On Using Certified Training towards Empirical Robustness
Authors: Alessandro De Palma
Serge Durand
Zakaria Chihani
François Terrier
Caterina Urban
Venue: Accepted by TMLR ()

Abstract: Adversarial training is arguably the most popular way to provide empirical robustness against specific adversarial examples. While variants based on multi-step attacks incur significant computational overhead, single-step variants are vulnerable to a failure mode known as catastrophic overfitting, which hinders their practical utility for large perturbations. A parallel line of work, certified training, has focused on producing networks amenable to formal guarantees of robustness against any possible attack. However, the wide gap between the best-performing empirical and certified defenses has severely limited the applicability of the latter. Inspired by recent developments in certified training, which rely on a combination of adversarial attacks with network over-approximations, and by the connections between local linearity and catastrophic overfitting, we present experimental evidence on the practical utility and limitations of using certified training towards empirical robustness. We show that, when tuned for the purpose, a recent certified training algorithm can prevent catastrophic overfitting on single-step attacks, and that it can bridge the gap to multi-step baselines under appropriate experimental settings. Finally, we present a conceptually simple regularizer for network over-approximations that can achieve similar effects while markedly reducing runtime.

Zakaria Chihani Published in Transactions on Machine Learning Research (03/2025)
On Using Certified Training towards Empirical Robustness
Alessandro De Palma'
Inria, Ecole Normale Supérieure, PSL University, CNRS
Serge Durand
serge.durand@@nria..
Inria, École Normale Supérieure, PSL University, CNRS Université Paris-Saclay, CEA, List
sakaria.chthariecc..f
Université Paris-Saclay, CEA, List
François Terrier
Truncois.terrierfer
Université ParrisSSclay, CEA, List
Caterina Urban
caterina, wrrii@irrorbn
Inria, École Normale Supérieure, PSL University, CNRS
Reviewed on OpenReview; https:: // openrvieew...e....momeeeee net/ formm//rmmmm id= VaaT2fI9DC
Abstract
Adversarial training is arguably the most popular way to provide empirical robustness against specific adversarial examples. While variants based on multi-step attacks incur significant computational overhead, single-step variants vulnerable to failure mode known catastrophic overfitting, which hinders their practical utility for large pertur- bations. A parallel line of work, certified training, has focused on producing nelworks amenable to formal guarantees of robustness against any possible attack. However, the wide gap between the best-performing empirical and certified defenses has severely limited the applicability of the latter. Inspired by recent developments in certified training, which rely on a combination of adversarial attacks with network over-approximations and by the connections between local linearity and catastrophic overfitting, we present experimental evidence on the practical utility and limitations of using certified training towards empirical robustness. We show that, when tuned for the purpose, recent certified training algorithm can prevent catastrophic overfitting on single-step attacks, and that it can bridge the gap to multi-step baselines under appropriate experimental settings. Finally, we present a conceptually simple regularizer for network over- pee-aappoxxmaaions that can achieve similar effects while markedly roducing runtime.
Introduction
Goodfellow et al. 2015 semantic invariant perturbations that induce high-confidencee misclassifications in neural networks, has led to the development of a variety of adversarial attacks Aioossavi-eezfooll et al.] 2016 Carlini & Wagner 2017) and empirical defenses (Papernot et al.) 2016 Cisse et al.) 2017 Tramèr et al. 2018). Adversarial training (Madry et al. 2018) is undeniably the most successtul empirical defense, owing to its efficacy and conceptual simplicity. Employing robust optimization perspective, Madry el al.
The discovery of adversarial examples [Biggio et al. 2013 Szegedy et al. 2014
(2018) train using the loss
incurred at the point returned by a multi-step attack, named PGD. The large cost of
adversarial training ushered in the development loss expensive techniques (Shafahi et al. 2019 However, single-
step alfacks (Goodellow et al., 2015), were shown to suffer from a phenomenon known as Catastrophic
"Equal contribution.

---

Published in Transactions on Machine Learning Research (03/2025)
Overfitting (CO) (Wong et al. 2020 under which they display vulnerability to multi-step attacks whilst preserving strong robustness to single-step attacks. It was shown that CO can be miligated at no additional cost through strong noise (de Jorge et al. 2022) for smaller perturbations, yet stronger attack models require the addition of explicit regularizers based on local lincarity (Andrinshchenko & Flammarion 2020 Rocamora
et al. 2024). Indeed, strong links between lack of local linearity and CO exist (Orliz-Jimenez et al. 2023
While empirical robustness strong attack suites Croce& & Hein 2020 understood to be sufficient for many practical use-cases, network could still be vulnerable to stronger and unseen attacks, casting doubts over its suitability for safety-critical contexts. In light of this, a variety of techniques to formally verify network robustness have been designed (Katz et al. 2017: Bunel et al. 2018 Ehlers 2017: Tjeng et al. 2019 Lomuscio
suitesCroce
& Maganti 2017). In spite of significant improvements over the last years (Bunel et al. 2020b; Wang et al. 2021 Ferrari et al., 2022), neural network verification techniques still face significant scaling challenges. As a result, a series of works have devised so-called certified training schemes, which produce networks more amenable formal verification by enforcing small network vver-approximations (Gowal et al.) 2018 Mirman et al. 2018 Zhang et. al.
2018 Xu et. al.] 2020). Remarkably, a particularly inexpensive aperappproiinttinn based on Interval Bound Propagation (IBP) has emerged as crucial technique in the
2020
Wong & Kolter
2024b). Indeed, the current statc-of-the-art in certified training relies on a combination of adversarial attacks and IBP, greatly improving performance over a variety of Mao et al. 2023). Some of these techniques were formalized into the notion of
area (Jovanović et al.
2022
Mao et al.
settings (Miller et al. 2023
expressive losses, capable of interpolating between attacks and over-approximation De Palma et al. 2024b).
On popular vision benchmarks, there is often a wide gap between the best-reported empirical robustness across networks and adversarial training algorithms, and the best-reported certified robustness across certified training schemes (Croce & Hein 2020; Jovanović et al. 2022 De Palma et al. 2024b). As result, the latter are typically understood to improve verifiability at the expense of empirical robustness. Intrigued by the versatility of recent certified training algorithms and by the links between local linearity and small network over-approximations, we present a comprchensive empirical study on the applicability of recent certified training techniques towards empirical robustness, leading to the following contributions:
We systematically show for the first time that, when explicitly tuned for the purpose, a multiplicative expressive loss named Exp-IBP (De Palma al. 2024b) can effectively prevent CO on sctups common in the single-step adversarial training literature ($5.1) p.. Under limited subset of these settings, can match or overcome the performance of some multi-step adversarial training baselines (PGD-5) while exclusively relying on single-step attacks and enforcing large verifiability.
We show that the relative empirical robustness of Exp-IBP improves on shallower networks and longer training schedules, demonstrating that pure IBP outperforms a strong multi-step adversarial training bascline (PGD-10) for large perturbation radii on CIFAR-10 (55.2).
We present conceptually simple proxy for the IBP loss, named ForwAbs, which can be computed at the cost of a single network evaluation (33.3). When used as regularizer, Forw prevent CO and improve the robustness of single-step attacks while significantly reducing overhead compared to expressive losses.
We believe our work demonstrates both the potential and the limitations of using current certified training techniques towards empirical robustness, paving the way for further developments in this direction. Code is available at httpp///tthhcccooeggeeaaaaaaffet
2 Background
We will use the following notations: a for a scalar, A for sets, A for matrices, x for a vector and x; for its i-th component. We will furthermore use [[o, b] for integer ranges, while denoting by min, f (ax) the vector given by the entry-wise minimization over the vector function f, by Proj(z, A) the Euclidean projection of x onto A, and by |A| the entry-wise absolute value of A. Finally, 1 stands for vector whose entries are all 1.
2

---

Published in Transactions on Machine Learning Research (03/2025)
2.1 Adversarial Robustness
Let fo : - R be neural network parameterized by 0. Given an input Rd and a label y E [[0, l: 1] from a k-way classification dataset (x. D, fo is said to be locally robust on if, given a set of allowed perturbations C(x) _ RR:
x' E C(x) arg max fo(x'); = y.
(1)
In other words, the network is robust if the predicted label for æ is invariant to perturbations in C(x). In the following, we will focus on lo balls of radius C(x) = (x) == {æ': || - = S E)
Given a surrogate loss & for classification, typically cross-entropy, the problem of training a network satisfying equation 1 for all (2r,)) v) ~ D, fo can be formulated as a robust optimization problem (Madry el al. 2018
min 0
E (EDD)ED
('o,, : where (' = max [(fo(x'),)) x'EB.(
Computing the worst-case loss (fo, (x)::)) exactly is not feasible training time as, owing to the non- lincarity of the network activations, it involves computing the global optimum of non-concave optimization problem. In the case of piecewise-linear networks, this was shown to be NP-complete (Katz et. al. 2017). The worst-case loss is hence commonly replaced by different approximations depending on the training goal.
2.2 Training for Empirical Robustness: Adversarial Training
Adversarial attacks are hcuristic algorithms, typically basod on gradient-basod local maximization MMaryy jet al. 2018) or random search (Andriushchenko el al., 2020), that provide lower bounds to L (Jo, B, (x): Let us denote by Lndv,A the output of running an attack A on fo for the perturbation set B,(x). A network is deemed to be empirically robust to A for (æz, y) if arg max, (a = y. When training for empirical is replaced by the so-called adversarial loss:
robustness, L
Ladv (x)) = ((fae
which is a lower bound to L algorithms employs the PGD attack Madry et al. 2018) at training time. Starting from random uniform input in (æ),, PGD iteratively steps using the sign of the network imput gradient sign projecting back to (x) after every iteration. Owing to the large cost of training with multi-step PGD, a series of works have focused on designing elfective single-step allernatives (Shafahi et al. 2019 Wong el al. 2020 de Jorge et al. 2022). Among them is FGSM (Goodfellow al. 2015). which systematically lands on a corner of the perturbation space: FGSM x + sign ((f((f((z)) (x), y)). FGSM was shown suffer from failure mode known as catastrophic overfitting (Wong al. 2020) under which the network's robustness to PGD attacks rapidly drops to = 0%. Wong et al. 2020 empirically demonstrate that catastrophic overfitting can be prevented at moderate e values if using a random uniform input in B, (x) as a FGSM starting point and increasing the step size from = to 17 = 1.25c (RS-FGSM). de Jorge et al. (022) propose to sample uniformly from a larger set than the target model (typically, (x)), using a step size of 17 = e, and by removing RS-FGSM's projection onto (x()) after the step. The resulting attack, named N-FGSM, attains non-negligible PGD robustness at larger e without incurring any additional cost with respect to RS-FGSM, and acts implicit loss regularization (de Jorge et al. 2022). Nevertheless, explicit regularizers, often enforcing local linearity (Andriushchenko & Flammarion 2020 Rocamora et al. 2024 are needed to further mitigate CO against stronger attacks.
One of the most popular and effective adversarial training
v)),
2.3 Training for Verified Robustness: Certified Training
As described in 2.2 the notion of empirical robustness is specific to a given attack A. However, fo ( = y does not nccessarily imply that equation ① holds, as the network may still be vulner- able to more effective or unseen attack A'. Formal verification provides stronger, attack-independent, notion of robustness. A network fo is said to be certifiably robust for (æ,y) if and only if the difference
3

---

Published in Transactions on Machine Learning Research (03/2025)
between the ground truth logit fo(2)) and the other logits is positive for all x' B.(x):
min
B. fo
(x).v) min (.)
2 y) = (fo(x') fo(2')1 0.
(2)
Assuming the use of loss function & that is translation invariant with respect to the network output (Wong L
et al. 2020 such as cross-entropy, then B,, Bl is computationally infeasible. However,
= fu 2,(2)) .9) As for L (.
(see 2.1 computing the exact optimal logit differences = B. (m).y)
given lower bounds 3fo S jo (x).,y the optimal logit differences, we can conclude that fo is certifiably
robust if min: 22 ( 0. We will henceforth call a NN verifier any method to compute the above lower bounds. Given an efficient verifier, and assuming that the loss is monotonically increasing for all the network outputs except the one associated with the ground truth, networks can be trained for certified robustness by using the loss induced by the lower bounds to the logit differences (Wong & Kolter 2018 Zhang et al. 2020), which upper bounds the worst-case loss:
Lver (e())))) = C (-22/0 B,(a),9 v) Cr (fe,
(3)
Networks trained via Lver (fo. (z)::)) y) feature tight Z (2) lower bounds by design. We will focus on the least expensive bounding algorithm: IBP (Mirman et al.) 2018; Gowal et al., 2018). When used for training, IBP outperforms tighter relaxations as it results in better- behaved loss functions (Jovanović et al. 2022).
2.3.1 IBP
IBP is a method to over-approximate neural network outputs based on the application of interval arith- metics (Sunaga 1958 Moore 1966) onto the functions composing the neural architecture. As such, it be easily applied onto general computational graphs (Xu et al. 2020 For case of presentation, let assume that fo is n-layer feed-forward neural network, with layer J E [1,
- 1] composed of an affine operation followed by a monotonically increasing element-wise activation function a such as ReLU, w a (W' + b'), and a final affine layer: fe = (W"*x-1 + b²). In this case, we can compose the logit differences and the last layer into single affine layer: zyo (a. (W"x==1 + b*). Then, for perturbation (.(x)) through the following procedure, which iteratively derives lower and upper
(x(),, IBP computes zfo
bounds i and a² to the outputs of the k-th affinc layer:
(=).v
1 W (i- +
am-1) 10-1+am-1)
- - 1 (a--1 (an-1-pa-1) + +ba, where:
1 + 6a à W W''0 + W 1 b
i W x00 - |W1
2 fo
i = o
1 + o ( (w-1)) - [|3i @ (w--1)- 1--1--0 - - (i [1=11)
+ bj
V j E [2, n 1]
à } w'
o i
(i--)) + [lm]
a ( ()
i + b,
We will henceforth write 10. (a)) for the lower bounds to the logit differences obtained through equation and (I (z): = L 1 (a())))) v) for the associated loss.
(-
fo
2.3.2 Hybrid Methods
A network trained via the IBP loss bounds employed for training. However, the relative looseness of the over-approximation from equation (4) results in a significant decrease in standard performance. For ReLU networks, which are the main focus of this work, the availability of more effective verifiers based on branch-and-bound (Henriksen & Lomuscio, 2021 Wang et al. 2021, Ferrari et al.) 2022) post-training has motivated the development of alternative techniques. A scries of mothods have shown that combination of adversarial training with network over- approximations (Balunovic & Vechev 2020 Fan & Li. [2021] De Palma et al., 2022) Mao et al. 2023) can yield strong verifiability via branch-and-bound while reducing the impact on standard performance. Tn
(x)):)) can be casily verified to be robust using the same
4

---

Published in Transactions on Machine Learning Research (03/2025)
particular, Müller et al. (2023) proposed to compute the IBP loss over tunable subset of (x)z) containing adversarial examples, yielding favorable trade-offs bet standard performance and certified robustness via sawech-anddboudd-bbeee
methods. [e Palma et al. (024b)) introduced the notion of loss expressivity, defined as the ability of a loss function to spawn a continuous range of tradc-offs between the adversarial and the IBP losses, showing that expressive losses obtained through convex combinations between an adversarial and an over-approximation component lead to state-of-the-art certified robustness.
While past work in certified training has designed and deployed these algorithms to maximize certified robustness, empirical robustness through strong attacks (Croce & Hein 2020) remains the most adopted metric owing to the lack of scalability and to the looseness of network verifiers. Noting the potential versatility of recent hybrid certified training schemes, this work systematically investigates whether they can be employed towards improving empirical robustness.
3 Certified Training for Empirical Robustness
Recent certified training techniques (2..22 have demonstrated that the ability to precisely control the tight- ness of network aver-approx while preserving an adversarial training component crucial maxi- mize certified robustness across experimental sctups. We hypothesize that this versatility can be alternatively leveraged Lowards improving the empirical robustness of the adversarial training schemes on top of which they are applied, providing experimental evidence in {5] This section details the certified training algorithms employed in the experimental study. We begin with a motivating example ($3.1), then study the qualitative behavior of existing methods in settings of interest ($3.2). and conclude by presenting a conceptually simple regularizer designed to mimic the effect of IBP-based training while reducing the associated overhead (333
3.1 Motivating Example
In order to motivate our empirical study, we show that multi-stop attacks, which typically cxhibit superior ro- bustness at the expense of training time, are associated to measured by the IBP loss. Figure 1 which is associated to the experimen- tal setup from table L shows that the IBP loss indeed de- creases with the number of attack steps. Furthermore, it shows two distinct qualitative trends: for N-FGSM, which is prone to CO (causing the large experimental variabil- ity), the IBP loss increases with the perturbation radius. On the other hand, LIEr-fo: Be())))) decreases with for PGD-5 and PGD-10. Indeed, multi-step attacks yield networks that are more locally linear compared to single-
smaller network aperappproximttions,
10f
18
N-FGSM PCD-5
PGD 10
Epslion
IBP loss of adversarial training schemes on CIFAR-10, setup from table
Figure 1:
step attacks (Andriushchenko & Flammarion 2020: Rocamora et al. 2024
Ortiz-Jimenez et al. 2023), which
in turn results in lighter 250
B.w)).y bounds and hence smaller network over-approxinationn. In this work, we B, (w).y via certified training can benefit empirical robustness. investigate whether directly controlling Zfo
3.2 Expressive Losses
For a fixed verifier and attack algorithm, an expressive loss (af, y) can interpolate from the adversar- ial loss Ladv (fo; (x);;)) y) to the worst-case loss over-approximation Lver (fo, (x():: y) by continuously increas- ing a parameter a, the ever-apprxxination coefficient, from 0 to 1. Formally (De Palma et al. 2024b Defi- iition 3.1), assuming that IBP is the verifier of choice: (a B, (x):v) is monotonically increasing and con- tinuous with respect to a, Lo(fe. (x))))) = (fe, v. C Ci (x)))) = CIBP (fe. (x)).), and:
Ladv (fo, v) S L. (fe. < CIBe (fa. (x)):)) V [0.
As shown by De Palma et al. (024bb expressive losses include SABR Mulller et al. 2023) and three loss functions defined through convex combinations: CC-IBP, MTL--IPP and Exp-IBP. We found MTL.-BP,
5

---

Published in Transactions on Machine Learning Research (03/2025)
100 Accorsyy& 9G20 Arr
0.5
MTL-IIP
10
Exp
N-FGSM..
1011
0.3
MTL-1BP
Exp-1BP
0.2
N-GGMM
0.1
10'
10
20
25
30
Epochs
Epochs
(a) Certified accuracy via IBP bounds (solid lines), empirical accuracy under PGD-7 attacks (dashed).
(b) IBP loss.
Figure 2: IBP certified robustness attained by MTL-IBP and Exp-IBP on the PreActResNet18 training setup from de Jorge et al. (2022). Validation results on CIFAR-10 under perturbations of e 8/235.
CC-IBP and SABR to display similar behaviors in the scttings of interest: we refer the interested reader to appendix A for additional details. For simplicity and brevily, we will hence locus on MTL-IBP and ExP-IBPPi the remainder of this work. The former consists of convex combination of the adversarial and IBP losses. Exp-IBP, instead, performs the loss convex combination in logarithmic space.
Definition 3.1 The MTL-IBP and Erp-IBP losses are defined as follows:
CMTL-IBP (fo. (x)): = (1 a) (fo (x): + aLIBp(fo. (.)): LIBP(fo Eap-IBP (fa, (x): = Lado B, (x); Cre (. (x); La
a
(5)
Expressive losses for certified robustness In order to maximize certified accuracy (defined as the share of inputs verified to be robust) and stabilize training, previous work (Müller et al. 2023 De Palma et al.,
2024b) deployed the losses in equation (5) under specific set. of conditions. First, shal Thalloww low architectures.
2023 De Palma et al. such as the popular 7-layer CNN-7 (Shi et al. 2021 Müller et al. 2023 Mao et al.
2024b) (see appendix), which, aided by specialized initialization and regularization (Shi et al. 2021). contain the growth of the IBP bounds over consecutive layers. Second, relatively long training schedules featuring gradient clipping, a warm-up phase of standard training, and a ramp-up phase during which the perturbation radius used to compute both the attack and the IBP bounds gradually increased from to the target value
(x)x) on the logit differences. 6. Finally, relatively large values of to reduce the magnitude of the bounds zfo In this context, all the expressive losses from equation (5) display a similar qualitative behavior, attaining roughly the same certified robustness (De Palma et al. 2024b).
Qualitative differences in adversarial training setups In adversarial training, overhead is often major concern (Shafahi et al. 2019). Indeed, works on single-step adversarial training typically rely on deeper networks and shorter training schedules to maximize empirical robustness while minimizing runtimes. A common sctting, which we reproduce $5.1 because of prevalence in the catastrophic overfitting literature, involves PreactResNet18 (He et al. 2016) trained with a cyclic learning rale and without any
gradient clipping, ramp-up (except SVHN) nor warm-up (Andriushchenko & Flammarion
2020 Wong
et al.
2020 de Jorge et al.
2022
Owing to the exploding IBP loss at initialization (see appendix
D.6 and
MTL-IBP
MTL--EP
NTL-IPP
10
10a
10"
ISP
10a
104
10"
Loss
10
10
166
100
(a) 18 layers; OMTL IBP
10
(b) 18 layers; OBT 10
(c) layers; OMTL IBP = x 10-2
Figure 3: Sensitivity of the expressive losses toy network of varying depth, with dExp-IBP =

---

Published in Transactions on Machine Learning Research (03/2025)
to the specific training hyper-parameters, pure IBP training is not directly applicable this setup. In order to study the behavior of expressive losses in this context, we tuned MTT-IBP and Exp-IBP to maximize IBP-based verifiability on CLFAR-10 under perturbations of radius e = #/255, using N-FGSM to generate Aadv.A- Figure 2 shows that MTL-IBP is unable to attain non-negligible certified accuracy via IBP in this context. On the other hand, Exp-IBP reaches almost 20% IBP certified accuracy, highlighting a significant qualitative difference in behavior. In order to gain further insight on this, we plot the sensitivity of the two expressive losses on two toy networks where the magnitude of the IBP bounds is controlled through scalar parameter w (see appendix [.I]. Figure 3 shows that on the deeper network the MTL-IBP loss either flattens onto Cadv(fo (z)): y) at large IBP loss values (small a), or explodes with the IBP bounds, resulting in unstable training behavior (larger a). On the other hand, Exp-IBP can tuned so as to be able to drive (Jn Be (ar); y) to very small values without exploding at larger w values. On the shallow network, instead, for which the IBP bounds are significantly smaller, MTL-IBP can be tuned to display roughly the same behavior as Exp-IBP for smaller LIB (fo. (x)): y) without taking overly large loss values within the considered parameter range. We believe this explains their homogeneous behavior in training selups designed to prevent large IBP bounds, such as those typically employed in the certified training literature.
Maximizing empirical accuracy As seen in figure 2 expressive losses can pay large price in empirical accuracy compared to a = 0 (pure N-FGSM, in this case) when a tuned to tighten the IBP bounds. One may hence conclude that certified robustness is at odds with empirical accuracy. In section S we instead show that, when a is tuned for the purpose, expressive losses can result in increased empirical robustness.
3.3 ForwAbs
(.).)))))) using the procedure in equation (4), whose Expressive losses require the computation of IBP bounds 50 cost roughly corresponds to two network evaluations (also called forward passes): one using the original network, the other employing the absolute value of the network weights. This overhead on top of adversarial training is negligible only when Fadv,A are computed via multi-step attacks. We here study less expensive yet conceptually simple ways to control the IBP bounds when single-step attacks are instead employed.
The gap between the lower and upper bounds after the k-th affine layer, which we denote by 5k : -â* - i²), can be employed as a measure of the tightness of the IBP bounds Shi et al. 2021 For ReLU networks, 5² can be upper bound by |W (ora"\))) a(ix-1).. This up- per bound coincides with 5* in the case of Deep Linear Networks (DLNs), for which a(a) = a, or if the ReLUs are passing (i* 2 0). We propose to employ 8", which we define as the (looser) upper bound
>
1014
220
1072
200
101
180
1.0
4, R.g.
10*
N FMMM
140
101
120
100
8" obtained through repeated use of the |8 bound, as regularizer for the IBP loss. The 5" term can be computed at the cost of single forward pass through an auxiliary network with (a)) = a where each affine layer (a) = W + b is replaced by (*)a)) = |W|t.. We call the resulting method ForwAbs (Forward pass in Absolute value).
30
15
ForwAbs
FGSM
Rog.
Epocis
Figure 4: IBP loss over epochs (left), box plots (10 runs) for the training time of an epoch (right), setup as figure 2
Definition 3.2 The ForwAbs loss lakes the following form:
C CoorwAeee (foabbbeofff B.,, (x)) = Lode (o. (z)):) +x
(6)
where: 8 8 2c W 8 1 k E [2
In order to demonstrate the empirical correlation between the ForwAbs term 8" and the IBP bounds (., figure presents the results of a ForwAbs-trained network, where the À coefficient is tuned minimize the IBP bounds in the same setup figure 2 In spite of its simplicity and of its significantly
fo

---

Published in Transactions on Machine Learning Research (03/2025)
smaller runtime overhead, ForwAbs can drive the IBP loss to roughly the same values attained by MTL-IBP. Furthermore, the final LIBr(fo, (x))) y) attained by FbrwAbs is significantly lower than those associated to N-FGSM. Strong & regularization over the weights (with regularization coefficient λe_ = 0.04) fails to achieve a comparable effect, denonstrating that the behavior of ForwAbs is not merely a consequence of small 4 norms of the network weights.
4 Related Work
We here provide an overview of closely-related work across certified and adversarial training.
4.1 Neural Network Verification and Certified Training
As outlined in 22.3 a neural network verifier computes lower bounds to the worst-case logit differences (.(()).) Given its contrality to statc-of-the-art cortified training schomes (32.3.), we have focused on the inexpensive IBP algorithm (f2.3.1. However, a significant number of veriliers exist, for which tighter lower bounds are typically associated with larger overhead. One line of work, inspired by abstract inter-
fo
pretation Coousot & Cousot 1977) builds abstract domains over-approximating the neural network (Singh)
et al.
2018 2019b). Lower bounds can be also obtained by solving linear programs replacing network non-
linearities ies with convex relaxations (Ehlers 2017 Anderson et al., 2020 Tjandraatmadja et al.
2020:
Singh
et al.
2019a potentially through dual formulations (Wong & Kolter 2018 Dvijotham et al.
2018 Bunel
el al. 2020a De Palma et al. 2021 2024a). Allernatively, a series of fast verifiers relies on back- baack-rrpaggting
linear bounds through the network (Zhang et al. 2018 Xu et al.) 2021 Wang et al. 2021). Tight bounds
can be plugged in within a branch-and-bound framework (Bunel et al.) 2018 2020b) to yield verifier that
solve the verification problem in equation (2) exactly for piece-wise linear networks, with stale-of-the-art
complete verifiers often relying on a combination of linear bound propagation with dual bounds (Ferrari
et al. 2022; Zhang et al.] 2022b). Earlier certified training schemes (Gowal et al.) 2018 Wong & Kolter
2018 Zhang et al. 2020 Mirman et al. 2018 Shi et al.) 2021) typically rely on lincar bound propagation
or IBP to create a loss function for certified training using equation (3). (Boopathy et al. 2021] present
SingleProp: a regularizer which, computed at the cost of a single network evaluation and applied on top of the clean network loss, trades certified robustness for computational efficiency. As described in $2..22 many
later schemes combine IBP bounds from equation (4) with adversarial training, attaining better certified ro- bustness when using branch-and-boune post-training. We here rely on expressive losses ($3.2) owing to their versatility and satte-of-the-art performance, and on ForwAbs (#3.3), conceptually-simmplr alternative to SingleProp which we add on adversarial losses to enhance empirical robustness. Finally, while we focus on Exo certified training schemes applicable to ReLU networks and based deterministic lower bounds to 2B. (x),y
alternative techniques include randomized methods (Cohen et al. 2019). Lipschitz regularization (Huang
et al. 2021) and ad-hoc architectures (Xu et al. 2022 Zhang et al. 2022a.
4.2
Adversarial Training and Catastrophic Overfitting
For simplicity, this work focuses on the widely popular multi-step PGD training (Madry et al. 2018).
Nevertheless, multiple variants have been designed to improve its performance (Zhang et al. 2019 Wang
et al. 2019 Liu et al.) 2021 Xu et al., (023). Multi-step PGD is coupled with random search within AutoAttack Crooe & Hein 2020), a strong attack suite that has become the standard way to reliably evaluate empirical robustness. It was noted that adversarial training is prone to overfitting with respect to empirical robustness, a phenomenon known as robust overfitting (Rice et al., 2020), with specialized remedies including smoothing methods (Chen et al. 2020) and techniques linked to gameetheoreeical interpretation of the phenomenon |Wang et al. 2024). In this work, are rather concerned with catastrophic overfitting, thoroughly-studicd (Vivek & Babu 2020 Park & Loe 2021 Li et al. 2022 Tsiligkaridis & Roberts 2022)
failure mode associated with one-step adversarial training, and w which can be reduced without any additional cost by the appropriate addition of noise to the attacks (Wong et al. 2020 de Jorge et al. 2022
y see
[2.1] Other techniques include explicit regularizers on the loss smoothness (Sriramanan et al. 2020 2021).
dynamically varying the attack step size (Kim al. (2021), or selectively zeroing some coordinates of the attack step (Golgooni et al. 2023): : these are all outperformed by the noise-based N-FGSM (de Jorge et al.
8

---

Published in Transactions on Machine Learning Research (03/2025)
Regrettably, even N-FGSM suffer from catastrophic overfitting at larger perturbation radii. Better robustness at large albeit at additional cost, can be obtained by promoting the local linearity of the network, which is closely-linked with catastrophic overfitting (Ortiz-Jimenez et al. 2023 GradAlign (Andriushchenko & Flammarion 2020) aligns the input gradients of clean and randomly perturbed samples, ELLE (Rocamora et al. 2024) by enforcing a simple condition on two random samples from the perturbation set and their convex combination. Recent alternatives to attain large-c robustness include hindering the generation of adversarial examples with a larger loss than the clean input (Lin et al., 2023), or the use of adaptive weight perturbations ŞLin et al. 2024). In section 5.1 we systematically investigate, to the best of our knowledge for the first time, whether catastrophic overfitting on settings from the above literature can be instead mitigated through certified training techniques.
2022
4.3 Empirical Robustness of Certified Training
Previous works have reported, explicitly or implicitly, on the empirical robustness of certified training schemes deployed to maximize certified robustness. Except for De Bartolomeis et al. (2023), whose main conclusions focus on the inferior empirical robustness of the certified training schemes they considered compared to a multi-stop bascline, complying with the folklore in the area, empirical robustness was not the main focus of these works.
Gowal et al. (0118) showed that IBP can attain larger empirical robustness than adversarial training baselines relatively shallow networks for MNIST with e {0.3, and for CIFAR-10 10 with 5/255 when using long training schedules. In contrast with their main claims, similar results, albeit using inconsistent training schedules and optimizers across methods, are presented in De Bartolomeis et al. [2023 appendix B). A very recent work (Mao et al. 2024a) reports further analogous results, showing that a series of certified train- ing schemes tuned to maximize certified accuracy outperform multi-step PGD on MNIST with e = 0.3 and CIFAR-10 with c = 8/2ss. Nevertheless, given the gap between the best empirical and certified defenses across various setups (Croce & Hein 2020: Jovanović et al., 2022 De Palma et al. 2024b), certified training schemes are commonly understood to be at odds with empirical accuracy. Expanding on the above results and com- plementing 1..1 section 5.2 studies whether techniques from [3] when explicitly tuned for the purpose, can improve empirical robustness compared to multi-step PGD on larger perturbation radii, different datascts, and shorter training schedules. Detailed comments on the relationship between the results in $5.2 and those
from Gowal et al. (2018): : De Bartolomeis et al. 2023 Mao et al. (024a are provided in appendix E
Literature results offer partial insights into the relationship between CO and cortified training schemes. First, pure IBP (a = 1 in equation (5), which lacks any adversarial training component, is trivially immune to CO. However, it is not applicable to all training setups (see 43.2) and typically reduces robustness compared to lower values (see (2.3.2), on which we hence focus. Second, the results from De Palma et al. (2024b), which tune expressive losses for branch-and-
certified robustness, do not display CO on benchmarks from the certified training literature. This is in spite of the fact that they mainly compute Laav(fo. B, (a)): via a weak one-step attack, a modified RS-FGSM with 77 2 2e, that was shown to display CO on CIFAR-10 with e = 8/255 on a different network and training schedule (Wong & Kolter 2018 appendix C). As reported in De Palma et al.] (2024b) appendix G.9), where performance is shown to be relatively unchanged under a more effective one-step attack (standard RS-FGSM), these results point to the lack of CO for the employed setups. Nevertheless, it is unclear from the original experiments whether = 0 would display CO for those experimental settings and, hence, whether expressive losses prevent it. In 15.1 we systematically invest igate CO on settings popular in the relevant single-step adversarial training literature: deeper networks, different underlying attacks and datascts, shorter training schedules, and larger perturbation radii. Appendix E com- plements this by presenting a study on the occurrence and prevention of CO within setups from De Palma et al. (2024)). Furthermore, we show that the empirical robustness of trained models from the literature compares negatively with the results in 5522 highlighting the importance of tuning a for empirical robustness.
5 Experimental Study
We now present the results of our experimental study on the utility of certified training schemes towards empirical robustness. Appendices B to D report omitted details and supplementary experiments.
9

---

Published in Transactions on Machine Learning Research (03/2025)
0.15
A.Acc s accrna
Exp4IPP
0.3
Exp BP
0.30
Farwilbs
NTL-0P
WTL
0.00
6.1
0.0
0.00
Epochs
Epocts
(a) AutoAttack (solid) and IBP (dashed) acc.,
(b) AutoAttack (solid) and IBP (dashed) acc.,
6
8/255.
6
24/250.
3017
10
Exp-15P
10.0
1914
10.4
1104
MIL-BP
18P
TorwAbs
FEOM
10a
10a
10
20
25
39
10
15
20
25
30
Epocts
Epochs
(c) IBP loss for 8/255.
(d) TRP loss for 24/255.
Figure 5: The use of certified training techniques on top of FGSM can prevent CO for PreActResNet18 on the CIFAR-10 test set under perturbations of 8/255 and 24/255.
5.1
Preventing Catastrophic Overfitting
This section experimentally demonstrates that, on settings from the single-step adversarial training literature, Exp-IBP and FbswAbs can prevent CO when applied on top of single-step attacks.
5.1.1 FGSM
Experimental setting The seminal work from Wong et al. (2020) established that FGSM, which is arguably the most vulnerable single-step attack, suffers from CO on CIFAR-10 from as early as e = 8/255. Therefore, assessing whether MTI--BP, Exp-IBB and ForwAbs can be used to prevent CO when FGSM is used to 8/255, and the much harder c 24/255. In line with the single-step adversarial training literature (Andiishchenkoo & Flammarion 2020 de Jorge et al. 2022 Rocamora et al. (024) and section g we focus on PreactResNet118 trained via a cyclic learning rate schedule for 30 epochs. We run the three algorithms with a varying degree of regularization on their over-approximation lightness, plotting for each method the successful runs (i.e.,
generate the adversarial point & is crucial qualitative test. We consider two settings:
preventing CO) having the smallest a and values (see appendix C.3
Results Figure 5 shows that, on both setups, all the three considered certified training schemes can prevent CO. For <= 8/255, the empirical robustness of FGSM to multi-step attacks suddenly drops to near-O roughly mid-way through training (as shown in appendix D.3 this corresponds to a sudden spike in training FGSM accuracy), and already mull at epoch for c 24/253 (while displaying large FGSM accuracy). Differently from MTL-IBP and ForwAbs, in this setting Exp-IBP can only prevent CO while enforcing extremely low IBP loss values, resulting in nog-negligible IBP accuracies both 8/253 and 24/25s. This is associated to a smaller empirical robustness than the other certified training methods on $/255, but not on e = 24/255, where Exp-IBP outperforms the other algorithms also in empirical robustness. In both cases, Forw Abs attains very similar IBP losses to MTI--BP at the end of training.
In conformity with the relevant literature, this work mainly focuses on ReLU networks. Nevertheless, order demonstrate their wider applicability, appendix D.8 shows that MTL-IBP, Exp-IBP, and ForwAbs all prevent CO modified PreactResNet188 that employs Soft Plus activation function.
10

---

Published in Transactions on Machine Learning Research (03/2025)
0.35
490
0.30
0.25
399
0.20
1BP
0.15
299
Eshmated
0.10
ForwAls
MTL-18P
190
20
VILIE
Epsiloo
(a) AA (solid lines) and IBP (dashed) accuracies. Means over 5 repetitions and their 95% Cls.
(b) Box plots (10 runs) for the training time a single epoch, estimated on 80% subset of the training set.
Figure Certified training lechniques can prevent CO for N-FGSM when training PreactResNet118 on CIFAR-10, overcoming the robustness of PGD-5 for = 24/255 while incurring less overhead.
5.1.2 N-FGSM
Experimental setting As explained in (2.2ani) | the addition of noise on top of FGSM can mitigate CO lower perturbation radii without any overhead. However, previous single-step adversarial training work {Lin et al. 2023 2024 Rocamora et al. 2024) showed that even the state-of-the-art in noise-based single-step adversarial training, N-FGSM, becomes vulnerable when e is larger. In order to complement the results of figure we now consider a more realistic setting where certified training schemes rely on adversarial points Badv,A generated through N-FGSM, investigating the empirical robustness cost of preventing CO at large values from the literature [Roamooa et al.) 2024). As for the FGSM experiments, we use PreactReaNet18 with a 30-epoch cyclic training schedule. In these experiments we use empirical robustness to AutoAttack (AA) as the main performance criterion, and tune MTL-IBP, Exp-IBP and ForwAbs to maximize holdout validation set, with 21/255 for CIFAR-10 and CIFAR-100, and with 12/255 for SVHN. As reported in appendix D.4, this tuning criterion will take relatively heavy toll on standard performance. Nevertheless, |5.3 shows that, if desired, different tuming criteria may yield better trade-offs between clean and empirical robust accuracics. We then retrain on the full training set with the same chosen value for all the considered perturbation radii, reporting the test-set AA accuracy (and IBP accuracy when non-null). For this network, on CIFAR-100 and SVHN, we found the single-seed tuning employed in the rest of the paper be a poor marker of final performance. Figure reports valuos tuned to maximize mean validation PGD-50 accuracy 5 seeds while preventing CO. Figure shows estimate of the training cost of each algorithm, computed on a single epoch on 80% of the CIFAR-10 training set: see appendix D.2 for further details.
ForwAbs
MTL-BBP
0.12
0.5
Exp-IBP
N-FGSM
0.08
0.3
0.06
0.04
ForwAbs
0.02
Exp-IBP
MTL
0.1
FCMM
8.0
12
20
24
10
12
Epsilon
Epsion
(a) CIFAR-100
(b) SVHN
Figure When training PreactResNet118, certified training techniques can prevent CO on CIFAR-100, albeit decreasing the average empirical robustness for perturbation radii they were not tuned for. N-FGSM does not display CO for SVHN the same network: ForwAbs results nevertheless in minor average empirical robustness improvements, while MTL-IBP induces CO at 12/255 (means and 95% Cls over 5 runs).
11

---

Published in Transactions on Machine Learning Research (03/2025)
Results Figure shows that all the three considered algorithms can prevent CO for CIFAR-10, resulting in significantly larger robustness than N-FGSM on both 20/255 and 24/255. While certified training schemes pay a large price in empirical robustness for 12/255, they remarkably attain stronger AA robust- ness than PGD-5 for c = 21/255 with reduced runtime. Furthermore, for с 2 20/255 Exp-IBP yields an IBP accuracy comparable
the average AA accuracy of N-FGSM. As shown in Figure 7 CIFAR-100 and SVHN display instead worse tradc-offs. While MTL-IBP, Exp-IBP and ForwAbs all prevent CO on CTFAR-100 for 2/255, as visible from the reduced confidence intervals, they do robustness for 24/255. On the SVHN experiments, N-FGSM never suffers from CO. ForwAbs results in relatively small yet consistent performance improvements, while improvements from Exp-IBP are negligible. Remarkably, MTL-IBP fails to drive the IBP loss sufficiently low (cf. figure 21c and appears to be more vulnerable to CO than N-FGSM al. = 12/255. We ascribe this to the extreme sensitivity of MTL-IBP in the considered setup, linked to the qualitative properties of its loss on deeper networks described in (3.2 (soc figure 3 We exclude MTL-IBP from the rest of the empirical study owing this failure case. While the primary goal of this work to study the utility of certified training schemes for empirical robustness (as opposed to outperforming the state-of-the in single-step adversarial training), comparison with ELLE (Rocamora et al. 2024), recent state-of-theaate regularizer, is presented in appendix D.7 for refer- ence purposes. On CIFAR-10, MTL-IBP, Exp-IBP and ForwAbs all match or outperform ELLE in terms of AA accuracy for 2 20/255, highlighting their particularly strong performance on easier datasets. On the other hand, on CIFAR-100 ELLE significantly outperforms certified training techniques at all perturbation radii. We refer the reader to appendix D.7 for a more detailed discussion.
large cost in average empirical
In conclusion of this section, we point out that the empirical robustness costs on lower perturbation radii be mitigated by scparately tuning and X on them (for instance, the performance of N-FGSM can be trivially preserved via = À = O): we refer the reader to $5.3 for results supporting this. Nevertheless, optimizing performance on lower is out of the scope of this experiment.
5.2 Bridging the Gap to Multi-Step Adversarial Training
We here demonstrate that the gap between certified training techniques based on single-step attacks and multi-step baselines can be reduced by training on shallower networks and with longer schedules, in some set- tings outperforming PGD-10 empirical robustness without employing an adversarial training component.
5.2.1 Cyclic training schedule
Experimental setting We replicate the cyclic-schedule experiments from figures 0 and on two shallower networks without skip connections. As in figures G and 7 Fadv, for certified training methods is generated via N-FGSM. First, we consider CNN-7, 7-layer convolutional network from the certified training litera-
ture (Shi et al. 2021; Müller et al. 2023 Mao et al. 2023 De Palma et al. 2024b). Then, to study the
impact of network depth, we also provide results on 5-layer version, named CNN-5 (see appendix C.3.1
0.25
0.25
Acc: 6/187 Acturacy
0.20
0.20
PGD-10
Acc. S/BP
0.15
0.15
PSD
0.10
PGD-10
0.10
N-ROSM
Exp EP
PGD-5
0.05
Exp-IPP
N-FG55
0.00
12
20
16
20
24
Epsiton
Epsilon
(a) CHN-7.
(b) CHN-5.
Figure 8: When training CNN-7 and CNN-5 on CIFAR-10, ForwAbs and Exp-IBP prevent CO while displaying stronger empirical robustness than PGD-5 for e 2 20/255, and matching PGD-10 for CNN-5 at 24/255. AutoAttack (solid lines) and IBP (dashed) accuracies are reported (means and 95% Cls for 5 runs).
12

---

Published in Transactions on Machine Learning Research (03/2025)
0.10
0.09
0.08
0.06
PGD-10
PED-10
0.04
PGD-5
PGD-
FarwAbs
0.06
0.00
0.02
EXP-IPP
FM
0.05
Exp-BP
N.FGSM
12
20
16
20
24
Epsiion
Epsiion
(a) CNN-7
(b) CNN-5.
Figure 9: When training CNN-7 and CNN-5 for CIFAR-100, ForwAbs and Exp-IBP display better performance trade-ofls than on the deeper PreActResNet18 but still fail to improve on multi-step atlacks. AutoAttack (solid lines) and IBP (dashed) accuracies are reported (means and 95% CIs for 5 runs).
We tune Exp-IBP and ForwAbs to maximize AA accuracy for e 24/255 a validation set for each dataset and network, using the tuned value for all considered e. As discussed in $5.1 and reported in appendix D.4 this negatively impact the networks standard performance: while this is not the focus of these experiments, better robustness-accuracy trade-offs may be obtained using different tuning criteria (see 5.3)
Results Figure demoonstrats that both ForwAbs and Exp-IBP outperform PGD-5 in empirical robustness for c 2 20/255 on both CNN modcls, with ForwAbs preserving AA accuracy at lower epsilons, and Exp-IBP allaining significant. IBP accuracy (at least large as PGD-5's AA accuracy for 2 20/255). The gap to PGD-10 is also significantly reduced compared to the PreActResNet18 experiments, in spite of the significant CO shown by N-FGSM, the attack employed within both Exp-IBP and ForwAbs. Furthermore, as shown in appendix D.2. both Exp-IBP and ForwAbs reduce runtime compared to PGD-5 and PGD-10. Remarkably, on CNN-5, as shown in figure 8b. Exp-IBP matches the performance of PGD-10 for c = 24/255, significantly outperforming N-FGSM, which does not suffer from CO in this setup. In order to prevent ForwAbs from under-perte medfo-performing on CNN-5, we found it crucial to include sufficiently low values in the tuming grid: see appendix [C3.3] Finally, figure shows that, while the overall performance trade-offs are greatly improved compared to PreActResNet18,, Exp-IBP and Fbs fail to improve on multi-step attacks CIFAR-100 also the CNN architectures. We ascribe this to the larger number of classes, which produce a less favorable trade-off between empirical and certified robustness. Appendix D.6 shows that the PreActResNet18 IBP loss at initialization is more than a factor 10 larger than on the CNN architectures, providing an intuitive explanation for the different performance profiles.
5.2.2 Long training schedule
Experimental setting We now investigate whether certified training schemes can be more beneficial under longer training schodules. We consider a schedule of 160 epochs from the cortified training literature (Shi et al. 2021) in which the learning rate is decayed twice lowards the end of training, and the perturbation radius (for all methods and loss components) is gradually increased from 0 to its target value during the first 80 epochs. In order to show the benefits of tuning for each e, the paree-parameters of Exp-IBP and ForwAbs (a and X, respectively) are tuned to maximize validation AA accuracy individually on each setup considered in table [ with the exception of 16/255 CIFAR-10, which re-uses the values from 24/255 to reduce computational overhead. As in figures Ga to N-FGSM is used to generate &adv,A for Exp-1BP and Forw Abs, except for "Exp-IBP PGD-5", which relies on PGD-5 instead. Noticing the beneficial effect of large values, we also include pure IBP (a = 1), whose loss is attack-fred free, in the comparison.
Results Table [ shows that Exp-IBP outperforms PGD-5 on all considered CIFAR-10 setups. While empirical robustness maximized when the IBP accuracy large on c = 24/255, is not the case for = 8/255. Remarkably, pure IBP training outperforms all other methods for 2 16/255 on CIFAR-10. EXP PGD-5 demonstrates that on CIFAR-10 certified training techniques can also improve robustness when applied top of multi-step attacks: this appears to be useful to improve performance when single-step
13

---

Published in Transactions on Machine Learning Research (03/2025)
Table When training CNN-7 with the long training schedule, Exp-IBP consistently improves on the average empirical robustness of PGD-5 on CIFAR-10, with IBP outperforming PGD-10 for c 2 16/255. Multi-step adversarial training displays the best performance on CIFAR-100. Bold entries indicate the best AA IBP accuracy for each setting. Italics denote AA accuracy improvements PGD-5. Mcans and 95% Cls for 5 runs are reported.
CIFAR- 10
6/265
CIFAR-10 10 e 10/266
CIFAR-IB 10
21/255
CIFAR: 100 21/255
Method
AA
[%]]
IBP
AA
[%]]
IBP
[%]]
AA
[%]]
IBP
[%]]
AA
[%]]
IBP
[%]
EXP-IBP
38.44
0.25
0.00
20.72
1.54
20.55 + 1.45
14.79
1.67
14.74 + 1.59
3.25
0.44
3.14 + 0.41
EXP-IBP PGD-5
16.45 + 1.32
16.34 = 1.29
IBP
29.43 + 0.96
29.02 + 0.96
21.72 + 0.68
21.62 + 0.68
16.73 + 0.43
16.56 + 0.42
3.78
0.16
3.67 + 0.16
FORWABS
37.92 + 0.08
0.00
17.61 + 0.38
0,00
14.39 + 0.16
0.46 = 0.17
4.31 + 0.05
0.00
PGD-10
40.14 = 0.63
0.00
21.13 + 0.60
0,00
15.14 0.46
0.00
6.15 + 0.16
0.00
PGD-5
37.32 = 0.71
0.00
18.19 + 0.32
0.00
11.47 + 0.29
0.00
5.52 : 0.18
0.00
N-FGSM
37.76 = 0.30
0,00
7.13 + 11.43
0.00
0.23 + 0.64
0,00
0.02 0.06
0.00
attacks systematically fail. While ForwAbs can significantly boost the empirical robustness of N-FGSM, it manages to outperform PGD-5 only on CIFAR-10 with = 24/255. Finally, the long schedule does not benefit certified training schemes on CIFAR-100, where their relative performance compared to multi-step attacks remains unvaried compared to the cyclic schedule, and for which we did not find the use of PGD-5 to generate the attacks for Exp-IBP to be beneficial.
5.3 Sensitivity Analysis and Performance Trade-Offs
This section presents study of the test-set behavior of Exp-IBP and ForwAbs for varying values of their coefficients (respectively a and X) when training PreActResNet18 and CNN-7 with the cyclic schedule. Figures 6a
Sa. and Da display results tuned to maximize AA robustness on 24/255. We here focus on e = 20/255 to polentially showcase different performance profiles, either in terms of maximizing empirical robustness or terms of trade-offs with standard accuracy. For PreActResNet1B, figure IO shows that, on CTFAR-10, CO can be mitigated without incurring a significant cost standard performance. On the other hand, maximizing empirical robustness alone, especially if with respect to AutoAttack accuracy, will result in a larger standard performance drop: this is further highlighted by the clean accuracies relative to figures G to 9 and table ] which are reported in appendix D.4 Stronger regularisation is required CIFAR-100, where low coefficient values appear to be detrimental to robustness compared to N-FGSM (corresponding to a = 0 or A 0). Nevertheless, differently from the results showed in figure 7a both ExP-IBP and ForwAbs can improve on the average empirical robustness of N-FGSM, highlighting their
7a
60
60
50
Accuracy (88)
40
Accurasy [X6]
40
Accuracy 196]
25
30
30
20
AA
HGD
Ccun
20
15
20
10
10
10 4
10-3
10
10
10030 10-26
10-22
10-4 10-3 -0
10 30 23 10 18
Confficiont
Confficient
Cocfficiont
(a) IBP-IBP, CIFAR-10.
(b) Forw CIFAR-10.
(c) EXP-IBP C10.
(d) ForwAbs, CIFAR-100.
Sensitivity of EXp-IBP and FoswAbs their respective coefficients, a and X, when training PreActResNet18 for loo perturbations of 20/255. Plot 10c displays the legend for all sub-figures, which log standard accuracy (Clean), empirical robust. accuracies to PGD-50 and AutoAttack (AA), and IBP verified robust accuracy on the standard test sets.
Figure 10:
14

---

Published in Transactions on Machine Learning Research (03/2025)
30
50-
25
25
40-
Accuracy (N6
Accuracy [96]
20
Accurary (86)
20
30
30
PCD so
Clean
15
A4
20
20
10
10
10
10
10 Coefricient
10
10
10 47 10-3 10-2
10
10"
10 10
10-c9 10 10-1100-1 10 Coefficient
Coefficient
Coefficient
(a) EXp-IBP, CIFAR-10.
(b) FbrwAbs, CIFAR-10.
(c) Exp-IBP, CIFAR-100.
(d) ForwAbs, CIFAR-100.
Figure 11: Sensitivity of Exp-IBP and ForwAbs their respective coefficients, a and X, on CNN-7 for lx perturbations of c 22/255 using the cyclic training schedule. Plot 11b displays the legend for all sub-figures.
versatility and the potential advantages of per-instance tuning. Figure 11 shows similar trends for CIFAR-10 CNN-7, where however both methods attain larger AutoAttack accuracy, and at smaller cost in standard performance. N-FGSM does not suffer from CO on CIFAR-100 at e 20/255 for CNN-7, where it performs competitively with PGD-5: figures I1c and 11d show that non-zero coefficienss for Exp-IBP and ForwAbs are not beneficial in this setup. This is in contrast. with figure Sb and table | suggesting that the ability of certified training schemes to enhance the empirical robustness in setups where there no CO heavily depends on the size of the network (see appendix D.6. and on the difficulty of the learning task.
6 Conclusions
We presented comprehensive empirical study the utility of recent certified training techniques for empirical robustness, as opposed to verifiability, their original design goal. In particular, we showed that Exp-IBP can prevent catastrophic overfitting on single-step attacks for a variety of settings, outperforming some multi-step baselines in a subset of these. Furthermore, we presented a conceptually simple regularizer on the size of network over-approximations, named ForwAbs, that can achieve similar effects to Exp-IBP on top of single-step attacks while cutting down its overhead. While we believe that these results highlight the potential of certified training empirical defense, they also show the severe limitations of current techniques on harder datasets, ultimately calling for the development of better certified training algorithms.
Acknowledgments
This work was partially supported by the SAIF project, funded by the "France 2030" government invest- ment plan managed by the French National Research Agency, under the reference ANR-23-PEIAS PEIA-0006; and partially funded by the French Ministère des armées Agence de l'innovation de défense (Ministry of Armed Forces Defense Innovation Agency). This publication was made possible by the use of the Factory-IA su- percomputer, financially supported by the flo-de-France Regional Council. Finally, the authors are grateful to the CLEPS infrastructure from Inria Paris for providing resources and support.
References
Ross Anderson, Joey Huchette, Will Ma, Christian Tjandraatmadja, and Juan Pablo Vielma. Strong mixed- integer programming formulations for trained neural networks. Mathematical Programming, 2020.
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast. adversar- ial training. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and Н. Lin (eds.); Advances in Neural Information Processing Systems, volume 33, pp. 16048-16059, Curran As- sociates, Inc., 2020. URL http://poocoddingg.nrrrrpp.ppp.p BBc247755arr11114453300076444
15

---

Published in Transactions on Machine Learning Research (03/2025)
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-efficient black-box adversarial attack via random search. In Andrea Vedaldi, Horst Bischol, Thomas Brox, and Jan-Michae Frahm (eds.), Computer Vision ECCV 2020, pp. 484 501, Cham, 2020. Springer International Publishing.
Mislav Balunovic and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In Interaaiinaal Conference on Learning Represenlations, 2020. URL http:://ppenreviee.eeeeee http://iiweeeeeeoomimiimoooi
SJxSDxTKDr
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Srndió, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML PKDD). Springer, 2013.
Akhilan Boopathy, Lily Weng, Sijia Liu, Pin- Yu Chen, Gaoyuan Zhang, and Luca Daniel. Fast training provably robust neural networks by singleprop. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 6803 6811, 2021.
Rudy Bunel, llker Turkaslan, Philip HS Torr, Pushmeet Kohli, and M Pawan Kumar. A unified view of piecewise linear neural network verification. Neural Information Processing Systems, 2018.
Rudy Bunel, Alessandro De Palma, Alban Desmaison, Krishnamurthy Dvijotham, Pushmeet Kohli, Philip HS Torr, and M Pawan Kumar. Lagrangian decomposition for neural network verification. Confer- ence on Uncertainty in Artificial Intelligence, 2020a.
Rudy Bunel, Jingyue Lu, lkker Turkaslan, P Kohli, P Torr, and M Pawan Kumar. Branch and bound for piecewise linear neural network verification. Journal of Machine Learning Research, 21(2020), 2020b.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 39-57, 2017. doi: 10.1109/ S01109//P.2011. SP.2017.49.
Tianlong Chen, Zhenyn Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In International Conference Learning Representations, 2020.
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. In International conference on machine learning, 2017.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. Tn International Conference on Machène Learning, 2019.
Patrick Cousot and Radhia Cousot. Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints. In Robert M. Graham, Michael A. Harrison, and Ravi Sethi (eds.), Conference Record of the Fourth ACM Symposium on Principles of Programming Languages, Los Angeles, California, USA, January 1977, pp. 238 252. ACM, 1977. doi: 10. 10.1145/512950. 512973. URL
http://oo.orr///// 1145/ 512973 2599
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free free attacks. In ICML, 2020.
Piersilvio De Bartolomeis, Jacob Clarysse, Amartya Sanyal, and Fanny Yang. How robust accuracy suffers from certified training with convex relaxations. arXie preprint arXi::230600000 069995 2023.
Pau de Jorge, Adel Bibi, Riccardo Volpi, Amartya Sanyal, Philip Torr, Grégory Rogez, and Puneet K. Dokania. Make some noise: Reliable and efficient single-step adversarial training. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (eds.), Advances in Neural Information Processing Sys- tems, 2022. URL https:://oeenrevie: net:fooummiddiee...... bExYu
Alessandro De Palma, Harkirat Singh Behl, Rudy Bunel, Philip H. S. Torr, and M. Pawan Kumar. Scaling the convex barrier with active sets. International Conference on Learning Representations, 2021.
16

---

Published in Transactions on Machine Learning Research (03/2025)
Alessandro De Palma, Rudy Bunel, Krishnamurthy Dvijotham, M. Pawan Kumar, and Robert Stanforth. TBP regularization for verified adversarial robustness via. branch-and-bound. In ICML 2022 Workshop Formal Verification of Machine Learning, 2022.
Alessandro De Palma, Harkirat Singh Behl, Rudy Bunel, Philip H. Torr, and M. Pawan Kumar. Scaling the convex barrier with sparse dual algorithms. Journal of Machine Learning Reseorch, 2024a.
Alessandro De Palma, Rudy Bunel, Krishnamurthy Dvijotham, M. Pawan Kumar, Robert Stanforth, and Alessio Lomuscio. Expressive losses for verified robustness via convex combinations. In The Twelfth International Conference on Learning Representations, 2024b. URL https://openrevier wwwpiiewwwe//forrrir 1d=m2yZ4wzKJM
Krishnamurthy Dvijotham, Robert Stanforth, Sven Gowal, Timothy Mann, and Pushmect Kohli. dual approach to scalable verification of deep nelworks. Conference on Uncerlainly in Artificial Intelligence, 2018.
Ruediger Ehlers. Formal verification of piece-wise linear feed-forward neural networks. Automated Technology for Verification and Analysis, 2017.
Jiameng Fan and Wenchao Li. Adversarial training and provable robustness: tale of two objectives. AAAI Conference on Artificial Intelligence, 2021.
Claudio Ferrari, Mark Niklas Mueller, Nikola Jovanović, and Martin Vechev. Complete verification via multi- neuron relaxation guided branch-and-bound. International Conference on Learning Representations, 2022.
Zeinab Golgooni, Mchrdad Saberi, Masih Eskandar, and Mohammad Hossein Rohban. Zerograd: Costless
conscious remedies for catastrophic overfitting in the fgsm adversarial training. Intelligent Systems with Applications, 19:200258, 2023. ISSN 2667-3053 doi: https://dooi.org/10.001111 http://///....///./a...a.aaaaaaa
htw.:///.......///.......... www.:aa.22...000000 200258.. URL
Tan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, Son Diego CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. URL http:
//arxiv..o .rg. htgg/bbs/4412.66 6572
Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint urXiv: 12715, 2018. URL/tttp::////// htttp://aaxii... org/
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In Computer Vision-ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part IV 14, pp. 630 645. Springer, 2016.
P. Henriksen and A. Lomuscio. Deepsplit: An efficient splilting method for neural network verification via indirect effect analysis. In Proceedings of the 30th International Joint Conference on Artificial Intelligence (IJCA121), 2021.
Yujia Huang, Huan Zhang, Yuanyuan Shi, Zico Kolter, and Anima Anandkumar. Training certifiably robust neural networks with elficient local lipschitz bounds. In Neural Information Processing Systems, 2021.
Sergey loffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International Conference on Machine Learning, 2015.
Nikola Jovanovié, Mislav Balunovic, Maximilian Baader, and Martin Vochev. On the paradox of certified training. Transactions on Machine Learning Research, 2022. ISSN 2835-8856. URL https:://openreviin het/EforummidrraaJJHHUyBBB
17

---

Published in Transactions on Machine Learning Research (03/2025)
Guy Katz, Clark Barrett, David Dill, Kyle Julian, and Mykel Kochenderfer. Reluplex: An efficient SMT solver for verifying deep neural networks. orXiv preprint arXiv:1 702.0102111110 135, 01155, 2017.
Hoki Kim, Woojin Lee, and Jaewook Lee. Understanding catastrophic overfitting in single-step adversarial training. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 8119-8127, 2021.
A. Krizhevsky and G. Hinton. Learning multiple layers of features from tiny images. Master's thesis, Department of Computer Science, University of Toronto, 2009.
Tao Li, Yingwen Wu, Sizhe Chen, Kun Fang, and Xiaolin Huang. Subspace adversarial training. In Pro- ceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, 2022.
Runqi Lin, Chaojian Yu, and Tongliang Liu. Eliminating catastrophic overfitting via abnormal adversarial examples regularization. Advances in Newral Information Processing Systems, 2023.
Runqi Lin, Chaojian Yu, Bo Han, Hang Su, and Tongliang Liu. Layer-aware analysis of catastrophic overfit- ting: Revealing the pseudo-robust shorteut dependency. International Conference on Machine Learning, 2024.
Feng Liu, Bo Han, Tongliang Liu, Chen Gong, Gang Niu, Mingyuan Zhou, Masashi Sugiyama, et al. Proba- bilistic margins for instance reweighting in adversarial training. Advances in Neural Information Processing Systems, 2021.
Alessio Lomuscio and Lalit Maganti. An approach to reachability analysis for food-forward ReLU neural networks. xrv: 706. 706607351, 2017.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference Learning Representations, 2018. URL https:// wwtp:e//ooooummidddrrr222..
Yuhao Mao, Mark Niklas Mueller, Mare Fischer, and Martin Vechev. Connecting certified and adversarial training. In Thirlg-seventh Conference on Neural Informalion Processing Systems, 2023. URL https: //openreview met:/oorum?.d-2211aaa
Yuhao Mao, Stefan Balauca, and Martin Vechev. СТBENСH: A library and benchmark for certified training. arXiv preprint arXiv:2406.0480 04848, 2024a.
Yuhao Mao, Mark Niklas Müller, Marc Fischer, and Martin Vechev. Understanding certified training with interval bound propagation. International Conference Learning Representations, 2024b.
Matthew Mirman, Timon Gehr, and Martin Vechev. Differentiable abstract interpretation for provably robust neural networks. In International Conference on Machine Learning, 2018.
R.E. Moore. Interval Analysis. Prentico-Hall series in automatic computation. Prentico-Hall, 1966. URL htttps:/bbookes wowggeooooo.oooooooooooooo.oooo. ftt/boookssisccssAAAAAA
Seyed-Mohsen Ploosavi-Dezfooi Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. In Proceedings of the IEFE Conference Computer Vision and Pattern Recognition (CVPR), June 2016.
Mark Niklas Müller, Franziska Eckert, Mare Fischer, and Martin Vechev. Certified training: Small boxes are all you need. In International Conference on Learning Representations, 2023.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y. Ng. Reading digits natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Un- supervised Feature Learning 2011, 2011. URL http::/uffdd. httpa//ass..aacceaeooooooooaaaaa housenumbers.pg
18

---

Published in Transactions on Machine Learning Research (03/2025)
Guillermo Ortiz-Jimenez, Pau de Jorge, Amartya Sanyal, Adel Bibi, Puneet K Dokania, Pascal Frossard, Grégory Rogez, and Philip Torr. Catastrophic overfitting can be induced with iiscriminative non-robust features. Transactions on Machine Learning Research, 2023.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense adversarial perturbations against deep neural networks. In IEEE symposium on security and privacy (SP); 2016.
Geon Yeong Park and Sang Wan Lec. Reliably fast adversarial training via latent adversarial perturbation. In Proceedings of the TEEE/ CVV international conference on computer vision, 2021.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, perefrerffomccce deep learning library. Neural Information Processing Systems, 2019.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning, In International conference on machine learning, pp. 8093-8104. PMLR, 2020.
Elias Abad Rocamora, Fanghui Liu, Grigorios Chrysos, Pablo M. Olmos, and Volkan Gevher. Efficient local lincarity regularization overcome catastrophic overfitting. In The Twelfth International Conference on Learning Represenlations, 2024. URL https://openrevvie: htwp://rwwweeeeeeeooouoeeaaaaeaa htt.:///oormmmmaaa////22222
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S
Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019. URL httpt/ttttpp/oceeeeeeeeeee h/pprc/eedno........mooo neur heurips... cc/
paper http:///poooo...ooooooooooooooa0
Zhouxing Shi, Yihan Wang, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsich. Fast certified robust train- ing with short warmup. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan (ods.), Advances in Newral Information Processing Systems, volume 34, pp. 18335-18349. Cur- ran Associates, Inc., 2021. URL
wtwppporeeeiinnnnnr.ririrppppppp neurips wwtpssssccppppppppperrre filess/paper/222//ilee 3885115aaccf06633322/aaaaaaabba3
pdf
Gagandeep Singh, Timon Gehr, Matthew Mirman, Markus Püschel, and Martin Vechev. Fast and effective robustness certification. In S. Bengio, H. Wallach, Н. Larochelle, K. Grau- man, N. Cosa-Bianchi, and R. Garnett (eds.), Advances in Newral Information Processing Sys- lems 31, pp. 10802 10813. Curran Associates, Inc., 2018. URL http://papers nips mips.cc/ cc/paper/ 8278-fast
Gagandeep Singh, Rupanshu Ganvir, Markus Püschel, and Martin Vechev. Beyond the single neuron convex barrier for neural network certification. Neural Information Processing Systems, 2019a.
Gagandeep Singh, Timon Gehr, Markus Püschel, and Martin Vechev. An abstract domain for certifying neural networks. Proceedings of the ACM on Programming Languages, 3(POPL)::-30, 2019b. doi: 10. 1145/3290354. URL htttps://doi.rrg// http://200..rrr11010.114///3333
Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, and Venkatesh Babu R. Guided adversarial attack for evaluating and enhancing adversarial defenses. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 20297 20308. Cur- ran Associates, Inc., 2020. URL
ea2e2206610000000000000777777179 pdff
Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, and Venkatesh Babu Radhakrishnan. Towards efficiont and effective adversarial training. In A. Beygekimer, Y. Dauphin, P. Liang, and J. Wortman Vaughan (eds.), Advances in Neural Information Processing Systems, 2021. URL https://openrevvier het/forrum2id=xxuXXAArzz
19

---

Published in Transactions on Machine Learning Research (03/2025)
Teruo Sunaga. Theory of an interval algebra and its application to numerical analysis. RAAG Memoirs, 1958.
Christian Szegedy, Wojciech Zaremba, Nlya Sutskever, Joan Bruna, Dumitru Erhan, Tan J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Represenlations, ICLR 2014, Banßf AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL http://arxiv.. www. 111//3112266 6199
Christian Tjandraatmadja, Ross Anderson, Joey Huchette, Will Ma, Krunal Patel, and Juan Pablo Vielma. The convex relaxation barrier, revisited: Tightened single-neuron relaxations for neural network verifica- tion. Neural Information Processing Systems, 2020.
Vincent Tjeng, Kai Xiao, and Russ Tedrake. Evaluating Robustness of Neural Networks with Mixed Integer Programming. 2019. URL
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. En- semble adversarial training: Attacks and defenses. International Conference on Learning Representations, 2018.
Theodoros Tsiligkaridis and Jay Roberts. Understanding and increasing efficiency of frank-wolfe adversarial training. Tn Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022.
BS Vivek and R Venkatesh Babu. Single-step adversarial training with dropout scheduling. Tn 2020 IEEE/CVF Conference on Computer Vision and Pottern Recognition (CVPR). IEEE, 2020.
Shiqi Wang, Huan Zhang, Kaidi Xu, Xue Lin, Suman Jana, Cho-Jui Hsich, and J Zico Kolter. Beta-CROWN:
Efficient bound propagation with per-neuron split constraints for complete and incomplete neural network verification, Neural Information Processing Systems, 2021.
Yifei Wang, Liangehen Li, Jiansheng Yang, Zhouchen Lin, and Yisen Wang. Balance, imbalance, and rebal- ance: Understanding robust overfitting from a minimax game perspective. Advonces in neural information processing systems, 36, 2024.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial ro- bustness requires revisiting misclassified examples. In International conference on learning representations. 2019.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, 2018.
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast better than free: Revisiting adversarial training. Tn International Conference on Learning Representations, 2020. URL http::://oppaneeeeeeeeeee/eeeeee BJx040EFvH
Kaidi Xu, Zhouxing Shi, Huan Zhang, Yihan Wang, Kai- Wei Chang, Minlie Huang, Bhavya Kailkhura, Xue Tin, and Cho-Jui Hsieh. Automatic perturbation analysis for scalable certified robustness and beyond. Tn Newral Information Processing Systems, 2020.
Kaidi Xu, Huan Zhang, Shiqi Wang, Yihan Wang, Suman Jana, Xue Lin, and Cho-Jui Hsieh. Fast and complete: Enabling complete neural network verification with rapid and massively parallel incomplete verifiers. In International Conference Learning Representations, 2021.
Xiaojun Xu, Linyi Li, and Bo Li. Lot: Layer-wise orthogonal training on improving 12 certified robustness. In Neural Information Processing Systems, 2022.
Yuancheng Xu, Yanchao Sun, Micah Goldblum, Tom Goldstein, and Furong Huang. Exploring and ex- ploiting decision boundary dynamics for adversarial robustness. International Conference on Learning Representations, 2023.
20

---

Published in Transactions on Machine Learning Research (03/2025)
Bohang Zhang, Du Jiang, Di He, and Liwei Wang. Rethinking lipschitz neural networks and certified robustness: A boolean function perspective. In Neural Information Processing Systems, 2022a.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theo- retically principled trade-off between robustness and accuracy. In International Conference Machine Learning, 2019.
Huan Zhang, Tsui- Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neural network ro- bustness certification with general activation functions. In Bengio, H. Wallach, H. Larochelle, K. Grau- man, N. Cesa-Bianchi, and R. Garnett (eds.), Advances in Neural Information Processing Systems, vol- ume 31. Curran Associates, Inc., 2018. URL https://ppoeedigg..errrss...ccpp fttpppppprrttlsepppprrrrr//
2018 0857110000666770066a000006400000 pdf
Huan Zhang, Hongge Chen, Chaowci Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane Boning, and Cho- Jui Hsieh. Towards stable and efficient training of verifiably robust neural networks. In International Conference Learning Representations, 2020.
Huan Zhang, Shiqi Wang, Kaidi Xu, Linyi Li, Bo Li, Suman Jana, Cho-Jui Hsich, and J Zico Kolter. General cutting planes for bound-propagation-baadd neural network verification. Newral Information Processing Systems, 2022b.
21

---

Published in Transactions on Machine Learning Research (03/2025)
100 & 9GD0 Arr
0.5
CC-IP
10H
NTL:BB
101
0.3
I8P Los
NTL BP
Exp-B7
0.2
SABR
I-FGSM
0.1
5
10
30
Epochs
Epocts
(a) Certified accuracy via IBP bounds (solid lines), empirical accuracy under PGD-7 attacks (dashed).
(b) IBP loss.
Figure 12: IBP certified robustness attained by expressive losses on the PreActResNet18 training setup from de Jorge al. (0022) Validation results on CIFAR-10 under perturbations of e $/255.
A Qualitative Behavior of CC-IBP and SABR
We here present the CC-IBP and SABR losses, then expand the qualitative analysis on the behavior of expressive losses presented in $3.2 Specifically, focusing again on a PreActResNet18 setup prevalent the single-step adversarial training literature and studied $5.1 we will show that they share the same qualitative bchavior of MTL-IBP.
Let & be the output of the chosen attack for perturbation set (x)). SABR Müller al. 2023
putes the IBP loss
subset of the perturbation set of radius centered T. Proj (addv. B (æ)). Similarly to MTL-IBP and Exp-IBP (sce (3.2), the CC-IBP loss is defined through convex combinations. Specifically, it computes the chosen loss L on the convex combination between the adversarial logit differences z (Fadv,A A. y) and the IBP lower bounds 15 (=)..)
Definition A.1 The SABR and CC-IBP losses are defined as follows:
CSABR (fo. (x)):))) = LiBr(fo, Bac (za);y);
(7)
C CCC-IBP (fe. (x)))))) = C (- (1 a)= (Xady V) + (.))))))) .1)
fo
Figure 12 shows that, MTL.-IB, SABR and CC-IBP fail to yield non-negligible certified accuracy via IBP. As for MTL-IBP, gradually increase and the IBP perturbation radius to improve performance (see appendix D.I.. Their final IBP losses are both larger than those attained by MTL-IBP (and, transitively, by Exp-IBP). In addition, figure 13 shows that CC-IBP and SABR display the same growth trends of the MTL-IBP loss on the toy networks, further demonstrating their common similarity.
CC/BP
CC
CCIBF
10'
Exp-IPP
10'
101
Adv
10a
Adv
Adv
104
IP
10"
LoSS
IBP
16a
10
10
10"
(a) 18 layers; a = 10 for CC-IBP, (b) 18 layers; a = 10-2 for CC-IBP, MTL-IBP and SABR.
(c) 2 layers; a 3 x 10 for CC-IBP, MTL-IBP and SABR.
MTL-IBP and SABR.
Figure 13: Sensitivity of the expressive losses toy network of varying depth, with 10-1 for Exp-IBP. For all three plots, CC-IBP displays almost identical behavior to MTL-IBP.
22

---

Published in Transactions on Machine Learning Research (03/2025)
B Experimental Details
We now provide experimental details omitted from sections 3 to 5.2
B.1
Toy Networks
The toy neural networks employed in $3.2 are fully connected networks of depth n designed to feature IBP bounds which are tunable in magnitude through a scalar parameter w, and explode with the depth of the network. They are defined follows:
x' = ReLU ([-
w
2
3
x = ReLU (8
0 2 x x
)}
x
x
2
+
v & E n - 1].
w
[
evaluating to:
x
3
x" = 2 ReLU
w
[
Let us assume that = (a similar reasoning holds if y 0). In this context, 2 0, the logit differences z (x", y) can be computed as:
Zrn (xx,, 2- ReLLU (w (af =8)) ReLU (w (ag -=i))] -
w 2n ReL.U (xf m0) ReL.U (rg - -x]]]
= w 2n (z) 2q) - 2.
If an z such that z - z < 0 belongs to the perturbation set (x(x),, then z (i (1,1, .) will have (-o0, as image for w E [0, +oo). Noting that the relative IBP lower bounds (,,)),), evaluate to -2 w (see equation 4, that 1 (,(())),1 I = (x=, 1) for any 0, and that 1,, (a"),. is continuous function with respect to w (as it is computed through compositions and linear combinations of continuous functions), the
image of (s()), for w E [0, +00) will also be (-x,- 2].. In addition, for any fixed w > 0, 1 (.()"), will decrease at least as fast as zz" (2",1) (which decreases exponentially) with the depth of the network.
In order meet the above condition, figure uses x [-5,5]7, y = and B10(x") as perturbation. Furthermore, in order to keep the adversarial loss constant with for the purposes of figure Badv, = [0, 0JT, for which z (a 1) -2 regardless of w.
we set
B.2 Datasets
We focus three standard 32 x 32 image classification datasets: CIFAR-10 and CIFAR-100 (Kriheevsyy & Hinton 2009). and SVHN (Netzer et al. 2011). CIFAR-10 and CIFAR-100 consist of 60,000 32 x 32 RGB images, with 50,000 images for training and 10,000 for testing. CIFAR-10 contains 10 classes, while CIFAR-100 contains 100 classes. SVHN consists of 73,257 32 x 32 RGB images, with 73,257 images for training and 26,032 for testing.
Unless specified otherwise, for tuning purposes or when reporting validation results we use a random 20% holdout of the training set validation set, and train the remaining 80%. After tuning and when reporting test set results, we use the standard train and test splits for all datasets.
C Implementation Details and Computational Setup
This appendix details our implementation and outlines the computational setup employed to run the exper- iments.
C.1
Implementation Details
Our implementation relies on PyTorch (Paszke al. 2019 and on the public codebases from de Jorge et al.
(2022): Rocamora al. (2024) De Palma al. (202bb) We compute IBP bounds using the LiRPA implementation (Xu al. 2020
23

---

Published in Transactions on Machine Learning Research (03/2025)
N-FGSM may return point outside the set of allowed perturbations (x))). As result, when using it to compute the adversarial point Badv,A for SABR, we disable the projection of the SABR perturbation subset onto the original perturbation set, simply setting 2a = øadv. (see $3.2), which allows the implementation to meet the definition of expressivity for small a values.
Consistently with the single-step adversarial training literature (de Jorge et al. 2022 Rocamora et al, 2024), Norm layers (loffe Szegedy, 2015), which are present in all the employed models, are always kept in training mode throughout training (including during the attacks). When computing IBP bounds for expressive losses and ForwAbs terms at training time, we use the batch statistics from the current adversarial attack. For ForwAbs, these are retrieved from the auto LiRPA implementation (Xu et al. 2020). The clean inputs are never fed to the network at training time, except when using FGSM to generate the attack or when training with pure IBP (in that case, the clean batch statistics are used to compute the IBP bounds). The outcome of the running statistics compute during training systematically employed at evaluation time.
C.2 Computational Setup
All timing measurements were carried out on an Nvidia GTX 1080Ti GPU, using 6 cores of an Intel Skylake Xeon 5118 CPU. All the other experiments were run on a single GPU each, allocated from two separate Slurm-based internal clusters. We used the following GPU models from one cluster: Nvidia V100, Nvidia RTX6000, Nvidia RTX8000, Nvidia GTX 1080Ti, Nvidia RTX2080Ti. And the following GPU models from the other cluster: Nvidia Quadro P5000, Nvidia H100.
C.3 Training Details and Hyper-parameterr
We now provide omilted training details and hyper-paramettes.
C.3.1 Network Architectures
The PreActResNet18 and CNN-7 architectures used in our experiments are left unvaried with respect to the implementations from de Jorge et al. 2022) and De Palma et al. (2024b), respectively.
The CNN-5 architecture has the following structure:
3 filters, stride = and padding = 1, followed by BatchNorm and a convolutional layer with 64 x ReLU activation function;
2. convolutional layer with 64 4 x 4 filters, stride = 2 and padding = 1, then BatchNorm and ReLU; convolutional layer with 128 4 x filters, stride and padding = 1, then BatchNorm and ReL.U;
4. linear layer with 512 neurons, then BatchNorm and ReLU;
5. linear layer with l (the number of classes) neurons.
C.3.2 Initialization and Training Schedule
All the networks trained using MTL-IBP, Exp-IBP and ForwAbs are initialized using the specialized tech- nique from Shi et al. (002), which results smaller TBP bounds at initialization. Except for the experiments from g and for those in table D where the spocialized initialization is employed in order to fairly compare IBP bounds, all the networks trained via pure adversarial training and ELLE are instead initialized using PyTorrch's default initialization.
All the PreActResNeet18 experiments use a short schedule popular in the literature (Andriushchenko & Flammarion 2020 Wong et al.) 2020 de Jorge el al. 2022 Rocamora et al.) 2024 The batch size is set lo 128, and SGD with weight decay 5 x 10 is used for the optimization. Crucially, no gradient clipping is employed, which (in addition network depth and the lack of ramping up) we found to be major factor behind the instability of pure IBP training (see $3.2p. On CIFAR-10 and CIFAR-100 we train a PreAetResnet 18 for 30 epochs with cyelic learning rate linearly increasing from 0 to 0.2 during the first
24

---

Published in Transactions on Machine Learning Research (03/2025)
half of the training then decreasing back to O. On SVHN the training is done for 15 epochs, with cyclic learning rate linearly increasing from O to 0.05 during 6 epochs, then decreasing back to 0 for the remaining 9 epochs. Furthermore, for SVHN only, the attack perturbation radius is ramped up from 0 to during the first 5 epochs. For consistency, the CNN experiments from figures g
and 9 employ the same training schodule.
All the MTI.-IBP and Abs experiments using the cyclic schedule gradually increase both the method coefficient (respectively a and A) and the perturbation radius used to compute the LBP bounds (or their proxy 8*) from 0 to their target value. We conduct an ablation study MTL-IBP in the context of the experiment from figure 2 to justify this choice: refer the reader to appendix D.I The increase happens over the first 25 epochs for CIFAR-10 and CIFAR-100, and over the first 12 epochs for SVHN. The radius used to compute the attack is kept consistent with the adversarial training literature (that. is, constant in all cases except for the first 5 epochs on SVHN). In particular, the value is increased exponentially for the first 25% of the above epochs and linearly for the rest (Shi et al.] 2021), relying on the SmoothedScheduler from auto_ _ato_LiRPA (Xu al. 2020). In all cases, the attack perturbation radius is left unchanged with respect the schedules described above for consistency with pure adversarial training.
The long training schedule used for the experiments in table I mirror setup from Shi et al. 20221 widely
adapted in the certified training literature (Müller et al. 2023 Mao et al., 2023 De Palma et al. 2024b).
Training is carried out for 160 epochs using the Adam optimizer with a learning rate of 5 x 10-1 decayed twice by a factor of 0.2 at epochs 120 and 140. Gradient clipping is employed, with the maximal &g norm of gradients equal to 10. Training starts with an epoch of clean training ("warmup"). During epochs 1 to 81, the perturbation radius (regardless of the computation it is employed for) is increased from 0 its target value using the SmoothhdScheduler from auto_ a LiRPA (Xu et al., 2020). For Exp-IBP and IBP, we employ specialized regularizer (Shi et al. 2021 for the IBP bounds for the first 81 epochs (with coefficient 0.5
done by the original authors on CIFAR-10), as commonly done in previous work (Müller et al. 2023
Mao
et al. 2023 De Palma et al. 2024b).
C.3.3
Hyper- eyper-parameters
Experiment
EXp-IBP a MTL.-IBP a
Forw bs Ā
Figures
6a
20a
and
21a
2
x 10
1
x 10-8
1
10 24
Figures
7a
20g
and
21b
5
x 10
x 10
1
X
10
10-18
Figures
7b
20c
and
21c
2 x 10-3
2.75 x 10-15
1 X 10-23
Figures
8b
20e
and
21e
4
X 10
I
10
Figures
9b
20c
and
21g
2
10-3
1
10-10
Figures
8a
20d
and
21d
2
10
1
10
Figures
3a.
201
and
211
2
x 10-3
1
10-12
Table 1 CIFAR-IO,
5/233
5
x 10-3
1
10-12
Table
1
CIFAR-10, 6 = 24/255 and = 16/255
7.5 x 10
1 10 10
Table
CIFAR-100, c 24/255
7.5 x 10-1
1
X 10-8
Table 2: Exp-IBP, MTL-IBP and ForwAbs coefficients for figures to 9 figure 20 figure and table
For N-FGSM, we use the same hyper-parameters as de Jorge et al. 2022 : the uniform perturbation is sampled from 2c, 2c] for every sctting except for SVHN with c 12 255 where the perturbation sampled from 3e]. The step size is set to
for all settings. For PGD baselines, we use a step size of a s/4 in all settings. Unless stated otherwise, all the certified training algorithms rely on N-FGSM to generate the adversarial attack composing their loss. To mirror the hyper-parameter in our codebase, we will report == A/2 for the employed ForwAbs regularization coefficient X.
All a and À parameters for EXp-IBP, MTL-IBP and ForwAbs Figures
i to 9
20 and 21 and table are
reported in table [ Exp-IBP PGD5 on CIFAR-10 with 21/255 from table USSC & 0.75. All the tuning for these experiments is done on random validation set (see appendix B.2 On all experiments except those in figure 7 tuning is carried out by maximizing empirical robustness while above the CO threshold.
25

---

Published in Transactions on Machine Learning Research (03/2025)
CC.IBP Schee.
CC.IBP
NTL IBP Schoo
NTL IBP
P000 Accuncy
SABR Sched.
SABR
IBP Los
SABR Sched
10
0.10
10
15
20
25
30
10
15
20
25
30
Epochs
Epochs
(a) Empirical accuracy under PGD7 attacks.
(b) IBP loss.
Figure 15: Effect of scheduling the bounding perturbation radius and the IBP cortified robustnoss
allained by CC-IBP, MTL-IBP and SABR on the PreActResNet18 training selup from de Jorge el al. (0022) Validation results on CIFAR-10 under perturbations of e = $/255.
Except where otherwise stated, the employed metric is validation AA accuracy. As explained in 15.1 certified training schemes in figure 7 were tuned using 5 seeds, maximizing PGD-50 robustness while excluding from the final parrmmerrretter values any configuration displaying strong CO behavior.
For the experiments of 3.. 3.3 and appendix D.1. whose goal was instead to reduce the IBP loss as much as possible on the validation set, we employed the following values: a = 0.1 for Exp-IBP, = 10 for CC-IBP and MTL-IBP with scheduling, a = 10-15 for CC-IBP and MTL-IBP without scheduling, a 10 for SABR with scheduling and a = 10 9 for SABR without scheduling. Similarly, in figure 4 À = 10 10-15 15 was used for ForwAbs and de, 0.04 for f1-rgularizod N-FGSM. For all methods in this experiment, larger values among those we considered led to numerical problems or trivial behaviors, such as networks consistently outputting the same class in our implementation).
Finally, figure 5 employs the following hyper-paramcters: on c 8/255, =3=3x 3 10 for Exp-IBP, a = 10 for MTL-IBP, == 10-18 for ForwAbs; on 24/255, a = 2.5 x 10-2 for Exp-IBP, a = 10-7 for MTL-IBP, 2
2 x 10-16 for FbswAbs. The goal of the experiment is to qualitatively discern whether certified training schemes can prevent catastrophic overfitting on FGSM. In order to determine this, we ran a series of Exp- IBP, MTL-IBP and ForwAbs experiments directly on the CIFAR-10 test set, and plotted the successful runs À values (among those tried).
(in terms of preventing CO) with the smallest
In conclusion of this appendix, show preliminary version of figure 8b resulting from insufficient tuning of the ForwAbs coefficient A. Specifically, when tuning for the experiment, we first focused on excessively large coef- ficients, selecting Ā = 10 as the best-performing setup in terms of validation AA accuracy (as opposed x= 10- used for figure [b). Figure 14 shows the result: while ForwAbs achieves large IBP accuracy CNN-5, further confirming its utility towards certified robustness, it at- tains low empirical robustness throughout the experi- ment. Noticing instcad the strong empírical robustness of Abs with 10-10 on CNN-7 (figure Sap, we ex- tended the tuning on CNN-5 to smaller values. We then found À= 10-8 to yield stronger validation AA accuracy than À 10, hence producing figure 8b
Miccc BPccuuy
0.20
0.15
0.30
PGD-11
PGD-5
Forwills
Exp-BP
0.00
16
Epsiion
Figure 14: Results of insufficient tuning of
Fbs for CNN-5 on CIFAR-10, setup of figure 8b
Additional Experimental Results
This appendix displays supplementary experimental results.
26

---

Published in Transactions on Machine Learning Research (03/2025)
D.1 Supplement to Section 3.2 Scheduling Ablation
We here present experimental results omitted from $3.2 and appendix A Figure 16 displays the behavior of the training IBP loss for Exp-IBP. In particular, it shows that the training loss drops from more than 10 to 2.67 from the first to the second epoch, demonstrating the large degree of variability in IBP loss for the employed PreActResNet18 training setup. In this context, shown in figure 3 Exp-IBP displays less sensitivity to the magnitude of the IBP loss, proving more effective for the purposes of decreasing the IBP loss. In fact, the other losses from equation (5) display numerical problems that prevent successful training for large a coeflicients (and for pure IBP, which corresponds to a for any expressive loss), leading aborted runs in our PyTorch implementation.
Figure 15 studies the effect of scheduling (gradually increasing from 0 to their target value in 25 epochs) both a and the perturbation radius employed to com- pule the IBP lower bounds fo (.(())))) Excluding trivial outcomes, such networks systematically outputting the same class, for CC-IBP, MTL-IBP and SABR, we were unable to reach validation IBP loss values below 44 without scheduling. The scheduling allows the use of larger a values, resulting in lower IBP loss value for CC-IBP, MTL-IBP and SABR: respectively from 56.47 to 24.06, from 44.50 to 9.89, and from 185.51 to 69.09. These improvements crease in robustness to PGD-7 (a. PGD atlack with 7 steps). Nevertheless, CC-IBP, MTL-IBP and SABR are unable to attain neglnegli certified accuracy via IBP in this context. In view of these results, we employ the same scheduling for ForwAbs (see appendix C.3.2
Traiiing IaP Loss
10
Exp-BBP
2011
10*
1.0
15
25
Figure 16: Training IBP loss of the Exp-IBP exper- iment from figure
with slight de-
D.2 Training Overhead
shows the per-epoch training overhead of MTT-IBP, Exp-IBP, ForwAbs, PGD-5 and PGD-10 with respect to N-FGSM (which is used to compute the attack for MTL-IBP, Exp-IBP, ForwAbs) when training a PreActResNet18 on 80% of the CIFAR-10 training set using the cyclic schedule, complementing the information provided in figure 4 As described in $3.3 ForwAbs has minimal overhead with respect to N-FGSM. On the other hand, MTL-IBP and Exp-IBP display a runtime slightly smaller than PGD-5. As expected, PGD-10 training requires almost twice the time as PGD-5, and more than half the time as MTL- IBP and Exp-IBP. Figure 17 instead, plots the respective training overheads when training CNN-7 and CMN-5 using the cyclic schedule. The relative runtimes across methods remain similar PreActResNet18, with the runtime of each algorithm markedly smaller the CNN models, and for the 5-layer network. Differently from the experiments in 55 all these runtime measurements were carried out on the same machine under constant load (see also appendix C.2
Figure 6b
70
Extiaatd upocch nundinee 64)
192
122
202
02
20-
Peredbo
Punbls
Exp
PCD-10
(a)
CNN-7
CNN-5.
Figure 17: Box plots (10 repetitions) for the CIFAR-10 training time of single epoch (using 80% subset of the training set) on CNN-7 and CNN-5.
27

---

Published in Transactions on Machine Learning Research (03/2025)
Figure 18 explicitly plots trade-offs between runtime and empirical robustness. In particular, fig- ures 18a and 18c respectively plot the runtimes from figures 17a and 6b against the AA accuracies reported for CIFAR-10 at e 24/255 within figures 6a and Sa. Differently from the cyelic schedule, the long schedule (160 epochs) used for the experiments of table does not have a constant training cost throughout the epochs (see appendix C. all moth start with a warmup epoch that requires additionally evaluating the network on clean inputs, and methods using IBP bounds (Exp-IBP and TBP) employ the regularizer from Shi et al. (2021) control the bounds in earlier epochs, increasing their overhead until epoch 81. Figure 18b plots the AA accuracies for CIFAR-10 at 24/255 from table against the per-epoch runtimes from figure 7a for N-FGSM, PGD-5, PGD-10 and Forw (hence providing an estimate of long-schedule runtime after warmmup on 80% of the CIFAR-10 training set), and against the per-epoch runtimes (also com- puted on 80% the training set, after warmup) of Exp-IBP and IBP when the bounds regularizer is active. Across the three setups, both ForwAbs and Exp-IBP consistently outperform PGD-5, with the former in- curring a relatively small overhead compared N-FGSM. On the long schedule, IBP outperforms all the other algorithms despite its low runtime, including the stronger multi-step baseline PGD-10.
0.25
0.25
0.20
0.20
AutuAitack atourscy
acourayy
815
0.10
NFGGM
3.05
ForwAbs
PGD
FGD-5
PGD-10 10
PGD-10
IBP
4.
60
80
100
120
140
1:6
40
60
80
100
120
140
160
Extimated cuntime epoch (4)
Estimated nuntime per spoch 16)
(a) CNN-7, CIFAR-10, e = 24/253, setup of figure Sa
(b) CNN-7, CIFAR-10, c = 24/255, setup of table
0.25
AutoNtack acuuaty
Figure 18: Trade-offs between estimated per- epoch runtime and AA accuracy on CIFAR-10 for 24/255.
0.15
0.10
Exp
ForwAbs
PGD4
3.00
150
350
400
450
Estimated runtime
(c) PreactResNet18, CIFAR-10, 24/255, setup of
figure 6a
D.3 Supplement to FGSM experiments
Figure 19
plots The training adversarial accuracy computed via FGSM, the atlack employed to generate
Badv.A for all training methods in this experiment, associated to the plots in figure 5 The behavior of the training adversarial accuracy for FGSM, which spikes up for c = $/255 roughly when its validation PGD-7 accuracy goes towards (cf. figure and attains very large values for c 24/255 in spite of its null validation PGD-7 accuracy, is clear marker of catastrophic overfitting.
28

---

Published in Transactions on Machine Learning Research (03/2025)
Exp-BB FCSH
0.8
FGSM AcC.
Esp-inP
POSH
0.6
0.6
ForwAbs
MTL-iBP
0.2
10
15
20
25
30
10
15
20
25
30
Epachs
toochs
(a) FGSM training accuracy for 8/255.
(b) FGSM training accuracy for 24/253
Figure 19: Training FGSM accuracy for the experiments from figure
D.4 Clean Accuracies and IBP Loss for N-FGSM Experiments
We here provide omitted clean accuracies and IBP losses for the experiments for figures 8 to 9 and table 1 Figure 20 provides the results for the eyclic training schedule on PreActResNet18, CNN-7 and CNN-5. It is clear that the positive effects associated to the certified training schemes (the mitigation or prevention of catastrophic overfitting in $5. and the empirical robustness improvements detailed in (5.2) come a cost in clean accuracy, which speaking, visible in figure 21 Exp-IBP altains significantly better trade-ofls between clean accuracy and IBP loss, especially when compared to MTL-IBP. As result, Exp-IBP is to be preferred if IBP accuracy is the primary metric. Table 3 presents the clean accuracies and IBP losses pertaining to the long schedule experiment from table additionally presenting comparison between the IBP losses of the certified training schemes tuned for empirical robustness and the adversarial training baselines whose IBP loss was shown in figure ! all cases, certified training schemes decrease the IBP loss compared to the adversarial training basclines at cost in standard accuracy, with larger cost associated to greater reduction IBP loss. We conclude by pointing that an allernative luning criterion (considering trade-off's between standard accuracy and empirical robustness) could result in more favorable trade-offs. This not the focus of the presented experiments.
limitation of these methods and of enforcing low IBP loss. Generally
Table 3: Clean accuracies and IBP losses for the experiments table 1
Dataset
Method
Clean acc. [%]
IBP loss
ExP-IBP
76,30 = 0.43
(1.90 + 0.55) x 10
IBP
39.37 = 1.51
1.92 +: 0.01
FORW ABS
74.26 = 0.28
(2.05 0.11)) x 104
201
PCD-10
77.07 = 0.31
(9.70 0.85) x 10a
PGD-5
79.81 = 0.38
(1.72 x 10
N-FGSM
77.28 0.26
(1.91 0.14) x 10"
Exp-IBP
31.30 = 2.13
2.15 = 0.02
31.65 = 0.53
2.13
CIFAR-10
755
16
PGD-10
RORWABS
58.44
46.54
(T.72 + x 10'
(3.57 0.333 x 10
PGD-5
6107=0.
(1.01 x 10
N-FGSM
9.16
(2.93 2.66)
10"
ExP-IBP
23.03
2.25 0.02
EXP-IBP PGD-5
27.32
2.23 0.02
24
IBP
23.51200
2.22 0.01
706
FORWABS
30.15 = 0.37
8.73 0.53
PGD-10
39.99
(2.60 10"
PGD-5
0.37
(2.13 10
N-FGSM
57.46 9.60
(3.31 1.55) 10
EXP-IBP
Exp IBP
6.85 1.29
4.49 0.02
TBP
7.29 0.61
4.45 + 0.01
CIFAR-IO0 100
24
FORWABS
16.85 = 0.67
(5.79 x 10a
255
PGD-10
23.56 0.61
(2.19 10
PGD-5
28.53 0.46
(6.12 10a
N-FGSM
29.07 3.01
(6.50 1.92) x 108
29

---

Published in Transactions on Machine Learning Research (03/2025)
0.7
POD-S
Exp-IBP
FerwAbs
N-FGSM
Olenn Accuracy
0.6
Figure 20: Clean accuracics for the experiments from figures G and g Means and 95% con- fidence intervals over 5 repetitions.
24
Epsilon
(a) PreActResNet18, CIFAR-10. 10.
0.45
0.94
FonwAss
MTL-IBP
0.40
0.92
Exp IBP
Clan Accuacy
0.35
N-FGSM
0.90
0.30
Clean
0.88
0.25
ForwAbs
MTL-IBP
0.84
N-FGSM
12
Epsiion
Epsioon
(b) PreActResNet18, CIFAR-100.
(c) PreActResNiet1,, SVHN.
PGB-10
0.6
PGD-5
ForwAbs
Clean Accurscy
EXp-IBP
0.5
PGD 10
Clean Arc
N-FGSM
ForwAbs
0.4
Exp-IBP
N-FM5M
0.4
0.3
0.2
12
Epsilon
Epsiion
(d) CNN-7, CIFAR-10.
(e) CNN-5, CIFAR-II 10.
0.325
Cran Accuray
Cran Accuracy
0.775
0.500
PGD-10
0.255
PGD-10
ForwAbs
EXP-IPP
0.000
Exp-IBP
N-FGSM
N-FGSM
12
20
36
20
24
Epsiion
Epsilon
(f) CNK-7, CIFAR-100.
CNN-5, CTFA 1000.
30

---

Published in Transactions on Machine Learning Research (03/2025)
10a
ForwAbs
107
Exp-IBP
107
10
Figure 21: IBP losses of methods from experiments from figures and Means and standard deviations over 5 repetitions.
3 for the
101
10a
10
102
12
24
Epsilon
(a) PreActResNet18, CIEAR-10.
104
10
104
1041
20
ForwAbs Exp-IBP
Low
FerwAbs
MTL/IBP
202
1010
10a
Epsiion
(b) PreActResNet18, CIFAR-100.
(c) PreActResNiet18, SVHN.
Exp-BP
3.0
ForwAbs
18P Losn
IBP
Exp-UPP
104
Epsiion
(d) CNN-7, CIFAR-10.
(e) CNN-5, CIFAR- 10.
189 101
ISP LoNS
20'
102
ForwAbs Exp-IBP
ForwAbs EXp-IBP
16
24
Epsilon
Eprilon
(f) CNK-7, C10.R-100.
CNN-5, C-F0R-100.
31

---

Published in Transactions on Machine Learning Research (03/2025)
Table 4: Validation empirical robustness of the last model and of the model corresponding to the best PGD-50 accuracy when training PreActResNet18 with the cyclic schedule (means and 95% Cls for runs).
Dataset
Method
Final AA acc. [%]
Selected AA acc. [%
EXP-IBP
15.88
1.39
15.42 2.37
CIFAR-I0
20
FORW ABs
14.22 1.68
14.96 +: 1.29
255
N-FGSM
10.34 5.43
12.80 + 2.34
EXP-IBP
3.74 1.01
3.92 0.96
CIFAR- 100
FORW ABs
4.14
4.08 0.78
N-FGSM
2.20 = 2.29
4.34 0.50
D.5 Validation CO Study
This appendix presents study on the behavior of Exp-IBP and ForwAbs over the course of training epochs, aimed at providing further insights into their effect on CO when applied on top of N-FGSM. Specifically, we evaluate on a holdout set of 1000 images, and train on the remainder of the original training set. We compute the PGD-50 accuracy at each epoch, and store two models for a more accurate empirical robustness evaluation via AutoAttack: the one corresponding to the best PGD-50 accuracy (we call this the selected model), and the final model. We focus on two PreActResNet18 sctups: CIFAR-10
20/25,, and CIFAR- 100 24/255, which are the benchmarks in which N-FGSM displays the worst average AuloAttack accuracy within figures 6 and 7a
Table 4 shows that, on both settings, Exp-IBP and ForwAbs significantly reduce the variability between the final and the selected models compared to N-FGSM, further confirming their ability to prevent CO. On CIFAR-10, 10, both methods attain stronger empirical robustness than the selected N-FGSM models, showing that they are preferable to early stopping with an expensive attack on this dataset. While this is not immediately confirmed on the harder CIFAR-100, we point out that a tuming process aware of early stopping may likely bring to different conclusion: this is beyond the scope of the experiment. Exp-IBP and Fbs were with the following coefficients: on CIFAR-10. 10,
2x 10- for Exp-IBP, and Ā = 10-22 for ForwAbs; on CIFAR-100, a = 5 x 10 for Exp-IBP, and = 10 18 for ForwAbs. These coincide with the coefficients employed for figures 6 and 7a except for ForwAbs on CIFAR-10, where the new runs for this experiment showed some signs of CO for these dataset splits using À = 10-24 and hence prompted us to employ a larger coefficient for this appendix, pointing to some degree of experimental variability (cf. figure 10b which does not display CO even for significantly smaller coefficient values). We remark that the ForwAbs coefficient for figure 6 was tuned using single seed, on different dataset split, c = 24/255: variability could likely be reduced by tuning on multiple seeds and for the same perturbation radius.
D.6 Effect of Model Architecture
The experimental results in 5 show that the relative efficacy of certified training schemes towards empirical robustness improves on shallower networks. The present appendix is devoted to providing further insights on this phenomenon.
D.6.1 Effect of Model Architecture on Method Performance
Table presents an analysis of the effect of model size on the performance of both multi-step adversarial training and certified training techniques, grouping in table form the results from figures 6a
Sa
and Sb
on
Table 5: Effect of model architecture on AutoAttack accuracy on CIFAR-10 with = 24/255. Results from
figures 6a Sa.
and Sb [means and standard deviations for 5 runs).
Architecture
Exp-IBP AA sec. [%] ForwAbs AA acc. [%|
PGD-5 AA scc. [%]
PGD-10 AA acc. [%]
PReACTRESNer118
13.67 + 1.30
12.92 + 0.34
12.39 + 0.96
15.83 + 1.05
CNN-7
14.50 + 0.81
14.98 + 0.37
13.29 1 0.37
16.03
0.52
CNN-5
15.26 + 0.35
14.36 + 0.32
12.94 + 0.23
15.28 + 0.58
32

---

Published in Transactions on Machine Learning Research (03/2025)
Table 6: TBP loss at initialization for the network architectures considered in this work, computed on the
CLEAR-10 training set against perturbations of radius e = 24/255 (means and standard deviations for 5 runs).
Architecture
IBP loss
PReAcTReaNEr18
(2.20 0.06) x 1016
CNN-7
(8.67 + 0.18) x 10s
CNN-5
(1.11 + 0.01) 10
CIFAR-10 with e - 24/25.. Differently from 55 where the focus was relative performance across methods, here we concentrate on the impact of model architecture on the performance of each method. All considered algorithms attain larger empirical robustness on CNN-7 compared to PreActResNet18, Remarkably, and dif- ferently from all the other techniques, the AutoAttack accuracy of Exp-IBP is maximized on CNN-5, suggest- ing that smaller networks may be particularly beneficial to expressive losses under shorter training schedules.
D.6.2 IBP Losses at Initialization across Architectures
In order to provide further insights on the results from and table we compute the IBP loss at initialization on the three network architectures employed in this work, which provides an indication of the size of the IBP network over-approximation. Specifically, we measure the average TBP loss over the standard CIFAR-10 training set, against perturbations of radius = 24/255. Table x explode with the model depth, with PreActResNe118 displaying an IBP loss at initialization that is several orders of magnitude larger than those of the two employed CNN architectures. As result, the significantly smaller IBP loss values associated with maximal AutoAttack accuracy (see figure 21 come at larger cost in terms of empirical robustness, resulting in worse performance trade-offs. Finally, CNN-7 features an IBP loss almost two orders of magnitude larger than CNN-5, explaining the qualitative differences in behavior from figure g
shows that, as expected, the network bounds
D.7 Comparison with ELLE
The main objective of this work is to demonstrate that certified training techniques can be success- fully employed towards empirical robustness, hence beyond their original design goal. As part of the provided evidence, section 5.1 shows that Exp-IBP and ForwAbs can prevent CO on settings common to the single-step adversarial training literature. In order to contextualize their performance for the task, this appendix provides comparison of the performance of Exp-IBP, MTL-IBP and ForwAbs with ELLE-A [Rocamora et al.) ) a slate-of-the-arl method designed to prevent calastrophic overfitting.
The experimental setup is the one from figures schedule). As for the cortified training techniques, We use N-FGSM as underlying adversarial attack. The runtime overhead of ELLE-A, which slightly smaller than MTL-IBP and Exp-IBP, and significantly larger than ForwAbs on an Nvidia GTX 1080Ti GPU, is reported in figure 22d While the original work (Rocamora) et al.] 2024) reports less overhead for ELLE-A, which requires 3 batched forward passes to compute its regularization term, we found its overhead to be heavily dependent leading to faster execution of the batched forward pass (the original work relies an Nvidia A100 SXM4 GPU). We tuned the ELLE-A hyper-parameter λELLE, which controls the amount of regularization imposed on a notion of local lincarity proposed by the authors, consistently with the way MTL-IBP, Exp-IBP and Forw Abs were tuned for figures 0 and 7 The tuning resulted in the following values: λELLE = 6000 for CIFAR-10 (which maximizes both the validation PGD-50 and AA accuracy), λELLE = 3000 for CIFAR-100, and λELLE 1000 for SVHN.
G and 7 (a PreActResNet18 trained with a cyclic training
the GPU model, with newer models
As reported in Figure 22 ELLE-A prevents CO across all settings. Remarkably, CIFAR-10, certified train- ing techniques match or outperform ELLE-A in AA accuracy for c 2 20/255, with EXp-IBP outperforming ELLE-A while also producing non-negligible certified robustness via IBP. We believe this suggests that verifi- ability and empirical robustness are not conflicting objectives in this setup. Furthermore, ForwAbs performs at least competitively with ELLE-A on all the considered epsilons while reducing its overhead. The situation is drastically different on the harder CIFAR-100, where ELLE-A markedly outperforms certified training schemes. We speculate the employed network may lack the capacity to sustain tight over-approximations
33

---

Published in Transactions on Machine Learning Research (03/2025)
14,000 &/ Accurscy
0.25
MTL.IBP
BLLE-
ForwAbs
0.34
ForwAbs
ELLE-A
0.20
Exp-IBP
0.12
Exp-IBP
0.30
0.15
0.08
0.10
0.06
0.00
0.04
12
16
Epsiion
20
24
16
Epston
20
24
(a) CIEAR 10, AA (solid lines) and IBP accuracies (dashed).
(b) CIFAR-100.
BLLE-A
220
ForwAbs
0.5
MTL-IPP
250
Exp-IBP
Acccurr
0.4
380
0.3
Entimateed sporth
3.0
240
0.2
220
6.1
200
0.0
10
80
14NGON
Fanddba
NTL
Cxp-33
ELLEA
Epsilan
(d) Box plots (10 runs) for the CIFAR-10 training time of a single epoch, estimated on a 80% subset of the training set.
(c) SVHN.
Figure 22: Comparison of certified training techniques with ELLE-A (Rocamora et al. of-the-art regularizer for singe-step adversarial training. Setup from figures and 7 We report means over repetitions and their 95% confidence intervals.
2024 the state-
0.7
ELLE-A
0.45
ELLE-A
ForwAbs
FerwAbs
MTL-IBP
0.40
MTL-IBP
0.6
Exp-IBP
0.35
Clean Acc
0.5
0.30
0.25
0.20
0.3
0.15
16
Epalion
Epsion
(a) CIFARIO.
(b) CIFAR-100.
ELLE-A ForwAbs MTL:1BP
0.92
Exp-I0P
Oron
Figure 23: Clean accuracies for the experiments reported in Figure 22
0.88
0.84
10
Epsilon
(c) SVHN.
34

---

Published in Transactions on Machine Learning Research (03/2025)
0.15
0.05
ExprBP
0.04
KTLIBP
Exp IBP
ForwAls
0.10
0.03
FLSM
ForwAbs
0.05
0.01
0.00
0.00
25
15
30
Epocts
(a) PGD-7 7 (solid) and IBP (dashed) acc., CIFAR-10.
(b) PGD-7 (solid) and IBP (dashed) acc., CIFAR-100
30
101
Exp-IPP
Exp-IBP
10.3
MIL--P
19
MILIBP
TonaAbs
ForwAbs
10
TGSM
10
107
10'
10
25
10
15
30
Epocts
Epochs
(c) IBP loss for CIFAR-10.
(d) IBP loss for CIFAR-100.
When applied on top FGSM, certified training techniques can prevent CO beyond ReLU networks. Results with a modified PreActResNet:18 employing SoftPlus activations, for perturbations of 24/255 on the CIFAR-10 and CIFAR-100 test sets.
Figure 24:
while preserving empirical robustness. On SVHN, except MTL-IBP which fails owing to the sensitivity of its loss discussed in 55.1 all the algorithms attain similar performance profiles, with the most robust algorithm depending on the perturbation radius. Figure 23 reports the corresponding clean accuracies: on average ELL.F-A has less impact on clean accuracy than certified training schemes, except for SVHN, where expressive losses display larger standard performance, and on CIFAR-10 for e = 24/255, where ForwAbs does. In summary of this appendix, we argue that, on casier datasets such as CIFAR-10, cortified training tech- niques such as Exp-IBP and ForwAbs should be considered as strong baselines for CO prevention by the single-step adversarial training community.
D.8 Preventing Catastrophic Overfitting SoftPlus
We here present results demonstrating that certified training schemes can enhance empirical robustness beyond piecewise-linear networks. In particular, we focus on a modified PreActResNet18 architecture, for which each ReLU is replaced by SoftPlus activation, relying the training schedule from figure 5] Owing
to the monotonicity of SoftPlus, IBP bounds can be computed using the procedure outlined in $2.3. and
using the auto_ LiRPA library, which we also employ for ReLU networks (sce appendix C.1 We leave the ForwAbs implementation unvaried with respect to 3.3
provides results for CIFAR-10 and CIFAR-100 at E = 24/255, for which we show FGSM to highly vulnerable CO. Mirroring the experimental procedure for figure 5 we demonstrate that MTL-IBP, EXP-IBP and ForwAbs can all prevent CO on this setting. Similarly to the ReLU experiments, this involves significantly decreasing the IBP loss compared to FGSM. Figure 24 plots the following coefficient values: CIFAR-10, a 5 x 10-3 for Exp-IBP,
Figure 24
2 x 10-11 for MTL-IBP, X = 10-20 for ForwAbs; CIFAR-100, a = 1 x 10 for Exp-IBP, = 10 10 for MTL-IBP, 10 20 for ForwAbs.
E Previous Work on the Empirical Accuracy of Certified Training
We now comment on the relationship between 5 and literature results, explicit or implicit, on the empirical accuracy of certified training algorithms (see $
particular, ( additional experiments studying
CO within setups from the certified training literature (De Palma et al. 2024bb
35

---

Published in Transactions on Machine Learning Research (03/2025)
E.1
Empirical Robustness Evaluations
While this was not the focus of their works, Gowal et al.
(018 Mao et al. (2024a) both demonstrated that certified training schemes (including IBP for Gowal et al. (2018), IBP, SABR and MTL-IBP for Mao et al.
(2024a)) outperform multi-step adversarial training on large perturbation radii on MNIST for relatively shallow convolutional networks. Specifically, [oowal et al. (2018) showed that IBP outperforms PGD-7 training in terms of PGD-200-10 (PGD with 200 iterations and 10 restarts) accuracy for c E (0.3, 0.4), when using a 100-epoch training schedule. [Mao et al. (2024a) tuned the certified training schemes to maximize certified robustness, and then positively compared their empirical robustness, measured through the attacks within MN-BaB, a complete verifier based on branch-and- bound- (Ferrari al. 2022), to the AA accuracy of PGD-5-3 training for = 0.3 (using a 70-epoch training schedule). Morcover, De Bartolomeis et al. (2023) report that, on MNIST, IBP (Shi et al. 2021 outperforms adversarial training based on a 10-step AutoPGD (Croce& & Hein 2020) attack in terms of AA accuracy for e E {0.1, 0.2, 0.3, 0.4). However, they employ inconsistent training schedules and optimizers across methods, and their adversarial training baseline severely under-performa compared to other works (Mao et al. 2024a]. We omit MNIST from our main study owing to its relative simplicity, and to our focus on settings typically considered the single-step adversarial
training literature (de Jorge et al. 2022 Rocamora al.
2024 Andriushchenko & Flammarion 2020
Furthermore, Gowal et al. (2018): Mao et al. Gowal et al. 2018). SABR and MTI-IBP for Mao et al. (2024a)) can outperform multi-step attacks in
(2024a) reported that certified training schemes (IBP for
terms of empirical robustness using CNN-7 for 6= =/255 on CIFAR-10. Gowal et al. (2018) employ 3200-
epoch training schedule, using which PGD-7 and IBP respectively attain 34.77% and 24.95% PGD-200-10
accuracy. Mao et al. (2024a) rely instead on a 240-epoch schedule and again tune certified training schemes to maximize cortified robustness, reporting 35.93% AA accuracy for PGD-10-3, 36.11% and 36.02% MN-
BaB empirical robustanss for SABR and MTL-IBP, respectively. In addition, De Bartolomeis et al. (2023) reports better AA accuracy for IBP Shi et al. 2021 (32.5%), using 160-epoch schedule, compared to 10- step AutoPGD (Croce & Hein 2020 (30.2%) on CIFAR-10 for e = 8/255 using a residual network. However, as for their MNIST experiments, the comparison employs different training schedules and optimizers for the various methods, and features an empirically weak adversarial training baseline. We remark that. N-FGSM already attains 37.76% average AA accuracy using the same network architecture in table []] outperforming the results reported above for both adversarial and certified training, and highlighting the importance of strong baselines and appropriate regularization. In fact, differently from Mao et al. (2024a), who adopt & regularization also for the adversarial training baselines, we use weight decay (with coefficient 5 x 10-5), which is more commonly adopted in the adversarial training literature to combat robust overfitting.
E.2 CO in Certified Training Setups
The strong certified robustness results reported in previous work can be employed to draw conclusions on CO, exploiting the fact that certified accuracy lower bounds the empirical accuracy to any attack. It is easy to conclude that any certified training scheme which lacks an adversarial training component (see (2.3) is
trivially immune to CO (Gowal et al. 2018 Shi et al.) 2021 Zhang et al. 2020). Nevertheless, these are neither applicable in all training contexts (sco (3.2) nor necessarily associated to the best performance MMüller et al. 2023). For a < 1 tuned for certified robustness via verifiers based on branch-and-bound, the results reported in De Palma et al. (2024b) imply the absence of CO on the relative CC-IBP, MTL-IBP and Exp-IBP runs. As reported by De Palma et al. (202bb] appendix G.9), this is in spite of the fact that they rely randomized attack that always lands a corner of the perturbation region and was shown to display CO by previous work in different experimental setup (Wong el al. 2020 However, as highlighted in $4.3 fully demonstrating that the reported results imply the ability of expressive losses to prevent CO requires showing that the underlying onc-step attack (a = 0) would display CO in the specific experimental sctting. We here carry out such investigation, whose results are provided in table 7 In particular, we compare the average AutoAttack accuracy from RS-FGSM r = 10.0c, the one-step attack employed in most expressive loss results
from De Palma et al. (2024b with the best AutoAttack accuracy obtained from the published expressive losses checkpoints from De Palma et al. (2024b). Table shows that the one-step attack displays systematic
eexcept on CIFAR-10 with e 3/256, for which De Palma al. 20244g use multi-step attack.
36

---

Published in Transactions on Machine Learning Research (03/2025)
Table 7: CO study on CNN-7 setups from the certified training literature. We report mean and 95% over 5 runs for the one-step attack used in most expressive loss results from De Palma (2024b), and compare it with the best AutoAttack accuracy across the relative published CC-IBP, MTL-IBP and Exp-IBP checkpoints De Palma al. 2024b).
MNIST 0.1 MNIST - 0.3 CIFAR-10 - 2/255
CIFAR-10
8/258
TinyImageNet
1/255
Method
AA acc. [X]]
AA acc. [%]]
AA acc. [%]]
AA acc.
[%]
AA acc. [%6
RS-FGSM 10.0c
83.84 39.02
0.00
74.46
0.44
0.00
28.92
0.17
BEST EXPRESSIVE Loss
98.48
94.02
69.33
36.50
28. 28.46
CO on MNIST with c 0.3 and on CIFAR-10 with c c= $/255, and some signs of CO on MNIST with c 0.1. In all cases, this is effectively prevented by the expressive losses runs from the literature. heless, mirroring what is outlined in appendix E1 point out that the empirical robustness of literature models is still disappointing if compared with stronger one-step baselines. For CIFAR-10 with $/255, N-FGSM attains 37.76 77.76% average AA accuracy on the same network (table !
E.3
Comparison to
Differently from the previous literature, this work (:5 5.11
presents systematic analysis of the ability of certified training schemes to prevent CO on setups from the single-step adversarial training literature, and 5.2 extends the study by examining settings where certified training schemnes relying on single-step attacks can overcome multi-step attacks.
Owing to the strong sensitivity of CO and of expressive losses (sce appendix D.6 to the specific experimental setup, the conclusions in $5.1 do not trivially follow neither from the previous literature, nor from our study in appendix F.2 For instance, figure X shows that the occurrence of CO depends the network architecture even for the same training schedule, dataset, and perturbation radius, and comparison with table I illustrates the effect of changes in the training schedule. Compared to the literature discussed in appendix E. 5.2 provides a fair and systematic comparison (relying on the same strong atlack suite (Croce & Hein 2020). which also used as tuning metric on validation) which includes larger perturbation radii (up to e 24/255), the harder CIFAR-100 dataset, and a shorter cylic training schedule more common in the adversarial training literature.
Crucially, throughout 5 rather than simply assessing the robustness of certified training schemes deployed to maximize certified robustness, also tune these algorithms for empirical robustness. This can make a difference in practice. For instance, Exp-IBP attains 38, 38.44% average AA accuracy in our experiments for = 8/255 with a = 5 x 10-3 on CIFAR-10, outperforming N-FGSM and PGD-5 from table 1 the results from table E.2 with a = 0.5, and all values reported by Mao et al. (2024a).
37


Reviews:
[{"review_id": "EwpMh3HWaC", "reviewer": "Reviewer_J5KY", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "> Strengths:\n\n- The paper addresses a critical challenge in adversarial robustness—closing the gap between empirical and certified robustness. This is both timely and relevant, given the need for robustness guarantees in safety-critical applications.\n- Exp-IBP and ForwAbs effectively mitigate CO in single-step adversarial training. Introducing ForwAbs for improving empirical robustness with reduced overhead.\n- The paper is well articulated and structured.\n\n> Weakness:\n\n- The claim that Exp-IBP can outperform multi-step adversarial training baselines is valid only under carefully tuned setups and for specific datasets (CIFAR10), which diminishes its generality. \n- The reliance on extensive hyperparameter tuning (α for Exp-IBP and λ for ForwAbs) makes the method less practical for broader adoption, especially in large-scale settings. Also, it will be interesting to add sensitivity studies to analyze the effect of α and λ  over a range on both accuracy under different perturbation levels.\n- Lack of comparison against stronger multi-step adversarial training methods like TRADES, MART, or more recent AutoAttacks.\n-  Shallow CNNs (CNN-5/7) benefit most, while deeper models (PreActResNet18) show mixed results. The paper does not investigate why deeper networks struggle.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper shows that certified training methods like Exp-IBP and the proposed ForwAbs regularizer prevent catastrophic overfitting and reduce computational costs by approximating certified bounds efficiently in single-step adversarial training, matching multi-step methods in empirical robustness on CIFAR-10 for perturbations.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Address the questions raised in the weaknesses section.", "broader_impact_concerns": "No", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "anVl6XTyxE", "reviewer": "Reviewer_i76a", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\n- To the best of my knowledege there is only a small number of works comparing and combining empirical and certified robustification approaches. \n- The authors conduct an extensive study on combining IBP with adversarial training and demonstrate cases where certified robustness approaches can achieve competitive empirical robustness. This finding may motivate further research into this area, such as investigations on the empirical robustness of Lipschitz-constant architectures or the combination of Lipschitz-bound and empirical methods.\n- The authors provide further insights into catastrophic overfitting by relating it to the IBP objective\n- For all claims sufficient experimental evidence is provided\n\n**Weaknesses** \n\nW1: While I personally think that studies conducted on cifar10 are sufficient for this kind of research it would have been interesting to see if the proposed approach follows the same scaling trends as standard adv. training procedures concerning model size and dataset size. The biggest improvements in robustness have been made by scaling dataset size. \n\nW2: Could the authors provide an experiment investigating the difference between the maximum validation robust accuracy and the last validation robust accuracy to get further insights on the ability of IBP losses to reduce CO?\n\nW3: I understood that the authors did not try to push sota robustness in their work. However, some robustness values for larger epsilon balls appear to be very small and it is a bit unclear if an improvement in this regime is important?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors explore the utility of certified training schemes to boost empirical robustness in adversarial training. They find a connection between the phenomenon of catastrophic forgetting observed in fast adversarial training algorithms and local linearity of network gradients. Specifically, they show that IBP losses of multi-step adversarial trained networks are considerably lower compared to those trained with single-step attacks, which motivates them to explore combining single-step methods with IBP. \n1) They find that combining single-step adv. training with state-of-the-art IBP losses is competitive to multi-step adversarial training with sufficient hyperparameter tuning \n2) They investigate shallow networks in more detail and demonstrate that long training schedules and IBP can outperform standard adv. training in some cases.\n3) They propose an efficient to compute alternative loss to IBP, which prevents catastrophic overfitting and enables fast and robust single-step adv. training.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "- Add a study investigating best vs. last robust accuracy using a validation set\n- Could the authors clarify on the concern stated in W3?", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "DqiDWVod1G", "reviewer": "Reviewer_PdVS", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n\n* Key Insight Validation: The study identifies how multi-step attacks inherently promote robustness, providing a new perspective on certified training's utility for empirical defenses.\n*  Technique: ForwAbs introduces a computationally efficient alternative, reducing overhead without significantly compromising IBP effectiveness.\n\n\nWeaknesses\n*  Limited Scope of Activation Functions: The techniques and bounds proposed are optimized for ReLU activation, limiting applicability to networks using other activation types.\n* Unclear Messages in Section 5.1: The narrative of key results lacks clarity, making it difficult for readers to distill the main takeaways.\n* Efficiency Claims in Appendix: Core claims of computational efficiency for the proposed methods are relegated to the appendix, undermining their significance.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "1. Main Insight of paper - Multi-step adversarial attacks tighten network over-approximations, reducing IBP (Interval Bound Propagation) loss, unlike single-step attacks, which are prone to catastrophic overfitting. The authors hypothesize that certified training can enhance robustness for single-step adversarial training methods.\n\n2. Empirical Findings: \n    * Certified training with Exp-IBP prevents catastrophic overfitting.\n    * On shallower networks, IBP outperforms multi-step adversarial baselines like PGD-10 under specific conditions.\n    * A novel regularizer, ForwAbs, achieves robustness similar to Exp-IBP while being computationally cheaper.\n\n3. The introduction of ForwAbs as a proxy for IBP loss demonstrates to balance compute efficiency and performance.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Improve Clarity in Section 5:\n\n    a. Split results into distinct experiments, the current 5.1 and 5.2 sections are providing multiple results and many takeaways and is very hard to parse for the reader.\n\n    b. At the end of each experiment consider summarizing key takeaways. \n\n2. Reorganize Efficiency Discussion:\n\n    a. The main claim to fame for ForwAbs is efficiency. Relocate runtime analyses from Appendix D.2 to the main body.\n\n    b. Include a trade-off analysis plot showing compute costs (runtime on x-axis) versus robustness (AA accuracy/IBP accuracy on y-axis) to emphasize where the compute-robustness trade-offs lie for various methods.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "XIa8zTu2Ss", "reviewer": "Reviewer_u13t", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths:\n1. The paper is well-written and includes a thorough summary of related works.\n2. Results are presented clearly across various experimental settings.\n\n### Weaknesses and Questions:\n1. The reviewer is concerned about whether the paper provides sufficient new insights for the community’s interest. As discussed in Section 4.3, it is well understood that certified training tends to exhibit strong empirical robustness under certain conditions, such as for small networks or large adversarial perturbation budgets. In both cases, the certification becomes tighter, and the model behaves more linearly. The training objective proposed in this paper essentially combines standard adversarial loss with a certified objective. Consequently, compared to multi-step adversarial training, the proposed method is effective when either of these two conditions is met.\nFurthermore, the contribution of Exp-IBP in preventing catastrophic overfitting (CO) appears to be implicitly covered by the findings of De Palma et al. (2024b). They demonstrated that Exp-IBP, when used with one-step adversarial examples, can achieve strong certified robustness (a lower bound of empirical robustness), thereby mitigating CO.\n2. The paper emphasizes that “certified and adversarial training have so far evolved as two orthogonal lines of work with distinct objectives… This belief is consolidated by a wide and persisting performance gap between the best-reported certified and empirical reobustness for a given setup.” However, this claim feels overstated. Many certified robustness studies also examine empirical robustness; adversarial training inherently targets at empirical robustness and thus, only empirically robustness is evaluated (the certified robustness performance will be poor). The gap between certified and empirical robustness is expected, as certified robustness is constrained by the certification method and serves as a lower bound, while empirical robustness is an upper bound based on empirical evaluations. Better certification and training, and better empirical attacks will make the gap smaller. The reviewer feels like the Orthogonality is overemphasized here.\n3. Figure 5 – Evaluation with AA:Could the authors evaluate empirical robustness using AutoAttack (AA)? The community recognizes that even PGD-7 can suffer from gradient obfuscation, making AA a more reliable benchmark.\n4. Figure 6: The color representation of PGD-10 should be consistent across the two subfigures to aid interpretation.\n5. All methods utilizing a certified objective show lower clean accuracy compared to adversarial training, as indicated in Appendix D.4. This is a significant limitation and warrants discussion in the main paper.\n6. Table 3.3 highlights significant variations in the alpha parameter across different settings. While using certified objectives may reduce computational overhead, the tuning process for alpha appears complex. This complexity might negate the claimed time savings compared to direct adversarial training. Results examining the sensitivity of robustness outcomes to alpha are needed, especially given the frequent mention of \"explicit tuning\" in the paper.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes leveraging various certified training methods combined with single-step attacks to achieve strong empirical robustness, surpassing adversarial training with multi-step attacks. This approach reduces computational overhead and mitigates catastrophic overfitting.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "1. Provide responses to the weaknesses 1 and 2.\n2. Discuss the limitation of lower clean accuracy in the main paper.\n3. Add a new graph illustrating how changes in alpha affect empirical robustness.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: All reviewers recommend accept. Reviewer u13t (Leaning Accept) recommends leaning towards accepting after rebuttal with the added graph. Reviewer i76a (Accept) recommends acceptance after the rebuttal sufficiently addresses original concerns. Reviewer PdVS (Leaning Accept) addresses the limitations but has no further reasons to reject the paper.
Decision: Accept (poster)