O N THE C ONVERGENCE OF C ERTIFIED R OBUST T RAINING WITH I NTERVAL B OUND P ROPAGATION
*Equal contribution
A BSTRACT
Interval Bound Propagation (IBP) is so far the base of state-of-the-art methods for training neural networks with certiﬁable robustness guarantees when potential adversarial perturbations present, while the convergence of IBP training remains unknown in existing literature.
In this paper, we present a theoretical analysis on the convergence of IBP training.
With an overparameterized assumption, we analyze the convergence of IBP robust training.
We show that when we use IBP training to train a randomly initialized two-layer ReLU neural network with logistic loss, gradient descent can converge to zero robust training error with a linear convergence rate with a high probability if we have sufﬁciently small perturbation radius and large network width.
I NTRODUCTION
It has been shown that deep neural networks are vulnerable against adversarial examples (Szegedy et al., 2014; Goodfellow et al., 2015), where a human imperceptible adversarial perturbation can easily alter the prediction by neural networks.
This poses concerns to safety-critical applications such as autonomous vehicles, healthcare or ﬁnance systems.
To combat adversarial examples, many defense mechanisms have been proposed in the past few years (Kurakin et al., 2016;
Madry et al., 2018; Zhang et al., 2019; Guo et al., 2018; Song et al., 2018; Xiao et al., 2020).
However, due to the lack of reliable measurement on adversarial robustness, many defense methods are later broken by stronger attacks (Carlini & Wagner, 2017; Athalye et al., 2018; Tramer et al., 2020).
There are recently a line of robust training works, known as certiﬁed robust training (certiﬁed defense) , focusing on training neural networks with certiﬁed and provable robustness – the network is considered robust on an example if and only if the prediction is provably correct for any perturbation in a predeﬁned set (e.g., a small (cid:96) ∞ ball)
(Wang et al., 2018b; Bunel et al., 2018; Zhang et al., 2018; Wang et al., 2018c; Wong & Kolter, 2018; Singh et al., 2018; 2019; Weng et al., 2018; Xu et al., 2020).
Certiﬁed defense methods provide provable robustness guarantees without referring to any speciﬁc attack and thus do not rely on the strength of attack algorithms.
To obtain a neural network with certiﬁed robustness, a common practice is to derive a neural network veriﬁcation method that computes the upper and lower bounds of output neurons given an input region under perturbation, and then train the model by optimizing the loss deﬁned on the worstcase output from veriﬁcation w.r.t. any possible perturbation.
Many methods along this line have been proposed (Wong & Kolter, 2018;
Wong et al., 2018; Mirman et al., 2018; Gowal et al., 2018; Raghunathan et al., 2018a; Zhang et al., 2020a).
Among these methods, Interval Bound Propagation (IBP) (Mirman et al., 2018; Gowal et al., 2018) is a simple but effective and efﬁcient method so far, which propagates the interval bounds of each neuron through the network to obtain the output bounds of the network.
Most of the latest state-of-the-art certiﬁed defense works are at least partly based on IBP training (Zhang et al., 2020a; Shi et al., 2021;
Lyu et al., 2021; Zhang et al., 2021).
However, the convergence properties of IBP training remained unknown.
For standard neural network training (without considering adversarial perturbation, aka natural training), it has been shown that gradient descent for overparameterized networks can provably converge to a global minimizer with random initialization (Li & Liang, 2018; Du et al., 2019b;a; Jacot et al., 2018; Allen-Zhu et al., 2019; Zou et al., 2018).
Compared to standard training, IBP-based robust training has a very different training scheme which requires a different convergence analysis.
First, in the robust training problem, input can contain perturbations and is not a certain one, with a different training objective for robustness.
Second, IBP training essentially optimizes a different network augmented with IBP computation illustrated in Zhang et al.
(2020a).
Third, in IBP training, the activation state of each neuron depends on the certiﬁed bounds rather than the values in standard neural network computation, which introduces special perturbation-related terms in our analysis.
In this paper, we conduct a theoretical analysis to study the convergence of IBP training.
Following recent convergence analysis on Stochastic Gradient Descent (SGD) for standard training, we consider IBP robust training with gradient ﬂow (gradient descent with inﬁnitesimal step size) for a two-layer overparameterized neural network on a classiﬁcation task.
We summarize our contributions below:
• We provide the ﬁrst convergence analysis for IBP-based certiﬁed robust training.
On a two-layer overparameterized ReLU network with logistic loss, with sufﬁciently small perturbation radius and large network width, gradient ﬂow with IBP has a linear convergence rate, and is guaranteed to converge to zero training error with high probability.
• This result also implies that IBP converges to a state where the certiﬁed robust accuracy measured by IBP bounds tightly reﬂects the true robustness of the network.
• We show additional perturbation-related conditions required to guarantee the convergence of IBP training so far, and identify particular challenges in the convergence analysis for IBP training compared to standard training.
Notation We use lowercase letters to denote scalars, and use lower and upper case boldface letters to denote vectors and matrices respectively.
1 ( · ) stand for the indicator function. For a ddimensional vector x ∈ R d , (cid:107) x (cid:107) p is its (cid:96) p -norm. For two sequences { a n } and { b n } , n > 0 , we have a n = O ( b n ) if and only if ∃ C > 0 , ∃ N > 0 , ∀ n > N , a n ≤ Cb n , . And we have a n = Ω( b n ) if and only if ∃ C > 0 , ∃ N > 0 , ∀ n > N , a n ≥ Cb n .
R ELATED W ORK 2. C ERTIFIED R OBUST T RAINING
The goal of certiﬁed robust training is to maximize the robust accuracy of the model under the evaluation by provable robustness veriﬁers.
Some works added heuristic regularizations during adversarial training to improve certiﬁed robustness (Xiao et al., 2019; Balunovic & Vechev, 2020).
More effectively, certiﬁed defense works typically optimize a certiﬁed robust loss which is a certiﬁed upper bound of the loss w.r.t. all considered perturbations.
Among them, Wong & Kolter (2018); Mirman et al.
; Dvijotham et al.
; Wong et al.
; Wang et al.
(2018a) used veriﬁcation with linear relaxation for nonlinear activations, and Raghunathan et al.
(2018b) used semi-deﬁnite relaxation.
However, IBP (Mirman et al., 2018; Gowal et al., 2018), which computes and propagates interval lower and bounds for each neuron, has been shown as efﬁcient and effective and can even outperform methods using more complicated relaxation (Lee et al., 2021; Jovanovi´c et al., 2021).
At least partly based on IBP, Zhang et al.
(2020a)
combined IBP with linear relaxation bounds; Lyu et al.
(2021) designed a parameterized activation; Zhang et al.
(2021) designed a 1-Lipschitz layer with (cid:96) ∞ -norm computation before layers using IBP; Shi et al.
(2021) accelerated IBP training with shortened training schedules.
As most state-of-the-art methods so far contain IBP as an important part, we focus on analyzing the convergence of IBP training in this paper.
On the theoretical analysis for IBP bounds, Baader et al.
(2020) analyzed the universal approximation of IBP veriﬁcation bounds, and Wang et al.
(2020) extended the analysis to other activation functions beyond ReLU.
However, to the best of our knowledge, there is still no existing work analyzing the convergence of IBP training.
The aforementioned methods for certiﬁed robustness target at robustness with deterministic certiﬁcation.
There are also some other works on probabilistic certiﬁcation such as randomized smoothing (Cohen et al., 2019;
Li et al., 2019;
Salman et al., 2019) which is out of our scope.
2. C ONVERGENCE OF S TANDARD N EURAL N ETWORK T RAINING
There have been many works analyzing the convergence of standard neural network trainings For randomly initialized two-layer ReLU networks with quadratic loss, Du et al.
(2019b) proved that gradient descent can converge to a globally optimum with a large enough network width polynomial in the data size.
Ji & Telgarsky (2019) pushed the requirement of network width to a polylogarithmic function.
For deep neural networks, Allen-Zhu et al.
(2019) proved that for deep ReLU networks, gradient descent has a linear convergence rate for various loss functions with width polynomial in network depth and data size.
And Chen et al.
(2019) proved that a polylogarithmic width is also sufﬁcient for deep neural networks to converge.
However, they only focus on standard training and cannot be directly adapted to the robust training settings.
2. C ONVERGENCE OF E MPIRICAL A DVERSARIAL T RAINING
Robust training is essentially a min-max optimization.
For a training data distribution X , the objective for learning a model f θ parameterized by θ can be written as 1 :
[Equation]
where ( x , y ) is a sample, (cid:96) ( · , y ) is the loss function, S is the space of perturbations.
Empirical adversarial training approximates the inner minimization by adversarial attacks, and some works analyzed the convergence of adversarial training:
Wang et al.
(2019) considered a ﬁrst-order stationary condition for the inner maximization problem; Gao et al.
; Zhang et al.
(2020b) showed that overparameterized networks with projected gradient descent can converge to a state with robust loss close to 0 and the the inner maximization by adversarial attack is nearly optimal; and Zou et al.
(2021) showed that adversarial training provably learns robust halfspaces in the presence of noise.
However, there is a signiﬁcant difference between empirical adversarial training and IBP training.
In adversarial training, there is a concrete perturbation ∆ for the inner maximization, and there is a concrete adversarial input x + ∆ .
However, in IBP-based training, the inner maximization is computed from certiﬁed bounds, where for each layer, the certiﬁed bounds of each neuron are computed independently, and thereby the certiﬁed bounds of the network generally do not correspond to any speciﬁc ∆ .
Due to this signiﬁcant difference, prior theoretical analysis on adversarial training, which required there to be a concrete ∆ for inner maximization, is not applicable to IBP.
P RELIMINARIES 3. N EURAL N ETWORKS
Following Du et al.
(2019b), we consider a similar two-layer ReLU network.
Unlike Du et al.
(2019b) which considered a regression task with the square loss, we consider a classiﬁcation task where IBP is usually used, and we consider binary classiﬁcation for simplicity.
On a training dataset { ( x i , y i ) } ni =1 , for every i ∈ [ n ] , ( x i , y i ) is a training example with d -dimensional input x i ( x i ∈ R d ) and label y i
( y i ∈{± 1 } ) , and the network output is:
[Equation]
where m is the width of hidden layer (the ﬁrst layer) in the network, W ∈ R m × d is the weight matrix of the hidden layer, w r ( r ∈ [ m ]) is the r -th row of W , a ∈ R m is the weight vector of the second layer (output layer) with elements a 1 , · · · , a m , and σ ( · ) is the activation function.
We assume the activation is ReLU as IBP is typically used with ReLU.
For initialization, we set a r ∼ unif [ { 1 , − 1 } ] and w r ∼ N (0 , I ) .
Only the ﬁrst layer is trained after initialization.
Since we consider binary classiﬁcation, we use a logistic loss.
For training example ( x i , y i ) , we deﬁne u
i ( W , a , x i ) :
=
y i f
( W , a , x i ) , and then the loss for this example is computed as l ( u i ( W , a , x i ))
=
log(1 + exp( − u
i ( W , a , x i ))) , and the standard training loss on the whole training set is
[Equation]
3. C ERTIFIED R OBUST T RAINING
In the robust training setting, for original input x i ( ∀ i ∈ [ n ] ), we consider that the actual input may be perturbed into x i + ∆ i by perturbation ∆ i .
For a widely adopted setting, we consider (cid:96) ∞ perturbations, where ∆ i is bounded by an (cid:96) ∞ ball with radius (cid:15) (0 ≤ (cid:15) ≤ 1) , i.e., (cid:107) ∆ i (cid:107) ∞ ≤ (cid:15) .
For the convenience of subsequent analysis and without loss of generality, we set the following assumption on each x i , which can be easily satisﬁed by normalizing the training data:
Assumption 1.
∀ i ∈
[ n ] , we assume there exists some ξ > 0 , such that x i ∈
[ (cid:15), 1] d , (cid:107) x
i (cid:107) 2 ≥ ξ .
In Du et al.
(2019b), they also assume there are no parallel data points, and in our case we assume this holds under any possible perturbation, formulated as:
Assumption 2.
For perturbation radius (cid:15) , we assume that
[Equation]
where B ∞ ( x i , (cid:15) ) stands for the (cid:96) ∞ -ball with radius (cid:15) centered at x i .
IBP training computes and optimizes a robust loss L , which is an upper bound of the standard loss for any possible perturbation ∆ i ( ∀ i ∈ [ n ]) :
[Equation]
To compute L , since log( · ) and exp( · ) are both monotonic, for every i ∈ [ n ] , IBP ﬁrst computes the lower bound of u i ( W , a ,
x i + ∆ i ) for (cid:107) ∆ i (cid:107) ∞ ≤ (cid:15) , denoted as u i .
Then the IBP robust loss is:
[Equation]
where u i ≤ min ∆ i u i ( W , a , x i + ∆ i ) ( i ∈ [ n ]) .
[Equation]
IBP computes and propagates an interval lower and upper bound for each neuron in the network, and then u i is equivalent to the lower bound of the ﬁnal output neuron.
Initially, the interval bound of the input is [ x i − (cid:15) · 1 , x + (cid:15) · 1 ] given (cid:107) ∆ i (cid:107) ∞ ≤ (cid:15) , since x i − (cid:15) · 1 ≤ x i + ∆ i ≤ x i + (cid:15) ·element-wisely holds.
Then this interval bound is propagated to the ﬁrst hidden layer, and we have the interval bound for each neuron in the ﬁrst layer:
[Equation]
These bounds are further propagated to the second layer.
We focus on the lower bound of u i , which can be computed from the bounds of the ﬁrst layer by considering the sign of multiplier y i a r :
[Equation]
Then the IBP robust loss can be obtained as Eq.
And we deﬁne u :=
( u 1 , u 2 , · · · , u n ) .
We deﬁne a certiﬁed robust accuracy in IBP training, which is the percentage of examples that IBP bounds can successfully certify that the prediction is correct for any concerned perturbation.
For example i ( i ∈ [ n ]) , it is considered as robustly classiﬁed under IBP veriﬁcation, if and only if u i > 0 .
Let ˜ u
i be the exact solution of the minimization in Eq.
(2) rather than relaxed IBP bounds, we also deﬁne a true robust accuracy , where the robustness requires ˜ u i > 0 .
The certiﬁed robust accuracy by IBP is a provable lower bound of the true robust accuracy.
3. G RADIENT F LOW
Gradient ﬂow is gradient descent with inﬁnitesimal step size for a continuous time analysis, and it is adopted in prior works analyzing standard training (Arora et al., 2018; Du et al., 2019a;b). We also adopt gradient ﬂow, and in IBP training, gradient ﬂow is deﬁned as:
[Equation]
where w 1 ( t ) , w 2 ( t ) , · · · , w m ( t ) are rows of the weight matrix at time t , and L ( t ) is the IBP robust loss deﬁned as Eq.
(2) using weights at time t .
3. G RAM M ATRIX
Under the gradient ﬂow setting as Eq.
(4), for all i ∈ [ n ] , we analyze the dynamics of u i during IBP training, and we use u i ( t ) to denote the value at time t :
[Equation]
where l (cid:48) ( u j ) is the derivative of the loss, H ( t ) is a Gram matrix and deﬁned as H ij ( t )
= (cid:80)
[Equation]
( ∀ 1 ≤ i, j ≤ n ) . We provide a detailed derivation in Appendix B.1.
The dynamic of u i can be described using H .
From Eq.
(3), ∀ i ∈ [ n ] , r ∈ [ m ] , derivative ∂u i ( t ) ∂ w r ( t ) can be computed as follows:
[Equation]
where sign( w r ( t )) is element-wise for w r ( t )
[Equation]
and we deﬁne indicators
[Equation]
Then elements in H can be written as:
[Equation]
where α rij ( t ) , β rij ( t ) , γ rij ( t ) are deﬁned as follows
[Equation]
Further, we deﬁne H ∞ which is the elementwise expectation of H (0) , to characterize H (0) on the random initialization basis:
[Equation]
where H ij (0) depends on the initialization of weights w r and a r .
We also deﬁne λ 0 :=
λ min ( H ∞ ) as the least eigenvalue of H ∞ .
We will prove that H (0) is positive deﬁnite with high probability, by showing that H ∞ is positive deﬁnite and bounding the difference between H (0) and H ∞ .
C ONVERGENCE A NALYSIS FOR IBP T RAINING
We present the following main theorem which shows the convergence of IBP training under certain conditions on perturbation radius and network width:
Theorem 1 (Convergence of IBP Training) .
Suppose Assumptions 1 and 2 hold for the training data, and the (cid:96) ∞ perturbation radius satisﬁes (cid:15) ≤ O [Equation]
(cid:19)(cid:19) , where R = [Equation] [Equation]
For a two-layer ReLU network (Eq.
, suppose its width for the ﬁrst hidden layer satisﬁes m [Equation] (cid:18)(cid:16)
[Equation]
, and the network is randomly initialized as a r ∼ unif [ { 1 , − 1 } ] , w r ∼ N (0 , I ) , with the second layer ﬁxed during training.
Then for any conﬁdence δ (0 <δ< 1) , with probability at least 1 − δ , IBP training with gradient ﬂow can converge to zero training error.
The theorem contains two folds: First, for a given (cid:15) , as long as it satisﬁes the upper bound on (cid:15) speciﬁed in the theorem, with a sufﬁciently large width m , convergence of IBP training is guaranteed with high probability; Second, when (cid:15) is larger than the upper bound, IBP training is not guaranteed to converge under our analysis even with arbitrarily large m , which is essentially different from analysis on standard training and implies a possible limitation of IBP training.
In the following part of this section, we provide the proof sketch for the main theorem.
4. S TABILITY OF THE G RAM M ATRIX DURING IBP T RAINING
We ﬁrst analyze the stability of H during training, since H can characterize the dynamic of the training as deﬁned in Eq.
We show that when there exists some R such that the change of w r ( ∀ r ∈ [ m ]) is restricted to (cid:107) w r ( t ) − w r (0) (cid:107) 2 ≤ R during training, we can guarantee that λ min ( H ( t )) remains positive with high probability.
This property will be later used to reach the conclusion on the convergence.
We defer the derivation for the constraint on R to a later part.
For all r ∈ [ m ] , with the aforementioned constraint on w r ( t ) , we ﬁrst show that during the IBP training, most of α rij ( t ) , β rij ( t ) , γ rij ( t ) terms in Eq.
(6) remain the same as their initialized values ( t = 0 ).
This is because for for each of α rij ( t ) , β rij ( t ) , γ rij ( t ) , the probability that its value changes during training can be upper bounded by a polynomial in R , and thereby the probability can be made sufﬁciently small for a sufﬁciently small R , as the following lemma shows:
Lemma 1.
∀ r ∈ [ m ] , at some time t > 0 , suppose (cid:107) w r ( t ) − w r (0) (cid:107) 2 ≤ R holds for some R , and (cid:15) ≤ √ 2 dR log( √ 2 πdR ξ ) holds, then for all 1 ≤ i, j ≤ n , we have
[Equation]
We provide the full proof in Appendix A.1.
Probabilities in Lemma 1 can be bounded as long as the probability that each of indicator A + ri ( t ) , A − ri ( t ) , A + rj ( t ) , A − rj ( t ) changes is upper bounded respectively.
When the change of w r ( t ) is bounded, the indicators can change during the training only if at initialization | w r (0) (cid:62) x i ± (cid:15) (cid:107) w r (0) (cid:107) 1 | is sufﬁciently small, whose probability can be upper bounded (notation ± here means the analysis is consistent for both + and − cases).
To bound this probability, while Du et al.
(2019b) simply used the anti-concentration of standard Gaussian distribution in their standard training setting, here our analysis is different due to additional perturbation-related terms (cid:15) (cid:107) w r (0) (cid:107) 1 , and we combine anti-concentration and the tail bound of standard Gaussian in our proof.
Then we can then bound the change of the Gram matrix, i.e., (cid:107) H ( t ) − H (0) (cid:107) 2 :
Lemma 2.
∀ r ∈ [ m ] , at some time t > 0 , suppose (cid:107) w r ( t ) − w r (0) (cid:107) 2 ≤ R holds for some constant
R , for any conﬁdence δ (0 < δ < 1) , with probability at least 1 − δ , it holds that
[Equation]
It can be proved by ﬁrst upper bound E [ | H ij ( t ) − H ij (0) | ] ( ∀ 1 ≤ i, j ≤ n ) , using Lemma 1, and then by Markov’s inequality, we can upper bound (cid:107) H ( t ) − H (0) (cid:107) 2 with high probability.
We provide the proof in Appendix A.2.
And by triangle inequality, we can also lower bound λ min ( H ( t )) :
Corollary 1.
∀ r ∈ [ m ] , at some time t > 0 , suppose (cid:107) w r ( t ) − w r (0) (cid:107) 2 ≤ R holds for some constant R , for any conﬁdence δ (0 < δ < 1) , with probability at least 1 − δ , it holds that
[Equation]
where λ min ( · ) stands for the minimum eigenvalue.
We also need to lower bound λ min ( H (0)) to lower bound λ min ( H ( t )) .
Given Assumption 2, we show that the minimum eigenvalue of H ∞ is positive:
Lemma 3.
When the dataset satisﬁes Assumption 2, λ 0 :
= λ min ( H ∞ ) > 0 holds true.
The lemma can be similarly proved as Theorem 3.1 in Du et al.
(2019b),
but we have a different
Assumption 2 considering perturbations.
We discuss in more detail in Appendix A.3.
Then we can lower bound λ min ( H (0)) by Lemma 3.1 from Du et al.
(2019b):
Lemma 4 (Lemma 3.1 from Du et al. (2019b)) .
If λ 0 > 0 , for any conﬁdence δ (0 < δ < 1) , take m = Ω( n 2 λ 20 log( nδ )) , then with probability at least 1 − δ , it holds true that λ min ( H (0)) ≥ 34 λ 0 .
Although we have different values in H (0) for IBP training, we can still adopt their original lemma because their proof by Hoeffding’s inequality is general regardless of values in H (0) .
We then plug in λ min ( H (0)) ≥ 34 λ 0 to Eq. (8), and we solve the inequality to ﬁnd a proper R such that λ min ( H )( t ) ≥ λ 0 2 , as shown in the following lemma (proved in Appendix A.4):
Lemma 5.
For any conﬁdence δ (0 < δ < 1) , ∀ r ∈ [ m ] , suppose (cid:107) w r ( t ) − w r (0) (cid:107) 2 ≤ R holds, where R = cδλ 0 d 1 . 5 n 2 with c = √ 2 πξ 384 , then probability at least 1 − δ , λ min ( H ( t )) ≥ λ 0 2 holds.
Therefore, we have shown that with overparameterization (required by Lemma 4), when w r is relatively stable during training for all r ∈ [ m ] , i.e., the maximum change on w r ( t ) is upper bounded during training (characterized by the (cid:96) 2 -norm of weight change restricted by R ), H ( t ) is also relatively stable and remains positive deﬁnite with high probability.
4. C ONVERGENCE OF THE IBP R OBUST L OSS
Next, we can derive the upper bound of the IBP loss during training.
In the following lemma, we show that when H ( t ) remains positive deﬁnite, the IBP loss L ( t ) descends in a linear convergence rate, and meanwhile we have an upper bound on the change of w r ( t ) w.r.t.
time t :
Lemma 6.
Suppose for 0 ≤ s ≤ t , λ min ( H ( t )) ≥ λ 0 2 , we have
[Equation]
(cid:18)
[Equation]
0) (cid:19)
[Equation]
[Equation]
(cid:18) −
[Equation]
[Equation]
This lemma is proved in Appendix A.5, which follows the proof of Lemma 5.4 in Zou et al.
To guarantee that λ min ( H ( s )) ≥ λ 0 2 for 0 ≤ s ≤ t , by Lemma 5, we only require nt √ m ≤ R = cδλ 0 d 1 . 5 n 2 , which holds sufﬁciently by
[Equation]
Meanwhile, for each example i , the model can be certiﬁed by IBP on example i with any (cid:96) ∞ perturbation within radius (cid:15) , if and only if u i > 0 , and this condition is equivalent to l ( u i ) <
κ , where κ :=
log(1 + exp(0)) .
Therefore, to reach zero training error on the whole training set at time t , we can require L ( t ) < κ , which implies that ∀ 1 ≤ i ≤ n, l ( u i ) < κ .
Then with Lemma 6, we want the upper bound of L ( t ) to be less than κ :
[Equation]
which holds sufﬁciently by
[Equation]
To make Eq.
(10) reachable at some t , with the constraint in Eq.
(9) we require:
[Equation]
The left-hand-side of Eq.
(11) can be upper bounded by
[Equation]
Therefore, in order to have Eq.
(11) hold, it sufﬁces to have
[Equation]
where c (cid:48) :
= c 8 and c 0 are positive constants.
Since L (0) has randomness from the randomly initialized weight W , we need to upper bound the value of L (0) as we show in the following lemma (proved in Appendix A.6 by concentration):
Lemma 7.
In natural training, for any conﬁdence δ (0 < δ < 1) , with probability at least 1 − δ ,
L (0) =
O ( nδ ) holds.
In IBP training, for any conﬁdence δ (0 < δ < 1) , with probability at least 1 − δ , L (0) =
O ( n √ md(cid:15)δ [Equation] holds
[Equation]
And this lemma implies that with large n and m , there exist constants c 1 , c 2 , c
3 such that
[Equation]
Plug Eq.
(13) into Eq.
(12), then the requirement in Eq.
(12) can be relaxed into:
[Equation]
where c 4 :
=
c 3 + c 0 is a constant.
As long as Eq.
(14) holds, Eq.
(11) also holds, and thereby IBP training is guaranteed to converge to zero IBP robust error on the training set.
4. P ROVING THE M AIN T HEOREM
Finally, we are ready to prove the main theorem.
To make Eq.
(11) satisﬁed, we want to make its relaxed version, Eq.
(14) hold by sufﬁciently enlarging m .
This requires that the coefﬁcient of √ m in Eq.
(14) , c (cid:48) δλ 20 d 1 .
5 n 3 − c 1 nd(cid:15)δ to be positive, and we also plug in the constraint on (cid:15) in Lemma 1:
[Equation]
Combining this two constraints, we can obtain the constraint for (cid:15) in the main theorem:
[Equation]
Then by Eq.
(14), our requirement on width m is
[Equation]
This completes the proof of the main theorem.s
In our analysis, we focus on IBP training with (cid:15) > 0 .
But IBP with (cid:15) = 0 can also be viewed as standard training.
By setting (cid:15) = 0 , if m ≥ Ω( n 8 d 3 λ 40 δ 4 ) , our result implies that for any conﬁdence δ (0 < δ < 1) , standard training with logistic loss also converges to zero training error with probability at least 1 − δ .
And as (cid:15) gets larger, the required m for convergence also becomes larger. [Figure]
E XPERIMENTS
We further conduct experiments to compare the convergence of networks with different width m for natural training and IBP training respectively.
We use the MNIST (LeCun et al., 2010) dataset and take digit images with label 2 and 5 for binary classiﬁcation.
And we use a two-layer fullyconnected ReLU network with a variable width.
We train the model for 70 epochs with SGD, and we keep (cid:15) ﬁxed throughout the whole training process.
We present results in Figure 1.
First, compared with standard training, for the same width m , IBP has higher training errors (Figure 1a).
Second, for relatively large (cid:15) ( (cid:15) = 0 . 04 ), even if we enlarge m up to 80,000 limited by the memory of a single GeForce RTX 2080 GPU, IBP error is still far away from 0 (Figure 1a).
This is consistent to our main theorem that when (cid:15) is too large, simply enlarging m cannot guarantee the convergence.
Moreover, when (cid:15) is even larger, IBP training falls into a local minima of random guess (with errors close to 50% ) (Figure 1b).
We conjecture that this is partly because λ 0 can be very small with a large perturbation, and then the training can be much more difﬁcult, and this difﬁculty cannot be alleviated by simply enlarging the network width m . Existing works using IBP-based training typically use a scheduling on (cid:15) and gradually increase (cid:15) from 0 until the target value for more stable training.
Overall, the empirical observations match our theoretical results.
C ONCLUSION
In this paper, we present the ﬁrst theoretical analysis of IBP-based certiﬁed robust training, and we show that IBP training can converge to zero training error with high probability, under certain conditions on perturbation radius and network width.
Meanwhile, since the IBP robust accuracy is a lower bound of the true robust accuracy (see Section 3.2), upon convergence the true robust accuracy also converges to 100% on training data and the certiﬁcation by IBP accurately reﬂects the true robustness.
Our results have a condition requiring a small upper bound on (cid:15) , and it will be interesting for future work to study how to relax this condition, take the effect of (cid:15) scheduling into consideration, and extend the analysis to deeper networks.
A CKNOWLEDGEMENTS
We thank the anonymous reviewers for their helpful comments.
This work is partially supported by NSF under IIS-2008173, IIS-2048280 and by Army Research Laboratory under agreement number W911NF-20-2-0158; QG is partially supported by the National Science Foundation CAREER
Award 1906169 and IIS-2008981. The views and conclusions contained in this paper are those of the authors and should not be interpreted as representing any funding agencies.
A P ROOF OF L EMMAS A. P ROOF OF L EMMA
Proof.
For all i ∈ [ n ] , r ∈ [ m ] , we ﬁrst consider the change of indicator 1 ( w r ( t ) (cid:62) x i ± (cid:15) (cid:107) w r ( t ) (cid:107) 1 > 0) during training compared to the value at t =
(the notation ± here means the analysis is consistent for both + and − cases).
Under the constraint that (cid:107) w r ( t ) ± w r (0) (cid:107) 2 ≤ R
and (cid:107) x
i (cid:107) ∞ ∈ [0 , 1] d , we have (see Appendix B.2 for details):
[Equation]
Thereby, if sign( w r ( t )
[Equation]
= sign
[Equation]
[Equation]
w [Equation]
[Equation]
1 ) , then at initialization, we must have
[Equation]
We want to upper bound the probability that Eq.
(16) holds.
It is easy to show that if the following two inequalities hold, then Eq.
(16) does not hold for sure:
[Equation]
Therefore,
[Equation]
For Eq.
(17), by anti-concentration inequality for Gaussian
[Equation]
we have
[Equation]
In other words
[Equation]
with probability at least 1 − 4(1 + (cid:15) ) √ dR/ ( √ 2 πξ ) , Eq.
(17) holds.
And for Eq.
(18), by the tail bound of standard Gaussian and union bound
[Equation]
we have
[Equation]
Combining Eq.
(19) and Eq.
(20), Eq.
(16) holds with at most the following probability
[Equation]
Here we require (cid:15) to be sufﬁciently small such that
[Equation]
[Equation]
and we can solve the inequality to obtain an upper bound for (cid:15) (detailed in Appendix B.3):
[Equation] [Equation]
and in this case Eq.
(21) holds with probability at least
[Equation]
Therefore, we upper bound the probability:
[Equation]
Thereby
[Equation]
Note that at least one of A + ri ( t ) and A − ri ( t ) always remains zero during training, because condition y i a r = 1 in A + ri ( t ) and condition y i a r = − 1 in A − ri ( t ) are mutually exclusive.
Then
[Equation]
Next we can upper bound the probability that each of α rij ( t ) , β rij ( t ) , γ rij ( t ) ( ∀ [Equation] , j ∈ [ n
[Equation]
, r ∈ [ m [Equation] changes respectively:
[Equation]
A. P ROOF OF L EMMA
Proof.
With Lemma 1, we can bound the expectation of the change for each element in H ( t ) (Eq.
(6)) as:
[Equation]
i
[Equation]
j ∈ [ n ]) Then by Markov’s inequality, we have that with probability at least 1 − δ , (cid:107) H ( t ) − H (0) (cid:107) 2 ≤ (cid:88) i ∈ [ n ] ,j ∈ [ n ]
[Equation]
R.
A. P ROOF OF L EMMA
Proof.
First for simplicity, we deﬁne ρ i = − A
+ ri (0) + A − ri (0) ( ρ i ∈ {− 1 , 0 , 1 } ) , and φ ( x i )( w r (0)) =
y i (cid:16) x i + (cid:15)ρ i sign( w r (0) (cid:17) 1 (cid:18) w r (0) (cid:62) (cid:16) x
i + (cid:15)ρ i sign( w r (0)) (cid:17) > 0 (cid:19) .
To prove that λ 0 > 0 , similar as Theorem 3.1 in Du et al. (2019b), we need to prove that for any r ∈ [ m ] , if η 1 , η 2 , ..., η n ( ∀ i ∈ [ n ] , η i ∈ R ) satisfy (cid:80) ni
=1 η i φ ( x i )( w r (0))
=
almost everywhere (a.e.) for any w r (0) , we have ∀ i ∈ [ n ] , η i = 0 .
In Theorem 3.1 in Du et al. (2019b), it is proved that for φ (cid:48)
( x i )( w ) =
x i 1 ( w (cid:62) x i ) ( i ∈ [ n ]) , when ∀ i (cid:54) = j, x i ∦ x j holds, for any η 1 , η 2 , ..., η n ( ∀ i ∈ [ n ] , η i ∈ R ) , if n (cid:88) i = η i φ (cid:48) ( x i )( w r (0))
= 0 , then ∀ i ∈ [ n ] , η i = 0 . For any r ∈ [ m ] , by taking ∀ i ∈ [ n ] , x (cid:48) i = x i + (cid:15)ρ i sign( w r (0)) , we have φ ( x i )( w r (0))
=
φ (cid:48)
( x (cid:48) i )( w r (0)) , and it holds that x (cid:48) i ∈ B ∞ ( x i , (cid:15) ) , x (cid:48)
j ∈ B ∞ ( x j , (cid:15) ) . Then if x i ∦ x j , ∀ i, j , η 1 , η 2 , ..., η n satisfy (cid:80) ni =1 η i φ (cid:48) ( x (cid:48) i )( w r (0))
{+= 
+}
a.e., we have ∀ i ∈ [ n ] , η i = 0 . Therefore if ∀ i, j ∈ [ n ] , i (cid:54) = j, ∀ x (cid:48) i ∈ B ∞ ( x i , (cid:15) ) , ∀ x (cid:48) j ∈ B ∞ ( x j , (cid:15) ) , x (cid:48)
i ∦ x (cid:48)
j , if η 1 , ..., η n satisfy (cid:88) i η i φ ( x i )( w r (0)) = 0 , then (cid:88) i η i φ (cid:48)
( x (cid:48) i )( w r (0))
=also holds, and then ∀ i ∈ [ n ] , η i = 0 .
A. P ROOF OF L EMMA
Proof.
The lemma can be proved by solving inequality
[Equation]
According to Lemma 4, λ min ( H (0)) ≥ 34 λ 0 .
And with Eq.
(8), in order to ensure λ min ( H ( t )) ≥ λ 0 2 , we can make
[Equation]
This yields
[Equation]
Note that 0 ≤ (cid:15) ≤ 1 , and thus 1 + (cid:15) ≤ 2 and 1 + 2 (cid:15) + (cid:15) 2 ≤ 4 can be upper bounded by constants respectively.
Then we can take
[Equation]
where c = √ 2 πξ 384 , and in this case λ min ( H ( t )) ≥ λ 0 2 w.p.
at least 1 − δ probability.
A. P ROOF OF L EMMA
Proof.
The proof of this lemma is inspired by the proof of Lemma 5.4 in Zou et al.
In our proof, we deﬁne f ( x ) =
( f ( x 1 ) , f ( x 2 ) , ..., f ( x n )) , where f ( x ) is a scalar function and x is a vector of length n .
When λ min ( H )( s ) ≥ λ 0 2 holds for 0 ≤ s ≤ t , we can bound the derivative of L ( t ) : dL ( u ) dt = n (cid:88) [Table] =
[Table]
l (cid:48) ( u i ) ∂u i ∂t = − n
[Table]
=
[Table]
l (cid:48) [Table] u i ) n [Table]
j = [Table] l [Table]
u j ) H
[Table]
= − [Table] u ) [Table]
H
[Table]
( u ) ( i ) ≤ [Table] λ n
[Table]
=
[Table]
( u
[Table] [Table]
( ii ) ≤ λ n (cid:88)
[Table]
=
[Table]
l
[Table] ( u [Table]
) ( iii ) ≤ − λ [Table] n [Table]
= [Table]
min(
[Table]
[Table]
[Table]
[Table] ) ( iv ) ≤ − λ2 min (cid:18) [Table] / 2 , n
[Table] = [Table]
l ( u i ) (cid:19)
[Equation]
[Equation]
where (i) is due to λ min ( H ) ≥ λ 0 , (ii) is due to − l (cid:48) ( u ) ≤ 1 , (iii) holds due to the following property of cross entropy loss − l (cid:48)
( u ) ≥ min(1 / 2 , l ( u ) 2 ) , (iv) holds due to the function min(1 / 2 , x ) is a concave function and Jenson’s inequality, (v) holds due to min( a, b ) ≥ 1
/a +1 /b
Therefore, we have
[Equation]
By integration on both sides from 0 to t , we have
[Equation]
u ( t ))
(cid:19) − log (cid:18) L ( u (0)) (cid:19) ≤ − λ 0 t 4 .
Therefore, we have log (cid:18)
L ( u ( t )) (cid:19) ≤ − λ 0 t 4 + L ( u (0)) + log (cid:18) L ( u (0))
(cid:19) , which yields
L ( u ( t )) ≤ exp (cid:18) − λ 0 t (cid:19) exp (cid:18) L ( u (0)) (cid:19) L ( u (0)) .
And we can bound the change of w r .
[Equation]
where σ (cid:48) ( · ) stands for the derivative of the ReLU activation.
Thus
[Equation]
A. P ROOF OF L EMMA
Proof.
We ﬁrst prove the standard training part.
As we have deﬁned previously that
[Equation]
where
[Equation]
For each a r σ ( w r (0) (cid:62) x i ) , r ∈ [ m ] , i ∈ [ n ] , note that the randomness only comes from random initialization for w r , there is 12 possibility that it is equal to 0, and another 12 possibility that it follows a normal distribution N (0 , σ 2 i ) , where σ i = (cid:107) x i (cid:107) 22 .
Therefore, we have
[Equation]
Therefore, by Chebyshev’s inequality, we can bound
[Equation]
And we can bound L (0) =
O ( n max ni = [Equation] 2 i 2 δ )
=
O ( nδ ) with probability at least 1 − δ .
For IBP training, u i (
[Equation]
= 1 √
m m (cid:88)
[Equation]
=
[Equation]
w
[Equation]
[Equation]
(cid:107) 1 (cid:1) .
Thus |
[Equation]
By E ( (cid:107) w r (cid:107) 1 ) =
O ( d ) and Markov’s inequality, with probability at least 1 − δ , | u
i (0) − u i (0) | ≤ O ( √ md(cid:15) δ ) .
And we can bound L (0) =
O ( n √ md(cid:15) δ + n δ ) with probability at least 1 − δ .
B D ETAILED D ERIVATION FOR O THER E QUATIONS OR I NEQUALITIES B. D ERIVATION ON THE D YNAMICS OF u i ( t )
We provide a detailed derivation on the dynamics of u i ( t ) presented in Eq.
(5), which we use H i ( t ) to describe ddt u i ( t ) :
[Equation]
B. D ERIVATION FOR E Q . (15)
Eq.
(15) basically comes by triangle inequality:
[Equation]
B. D ERIVATION FOR E Q . (23)
We solve the inequality in Eq.
(22) to derive an upper bound for (cid:15) in Eq.
[Equation]
and then we can require log
[Equation]