P ROVABLE D EFENSE A GAINST G EOMETRIC T RANSFORMATIONS
Anonymous authors
Paper under double-blind review
A BSTRACT
Geometric image transformations that arise in the real world, such as scaling and rotation, have been shown to easily deceive deep neural networks (DNNs).
Hence, training DNNs to be certifiably robust to these perturbations is critical.
However, no prior work has been able to incorporate the objective of deterministic certified robustness against geometric transformations into the training procedure, as existing verifiers are exceedingly slow.
To address these challenges, we propose the first provable defense for deterministic certified geometric robustness.
Our framework leverages a novel GPU-optimized verifier that can certify images between 60 × to 42,600 × faster than existing geometric robustness verifiers, and thus unlike existing works, is fast enough for use in training.
Our results across multiple datasets show that networks trained via our framework consistently achieve state-of-the-art deterministic certified geometric robustness and clean accuracy.
Furthermore, for the first time, we verify the geometric robustness of a neural network for the challenging, real-world setting of autonomous driving.
I NTRODUCTION
Despite the widespread success of deep neural networks (DNNs), they remain surprisingly susceptible to misclassification when small adversarial changes are applied to correctly classified inputs (Goodfellow et al., 2015; Kurakin et al., 2018).
This phenomenon is especially concerning as DNNs are increasingly being deployed in many safety-critical domains, such as autonomous driving (Bojarski et al., 2016; Sitawarin et al., 2018) and medical imaging (Finlayson et al., 2019).
As a result, there have been widespread efforts aimed at formally verifying the robustness of DNNs against norm-based adversarial perturbations (Gehr et al., 2018;
Singh et al., 2019; Weng et al., 2018; Zhang et al., 2018) and designing novel mechanisms for incorporating feedback from the verifier to train provably robust networks with deterministic guarantees (Gowal et al., 2019; Mirman et al., 2018; Xu et al., 2020; Zhang et al., 2020).
However, recent works (Dreossi et al., 2018; Engstrom et al., 2019; Hendrycks & Dietterich, 2019; Kanbak et al., 2018; Liu et al., 2019) have shown that geometric transformations – which capture real-world artifacts like scaling and changes in contrast – can also easily deceive DNNs.
No prior work has formulated the construction of deterministic provable defenses needed to ensure DNN safety against geometric transformations.
Further, existing deterministic verifiers for geometric perturbations (Balunovic et al., 2019; Mohapatra et al., 2020) are severely limited by their scalability and cannot be used during training for building provable defenses.
Probabilistic geometric robustness verifiers (Fischer et al., 2020; Hao et al., 2022; Li et al., 2021) are more scalable but may be inadequate for safety-critical applications like autonomous driving, since they may falsely label an adversarial region as robust.
These limitations have prevented the development of provable defenses against geometric transformations thus far.
Challenges.
Training networks to be certifiably robust against geometric transformations carries multiple challenges that do not arise with norm-based perturbations.
First, geometric transformations are much more difficult to formally reason about than ℓ p perturbations, as unlike an ℓ p -ball, the adversarial region of a geometric transformation is highly nonuniform and cannot be directly represented as a symbolic formula encoding a convex shape.
Computing this adversarial input region for geometric perturbations is indeed the main computational bottleneck faced by existing geometric robustness verifiers (Balunovic et al., 2019; Mohapatra et al., 2020), thus making the overall verification too expensive for use during training.
Hence, training DNNs for deterministic certi- fied robustness against geometric perturbations requires not only formulating the construction of a provable defense, but also completely redesigning geometric robustness verifiers for scalability.
This Work.
To address the outlined challenges, we propose Certified Geometric Training (CGT), a framework for training neural networks that are deterministically certified robust to geometric transformations.
The framework consists of (1) the Fast Geometric Verifier (FGV), a novel method to perform geometric robustness certification that is orders of magnitude faster than the state-of-theart and (2) computationally efficient loss functions that embed FGV into the training procedure.
We empirically evaluate our method on the MNIST (LeCun et al., 1998), CIFAR10 (Krizhevsky, 2009), Tiny-ImageNet (Le & Yang, 2015), and Udacity self-driving car (Udacity, 2016) datasets to demonstrate CGT’s effectiveness.
Our results show that CGT-trained networks consistently achieve state-of-the-art clean accuracy and certified robustness, while being between 60 × to 42,600 × faster than the state-of-the-art verifier for certifying each image.
Furthermore, we achieve several breakthroughs: (1) FGV enables us to certify deterministic robustness against geometric transformations on entire test sets of 10,000 images, which is more than 50 × the number of images over existing works (100 in Balunovic et al.
(2019) and 200 in Mohapatra et al.
; (2) we are the first to scale deterministic geometric verification beyond CIFAR10; and (3) we are the first to verify a neural network for autonomous driving under realistic geometric perturbations.
All data and code will be made publicly available upon publication.
R ELATED W ORK
Geometric Robustness Certification.
Certification of geometric perturbations (such as image rotations or scaling) going beyond ℓ p -norm attacks have recently begun to be studied in the literature.
There are two main approaches to formally verifying the geometric robustness of neural networks: deterministic and probabilistic.
Most recent works on geometric robustness verification use randomized smoothing-based techniques to obtain probabilistic guarantees of robustness (Fischer et al., 2020; Hao et al., 2022; Li et al., 2021).
While these approaches can scale to larger datasets, their analysis is inherently unsound , i.e., they may falsely label an adversarial region as robust.
For safety-critical domains, this uncertainty may be undesirable.
Furthermore, such guarantees are obtained over a smoothed version of a base network, which at inference time requires sampling (i.e., repeatedly evaluating) the network up to 10,000 times per image, thereby introducing significant runtime or memory overhead (Fischer et al., 2020).
Our work focuses on deterministic verification, whose analysis is always guaranteed to be correct and whose certified network incurs no overhead during inference.
In particular, this type of certificate always holds against any adaptive attacker.
However, the existing deterministic geometric robustness verifiers (Balunovic et al., 2019; Mohapatra et al., 2020) are exceedingly slow and thus unsuitable for training, due to the high cost of abstracting the geometric input region (even before propagating it through the network).
Singh et al.
(2019) also studied deterministic geometric robustness, but their results are entirely subsumed by Balunovic et al.
While some works have focused on scaling verifiers (M ¨ uller et al., 2021; Xu et al., 2020), they have not targeted geometric robustness as we do.
Provable Defenses Against Norm-based Perturbations.
Prior works (Gowal et al., 2019; Mirman et al., 2018; Xu et al., 2020; Zhang et al., 2020) incorporate verification explicitly into the training loop so that the trained networks become easier to verify.
Typically, this task is accomplished by formulating a loss function that strikes a balance between the desired formal guarantees (i.e., high certified robustness) and clean accuracy (i.e., the network’s accuracy on the original dataset).
To ensure quick loss computation over a large set of training images, interval bound propagation (IBP) (Gowal et al., 2019; Mirman et al., 2018) is the most popular technique.
However, previous
IBP works only consider norm-based perturbations, which do not capture the highly nonuniform adversarial input regions that characterize geometric transformations.
B ACKGROUND
We denote a neural network as a function f : R C × H × W
→ R n from an H × W image with C channels to n real values.
We focus on feedforward networks, but our approach is general and equally applicable to other architectures.
For the remainder of the paper, we write interval variables in bold: e.g., x = [ x, x ] = { x : x ≤ x ≤ x } is an interval with x and x as lower and upper bounds, respectively.
First, we detail the geometric transformations that our work considers.
3. G EOMETRIC T RANSFORMATIONS
A geometric image perturbation is a function P : R C
× H × W × R p
→ R C × H × W , which takes an input image and p parameters (e.g., angle of rotation or amount of brightness), then produces the geometrically perturbed image.
We consider interpolated transformations – rotation, translation, scaling, and shearing – and pixelwise transformations – contrast and brightness.
Interpolated Transformations.
Interpolated transformations involve an affine transformation on each pixel’s row and column indices, followed by an interpolation operation.
As these operations are performed in the 2D plane, we must interpret the row and column indices as points in R 2 .
Hence, we first define functions ϕ x ( j ) =
j − ( W − 1) / 2 and ϕ y
( i ) =
( H − 1) / 2 − i , which convert zeroindexed i, j pixel indices to x, y coordinates with respect to the center of an H × W image.
Let
T θ : R 2 → R 2 be an invertible affine transformation (e.g., rotation, translation) parameterized by θ (e.g., rotation angle, amount of horizontal shift).
The equations for each affine transformation are given in Eqs.
10-13 in Appendix A. To compose multiple perturbations, we compose their respective affine transformations; for example, scaling by λ , rotating by φ , then shearing by m results in the transformation T θ ( x, y )
=
( T shear m ◦ T rotate φ ◦ T scale λ )( x, y ) where θ =
( λ, φ, m ) .
Having converted pixel indices to R 2 , we compute for each location ( ϕ x ( j ) , ϕ y ( i ))
the (real-valued) coordinate that maps to this location under T θ ; we can obtain this coordinate as ( x ′ , y ′ )
=
T − 1 θ ( ϕ x ( j ) , ϕ y ( i )) , where T − 1 θ is the inverse transformation.
But, as these transformed coordinates may not align exactly with integer-valued pixel indices, we must interpolate.
Here, we consider the bilinear interpolation kernel of Jaderberg et al.
(2015), which for a (single-channel) image X ∈ R H × W , is given as:
[Equation]
We now define the general form of a geometric perturbation for an image X as:
[Equation]
where X ′ is the geometrically perturbed image.
For multichannel images, Eq. 2 is applied independently to each channel.
Pixelwise Transformations.
The cumulative effects of contrast and brightness acting on a pixel
X i,j of an image X can be given by the respective contrast and brightness perturbation parameters c, b ∈ R , as described in Balunovic et al.
; Mohapatra et al.
[Equation]
3. I NTERVAL B OUND P ROPAGATION (IBP)
For each pixel in the input and each neuron in the DNN, verification with interval bound propagation (IBP) (Gowal et al., 2019) associates an interval bounding its minimum and maximum values.
A sound verifier propagates intervals through the network from the input to the output layer by evaluating the network’s layers using interval arithmetic; we detail these operations in Appendix B.
3. C ERTIFYING G EOMETRIC R OBUSTNESS USING IBP
We now show how to certify the geometric robustness of classification and regression networks.
Definition 1 (Worst-Case Output) For an image x ∈ R C × H × W with label y t , let the output for the correct class of a classifier be denoted as f y t ( x ) and for any incorrect class as f j ( x ) , where j ∈ { 1 , 2 , . . .
, n } \ { y t } .
Given a set of perturbed inputs x = [ x, x ] , we denote the worst-case output vector as ˆ f ( x ) , where (interpreting all operations via interval arithmetic) the correct class’s entry is its lower bound and all other entries are their upper bounds:
[Equation]
and
[Equation]
We say that f is certifiably robust for x if, even in the worst case, we can still guarantee that the network classification is correct: y t = arg max i
ˆ f i ( x ) .
To certify geometric robustness on an image x requires computing its bounds as x = P ( x, θ ) , where θ =
[ θ, θ ] is an interval vector bounding the range of geometric perturbation parameters, and the geometric perturbation P is interpreted over interval arithmetic.
However, for a given range of perturbation parameters θ for which we wish to verify robustness, the interval width θ − θ may be too large for the direct evaluation of ˆ f ( P ( x, θ )) to yield bounds that are precise enough for successful certification.
Hence, we subdivide the entire range of input parameters into smaller intervals and certify each split independently; if verifying all splits succeeds, then certification holds on the entire range.
As interval bounds are constants and do not symbolically depend on the input parameters (unlike DeepG (Balunovic et al., 2019)), IBP is highly efficient and can be rerun on a large number of parameter splits for improved precision.
Definition 2 (Certified Classification Robustness for Geometric Transformations) For an image x ∈ R C × H × W with label y t , a perturbation function P , and a set of K disjoint interval vectors { θ 1 , θ 2 , . .
, θ K } where θ = (cid:83) Ki
=
θ i , we say that f is certifiably robust for P ( x, θ ) if:
[Equation] [Equation]
Distinct from classifiers, as regression tasks do not have a strict notion of correctness, our goal is to verify whether a network’s outputs are within a range close to the ground truth.
Hence, our certification problem is to directly bound the network outputs.
For a given range of perturbation parameters, the certified output range will be the union over all the output bounds of each split.
Definition 3 (Certified Regression Bound for Geometric Transformations) For an image x ∈ R C × H × W , a perturbation function P , and a set of K disjoint interval vectors { θ 1 , θ 2 , . .
, θ K } where θ = (cid:83) Ki
=
θ i , we obtain certified bounds on the network output as the smallest interval containing the union of all splits’ output intervals:
[Equation]
C ERTIFIED G EOMETRIC T RAINING
We now describe the formulation of our provable defense and fast geometric verifier (FGV) that comprise our training framework for certified geometric robustness.
4. R OBUST L OSS FOR C LASSIFICATION AND R EGRESSION N ETWORKS
Classification DNNs.
The key to incorporating geometric robustness guarantees into training lies in formulating certification as part of the loss function.
Since ˆ f represents the worst-case output under a range of perturbed inputs, we can use it in the training loss to penalize networks and guide the parameter update toward obtaining provably robust DNNs.
To account for input splitting during certification, we formulate our training loss to enforce local geometric robustness at the level of individual input splits.
Further, to certify the network across the entire desired range θ =
[ θ, θ ] , we enforce this local property across all splits.
Similar to other works on certified training, we also need to enforce high clean accuracy.
This yields the following loss formulation for classification DNNs.
Definition 4 (Ideal Robust Classification Loss)
For an input x with label y t , and K partitioned ranges of geometric perturbation parameters { θ k } where (cid:83)
Kk =
θ k
= θ , the ideal loss L is:
[Equation]
where ℓ can be any classification loss function (we use the cross-entropy loss) and κ ∈ [0 , 1] governs the relative weighting between the clean accuracy and geometric robustness terms (with higher κ prioritizing clean accuracy).
In practice, the loss in Eq.
7 is too computationally expensive, since the runtime scales linearly with the number of splits, which often needs to be large to ensure precise certification.
As a remedy, we enforce the robustness property stochastically using data augmentation in conjunction with a randomized sampling of interval splits, which we next describe.
Definition 5 (Tractable Robust Classification Loss)
For an input x with label y t , we uniformly sample a scalar perturbation amount θ ∼ U ( θ, θ ) and compute a local interval split θ l = [ θ − ν, θ + ν ] (where ν is a hyperparameter vector governing the interval size of each perturbation parameter).
We can then compute the tractable classification loss L as:
[Equation]
Since we sample a different θ for each mini-batch of training samples, this approach will, on average, effectively enforce local robustness over the entire desired range (hence leading to global robustness).
As in prior works (Gowal et al., 2019; Xu et al., 2020; Zhang et al., 2020), we can vary κ with the training iteration, temporally changing the weighting between clean accuracy and robustness.
The hyperparameter vector ν is akin to ϵ in the ℓ ∞ -norm case, but it governs the size of a geometric ball around an image rather than an ϵ -ball; note that ν is a vector, since the interval size corresponding to each geometric perturbation may be different.
We show that this hyperparameter is easy to determine.
Finally, while this loss function incorporates only IBP to propagate the geometric region through the network, it can be easily adapted to other provable training methods like CROWN-IBP (Zhang et al., 2020) by substituting the ϵ -balls in their loss functions with our formulation of local geometric balls.
Regression DNNs.
Since our goal is to minimize both the width of the certified output bound as well as its distance to the ground truth, the ideal scenario would be when the certified lower and upper bounds coincide at the ground truth.
Hence, we can essentially treat the certified bounds as worst-case network outputs and minimize both the lower and upper bounds’ distance to the label.
With similar insights gleaned from the classification loss function, we thus arrive at the formulation:
Definition 6 (Robust Regression Loss)
For an input x with label y t , we uniformly sample a scalar perturbation amount θ and compute a local interval split θ l (just as in Def. 5).
We can then compute the regression loss L as:
[Equation]
where ℓ can be any regression loss function (we use the mean squared error).
While we experimentally focus on the more common interpolated perturbations, our loss formulation can also be used for any other parameterized semantic perturbation P on which interval overapproximations for each pixel can be computed, such as Gaussian blur or color space perturbations.
4. F AST G EOMETRIC V ERIFIER
A key technical challenge arises during the computation of the loss functions in Eqs.
8 and 9: we need to perform geometric robustness certification on images at every iteration of training.
Certification against geometric transformations requires two key steps: (1) obtaining bounds on the set of perturbed images obtainable after applying geometric perturbation P and (2) propagating these bounds through a neural network.
The key bottleneck of existing geometric verifiers, which renders them unusable for training, lies in this first step (which we show in Section 5.3).
This bottleneck stems from the fact that when computing the interpolation, the sequence of arithmetic computations performed at each pixel can be drastically different depending on the pixel location, which has precluded existing approaches from leveraging parallelism.
Thus, a core part of our contribution is designing a novel and efficient GPU-parallelizable method for computing interpolated transformations over interval bounds: serving the dual purpose of speeding up verification and being able to utilize these bounds during training.
Algorithm 1 presents the pseudocode.
Additionally, we also show a running example in Appendix C.1.
By default, areas of an interpolated image with no corresponding source pixel will be padded with zero, as in Balunovic et al.
However, our algorithm is agnostic to the particular padding mode: we discuss how to handle other padding strategies (e.g., replicating the border pixel values) in Appendix C.2.
Input: X ∈ [0 , 1] N × C × H × W , a batch of N images with dimension C × H × W
T θ , an interpolated transformation with interval parameters θ Output: X ′ ∈ [[0 , 1] N × C × H × W , [0 , 1] N × C × H × W ] 1: procedure M AKE I NTERP G RID ( H, W, T θ ) 2: ( i, j ) ← ([0 , 1 , . . .
, H − 1] , [0 , 1 , . . .
, W − 1]) 3: ( x, y ) ← ( j − ( W − 1) / 2 , ( H − 1) / 2 − i )
▷ compute ( ϕ x ( j ) , ϕ y ( i )) 4: ( x g , y g ) ← ([ x T , x T , . . .
, x T ] T (cid:124) (cid:123)(cid:122) (cid:125)
H times , [ y T , y T , . . .
, y T ] (cid:124) (cid:123)(cid:122) (cid:125) W times )
▷ create meshgrid of x, y coords; x g , y g are H × W 5: ( x ′ , y ′ )
← T − 1 θ ( x g , y g ) 6: ( x ′ , y ′ )
← ( x ′ .reshape
( HW, 1 , 1) , y ′ .reshape
( HW, 1 , 1))
▷ dimension: HW × 1 ×7: g ← max(0 , 1 − | y ′
− y g | ) ⊙ max(0 , 1 − | x ′ − x g | )
▷ dimension: HW × H × W 8:
Z ← count nonzeros( g , dim = 0 )
▷ dimension: 1 × HW 9: g ← flatten ( g ) ▷ dimension: 1 × HWHW 10:
z i ← get nonzero indices( g ) 11:
V ← g [ z i ] 12: ( R s , C s ) ← ( ⌊ ( z i mod HW ) /W ⌋ , ( z i mod HW ) mod W ) 13: return G ← ( R s , C s , V , Z )
▷ g in custom sparse representation 14: end procedure 15: 16: procedure I NTERPOLATE ( X, G ) 17: ( R s , C s , V , Z ) ← G 18: s ← V ⊙ X
[: , : , R s , C s ]
▷ dimension: N × C × sum ( Z ) 19:
X ′ f ← split and sum( s , dim = 2 , sizes =
Z )
▷ dimension: N × C × HW 20: return X ′ ← X
′ f .reshape
( N, C, H, W ) 21: end procedure
We mathematically decompose the interpolated transformations (Eqs. 1 and 2) into three parts: computing the coordinates of each pixel under inverse transformation T − 1 θ , computing the interpolation distances max(0 , 1 − | y ′
− ϕ y ( n ) | ) · max(0 , 1 − | x ′ − ϕ x ( m ) | ) , and finally obtaining the resulting interpolated images.
Our key insight is that the first two steps are solely dependent on the transformation T θ and the height and width of the images, but not the image pixel values themselves.
Hence, these computations need only be done once for a given transformation range, amortizing the cost for any number of images in a batch.
All parts are GPU-parallelizable.
We now detail each part.
Inverse Coordinates 1 .
We first determine the inverse coordinates ( x ′ , y ′ )
=
T − 1 θ ( ϕ x ( j ) , ϕ y ( i )) for each ( i, j ) pixel index, where 0 ≤ i < H and 0 ≤ j < W for images with height H and width W .
The inverse transformations (shown in Appendix A Eqs. 10–13) are pixelwise, hence this step can immediately be parallelized by defining the matrices x g , y g ∈ R H × W where
x g ( i, j ) =
ϕ x ( j ) and y g
( i, j ) =
ϕ y
( i ) , then applying T − 1 θ over this whole grid of coordinates.
Since T − 1 θ is parameterized by an interval range of parameters, this inverse transformation and all subsequent arithmetic operations are interpreted via interval arithmetic.
Interpolation Grid 2 and Exploiting Sparsity 3 .
For each ( x ′ , y ′ ) , we next calculate the terms max(0 , 1 − | y ′
− ϕ y ( n ) | ) · max(0 , 1 − | x ′ − ϕ x ( m ) | ) in Eq. 1; we call these terms interpolation distances and denote them d x ′ ,y ′ n,m .
Here lies a key difference between our interpolation formulation and that of sequential implementations.
In the sequential case, one need only compute d x ′ ,y ′ n,m for n where y ′ ≤ ϕ y ( n ) ≤ y ′ and m where x ′ ≤ ϕ x ( m ) ≤ x ′ ; this is because all other values of n, m will evaluate to a distance of 0.
Yet since these ranges of n, m can be vastly different for each ( x ′ , y ′ ) , the only way to parallelize the simultaneous computation of these distances for all inverse coordinates is to, for each ( x ′ , y ′ ) , compute d x ′ ,y ′ n,m for all 0 ≤ n < H , 0 ≤ m < W .
We term these computed distances the interpolation grid g .
However, since most of the entries in g will be 0 (i.e., the degenerate interval [0 , 0] ) – typically more than 99% of them – we design a custom sparse tensor representation of g so that only the nonzero entries will be multiplied with image pixel values (i.e, computing X n,m · d x ′ ,y ′ n,m only when the distance is nonzero).
First, for each nonzero d x ′ ,y ′ n,m , we must know its location (i.e., n, m ) so that we can multiply its value with the corresponding image pixels in the same location.
To do so, we convert g to COO (coordinate) format, a 3-tuple of vectors:
V which stores the values of g and R s , C s which store the values’ row and column indices n, m .
Second, once we obtain all the summands s x ′ ,y ′ n,m = X n,m · d x ′ ,y ′ n,m , we need to know which of them contribute to the same pixel (i.e., have the same x ′ and y ′ ) and thus should be summed together; this is challenging since the grid values have been flattened.
To solve this issue, we store an additional vector Z that records the number of nonzero interpolation distances for each ( x ′ , y ′ ) .
Obtaining Interpolated Images 4 .
After calling M AKE I NTERP G RID (which only needs to be done once for a given set of transformations) and obtaining G =
( R s , C s , V , Z ) , we can now efficiently interpolate across any batch of images X .
For all batch and channel dimensions, we obtain the pixel values at locations corresponding to the interpolation distances in V (by indexing the last two dimensions of X with R s , C s ) and elementwise multiply with V to obtain s , which contains the values of all summands across all pixels.
To recover the final pixel values, we sum the terms belonging to the same pixel (i.e., the s x ′ ,y ′ n,m that have the same x ′ , y ′ ) together.
We split the last dimension of s into HW chunks { c i } HWi =1 , where each c i has length Z i ; then, each chunk’s sum is exactly the final pixel value.
Since this last dimension has been flattened to take advantage of sparsity, we reshape it back to H × W to obtain the final interpolated images.
Finally, we use IBP (during both training and certification) to propagate the computed geometric bounds through the neural network.
E VALUATION
We evaluate the effectiveness of CGT over multiple datasets and transformations.
We implemented
CGT atop PyTorch (Paszke et al., 2019) and use auto_LiRPA (Xu et al., 2020) as a sound verifier to propagate our computed geometric perturbation bounds through neural networks.
Datasets and Architectures.
We evaluate our approach on the MNIST, CIFAR10, Tiny-ImageNet, and Udacity self-driving car datasets.
The first three are image classification tasks, while the last is a regression task that predicts a steering angle given a driving scene image.
On MNIST and CIFAR10, we use the same architectures from DeepG (Balunovic et al., 2019) as to compare directly with their results.
On Tiny-ImageNet, we use a 7-layer CNN similar to Xu et al.
On Udacity, we use the classic Nvidia architecture from Bojarski et al.
Details are in Appendix D.1.
Metrics.
Our primary metrics for a classifier are (1) its clean accuracy, (2) its certified robustness under geometric transformations, and (3) the certification time on the test set.
For a regression network, we utilize the analogous metrics of (1) mean absolute error (MAE), (2) certified MAE, i.e., the larger of the certified lower and upper bounds’ MAEs, as well as (3) certification time.
We also measure per-epoch runtime and GPU memory usage during training (shown in Appendix E.4).
Baselines.
To the best of our knowledge, training a DNN via PGD (Madry et al., 2018) combined with data augmentation (denoted PGD/A) and certifying it with DeepG produces the current stateof-the-art deterministic geometric certification and accuracy.
However, the DeepG verifier does not scale beyond CIFAR10; hence, we compare our approach to theirs on just the MNIST and
CIFAR10 datasets, using the sets of transformations from their work.
Notably, DeepG only certifies 100 images (due to long runtimes), while we certify full test sets of 10,000 images.
The work of
Semantify-NN (Mohapatra et al., 2020) is strictly less precise than DeepG and also only handles a single interpolated transformation (rotation); thus, we only compare certification with DeepG.
However, they propose an algorithm to compute the interval over-approximation of images under rotation, and we provide an ablation study comparing the speed of Algorithm 1 to theirs.
Hyperparameters.
We show the training/certification hyperparameters in Appendices D.2 and D. and explain how to tune these hyperparameters in Appendix D.4.
Hardware.
We trained and certified all networks on a machine with a 2.40GHz 24-core Intel Xeon
Silver 4214R CPU with 192GB of main memory and one Nvidia A100 GPU with 40GB of memory.
All baseline results are also run on the same hardware for fair comparisons.
5. MNIST AND CIFAR
Table 1 presents the comparison of our approach with DeepG; asterisks denote DeepG certification results over a subset of 100 images (since their approach takes too long to run on the full test set).
[Table]
Over a variety of challenging transformations on MNIST and CIFAR10, our approach consistently achieves state-of-the-art performance.
On all MNIST experiments, our certified robustness is substantially higher than DeepG, while attaining comparable clean accuracy.
Furthermore, our verifier is several orders of magnitude faster.
On CIFAR10, we achieve significantly better tradeoff between certified robustness and accuracy than the baseline for the first two cases, while obtaining similar results on the third transformation set.
Our certification time is considerably lower than DeepG. For the first and third CIFAR10 experiments, we attain 65% and 49% on the subset of 100 images used by DeepG (which are equal or better than their results), while the certifiability evaluated over the whole test set (presented in the table) is slightly lower.
These results demonstrate that, compared to employing more precise abstractions on the input set during certification on DNNs not trained to be provably robust, explicitly training the network to be certifiably robust and verifying the trained network with a less precise but faster verifier with a larger number of splits, is a more effective approach for achieving better accuracy and robustness.
Utilizing our custom loss formulation in Eq.yields the best results on our verifier; Table 6 in Appendix E.1 shows that other existing ℓ ∞ -based training methods (which cannot incorporate precise geometric bounds) do not perform as well.
5. S CALABILITY TO L ARGER D ATASETS
[Table]
Our work can scale to larger datasets like TinyImageNet and a real-world autonomous driving dataset where previous approaches do not.
Table 2 presents our results on Tiny-ImageNet networks trained for the shear, scale, and rotation transformations.
We observe that our approach preserves a relatively high clean accuracy between 26-27% while obtaining substantial robustness guarantees between 12-18%; for context, in Xu et al.
(2020) for ℓ ∞ -robustness with ϵ = 1 / 255 , they attain 21.6% accuracy and 12.7% certified robustness on a 7-layer CNN.
Certification time is still fast, even though the images are much higher-definition than MNIST and CIFAR10, showcasing FGV’s scalability.
Next, we demonstrate, to the best of our knowledge, the first study of a provable defense in a real-world setting against realistic geometric transformations on the Udacity dataset.
The neural network takes as input high-definition RGB 3 × 66 × 200 images, and our task is to accurately predict the correct steering angle and tightly and provably bound the range of angles under geometric transformations.
Specifically, we consider a transformation of ± 2 ◦ rotation.
[Table]
While there is an inherent tradeoff between certified robustness and network performance on the previous datasets, we find that, surprisingly, here we can scale our approach to obtain both high certifiability and improve network performance at the same time .
To demonstrate this phenomenon, we train a network with (1) just the regular mean-squared error loss and input data augmentation of ± 2 ◦ rotation (Nominal), (2) the first method with the addition of dropout on linear layers (Dropout), and (3) our CGT formulation in Eq. 9.
Table 3 presents our results for the standard and certified errors of these training methods (lower is better).
An interesting observation is that this task is prone to overfitting: we can observe that adding dropout significantly improves the standard error of the network.
Therefore, in this case, training with CGT’s interval bounds actually acts as an effective regularizer that serves the dual purpose of combatting overfitting and enforcing certifiability.
Training without CGT leads to trivial certification bounds (i.e., the certified steering angle can be anywhere in ± 90 ◦ ); conversely, training with
CGT yields very tight certified bounds.
Fig.
1 shows visualizations of the CGT-trained network’s predictions and certified bounds.
5. A BLATION S TUDIES
Algorithm for Interval Interpolated Transformation.
In Appendix E.3, we compare Algorithmto Semantify-NN’s algorithm for computing interval rotation bounds.
We show that our algorithm is orders of magnitude faster, hence enabling our scalable training and verification approaches.
Effect of Parameter Split Size.
We train a CIFAR10 and Tiny-ImageNet network with various sizes of the hyperparameter ν and discuss how it affects certified and clean accuracy in Appendix E.2.
C ONCLUSION
We proposed Certified Geometric Training (CGT), a training formulation that improves the deterministic certified robustness of neural networks with respect to geometric transformations.
Our experiments across multiple datasets showed that CGT consistently attains state-of-the-art certified geometric robustness and clean accuracy, while being highly scalable.
A E QUATIONS FOR I NTERPOLATED T RANSFORMATIONS
For each interpolated transformation, we present the equation for its inverse transform T − 1 θ , which is used to instantiate the general form in Eq. 2.
Rotation.
Parameterized by an angle φ ∈ [0 , 2 π ] :
[Equation]
Translation.
Parameterized by an amount of horizontal shift h ∈ R and an amount of vertical shift v
[Equation] [Equation]
Scaling.
Parameterized by a scaling factor λ ∈ R , λ
[Equation]
− 1 :
[Equation]
Shearing.
Parameterized by a horizontal shearing factor m ∈ R :
[Equation]
B I NTERVAL B OUND P ROPAGATION T RANSFORMERS
Interval bound propagation (IBP) is a special case of linear relaxation-based perturbation analysis (LiRPA), where each neuron’s bounds are hyperrectangles.
Below, we give a recap on how to compute the bounds for affine (i.e., convolutional and fully connected) layers and monotonic activation functions from Gowal et al.
For a more detailed discussion, we refer the reader to Gowal et al.
(2019) and Xu et al.
For a neuron (or pixel) z =
[ z, z ] , its bounds after applying an affine layer with weights W and bias b are computed as:
[Equation] [Equation]
where µ = W (cid:0) z
+ z 2 (cid:1) + b and r = | W | (cid:0) z − z 2 (cid:1) .
For a neuron z =
[ z, z ] , its bounds after applying a monotonic activation function h : R → R (e.g.,
ReLU) are computed as:
[Equation] [Equation]
We can obtain final bounds on a network’s outputs by composing the operations above and propagating intervals from the input layer to the output layer.
C A DDITIONAL D ETAILS ON F AST I NTERVAL I NTERPOLATED T RANSFORMATIONS C. R UNNING E XAMPLE
We present a running example of Algorithm 1.
Here, we consider applying a scaling of λ = ± 2% to 3 × 3 images.
Per Eq.
12, the inverse transform function for this perturbation is:
[Equation]
We color code the diagrams below, so that information belonging to the same pixel location has the same color.
Lines 2-4: First, we create a meshgrid of ( x, y ) coordinates so that the inverse transform of all coordinates can be computed in parallel.
We obtain: x g = -
-1 0-1 0and y g
= 1 10 0-1 -1Line 5:
Now, we apply T − 1 λ to each entry in x g , y g .
Note that since T − 1 λ produces interval coordinates, all subsequent operations need to be interpreted via interval arithmetic.
We have: x ′ =
x g [0 . 98 , 1 . 02]
=
[-1.02, -0.98] [0, 0] [0.98, 1.02] [-1.02, -0.98] [0, 0] [0.98, 1.02] [-1.02, -0.98] [0, 0] [0.98, 1.02] y ′
=
y g
= [0.98, 1.02] [0.98, 1.02] [0.98, 1.02] [0, 0] [0, 0] [0, 0]
Lines 6-7: We can now compute the bilinear interpolation grid (i.e., all interpolation distances).
For each ( x ′ , y ′ ) coordinate, we compute x ′ − x g and y ′ − y g , which are both 3 × 3 interval matrices.
As there are 9 inverse coordinates, we end up with two 9 × 3 × 3 interval tensors x d and y d (where the ordering of the first dimension is according to row-major order of x ′ , y ′ ).
The rest of the operations to compute the interpolation distances are all elementwise; we can thus obtain g = max(0 , 1 − | y d | ) ⊙ max(0 , 1 − | x d | ) , shown below.
We omit writing entries that are zero (i.e., the interval [0 , 0] ).
[Table]
As discussed in Section 4.2, we can see that the region of interpolation is significantly different for each pixel, hence in order to parallelize the entire computation across all inverse coordinates, we must interpolate over the entire 3 × 3 range of ( x, y ) coordinates for each ( x ′ , y ′ ) .
However, doing so leads to a lot of sparsity in g , which we can now exploit.
(Note: with larger images, typically more than 99 .
5% of g are zero entries; however, since the image dimension in this running example is small, the sparsity is not as great.)
Lines 8-12: We now convert g to our custom sparse format before performing interpolation with image pixels, so that all zero-multiplications may be eliminated.
First, we count the number of nonzero entries in each inverse coordinate’s matrix:
[Equation]
Then, we flatten g (in row-major order) and store it in a COO (coordinate) format.
We thus obtain an interval vector V that stores all the nonzero interpolation distances, along with integer vectors
R s , C s which, for each value of V , stores its corresponding row and column index:
V =
[Equation]
[Table]
[Equation]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Equation]
[Table]
R s = 0 0 1 1 0 1 0 0 1 1 1 1 1 1 1 1 1 2 2 1 2 1 1
C s = 0 1 0 1 1 1 1 2 1 2 0 1 1 1 2 0 1 0 1 1 1 1 2
This concludes the procedure MakeInterpGrid() , and we are now ready to use this information to compute actual interpolated images.
Consider a batch of 1000 3 × 3 RGB images,
X ∈ [0 , 1] 1000 × 3 × 3 × 3 .
Now, consider the first channel of the first image, X [0 , 0] , which is a 3 ×matrix (whose values we randomly select for this example):
X [0 , 0]
= .
Line 18: We multiply each interpolation distance with the pixel value of X [0 , 0] in the corresponding location; this will yield the values of all summands in Eq.
1 across all pixels.
To accomplish this, we index the image according to the indices stored in ( R s , C s ) and elementwise multiply these pixel values with V , obtaining s = V ⊙ X [0 , 0 , R s , C s ] :
[Table] [Table]
Line 19:
Finally, we sum the terms in s that belong to the same pixel location.
In the context of the diagram above, this is summing the entries in s that are of the same color.
In practice, this color information is encoded in the vector Z , which stores, for each pixel location, the number of nonzero interpolation entries; hence, we break s into contiguous chunks such that the length of chunk i (where 0 ≤ i < 9 ) is given by Z i , and sum all values in each chunk, obtaining:
X ′ f
= [0.53, 0.57] [0.49, 0.51] [0.40, 0.44] [0.52, 0.54] [0.49, 0.49] [0.50, 0.52] [0.54, 0.58] [0.61, 0.63] [0.43, 0.47]
Line 20: This vector is then reshaped to a 3 × 3 matrix, yielding the final pixel values of X [0 , 0] under transformation:
X ′ =
Finally, we remark that this interpolation process is completely independent for each batch and channel.
Therefore, to parallelize across multiple images and channels, we simply need to index across all batch and channel dimensions when computing s (i.e., let s = V ⊙ X
[: , : , R s , C s ] ).
C. P ADDING S TRATEGY
To handle other padding techniques (e.g., replicating the border pixels of the in-frame part of the image), our core algorithm remains completely unchanged – all that is needed is a preprocessing step that pads the input image according to the desired padding strategy, and a postprocessing step that crops the output back to the original dimensions.
We describe these steps in detail below.
Let us assume we have a batch of H × W images X , an interpolated transformation T θ , and a desired padding mode strategy by which to fill in the areas of the interpolated images with no source pixel.
First, we determine the number of pixels by which to pad the original H × W images.
To do so, we compute the meshgrid ( x g , y g ) and the inverse coordinates ( x ′ , y ′ )
as in 1 in
Algorithm 1.
Then, the amount of padding required is p = ⌈ max {| min x ′ − min x g | , | max x ′ − max x g | , | min y ′ − min y g | , | max y ′ − max y g
|}⌉ .
In other words, the padding amount is the integer just greater than the maximum distance from an x or y coordinate on the border to its inverse counterpart; this ensures that after padding, none of the central H × W pixels will have a value of zero after interpolation.
Now, we pad X on all sides by p pixels according to strategy .
This padded batch of images can then be directly fed into Algorithm 1 to obtain a batch of transformed interval images X ′ .
Finally, to obtain transformed images in the original dimensions, we take a central H × W crop of X ′ .
D A DDITIONAL E XPERIMENTAL D ETAILS D. N ETWORK A RCHITECTURES
We detail the network architecture used for each dataset below.
We express a convolutional layer as a 4-tuple of (number of filters, kernel size, stride, padding).
All layers are followed by a ReLU activation, except for the final output layer.
• MNIST: 2 conv layers of { (32 , 4 , 2 , 1) , (64 , 4 , 2 , 1) } followed by 2 linear layers with { 200 , 10 } neurons.
• CIFAR10: 3 conv layers of { (32 , 3 , 1 , 1) , (32 , 4 , 2 , 1) , (64 , 4 , 2 , 1) } followed by 2 linear layers with { 150 , 10 } neurons.
• Tiny-ImageNet: 5 conv layers of { (64 , 3 , 1 , 1) , (64 , 3 , 1 , 1) , (128 , 3 , 2 , 1) , (128 , 3 , 1 , 1) , (128 , 3 , 2 , 1) } followed by 2 linear layers with { 512 , 200 } neurons.
• Driving: 5 conv layers of { (24 , 5 , 2 , 0) , (36 , 5 , 2 , 0) , (48 , 5 , 2 , 0) , (64 , 3 , 1 , 0) , (64 , 3 , 1 , 0) } followed by 4 linear layers with { 100 , 50 , 10 , 1 } neurons.
For the Dropout network, we add a dropout layer with p = 0 .
5 after the first 3 linear layers.
D. A DDITIONAL T RAINING D ETAILS
Training Schedule.
We train the MNIST networks for 100 epochs with batch size 256, CIFAR networks for 120 epochs with batch size 128, Tiny-ImageNet networks for 160 epochs with batch size 128, and the self-driving network for 50 epochs with batch size 128.
For the classifiers, we first train with only the cross-entropy loss during a warm-up period; we warm up for 15 epochs on
MNIST and 30 epochs on CIFAR10 and Tiny-ImageNet.
For the self-driving network, we directly use Eq.
9 from the start.
In order to ensure convergence for the loss, we linearly decay κ fromto κ f = 0 .
5 and employ a linear ramp-up schedule to slowly increase the value of ν from 0 up to a final parameter size of ν f ; we ramp up across 50, 60, 80, and 50 epochs for MNIST, CIFAR10,
Tiny-ImageNet, and self-driving, respectively.
We explain how to tune the hyperparameter ν f and provide the values of ν f for each experiment in Section D.4.
Data Preprocessing and Augmentation.
For all networks, we augment the input images during training according to the set of transformations to which we want to be robust.
In addition, for
CIFAR10 and Tiny-ImageNet, we also perform random horizontal flips and select random crops of 32 × 32 with padding 4 (for CIFAR10) and random crops of 56 × 56 (for Tiny-ImageNet).
At test time, we use a central crop of 56 × 56 for Tiny-ImageNet.
For the self-driving dataset, we first crop the top of the 480 × 640 input images to 280 × 640 , then resize them with bilinear interpolation to 66 × 200 ; we also perform random horizontal flips.
For all datasets, we normalize input images according to the channel statistics from the train set immediately before the first network layer.
Optimizer.
We use the Adam optimizer (Kingma & Ba, 2015) across all networks.
For MNIST and CIFAR10, we use an initial learning rate of 10 − 3 , which we decay by 0.1 at the 80th and 100th epoch, respectively.
For Tiny-ImageNet, we use an initial learning rate of 5 × 10 − 4 , which we decay by 0.1 after 120 and 150 epochs.
For self-driving, we use an initial learning rate of 10 − 3 , which we decay by 0.1 after 20 and 40 epochs.
For all networks, we clip gradients at an ℓ 2 -norm of 8.
D. A DDITIONAL C ERTIFICATION D ETAILS
Batch Size.
We use a batch size of 10,000, 10,000, 5,000, and 3,000 during the certification of
MNIST, CIFAR10, Tiny-ImageNet, and self-driving networks, respectively.
Parameter Splits.
To ensure precise certification, we select parameter splits that are 1 − 5 × smaller in width than those used during training.
The certification configurations for each experiment can be found in Section D.4.
[Table] [Table]
P ARAMETER I NTERVAL S IZES
In Table
[Table]
we show the interval sizes of the geometric perturbation parameters that we use during training and certification for all experiments.
In the Training column, we present the final (i
[Table]
e., after ramp-up) interval size of each perturbation parameter used during training.
Since we enforce a local geometric ball of up to ± ν f in Eqs.
8 and 9, the interval size of this ball is 2 ν f (where ν f is the final parameter interval size after ramp-up, as discussed in Section D.2).
In the Certification column, we present the interval size of each split used during robustness certification.
For experiments with multiple perturbations, the ordering of the sizes corresponds with the ordering of the transformations in the Perturbations column.
We describe below the procedure to obtain the values of ν f shown in Table 4:
For a given set of n perturbations P with interval parameter ranges θ =
[ θ, θ ] , we first start with an arbitrary ν f such that ν fi < θ i − θ i for all 1 ≤ i ≤ n . 2.
Then, we uniformly sample 10 random scalar parameter values { θ k } 10 k =1 (where each θ k ∼ U ( θ, θ ) as in Eqs.
8 and 9) and compute, over all train set images X ∈ [0 , 1] N × C × H × W , the maximum pixel interval width of each image under perturbation of P with parameters
[Equation]
given X ′ i denotes the i th perturbed image in the train set.
Essentially, in this step we are converting interval sizes in parameter space to pixel space to gauge the amount of overapproximation in the computed bounds (as it is the pixel’s intervals that are ultimately propagated through the network).
Now, we calculate the average maximum pixel interval width over all images and parameter samples, obtaining ˜ M
= mean { mean M k } 10 k =1 .
We find that selecting ν f such that ˜ M is close to typical values of ϵ used in the ℓ ∞ -norm setting (e.g., 0 . 2 and 0 .
4 for MNIST, 4 / 255 and 8 / 255 for CIFAR10) yields both accurate and certifiable networks.
If ˜ M > ϵ , then we reduce ν f (hence reducing the amount of over-approximation) and recompute this step until ˜ M ≈ ϵ .
Note that this tuning requires no training , and ˜ M can be computed in under a minute for all the datasets that we consider.
Once appropriate values of ν f have been determined from step (2), we can proceed to use them in training.
We perform a 80-20 train-validation split of the train set, and use CGT to train a network to completion.
If the validation accuracy is sufficiently high, then no further tuning is required.
Else, we reduce ν f and repeat this step.
We only had to do this step a few times, as the calculation of the pixel widths already provided a good heuristic for network performance.
After determining the appropriate parameter sizes during training time, selecting the certification split sizes is straightforward.
We empirically find that selecting parameter sizes that are 2 × smaller than those used during training yields a good balance between certification rate and runtime.
If faster certification time is desired, one can use the same parameter sizes at both training and certification time (as we do in the CIFAR10 experiment with scaling, rotation, contrast, and brightness).
If higher certification rate is desired, one can use parameter sizes that are even smaller, at the cost of higher runtime (e.g., we find 5 × to be effective for Tiny-ImageNet, while using parameter sizes that are even smaller has diminishing returns and does not appreciably increase certification rate).
Table 5 shows the maximum pixel interval width during training and certification for each experiment.
Additionally, we also show the average pixel interval width (i.e., Eq.
16 with the max operation replaced by mean)
to demonstrate that geometric transformations produce highly nonuniform bounds, further motivating why supplying precise geometric bounds during training is crucial to achieving networks that are both accurate and certifiable
[Table]
E A DDITIONAL R ESULTS E. T RAINING M ETHODS
[Table]
To demonstrate the benefit of our loss function
[Table]
we compare CGT with three baseline training methods: (1) data augmentation, denoted Augment.
; (2) augmentation with PGD (Madry et al., 2018), denoted PGD+A; and (3) augmentation with IBP (Gowal et al., 2019), denoted IBP+A. We select these baselines because, to the best of our knowledge, they are the only training methods utilized in existing works on deterministic geometric robustness (as no work incorporates precise geometric regions into training as we do).
For (1), the loss function is simply the cross-entropy loss, with input images augmented according to the perturbations we are trying to certify.
For (2), we use PGD to generate adversarial examples of the augmented images.
For (3), we employ the IBP loss, with interval ϵ -balls placed around the augmented images.
[Table]
Table 6 shows these comparisons on the MNIST translation and CIFAR10 rotation benchmarks.
For the PGD and IBP-based baselines, we select ϵ = 0 .
1 and ϵ = 2 / 255 for MNIST and CIFAR10, respectively, which are commonly used in the literature (Balunovic et al., 2019; Gowal et al., 2019;
Zhang et al., 2020).
For PGD, we use a step size of 0.005 and 40 steps for MNIST and a step size of 0.002 and 7 steps for CIFAR10.
We can observe that our approach, which can supply precise bounds that correspond to the geometric perturbations we are trying to certify, is able to attain the best certified accuracy while maintaining high clean accuracy and only using slightly more time and memory per epoch compared to the other approaches.
E. E FFECT OF H YPERPARAMETER ν
As the size of the local geometric ball (controlled by ν ) is a key training hyperparameter of our loss function in Eq.
8, we conduct an ablation study on a CIFAR10 and Tiny-ImageNet network on how varying ν
f
(i.e., the final parameter interval size after ramp-up, as discussed in Section D.2) affects the certified and clean accuracies of CGT-trained networks.
Table 7 presents these results.
In addition to the original value of ν f used in our benchmarks in Sections 5.1 and 5.2 (denoted ν o ), we select four additional settings for ν f and train with CGT for each of these values.
We choose the smallest ν f to be equal to the interval size at certification time, c , and the largest ν f to be equal to c plus two times the difference between ν o and c .
We certify all networks with the original size of c .
We can observe that generally, larger values of ν f lead to increased certified accuracy, at the cost of decreased clean accuracy.
CGT thus allows one to explicitly tune the tradeoff between these metrics by varying ν f .
The notable exception to this trend is the CIFAR10 network with the largest ν f ; in this case, using a ν f that is excessively large actually decreases certified robustness (since the clean accuracy drops considerably).
There are diminishing returns to using larger intervals during training: while the certified accuracy increases significantly when using ν f = ν o compared to ν f = c , further increasing the size to ν f = ν o + g/ 2 or above only slightly increases certifiability.
E. S PEED OF I NTERVAL I NTERPOLATED T RANSFORMATION A LGORITHM
[Table]
We demonstrate why FGV is a necessary component of our framework.
Table 8 presents the comparison of Algorithm 1 to the state-of-the-art algorithm for computing interval geometric bounds in
Semantify-NN (Mohapatra et al., 2020), which is sequential and CPU-only.
To compute interval rotation bounds for a batch of training images (256 for MNIST and 128 for CIFAR10 and TinyImageNet), we are 8000-18000 × faster.
Our end-to-end speedup when combining both the input geometric perturbation bound computation and the propagation of these bounds through the network is 3000-5000 × .
These results show that without Algorithm 1, the overhead during training is too high to use our proposed loss functions.
[Table]
As an ablation study
[Table]
we run our algorithm under the same conditions as Semantify-NN’s – on the
CPU and with a batch size of 1.
As seen in Table
[Table]
our runtime is still 100-200 × faster than
Semantify-NN’s.
These results show that our speedup is not only due to the ability to leverage
GPU hardware, but also due to fundamental algorithmic improvements that the computation of interpolated transformations to be efficiently parallelized.
E. T RAINING S TATISTICS
Table 10 shows the training statistics of runtime per epoch and GPU memory usage for all of our networks.
[Table]