Title: Asymmetric Certified Robustness via Feature-Convex Neural Networks
Venue: NeurIPS 2023
Accepted: yes
Keywords: asymmetric certified robustness

input-convex neural networks
Abstract: Real-world adversarial attacks on machine learning models often feature an asymmetric structure wherein adversaries only attempt to induce false negatives (e.g., classify a spam email as not spam). We formalize the asymmetric robustness certification problem and correspondingly present the feature-convex neural network architecture, which composes an input-convex neural network (ICNN) with a Lipschitz continuous feature map in order to achieve asymmetric adversarial robustness. We consider the aforementioned binary setting with one "sensitive" class, and for this class we prove deterministic, closed-form, and easily-computable certified robust radii for arbitrary $\ell_p$-norms. We theoretically justify the use of these models by characterizing their decision region geometry, extending the universal approximation theorem for ICNN regression to the classification setting, and proving a lower bound on the probability that such models perfectly fit even unstructured uniformly distributed data in sufficiently high dimensions. Experiments on Malimg malware classification and subsets of the MNIST, Fashion-MNIST, and CIFAR-10 datasets show that feature-convex classifiers attain substantial certified $\ell_1$, $\ell_2$, and $\ell_{\infty}$-radii while being far more computationally efficient than competitive baselines.

Asymmetric Certified Robustness via Feature-Convex Neural Networks

Abstract

Real-world adversarial attacks on machine learning models often feature an asymmetric structure wherein adversaries only attempt to induce false negatives (e.g., classify a spam email as not spam). We formalize the asymmetric robustness certification problem and correspondingly present the feature-convex neural network architecture, which composes an input-convex neural network (ICNN) with a Lipschitz continuous feature map in order to achieve asymmetric adversarial robustness. We consider the aforementioned binary setting with one 'sensitive' class, and for this class we prove deterministic, closed-form, and easily-computable certified robust radii for arbitrary glyph[lscript] p -norms. We theoretically justify the use of these models by extending the universal approximation theorem for ICNN regression to the classification setting, and proving a lower bound on the probability that such models perfectly fit even unstructured uniformly distributed data in sufficiently high dimensions. Experiments on Malimg malware classification and subsets of the MNIST, Fashion-MNIST, and CIFAR-10 datasets show that feature-convex classifiers attain substantial certified glyph[lscript] 1 , glyph[lscript] 2 , and glyph[lscript] ∞ -radii while being far more computationally efficient than competitive baselines. 1

1 Introduction

Although neural networks achieve state-of-the-art performance across a range of machine learning tasks, researchers have shown that they can be highly sensitive to adversarial inputs that are maliciously designed to fool the model [11, 61, 52]. For example, the works Eykholt et al. [22] and Liu et al. [42] show that small physical and digital alterations of vehicle traffic signs can cause image classifiers to fail. In safety-critical applications of neural networks, such as autonomous driving [12, 69] and medical diagnostics [1, 71], this sensitivity to adversarial inputs is clearly unacceptable.

A line of heuristic defenses against adversarial inputs has been proposed, only to be defeated by stronger attack methods [14, 36, 7, 64, 46]. This has led researchers to develop certifiably robust methods that provide a provable guarantee of safe performance. The strength of such certificates can be highly dependent on network architecture; general off-the-shelf models tend to have large Lipschitz constants, leading to loose Lipschitz-based robustness guarantees [29, 23, 73]. Consequently, lines of work that impose certificate-amenable structures onto networks have been popularized, e.g., specialized model layers [63, 77], randomized smoothing-based networks [41, 18, 76, 72, 3], and ReLU networks that are certified using convex optimization and mixed-integer programming [68, 67, 54, 4, 45]. The first category only directly certifies against one specific choice of norm, producing poorly scaled radii for other norms in high dimensions. The latter two approaches incur serious computational challenges: randomized smoothing typically requires the classification of thousands

of randomly perturbed samples per input, while optimization-based solutions scale poorly to large networks.

Despite the moderate success of these certifiable classifiers, conventional assumptions in the literature are unnecessarily restrictive for many practical adversarial settings. Specifically, most works consider a multiclass setting where certificates are desired for inputs of any class. By contrast, many real-world adversarial attacks involve a binary setting with only one sensitive class that must be robust to adversarial perturbations. Consider the representative problem of spam classification; a malicious adversary crafting a spam email will only attempt to fool the classifier toward the 'not-spam' classnever conversely [20]. Similar logic applies for a range of applications such as malware detection [28], malicious network traffic filtering [56], fake news and social media bot detection [19], hate speech removal [27], insurance claims filtering [24], and financial fraud detection [15].

The important asymmetric nature of these classification problems has long been recognized in various subfields, and some domain-specific attempts at robustification have been proposed with this in mind. This commonly involves robustifying against adversaries appending features to the classifier input. In spam classification, such an attack is known as the 'good word' attack [44]. In malware detection, numerous approaches have been proposed to provably counter such additive-only adversaries using special classifier structures such as non-negative networks [25] and monotonic classifiers [32]. We note these works strictly focus on additive adversaries and cannot handle general adversarial perturbations of the input that are capable of perturbing existing features. We propose adding this important asymmetric structure to the study of norm ball-certifiably robust classifiers. This narrowing of the problem to the asymmetric setting provides prospects for novel certifiable architectures, and we present feature-convex neural networks as one such possibility.

1.1 Problem Statement and Contributions

This section formalizes the asymmetric robustness certification problem for general norm-bounded adversaries. Specifically, we assume a binary classification setting wherein one class is 'sensitive'meaning we seek to certify that, if some input is classified into this sensitive class, then adversarial perturbations of sufficiently small magnitude cannot change the prediction.

Formally, consider a binary classifier f τ : R d →{ 1 , 2 } , where class 1 is the sensitive class for which we desire certificates. We take f τ to be a standard thresholded version of a soft classifier g : R d → R , expressible as f τ ( x ) = T τ ( g ( x )) , where T τ : R →{ 1 , 2 } is the thresholding function defined by with τ ∈ R being a user-specified parameter that shifts the classification threshold. A classifier f τ is considered certifiably robust at a class 1 input x ∈ R d with a radius r ( x ) ∈ R + if f τ ( x + δ ) = f τ ( x ) = 1 for all δ ∈ R d with ‖ δ ‖ < r ( x ) for some norm ‖ · ‖ . Thus, τ induces a tradeoff between the clean accuracy on class 2 and certification performance on class 1 . As τ →∞ , f τ approaches a constant classifier which achieves infinite class 1 certified radii but has zero class 2 accuracy.

For a particular choice of τ , the performance of f τ can be analyzed similarly to a typical certified classifier. Namely, it exhibits a class 2 clean accuracy α 2 ( τ ) ∈ [0 , 1] as well as a class 1 certified accuracy surface Γ with values Γ( r, τ ) ∈ [0 , 1] that capture the fraction of the class 1 samples that can be certifiably classified by f τ at radius r ∈ R + . The class 1 clean accuracy α 1 ( τ ) = Γ(0 , τ ) is inferable from Γ as the certified accuracy at r = 0 .

The full asymmetric certification performance of the family of classifiers f τ can be captured by plotting the surface Γ( r, τ ) , as will be shown in Figure 1a. Instead of plotting against τ directly, we plot against the more informative difference in clean accuracies α 1 ( τ ) -α 2 ( τ ) . This surface can be viewed as an asymmetric robustness analogue to the classic receiver operating characteristic curve.

Note that while computing the asymmetric robustness surface is possible for our feature-convex architecture (to be defined shortly), it is computationally prohibitive for conventional certification methods. We therefore standardize our comparisons throughout this work to the certified accuracy cross section Γ( r, τ ∗ ) for a τ ∗ such that clean accuracies are balanced in the sense that α 2 ( τ ∗ ) = α 1 ( τ ∗ ) , noting that α 1 monotonically increases in τ and α 2 mononically decreases in τ . We discuss finding such a τ ∗ in Appendix E.4. This choice allows for a direct comparison of the resulting certified accuracy curves without considering the non-sensitive class clean accuracy.

With the above formalization in place, the goal at hand is two-fold: 1) develop a classification architecture tailored for the asymmetric setting with high robustness, as characterized by the surface Γ , and 2) provide efficient methods for computing the certified robust radii r ( x ) used to generate Γ .

Contributions. We tackle the above two goals by proposing feature-convex neural networks and achieve the following contributions:

We exploit the feature-convex structure of the proposed classifier to provide asymmetrically tailored closed-form class 1 certified robust radii for arbitrary glyph[lscript] p -norms, solving the second goal above and yielding efficient computation of Γ .

We characterize the decision region geometry of convex classifiers, extend the universal approximation theorem for input-convex ReLU neural networks to the classification setting, and show that convex classifiers are sufficiently expressive for high-dimensional data.

We evaluate against several baselines on MNIST 3-8 [37], Malimg malware classification [50], Fashion-MNIST shirts [70], and CIFAR-10 cats-dogs [35], and show that our classifiers yield certified robust radii competitive with the state-of-the-art, empirically addressing the first goal listed above.

All proofs and appendices can be found in the Supplemental Material.

1.2 Related Works

Certified adversarial robustness. Three of the most popular approaches for generating robustness certificates are Lipschitz-based bounds, randomized smoothing, and optimization-based methods. Successfully bounding the Lipschitz constant of a neural network can give rise to an efficient certified radius of robustness, e.g., via the methods proposed in Hein and Andriushchenko [29]. However, in practice such Lipschitz constants are too large to yield meaningful certificates, or it is computationally burdensome to compute or bound the Lipschitz constants in the first place [65, 23, 73]. To overcome these computational limitations, certain methods impose special structures on their model layers to provide immediate Lipschitz guarantees. Specifically, Trockman and Kolter [63] uses the Cayley transform to derive convolutional layers with immediate glyph[lscript] 2 -Lipschitz constants, and Zhang et al. [77] introduces a glyph[lscript] ∞ -distance neuron that provides similar Lipschitz guarantees with respect to the glyph[lscript] ∞ -norm. We compare with both these approaches in our experiments.

Randomized smoothing, popularized by Lecuyer et al. [38], Li et al. [41], Cohen et al. [18], uses the expected prediction of a model when subjected to Gaussian input noise. These works derive glyph[lscript] 2 -norm balls around inputs on which the smoothed classifier remains constant, but suffer from nondeterminism and high computational burden. Follow-up works generalize randomized smoothing to certify input regions defined by different metrics, e.g., Wasserstein, glyph[lscript] 1 -, and glyph[lscript] ∞ -norms [39, 62, 72]. Other works focus on enlarging the certified regions by optimizing the smoothing distribution [76, 21, 5], incorporating adversarial training into the base classifier [57, 78], and employing dimensionality reduction at the input [53].

Optimization-based certificates typically seek to derive a tractable over-approximation of the set of possible outputs when the input is subject to adversarial perturbations, and show that this overapproximation is safe. Various over-approximations have been proposed, e.g., based on linear programming and bounding [68, 67], semidefinite programming [54], and branch-and-bound [4, 45, 66]. The α, β -CROWN method [66] uses an efficient bound propagation to linearly bound the neural network output in conjunction with a per-neuron branching heuristic to achieve state-ofthe-art certified radii, winning both the 2021 and the 2022 VNN certification competitions [8, 48]. In contrast to optimization-based methods, our approach directly exploits the convex structure of input-convex neural networks to derive closed-form robustness certificates, altogether avoiding any efficiency-tightness tradeoffs.

Input-convex neural networks. Input-convex neural networks, popularized by Amos et al. [2], are a class of parameterized models whose input-output mapping is convex. The authors develop tractable methods to learn input-convex neural networks, and show that such models yield state-ofthe-art results in a variety of domains where convexity may be exploited, e.g., optimization-based inference. Subsequent works propose novel applications of input-convex neural networks in areas

such as optimal control and reinforcement learning [16, 75], optimal transport [47], and optimal power flow [17, 79]. Other works have generalized input-convex networks to input-invex networks [58, 51] and global optimization networks [80] so as to maintain the benign optimization properties of input-convexity. The authors of Siahkamari et al. [59] present algorithms for efficiently learning convex functions, while Chen et al. [16], Kim and Kim [34] derive universal approximation theorems for input-convex neural networks in the convex regression setting. The work Sivaprasad et al. [60] shows that input-convex neural networks do not suffer from overfitting, and generalize better than multilayer perceptrons on common benchmark datasets. In this work, we incorporate input-convex neural networks as a part of our feature-convex architecture and leverage convexity properties to derive novel robustness guarantees.

1.3 Notations

The sets of natural numbers, real numbers, and nonnegative real numbers are denoted by N , R , and R + respectively. The d × d identity matrix is written as I d ∈ R d × d , and the identity map on R d is denoted by Id: x ↦→ x . For A ∈ R n × d , we define | A | ∈ R n × d by | A | ij = | A ij | for all i, j , and we write A ≥ 0 if and only if A ij ≥ 0 for all i, j . The glyph[lscript] p -norm on R d is given by ‖ · ‖ p : x ↦→ ( | x 1 | p + · · · + | x d | p ) 1 /p for p ∈ [1 , ∞ ) and by ‖ · ‖ p : x ↦→ max {| x 1 | , . . . , | x d |} for p = ∞ . The dual norm of ‖ · ‖ p is denoted by ‖ · ‖ p, ∗ . The convex hull of a set X ⊆ R d is denoted by conv( X ) . The subdifferential of a convex function g : R d → R at x ∈ R d is denoted by ∂g ( x ) . If glyph[epsilon1] : Ω → R d is a random variable on a probability space (Ω , B , P ) and P is a predicate defined on R d , then we write P ( P ( glyph[epsilon1] )) to mean P ( { ω ∈ Ω : P ( glyph[epsilon1] ( ω )) } ) . Lebesgue measure on R d is denoted by m . We define ReLU: R → R as ReLU( x ) = max { 0 , x } , and if x ∈ R d , ReLU( x ) denotes (ReLU( x 1 ) , . . . , ReLU( x d )) . We recall the threshold function T τ : R →{ 1 , 2 } defined by (1), and we define T = T 0 . For a function ϕ : R d → R q and p ∈ [1 , ∞ ] , we define Lip p ( ϕ ) = inf { K ≥ 0 : ‖ ϕ ( x ) -ϕ ( x ′ ) ‖ p ≤ K ‖ x -x ′ ‖ p for all x, x ′ ∈ R d } , and if Lip p ( ϕ ) < ∞ we say that ϕ is Lipschitz continuous with constant Lip p ( ϕ ) (with respect to the glyph[lscript] p -norm).

2 Feature-Convex Classifiers

Let d, q ∈ N and p ∈ [1 , ∞ ] be fixed, and consider the task of classifying inputs from a subset of R d into a fixed set of classes Y ⊆ N . In what follows, we restrict to the binary setting where Y = { 1 , 2 } and class 1 is the sensitive class for which we desire robustness certificates (Section 1). In Appendix A, we briefly discuss avenues to generalize our framework to multiclass settings using one-versus-all and sequential classification methodologies and provide a proof-of-concept example for the Malimg dataset.

We now formally define the classifiers considered in this work. Note that the classification threshold τ discussed in Section 1.1 is omitted for simplicity.

Definition 2.1. Let f : R d →{ 1 , 2 } be defined by f ( x ) = T ( g ( ϕ ( x ))) for some ϕ : R d → R q and some g : R q → R . Then f is said to be a feature-convex classifier if the feature map ϕ is Lipschitz continuous with constant Lip p ( ϕ ) < ∞ and g is a convex function.

We denote the class of all feature-convex classifiers by F . Furthermore, for q = d , the subclass of all feature-convex classifiers with ϕ = Id is denoted by F Id .

As we will see in Section 3.1, defining our classifiers using the composition of a convex classifier with a Lipschitz feature map enables the fast computation of certified regions in the input space. This naturally arises from the global underestimation of convex functions by first-order Taylor approximations. Since sublevel sets of such g are restricted to be convex, the feature map ϕ is included to increase the representation power of our architecture (see Appendix B for a motivating example). In practice, we find that it suffices to choose ϕ to be a simple map with a small closedform Lipschitz constant. For example, in our experiments that follow with q = 2 d , we choose ϕ ( x ) = ( x -µ, | x -µ | ) with a constant channel-wise dataset mean µ , yielding Lip 1 ( ϕ ) ≤ 2 , Lip 2 ( ϕ ) ≤ √ 2 , and Lip ∞ ( ϕ ) ≤ 1 . Although this particular choice of ϕ is convex, the function g need not be monotone, and therefore the composition g ◦ ϕ is nonconvex in general. The prediction and certification of feature-convex classifiers are illustrated in Figure 1b.

glyph[lscript]

1

-radius

0

5

10

15

20

25

Clean accuracy difference

-

0

.

6

-

0

.

4

-

0

.

2

0

.

0

0

.

2

0

.

4

Certified accuracy

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

(a)

Input

space

Feature

space

Logit

Input

certificate

Feature

certificate

Margin

Prediction

Certification

g

ϕ

(

x

)

g

(

ϕ

(

x

))

glyph[lscript]

2

:

glyph[lscript]

1

:

glyph[lscript]

∞

:

ϕ

(Lipschitz)

g

Convexity

Lipschitzness

(b)

In practice, we implement feature-convex classifiers using parameterizations of g , which we now make explicit. Following Amos et al. [2], we instantiate g as a neural network with nonnegative weight matrices and nondecreasing convex nonlinearities. Specifically, we consider ReLU nonlinearities, which is not restrictive, as our universal approximation result in Theorem 3.6 proves.

Definition 2.2. A feature-convex ReLU neural network is a function ˆ f : R d →{ 1 , 2 } defined by ˆ f ( x ) = T (ˆ g ( ϕ ( x ))) with ϕ : R d → R q Lipschitz continuous with constant Lip p ( ϕ ) < ∞ and ˆ g : R q → R defined by

for all l ∈ { 1 , 2 , . . . , L -1 } for some L ∈ N , L > 1 , and for some consistently sized matrices A ( l ) , C ( l ) and vectors b ( l ) satisfying A ( l ) ≥ 0 for all l ∈ { 2 , 3 , . . . , L } .

Going forward, we denote the class of all feature-convex ReLU neural networks by ˆ F . Furthermore, if q = d , the subclass of all feature-convex ReLU neural networks with ϕ = Id is denoted by ˆ F Id , which corresponds to the input-convex ReLU neural networks proposed in Amos et al. [2].

For every ˆ f ∈ ˆ F , it holds that ˆ g is convex due to the rules for composition and nonnegatively weighted sums of convex functions [13, Section 3.2], and therefore ˆ F ⊆ F and ˆ F Id ⊆ F Id . The 'passthrough' weights C ( l ) were originally included by Amos et al. [2] to improve the practical performance of the architecture. In some of our more challenging experiments that follow, we remove these passthrough operations and instead add residual identity mappings between hidden layers, which also preserves convexity. We note that the transformations defined by A ( l ) and C ( l ) can be taken to be convolutions, which are nonnegatively weighted linear operations and thus preserve convexity [2].

3 Certification and Analysis of Feature-Convex Classifiers

We present our main theoretical results in this section. First, we derive asymmetric robustness certificates (Theorem 3.1) for our feature-convex classifiers in Section 3.1. Then, in Section 3.2, we introduce the notion of convexly separable sets in order to theoretically characterize the representation power of our classifiers. Our primary representation results give a universal function approximation

theorem for our classifiers with ϕ = Id and ReLU activation functions (Theorem 3.6) and show that such classifiers can perfectly fit convexly separable datasets (Theorem 3.7), including the CIFAR-10 cats-dogs training data (Fact 3.8). We also show that this strong learning capacity generalizes by proving that feature-convex classifiers can perfectly fit high-dimensional uniformly distributed data with high probability (Theorem 3.10).

3.1 Certified Robustness Guarantees

In this section, we address the asymmetric certified robustness problem by providing class 1 robustness certificates for feature-convex classifiers f ∈ F . Such robustness corresponds to proving the absence of false negatives in the case that class 1 represents positives and class 2 represents negatives. For example, if in a malware detection setting class 1 represents malware and class 2 represents nonmalware, the following certificate gives a lower bound on the magnitude of the malware file alteration needed in order to misclassify the file as non-malware.

Theorem 3.1. Let f ∈ F be as in Definition 2.1 and let x ∈ f -1 ( { 1 } ) = { x ′ ∈ R d : f ( x ′ ) = 1 } . If ∇ g ( ϕ ( x )) ∈ R q is a nonzero subgradient of the convex function g at ϕ ( x ) , then f ( x + δ ) = 1 for all δ ∈ R d such that

Remark 3.2 . For f ∈ F and x ∈ f -1 ( { 1 } ) , a subgradient ∇ g ( ϕ ( x )) ∈ R q of g always exists at ϕ ( x ) , since the subdifferential ∂g ( ϕ ( x )) is a nonempty closed bounded convex set, as g is a finite convex function on all of R q -see Theorem 23.4 in Rockafellar [55] and the discussion thereafter. Furthermore, if f is not a constant classifier, such a subgradient ∇ g ( ϕ ( x )) must necessarily be nonzero, since, if it were zero, then g ( y ) ≥ g ( ϕ ( x )) + ∇ g ( ϕ ( x )) glyph[latticetop] ( y -ϕ ( x )) = g ( ϕ ( x )) > 0 for all y ∈ R q , implying that f identically predicts class 1 , which is a contradiction. Thus, the certified radius given in Theorem 3.1 is always well-defined in practical settings.

Theorem 3.1 is derived from the fact that a convex function is globally underapproximated by any tangent plane. The nonconstant terms in Theorem 3.1 afford an intuitive interpretation: the radius scales proportionally to the confidence g ( ϕ ( x )) and inversely with the input sensitivity ‖∇ g ( ϕ ( x )) ‖ p, ∗ . In practice, Lip p ( ϕ ) can be made quite small as mentioned in Section 2, and furthermore the subgradient ∇ g ( ϕ ( x )) is easily evaluated as the Jacobian of g at ϕ ( x ) using standard automatic differentiation packages. This provides fast, deterministic class 1 certificates for any glyph[lscript] p -norm without modification of the feature-convex network's training procedure or architecture. We emphasize that our robustness certificates of Theorem 3.1 are independent of the architecture of f .

3.2 Representation Power Characterization

We now restrict our analysis to the class F Id of feature-convex classifiers with an identity feature map. This can be equivalently considered as the class of classifiers for which the input-to-logit map is convex. We therefore refer to models in F Id as input-convex classifiers . While the feature map ϕ is useful in boosting the practical performance of our classifiers, the theoretical results in this section suggest that there is significant potential in using input-convex classifiers as a standalone solution.

Classifying convexly separable sets. We begin by introducing the notion of convexly separable sets, which are intimately related to decision regions representable by the class F Id .

Notice that it may be the case that a pair ( X 1 , X 2 ) is convexly separable yet the pair ( X 2 , X 1 ) is not. Although low-dimensional intuition may raise concerns regarding the convex separability of binary-labeled data, we will soon see in Fact 3.8 and Theorem 3.10 that convex separability typically holds in high dimensions. We now show that convexly separable datasets possess the property that they may always be perfectly fit by input-convex classifiers.

Definition 3.3. Let X 1 , X 2 ⊆ R d . The ordered pair ( X 1 , X 2 ) is said to be convexly separable if there exists a nonempty closed convex set X ⊆ R d such that X 2 ⊆ X and X 1 ⊆ R d \ X .

Proposition 3.4. For any nonempty closed convex set X ⊆ R d , there exists f ∈ F Id such that X = f -1 ( { 2 } ) = { x ∈ R d : f ( x ) = 2 } . In particular, this shows that if ( X 1 , X 2 ) is a convexly

separable pair of subsets of R d , then there exists f ∈ F Id such that f ( x ) = 1 for all x ∈ X 1 and f ( x ) = 2 for all x ∈ X 2 .

We also show that the converse of Proposition 3.4 holds: the geometry of the decision regions of classifiers in F Id consists of a convex set and its complement.

Proposition 3.5. Let f ∈ F Id . The decision region under f associated to class 2 , namely X := f -1 ( { 2 } ) = { x ∈ R d : f ( x ) = 2 } , is a closed convex set.

Note that this is not necessarily true for our more general feature-convex architectures with ϕ = Id . We continue our theoretical analysis of input-convex classifiers by extending the universal approximation theorem for regressing upon real-valued convex functions (given in Chen et al. [16]) to the classification setting. In particular, Theorem 3.6 below shows that any input-convex classifier f ∈ F Id can be approximated arbitrarily well on any compact set by ReLU neural networks with nonnegative weights. Here, 'arbitrarily well' means that the set of inputs where the neural network prediction differs from that of f can be made to have arbitrarily small Lebesgue measure.

glyph[negationslash]

Theorem 3.6. For any f ∈ F Id , any compact convex subset X of R d , and any glyph[epsilon1] > 0 , there exists ˆ f ∈ ˆ F Id such that m ( { x ∈ X : ˆ f ( x ) = f ( x ) } ) < glyph[epsilon1] .

glyph[negationslash]

An extension of the proof of Theorem 3.6 combined with Proposition 3.4 yields that input-convex ReLU neural networks can perfectly fit convexly separable sampled datasets.

Theorem 3.7. If ( X 1 , X 2 ) is a convexly separable pair of finite subsets of R d , then there exists ˆ f ∈ ˆ F Id such that ˆ f ( x ) = 1 for all x ∈ X 1 and ˆ f ( x ) = 2 for all x ∈ X 2 .

Theorems 3.6 and 3.7, being specialized to models with ReLU activation functions, theoretically justify the particular parameterization in Definition 2.2 for learning feature-convex classifiers to fit convexly separable data.

Empirical convex separability. Interestingly, we find empirically that high-dimensional image training data is convexly separable. We illustrate this in Appendix D by attempting to reconstruct a CIFAR-10 cat image from a convex combination of the dogs and vice versa; the error is significantly positive for every sample in the training dataset, and image reconstruction is visually poor. This fact, combined with Theorem 3.7, immediately yields the following result.

Fact 3.8. There exists ˆ f ∈ ˆ F Id such that ˆ f achieves perfect training accuracy for the unaugmented CIFAR-10 cats-versus-dogs dataset.

The gap between this theoretical guarantee and our practical performance is large; without the feature map, our CIFAR-10 cats-dogs classifier achieves just 73 . 4% training accuracy (Table 4). While high training accuracy does not necessarily imply strong test set performance, Fact 3.8 demonstrates that the typical deep learning paradigm of overfitting to the training dataset is theoretically attainable [49]. We thus posit that there is substantial room for improvement in the design and optimization of input-convex classifiers. We leave the challenge of overfitting to the CIFAR-10 cats-dogs training data with an input-convex classifier as an open research problem for the field.

Open Problem 3.9. Learn an input-convex ReLU neural network that achieves 100% training accuracy on the unaugmented CIFAR-10 cats-versus-dogs dataset.

Convex separability in high dimensions. We conclude by investigating why the convex separability property that allows for Fact 3.8 may hold for natural image datasets. We argue that dimensionality facilitates this phenomenon by showing that data is easily separated by some f ∈ ˆ F Id when d is sufficiently large. In particular, although it may seem restrictive to rely on models in ˆ F Id with convex class 2 decision regions, we show in Theorem 3.10 below that even uninformative data distributions that are seemingly difficult to classify may be fit by such models with high probability as the dimensionality of the data increases.

Theorem 3.10. Consider M,N ∈ N . Let X 1 = { x (1) , . . . , x ( M ) } ⊆ R d and X 2 = { y (1) , . . . , y ( N ) } ⊆ R d be samples with all elements x ( i ) k , y ( j ) l drawn independently and identi-

cally from the uniform probability distribution on [ -1 , 1] . Then, it holds that

In particular, ˆ F Id contains an input-convex ReLU neural network that classifies all x ( i ) into class 1 and all y ( j ) into class 2 almost surely for sufficiently large dimensions d .

Although the uniformly distributed data in Theorem 3.10 is unrealistic in practice, the result demonstrates that the class ˆ F Id of input-convex ReLU neural networks has sufficient complexity to fit even the most unstructured data in high dimensions. Despite this ability, researchers have found that current input-convex neural networks tend to not overfit in practice, yielding small generalization gaps relative to conventional neural networks [60]. Achieving the modern deep learning paradigm of overfitting to the training dataset with input-convex networks is an exciting open challenge [49].

4 Experiments

This section compares our feature-convex classifiers against a variety of state-of-the-art baselines in the asymmetric setting. Before discussing the results, we briefly describe the datasets, baselines, and architectures used. For a more in-depth description and hyperparameter details, see Appendix E.

Datasets. We use four datasets. First, we consider distinguishing between 28 × 28 greyscale MNIST digits 3 and 8 [37], which are generally more visually similar and challenging to distinguish than other digit pairs. Next, we consider identifying malware from the 'Allaple.A' class in the Malimg dataset of 512 × 512 bytewise encodings of malware [50]. Next, we consider distinguishing between shirts and T-shirts in the Fashion-MNIST dataset of 28 × 28 greyscale images [70], which tend to be the hardest classes to distinguish [33]. Finally, we consider the 32 × 32 RGB CIFAR-10 cat and dog images since they are relatively difficult to distinguish [26, 43, 30]. The latter two datasets can be considered as our more challenging settings. All pixel values are normalized into the interval [0 , 1] .

Baseline Methods. We consider several state-of-the-art randomized and deterministic baselines. For all datasets, we evaluate the randomized smoothing certificates of Yang et al. [72] for the Gaussian, Laplacian, and uniform distributions trained with noise augmentation (denoted RS Gaussian, RS Laplacian, and RS Uniform, respectively), as well as the deterministic bound propagation framework α, β -CROWN [66], which is scatter plotted since certification is only reported as a binary answer at a given radius. We also evaluate, when applicable, deterministic certified methods for each norm ball. These include the splitting-noise glyph[lscript] 1 -certificates from Levine and Feizi [40] (denoted Splitting), the orthogonality-based glyph[lscript] 2 -certificates from Trockman and Kolter [63] (denoted Cayley), and the glyph[lscript] ∞ -distance-based glyph[lscript] ∞ -certificates from Zhang et al. [77] (denoted glyph[lscript] ∞ -Net). The last two deterministic methods are not evaluated on the large-scale Malimg dataset due to their prohibitive runtime. Furthermore, the glyph[lscript] ∞ -Net was unable to significantly outperform a random classifier on the CIFAR-10 cats-dogs dataset, and is therefore only included in the MNIST 3-8 and FashionMNIST shirts experiments. Notice that the three randomized smoothing baselines have fundamentally different predictions and certificates than the deterministic methods (including ours), namely, the predictions are random and the certificates hold only with high probability.

Feature-Convex Architecture. Our simple experiments (MNIST 3-8 and Malimg) require no feature map to achieve high accuracy ( ϕ = Id ). The Fashion-MNIST shirts dataset also benefited minimally from the feature map inclusion. For the CIFAR-10 cats-dogs task, we let our feature map be the concatenation ϕ ( x ) = ( x -µ, | x -µ | ) , as motivated by Appendix B, where µ is the channel-wise dataset mean (e.g., size 3 for an RGB image) broadcasted to the appropriate dimensions. Our MNIST 3-8 and Malimg architecture then consists of a simple two-hidden-layer input-convex multilayer perceptron with ( n 1 , n 2 ) = (200 , 50) hidden features, ReLU nonlinearities, and passthrough weights. For the Fashion-MNIST shirts (CIFAR-10 cats-dogs, resp.) dataset, we use a convex ConvNet architecture consisting of 3 ( 5 , resp.) convolutional, BatchNorm, and ReLU layers. All models are trained using SGD on the standard binary cross entropy loss with Jacobian regularization, and clean accuracies are balanced as described in Section 1.1 and Appendix E.4 to ensure a fair comparison of different robustness certificates.

Results and Discussion. Experimental results for glyph[lscript] 1 -norm certification are reported in Figure 2, where our feature-convex classifier radii, denoted by Convex*, are similar or better than all other baselines across all datasets. Also reported is each method's clean test accuracy without any attacks, denoted by 'clean.' Due to space constraints, we defer the corresponding plots for glyph[lscript] 2 - and glyph[lscript] ∞ -norm balls to Appendix F, where our certified radii are not dominant but still comparable to methods tailored specifically for a particular norm. We accomplish this while maintaining completely deterministic, closed-form certificates with orders-of-magnitude faster computation time than competitive baselines.

0

5

10

15

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

RS Uniform

Splitting

α, β

-CROWN

Cayley

glyph[lscript]

∞

-Net

[99.0% clean]

[99.8% clean]

[99.8% clean]

[99.6% clean]

[98.4% clean]

[99.2% clean]

[100 % clean]

[100 % clean]

(a) MNIST 3-8.

10

-

2

10

0

10

2

10

4

RS Uniform

Splitting

α, β

-CROWN

[97.9% clean]

[98.0% clean]

[98.0% clean]

[98.4% clean]

[98.6% clean]

[97.7% clean]

(b) Malimg.

0

10

20

30

glyph[lscript]

1

-radius

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

RS Uniform

Splitting

α, β

-CROWN

Cayley

glyph[lscript]

∞

-Net

[83.1% clean]

[80.5% clean]

[82.1% clean]

[80.7% clean]

[85.8% clean]

[83.9% clean]

[87.5% clean]

[79.4% clean]

(c) Fashion-MNIST shirts.

0

10

20

30

glyph[lscript]

1

-radius

RS Uniform

Splitting

α, β

-CROWN

Cayley

[68.0% clean]

[65.0% clean]

[66.6% clean]

[67.2% clean]

[73.0% clean]

[61.6% clean]

[76.1% clean]

(d) CIFAR-10 cats-dogs.

For the MNIST 3-8 and Malimg datasets (Figures 2a and 2b), all methods achieve high clean test accuracy. Our glyph[lscript] 1 -radii scale exceptionally well with the dimensionality of the input, with two orders of magnitude improvement over smoothing baselines for the Malimg dataset. The Malimg certificates in particular have an interesting concrete interpretation. As each pixel corresponds to one byte in the original malware file, an glyph[lscript] 1 -certificate of radius r provides a robustness certificate for up to r bytes in the file. Namely, even if a malware designer were to arbitrarily change r malware bytes, they would be unable to fool our classifier into returning a false negative. We note that this is primarily illustrative and is unlikely to have an immediate practical impact as small semantic changes (e.g., reordering unrelated instructions) can induce large glyph[lscript] p -norm shifts.

While our method produces competitive robustness certificates for glyph[lscript] 2 - and glyph[lscript] ∞ -norms (Appendix F), it offers the largest improvement for glyph[lscript] 1 -certificates in the high-dimensional image spaces considered. This is likely due to the characteristics of the subgradient dual norm factor in the denominator of

Theorem 3.1. The dual of the glyph[lscript] 1 -norm is the glyph[lscript] ∞ -norm, which selects the largest magnitude element in the gradient of the output logit with respect to the input pixels. As the input image scales, it is natural for the classifier to become less dependent on any one specific pixel, shrinking the denominator in Theorem 3.1. Conversely, when certifying for the glyph[lscript] ∞ -norm, one must evaluate the glyph[lscript] 1 -norm of the gradient, which scales proportionally to the input size. Nevertheless, we find in Appendix F that our glyph[lscript] 2 - and glyph[lscript] ∞ -radii are generally comparable those of the baselines while maintaining speed and determinism.

Our feature-convex neural network certificates are almost immediate, requiring just one forward pass and one backward pass through the network. This certification procedure requires a few milliseconds per sample on our hardware and scales well with network size. This is substantially faster than the runtime for randomized smoothing, which scales from several seconds per CIFAR-10 image to minutes for an ImageNet image [18]. The only method that rivaled our glyph[lscript] 1 -norm certificates was α, β -CROWN; however, such bound propagation frameworks suffer from exponential computational complexity in network size, and even for small CIFAR-10 ConvNets typically take on the order of minutes to certify nontrivial radii. For computational tractability, we therefore used a smaller network in our experiments (Appendix E). Certification time for all methods is reported in Table 1.

Unlike the randomized smoothing baselines, our method is completely deterministic in both prediction and certification. Randomized prediction poses a particular problem for randomized smoothing certificates: even for a perturbation of a 'certified' magnitude, repeated evaluations at the perturbed point will eventually yield misclassification for any nontrivial classifier. While the splitting-based certificates of Levine and Feizi [40] are deterministic, they only certify quantized (not continuous) glyph[lscript] 1 -perturbations, which scale poorly to glyph[lscript] 2 - and glyph[lscript] ∞ -certificates (Appendix F). Furthermore, the certification runtime grows linearly in the smoothing noise σ ; evaluating the certified radii at σ used for the Malimg experiment takes several minutes per sample.

Ablation tests examining the impact of Jacobian regularization, the feature map ϕ , and data augmentation are included in Appendix G. We illustrate the certification performance of our method across all combinations of MNIST classes in Appendix H.

5 Conclusion

This work introduces the problem of asymmetric certified robustness, which we show naturally applies to a number of practical adversarial settings. We define feature-convex classifiers in this context and theoretically characterize their representation power from geometric, approximation theoretic, and statistical lenses. Closed-form sensitive-class certified robust radii for the feature-convex architecture are provided for arbitrary glyph[lscript] p -norms. We find that our glyph[lscript] 1 -robustness certificates in particular match or outperform those of the current state-of-the-art methods, with our glyph[lscript] 2 - and glyph[lscript] ∞ -radii also competitive to methods tailored for a particular norm. Unlike smoothing and bound propagation baselines, we accomplish this with a completely deterministic and near-immediate computation scheme. We also show theoretically that significant performance improvements should be realizable for natural image datasets such as CIFAR-10 cats-versus-dogs. Possible directions for future research include bridging the gap between the theoretical power of feature-convex models and their practical implementation, as well as exploring more sophisticated choices of the feature map ϕ .

References

Filippo Amato, Alberto López, Eladia María Peña-Méndez, Petr Vaˇ nhara, Aleš Hampl, and Josef Havel. Artificial neural networks in medical diagnosis. Journal of Applied Biomedicine , 11(2):47-58, 2013.

Brandon Amos, Lei Xu, and J Zico Kolter. Input convex neural networks. In International Conference on Machine Learning , pages 146-155. PMLR, 2017.

Brendon G. Anderson and Somayeh Sojoudi. Certified robustness via locally biased randomized smoothing. In Learning for Dynamics and Control . PMLR, 2022.

Brendon G. Anderson, Ziye Ma, Jingqi Li, and Somayeh Sojoudi. Tightened convex relaxations for neural network robustness certification. In Proceedings of the 59th IEEE Conference on Decision and Control , 2020.

Brendon G. Anderson, Samuel Pfrommer, and Somayeh Sojoudi. Towards optimal randomized smoothing: A semi-infinite linear programming approach. In ICML Workshop on Formal Verification of Machine Learning , 2022.

MOSEK ApS. The MOSEK optimization toolbox for MATLAB manual. Version 9.0. , 2019. URL http://docs.mosek.com/9.0/toolbox/index.html .

Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning , pages 274-283. PMLR, 2018.

Stanley Bak, Changliu Liu, and Taylor Johnson. The second international verification of neural networks competition (VNN-COMP 2021): Summary and results. arXiv preprint arXiv:2109.00498 , 2021.

Randall Balestriero, Jerome Pesenti, and Yann LeCun. Learning in high dimension always amounts to extrapolation. arXiv preprint arXiv:2110.09485 , 2021.

Dimitri Bertsekas. Nonlinear Programming . Athena Scientific, 3rd edition, 2016.

Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndi´ c, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases , pages 387-402. Springer, 2013.

Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence D. Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, et al. End to end learning for self-driving cars. arXiv preprint arXiv:1604.07316 , 2016.

Stephen Boyd and Lieven Vandenberghe. Convex Optimization . Cambridge University Press, 2004.

Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , pages 3-14, 2017.

Francesco Cartella, Orlando Anunciacao, Yuki Funabiki, Daisuke Yamaguchi, Toru Akishita, and Olivier Elshocht. Adversarial attacks for tabular data: Application to fraud detection and imbalanced data. arXiv preprint arXiv:2101.08030 , 2021.

Yize Chen, Yuanyuan Shi, and Baosen Zhang. Optimal control via neural networks: A convex approach. In International Conference on Learning Representations , 2019.

Yize Chen, Yuanyuan Shi, and Baosen Zhang. Data-driven optimal voltage regulation using input convex neural networks. Electric Power Systems Research , 189:106741, 2020.

Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning , pages 1310-1320. PMLR, 2019.

Stefano Cresci, Marinella Petrocchi, Angelo Spognardi, and Stefano Tognazzi. Adversarial machine learning for protecting against online manipulation. IEEE Internet Computing , 26(2): 47-52, 2021.

Nilesh Dalvi, Pedro Domingos, Sumit Sanghai, and Deepak Verma. Adversarial classification. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining , pages 99-108, 2004.

Francisco Eiras, Motasem Alfarra, M Pawan Kumar, Philip HS Torr, Puneet K Dokania, Bernard Ghanem, and Adel Bibi. ANCER: Anisotropic certification via sample-wise volume maximization. arXiv preprint arXiv:2107.04570 , 2021.

Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 1625-1634, 2018.

Mahyar Fazlyab, Alexander Robey, Hamed Hassani, Manfred Morari, and George Pappas. Efficient and accurate estimation of Lipschitz constants for deep neural networks. Advances in Neural Information Processing Systems , 32, 2019.

Samuel G Finlayson, John D Bowers, Joichi Ito, Jonathan L Zittrain, Andrew L Beam, and Isaac S Kohane. Adversarial attacks on medical machine learning. Science , 363(6433):12871289, 2019.

William Fleshman, Edward Raff, Jared Sylvester, Steven Forsyth, and Mark McLean. Nonnegative networks against adversarial attacks. arXiv preprint arXiv:1806.06108 , 2018.

Felipe O Giuste and Juan C Vizcarra. CIFAR-10 image classification using feature ensembles. arXiv preprint arXiv:2002.03846 , 2020.

Edita Grolman, Hodaya Binyamini, Asaf Shabtai, Yuval Elovici, Ikuya Morikawa, and Toshiya Shimizu. HateVersarial: Adversarial attack against hate speech detection algorithms on Twitter. In Proceedings of the 30th ACM Conference on User Modeling, Adaptation and Personalization , pages 143-152, 2022.

Kathrin Grosse, Nicolas Papernot, Praveen Manoharan, Michael Backes, and Patrick McDaniel. Adversarial examples for malware detection. In European Symposium on Research in Computer Security , pages 62-79. Springer, 2017.

Matthias Hein and Maksym Andriushchenko. Formal guarantees on the robustness of a classifier against adversarial manipulation. Advances in Neural Information Processing Systems , 30, 2017.

Tien Ho-Phuoc. CIFAR10 to compare visual recognition performance between deep neural networks and humans. arXiv preprint arXiv:1811.07270 , 2018.

Judy Hoffman, Daniel A Roberts, and Sho Yaida. Robust learning with Jacobian regularization. arXiv preprint arXiv:1908.02729 , 2019.

Íñigo Íncer Romeo, Michael Theodorides, Sadia Afroz, and David Wagner. Adversarially robust malware detection using monotonic classification. In Proceedings of the Fourth ACM International Workshop on Security and Privacy Analytics , pages 54-63, 2018.

Mohammed Kayed, Ahmed Anter, and Hadeer Mohamed. Classification of garments from fashion MNIST dataset using CNN LeNet-5 architecture. In 2020 International Conference on Innovative Trends in Communication and Computer Engineering (ITCE) , pages 238-243. IEEE, 2020.

Jinrae Kim and Youdan Kim. Parameterized convex universal approximators for decisionmaking problems. IEEE Transactions on Neural Networks and Learning Systems , 2022.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In International Conference on Learning Representations , 2017.

Yann LeCun. The MNIST database of handwritten digits. http://yann.lecun.com/exdb/mnist/ , 1998.

Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In IEEE Symposium on Security and Privacy , pages 656-672. IEEE, 2019.

Alexander Levine and Soheil Feizi. Wasserstein smoothing: Certified robustness against Wasserstein adversarial attacks. In International Conference on Artificial Intelligence and Statistics , pages 3938-3947. PMLR, 2020.

Alexander J Levine and Soheil Feizi. Improved, deterministic smoothing for glyph[lscript] 1 certified robustness. In International Conference on Machine Learning , pages 6254-6264. PMLR, 2021.

Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with additive noise. In Advances in Neural Information Processing Systems , volume 32, 2019.

Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensitive GAN for generating adversarial patches. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 33, pages 1028-1035, 2019.

Qun Liu and Supratik Mukhopadhyay. Unsupervised learning using pretrained cnn and associative memory bank. In 2018 International Joint Conference on Neural Networks (IJCNN) , pages 01-08. IEEE, 2018.

Daniel Lowd and Christopher Meek. Good word attacks on statistical spam filters. In CEAS , volume 2005, 2005.

Ziye Ma and Somayeh Sojoudi. A sequential framework towards an exact SDP verification of neural networks. In 2021 IEEE 8th International Conference on Data Science and Advanced Analytics (DSAA) , pages 1-8. IEEE, 2021.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

Ashok Makkuva, Amirhossein Taghvaei, Sewoong Oh, and Jason Lee. Optimal transport mapping via input convex neural networks. In International Conference on Machine Learning , pages 6672-6681. PMLR, 2020.

Mark Niklas Müller, Christopher Brix, Stanley Bak, Changliu Liu, and Taylor T Johnson. The third international verification of neural networks competition (VNN-COMP 2022): Summary and results. arXiv preprint arXiv:2212.10376 , 2022.

Preetum Nakkiran, Gal Kaplun, Yamini Bansal, Tristan Yang, Boaz Barak, and Ilya Sutskever. Deep double descent: Where bigger models and more data hurt. Journal of Statistical Mechanics: Theory and Experiment , 2021(12):124003, 2021.

Lakshmanan Nataraj, Sreejith Karthikeyan, Gregoire Jacob, and Bangalore S Manjunath. Malware images: Visualization and automatic classification. In Proceedings of the 8th International Symposium on Visualization for Cyber Security , pages 1-7, 2011.

Vitali Nesterov, Fabricio Arend Torres, Monika Nagy-Huber, Maxim Samarin, and Volker Roth. Learning invariances with generalised input-convex neural networks. arXiv preprint arXiv:2204.07009 , 2022.

Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 427-436, 2015.

Samuel Pfrommer, Brendon G. Anderson, and Somayeh Sojoudi. Projected randomized smoothing for certified adversarial robustness. Preprint , 2022. URL https://brendon-anderson. github.io/files/publications/pfrommer2022projected.pdf .

Aditi Raghunathan, Jacob Steinhardt, and Percy S Liang. Semidefinite relaxations for certifying robustness to adversarial examples. In Advances in Neural Information Processing Systems , pages 10877-10887, 2018.

R Tyrrell Rockafellar. Convex Analysis . Princeton University Press, 1970.

Amir Mahdi Sadeghzadeh, Saeed Shiravi, and Rasool Jalili. Adversarial network traffic: Towards evaluating the robustness of deep-learning-based network traffic classification. IEEE Transactions on Network and Service Management , 18(2):1962-1976, 2021.

Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In Advances in Neural Information Processing Systems , volume 32, 2019.

Suman Sapkota and Binod Bhattarai. Input invex neural network. arXiv preprint arXiv:2106.08748 , 2021.

Ali Siahkamari, Durmus Alp Emre Acar, Christopher Liao, Kelly L Geyer, Venkatesh Saligrama, and Brian Kulis. Faster algorithms for learning convex functions. In International Conference on Machine Learning , pages 20176-20194. PMLR, 2022.

Sarath Sivaprasad, Ankur Singh, Naresh Manwani, and Vineet Gandhi. The curious case of convex neural networks. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases , pages 738-754. Springer, 2021.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations , 2014.

Jiaye Teng, Guang-He Lee, and Yang Yuan. glyph[lscript] 1 adversarial robustness certificates: A randomized smoothing approach. Preprint , 2020. URL https://openreview.net/forum?id= H1lQIgrFDS .

Asher Trockman and J Zico Kolter. Orthogonalizing convolutional layers with the Cayley transform. arXiv preprint arXiv:2104.07167 , 2021.

Jonathan Uesato, Brendan O'Donoghue, Pushmeet Kohli, and Aaron Oord. Adversarial risk and the dangers of evaluating against weak attacks. In International Conference on Machine Learning , pages 5025-5034. PMLR, 2018.

Aladin Virmaux and Kevin Scaman. Lipschitz regularity of deep neural networks: Analysis and efficient estimation. Advances in Neural Information Processing Systems , 31, 2018.

Shiqi Wang, Huan Zhang, Kaidi Xu, Xue Lin, Suman Jana, Cho-Jui Hsieh, and J Zico Kolter. Beta-CROWN: Efficient bound propagation with per-neuron split constraints for neural network robustness verification. Advances in Neural Information Processing Systems , 34:29909-29921, 2021.

Lily Weng, Huan Zhang, Hongge Chen, Zhao Song, Cho-Jui Hsieh, Luca Daniel, Duane Boning, and Inderjit Dhillon. Towards fast computation of certified robustness for ReLU networks. In International Conference on Machine Learning , pages 5276-5285. PMLR, 2018.

Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning , pages 5286-5295. PMLR, 2018.

Bichen Wu, Forrest Iandola, Peter H. Jin, and Kurt Keutzer. SqueezeDet: Unified, small, low power fully convolutional neural networks for real-time object detection for autonomous driving. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops , pages 129-137, 2017.

Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747 , 2017.

Samir S Yadav and Shivajirao M Jadhav. Deep convolutional neural network based medical image classification for disease diagnosis. Journal of Big Data , 6(1):1-18, 2019.

Greg Yang, Tony Duan, J Edward Hu, Hadi Salman, Ilya Razenshteyn, and Jerry Li. Randomized smoothing of all shapes and sizes. In International Conference on Machine Learning , pages 10693-10705. PMLR, 2020.

Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ R Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. Advances in Neural Information Processing Systems , 33:8588-8601, 2020.

Roozbeh Yousefzadeh. Deep learning generalization and the convex hull of training sets. In Neurips Deep Learning through Information Workshop , 2020.

Fancheng Zeng, Guanqiu Qi, Zhiqin Zhu, Jian Sun, Gang Hu, and Matthew Haner. Convex neural networks based reinforcement learning for load frequency control under denial of service attacks. Algorithms , 15(2):34, 2022.

Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. MACER: Attack-free and scalable robust training via maximizing certified radius. In International Conference on Learning Representations , 2020.

Bohang Zhang, Du Jiang, Di He, and Liwei Wang. Boosting the certified robustness of l-infinity distance nets. arXiv preprint arXiv:2110.06850 , 2021.

Dinghuai Zhang, Mao Ye, Chengyue Gong, Zhanxing Zhu, and Qiang Liu. Black-box certification with randomized smoothing: A functional optimization based framework. In Advances in Neural Information Processing Systems , volume 33, pages 2316-2326, 2020.

Ling Zhang, Yize Chen, and Baosen Zhang. A convex neural network solver for DCOPF with generalization guarantees. IEEE Transactions on Control of Network Systems , 2021.

Sen Zhao, Erez Louidor, and Maya Gupta. Global optimization networks. In International Conference on Machine Learning , pages 26927-26957. PMLR, 2022.

Supplementary Material

A Classification Framework Generalization

While outside the scope of our work, we note that there are two natural ways to extend our approach to a multiclass setting with one sensitive class. Let Y = { 1 , 2 , . . . , c } , with class 1 being the sensitive class for which we aim to generate certificates.

One approach involves a two-step architecture, where a feature-convex classifier first distinguishes between the sensitive class 1 and all other classes { 2 , 3 , . . . , c } and an arbitrary second classifier distinguishes between the classes { 2 , 3 , . . . , c } . The first classifier could then be used to generate class 1 certificates, as described in Section 3.1.

Alternatively, we could define g to map directly to c output logits, with the first logit convex in the input and the other logits concave in the input. Concavity can be easily achieved by negating the output of a convex network. Let the i th output logit then be denoted as g i and consider an input x where the classifier predicts class 1 (i.e., g 1 ( ϕ ( x )) ≥ g i ( ϕ ( x )) for all i ∈ { 2 , 3 , . . . , c } ); since the difference of a convex and a concave function is convex, we can generate a certificate for the nonnegativity of each convex decision function g 1 ◦ ϕ -g i ◦ ϕ around x . Minimizing these certificates over all i ∈ { 2 , 3 , . . . , c } yields a robustness certificate for the sensitive class.

Note that g mapping to 2 or more logits, all convex in the input, would not yield any tractable certificates. This is because the classifier decision function would now be the difference of two convex functions and have neither convex nor concave structure. We therefore choose to instantiate our binary classification networks with a single convex output logit for clarity.

A.1 Malimg Multiclass Extension

As a proof-of-concept, we provide a concrete realization of the first scheme above on the Malimg dataset. Namely, consider the setting where we want to distinguish between 'clean' binaries and 24 classes of malware. A malware designer seeks to maliciously perturb the bytes in their binary to fool a classifier into falsely predicting that the malware is 'clean.' We therefore consider a cascading architecture where first a feature-convex classifier answers the 'clean or malware' question, and then a subsequent classifier (not necessarily feature-convex) predicts the particular class of malware in the case that the feature-convex classifier assigns a 'malware' prediction. Note that, in the initial step, we can either certify the 'clean' binaries or the collection of all 24 malware classes, simply by negating the feature-convex classifier output logit. We logically choose to certify the malware classes as done in our experiments of Section 4; these certificates provide guarantees against a piece of malware going undetected.

We use the same feature-convex architecture and training details as described in Appendix E. For the cascaded malware classifier, we use a ResNet-18 architecture trained with Adam for 150 epochs with a learning rate of 10 -3 . The confusion plot for the multiclass classifier is provided in Figure 3, with an overall accuracy of 96 . 5% . With the exception of few challenging classes to distinguish, the classifier achieves reasonable performance despite the unbalanced class sizes.

Figure 4 visualizes the distribution of certified radii for the four most common malware classes in the dataset, excluding the 'Yuner.A' class which featured duplicated images. Note that certification performance varies between classes, with high correlation across different norms for a particular malware class. Classes which tend to have larger certificates can be interpreted as clustering further away from the clean binaries, requiring larger perturbations to fool the classifier.

B Feature Map Motivation

This section examines the importance of the feature map ϕ with a low-dimensional example. Consider the binary classification setting where one class X 2 ⊆ R d is clustered around the origin and the other class X 1 ⊆ R d surrounds it in a ring. Here, the pair ( X 1 , X 2 ) is convexly separable (see Definition 3.3) as an glyph[lscript] 2 -norm ball decision region covering X 2 is convex (Figure 5a). Note that the reverse pair ( X 2 , X 1 ) is not convexly separable, as there does not exist a convex set containing X 1 but excluding X 2 . A standard input-convex classifier with ϕ = Id would therefore be unable to

Clean

2

4

6

8

10

12

14

16

18

20

22

24

Predicted label

Clean

2

4

6

8

10

12

14

16

18

20

22

24

True label

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

discriminate between the classes in this direction (Proposition 3.5), i.e., we would be able to learn a classifier that generates certificates for points in X 1 , but not X 2 .

The above problem is addressed by choosing the feature map to be the simple concatenation ϕ ( x ) = ( x, | x | ) mapping from R d to R q = R 2 d , with associated Lipschitz constants Lip 1 ( ϕ ) ≤ 2 , Lip 2 ( ϕ ) ≤ √ 2 , and Lip ∞ ( ϕ ) ≤ 1 . In this augmented feature space, X 1 and X 2 are convexly separable in both directions, as they are each contained in a convex set (specifically, a half-space) whose complement contains the other class. We are now able to learn a classifier that takes X 2 as the sensitive class for which certificates are required (Figure 5b). This parallels the motivation of the support vector machine 'kernel trick,' where inputs are augmented to a higher-dimensional space wherein the data is linearly separable (instead of convexly separable as in our case).

C Proofs and Supplemental Theoretical Results

Theorem 3.1. Let f ∈ F be as in Definition 2.1 and let x ∈ f -1 ( { 1 } ) = { x ′ ∈ R d : f ( x ′ ) = 1 } . If ∇ g ( ϕ ( x )) ∈ R q is a nonzero subgradient of the convex function g at ϕ ( x ) , then f ( x + δ ) = 1 for all δ ∈ R d such that

Proof. Suppose that ∇ g ( ϕ ( x )) ∈ R q is a nonzero subgradient of g at ϕ ( x ) , so that g ( y ) ≥ g ( ϕ ( x ))+ ∇ g ( ϕ ( x )) glyph[latticetop] ( y -ϕ ( x )) for all y ∈ R q . Let δ ∈ R d be such that ‖ δ ‖ p < r ( x ) . Then it holds that

Allaple.L

Fakerean

Instant...

VB.AT

0

.

5

0

.

6

0

.

7

0

.

8

0

.

9

1

.

0

1

.

1

1

.

2

/lscript

1

-certificates

×

10

4

Allaple.L

Fakerean

Instant...

VB.AT

50

60

70

80

90

/lscript

2

-certificates

Allaple.L

Fakerean

Instant...

VB.AT

0

.

14

0

.

16

0

.

18

0

.

20

0

.

22

0

.

24

/lscript

∞

-certificates

-

-

20

-

10

0

10

20

(a)

5

0

5

(b)

We now introduce a preliminary lemma for the results in Section 3.2.

LemmaC.1. For any nonempty closed convex set X ⊆ R d , there exists a convex function g : R d → R such that X = g -1 (( -∞ , 0]) = { x ∈ R d : g ( x ) ≤ 0 } .

Proof. Let X ⊆ R d be a nonempty closed convex set. We take the distance function g = d X defined by d X ( x ) = inf y ∈ X ‖ y -x ‖ 2 . Since X is closed and y ↦→ ‖ y -x ‖ 2 is coercive for all x ∈ R d , it holds that y ↦→ ‖ y -x ‖ 2 attains its infimum over X [10, Proposition A.8]. Let x (1) , x (2) ∈ R d and let θ ∈ [0 , 1] . Then there exist y (1) , y (2) ∈ X such that g ( x (1) ) = ‖ y (1) -x (1) ‖ 2 and g ( x (2) ) = ‖ y (2) -x (2) ‖ 2 . Since X is convex, it holds that θy (1) +(1 -θ ) y (2) ∈ X , and therefore

Hence, g = d X is convex. Since X = { x ∈ R d : inf y ∈ X ‖ y -x ‖ 2 = 0 } = { x ∈ R d : d X ( x ) = 0 } = { x ∈ R d : d X ( x ) ≤ 0 } = { x ∈ R d : g ( x ) ≤ 0 } by nonnegativity of d X , the lemma holds.

Proposition 3.4. For any nonempty closed convex set X ⊆ R d , there exists f ∈ F Id such that X = f -1 ( { 2 } ) = { x ∈ R d : f ( x ) = 2 } . In particular, this shows that if ( X 1 , X 2 ) is a convexly separable pair of subsets of R d , then there exists f ∈ F Id such that f ( x ) = 1 for all x ∈ X 1 and f ( x ) = 2 for all x ∈ X 2 .

Proof. Let X ⊆ R d be a nonempty closed convex set. By Lemma C.1, there exists a convex function g : R d → R such that X = { x ∈ R d : g ( x ) ≤ 0 } . Define f : R d →{ 1 , 2 } by f ( x ) = 1 if g ( x ) > 0 and f ( x ) = 2 if g ( x ) ≤ 0 . Clearly, it holds that f ∈ F Id . Furthermore, for all x ∈ X it holds that g ( x ) ≤ 0 , implying that f ( x ) = 2 for all x ∈ X . Conversely, if x ∈ R d is such that f ( x ) = 2 , then g ( x ) ≤ 0 , implying that x ∈ X . Hence, X = { x ∈ R d : f ( x ) = 2 } .

If ( X 1 , X 2 ) is a convexly separable pair of subsets of R d , then there exists a nonempty closed convex set X ⊆ R d such that X 2 ⊆ X and X 1 ⊆ R d \ X , and therefore there exists f ∈ F Id such that X 2 ⊆ X = f -1 ( { 2 } ) and X 1 ⊆ R d \ X = f -1 ( { 1 } ) , implying that indeed f ( x ) = 1 for all x ∈ X 1 and f ( x ) = 2 for all x ∈ X 2 .

Proposition 3.5. Let f ∈ F Id . The decision region under f associated to class 2 , namely X := f -1 ( { 2 } ) = { x ∈ R d : f ( x ) = 2 } , is a closed convex set.

Proof. For all x ∈ R d , it holds that f ( x ) = 2 if and only if g ( x ) ≤ 0 . Since f ∈ F Id , g is convex, and hence, X = { x ∈ R d : g ( x ) ≤ 0 } is a (nonstrict) sublevel set of a convex function and is therefore a closed convex set.

In order to apply the universal approximation results in Chen et al. [16], we now introduce their parameterization of input-convex ReLU neural networks. Note that it imposes the additional constraint that the first weight matrix A (1) is elementwise nonnegative.

Definition C.2. Define ˜ F Id to be the class of functions ˜ f : R d →{ 1 , 2 } given by ˜ f ( x ) = T (˜ g ( x )) with ˜ g : R d → R given by

for some L ∈ N , L > 1 , and some consistently sized matrices A (1) , C (1) , . . . , A ( L ) , C ( L ) , all of which have nonnegative elements, and some consistently sized vectors b (1) , . . . , b ( L ) .

The following preliminary lemma relates the class ˆ F Id from Definition 2.2 to the class ˜ F Id above.

Lemma C.3. It holds that ˜ F Id ⊆ ˆ F Id .

Proof. Let ˜ f ∈ ˜ F Id . Then certainly A ( l ) ≥ 0 for all l ∈ { 2 , 3 , . . . , L } , so indeed ˜ f ∈ ˆ F Id . Hence, ˜ F Id ⊆ ˆ F Id .

Theorem 1 in Chen et al. [16] shows that a Lipschitz convex function can be approximated within an arbitrary tolerance. We now provide a technical lemma adapting Theorem 1 in Chen et al. [16] to show that convex functions can be underapproximated within an arbitrary tolerance on a compact convex subset.

Lemma C.4. For any convex function g : R d → R , any compact convex subset X of R d , and any glyph[epsilon1] > 0 , there exists ˆ f ∈ ˆ F Id such that ˆ g ( x ) < g ( x ) for all x ∈ X and sup x ∈ X ( g ( x ) -ˆ g ( x )) < glyph[epsilon1] .

Proof. Let g : R d → R be a convex function, let X be a compact convex subset of R d , and let glyph[epsilon1] > 0 . Since g -glyph[epsilon1]/ 2 is a real-valued convex function on R d (and hence is proper), its restriction to the closed and bounded set X is Lipschitz continuous [55, Theorem 10.4], and therefore Lemma C.3 together with Theorem 1 in Chen et al. [16] gives that there exists ˆ f ∈ ˜ F Id ⊆ ˆ F Id such that sup x ∈ X | ( g ( x ) -glyph[epsilon1]/ 2) -ˆ g ( x ) | < glyph[epsilon1]/ 2 . Thus, for all x ∈ X ,

Furthermore,

which proves the lemma.

We leverage Lemma C.4 to construct a uniformly converging sequence of underapproximating functions.

Lemma C.5. For all f ∈ F Id and all compact convex subsets X of R d , there exists a sequence { ˆ f n ∈ ˆ F Id : n ∈ N } ⊆ ˆ F Id such that ˆ g n ( x ) < ˆ g n +1 ( x ) < g ( x ) for all x ∈ X and all n ∈ N and ˆ g n converges uniformly to g on X as n →∞ .

Proof. Let f ∈ F Id and let X be a compact convex subset of R d . Let { glyph[epsilon1] n > 0 : n ∈ N } be a sequence such that glyph[epsilon1] n +1 < glyph[epsilon1] n for all n ∈ N and glyph[epsilon1] n → 0 as n → ∞ . Such a sequence clearly exists, e.g., by taking glyph[epsilon1] n = 1 /n for all n ∈ N . Now, for all n ∈ N , the function g -glyph[epsilon1] n +1 is convex, and therefore by Lemma C.4 there exists ˆ f n ∈ ˆ F Id such that ˆ g n ( x ) < g ( x ) -glyph[epsilon1] n +1 for all x ∈ X and sup x ∈ X (( g ( x ) -glyph[epsilon1] n +1 ) -ˆ g n ( x )) < glyph[epsilon1] n -glyph[epsilon1] n +1 . Fixing such ˆ f n , ˆ g n for all n ∈ N , we see that sup x ∈ X (( g ( x ) -glyph[epsilon1] n +2 ) -ˆ g n +1 ( x )) < glyph[epsilon1] n +1 -glyph[epsilon1] n +2 , which implies that for all x ∈ X , which proves the first inequality. The second inequality comes from the fact that ˆ g n +1 ( x ) < g ( x ) -glyph[epsilon1] n +2 < g ( x ) for all x ∈ X . Finally, since g ( x ) -ˆ g n ( x ) > glyph[epsilon1] n +1 > 0 for all x ∈ X and all n ∈ N , we see that

which proves that lim n →∞ sup x ∈ X | g ( x ) -ˆ g n ( x ) | = 0 , so indeed ˆ g n converges uniformly to g on X as n →∞ .

With all the necessary lemmas in place, we now present our main theoretical results.

Theorem 3.6. For any f ∈ F Id , any compact convex subset X of R d , and any glyph[epsilon1] > 0 , there exists ˆ f ∈ ˆ F Id such that m ( { x ∈ X : ˆ f ( x ) = f ( x ) } ) < glyph[epsilon1] .

glyph[negationslash]

Proof. Let f ∈ F Id and let X be a compact convex subset of R d . By Lemma C.5, there exists a sequence { ˆ f n ∈ ˆ F Id : n ∈ N } ⊆ ˆ F Id such that ˆ g n ( x ) < ˆ g n +1 ( x ) < g ( x ) for all x ∈ X and all n ∈ N and ˆ g n converges uniformly to g on X as n →∞ . Fix this sequence.

glyph[negationslash]

For all n ∈ N , define i.e., the set of points in X for which the classification under ˆ f n does not agree with that under f . Since ˆ g n ( x ) < g ( x ) for all x ∈ X and all n ∈ N , we see that

Since g is a real-valued convex function on R d , it is continuous [55, Corollary 10.1.1], and therefore g -1 ((0 , ∞ )) = { x ∈ R d : g ( x ) > 0 } is measurable. Similarly, ˆ g -1 n (( -∞ , 0]) = { x ∈ R d : ˆ g n ( x ) ≤ 0 } is also measurable for all n ∈ N since ˆ g n is continuous. Furthermore, X is measurable as it is compact. Therefore, E n is measurable for all n ∈ N . Now, since ˆ g n ( x ) < ˆ g n +1 ( x ) for all x ∈ X and all n ∈ N , it holds that E n +1 ⊆ E n for all n ∈ N . It is clear that to prove the result, it suffices to show that lim n →∞ m ( E n ) = 0 . Therefore, if we show that m (⋂ n ∈ N E n ) = 0 , then the fact that m ( E 1 ) ≤ m ( X ) < ∞ together with Lebesgue measure's continuity from above yields that lim n →∞ m ( E n ) = 0 , thereby proving the result.

glyph[negationslash]

It remains to be shown that m (⋂ n ∈ N E n ) = 0 . To this end, suppose for the sake of contradiction that ⋂ n ∈ N E n = ∅ . Then there exists x ∈ ⋂ n ∈ N E n , meaning that g ( x ) > 0 and ˆ g n ( x ) ≤ 0 for all n ∈ N . Thus, for this x ∈ X , we find that lim sup n →∞ ˆ g n ( x ) ≤ 0 < g ( x ) , which contradicts the fact that ˆ g n uniformly converges to g on X . Therefore, it must be that ⋂ n ∈ N E n = ∅ , and thus m (⋂ n ∈ N E n ) = 0 , which concludes the proof.

Theorem 3.7. If ( X 1 , X 2 ) is a convexly separable pair of finite subsets of R d , then there exists ˆ f ∈ ˆ F Id such that ˆ f ( x ) = 1 for all x ∈ X 1 and ˆ f ( x ) = 2 for all x ∈ X 2 .

Proof. Throughout this proof, we denote the complement of a set Y ⊆ R d by Y c = R d \ Y .

Suppose that X 1 = { x (1) , . . . , x ( M ) } ⊆ R d and X 2 = { y (1) , . . . , y ( N ) } ⊆ R d are such that ( X 1 , X 2 ) is convexly separable. Then, by definition of convex separability, there exists a nonempty closed convex set X ′ ⊆ R d such that X 2 ⊆ X ′ and X 1 ⊆ R d \ X ′ . Let X = X ′ ∩ conv( X 2 ) . Since X 2 ⊆ X ′ and both sets X ′ and conv( X 2 ) are convex, the set X is nonempty and convex. By finiteness of X 2 , the set conv( X 2 ) is compact, and therefore by closedness of X ′ , the set X is compact and hence closed.

By Proposition 3.4, there exists f ∈ F Id such that f -1 ( { 2 } ) = X . Since conv( X 1 ∪ X 2 ) is compact and convex, Lemma C.5 gives that there exists a sequence { ˆ f n ∈ ˆ F Id : n ∈ N } ⊆ ˆ F Id such that ˆ g n ( x ) < ˆ g n +1 ( x ) < g ( x ) for all x ∈ conv( X 1 ∪ X 2 ) and all n ∈ N and ˆ g n converges uniformly to g on conv( X 1 ∪ X 2 ) as n →∞ . Fix this sequence.

Let x ∈ X 2 . Then, since X 2 ⊆ X ′ and X 2 ⊆ conv( X 2 ) , it holds that x ∈ X ′ ∩ conv( X 2 ) = X = f -1 ( { 2 } ) , implying that f ( x ) = 2 and hence g ( x ) ≤ 0 . Since ˆ g n ( x ) < g ( x ) for all n ∈ N , this shows that ˆ f n ( x ) = 2 for all n ∈ N . On the other hand, let i ∈ { 1 , . . . , M } and consider x = x ( i ) ∈ X 1 . Since X 1 ⊆ R d \ X ′ = R d ∩ ( X ′ ) c ⊆ R d ∩ ( X ′ ∩ conv( X 2 )) c = R d ∩ X c = R d ∩ f -1 ( { 1 } ) , it holds that f ( x ) = 1 and thus g ( x ) > 0 . Suppose for the sake of contradiction that ˆ f n ( x ) = 2 for all n ∈ N . Then ˆ g n ( x ) ≤ 0 for all n ∈ N . Therefore, for this x ∈ X 1 , we find that lim sup n →∞ ˆ g n ( x ) ≤ 0 < g ( x ) , which contradicts the fact that ˆ g n uniformly converges to g on conv( X 1 ∪ X 2 ) . Therefore, it must be that there exists n i ∈ N such that ˆ f n i ( x ) = 1 , and thus ˆ g n i ( x ) > 0 . Since ˆ g n ( x ) < ˆ g n +1 ( x ) for all n ∈ N , this implies that ˆ g n ( x ) > 0 for all n ≥ n i . Hence, ˆ f n ( x ) = ˆ f n ( x ( i ) ) = 1 for all n ≥ n i .

Let n glyph[star] be the maximum of all such n i , i.e., n glyph[star] = max { n i : i ∈ { 1 , . . . , M }} . Then the above analysis shows that ˆ f n glyph[star] ( x ) = 2 for all x ∈ X 2 and that ˆ f n glyph[star] ( x ) = 1 for all x ∈ X 1 . Since ˆ f n glyph[star] ∈ ˆ F Id , the claim has been proven.

Theorem 3.10. Consider M,N ∈ N . Let X 1 = { x (1) , . . . , x ( M ) } ⊆ R d and X 2 = { y (1) , . . . , y ( N ) } ⊆ R d be samples with all elements x ( i ) k , y ( j ) l drawn independently and identically from the uniform probability distribution on [ -1 , 1] . Then, it holds that

In particular, ˆ F Id contains an input-convex ReLU neural network that classifies all x ( i ) into class 1 and all y ( j ) into class 2 almost surely for sufficiently large dimensions d .

Proof. Throughout the proof, we denote the cardinality of a set S by | S | . For the reader's convenience, we also recall that, for n ∈ N , the symmetric group S n consists of all permutations (i.e., bijections) on the set { 1 , 2 , . . . , n } , and that | S n | = n ! . If σ : { 1 , 2 , . . . , n } → { 1 , 2 , . . . , n } is a permutation in S n , we denote the restriction of σ to the domain I ⊆ { 1 , 2 , . . . , n } by σ | I : I → { 1 , 2 , . . . , n } , which we recall is defined by σ | I ( i ) = σ ( i ) for all i ∈ I , and is not necessarily a permutation on I in general.

Consider first the case where d ≥ M + N . Let b ∈ R M + N be the vector defined by b i = 1 for all i ∈ { 1 , . . . , M } and b i = -1 for all i ∈ { M + 1 , . . . , M + N } . Then, since x ( i ) k , y ( j ) l are independent uniformly distributed random variables on [ -1 , 1] , it holds that the matrix

has rank M + N almost surely, and therefore the linear system of equations

has a solution a ∈ R d with probability 1 , and we note that from this solution we find that X 2 is a subset of the nonempty closed convex set { x ∈ R d : a glyph[latticetop] x ≤ 0 } and that X 1 is a subset of its complement. Hence, ( X 1 , X 2 ) is convexly separable with probability 1 in this case.

Now let us consider the general case: d ∈ N and in general it may be the case that d < M + N . For notational convenience, let P be the probability of interest:

Suppose that there exists a coordinate k ∈ { 1 , 2 , . . . , d } such that x ( i ) k < y ( j ) k for all pairs ( i, j ) ∈ { 1 , 2 , . . . , M } × { 1 , 2 , . . . , N } and that a := min { y (1) k , . . . , y ( N ) k } < max { y (1) k , . . . , y ( N ) k } =: b . Then, let X = { x ∈ R d : x k ∈ [ a, b ] } . That is, X is the extrusion of the convex hull of the projections { y (1) k , . . . , y ( N ) k } along all remaining coordinates. The set X is a nonempty closed convex set, and it

is clear by our supposition that X 2 ⊆ X and X 1 ⊆ R d \ X . Therefore, the supposition implies that ( X 1 , X 2 ) is convexly separable, and thus

where the final equality follows from the independence of the coordinates of the samples. Since min { y (1) k , . . . , y ( N ) k } < max { y (1) k , . . . , y ( N ) k } almost surely, we find that

where we define S to be the set of permutations on { 1 , . . . , M + N } whose restriction to { 1 , . . . , M } is also a permutation;

and where, for a permutation σ ∈ S M + N , E σ is the event where an ( M + N ) -vector has indices ordered according to σ ;

We note that the final equality in (3) relies on the fact that P ( x ( i ) k = x ( i ′ ) k ) = P ( y ( j ) k = y ( j ′ ) k ) = 0 for all i ′ = i and all j ′ = j , which is specific to our uniform distribution at hand.

Now, since E σ , E σ ′ are disjoint for distinct permutations σ, σ ′ ∈ S M + N , the bound (3) gives that glyph[negationslash]

glyph[negationslash]

Since x (1) k , . . . , x ( M ) k , y (1) k , . . . , y ( N ) k are independent and identically distributed samples, they define an exchangeable sequence of random variables, implying that P (( x (1) k , . . . , x ( M ) k , y (1) k , . . . , y ( N ) k ) ∈ E σ ) = P ( x (1) k < · · · < x ( M ) k < y (1) k < · · · < y ( N ) k ) for all permutations σ ∈ S M + N . Since, under the uniform distribution at hand, ( x (1) k , . . . , x ( M ) k , y (1) k , . . . , y ( N ) k ) ∈ E σ for some σ ∈ S M + N almost

surely, it holds that

This implies that

for all permutations σ ∈ S M + N . Hence, our bound (4) becomes

Finally, we immediately see that that map Γ: S M × S N → S M + N defined by

is injective and has image S , implying that | S | = | S M × S N | = | S M || S N | = M ! N ! . Thus,

which proves (2).

The unit probability of ˆ F Id containing a classifier that classifies all x ( i ) into class 1 and all y ( j ) into class 2 for large d follows immediately from Theorem 3.7.

D CIFAR-10 Cats-versus-Dogs Convex Separability

In order to establish that the cat and dog images in CIFAR-10 are convexly separable, we experimentally attempt to reconstruct an image from one class using a convex combination of all images in the other class (without augmentation such as random crops, flips, etc.). Namely, if x is drawn from one class and y (1) , . . . , y ( N ) represent the entirety of the other class, we form the following optimization problem:

The reverse experiment for the other class follows similarly. We solve the optimization using MOSEK [6], and report the various norms of x -∑ N j =1 α j y ( j ) in Figure 6. Reconstruction accuracy is generally very poor, with no reconstruction achieving better than an glyph[lscript] 1 -error of 52 . A typical reconstructed image is shown in Figure 7.

Yousefzadeh [74] and Balestriero et al. [9] showed a related empirical result for CIFAR-10, namely, that no test set image can be reconstructed as a convex combination of training set images. However, we remark that their findings do not necessarily imply that a training set image cannot be reconstructed via other training set images; our new finding that the CIFAR-10 cats-versus-dogs training set is convexly separable is required in order to assert Fact 3.8.

Dogs

→

cat

Cats

→

dog

100

200

300

400

500

600

700

glyph[lscript]

1

-reconstruction error

Dogs

→

cat

Cats

→

dog

2

4

6

8

10

12

14

glyph[lscript]

2

-reconstruction error

Dogs

→

cat

Cats

→

dog

0

.

1

0

.

2

0

.

3

0

.

4

0

.

5

0

.

6

0

.

7

0

.

8

glyph[lscript]

∞

-reconstruction error

E Experimental Setup

We include a detailed exposition of our experimental setup in this section, beginning with general details on our choice of epochs and batch size. We then discuss baseline methods, architecture choices for our method, class balancing, and data processing.

Epochs and batch size. Exempting the randomized smoothing baselines, for the MNIST 3-8 and Fashion-MNIST shirts experiments, we use 60 epochs for all methods. This is increased to 150 epochs for the Malimg dataset and CIFAR-10 cats-dogs experiments. The batch size is 64 for all datasets besides the 512 × 512 Malimg dataset, where it is lowered to 32 .

To ensure a fair comparison, the randomized smoothing baseline epochs are scaled larger than the aforementioned methods according to the noise value specified in the sweeps in Section I. The final epochs and smoothing noise values used are reported in Table 2. Note that as classifiers are typically more robust to the noise from splitting smoothing, larger values of σ are used for only this smoothing method in the MNIST 3-8 and Malimg datasets. For Malimg, we find experimentally that even noise values of up to σ = 100 are tractable for the splitting method, outside the sweep range considered in Section I. As verification at that σ already takes several minutes per sample and runtime scales linearly with σ , we do not explore larger values of σ .

Hardware. All experiments were conducted on a single Ubuntu 20.04 instance with an Nvidia RTX A6000 GPU. Complete reproduction of the experiments takes approximately 0 . 08 GPU-years.

E.1 Datasets

We introduce the various datasets considered in this work. MNIST 3-8 and Malimg are relatively simple classification problems where near-perfect classification accuracy is attainable; the Malimg dataset falls in this category despite containing relatively large images. Our more challenging settings consist of a Fashion-MNIST shirts dataset as well as CIFAR-10 cats-versus-dogs dataset.

For consistency with [77], we augment the MNIST and Fashion-MNIST training data with 1 -pixel padding and random cropping. The CIFAR-10 dataset is augmented with 3 -pixel edge padding, horizontal flips, and random cropping. The Malimg dataset is augmented with 20 -pixel padding and random 512 × 512 cropping.

For CIFAR-10, MNIST, and Fashion-MNIST, we use the preselected test sets. For Malimg we hold out a random 20% test dataset, although this may not be entirely used during testing. The training set is further subdivided by an 80% -20% validation split. For all experiments, we normalize pixel values into the interval [0 , 1] , and we use the first 1000 test samples to evaluate our methods.

MNIST 3-8. For our MNIST binary classification problem, we choose the problem of distinguishing between 3 and 8 [37]. These were selected as 3 and 8 are generally more visually similar and challenging to distinguish than other digit pairs. Images are 28 × 28 pixels and greyscale.

Malimg. Our malware classification experiments use greyscale, bytewise encodings of raw malware binaries Nataraj et al. [50]. Each image pixel corresponds to one byte of data, in the range of 0 -255 , and successive bytes are added horizontally from left to right on the image until wrapping at some predetermined width. We use the extracted malware images from the seminal dataset Nataraj et al. [50], normalizing pixel values into [0 , 1] , as well as padding and cropping images to be 512 × 512 . Note that licensing concerns generally prevent the distribution of 'clean' executable binaries. As this work is focused on providing a general approach to robust classification, in the spirit of reproducibility we instead report classification results between different kinds of malware. Namely, we distinguish between malware from the most numerous 'Allaple.A' class ( 2949 samples) and an identically-sized random subset of all other 24 malware classes. To simulate a scenario where we must provide robustness against evasive malware, we provide certificates for the latter collection of classes.

Fashion-MNIST shirts. The hardest classes to distinguish in the Fashion-MNIST dataset are T-shirts vs shirts, which we take as our two classes [33, 70]. Images are 28 × 28 pixels and greyscale.

CIFAR-10 cats-dogs. We take as our two CIFAR-10 classes the cat and dog classes since they are relatively difficult to distinguish [26, 43, 30]. Other classes (e.g., ships) are typically easier to classify since large background features (e.g., blue water) are strongly correlated with the target label. Samples are 32 × 32 RGB images.

E.2 Baseline Methods

We provide additional details on each of the baseline methods below.

Randomized smoothing. Since the certification runtime of randomized smoothing is large, especially for the 512 × 512 pixel Malimg images, we evaluate the randomized smoothing classifiers over 10 4 samples and project the certified radius to 10 5 samples by scaling the number fed into the ClopperPearson confidence interval, as described in [18]. This allows for a representative and improved certified accuracy curve while dramatically reducing the method's runtime. We take an initial guess for the certification class with n 0 = 100 samples and set the incorrect prediction tolerance parameter α = 0 . 001 . For CIFAR-10 we use a depth-40 Wide ResNet base classifier, mirroring the choices from Cohen et al. [18], Yang et al. [72]; for all other datasets we use a ResNet-18. All networks are trained using SGD with an initial learning rate of 0 . 1 , Nesterov momentum of 0 . 9 , weight decay of 10 -4 , and cosine annealing scheduling as described in Yang et al. [72]. Final smoothing noise values are selected as in Table 2, and are determined from the noise level comparison sweeps in Appendix I.

Splitting noise. As this method is a deterministic derivative of randomized smoothing, it avoids the many aforementioned hyperparameter choices. We use the same architectures described above for the other randomized smoothing experiments.

Cayley convolutions. To maintain consistency, we use a two-hidden-layer multilayer perceptron with ( n 1 , n 2 ) = (200 , 50) hidden features, CayleyLinear layers, and GroupSort activations for the MNIST experiment. For the more challenging Fashion-MNIST and CIFAR-10 experiments, we use the ResNet-9 architecture implementation from [63]. Following the authors' suggestions, we train these networks using Adam with a learning rate of 0 . 001 .

glyph[lscript] ∞ -distance nets. As the architecture of the glyph[lscript] ∞ -distance net [77] is substantially different from traditional architectures, we use the authors' 5 -layer MNIST/Fashion-MNIST architecture and 6 -layer CIFAR-10 architecture with 5120 neurons per hidden layer. Unfortunately, the classification accuracy on the CIFAR-10 cats-dogs experiment remained near 50% throughout training. This was not the case when we tested easier classes, such as planes-versus-cars, where large features (e.g., blue sky) can be used to discriminate. We therefore only include this model in the MNIST and Fashion-MNIST experiments, and use the training procedure directly from the aforementioned paper's codebase.

α, β -CROWN. As α, β -CROWN certification time scales exponentially with the network size, we keep the certified networks small in order to improve the certification performance of the baseline. For all datasets, we train and certify a one-hidden-layer network with 200 hidden units and ReLU activations. All networks are adversarially trained for a glyph[lscript] ∞ -perturbation radius starting at 0 . 001 and linearly scaling to the desired glyph[epsilon1] over the first 20 epochs, as described in Kayed et al. [33], which trained the models used in Wang et al. [66]. The desired final glyph[epsilon1] is set to 0 . 3 for MNIST, 0 . 1 for Fashion-MNIST and Malimg, and 2 / 255 for CIFAR-10. The adversarial training uses a standard PGD attack with 50 steps and step size 2 glyph[epsilon1]/ 50 . Other optimizer training details are identical to Wang et al. [66]. The branch-and-bound timeout is set to 30 seconds to maintain comparability to other methods, and robustness is evaluated over a dataset-dependent range of discrete radii for each adversarial norm.

E.3 Feature-Convex Architecture and Training

In this section, we provide more details of the feature-convex architectures used in our experiments of Section 4. For the more challenging datasets (Fashion-MNIST shirts and CIFAR-10 cats-dogs), we use various instantiations of a convex ConvNet (described below) where successive layers have a constant number of channels and image size. This allows for the addition of identity residual connections to each convolution and lets us remove the passthrough connections altogether. Convexity is enforced by projecting relevant weights onto the nonnegative orthant after each epoch and similarly constraining BatchNorm γ parameters to be positive. We initialize positive weight matrices to be drawn uniformly from the interval [0 , glyph[epsilon1] ] , where glyph[epsilon1] = 0 . 003 for linear weights and glyph[epsilon1] = 0 . 005 for convolutional weights. Jacobian regularization is also used to improve our certified radii [31].

The convex ConvNet architecture consists of a sequence of convolutional layers, BatchNorms, and ReLU nonlinearities. The first convolutional layer is unconstrained, as the composition of a convex function with an affine function is still convex [2]. All subsequent convolutions and the final linear readout layer are uniformly initialized from some small positive weight interval ( [0 , 0 . 003] for linear weights, [0 , 0 . 005] for convolutional weights) and projected to have nonnegative weights after

each gradient step. We found this heuristic initialization choice helps to stabilize network training, as standard Kaiming initialization assumptions are violated when weights are constrained to be nonnegative instead of normally distributed with mean zero. More principled weight initialization strategies for this architecture would form an exciting area of future research. Before any further processing, inputs into the network are fed into an initial BatchNorm-this enables flexibility with different feature augmentation maps.

Since the first convolutional layer is permitted negative weights, we generally attain better performance by enlarging the first convolution kernel size (see Table 3). For subsequent convolutions, we set the stride to 1 , the input and output channel counts to the output channel count from the first convolution, and the padding to half the kernel size, rounded down. This ensures that the output of each of these deeper convolutions has equivalent dimension to its input, allowing for an identity residual connection across each convolution. If C i ( z ) is a convolutional operation on a hidden feature z , this corresponds to evaluating C i ( z ) + z instead of just C i ( z ) . The final part of the classifier applies MaxPool and BatchNorm layers before a linear readout layer with output dimension 1 . See Figure 8 for a diagram depicting an exemplar convex ConvNet instantiation.

conv1

stride 2

conv2

nonneg

32 x 32 x 6

16 x 16 x 32

convolutional

ReLU + batchnorm

maxpool

fully connected

feature map

input

16 x 16 x 32

+

16 x 16 x 32

+

16 x 16 x 32

+

maxpool

size 4

4 x 4 x 32

batchnorm + fc

nonneg

scalar logit

conv3

nonneg

conv4

nonneg

For training, we use a standard binary cross entropy loss, optionally augmented with a Jacobian regularizer on the Frobenius norm of the network Jacobian scaled by λ > 0 [31]. As our certified radii in Theorem 3.1 vary inversely to the norm of the Jacobian, this regularization helps boost our certificates at a minimal loss in clean accuracy. We choose λ = 0 . 0075 for CIFAR-10, λ = 0 . 075 for Malimg and λ = 0 . 01 for MNIST and Fashion-MNIST. Further ablation tests studying the impact of regularization are reported in Appendix G. All feature-convex networks are trained using SGD with a learning rate of 0 . 001 , momentum 0 . 9 , and exponential learning rate decay with γ = 0 . 99 .

E.4 Class Accuracy Balancing

As discussed in Section 1.1, a balanced class 1 and class 2 test accuracy is essential for a fair comparison of different methods. For methods where the output logits can be directly balanced, this is easily accomplished by computing the ROC curve and choosing the threshold that minimizes | TPR -(1 -FPR) | . This includes both our feature-convex classifiers with one output logit and the Cayley orthogonalization and glyph[lscript] ∞ -Net architectures with two output logits.

Randomized smoothing classifiers are more challenging as the relationship between the base classifier threshold and the smoothed classifier prediction is indirect. We address this using a binary search balancing procedure. Namely, on each iteration, the classifier's prediction routine is executed over the test dataset and the 'error' between the class 1 accuracy and the class 2 accuracy is computed. The sign of the error then provides the binary signal for whether the threshold should be shifted higher or lower in the standard binary search implementation. This procedure is continued until the error drops below 1% .

F glyph[lscript] 2 - and glyph[lscript] ∞ -Certified Radii

This section reports the counterpart to Figure 2 for the glyph[lscript] 2 - and glyph[lscript] ∞ -norms. Across all experiments, we attain substantial glyph[lscript] 2 - and glyph[lscript] ∞ -radii without relying on computationally expensive sampling schemes or nondeterminism. Methods that certify to another norm ‖ · ‖ p are converted to glyph[lscript] q -radii at a factor of 1 if p > q or d 1 /p -1 /q otherwise.

Certified glyph[lscript] 2 -radii are reported in Figure 9. Our glyph[lscript] 2 -radii are moderate, generally slightly smaller than those produced by Gaussian randomized smoothing.

Certified glyph[lscript] ∞ -radii are reported in Figure 10. For the MNIST 3-8 experiment, the glyph[lscript] ∞ -distance nets produce exceptional certified radii. Likewise, the glyph[lscript] ∞ -distance net certificates are dominant for the Fashion-MNIST dataset, despite achieving slightly inferior clean accuracy. We note however that the applicability of glyph[lscript] ∞ -distance nets for sophisticated vision tasks is uncertain as the method is unable to achieve better-than-random performance for CIFAR-10 cats-dogs (Section E.2). Our method is comparable to randomized-smoothing and α, β -CROWN in all glyph[lscript] ∞ experiments.

0

1

2

3

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

RS Uniform

Splitting

α, β

-CROWN

Cayley

glyph[lscript]

∞

-Net

[99.0% clean]

[99.8% clean]

[99.8% clean]

[99.6% clean]

[98.4% clean]

[99.2% clean]

[100 % clean]

[100 % clean]

(a) MNIST 3-8.

10

-

5

10

-

3

10

-

1

10

1

RS Uniform

Splitting

α, β

-CROWN

[97.9% clean]

[98.0% clean]

[98.0% clean]

[98.4% clean]

[98.6% clean]

[97.7% clean]

(b) Malimg.

0

1

2

3

glyph[lscript]

2

-radius

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

RS Uniform

Splitting

α, β

-CROWN

Cayley

glyph[lscript]

∞

-Net

[83.1% clean]

[80.5% clean]

[82.1% clean]

[80.7% clean]

[85.8% clean]

[83.9% clean]

[87.5% clean]

[79.4% clean]

(c) Fashion-MNIST shirts.

0

2

4

6

glyph[lscript]

2

-radius

RS Uniform

Splitting

α, β

-CROWN

Cayley

[68.0% clean]

[65.0% clean]

[66.6% clean]

[67.2% clean]

[73.0% clean]

[61.6% clean]

[76.1% clean]

(d) CIFAR-10 cats-dogs.

0

.

0

0

.

2

0

.

4

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

RS Uniform

Splitting

α, β

-CROWN

Cayley

glyph[lscript]

∞

-Net

[99.0% clean]

[99.8% clean]

[99.8% clean]

[99.6% clean]

[98.4% clean]

[99.2% clean]

[100 % clean]

[100 % clean]

(a) MNIST 3-8.

10

-

6

10

-

4

10

-

2

RS Uniform

Splitting

α, β

-CROWN

[97.9% clean]

[98.0% clean]

[98.0% clean]

[98.4% clean]

[98.6% clean]

[97.7% clean]

(b) Malimg.

0

.

0

0

.

1

0

.

2

0

.

3

glyph[lscript]

∞

-radius

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

RS Uniform

Splitting

α, β

-CROWN

Cayley

glyph[lscript]

∞

-Net

[83.1% clean]

[80.5% clean]

[82.1% clean]

[80.7% clean]

[85.8% clean]

[83.9% clean]

[87.5% clean]

[79.4% clean]

(c) Fashion-MNIST shirts.

0

.

000

0

.

025

0

.

050

0

.

075

0

.

100

glyph[lscript]

∞

-radius

RS Uniform

Splitting

α, β

-CROWN

Cayley

[68.0% clean]

[65.0% clean]

[66.6% clean]

[67.2% clean]

[73.0% clean]

[61.6% clean]

[76.1% clean]

(d) CIFAR-10 cats-dogs.

G Ablation Tests

We conduct a series of ablation tests on the CIFAR-10 cats-dogs dataset, examining the impact of regularization, feature maps, and data augmentation.

G.1 Regularization

Figure 11 examines the impact of Jacobian regularization over a range of regularization scaling factors λ , with λ = 0 corresponding to no regularization. As is typical, we see a tradeoff between clean accuracy and certified radii. Further increases in λ yield minimal additional benefit.

G.2 Feature Map

In this section, we investigate the importance of the feature map ϕ . Figure 12 compares our standard feature-convex classifier with ϕ ( x ) = ( x -µ, | x -µ | ) against an equivalent architecture with ϕ = Id . Note that the initial layer in the convex ConvNet is a BatchNorm, so even with ϕ = Id , features still get normalized before being passed into the convolutional architecture. We perform this experiment across both the standard cats-dogs experiment (cats are certified) in the main text and the reverse dogs-cats experiment (dogs are certified).

0

10

20

30

40

50

glyph[lscript]

1

-radius

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

λ

= 0

.

0

λ

= 0

.

0025

λ

= 0

.

005

λ

= 0

.

0075

λ

= 0

.

01

[72.6% clean]

[70.6% clean]

[68.2% clean]

[68.0% clean]

[65.8% clean]

As expected, the clean accuracies for both datasets are lower for ϕ = Id , while the certified radii are generally larger due to the Lipschitz scaling factor in Theorem 3.1. Interestingly, while the standard ϕ produces comparable performance in both experiments, the identity feature map classifier is more effective in the dogs-cats experiment, achieving around 7% greater clean accuracy. This reflects the observation that convex separability is an asymmetric condition and suggests that feature maps can mitigate this concern.

0

10

20

glyph[lscript]

1

-radius

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

Cats-dogs (certifying cats)

ϕ

=

Id

Standard

ϕ

[60.2% clean]

[72.6% clean]

(a)

0

5

10

15

glyph[lscript]

1

-radius

Dogs-cats (certifying dogs)

ϕ

=

Id

Standard

ϕ

[66.4% clean]

[72.4% clean]

(b)

G.3 Unaugmented Accuracies

Table 4 summarizes the experimental counterpart to Section 3.2. Namely, Fact 3.8 proves that there exists an input-convex classifier ( ϕ = Id ) that achieves perfect training accuracy on the CIFAR-10 cats-dogs dataset with no dataset augmentations (random crops, flips, etc.). Our practical experiments

are far from achieving this theoretical guarantee, with just 73 . 4% accuracy for cats-dogs and 77 . 2% for dogs-cats. Improving the practical performance of input-convex classifiers to match their theoretical capacity is an exciting area of future research.

H MNIST Classes Sweep

For our comparison experiments, we select a specific challenging MNIST class pair ( 3 versus 8 ). For completeness, this section includes certification results for our method over all combinations of class pairs in MNIST. As this involves training models over 90 combinations, we lower the number of epochs from 60 to 10 , maintaining all other architectural details described in Appendix E.

0

2

4

6

8

Sensitive class

0

2

4

6

8

Non-sensitive class

10

20

(a)

glyph[lscript]

1

-certificates.

0

2

4

6

8

Sensitive class

0

2

4

6

8

Non-sensitive class

1

2

3

(b)

glyph[lscript]

2

-certificates.

0

2

4

6

8

Sensitive class

0

2

4

6

8

Non-sensitive class

0

.

05

0

.

10

0

.

15

(c)

glyph[lscript]

∞

-certificates.

Our certified radii naturally scale with the complexity of the classification problem. As expected, 3 and 8 are among the most challenging digits to distinguish, along with 2-8, 5-8, 4-9, and 7-9. Particularly easy combinations to classify typically include 0 or 1 .

The certification performance is remarkably symmetric across the diagonal despite the asymmetry in our convex architectures. In other words, when classifying between digits i and j , if a convex classifier exists which generates strong certificates for i , then we can generally train an asymmetric classifier that generates strong certificates for j . A few exceptions to this can be seen in Figure 13; the most notable are the 1-9 versus 9-1 pairs and the 4-8 versus 8-4 pairs. A deeper understanding of how class characteristics affect asymmetric certification is an exciting avenue of future research.

I Randomized Smoothing Noise Level Sweeps

In this section, we reproduce the performance randomized smoothing classifiers under different noise distributions for a range of noise parameters σ . Namely, we sweep over multiples of base values of σ reported in the subcaptions of Figures 14, 15, and 16. The base values of σ were set to σ = 0 . 75 for the MNIST 3-8, Fashion-MNIST, and CIFAR-10 cats-dogs experiments. For the higher-resolution Malimg experiment, we increase the base noise to σ = 3 . 5 , matching the highest noise level examined in Levine and Feizi [40]. The epochs used for training were similarly scaled by n , starting from the base values provided in Section E, with the exception of the CIFAR-10 base epochs being increased to 600 epochs.

0

2

4

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(a) MNIST 3-8,

σ

= 0

.

75

.

0

50

100

150

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(b) Malimg,

σ

= 3

.

5

.

0

2

4

glyph[lscript]

1

-radius

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(c) Fashion-MNIST shirts,

σ

= 0

.

75

.

0

5

10

15

glyph[lscript]

1

-radius

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(d) CIFAR-10 cats-dogs,

σ

= 0

.

75

.

0

1

2

3

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(a) MNIST 3-8,

σ

= 0

.

75

.

0

20

40

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(b) Malimg,

σ

= 3

.

5

.

0

1

2

3

4

glyph[lscript]

2

-radius

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(c) Fashion-MNIST shirts,

σ

= 0

.

75

.

0

.

0

2

.

5

5

.

0

7

.

5

10

.

0

glyph[lscript]

2

-radius

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(d) CIFAR-10 cats-dogs,

σ

= 0

.

75

.

0

.

00

0

.

05

0

.

10

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(a) MNIST 3-8,

σ

= 0

.

75

.

0

.

000

0

.

025

0

.

050

0

.

075

0

.

100

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(b) Malimg,

σ

= 3

.

5

.

0

.

00

0

.

05

0

.

10

0

.

15

glyph[lscript]

∞

-radius

0

.

0

0

.

2

0

.

4

0

.

6

0

.

8

1

.

0

Certified accuracy

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(c) Fashion-MNIST shirts,

σ

= 0

.

75

.

0

.

00

0

.

05

0

.

10

0

.

15

0

.

20

glyph[lscript]

∞

-radius

(

n

·

σ

)

(

n

·

σ

)

RS Uniform

(

n

·

σ

)

Splitting

(

n

·

σ

)

(d) CIFAR-10 cats-dogs,

σ

= 0

.

75

.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper is based on the following elegant observation: Consider the case of binary classification in which we learn a function $f: \\mathbb R^e\\to \\mathbb R$ and classify a point based on thresh-holding $f$ at 0. Assume $f(x)=g(\\phi(x))$ where $f:\\mathbb R^m \\to \\mathbb R$ is convex and $\\phi$ is Lipschitz. Then using the Lipschitz consonant of $\\phi$ and the fact that $g(y)\\geq g(\\phi(x))+\\nabla g(\\phi(x))\\cdot (h-\\phi(x))$ for any subgradient of $g$, one can easily compute a robustness certification for $f$. The authors then argue that this paradigm is fairly applicable to adversarial binary classification based on the following observations: 1) If $m$ is larger than the number of data points and $\\phi$ is the identity, then there is a convex function achieving perfect accuracy. 2) There are many adversarial classification tasks involving asymmetric binary classification such as malware detection and spam detection\n\nSTRENGTHS:\n- computation of a robust certificate for this method is much faster than competing methods and achieves comparable performance\n- formalizes the fact that in many real world applications, adversarial classification is an asymmetric problem\n- exposition is excellent and bibliography is very thorough\n\nWEAKNESSES:\n- Binary classification problems are often handled by SVMs, for which a robust certification is easy to compute. These models are simpler and easier to train than neural nets. Furthermore, one expects some robustness to arise from these models as they minimize the maximum margin. This paper does not compare accuracy or robustness with SVMs. For instance, due to Corrollary 3.8, I would expect SVMs to perform well on the CIFAR 10 example. Can you find an example where your method does better than an SVM in terms of either accuracy or robustness?\n- Consider $\\hat g$ as defined in definition 2.2 If $b_2,\\ldots b_\\ell\\geq 0$, the last $\\ell-1$ layers reduce to a linear function. This observation suggests that depth for convex neural nets has fairly different effects than depth for standard neural nets. This observation further suggests that to achieve an expression $\\hat g$, $\\ell$ would need to be quite large. Can you elaborate on your choice of $\\ell$? \n- There are many instances for which the dimension of the dataset $d$ is less than the number of data points. One would expect that using a non-identity $\\phi$ in these cases would be advantageous. The paper does not discuss how to choose $\\phi$ in this case\n- Comment: I would call \"Corollary 3.8\" a \"Fact\" rather than a \"Corollary\". Optimization in finite precision arithmetic always has errors, which is weaker than a formal proof.\n\nQUESTIONS:\nSee the questions in the first two bullets of \"Weaknesses\". A convincing response to the first bullet could significantly change my opinion on the rating of this paper.\n\nLIMITATIONS:\nSee the first two bullets under \"Weaknesses\"", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-23"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper tackles the asymmetric nature of classification and adversarial attacks intrinsic in most real-world scenarios that have a live and motivated attacker: that attacks are unidirectional, and proposes a general-purpose technique for specifying a certifiably robust defense in such scenarios. This is done by using an Input Convex Neural Network (ICNN) to guarantee the convexity of the function $g(x)$, and then double-backprop is applied to get the gradient of the ICNN with respect to its input to compute the certificate radius. \n\n-------\n\nI think my concerns are mostly addressed. I'm waffling between 6/7, so at least updating my minimum confidence.\n\nSTRENGTHS:\n1. Valuable theoretical contribution to how adversarial machine learning works in real-life, over unmotivated fears about a computer-vision boogie man. \n2. Comparisons against many alternative certifiable defenses, with significant improvement in some cases. \n3. Should be faster, but such results are obscured.\n\nWEAKNESSES:\n1. The experimental section is woefully presented and obscures the nature of the benefit, abdicating the setup/explanation to the appendix is not acceptable in my opinion. \n2. The mathematical presentation (additionally not helped by the NeurIPS template) is hard to follow, e.g. the setup for the reader in section 1.3 is crammed into a tightly packed paragraph to hit the page limit, and the readability suffers.\n\nQUESTIONS:\n1. How much faster is your approach at certifying a radius against each other classifier? This should be in the experiments section to justify the value of the method. \n2. Is there a predictive difference in your approach verses other methods (I suspect yes, e.g., randomized smoothing)? See Q1, it should be in Experiments. \n3. I read the appendix and it says the \"pixels\" in malimage are [0, 255] encoded. Wouldn't that mean 10^4/255 = 39 pixels can be altered? It looks like others are right around the one-pixel attack radius in this case. \n4. Why not use the neural network approach/data from _SOREL-20M: A large scale benchmark dataset for malicious PE detection_? The MalImage dataset is highly flawed, taking an approach (\"malware images\") that has been long known to be errant (_Malware Detection by Eating a Whole EXE_) and has significant issues in failing to account for biases that occur in the malware space (_TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time_).\n\nLIMITATIONS:\nLimitations are maybe sufficiently addressed, see questions.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper considers a specific problem in binary classification task, where one class is recognized as a ‘sensitive’ class, which needs to be certified for robustness. The authors propose a special network called feature-convex neural network, which combines a Lipschitz network and a convex ReLU network. Expressive power of input-convex networks for convexly separable sets are provided. Experiments show that proposed networks achieve better performance on $l_1$ robustness compared to other certified robustness methods.\n\nSTRENGTHS:\n1. The paper is well-written and the problem and proposed method are clear.\n2. The proposed problem and method are new.\n3. The theoretical results are solid.\n\nWEAKNESSES:\n1. The proposed feature-convex network may limited classification power to be practically useful. The lower training accuracy on larger dataset like CIFAR-10 may imply that this architecture will be harder to apply in more complex real-world datasets.\n\n2. The verification of convex separability of CIFAR-10 cats vs dogs is confusing. The authors use convex optimization showing that certain cat image is hard to be recovered from the convex combination of dog images. Is this the sufficient evidence for convex separability? As authors mentioned, input-convex classifier is hard to fit the CIFAR-10 cats vs dogs data, which only achieves $70\\%+$ training accuracy. To make convex separability convincing, one may at least design an input-convex network architecture to achieve higher training accuracy (even without generalization ability).\n\n3. The experimental results are a little weak. The proposed feature-convex classifier only shows decent performance on $l_1$ robustness, but is suboptimal in $l_2$ and $l_{\\infty}$ robustness. As randomized smoothing is a more general certified method which is not designed for asymmetric binary classification, the suboptimality of feature-convex classifier shows the limited power of the proposed network.\n\n4. A two-layers neural network is used to evaluate the certified power of $\\alpha,\\beta$-CROWN. This seems to be a weaker baseline, as the conv-small net in $\\alpha,\\beta$-CROWN uses a four-layer convolutional network [1].\n\n5. The applications mentioned in the paper are mostly for imbalanced dataset (one class has more data than another), but the experiments are mostly for balanced dataset.\n\n[1] S Wang, H Zhang, K Xu, X Lin, S Jana, C J Hsieh, and J Z Kolter. Beta-CROWN: Efficient bound propagation with per-neuron split constraints for neural network robustness verification. In NeurIPS 2021.\n\nQUESTIONS:\n1. When selecting the parameter $\\tau$ to shift the classification threshold, why use the balanced accuracy $\\alpha_2(\\tau)=\\alpha_1(\\tau)$, but not the commonly-used criterion in binary classification, F1-score or AUROC? Does there exist previous work using balanced accuracy for (asymmetric) binary classification?\n\n2. Can your method be extended to multi-class classification tasks?\n\n3. A very simple Lipschitz feature extractor $g$ is used in the proposed classifier. Can a more complex Lipschitz feature extractor be used to keep both certified robustness and accuracy high?\n\n4. In the proposed application on spam classification, why attackers only attempt to fool the classifier toward the “not-spam” class? The converse attack is more detrimental if the classifier recognizes a not-spam, important email as a spam one.\n\nLIMITATIONS:\nSee weakness", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper is about certified robustness of neural networks.  In particular the authors explore the concept that there is typically a one-sided attack that needs to be certified since adversaries have certain goals that only work in certain directions (e.g., classify a spam email as ham).  The authors call this framework \"asymmetric robustness certification problem\" and approach a solution to this problem using a feature-convex neural network architecture.  The analysis is upon ReLU activation functions where the authors formalize and prove several results that are related to the geometry/convexity of the input data and how this can translate into the existence (not the identification) of a neural network that has perfect accuracy on the dataset.  Of course, it is a neural network at the end of the day and can be applied anywhere and observe its performance.  In this direction, eventually the authors evaluate their method on four different datasets against several baselines.\n\n**After Rebuttal:**\nI have read the reviews of others as well as the response by the authors. I am happy with the answers provided by the authors as well as their willingness to improve the presentation of the paper. I will upgrade my presentation score from 1 to 2 and also increase my overall score from borderline accept to weak accept.\n\nSTRENGTHS:\n+ A new approach for certified robustness in a framework that deserves attention.\n+ The proposed method is backed up with theoretical guarantees.\n+ Experimental results on different datasets show that the method behaves well.\n\nWEAKNESSES:\nI think the main issue of the paper is the presentation of the results.  Granted the authors have put a lot of effort in this paper as it can be seen from the full paper.  Nevertheless: \n+ The authors use in many situations very long sentences and this makes it hard to follow their work, their descriptions, and ultimately give the appropriate merit to their work.  \n+ In addition to that, Section 3 and especially Section 3.2, is hard to follow as we have a sequence of definitions, propositions, and theorems that the authors prove as part theoretically justifying their method. \n+ Not only that, but it is hard to understand what is important and what is not for the story that the authors want to discuss.\n+ In Section 4 where we find the experiments, we have Figure 2 where the authors' method is compared against baseline methods. However, neither in the caption of the figure and the subfigures, nor in the actual text of the paper do we get to see what the other baselines are.  There are some keywords in the legends of the different subfigures, but no explanation.  Most likely RS X means randomized smoothing using noise X (but this is left as an exercise to the reader).  No more information about the rest of the cases is given either, neither are papers cited for these methods that are used as baselines (at least not in that section).  Also, there are some some percentage points next to each method which should present (from the context) that these values correspond to accuracy without any perturbations (and hence the \"clean\" word appearing next to these numbers) but really, these things need to be spelled out on the paper. One cannot really throw some figures on a paper, with keywords resembling names of certain methods but refuse to explain what these methods really are.  After looking into the appendix, indeed the authors there explain the names of the different methods and cite the relevant work, but this is happening 14 pages after the figure was presented to the reader.  I am sorry, but this is not how papers are read.\n\nI am really torn with this paper and I would like to see the views of the other reviewers. Nevertheless, I appreciate theoretical results and I am leaning more towards acceptance.\n\nQUESTIONS:\nQ1. Are ReLU functions instrumental in the results that you prove? Can these results be extended to other activation functions?\n\nQ2. Apart from the experimental proof that cats and dogs from CIFAR-10 is convexly separable, were you aware of any classification datasets that are convexly separable and could motivate the work that you did?  Of course, this is not to diminish the work that you did; I am just asking.\n\nQ3. At the top of page 4 we see that a neural network is defined as a mapping\n$f \\colon R^d \\times R^n \\rightarrow R$.\nCan you explain why your input is decomposed to $(x, y)$, with $x\\in R^d$ and $y\\in R^n$, and why we have R in the output?\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-05"}