Paper:
Scaling provable adversarial defenses
Recent work has developed methods for learning deep network classifiers that are provably robust to norm-bounded adversarial perturbation; however, these methods are currently only possible for relatively small feedforward networks. In this paper, in an effort to scale these approaches to substantially larger models, we extend previous work in three main directions. First, we present a technique for extending these training procedures to much more general networks, with skip connections (such as ResNets) and general nonlinearities; the approach is fully modular, and can be implemented automatically (analogous to automatic differentiation). Second, in the specific case of ∞ adversarial perturbations and networks with ReLU nonlinearities, we adopt a nonlinear random projection for training, which scales linearly in the number of hidden units (previous approaches scaled quadratically). Third, we show how to further improve robust error through cascade models. On both MNIST and CIFAR data sets, we train classifiers that improve substantially on the state of the art in provable robust adversarial error bounds: from 5.8% to 3.1% on MNIST (with ∞ perturbations of = 0.1), and from 80% to 36.4% on CIFAR (with ∞ perturbations of = 2/255).

Review:
__ Post-rebuttal feedback: I thank the authors for the clarification. Based on the rebuttal letter, in the final version I'd suggest emphasizing the provable defense is guaranteed in probabilistic sense. Even though I agree in test time the geometric estimator is not necessary, what you indeed certified are training data, instead of test data. This is a nice piece of work and I enjoy reading it. __ This paper primarily builds upon the seminal work in [Wong-Kolter’17] to show improved and generalized verification and model robustness evaluation in three aspects: (I) extension to general networks (e.g., those with skip connections) and non-ReLU activation functions; (II) make the proposed verification method scalable via a nonlinear random projection technique, exhibiting linear computation complexity in the input dimension and the number of hidden units; (III) Verifiable bound improvement using model cascades. In my opinion, this work has made important contributions in norm-bounded robustness verification by proposing a scalable and more generic toolkit for robustness certification. The autodual framework is both theoretically grounded and algorithmically efficient. However, I also have two major concerns about this work: (I) the proposed nonlinear random projection leads to an estimated (i.e., probabilistic) lower bound of the minimum distortion towards misclassification, which is a soft robustness certification and does not follow the mainstream definition of deterministic lower bound; (II) Since this method yields an estimated lower bound, it then lacks performance comparison to existing bound estimation methods.   Strength: 1. This paper is well-written and it proposes a theoretically grounded and practically important solution to support scalable robustness verification of neural networks with different network architectures (e.g., skip connections) and non-ReLU activation functions.  2. To the best of my knowledge, this work is the first verification method that can scale up to more than 10K hidden units within a reasonable computation time.  Weakness: 1. An estimated lower bound (on minimum distortion for misclassification) is not a lower bound: I was very concerned that the current write-up may give a false sense of scalable “deterministic” defense. In order to speed up the computation, the use of the random projection makes the lower bound an estimation rather than a hard certificate. However, the notion of statistical lower bound (that means with some probability the result is not a lower bound) actually differs from the mainstream definition of verification – which needs to be deterministically verified, such as the definition in [Wong-Kolter’17]. Although the authors have discussed in the appendix on how to convert this probabilistic bound to the associated lower bound for certification, I am not quite convinced that one should call the proposed method a “provable defense”. I suggest modifying the title to be "Scaling adversarial defenses with statistical guarantees". The use of "provable" here is very vague and may be messed up with deterministic robustness certification. In the introduction, the authors should also highlight that the notion of robustness certification in this paper is statistical rather than deterministic. 2. Lack of performance comparison to existing methods: Since the proposed scalable approach yields a statistical estimate of a lower bound, there are already existing works that use extreme value theory to estimate the a lower bound, which is scalable to deep ImageNet classifiers and empirically aligned with the results of strong attacks (i.e., tight upper bounds). Due to the same spirit of efficient statistical estimation of a lower bound, I suggest the authors to compare with [R1] by fixing the same network and setting the \epsilon in Table 2 to be the same as the estimated lower bound in [R1] (by tuning ), and compare the resulting robust errors. 3. Extension beyond ReLU: One of the main contributions claimed in this work is the capability of certifying robustness for networks with non-ReLU activation functions. However, the experimental results are all based on ReLU networks and in the manuscript the authors merely refer readers to [Dvijotham et al., 2018]. I suggest including additional descriptions on the detailed procedures of incorporating the results in [Dvijotham et al., 2018] into the autodual framework and provide empirical results on non-ReLU networks for proper justification.  Summary:  This paper has made important contributions in scaling up the robustness certification method. However, the proposed method trades in the commonly used deterministic robustness guarantee to a probabilistic one (the latter is not a mainstream definition of certified robustness under norm-bounded perturbation attacks), and lacks performance comparison to existing methods that also use statistical estimates of lower bounds. Therefore, my main concerns are the credibility of probabilistic robustness guarantee and lacking performance comparison to other statistical robustness certification approaches.  [R1] Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach