 1\" in Page 7.\n3. $x_k$ where k should be defined from 1 to m in Page 8.\n4. fi(x_0) in Page 8 should be in latex symbol.\n5. True robustness in Page 11 should be somehow defined.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes to introduce Signal-Noise-Ratio (SNR) to improve the performance of adversarial robustness and certified robustness caused by over-approximation problem . Specifically, the paper first starts with analyzing the neuron variance and neuron stability to find their correlation with over-approximation. Through a case study with numerical analysis, it finds the reachable sets is sensitive to the change of the neuron status but the exact reachable set is insensitive. It also tries to theoretically analyze the radius of the reachable sets with a two layer neural networks. Inspired by the findings, the paper then proposes layer SNR loss to penalize the neuron variance and Neuron SNR to reduce the number of unstable neurons. Experiments conducted in MNIST and CIFAR10 both on certified training and adversarial training shows the proposed method could achieve a better robustness than other baselines.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please see the Cons and Minors. In sum,\n1. Definition and more introduction on the reachable sets.\n2. Evidence on Neuron SNR loss to reduce # of unstable neurons.\n3. Experiments on different $\\alpha$ and $\\beta$.\n4. Stronger baselines in adversarial training setting.", "broader_impact_concerns": "No ethic concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "pFZ6kFp8ts", "reviewer": "Reviewer_kTim", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n\nThe paper builds a connection between neuron stability and tightness of adversarial robustness certification approaches with interesting empirical evidence. \n\nThe paper writing is good-quality in general.\n\n\nWeaknesses:\n\nThe major weakness is that the proposed SNR loss is not quite effective at improving cerfitied accuracy according to Table 2. For instance, SNR is better than SABR with a margin of 0.15% when $\\epsilon$=2/255 and 0.3% when $\\epsilon$=8/255. This weakness is the reason why I choose No in the Claims and Evidence section. \n\nFrom Fig. 8, it is hard to see the correlation between adversarial robustness and Layer SNR.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper investigates the impact of neuron stability on cerfitied adversarial robustness. The connection between neuron stability and tightness of approximation bound of several cerfitication methods is first empirically studied and then analyzed mathematically. The Signal-to-Noise Ratio (SNR) loss is proposed to induce more neuron stability and improve cerfitied adversarial robustness. The experiment on MNIST and CIFAR10 is shown to validate the effectiveness of the proposed SNR loss.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "From Fig. 8, it is hard to see the correlation between adversarial robustness and Layer SNR. Please give a quantitative result to show this correlation.", "broader_impact_concerns": "Not applicable.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper studied certified robustness and proposed a signal-to-noise ratio loss to improve this robustness. It has nice results both theoretical and empirical. After the rebuttal, two reviewers voted for acceptance and one for rejection --- the rejection argument was as follows:
> (recommendation) The effectiveness of the proposed method is not supported by the empirical evidence

> (review) The major weakness is that the proposed SNR loss is not quite effective at improving cerfitied accuracy according to Table 2. For instance, SNR is better than SABR with a margin of 0.15% when $\epsilon$=2/255 and 0.3% when $\epsilon$=8/255. This weakness is the reason why I choose No in the Claims and Evidence section.

However, I think it is fine, since certified robustness is much harder than empirical robustness, as the authors pointed out in their rebuttal. Even if the improvements look minor to some researchers, some other researchers may find this paper interesting and useful. Therefore, I would like to accept this submission.

One point I want to mention is that your abstract is really too short! It explains the title --- nothing more than that. A good abstract should have both the motivation part and the contribution part, so please consider to add the motivation part for your abstract.
Decision: Accept (poster)