P ROVABLE R OBUSTNESS BY G EOMETRIC R EGULARIZATION OF R E LU N ETWORKS
Anonymous authors
Paper under double-blind review
A BSTRACT
Recent work has demonstrated that neural networks are vulnerable to small, adversarial perturbations of their input.
In this paper, we propose an efﬁcient regularization scheme inspired by convex geometry and barrier methods to improve the robustness of feedforward ReLU networks.
Since such networks are piecewise linear, they partition the input space into polyhedral regions (polytopes).
Our regularizer is designed to minimize the distance between training samples and the analytical centers of their respective polytopes so as to push points away from the boundaries.
Our regularizer provably optimizes a lower bound on the necessary adversarial perturbation required to switch an example’s label.
The addition of a second regularizer that encourages linear decision boundaries improves robustness while avoiding over-regularization of the classiﬁer.
We demonstrate the robustness of our approach with respect to (cid:96) ∞ and (cid:96) 2 adversarial perturbations on multiple datasets.
Our method is competitive with state-of-the-art algorithms for learning robust networks while involving fewer hyperparameters.
Moreover, applying our algorithm in conjunction with adversarial training boosts the robustness of classiﬁers even further.
I NTRODUCTION
Neural networks have been very successful in tasks such as image classiﬁcation and speech recognition.
However, recent work (Szegedy et al., 2014; Goodfellow et al., 2015) has demonstrated that neural networks classiﬁers can be arbitrarily fooled by small, adversarially-chosen perturbations of their inputs.
Notably, Su et al.
(2017) demonstrated that neural network classiﬁers which can correctly classify “clean” images may be vulnerable to targeted attacks , e.g., misclassify those same images when only a single pixel is changed.
Previous work demonstrating this fragility of neural network classiﬁers to adversarial noise has motivated the development of many heuristic defenses including adversarial training (Madry et al., 2018) as well as certiﬁably robust classiﬁers such as randomized smoothing (Cohen et al., 2019;
Salman et al., 2019) which characterize the robustness of a classiﬁer according to its smoothness .
The intrinsic relationship between smoothness, or Lipschitz continuity—and their corresponding local variants—and robustness has motivated a variety of techniques to encourage uniform and local smoothness through the explicit regularization of approximations of the global and local
Lipschitz constants (Zhang et al., 2018; Weng et al., 2018a;b).
Recently, Lecuyer et al.
; Li et al.
; Cohen et al.
Salman et al.
(2019) proposed and extended a simple, scalable technique—randomized smoothing—to transform arbitrary functions (e.g. neural network classiﬁers) into certiﬁably and robust classiﬁers on (cid:96) 2 perturbations.
Alternatively, previous work has also addressed adversarial robustness in the context of piecewiselinear classiﬁers (e.g., feedforward neural networks with ReLU activations).
Wong & Kolter (2018);
Jordan et al.
(2019) propose to certify the robustness of a network f at an example x by considering a bound on the radius of the maximum (cid:96) p -norm ball contained within a union of polytopes over which f predicts the same class.
Related to our work, Croce et al.
; Liu et al.
(2020) propose maximum margin regularizers (MMR) which quantiﬁes robustness of a network at a point according to the local region in which it lies and the distance to the classiﬁcation boundary.
Recent work also includes recovery and analysis of the piecewise linear function learned by an ReLU neural network during a training process (Arora et al., 2018; Mont ´ ufar et al., 2014; Croce & Hein, 2019).
Typically, work in this area centers around studying the complexity, interpretation, and improvement of stability and robustness of neural networks.
For example, Mont´ufar et al.
(2014); Serra et al. (2017) studied piecewise linear representations of neural networks and proposed the “activation proﬁle” to characterize the linear regions.
In this work, we propose a novel regularizer for feedforward piecewise-linear neural networks, including convolutional neural networks, to increase their robustness to adversarial perturbations.
Our
Geometric Regularization (GR) method is based on the fact that ReLU networks deﬁne continuous piecewise afﬁne functions and is inspired by classical techniques from convex geometry and linear programming.
We provide a novel robustness certiﬁcate based on the local polytope geometry of a point and show that our regularizer provably maximizes this certiﬁcate.
We evaluate the efﬁcacy of our method on three datasets.
Notably, our method works regardless of the perturbation model and relies on fewer hyperparameters compared with related approaches.
We demonstrate that our regularization term leads to classiﬁers that are empirically robust and are comparable to the state of the art algorithms with respect to clean and robust test accuracy under (cid:96) 1 and (cid:96) ∞ -norm adversarial perturbations.
P RELIMINARIES
In this section, we brieﬂy present background terminology pertaining to polytopes and their characterizations, adversarially robust classiﬁcation, and the polytope decomposition of the domain induced by an ReLU network and its linearization over a given polytope.
2. P IECEWISE - LINEAR NETWORKS
An ReLU network is a neural network such that all nonlinear activations are ReLU functions, where we denote the ReLU activation by σ : R → R , σ ( x ) = max { 0 , x } .
Informally, we deﬁne σ : R d → R d by σ ( x ) =
[ σ ( x 1 ) , . . .
, σ ( x d )] .
Let f : R d → [0 , 1] k be a feedforward ReLU network with L hidden layers; for example, f may map from a d -dimensional image to a k -dimensional vector corresponding to likelihoods for k classes.
Let n l be the number of hidden units at layer l , the input layer is of size n 0 = d , and let W ( l ) ∈ R n l − 1 × n l and b ( l ) ∈ R n l denote the weight matrix and bias vector at layer l , respectively.
Since f may be represented as the composition of L + 1 linear transformations and L continuous piecewise-afﬁne functions, f must necessarily be continuous and piecewise-afﬁne (for brevity, we will say piecewise-linear).
The half-space representation, or H -representation, of convex polytopes is deﬁned as follows:
Deﬁnition 2.1 (Convex polytope) .
A convex polytope K is the convex hull of ﬁnitely many points.
Alternatively, a convex polytope may be expressed as an intersection of m half-spaces.
The Hrepresentation of a polytope is deﬁned as the solution set to a system of linear inequalities Ax ≤ b :
[Equation]
Following deﬁnition 3.1 from Croce et al., a function is piecewise-linear if there exists a ﬁnite set of convex polytopes { Q r } mr =1 (referred to as linear regions of f ) such that ∪ mr =1 Q r = R d and f is afﬁne when restricted to each Q r , i.e., can be expressed on Q r as f ( x ) =
V x + a .
Given a feedforward ReLU network f and an input x ∈ R d , we intend to recover the polytope Q conditioned on x and the linear restriction of f on Q .
Therefore, we need to ﬁnd A and b such that Ax ≤ b , where A and b deﬁne the intersection of k half-spaces, i.e. a polytope , and V and a corresponding to the linearization of f within this polytope such that f ( x ) =
V x + a when restricted to Q .
We follow the formulation and notations of Croce et al..
If x ∈ R d and g (0) ( x ) = x we recursively deﬁne the pre- and post-activation output of every layer:
[Equation]
The resulting classiﬁer is then: f ( L +1)
=
W ( L +1) g
( L ) ( x ) + b ( L +1) .
By rewriting σ as an afﬁne function, we can write f ( l ) formally as a composition of afﬁne functions:
[Equation]
where we deﬁne ∆ ( l ) , Σ ( l ) ∈ R n l × n l conditioned on x and deﬁned elementwise as:
[Equation]
i
[Equation]
We now derive the polytope of f at x and the linear restriction of f on polytope Q .
By expanding the composition, we can concisely write f ( l ) ( x ) =
V ( l ) x
+ a ( l ) , where
[Equation]
and characterize the polytope Q where x lies as the intersection of N = (cid:80)
Ll =1 n l half-spaces:
[Equation]
2. P OLYTOPE CENTERS
There are various deﬁnitions of the “center” of a polytope.
Notably, the Chebyshev center of a polytope K is the center of the largest inscribed ball of K , or equivalently, the interior point of K that maximizes the minimum distance between itself and the boundary of K .
More formally,
Deﬁnition 2.2 (Chebyshev center) .
Let K be a convex polytope.
The Chebyshev center of K with respect to an (cid:96) p distance is the point x ∈ R d which satisﬁes the following min-max problem:
[Equation]
Previous work explored the Chebyshev center in the context of adversarial machine learning (Croce et al. ; Jordan et al., 2019).
For example, Croce & Hein (2019) propose to include the minimum distance to the boundary in a non-smooth regularization term in their Maximum Margin Regularizer (MMR) to encourage samples to lie close to the Chebyshev centers of their respective polytopes.
In contrast, we explore the application of an alternative polytope center: the analytic center.
The analytic center of a convex polytope K expressed via the H -representation
Ax ≤ b is canonically deﬁned as an element of K that maximizes the product of the distances to the hyperplanes characterized by the rows of A and the elements of b .
Deﬁnition 2.3 (Analytic center) .
Let K be a convex polytope expressed via the H -representation:
Ax ≤ b .
The analytic center of K is the point x ∈ R d which satisﬁes the following objectives:
[Equation]
where the second objective is canonically known as the logarithmic barrier potential (Nesterov &
Nemirovskii, 1994).
It naturally follows that when boundary-planes of the polytope are symmetric about the analytic center (e.g. for polytopes that satisfy a central symmetry property), it exactly corresponds to the Chebyshev center. A polytope K ⊂ R
d is centrally symmetric if K = −K ; that is, x ∈ K if and only if there is a unique point y such that the reﬂection of x about y is in K : 2 y − x ∈ K .
The analytic center, namely a weighted analytic center, has been extensively used in interior point (IP) methods for linear programming (Boyd & Vandenberghe, 2004).
In general, the measure of closeness [Figure] [Figure] to the analytic center is an important factor for the convergence of center-following algorithms.
The properties of the log barrier potential that make it a popular choice for interior point methods (including being twice continuously differentiable and convex) suggest we might use it as a regularizer to encourage robustness during learning.
Note, however, that the analytic center depends on how the set of particular inequalities is deﬁned.
The addition of redundant inequalities could feasibly push the analytic center arbitrarily close to the boundary of the polytope.
We discuss this further in Sec. 3.
2. R OBUST CLASSIFICATION
Consider again the network f : R d → R k , where the input might be a d -dimensional image and the output is a likelihood of that image belongs to one of k classes.
The associated classiﬁcation is then c ( x ) =
arg max i ∈ [1 ,k ] f i ( x ) .
In adversarial machine learning, we are not just concerned that the classiﬁcation be correct, but we also want to be robust against adversarial examples, i.e. small perturbations to the input which may change the output to an incorrect class.
Deﬁnition 2.4 ( (cid:15) -robust) .
f is called (cid:15) -robust with respect to norm p at x if the classiﬁcation is consistent for a small ball of radius (cid:15) around x :
[Equation]
This (cid:15) -robustness is intimately related to the uniform and local Lipschitz smoothness of f .
Recall that a function f has ﬁnite, global Lipschitz constant k > 0 with respect to norm || · || , if
[Equation]
An immediate consequence of Eq. 3 and Def.
2.3 is that if f is uniformly L -Lipschitz, then f is (cid:15) -robust at x with (cid:15) =
12 L ( P a − P b ) where P a is the likelihood of the most likely outcome, and P b is the likelihood of the second most likely outcome (Salman et al., 2019).
The piecewise linearity of
ReLU networks facilitates the extension of this consequence to the locally Lipschitz regime such that for case 1 of Fig.
1, L corresponds to the norm of the afﬁne map characterized by f conditioned on an input x .
Local smoothness is a property exhibited by provably and empirically robust networks.
In Fig 2, the adversarially trained neural network is smoother compared to the vanilla network (larger linear regions with linear functions that have smaller slope and smoother transitions—“corner points”—between linear functions).
In conjunction with smoothness, adversarial training also results in coarser partitions, i.e. larger polytopes, in contrast to vanilla networks.
It is reasonable to assume that both of these properties are desirable in the context of robust classiﬁcation.
In the case of piecewise linear networks, the lower-bound on the robustness of a network at a point given its associated polytope may be described with respect to two cases presented in Fig. 1(a)-(b).
In case 1, the point may be closer to the boundary of its polytope compared to the decision boundary, and vica-versa for case 2.
It follows that for case 1, the distance to the polytope boundary is a lower bound on the robustness of the network at that point.
Croce et al.
propose to optimize this certiﬁcate exactly, and we propose to optimize a relaxed version presented in the next section.
G EOMETRIC R EGULARIZATION 3. A NALYTIC C ENTER R EGULARIZER (ACR)
We propose to adopt the logarithmic barrier potential as a regularizer to encourage points be near their analytical centers.
We deﬁne the analytic center regularization (ACR) as
[Equation]
where V and a are computed for network f given an input x via Eq.
(1), and row-normalized.
In related work, Croce et al.;
Liu et al.
both propose variants to the vanilla MMR formulation which involve regularizing a summation over the distances to the k nearest boundary hyperplanes as opposed to only the distance to the nearest plane.
This extension aims to ensure that the input is far from the boundary of the polytope.
However, in addition to tuning this number, both methods employ a warm-up scheme to gradually increase the number of hyperplanes considered.
In contrast, by regularizing the distance to the analytic center, ACR natively inherits the desirable properties of MMR while taking into account all hyperplanes comprising the boundary and involving no additional hyperparameters.
We note that many assumptions made regarding the analytic center rely on the polytope P being minimally represented (e.g. the uniqueness of the analytic center).
To elucidate this concept, we deﬁne redundant hyperplanes:
Deﬁnition 3.1 (Redundant hyperplanes) .
Let P :=
{ x | Ax ≤ b } be a polytope comprised of m constraints and i ∈ [ m ] .
a i x ≤ b is a redundant constraint , or a redundant hyperplane , if it can be removed from the system without changing P , and irredundant otherwise.
If all constraints in
Ax ≤ b are irredundant, then the system is irredundant , and redundant otherwise.
In other words, the H -representation of a polytope is not unique.
In fact, there are inﬁnitely many
H -representations of a polytope, but only one minimal representation.
It is well-known that the inclusion of redundant hyperplanes may signiﬁcantly affect the location of the analytic center.
Lemma 3.1 (Boyd & Vandenberghe (2004)) .
Let P :=
{ x | Ax ≤ b } be an H -representation of a polytope.
The inclusion of redundant hyperplanes can make any interior point the analytic center.
To address this, we propose a masked variant of the ACR term which ensures that only boundary hyperplanes of P are included in the objective.
However, recovering an irredundant H -representation is nontrivial.
We apply an approximate method which leverages the primal-dual equivalence between the half-space intersection problem and the convex hull problem.
Details are provided in Appendix E.
In practice, we found that the application of ACR to all constraints (i.e. without removing redundant constraints) performs as well or better than than the masked variant in addition to having lower computational overhead.
We hypothesize that this is due to the composite nature of neural networks and the fact that the output of the network f is dependant on all hyperplanes—not just irredundant hyperplanes—and that ignoring redundant hyperplanes during regularization may adversely affect learning.
Additional justiﬁcation for inclusion of the redundant constraints when evaluating GR can be found in Fig. 11 where we see that the network trained with GR exhibits a more even and symmetric distribution of hyperplanes compared to other networks.
3. L INEAR D ECISION B OUNDARY R EGULARIZER (LDR)
Recent work (Moosavi-Dezfooli et al., 2019; Qin et al., 2019) has demonstrated that regularizing the curvature of the loss corresponds to regularizing the curvature of the decision boundary, thus improving robustness.
Speciﬁcally, Moosavi-Dezfooli et al.
; Qin et al.
(2019) respectively provide a tight certiﬁcate that is linear in the maximum eigenvalue of the Hessian of the loss with respect to the input and an upper bound on the adversarial loss.
However, the regularization schemes proposed suffer drawbacks.
Namely, both methods require the careful setting of a parameter which characterizes the local approximation of the Hessian and Qin et al.
(2019) requires multiple iterations per training iteration.
We exploit the intrinsic manifold structure of the data to encourage the loss to behave linearly around data via the following regularization term:
[Equation]
In general, we cannot compute this integral because M is not known analytically.
Belkin et al.
Belkin & Niyogi (2008) propose the following discrete approximation that converges to the integral in the sample limit:
[Equation]
where N b is the minibatch size.
Note that the contents of batches are randomized each epoch.
The application of regularizers based on the graph Laplacian have also been explored in the past (Mishne et al., 2019), including in the context of adversarial robustness (Jin & Rinard, 2020).
However, we propose to apply manifold regularization to the gradient of the loss instead of the weights of classiﬁer.
In the case of piecewise linear networks, this regularizer may be interpreted as reducing the angle between adjacent linear restrictions of f .
Such sharp angles are known to facilitate brittleness in the presence of adversarial noise (Roth et al., 2019).
3. G EOMETRIC REGULARIZATION OF R E LU NETWORKS
Following the deﬁnitions above, we propose the following objective for adversarially robust training
[Equation]
where (cid:96) ( x ) is an arbitrary classiﬁcation loss and λ A and λ L are hyper-parameters to be optimized.
We note that, given an input x , a forward pass through f is sufﬁcient to compute both the linearization of f around x and the associated region (the polytope).
Given these entries, optimizing the regularization term corresponds to solving a smooth, unconstrained convex problem - which can be done very efﬁciently using gradient descent.
Analogous to adversarial training, LDR requires computation of ∇ x (cid:96) ( x ) – performed via backpropagation.
However, the gradients are computed only once per batch as opposed to iteratively as in adversarial training-based methods.
3. G EOMETRIC R OBUSTNESS G UARANTEES FOR R E LU NETWORKS
We show that GR provably optimizes a lower bound on the radius of robustness.
Given an input x and network f , let d B ( x ) be the distance from x to the boundary of its polytope and let d D ( x ) be the distance from x to the decision boundary deﬁned by f .
To recover robustness guarantees when d B ( x ) ≤ d D ( x ) , and demonstrate that GR optimizes a lower bound on the robustness, we rely on the Dikin Ellipsoid (DE), deﬁned by the Hessian of the logarithmic barrier function (Nesterov &
Nemirovskii, 1994).
Deﬁnition 3.2 (Dikin ellipsoid) .
The Dikin ellipsoid of radius r of a polytope K expressed by Ax ≤ b centered at ˆ x is deﬁned as the set: E r (ˆ x )
= { x | ( x − ˆ x ) T H (ˆ x )( x − ˆ x ) ≤ r } , where H is the Hessian of the log-barrier function deﬁned to be H =
A T S − 2 A with s ij = (cid:26) a i x − b i i =
j otherwise.
Notably, the Hessian of the logarithmic barrier function and the Dikin ellipsoid describe well the local geometry of K at x in the following sense (we refer to Nesterov & Nemirovskii (1994) for details and proofs): (1) the Dikin ellipsoid is contained inside K : E 1 ( x ) ⊆
K for any x ∈ K . The
Hessian of the log-barrier changes slowly with respect to its local norm; while exploding to inﬁnity at the boundary of K . In other words, the gradient of the logarithmic barrier function at points near the boundary of K is dominated by a component with direction perpendicular to the boundary and pointing towards the interior of K .
The volume of the Dikin ellipsoid is guaranteed to be at leastm V ol ( K ) where m is the number of hyperplanes comprising the boundary of K .
An example of an analytic center and its Dikin ellipse are given in Figure 1c.
The properties of the Dikin ellipsoid imply that it may be used to construct a certiﬁcate at x by taking the length of the shortest semi-axis of the ellipsoid.
In particular, the length of the minor axis of the
Dikin ellipsoid at x may serve as a uniform lower-bound on the radius of robustness, and optimizing
Eq.
4 provably improves this radius.
More concretely, we get the following robustness guarantees:
Theorem 1 (ACR Robustness guarantee for ReLU networks) .
If d B ( x ) ≤ d D ( x ) , then f is locally robust at x with radius (cid:15) = 1 / √ λ max where λ max is the maximum eigenvalue of the Hessian matrix (and 1 / √ λ max is the length of the minor axis of the Dikin ellipsoid) of the log-barrier potential function (maximized when J ACR is minimized).
If d B ( x ) ≥ d D ( x ) , let g = ∇ L x ( x ) .
Then, for some constant c , the radius (cid:15) = c || g
|| − 2 νc 2 || g ||where ν is the maximum eigenvalue of the Hessian of L ( D ) (maximized as J LDR is minimized).
Note that i -th axis of the ellipse described by the quadratic form x T
Ax = r , corresponds to the i -th eigenvector of A with length 1 √ λ i . As previously stated, we propose to use the length of the shortest minor sub-axis as a certiﬁcate of robustness. We call this certiﬁcate the Dikin certiﬁcate . The proof that the Dikin certiﬁcate is a lower bound on the radius of robustness is given in the appendix, and relies on the following property and lemma which directly follow from the deﬁnitions of the Dikin ellipsoid and the analytic center.
Property 3.1.
Let K be a convex polytope. Let x be an interior point of K and let E x be the Dikin ellipse deﬁned at x . Then E x ⊆ K . Lemma 3.2.
Let K be a centrally symmetric convex polytope, and let H be the Hessian of the logarithmic barrier function deﬁned on an irreducible H -representation of K . Then, x ac = x cheb and λ max ( H ( x ac )) ≤ λ max ( H ( x )) ∀ x ∈ K . In other words, the point that satisﬁes the largest radius of robustness with respect to the Dikin certiﬁcate is exactly the analytic center.
We provide a variety of experiments to demonstrate the performance of GR. We evaluate GR on three datasets: MNIST (LeCun & Cortes, 2010), Fashion MNIST (Xiao et al., 2017), and CIFAR- (Krizhevsky et al.).
We consider robustness with respect to both (cid:96) 2 and (cid:96) ∞ distances.
We use three criteria: upper and lower bounds on the robust test error for a given threshold (cid:15) and the mean lower bound on the pointwise radius of robustness.
Lower bounds on the robust test error for (cid:96) 2 and (cid:96) ∞ are computed using the attack via Projected Gradient Descent (PGD) (Madry et al., 2018).
Upper bounds and robust radii are computed using Wong & Kolter (2018).
We report our results in Table 1.
We compare seven methods: plain training, adversarial training (AT) of (Madry et al., 2018), the robust loss of (Wong & Kolter, 2018) (KW), the MMR and MMR + [Table] We evaluate each approach using the CNN architecture described in Table 3 and utilize the PGD (cid:96) ∞ attach with (cid:15) = 0 . 1 for MNIST and (cid:15)
{+= 
+}
for CIFAR10. MNIST CIFAR TE
LB
TE
LB
GR (this work) 2.
LLR 1.
TULIP 2.
TRADES ( β = 1 ) 0.
CURE 1.
with adversarial training scheme (Croce et al.)
, and our approach (GR) with and without adversarial training.
All schemes are evaluated on a one hidden layer fully connected network with 1024 hidden units (FC1) and a convolutional network (CNN) with 2 convolutional and 2 dense layers.
Note that unlike other reported results which ﬁne-tune their defense to each attack type, we demonstrate empirical robustness against multiple perturbation types by training one model per architecture and dataset and report its robustness against different attack types.
Additional details are in the Appendix.
On MNIST, we outperform or match MMR’s clean test error and lower-bound robust accuracy performance with respect to both (cid:96) 2 and (cid:96) ∞ -norm perturbations.
With respect to robust accuracy, we note that although the GR certiﬁcate is a lower bound on the MMR certiﬁcate, we closely match
MMR’s KW-based average certiﬁed radius.
On F-MNIST and CIFAR10, we again match MMR with respect to clean test error and empirical robust accuracy and certiﬁable radius.
We emphasize that
Croce et al.
perform grid search on model parameters for each dataset and perturbation, while our performance is based on a single model trained per-dataset.
We compare our approach to state-of-the-art ﬁrst and second-order regularizers in Table 2.
Details of these algorithms are provided in the appendix.
We note that TRADES and AT remain the state-of-theart heuristic methods, while GR performs competitively with other provable methods that encourage local linearity of the loss.
We note that these methods (i.e. LLR, TULIP, and CURE) necessitate
[Figure]
[Figure]
iterating or sampling around each training example to compute their regularization terms and, and thus require additional overhead and setting hyperparameters governing their sampling procedures.
As mentioned before, the GR certiﬁcate is a lower bound on the certiﬁcate proposed by Croce et al.
which is a lower-bound on the radius of robustness.
We present the empirical differences in point-wise certiﬁed radii in Fig.
For networks that are adversarially trained or regularized with GR, the distribution of point-wise radii of robustness is close.
In contrast, the distributions are signiﬁcantly different for vanilla networks and networks trained with MMR.
The implication is that for certain networks and inputs, the Dikin ellipsoid may not optimally characterize the polytopes, in particular, if the H -representation of a polytope exhibits redundancy concentrated on one side, or if the polytope is poorly conditioned in the sense that H is poorly conditioned ( K is geometrically “elongated”). 4. R OBUSTNESS TO G RADIENT O BFUSCATION Athalye et al. Qin et al.
(2019) demonstrated that empirical robustness of neural networks may often be due to the effect of gradient obfuscation—i.e. the network learns to fool ﬁrst-order attacks by contorting the loss surface. Although this non-linearity of the loss surface may cause networks to appear to exhibit robustness to adversarial attacks, Athalye et al. (2018) further demonstrated that merely running PGD for more iterations reliably produces adversarial perturbations. In contrast, networks that exhibit robustness while being close to locally linear exhibit “true” robustness to adversarial attacks.
In Fig 4, we demonstrate that our regularizer produces models that exhibit such robustness to gradient obfuscation.
We plot local regions of the loss surface near the decision boundary for various networks and show that training with GR leads to a smooth loss in the region of samples near the decision boundary, replicating the effect of adversarial training, while the local loss surface exhibited by networks trained with MMR leads to highly non-linear loss surfaces.
C ONCLUSION
We have introduced a method based on leveraging the geometry of piecewise-linear neural networks for training classiﬁers that are provably robust to norm-bounded adversarial attacks.
Our approach is based on the notion that piecewise-linear classiﬁers with large linear regions and smoother decision boundaries are robust.
We demonstrate that our method learns robust networks that exhibit properties typical to robust networks and perform competitively with current state-of-the art methods, including related, geometrically-motivated techniques.
By exploiting the geometry of the network and data, our method relies on fewer hyperparameters compared to related approaches.
Furthermore, our method is scalable and leads to models which are simultaneously robust to multiple perturbation models. A P RELIMINARIES
Let Ax ≤ b be an irreducible, afﬁne matrix inequality characterizing a polytope in R d where
A ∈ R m × n , x ∈ R n and b ∈ R n .
We denote the feasible set characterizing the polytope by K :
[Equation] Without loss of generality, let the rows of A be normalized under any (cid:96) p norm. Then, the (cid:96) p distance between any interior point x of K to the i -th plane on the boundary of K is nothing but d i ( x ) = a Ti x − b i .
For completeness, we restate the curvature-based certiﬁcate of Moosavi-Dezfooli et al.
(2019) below.
Theorem 2 (Moosavi-Dezfooli et al.
Let (cid:96) ( x ) denote the loss of a neural network f evaluated at x , and let r ∗ be be the minimal perturbation necessary to fool the classiﬁer.
Let H be the Hessian matrix of (cid:96) ( x ) , H =
[Equation]
∂x j ∈ R d × d .
Then, || r ∗ || is the radius of robustness of f at x with respect to the second order Taylor expansion of (cid:96) at x :
[Equation]
for a threshold t .
Let x be such that c := t − (cid:96) ( x ) ≥ 0 , and let g = ∇ (cid:96) ( x ) .
Assume that ν := λ max and let u be the eigenvector corresponding to ν .
Then, we have
[Equation]
The above bounds can be further simpliﬁed to:
[Equation]
B P ROOFS B. T HE D IKIN ELLIPSOID OF RADIUS 1 IS CONTAINED WITHIN K . (B OYD & V ANDENBERGHE , 2004)
Let E x denote the Dikin ellipse of radius 1 at x ∈ K .
Note that since x ∈ K , d i ( x ) ≥ 0 ∀ i .
Let y ∈
E x .
Additionally, let H be the Hessian of the logarithmic barrier function at a feasible point x : [Equation] otherwise* The statement can be proven by showing that y ∈ K (i.e. y is feasible).
Equivalently, we will show that d i ( y ) ≥ 0 ∀ i . ( y − x [Equation]
H [Equation] x ) [Equation]
y − x ) ≤ 1 by deﬁnition = ⇒ m (cid:88) i = (cid:104) a i , y − x (cid:105)d 2 i ≤= ⇒ (cid:104) a
i , y − x (cid:105)d i ( x )≤ 1 ∀ i since all entries in the summation are nonnegative = ⇒ (cid:18) d i ( x ) − d i ( y )
d i ( x ) (cid:19)≤ 1 ∀ i = ⇒ (cid:12)(cid:12)(cid:12)(cid:12) 1 − d i ( y ) d i ( x ) (cid:12)(cid:12)(cid:12)(cid:12) ≤ 1 ∀ i Hence, for all i , 0 ≤ d i ( y ) d
i ( x ) , so d i ( y ) ≥ 0 ∀ i , and y ∈ K . [Equation]
Recall the problem of recovering the Analytic center deﬁned in Eq 4:
[Equation] For brevity, let F = (cid:81) mi =1 d i ( x ) . Then the problem may be concisely written as
[Equation]
We will show that for any convex polytope K satisfying a central symmetry property (for example, zonotopes ), that the maximizer of this problem is precisely a unique origin of the polytope.
By deﬁnition, for centrally symmetric polytopes, for any constraint a Ti x ≤ b there is a corresponding constraint a Ti x ≤ − b , and there exists a unique interior point x c such that if x ∈ K , its inversion with respect to x c is also in K : ¯ x ∈ K where ¯ x = 2 x c − x .
We call this point x c , the origin of K .
A simple consequence of this deﬁnition is that x c lies at the midpoint of the line x ¯ x .
It follows that if x i is the minimum-distance projection from x onto boundary plane i , and if ¯ x i lies on plane j , then d i =
d j .
The lemma is a simple consequence of this deﬁnition.
For any perturbation applied to x c , let (cid:15) i > 0 be the variation in the (cid:96) p distance associated with the perturbation to boundary plane i .
By the linearity of the boundary planes, the variation in the (cid:96) p distance suffered by the inverse boundary plane of boundary plane i is − (cid:15) i .
[Equation] so arg max x ∈K F ( x ) = x c , and x ac = x c . Accordingly, x c also corresponds to the Chebyshev center.
Note that we can restate the deﬁnition of the Chebyshev center using the above notation: [Equation] Again, for any perturbation to x c , we have that [Equation]
so the solution to Eq.
10 is the origin of K , and x ac = x cheb .
Finally, let H be the Hessian of the logarithmic barrier function at a feasible point x :
[Equation]
Then, for any interior point x , it follows that [Equation] B. T HEOREMP ROOF OF (1) First, note that if d B ( x ) ≤ d D ( x ) , then the predicted class of x does not change for ball of radius d B ( x ) around x — B p ( x, d B ( x )) .
Let E x be the Dikin ellipsoid at x characterized by H ( x ) ,
the
Hessian of the logarithmic barrier potential evaluated at x .
Let r i be the length of i -th shortest sub-axis of E x .
By deﬁnition, [Equation] where λ i is the i -th largest eigenvalue of H ( x ) .
Since E x ⊆ K x , the polytope in which x lies, by Property 3.1, it follows that [Equation] where λ max is the largest eigenvalue of H ( x ) and 1 √ λ max is a lower bound on the minimal (cid:96) p -norm perturbation necessary to change the class.
Note that if d D ( x ) ≤ d B ( x ) , then the Dikin certiﬁcate is not a sufﬁcient lower-bound on the radius of robustness r ∗ , however, the bound of Theorem 2 holds globally: [Equation] where c is a loss-dependant constant, g = ∇ (cid:96) ( x ) , and ν = λ max .
C M AIN E XPERIMENTS
[Table]
[Table]
We abbreviate one hidden layer fully connected network with 1024 hidden units with FC1.
The convolutional architecture that we use is identical to that of Wong & Kolter (2018); Croce et al.
—consisting of two convolutional layers with 16 and 32 ﬁlters of size 4 × 4 and stride 2 , followed by a fully connected layer with 100 hidden units.
For all experiments we use batch size
and we train the models for 100 epochs.
Moreover, we use Adam optimizer (Kingma & Ba, 2015) with the default learning rate 0 .
On MNIST and F-MNIST we restrict the input to be in the range [0 , 1] .
On the CIFAR-10 dataset, following Croce et al.
, we apply random crops and random mirroring of the images as data augmentation.
We also apply a warm-up training schedule for both regularization weights where we linearly increase them from λ /10 to λ during the ﬁrst 10 epochs.
For each dataset and architecture, we perform a grid search over the regularization weights.
All the reported models and the ﬁnal set of hyperparameters will be made available on acceptance.
In order to make a comparison to the robust training of Croce et al.
Wong & Kolter (2018) we take their publicly available models.
We perform adversarial training using the PGD attack of Madry et al.
(2018) with a random selection of 50% clean and 50% adversarial examples in every batch.
For the (cid:96) 2 -norm, we used the implementation from Rauber et al.
(2017) to perform PGD-based (cid:96) 2 attacks.
We use the same (cid:96) 2 -bound on the perturbation as the (cid:15) used in robust error.
During training, we perform 40 iterations of the PGD attack for MNIST and F-MNIST, and 7 for CIFAR-10.
During evaluation, we use 40 iterations for all datasets.
Following Croce et al.
, the step size is selected as (cid:15) divided by the number of iterations and multiplied by 2 . C. D ETAILS OF STATE - OF - THE - ART METHODS
We use publicly available implementation for all methods.
We denote L ( D ) =
E D [ (cid:96) ( x ) + R ( x )] to be the objective (e.g. as in Eq.
We brieﬂy describe how each technique we compare to in Tableformulates the R ( x ) term below:
Gradient Regularization (TULIP) (Finlay & Oberman, 2019). The Gradient Regularization term of Finlay & Oberman (2019) is formulated as a norm on the gradient of the loss function with respect to the input: [Equation] Locally-Linear Regularization (LLR) (Qin et al., 2019).
Qin et al.
(2019) propose to regularize the local linearity of the classiﬁer:
[Equation]
where γ ( (cid:15), x ) = max δ ∈ B ( x,(cid:15) ) g ( f, δ, x ) and g ( f, δ, x ) = | (cid:96) ( x + δ ) − (cid:96) ( x ) − δ ∇ x (cid:96) ( x ) |
Locally-Lipschitz Regularization (TRADES) (Zhang et al., 2019).
Trades is the current empirical state of the art and is motivated by the relationship between robustness and local Lipschitzness.
[Equation]
Curvature Regularization (CURE) (Moosavi-Dezfooli et al., 2019)
Propose to regularize the curvature of the loss with respect to the input:
[Equation]
Note that H is estimated through iterative approximation by computing ﬁnite differences.
D A DDITIONAL E XPERIMENTS D. V ISUALIZING THE EFFECTS OF REGULARIZATION
We explore the geometry of polytopes.
In Fig.
5, we overlay histograms corresponding to the radii of
Dikin ellipsoids of samples pre- and post-robust training.
It is clear that robust training increases the size of polytopes, agreeing with the intuition of the GR certiﬁcate.
In Fig.
6 we visualize the decision boundary for different values of λ L via Eq.
As expected, we see that as this weight is increased, the network imposes higher cost on the local loss curvature resulting in a linearization of the decision boundary and lower overall conﬁdence in predictions over the domain.
However, something unusual happens when λ L exceeds a threshold: the network exhibits uncertainty uniformly over the domain, and both clean and adversarial test accuracy drop signiﬁcantly.
In Table 4, we highlight the importance of both parts of the regularization, i) penalization of the distance to boundary of the polytope ii) penalizing the curvature of decision boundaries across polytopes via ablative experiments.
We train FC1 on MNIST using the each component of the regularization scheme.
We clearly see that lower bounds on robustness computed using PGD is always signiﬁcantly better when both terms are used.
In order to achieve the best empirical performance, it is necessary to both increase the distance of the points to the boundaries of the polytope and regularize the curvature of the decision boundary between polytopes.
[Figure] [Figure] [Figure]
networks noise analytic centers of polytopes by robust networks are clearly interpretable and
D. A NALYSIS OF ELLIPSOIDS AND ANALYTIC CENTERS
The geometry of the partitioning and the associated polytopes induced by an ReLU network is not obvious.
Intuitively, we would like the partitions to be semantically reasonable, i.e. cleanly partition the domain into class-regions.
However, this is not the case as implied by the existence of adversarial examples.
An immediate consequence of the GR certiﬁcate is that we expect “realistic” examples to lie far from the boundary of their respective polytopes.
We encourage this via the J ACR regularizer.
[Figure] [Figure] As a consequence after training a robust network we expect the true analytic centers of a given polytope to be semantically interpretable and close to “real” samples.
We demonstrate that this is the case in Figure 8.
First, note that the ACs of polytopes produced by a vanilla network are entirely noisy.
We hypothesize (Fig. 5) that partitions converge early in training and that the linear functions on each partition are the focus of the majority of training.
As a consequence, the content of polytopes for non-robust networks are near-random.
It is clear that the analytic centers of robust network polytopes are more interpretable (Fig. 5).
D. V ISUALIZING THE STRUCTURE OF ROBUST MODELS
We demonstrate several properties of networks trained with robust regularization terms.
We train a single hidden layer feed forward ReLU network on the Two Moons dataset.
The decision boundaries are presented in Fig.
We estimate decision boundaries by plotting
[Equation]
where L ( x ) =
e x (cid:80) k ∈
[ K ] e x and y are the logits of f evaluated at x .
In other words, r ( x ) directly corresponds to the second term of the Lipschitz robustness bound of f at x .
We ﬁrst note in Fig.
10 that MMR and GR preserve the decision boundary learned by the vanilla network for the most [Figure] [Figure] part, however, the network trained via adversarial training has over-regularized, resulting in a suboptimal classiﬁer.
Interestingly, the regularizer we propose does exhibit a signiﬁcant gap between the most likely and second most likely class likelihoods this is a desirable property with respect to the GR robustness guarantee.
We also notice that the network trained with GR exhibits less uniform smoothness compared to the other regularizers as seen in Fig.
MMR and adversarial training appear to over-regularize the network by imposing smoothness uniformly over the domain.
In Figures 11 and 12 we demonstrate that the network trained with GR exhibits spatial smoothness in contrast to the MMR term, i.e. neighboring points exhibit similar regularization loss.
We hypothesize that this may partially provide evidence for (1) the empirical reduction in the number of linear partitions and increases their size (Fig. 5) such that more points are co-located within the interior of the same polytope and (2) smoother optimization.
In Fig.
9 we visualize the local smoothness of robust and non-robust networks.
We uniformly sample points from the 2- d cube and approximate the stochastic local Lipschitz constant of f by computing the following term: [Equation]
[Equation]
where δ i ∼ U (0 ,(cid:15) ] .
Note that for large values of L around a point x , f exhibits local instability, and potentially brittleness with respect to adversarial perturbations of x .
In conjunction with Fig 10, we see that GR along with AT and MMR exhibits behavioral properties that are typical of robust networks (e.g. local smoothness and conﬁdence).
We also plot visualizations of layer-weights for a fully connected network It is well-known that structured neuron weights lead to more robust networks (Allen-Zhu & Li, 2020).
However it has only been recently deeply explored in the context of adversarial machine learning (Allen-Zhu & Li, 2020).
We demonstrate that networks trained with GR exhibit this property of encouraging neurons to learn structured features.
E E FFICIENT PRUNING OF REDUNDANT POLYTOPE REPRESENTATIONS
To remedy the issue of redundant representations of polytopes, we propose the following maskedversion of ACR:
[Equation]
where Ω is the index-set of irredundant hyperplanes.
To compute Ω , we leverage the primal-dual equivalence between half-plane intersections and convex hulls and adopt the approximate convex-hull algorithm of Sartipizadeh & Vincent (2016) to prune redundant hyperplanes.
Given a ﬁnite set of points S = { x 1 , . . .
, x N } where each x i ∈ R d , Sartipizadeh & Vincent (2016) propose to iteratively build an estimate of an (cid:15) -approximate convex hull (denoted by E ) by selecting a point to add to E such that the maximum over all projections from S \ E to E is minimized (i.e. is an extreme point of S ), where the projection length from a point x to E is computed by solving the following quadratic program:
[Equation]
instead of exactly solving this problem, Sartipizadeh & Vincent (2016) propose to select points that are (cid:15) -close to the convex hull - i.e. by requiring that max v ∈ S d ( v, E ) ≤ (cid:15) .
In summary, at iteration t the algorithm selects x t to add to E according to the following decision rule:
[Equation]
Note that we are not guaranteed uniqueness, in that there may be multiple E with the same number of elements, satisfying the distance requirements.
However, as (cid:15) increases, the size of a minimal representation, E , may decrease.
Notably, the above algorithm runs in time independent-of the dimension: O ( K 3 / 2 N 2 log K(cid:15) ) for N points in dimension d , and where K is the number of iterations.
Additionally, it is provably correct, i.e. after the algorithm terminates the set E is guaranteed to be an (cid:15) -approximate convex hull of S where an (cid:15) -approximate convex hull is deﬁned to be:
Deﬁnition E.1 ( (cid:15) -approximate convex hull) .
An (cid:15) -approximate convex hull of S is the convex hull of a minimal subset E ⊆ S such that ∀ z ∈ S , d
( z, S ) ≤ (cid:15) .