Original: L EARNING C ONTEXTUAL P ERTURBATION B UDGETS FOR T RAINING R OBUST N EURAL N ETWORKS
Revised: L EARNING C ONTEXTUAL P ERTURBATION B UDGETS FOR T RAINING R OBUST N EURAL N ETWORKS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Existing methods for training robust neural networks generally aim to make models uniformly robust on all input dimensions.
Revised: Existing methods for training robust neural networks generally aim to make models uniformly robust on all input dimensions.

Original: However, different input dimensions are not uniformly important to the prediction.
Revised: However, different input dimensions are not uniformly important to the prediction.

Original: In this paper, we propose a novel framework to train certiﬁably robust models with non-uniform perturbation budgets on different input dimensions, in contrast to  the popular (cid:96) ∞ threat model that has uniform perturbation budgets.
Revised: In this paper, we propose a novel framework to train certiﬁably robust models and learn non-uniform perturbation budgets on different input dimensions, in contrast to using the popular (cid:96) ∞ threat model.

Original: We incorporate a perturbation budget generator into the existing certiﬁed defense framework, and perform certiﬁed training with generated perturbation budgets.
Revised: We incorporate a perturbation budget generator into the existing certiﬁed defense framework, and perform certiﬁed training with generated perturbation budgets.

Original: We also impose a “robustness volume” constraint on generated perturbation budgets to control the robustness intensity, in comparison to the radius of (cid:96) ∞ ball in previous works.
Revised: In comparison to the radius of (cid:96) ∞ ball in previous works, the robustness intensity is measured by robustness volume which is the multiplication of perturbation budgets on all input dimensions.

Original: We evaluate our method on MNIST and CIFAR-10 datasets and show that we can achieve lower clean and certiﬁed errors on relatively larger robustness volumes, compared to methods using uniform perturbation budgets.
Revised: We evaluate our method on MNIST and CIFAR-10 datasets and show that we can achieve lower clean and certiﬁed errors on relatively larger robustness volumes, compared to methods using uniform perturbation budgets.

Original: Further with two synthetic datasets constructed from MNIST and CIFAR-10, we also demonstrate that the perturbation budget generator can produce semantically-meaningful budgets, which implies that the generator can capture contextual information and the sensitivity of different features in input images.
Revised: Further with two synthetic datasets constructed from MNIST and CIFAR-10, we also demonstrate that the perturbation budget generator can produce semantically-meaningful budgets, which implies that the generator can capture contextual information and the sensitivity of different features in input images.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: It has been demonstrated that deep neural networks, although achieving impressive performance on various tasks, are vulnerable to adverarial perturbations (Szegedy et al., 2013).
Revised: It has been demonstrated that deep neural networks, although achieving impressive performance on various tasks, are vulnerable to adverarial perturbations (Szegedy et al., 2013).

Original: Models with high accuracy on clean and unperturbed data can be fooled to have extremely poor performance when input data are adversarially perturbed.
Revised: Models with high accuracy on clean and unperturbed data can be fooled to have extremely poor performance when input data are adversarially perturbed.

Original: The existence of adversarial perturbations causes concerns in safety-critical applications such as self-driving cars, face recognition and medical diagnosis.
Revised: The existence of adversarial perturbations causes concerns in safety-critical applications such as self-driving cars, face recognition and medical diagnosis.

Original: A number of methods have been proposed for training robust neural networks that can resist to adversarial perturbations to some extent.
Revised: A number of methods have been proposed for training robust neural networks that can resist to adversarial perturbations to some extent.

Original: Among them, adversarial training (Goodfellow et al., 2015;
Revised: Among them, adversarial training (Goodfellow et al., 2015;

Original: Madry et al., 2018) and certiﬁed defenses (Wong et al., 2018; Gowal et al., 2018; Zhang et al., 2020) are of the most reliable ones so far, and all of them are trying to make the network robust to any perturbation within an (cid:96) p norm ball.
Revised: Madry et al., 2018) and certiﬁed defenses (Wong et al., 2018; Gowal et al., 2018; Zhang et al., 2020) are of the most reliable ones so far, and most of them are trying to make the network robust to any perturbation within an (cid:96) p norm ball.

Original: Taking the commonly used (cid:96) ∞ -ball defense as an example, robust training methods aim to make model robust to (cid:15) perturbation on any pixel, which means the model is uniformly robust on all the input dimensions.
Revised: Taking the commonly used (cid:96) ∞ -ball defense as an example, robust training methods aim to make model robust to (cid:15) perturbation on any pixel, which means the model is uniformly robust on all the input dimensions.

Original: But is this a valid assumption we should make?
Revised: But is this a valid assumption we should make?

Original: As we know, human perception is non-uniform (humans focus on important features even though these features can be sensitive to small noise) and context dependent (what part of image is important heavily depends on what’s on the image).
Revised: As we know, human perception is non-uniform (humans focus on important features even though these features can be sensitive to small noise) and context dependent (what part of image is important heavily depends on what is on the image).

Revised: We expect a robust model to be close to human perception, rather than learn to defend against a particular ﬁxed threat model, e.g., the traditional (cid:96) ∞ -norm one.

Original: Intuitively, we expect a good model to be more robust to important features and less robust to unimportant features. Moreover, the “importance” of features should be context-dependent.
Revised: Intuitively, we expect a good model to be more sensitive to important features and less sensitive to unimportant features, and the importance of features should be context-dependent.

Original: Taking the MNIST hand-written digit classiﬁcation problem as an example, the digit 9 can be transformed to 4 simply by modifying just a few pixels on its head, so those pixels should be considered more important, and enforcing them to be robust to (cid:15) perturbation may not be correct.
Revised: Taking the MNIST hand-written digit classiﬁcation problem as an example, the digit 9 can be transformed to 4 simply by modifying just a few pixels on its head, so those pixels should be considered more important, and enforcing them to be robust to a large perturbation may not be correct.

Original: On the other hand, the pixels on the frame of such an input image, however, can be safely modiﬁed without changing the ground-truth label of the image.
Revised: On the other hand, the pixels on the frame of such an input image can be safely modiﬁed without changing the ground-truth label of the image.

Original: Therefore, a uniform (cid:15) budget in robust training can greatly hamper the performance of neural networks on certain tasks, and will force network to ignore some important features that are important for classiﬁcation.
Revised: Therefore, a uniform (cid:15) budget in robust training can greatly hamper the performance of neural networks on certain tasks, and will force network to ignore some important features that are important for classiﬁcation.

Original: Robustness certiﬁcation with non-uniform perturbation budgets has been discussed in a prior work (Liu et al., 2019), but training robust models and learning context-dependent perturbation budgets has not been addressed in prior works, which is  important for obtaining robust models and more challenging than certifying trained models only.
Revised: Robustness certiﬁcation with non-uniform perturbation budgets has been discussed in a prior work (Liu et al., 2019), but training robust models and learning context-dependent perturbation budgets has not been addressed in prior works, which is more challenging and important for obtaining robust models.

Original: A detailed discussion on our difference with Liu et al.
Revised: A detailed discussion on our difference with Liu et al.

Original: (2019) is in
Revised: (2019) is in

Original: Sec 2.2.
Revised: Sec.

Original: In this paper, we propose the ﬁrst method that can learn context-dependent  perturbation budgets in  robust training. Our algorithm is based on  certiﬁed defense algorithms that conduct robust veriﬁcation at each training step (Zhang et al., 2020; Xu et al., 2020).
Revised: In this paper, we propose the ﬁrst method that can learn context-dependent non-uniform perturbation budgets in certiﬁed robust training, based on prior certiﬁed defense algorithms on (cid:96) p -norm threat models (Zhang et al., 2020; Xu et al., 2020).

Original: To learn a context-dependent budget without introducing too many learnable parameters, we introduce a perturbation budget generator with an auxiliary neural network, to generate the context-dependent budgets based on the input image.
Revised: To learn a context-dependent budget without introducing too many learnable parameters, we introduce a perturbation budget generator with an auxiliary neural network, to generate the context-dependent budgets based on the input image.

Original: We also impose constraints on the generator to make generated budgets satisfy target robustness volumes and ranges of budgets, where robustness volume is deﬁned as the multiplication of budgets on each pixel.
Revised: We also impose constraints on the generator to make generated budgets satisfy target robustness volumes and ranges of budgets, where robustness volume is deﬁned as the multiplication of budgets on all input dimensions.

Original: We then train the classiﬁer with a linear-relaxation-based certiﬁed defense algorithm, auto LiRPA (Xu et al., 2020) generailized from CROWN-IBP (Zhang et al., 2020), to minimize the veriﬁed error under given budget constraints.
Revised: We then train the classiﬁer with a linear-relaxation-based certiﬁed defense algorithm, auto LiRPA (Xu et al., 2020) generalized from CROWN-IBP (Zhang et al., 2020), to minimize the veriﬁed error under given budget constraints.

Original: The gradients of the loss function can be backpropagated to the perturbation budgets, allowing training the classiﬁcation network and budget generator jointly in robust training.
Revised: The gradients of the loss function can be back-propagated to the perturbation budgets, allowing training the classiﬁcation network and budget generator jointly in robust training.

Original: Our contribution can be summarized below:
Revised: Our contribution can be summarized below:

Original: • We propose a novel algorithm to train robust networks with contextual perturbation budgets rather than uniform ones.
Revised: • We propose a novel algorithm to train robust networks with contextual perturbation budgets rather than uniform ones.

Original: We show that it can be incorporated into certiﬁed defense methods with linear relaxation-based robustness veriﬁcation.
Revised: We show that it can be incorporated into certiﬁed defense methods with linear relaxation-based robustness veriﬁcation.

Original: • We demonstrate that our method can effectively train both the classiﬁer and the perturbation generator jointly, and we able to train models on relatively larger robustness volumes and outperform those trained with uniform budgets.
Revised: • We demonstrate that our method can effectively train both the classiﬁer and the perturbation generator jointly, and we able to train models on relatively larger robustness volumes and outperform those trained with uniform budgets.

Original: • We also show that the learned perturbation budgets are semantically meaningful and align well with the importance of different pixels in the input image.
Revised: • We also show that the learned perturbation budgets are semantically meaningful and align well with the importance of different pixels in the input image.

Original: We further conﬁrm this with two synthetic tasks and datasets constructed from MNIST and CIFAR-10 respectively.
Revised: We further conﬁrm this with two synthetic tasks and datasets constructed from MNIST and CIFAR-10 respectively.

Original:  B ACKGROUND AND R ELATED W ORK 2. T RAINING R OBUST N EURAL N ETWORKS
Revised:  B ACKGROUND AND R ELATED W ORK 2. T RAINING R OBUST N EURAL N ETWORKS

Original: Since the discovery of adversarial examples (Szegedy et al.
Revised: Since the discovery of adversarial examples (Szegedy et al.

Original: (2013), Biggio et al.
Revised: (2013), Biggio et al.

Original: , a great number of works has been devoted to improving the robustness of neural networks from both attack and defense perspectives (Moosavi-Dezfooli et al., 2016; Carlini & Wagner, 2017; Papernot et al., 2016; Moosavi-Dezfooli et al., 2017; Gowal et al., 2019).
Revised: , a great number of works has been devoted to improving the robustness of neural networks from both attack and defense perspectives (Moosavi-Dezfooli et al., 2016; Carlini & Wagner, 2017; Papernot et al., 2016; Moosavi-Dezfooli et al., 2017; Gowal et al., 2019).

Original: On a K -way classiﬁcation task, training an adversarially robust neural network f w with weight w can generally be formulated as solving the following min-max optimization problem:
Revised: On a K -way classiﬁcation task, training an adversarially robust neural network f w with weight w can generally be formulated as solving the following min-max optimization problem:

Original: [Equation]
Revised: [Equation]

Original: where D is the data distribution, and ∆ is a threat model deﬁning the space of the perturbations, and
Revised: where D is the data distribution, and ∆ is a threat model deﬁning the space of the perturbations, and

Original: L is a loss function.
Revised: L is a loss function.

Original: Adversarial training (Goodfellow et al., 2015; Madry et al., 2018) applies adversarial attacks to solve the inner maximization problem and train the neural network on generated adversarial examples, with efﬁciency advanced in some recent works (Shafahi et al., 2019; Wong et al., 2020).
Revised: Adversarial training (Goodfellow et al., 2015; Madry et al., 2018) applies adversarial attacks to solve the inner maximization problem and train the neural network on generated adversarial examples, with efﬁciency advanced in some recent works (Shafahi et al., 2019; Wong et al., 2020).

Original: However, robustness improvements from adversarial training do not have provable guarantees.
Revised: However, robustness improvements from adversarial training do not have provable guarantees.

Original: Some other recent works seek to train networks that have provable robustness, namely certiﬁed defense methods.
Revised: Some other recent works seek to train networks that have provable robustness, namely certiﬁed defense methods.

Original: Such methods solves the inner maximization by computing certiﬁed upper bounds that provably hold true for any perturbation within the threat model, including abstract interpretation (Singh et al., 2018), interval bound propagation (Gowal et al., 2018; Mirman et al., 2018), randomized smoothing (Cohen et al., 2019; Salman et al., 2019; Zhai et al., 2020), and linear-relaxation-based methods (Wong & Kolter, 2018; Mirman et al., 2018; Wong et al., 2018; Zhang et al., 2020; Xu et al., 2020).
Revised: Such methods solves the inner maximization by computing certiﬁed upper bounds that provably hold true for any perturbation within the threat model, including abstract interpretation (Singh et al., 2018), interval bound propagation (Gowal et al., 2018; Mirman et al., 2018), randomized smoothing (Cohen et al., 2019; Salman et al., 2019; Zhai et al., 2020), and linear-relaxation-based methods (Wong & Kolter, 2018; Mirman et al., 2018; Wong et al., 2018; Zhang et al., 2020; Xu et al., 2020).

Original: However, nearly all existing certiﬁed defense methods treat all input features equally in the threat model, such as an (cid:96) p -ball threat models, ∆= { δ : (cid:107) δ (cid:107) p ≤ (cid:15) } , especially the (cid:96) ∞ threat model commonly used in many previous works.
Revised: However, nearly all existing certiﬁed defense methods treat all input features equally in the threat model, such as an (cid:96) p -ball threat models, ∆= { δ : (cid:107) δ (cid:107) p ≤ (cid:15) } , especially the (cid:96) ∞ threat model commonly used in many previous works.

Original: But different input pixels are not uniformly important to the prediction, and thus we propose to learn contextual perturbation budgets for different pixels.
Revised: But different input pixels are not uniformly important to the prediction, and thus we propose to learn contextual perturbation budgets for different pixels.

Original: 2. R OBUSTNESS C ERTIFICATION WITH N ON -U NIFORM B UDGETS
Revised: 2. R OBUSTNESS C ERTIFICATION WITH N ON -U NIFORM B UDGETS

Original: There has been a recent work Liu et al.
Revised: There has been a recent work Liu et al.

Original: (2019) studying robustness certiﬁcation with non-uniform budgets.
Revised: (2019) studying robustness certiﬁcation with non-uniform budgets.

Original: Their work aims to maximize the robustness volume while ensuring the network prediction is certiﬁably correct, and this optimization problem is solved using augmented Lagrangian method.
Revised: Their work aims to maximize the robustness volume while ensuring the network prediction is certiﬁably correct, and this optimization problem is solved using augmented Lagrangian method.

Original: To highlight, their method has several limitations: 1) The perturbation budgets are obtained by solving a constrained optimization problem for each input example, which is very time-consuming.
Revised: To highlight, their method has several limitations: 1) The perturbation budgets are obtained by solving a constrained optimization problem for each input example, which is very time-consuming.

Original: This is not only too inefﬁcient for training as it can bring a large overhead in each training step, but also incapable for learning perturbation budgets jointly with the classiﬁer.
Revised: This is not only too inefﬁcient for training as it can bring a large overhead in each training step, but also incapable for learning perturbation budgets jointly with the classiﬁer.

Original: In contrast, we have a signiﬁcantly different scheme – we aim to maximize the accuracy under given target robustness volumes.
Revised: In contrast, we have a signiﬁcantly different scheme – we aim to maximize the accuracy under given target robustness volumes.

Original: And our perturbation budgets is obtained with a lightweight neural-network-based generator, and it can be jointly trained with the classiﬁer in an end-to-end way.
Revised: And our perturbation budgets is obtained with a lightweight neural-network-based generator, and it can be jointly trained with the classiﬁer in an end-to-end way.

Original: Their work only focuses on certifying trained models due to the inherent limitation of the method, while we address of the problem of training robust neural networks and learning contextual perturbation budgets simultaneously.
Revised: Their work only focuses on certifying trained models due to the inherent limitation of the method, while we address of the problem of training robust neural networks and learning contextual perturbation budgets simultaneously.

Original: Consequently, we are able to empirically demonstrate that we can effectively train robust models with much larger robustness volumes and achieve lower errors under given target robustness volumes.
Revised: Consequently, we are able to empirically demonstrate that we can effectively train robust models with much larger robustness volumes and achieve lower errors under given target robustness volumes.

Original: We further have experiments with synthetic tasks on MNIST and CIFAR-10 in Sec.
Revised: We further have experiments with synthetic tasks on MNIST and CIFAR-10 in Sec.

Original: 4.2 and Sec. 4.
Revised: 4.2 and Sec. 4.

Original: respectively to demonstrate that the learned perturbation budgets are semantically meaningful and can capture contextual information.
Revised: respectively to demonstrate that the learned perturbation budgets are semantically meaningful and can capture contextual information.

Original:  P ROPOSED M ETHOD 3. P ROBLEM S ETTING
Revised:  P ROPOSED M ETHOD 3. P ROBLEM S ETTING

Original: Variable threat model Unlike many previous works that use an (cid:96) ∞ threat model with a uniform (cid:15) on all input dimensions, we allow different pixels to have different perturbation budgets, but they need to meet some constraints as we will deﬁne below.
Revised: Variable threat model Unlike many previous works that use an (cid:96) ∞ threat model with a uniform (cid:15) on all input dimensions, we allow different pixels to have different perturbation budgets, but they need to meet some constraints as we will deﬁne below.

Original: For an n -dimensional input x , when the perturbation budget of pixel x i is (cid:15) i , the threat model is ∆( (cid:15) 1 , (cid:15) 2 ,
Revised: For an n -dimensional input x , when the perturbation budget of pixel x i is (cid:15) i , the threat model is ∆( (cid:15) 1 , (cid:15) 2 ,

Original: [Equation]
Revised: [Equation]

Original: And thereby the (cid:96) ∞ threat model is a special case with (cid:15)
Revised: And thereby the (cid:96) ∞ threat model is a special case with (cid:15)

Original: i = (cid:15) 

Revised: i = (cid:15)

Original: ( ∀ 1 ≤ i ≤ n ) .
Revised: ( ∀ 1 ≤ i ≤ n ) .

Original: We deﬁne the robustness volume of a threat model ∆ as the multiplication of all (cid:15) i (1 ≤ i ≤ n ) :
Revised: We deﬁne the robustness volume of a threat model ∆ as the multiplication of all (cid:15) i (1 ≤ i ≤ n ) :

Original: [Equation]
Revised: [Equation]

Original: In principal, we have a target robustness volume , V 

Revised: In principal, we have a target robustness volume , V

Original: = (cid:15) n 0 , and f w is considered to be provably robust under this target robustness volume on instance ( x , y )
Revised: = (cid:15) n 0 , and f w is considered to be provably robust under this target robustness volume on instance ( x , y )

Original: if and only if:
Revised: if and only if:

Original: [Equation]
Revised: [Equation]

Original: This means that the predicted score of the ground-truth class y is certiﬁably larger than any other class k (cid:54) =
Revised: This means that the predicted score of the ground-truth class y is certiﬁably larger than any other class k (cid:54) =

Original: y under some threat model ∆ .
Revised: y under some threat model ∆ .

Original: And instead of using a ﬁxed ∆ , in our framework ∆ can be taken from a threat model space D , which consists of threat models ∆( (cid:15) 1 , (cid:15) 2 , · · · , (cid:15) n ) satisfying the following two constraints:
Revised: And instead of using a ﬁxed ∆ , in our framework ∆ can be taken from a threat model space D , which consists of threat models ∆( (cid:15) 1 , (cid:15) 2 , · · · , (cid:15) n ) satisfying the following two constraints:

Original: [Equation]
Revised: [Equation]

Original: The volume constraint states that the robustness volume of ∆ is equal to the target robustness volume (cid:15) n 0 (written in log domain above).
Revised: The volume constraint states that the robustness volume of ∆ is equal to the target robustness volume (cid:15) n 0 (written in log domain above).

Original: For the range constraint, there are relative factors α and α controlling the perturbation budget range of each pixel, namely [ l, u ] .
Revised: For the range constraint, there are relative factors α and α controlling the perturbation budget range of each pixel, namely [ l, u ] .

Original: This constraint can be set to guarantee a minimum robustness and also prevent the model from over-invariant on each pixel.
Revised: This constraint can be set to guarantee a minimum robustness and also prevent the model from over-invariant on each pixel.

Original: Perturbation budget generation A classiﬁer can be accompanied by a perturbation budget generator (cid:15) ( x ) which tries to ﬁnd perturbation budgets (cid:15) 1 , (cid:15) 2 , · · · , (cid:15) n and the corresponding threat model ∆( x ) that can minimize the veriﬁed loss of the classiﬁer while satisfying constraints (4) and (5), so that (3) is more likely to hold true with ∆ generated by (cid:15) ( x ) .
Revised: Perturbation budget generation A classiﬁer can be accompanied by a perturbation budget generator (cid:15) ( x ) which tries to ﬁnd perturbation budgets (cid:15) 1 , (cid:15) 2 , · · · , (cid:15) n and the corresponding threat model ∆( x ) that can minimize the veriﬁed loss of the classiﬁer while satisfying constraints (4) and (5), so that (3) is more likely to hold true with ∆ generated by (cid:15) ( x ) .

Original: We will state the optimization problem in the next paragraph.
Revised: We will state the optimization problem in the next paragraph.

Original: Robust classiﬁcation Accompanied by a perturbation budget generator, we aim to learn a robust classiﬁer f w with the following min-max optimization problem:
Revised: Robust classiﬁcation Accompanied by a perturbation budget generator, we aim to learn a robust classiﬁer f w with the following min-max optimization problem:

Original: [Equation]
Revised: [Equation]

Original: Note that a key difference between this problem and the traditional one in (1) is that now the threat model ∆( x ) is variable and dependent on the input x .
Revised: Note that a key difference between this problem and the traditional one in (1) is that now the threat model ∆( x ) is variable and dependent on the input x .

Original: This ∆( x ) is generated by (cid:15) ( x ) , under the given volume and range constraints.
Revised: This ∆( x ) is generated by (cid:15) ( x ) , under the given volume and range constraints.

Original: We evaluate the robustness of a classiﬁer f w by computing an average veriﬁed error on all the test instances, where the veriﬁed correctness on each instance is evaluated similarly as (3), where ∆ is taken as the generated ∆( x ) .
Revised: We evaluate the robustness of a classiﬁer f w by computing an average veriﬁed error on all the test instances, where the veriﬁed correctness on each instance is evaluated similarly as (3), where ∆ is taken as the generated ∆( x ) .

Original: 3. A LGORITHM F RAMEWORK
Revised: 3. A LGORITHM F RAMEWORK

Original: Figure 1 illustrates our algorithm framework.
Revised: Figure 1 illustrates our algorithm framework.

Original: Given an input x , the perturbation budget generator outputs perturbation budgets (cid:15) ( x ) based on an auxiliary network g θ ( x ) parameterized by θ .
Revised: Given an input x , the perturbation budget generator outputs perturbation budgets (cid:15) ( x ) based on an auxiliary network g θ ( x ) parameterized by θ .

Original: Then a robustness veriﬁer takes the unperturbed input x and perturbation budgets (cid:15) ( x ) as input and computes a robust loss function L rob ( x , (cid:15) ( x )) .
Revised: Then a robustness veriﬁer takes the unperturbed input x and perturbation budgets (cid:15) ( x ) as input and computes a robust loss function L rob ( x , (cid:15) ( x )) .

Original: During training, this loss function is back propagated to compute its gradients w.r.t.
Revised: During training, this loss function is back propagated to compute its gradients w.r.t.

Original: the parameters of the classiﬁer f w and also perturbation budgets (cid:15) ( x ) , and the gradients w.r.t.
Revised: the parameters of the classiﬁer f w and also perturbation budgets (cid:15) ( x ) , and the gradients w.r.t.

Original: (cid:15) ( x ) are further propagated the parameters of g θ ( x ) .
Revised: (cid:15) ( x ) are further propagated the parameters of g θ ( x ) .

Original: f w and g θ are jointly trained to minimize the robust loss.
Revised: f w and g θ are jointly trained to minimize the robust loss.

Original: During test, the veriﬁer also outputs a veriﬁed error for evaluation by computing the lower bound of the margin, m ( x , (cid:15) ( x ))
Revised: During test, the veriﬁer also outputs a veriﬁed error for evaluation by computing the lower bound of the margin, m ( x , (cid:15) ( x ))

Original: (see Sec. 3.4).
Revised: (see Sec. 3.4).

Original: 3. P ERTURBATION B UDGET G ENERATOR
Revised: 3. P ERTURBATION B UDGET G ENERATOR

Original: For the perturbation budget generator (cid:15) ( x ) , we generate perturbation budgets in two steps.
Revised: For the perturbation budget generator (cid:15) ( x ) , we generate perturbation budgets in two steps.

Original: In the ﬁrst step, we generate initial perturbation budgets that are only required to meet the range constraint.
Revised: In the ﬁrst step, we generate initial perturbation budgets that are only required to meet the range constraint.

Original: And in the second step, we reﬁne the perturbation budgets to meet the volume constraint.
Revised: And in the second step, we reﬁne the perturbation budgets to meet the volume constraint.

Original: These two steps are detailed below.
Revised: These two steps are detailed below.

Original: Initial perturbation budgets We ﬁrst use a neural network g θ ( x ) ∈ [0 , 1] n to generate an initial budget distribution.
Revised: Initial perturbation budgets We ﬁrst use a neural network g θ ( x ) ∈ [0 , 1] n to generate an initial budget distribution.

Original: Speciﬁcally, we assign [˜ (cid:15) ( x )]
Revised: Speciﬁcally, we assign [˜ (cid:15) ( x )]

Original: i =
Revised: i =

Original: exp(log l + [ g θ ( x )]
Revised: exp(log l + [ g θ ( x )]

Original: i (log u − log l )) as the initial budget of the i -th pixel, and thereby [˜ (cid:15) ( x )] i ∈
Revised: i (log u − log l )) as the initial budget of the i -th pixel, and thereby [˜ (cid:15) ( x )] i ∈

Original: [ l, u ] .
Revised: [ l, u ] .

Original: In our work, we employ a two-layer convolutional model with a sigmoid activation in the last as g θ ( x ) .
Revised: In our work, we employ a two-layer convolutional model with a sigmoid activation in the last as g θ ( x ) .

Original: Reﬁning the perturbation budgets We then reﬁne the perturbation budgets to make them meet the volume constraint.
Revised: Reﬁning the perturbation budgets We then reﬁne the perturbation budgets to make them meet the volume constraint.

Original: We compute the log volume of these budgets, log V = n log l + (log u − log l ) (cid:80) i
Revised: We compute the log volume of these budgets, log V = n log l + (log u − log l ) (cid:80) i

Original: [˜ (cid:15) ( x )] i , and compare it with the target log robustness volume log V 

Revised: [˜ (cid:15) ( x )] i , and compare it with the target log robustness volume log V

Original: = n log (cid:15) 0 .
Revised: = n log (cid:15) 0 .

Original: If V <V 0 , we need to allocate ( V 0 − V ) to the log perturbation budgets of different pixels, while still ensuring that each budget is no larger than u .
Revised: If V <V 0 , we need to allocate ( V 0 − V ) to the log perturbation budgets of different pixels, while still ensuring that each budget is no larger than u .

Original: This allocation is done proportionally according to the distance between the current log perturbation budget log[˜ (cid:15) ( x )]
Revised: This allocation is done proportionally according to the distance between the current log perturbation budget log[˜ (cid:15) ( x )]

Original: i and the upper limit log u of each pixel, for each pixel i , and then budget log[ (cid:15) ( x )]
Revised: i and the upper limit log u of each pixel, for each pixel i , and then budget log[ (cid:15) ( x )]

Original: i is obtained with:
Revised: i is obtained with:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: for V <V 0 = n log (cid:15) 0 .
Revised: for V <V 0 = n log (cid:15) 0 .

Original: If V > n log (cid:15) 0 , we remove redundant perturbation budgets.
Revised: If V > n log (cid:15) 0 , we remove redundant perturbation budgets.

Original: Similar to previous case, this reﬁnement is done proportionally according to the distance between log[ (cid:15) ( x )]
Revised: Similar to previous case, this reﬁnement is done proportionally according to the distance between log[ (cid:15) ( x )]

Original: i and the lower limit log l : log[ (cid:15) ( x )] i = log[˜ (cid:15) ( x )] i − ( V − n log (cid:15) 0 )log[˜ (cid:15) ( x )]
Revised: i and the lower limit log l : log[ (cid:15) ( x )] i = log[˜ (cid:15) ( x )] i − ( V − n log (cid:15) 0 )log[˜ (cid:15) ( x )]

Original: i − log l V − n log l for V >V 0 = n log (cid:15) 0 .
Revised: i − log l V − n log l for V >V 0 = n log (cid:15) 0 .

Original: 3. C ERTIFIED T RAINING WITH N ON -U NIFORM P ERTURBATION B UDGETS
Revised: 3. C ERTIFIED T RAINING WITH N ON -U NIFORM P ERTURBATION B UDGETS

Original: For the robustness veriﬁer, we adopt auto LiRPA (Xu et al., 2020).
Revised: For the robustness veriﬁer, we adopt auto LiRPA (Xu et al., 2020).

Original: It is based on linear relaxations and generalized from CROWN-IBP (Zhang et al., 2020), and there is also a loss fusion technique for more efﬁcient robust training.
Revised: It is based on linear relaxations and generalized from CROWN-IBP (Zhang et al., 2020), and there is also a loss fusion technique for more efﬁcient robust training.

Original: In CROWN-IBP and also the default setting in auto LiRPA, there are generally two passes for each input batch, excluding the gradient back-propagation pass.
Revised: In CROWN-IBP and also the default setting in auto LiRPA, there are generally two passes for each input batch, excluding the gradient back-propagation pass.

Original: In the ﬁrst pass, Interval Bound Propagation (IBP) (Mirman et al., 2018; Gowal et al., 2018) is used to compute the output bounds of intermediate layers, which is required by linear relaxations.
Revised: In the ﬁrst pass, Interval Bound Propagation (IBP) (Mirman et al., 2018; Gowal et al., 2018) is used to compute the output bounds of intermediate layers, which is required by linear relaxations.

Original: Given an input x and a uniform perturbation budget (cid:15) , the input of the IBP pass is the lower and upper bounds of the input image, [ Clip ( x − (cid:15) ) , Clip ( x + (cid:15) )] , where Clip ( · ) stands for clipping the image bounds into domain [0 , 1] n .
Revised: Given an input x and a uniform perturbation budget (cid:15) , the input of the IBP pass is the lower and upper bounds of the input image, [ Clip ( x − (cid:15) ) , Clip ( x + (cid:15) )] , where Clip ( · ) stands for clipping the image bounds into domain [0 , 1] n .

Original: In the second pass, the CROWN algorithm (Zhang et al., 2018) is applied on the output layer to compute its linear bounds w.r.t.
Revised: In the second pass, the CROWN algorithm (Zhang et al., 2018) is applied on the output layer to compute its linear bounds w.r.t.

Original: perturbed input ( x + δ ) , utilizing intermediate bounds by IBP for linearly relaxing activation functions.
Revised: perturbed input ( x + δ ) , utilizing intermediate bounds by IBP for linearly relaxing activation functions.

Original: Let h ( x + δ ) represent the output layer, then its linear bounds w.r.t.
Revised: Let h ( x + δ ) represent the output layer, then its linear bounds w.r.t.

Original: ( x + δ ) and concrete (ﬁnal) bounds without ( x + δ ) are (Zhang et al., 2018):
Revised: ( x + δ ) and concrete (ﬁnal) bounds without ( x + δ ) are (Zhang et al., 2018):

Original: [Equation]
Revised: [Equation]

Original: where A , A , b , b are parameters of linear bounds obtained by CROWN.
Revised: where A , A , b , b are parameters of linear bounds obtained by CROWN.

Original: We refer readers to Xu et al.
Revised: We refer readers to Xu et al.

Original: (2020) for their detailed algorithm.
Revised: (2020) for their detailed algorithm.

Original: When non-uniform perturbation budgets are used, (cid:15) ( x ) from the perturbation generator is used rather than scalar (cid:15) .
Revised: When non-uniform perturbation budgets are used, (cid:15) ( x ) from the perturbation generator is used rather than scalar (cid:15) .

Original: This causes differences mainly on the input lower and upper bounds for the IBP pass and the concretization of linear bounds in (7).
Revised: This causes differences mainly on the input lower and upper bounds for the IBP pass and the concretization of linear bounds in (7).

Original: In inference, we compute the lower bound of the minimum margin between the ground truth label y and any other label i (cid:54) =
Revised: In inference, we compute the lower bound of the minimum margin between the ground truth label y and any other label i (cid:54) =

Original: y :
Revised: y :

Original: [Equation]
Revised: [Equation]

Original: , where m
Revised: , where m

Original: [Equation]
Revised: [Equation]

Original: x +
Revised: x +

Original: [Equation]
Revised: [Equation]

Original: =
Revised: =

Original: [Equation]
Revised: [Equation]

Original: by taking the margin functions as the output layer in robustness veriﬁcation.
Revised: by taking the margin functions as the output layer in robustness veriﬁcation.

Original: m ( x , (cid:15) ( x )) is the lower bound of the margin for all possible perturbation δ ∈ ∆ .
Revised: m ( x , (cid:15) ( x )) is the lower bound of the margin for all possible perturbation δ ∈ ∆ .

Original: The classiﬁer is veriﬁably robust on this instance and the threat model ∆( x ) from the generated perturbation budgets, if m ( x , (cid:15) ( x )) > 0 , as deﬁned in (3).
Revised: The classiﬁer is veriﬁably robust on this instance and the threat model ∆( x ) from the generated perturbation budgets, if m ( x , (cid:15) ( x )) > 0 , as deﬁned in (3).

Original: During training, we use loss fusion (Xu et al., 2020), to compute and optimize the robust loss
Revised: During training, we use loss fusion (Xu et al., 2020), to compute and optimize the robust loss

Original: L rob ( x
Revised: L rob ( x

Original: [Equation]
Revised: [Equation]

Original: where the robust loss is an upper bound of the right-hand-side, obtained from the veriﬁer.
Revised: where the robust loss is an upper bound of the right-hand-side, obtained from the veriﬁer.

Original: The auto LiRPA veriﬁer is differentiable and thus we are able to back-propagate the gradients of the loss function w.r.t.
Revised: The auto LiRPA veriﬁer is differentiable and thus we are able to back-propagate the gradients of the loss function w.r.t.

Original: the parameters of the both classiﬁer and perturbation budget generator for training.
Revised: the parameters of the both classiﬁer and perturbation budget generator for training.

Original: In contrast, this joint training appears to be more difﬁcult for adversarial training methods such as Projected Gradient Descent (PGD) attack (Madry et al., 2018).
Revised: In contrast, this joint training appears to be more difﬁcult for adversarial training methods such as Projected Gradient Descent (PGD) attack (Madry et al., 2018).

Original: The PGD loss is technically differentiable to the perturbation budgets.
Revised: The PGD loss is technically differentiable to the perturbation budgets.

Original: However, take N -step PGD training as an example, each step we add a noise roughly (cid:15)N , so the (cid:15) is used by every step of PGD.
Revised: However, take N -step PGD training as an example, each step we add a noise roughly (cid:15)N , so the (cid:15) is used by every step of PGD.

Original: Eventually, to get the correct gradient w.r.t (cid:15) , we will need to backprop through the N PGD update steps, which makes the gradient complicated and hard to calculate.
Revised: Eventually, to get the correct gradient w.r.t (cid:15) , we will need to backprop through the N PGD update steps, which makes the gradient complicated and hard to calculate.

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: We conduct experiments mainly on MNIST (LeCun et al., 2010) and CIFAR-10 (Krizhevsky et al., 2009) to demonstrate the effectiveness of our proposed method.
Revised: We conduct experiments mainly on MNIST (LeCun et al., 2010) and CIFAR-10 (Krizhevsky et al., 2009) to demonstrate the effectiveness of our proposed method.

Original: We show that our method can effectively train certiﬁably robust models with learned contextual perturbation budgets, and the models achieve lower veriﬁed errors compared to those using uniform budgets.
Revised: We show that our method can effectively train certiﬁably robust models with learned contextual perturbation budgets, and the models achieve lower veriﬁed errors compared to those using uniform budgets.

Original: We also constructed two synthetic datasets to demonstrate that the learned perturbation budgets are semantically meaningful.
Revised: We also constructed two synthetic datasets to demonstrate that the learned perturbation budgets are semantically meaningful.

Original: We report implementation details in Appendix A.
Revised: We report implementation details in Appendix A.

Original: 4. E XPERIMENTS ON MNIST AND CIFAR- 
Revised: 4. E XPERIMENTS ON MNIST AND CIFAR-

Original: For MNIST, we consider robustness volumes with (cid:15) 0 = 0 .
Revised: For MNIST, we consider robustness volumes with (cid:15) 0 = 0 .

Original: 8 respectively and set α to 0.
Revised: 8 respectively and set α to 0.

Original: and α = 2 . 0 , and for CIFAR-10, we consider (cid:15) 

Revised: and α = 2 . 0 , and for CIFAR-10, we consider (cid:15)

Original: = 8 / 255 , 32 / 255 respectively and set α to 0.
Revised: = 8 / 255 , 32 / 255 respectively and set α to 0.

Original: and α to 2.0.
Revised: and α to 2.0.

Original: We reproduce baseline models with uniform budgets following the best setting in
Revised: We reproduce baseline models with uniform budgets following the best setting in

Original: CROWN-IBP (Zhang et al., 2020), and in particular, the models with uniform perturbation budgets (cid:15) 

Revised: CROWN-IBP (Zhang et al., 2020), and in particular, the models with uniform perturbation budgets (cid:15)

Original: = 0 .
Revised: = 0 .

Original: 4 on MNIST and (cid:15) 

Revised: 4 on MNIST and (cid:15)

Original: = 8 / 255 on CIFAR-10 are directly downloaded from their released models 1 .
Revised: = 8 / 255 on CIFAR-10 are directly downloaded from their released models 1 .

Original: We evaluate the baseline models and our models with learned perturbation budgets mainly using clean error and veriﬁed error with the corresponding type of perturbation budgets used for training, i.e., baseline models are veriﬁed with uniform budgets and our models are veriﬁed with learned budgets.
Revised: We evaluate the baseline models and our models with learned perturbation budgets mainly using clean error and veriﬁed error with the corresponding type of perturbation budgets used for training, i.e., baseline models are veriﬁed with uniform budgets and our models are veriﬁed with learned budgets.

Original: In addition, we also report veriﬁed error computed with Liu et al.
Revised: In addition, we also report veriﬁed error computed with Liu et al.

Original: (2019) 2 , where the model is considered as veriﬁed on an example if and only if the volume of perturbation budgets by Liu et al.
Revised: (2019) 2 , where the model is considered as veriﬁed on an example if and only if the volume of perturbation budgets by Liu et al.

Original: (2019) is at least (cid:15) n 0 .
Revised: (2019) is at least (cid:15) n 0 .

Original: 8 respectively.
Revised: 8 respectively.

Original: For veriﬁed errors in evaluation, we provide results evaluated with the method by Liu et al.
Revised: For veriﬁed errors in evaluation, we provide results evaluated with the method by Liu et al.

Original: (2019), on uniform budgets, and on our learned budgets respectively
Revised: (2019), on uniform budgets, and on our learned budgets respectively

Original: [Table]
Revised: [Table]

Original: [Table]
Revised: [Table]

Original: Results are shown in Table 1 for MNIST and Table 2 for CIFAR-10.
Revised: Results are shown in Table 1 for MNIST and Table 2 for CIFAR-10.

Original: On MNIST, on the smaller (cid:15) 0 = 0 .
Revised: On MNIST, on the smaller (cid:15) 0 = 0 .

Original: 4 target volume, our model has lower clean error and lower veriﬁed error on learned budgets, compared to the model trained and evaluated with uniform budgets, though the veriﬁed error of our model is higher than the one trained with uniform budgets when evaluating with Liu et al.
Revised: 4 target volume, our model has lower clean error and lower veriﬁed error on learned budgets, compared to the model trained and evaluated with uniform budgets, though the veriﬁed error of our model is higher than the one trained with uniform budgets when evaluating with Liu et al.

Original: When using larger target volumes, we ﬁnd that training with uniform budgets totally fail on (cid:15) 

Revised: When using larger target volumes, we ﬁnd that training with uniform budgets totally fail on (cid:15)

Original: = 0 .and
Revised: = 0 .and

Original: (cid:15) 

Revised: (cid:15)

Original: = 0 . 8 , because we are able to totally break the classiﬁcation by perturbing every pixel to 0.5 under uniform perturbation budgets (cid:15)
Revised: = 0 . 8 , because we are able to totally break the classiﬁcation by perturbing every pixel to 0.5 under uniform perturbation budgets (cid:15)

Original: = 0 .
Revised: = 0 .

Original: 6 or (cid:15) = 0 . 8 , and the model trained with (cid:15) 

Revised: 6 or (cid:15) = 0 . 8 , and the model trained with (cid:15)

Original: = 

Revised: =

Original: .uniform budget is not able to generalize to (cid:15) 0 = 0 .
Revised: .uniform budget is not able to generalize to (cid:15) 0 = 0 .

Original: 6 and (cid:15) 

Revised: 6 and (cid:15)

Original: = 0 .
Revised: = 0 .

Original: 8 target robustness volumes in test.
Revised: 8 target robustness volumes in test.

Original: In contrast to using uniform budgets, with our learned budgets, we are able to handle (cid:15) 

Revised: In contrast to using uniform budgets, with our learned budgets, we are able to handle (cid:15)

Original: = 0 .
Revised: = 0 .

Original: 6 and (cid:15) 

Revised: 6 and (cid:15)

Original: = 0 . 8 , achieving reasonable veriﬁed errors.
Revised: = 0 . 8 , achieving reasonable veriﬁed errors.

Original: Moreover, on CIFAR-10, our models using learned
Revised: Moreover, on CIFAR-10, our models using learned

Original: [Figure]
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: cat ship ship airplane frog frog automobile frog cat automobile
Revised: cat ship ship airplane frog frog automobile frog cat automobile

Original: For better visualization, the visualized budgets are normalized by the upper limit of the perturbation budgets, 32/255, since the budgets on CIFAR-10 are much smaller than 1.
Revised: For better visualization, the visualized budgets are normalized by the upper limit of the perturbation budgets, 32/255, since the budgets on CIFAR-10 are much smaller than 1.

Original: budgets achieve lower veriﬁed errors than models with uniform budgets on both (cid:15) 

Revised: budgets achieve lower veriﬁed errors than models with uniform budgets on both (cid:15)

Original: = 8 / 255 and (cid:15) 

Revised: = 8 / 255 and (cid:15)

Original: = 32 / 255 .
Revised: = 32 / 255 .

Original: The experiments demonstrates the effectiveness of our method for training more robust models under non-uniform perturbation budgets.
Revised: The experiments demonstrates the effectiveness of our method for training more robust models under non-uniform perturbation budgets.

Original: We note that our models have higher veriﬁed errors when evaluated on uniform budgets, but evaluation on uniform budgets is not the major goal of this paper, nor it is the ultimate goal of robust machine learning, as we have argued that non-uniform budgets are more practical.
Revised: We note that our models have higher veriﬁed errors when evaluated on uniform budgets, but evaluation on uniform budgets is not the major goal of this paper, nor it is the ultimate goal of robust machine learning, as we have argued that non-uniform budgets are more practical.

Original: Nevertheless, in case that one expects to maintain a performance on uniform budgets while training with non-uniform learned budgets, this can be achieved by setting α which controls the minimum budget of each pixel, as we demonstrate in Appendix C.
Revised: Nevertheless, in case that one expects to maintain a performance on uniform budgets while training with non-uniform learned budgets, this can be achieved by setting α which controls the minimum budget of each pixel, as we demonstrate in Appendix C.

Original: We also visualize our learned perturbation budget distributions in Figure 2 and Figure 3 for MNIST and CIFAR-10 respectively.
Revised: We also visualize our learned perturbation budget distributions in Figure 2 and Figure 3 for MNIST and CIFAR-10 respectively.

Original: Our perturbation budget generator is able to identify important and sensitive features in the input image and assign relatively smaller budgets to the corresponding pixels, while insensitive pixels are assigned with relatively larger perturbation budgets.
Revised: Our perturbation budget generator is able to identify important and sensitive features in the input image and assign relatively smaller budgets to the corresponding pixels, while insensitive pixels are assigned with relatively larger perturbation budgets.

Original: Note that the perturbation budgets also highlight sensitive pixels that are missing from input images.
Revised: Note that the perturbation budgets also highlight sensitive pixels that are missing from input images.

Original: Therefore, learned perturbations contain important features from both the ground truth class and the classes that are close to it.
Revised: Therefore, learned perturbations contain important features from both the ground truth class and the classes that are close to it.

Original: For example, as visualized in Figure 2, perturbation budgets of digit 4 combine features from both 4 and 9, and digit 5 looks like 5 overlapped with 8.
Revised: For example, as visualized in Figure 2, perturbation budgets of digit 4 combine features from both 4 and 9, and digit 5 looks like 5 overlapped with 8.

Original: 4. E XPERIMENTS ON W ATERMARKED MNIST
Revised: 4. E XPERIMENTS ON W ATERMARKED MNIST

Original: [Figure]
Revised: [Figure]

Original: To demonstrate another beneﬁt of using different perturbation budgets for different pixels, we artiﬁcially constructed a dataset from MNIST, namely the Watermarked MNIST.
Revised: To demonstrate another beneﬁt of using different perturbation budgets for different pixels, we artiﬁcially constructed a dataset from MNIST, namely the Watermarked MNIST.

Original: For each image in the original MNIST dataset, as shown in the ﬁrst row of Figure 4, we add a small watermark to the left or right margin of the image, which decides the gold label jointly with the main digit in the image.
Revised: For each image in the original MNIST dataset, as shown in the ﬁrst row of Figure 4, we add a small watermark to the left or right margin of the image, which decides the gold label jointly with the main digit in the image.

Original: The watermark is darker than the main digit, and thus we expect to see the perturbation generator assign smaller perturbation budgets to the watermark, to retain the information carried by the watermark, while training uniform budgets is likely to fail for breaking the watermark.
Revised: The watermark is darker than the main digit, and thus we expect to see the perturbation generator assign smaller perturbation budgets to the watermark, to retain the information carried by the watermark, while training uniform budgets is likely to fail for breaking the watermark.

Original: Speciﬁcally, the watermark is a digit of zero or one, chosen randomly, from an image with the corresponding label in the original dataset.
Revised: Speciﬁcally, the watermark is a digit of zero or one, chosen randomly, from an image with the corresponding label in the original dataset.

Original: We scale down the image to 12 × 12 , and we crop out 2 pixels on each border and retain the inner 8 × 8 part.
Revised: We scale down the image to 12 × 12 , and we crop out 2 pixels on each border and retain the inner 8 × 8 part.

Original: The opacity of the watermark is reduced to 30%.
Revised: The opacity of the watermark is reduced to 30%.

Original: We randomly put the watermark either on the left or right 28 × 8 border, and the vertical position span is randomly chosen from [0 , 7] , [1 , 8] , · · · , [20 , 27] .
Revised: We randomly put the watermark either on the left or right 28 × 8 border, and the vertical position span is randomly chosen from [0 , 7] , [1 , 8] , · · · , [20 , 27] .

Original: The gold label of the new image is the main digit itself, if the watermark is 0, otherwise the gold label is the main digit plus 10.
Revised: The gold label of the new image is the main digit itself, if the watermark is 0, otherwise the gold label is the main digit plus 10.

Original: In this way, we construct a 20-class digit classiﬁcation problem.
Revised: In this way, we construct a 20-class digit classiﬁcation problem.

Original: We then perform certiﬁed defense on this synthetic dataset, with (cid:15) 

Revised: We then perform certiﬁed defense on this synthetic dataset, with (cid:15)

Original: = 0 .
Revised: = 0 .

Original: For our learned perturbation budget generator, we set α = 0 .
Revised: For our learned perturbation budget generator, we set α = 0 .

Original: 125 , α = 2 .
Revised: 125 , α = 2 .

Original: We compare the results with the method using uniform perturbation budgets, as shown in Table 3.
Revised: We compare the results with the method using uniform perturbation budgets, as shown in Table 3.

Original: When uniform perturbation budgets are used, the clean error and the veriﬁed error are very large (higher than 50%).
Revised: When uniform perturbation budgets are used, the clean error and the veriﬁed error are very large (higher than 50%).

Original: This is because the values of the pixels with the watermark is around 30% of those in an original digit, and thus when a perturbation budget of (cid:15) ≥ 0 .
Revised: This is because the values of the pixels with the watermark is around 30% of those in an original digit, and thus when a perturbation budget of (cid:15) ≥ 0 .

Original: 3 is uniformly added to all the pixels, it is enough to perturb the image and make the watermark disappear, and thus the model cannot achieve low errors.
Revised: 3 is uniformly added to all the pixels, it is enough to perturb the image and make the watermark disappear, and thus the model cannot achieve low errors.

Original: In contrast, as shown in Figure 4, by learning contextual perturbation budgets, the budget generator tends to assign relatively small budgets to pixels with the watermark.
Revised: In contrast, as shown in Figure 4, by learning contextual perturbation budgets, the budget generator tends to assign relatively small budgets to pixels with the watermark.

Original: Pixels with the main digit tend to have budgets that are somewhat larger, and there are empty pixels which receive even larger budgets.
Revised: Pixels with the main digit tend to have budgets that are somewhat larger, and there are empty pixels which receive even larger budgets.

Original: With such perturbation budgets, we achieve much lower veriﬁed error (19.04 v.s. 59.29 on (cid:15) 

Revised: With such perturbation budgets, we achieve much lower veriﬁed error (19.04 v.s. 59.29 on (cid:15)

Original: = 0 . 4 ) and clean error (3.48 v.s. 51.75 on (cid:15) 0 = 0 .
Revised: = 0 . 4 ) and clean error (3.48 v.s. 51.75 on (cid:15) 0 = 0 .

Original: 4 ) under the same robustness volume, as shown in Table 3.
Revised: 4 ) under the same robustness volume, as shown in Table 3.

Original: This experiment demonstrates the importance of learning different perturbation budgets for different pixels and the effectiveness of our proposed method.
Revised: This experiment demonstrates the importance of learning different perturbation budgets for different pixels and the effectiveness of our proposed method.

Original: [Table]
Revised: [Table]

Original: E XPERIMENTS ON D OUBLED CIFAR- 
Revised: E XPERIMENTS ON D OUBLED CIFAR-

Original: To further demonstrate the ability of the perturbation generator in identifying important input features, we create a harder synthetic dataset, namely Doubled CIFAR-10 , based on CIFAR-10.
Revised: To further demonstrate the ability of the perturbation generator in identifying important input features, we create a harder synthetic dataset, namely Doubled CIFAR-10 , based on CIFAR-10.

Original: An original input image in CIFAR-10 has a size of 32 × 32 .
Revised: An original input image in CIFAR-10 has a size of 32 × 32 .

Original: In this setting, each new input image consists of two original images on the left and the right respectively.
Revised: In this setting, each new input image consists of two original images on the left and the right respectively.

Original: Two images combined in this way yield a new one with a size of 32 × 64 .
Revised: Two images combined in this way yield a new one with a size of 32 × 64 .

Original: We also add a 4 × 64 border to the top of the new image and make the border either red or green.
Revised: We also add a 4 × 64 border to the top of the new image and make the border either red or green.

Original: If the border if red, the gold label is taken as the gold label of the left original image, otherwise it is the gold label of the right original image.
Revised: If the border if red, the gold label is taken as the gold label of the left original image, otherwise it is the gold label of the right original image.

Original: The border serves as a hint for the model to tell which original 32 × 32 image it should look at for prediction.
Revised: The border serves as a hint for the model to tell which original 32 × 32 image it should look at for prediction.

Original: Thereby the size of each new image is 36 × 64 .
Revised: Thereby the size of each new image is 36 × 64 .

Original: And with such a dataset, we expect to further study whether the perturbation budget generator can identify important features in the input image, since now one of the two component image in each new image does not affect the gold label, and thus the model is expected to assign large perturbation budgets on this component image.
Revised: And with such a dataset, we expect to further study whether the perturbation budget generator can identify important features in the input image, since now one of the two component image in each new image does not affect the gold label, and thus the model is expected to assign large perturbation budgets on this component image.

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: We use (cid:15) 

Revised: We use (cid:15)

Original: = 16 / 255 , α = 0 .
Revised: = 16 / 255 , α = 0 .

Original: α = 1 . 5 .
Revised: α = 1 . 5 .

Original: Results are shown in Table 4.
Revised: Results are shown in Table 4.

Original: Again, the errors of the model with learned perturbation budgets are much lower than those of the model with uniform budgets.
Revised: Again, the errors of the model with learned perturbation budgets are much lower than those of the model with uniform budgets.

Original: We also visualize the learned perturbation budgets in Figure 5.
Revised: We also visualize the learned perturbation budgets in Figure 5.

Original: We observe that when the border is in red, large perturbation budgets are assigned to the right side, which is consistent with that the gold label is determined only by the left side in this case.
Revised: We observe that when the border is in red, large perturbation budgets are assigned to the right side, which is consistent with that the gold label is determined only by the left side in this case.

Original: This observation also holds true for the case when the border is in green.
Revised: This observation also holds true for the case when the border is in green.

Original: Moreover, we also observe that the perturbation budget distributions of the other side are semantically meaningful.
Revised: Moreover, we also observe that the perturbation budget distributions of the other side are semantically meaningful.

Original: This experiment further demonstrates that our proposed method is able to identify important features in the input and learn semantically meaningful distributions of perturbation budgets.
Revised: This experiment further demonstrates that our proposed method is able to identify important features in the input and learn semantically meaningful distributions of perturbation budgets.

Original:  C ONCLUSIONS
Revised:  C ONCLUSIONS

Original: In this paper, we propose a novel approach to generate contextual perturbation budgets and successfully incorporate it into linear-relaxation-based certiﬁed training methods.
Revised: In this paper, we propose a novel approach to learn contextual perturbation budgets and successfully incorporate it into linear-relaxation-based certiﬁed training methods.

Original: We show its superiority over methods with uniform perturbation budgets via experiments on MNIST and CIFAR-10.
Revised: We show its superiority over methods with uniform perturbation budgets via experiments on MNIST and CIFAR-10.

Original: We also demonstrate that the perturbation budget generator can capture semantic information and align well with features in the input image with synthetically constructed Watermarked MNIST and Doubled
Revised: We also demonstrate that the perturbation budget generator can capture semantic information and align well with features in the input image with synthetically constructed Watermarked MNIST and Doubled

Original: CIFAR10 datasets.
Revised: CIFAR10 datasets.

Original: Our proposed method can be used in settings where the perturbation budget of a dataset cannot be easily determined as in toy datasets, and can handle context dependent perturbations.
Revised: Our proposed method can be used in settings where the perturbation budget of a dataset cannot be easily determined as in toy datasets, and can handle context dependent perturbations.

Original: A I MPLEMENTATION D ETAILS
Revised: A I MPLEMENTATION D ETAILS

Original: We conduct experiments on classiﬁcation models with similar structures as were used in prior works (Gowal et al., 2018; Zhang et al., 2020).
Revised: We conduct experiments on classiﬁcation models with similar structures as were used in prior works (Gowal et al., 2018; Zhang et al., 2020).

Original: Speciﬁcally, we adopt the DM-small and DM-large models used in CROWN-IBP (Zhang et al., 2020).
Revised: Speciﬁcally, we adopt the DM-small and DM-large models used in CROWN-IBP (Zhang et al., 2020).

Original: They are both convolutional models with 2 and 5 convolutional layers respectively, and their details have been reported in Zhang et al.
Revised: They are both convolutional models with 2 and 5 convolutional layers respectively, and their details have been reported in Zhang et al.

Original: On
Revised: On

Original: CIFAR-10, we use DM-large , and on MNIST, we ﬁnd that DM-large has a serious overﬁtting problem when training with learned perturbation budgets, and thus we use DM-small instead.
Revised: CIFAR-10, we use DM-large , and on MNIST, we ﬁnd that DM-large has a serious overﬁtting problem when training with learned perturbation budgets, and thus we use DM-small instead.

Original: Nevertheless, we still use DM-large to report the results of models with uniform budgets following the best setting in CROWN-IBP.
Revised: Nevertheless, we still use DM-large to report the results of models with uniform budgets following the best setting in CROWN-IBP.

Original: For the perturbation budget generator, it is a two-layer convolutional model with ReLU activations after each convolutional layer, and the two convolutional layers have 4 and 8 channels respectively and a kernel size of 3.
Revised: For the perturbation budget generator, it is a two-layer convolutional model with ReLU activations after each convolutional layer, and the two convolutional layers have 4 and 8 channels respectively and a kernel size of 3.

Original: After that, there is a linear layer mapping the hidden layer to each pixel in the image, with a Sigmoid activation for computing initial perturbation budgets.
Revised: After that, there is a linear layer mapping the hidden layer to each pixel in the image, with a Sigmoid activation for computing initial perturbation budgets.

Original: For training with certiﬁed defense, we mainly follow settings in CROWN-IBP (Zhang et al., 2020), but we use the loss fusion technique proposed in auto LiRPA for faster training (Xu et al., 2020).
Revised: For training with certiﬁed defense, we mainly follow settings in CROWN-IBP (Zhang et al., 2020), but we use the loss fusion technique proposed in auto LiRPA for faster training (Xu et al., 2020).

Original: There is a scheduling on the robustness volume during training, similar as the scheduling of uniform perturbation radius in CROWN-IBP.
Revised: There is a scheduling on the robustness volume during training, similar as the scheduling of uniform perturbation radius in CROWN-IBP.

Original: On MNIST, we use a linear scheduler, where the robustness volume linearly increases from 0 to the ﬁnal target robustness volume in 60 epochs starting from the 2nd epoch.
Revised: On MNIST, we use a linear scheduler, where the robustness volume linearly increases from 0 to the ﬁnal target robustness volume in 60 epochs starting from the 2nd epoch.

Original: The model is trained for 100 epochs.
Revised: The model is trained for 100 epochs.

Original: On CIFAR-10, we use a smoothed scheduler with a length of 160 epochs starting from the 32nd epoch, which slowly morphs into a linear schedule (Gowal et al., 2018).
Revised: On CIFAR-10, we use a smoothed scheduler with a length of 160 epochs starting from the 32nd epoch, which slowly morphs into a linear schedule (Gowal et al., 2018).

Original: The model is trained for 320 epochs.
Revised: The model is trained for 320 epochs.

Original: B V ISUALIZATION ON M ED MNIST D ATASET
Revised: B V ISUALIZATION ON M ED MNIST D ATASET

Original: MedMNIST
Revised: MedMNIST

Original: (Yang et al., 2020) is a recently released dataset consisting of 10 subsets of lightweight 28 × 28 medical images.
Revised: (Yang et al., 2020) is a recently released dataset consisting of 10 subsets of lightweight 28 × 28 medical images.

Original: In this section, we utilize the OrganMNIST(axial) subset consisting of CT images of body organs cropped from Abdominal CT images (Bilic et al., 2019; Xu et al., 2019) as an example, to further justify why non-uniform contextual perturbation budgets are needed in training robust models in a more practical scenario.
Revised: In this section, we utilize the OrganMNIST(axial) subset consisting of CT images of body organs cropped from Abdominal CT images (Bilic et al., 2019; Xu et al., 2019) as an example, to further justify why non-uniform contextual perturbation budgets are needed in training robust models in a more practical scenario.

Original: In such medical images, classiﬁers need to identify and classify abnormal regions in body organs.
Revised: In such medical images, classiﬁers need to identify and classify abnormal regions in body organs.

Original: In these complex medical images, some regions should be rather sensitive to adversarial perturbations, e.g., if regions right correspond to a speciﬁc abnormality is perturbed, the image label is very likely to change, while some other regions may be able to tolerate larger perturbations.
Revised: In these complex medical images, some regions should be rather sensitive to adversarial perturbations, e.g., if regions right correspond to a speciﬁc abnormality is perturbed, the image label is very likely to change, while some other regions may be able to tolerate larger perturbations.

Original: This is a practical situation where it is supposed to especially useful to leverage non-uniform and contextual perturbation budgets for robust training.
Revised: This is a practical situation where it is supposed to especially useful to leverage non-uniform and contextual perturbation budgets for robust training.

Original: For an initial demonstration, we train a model with (cid:15) 

Revised: For an initial demonstration, we train a model with (cid:15)

Original: = 16 / 255 using learned contextual perturbation budgets and uniform budgets respectively.
Revised: = 16 / 255 using learned contextual perturbation budgets and uniform budgets respectively.

Original: For the model with learned budgets, the clean error is 21.8 and the veriﬁed error is 50.6, while for the model with uniform budgets, the clean error is 28.0 and the veriﬁed error is 57.5.
Revised: For the model with learned budgets, the clean error is 21.8 and the veriﬁed error is 50.6, while for the model with uniform budgets, the clean error is 28.0 and the veriﬁed error is 57.5.

Original: Using learned contextual perturbation budgets, we are able to obtain a model with lower clean and veriﬁed errors under the same target robustness volume.
Revised: Using learned contextual perturbation budgets, we are able to obtain a model with lower clean and veriﬁed errors under the same target robustness volume.

Original: We also visualize several input images and our learned perturbation budgets in Figure 6.
Revised: We also visualize several input images and our learned perturbation budgets in Figure 6.

Original: The learned perturbation budgets appear to be semantically meaningful and align with the input images.
Revised: The learned perturbation budgets appear to be semantically meaningful and align with the input images.

Original: C C ONTROLLING P ERFORMANCE ON U NIFORM P ERTURBATION B UDGETS
Revised: C C ONTROLLING P ERFORMANCE ON U NIFORM P ERTURBATION B UDGETS

Original: In our experiment results shown in Table 1 and Table 2, we ﬁnd that models trained with our learned budgets tend to have higher veriﬁed errors when the models are evaluated with uniform budgets.
Revised: In our experiment results shown in Table 1 and Table 2, we ﬁnd that models trained with our learned budgets tend to have higher veriﬁed errors when the models are evaluated with uniform budgets.

Original: Although we have argued that evaluation on uniform budgets is not our major goal and it is less practical than learned non-uniform budgets, in this section, we demonstrate that it is still possible to maintain a performance on uniform budgets while training with learned budgets by controlling α .
Revised: Although we have argued that evaluation on uniform budgets is not our major goal and it is less practical than learned non-uniform budgets, in this section, we demonstrate that it is still possible to maintain a performance on uniform budgets while training with learned budgets by controlling α .

Original: We train a model on MNIST with (cid:15) 0 = 0 .
Revised: We train a model on MNIST with (cid:15) 0 = 0 .

Original: 5 and α = 0 .
Revised: 5 and α = 0 .

Original: 6 , which means the minimum budget of each pixel is 0.3.
Revised: 6 , which means the minimum budget of each pixel is 0.3.

Original: As a result, veriﬁed error on non-uniform budgets is 10.46, while the veriﬁed error on uniform (cid:15) = 0 .
Revised: As a result, veriﬁed error on non-uniform budgets is 10.46, while the veriﬁed error on uniform (cid:15) = 0 .

Original: 3 budget is 9.96, which is close to the 9.40 veriﬁed error reported in CROWN-IBP (Zhang et al., 2020) on the same “DM-small” model trained with uniform budgets.
Revised: 3 budget is 9.96, which is close to the 9.40 veriﬁed error reported in CROWN-IBP (Zhang et al., 2020) on the same “DM-small” model trained with uniform budgets.

Original: And if (cid:15) 0 = 0 .
Revised: And if (cid:15) 0 = 0 .

Original: 6 , α = 0 .
Revised: 6 , α = 0 .

Original: 5 , the veriﬁed error on uniform (cid:15) = 0 .
Revised: 5 , the veriﬁed error on uniform (cid:15) = 0 .

Original: 3 is 11.22 which is also not far away from 9.40, while now our model has a robustness on a volume as large as 0 .
Revised: 3 is 11.22 which is also not far away from 9.40, while now our model has a robustness on a volume as large as 0 .

Original: 6 n .
Revised: 6 n .

Original: Input
Revised: Input

Original: Budget
Revised: Budget

Original: Label
Revised: Label

Original: Input
Revised: Input

Original: Budget
Revised: Budget

Original: Label
Revised: Label

Original: Input
Revised: Input

Original: Budget
Revised: Budget

Original: Label
Revised: Label